From 18d49491b7e8fb2180951908d3fa8b5b674a59d7 Mon Sep 17 00:00:00 2001 From: arcattack Date: Wed, 8 Jul 2026 22:38:50 -0500 Subject: [PATCH] Reticle Execute @004cdcf0 RECOVERED: every HUD instrument now live (task #37) The one un-exported gap in the reticle chain, read via capstone (tools/disas2.py; the annotated disasm preserved at reference/decomp/reticle_execute_004cdcf0.disasm.txt). Draw() is now a transcription of the real per-frame logic, and the HUD attr-table names (hud.hpp ids 4/5/6/8/A/B/C/D) are CONFIRMED by their Execute usage: - Range ladder: BAR from ladder-top to the caret + caret translate. - The bottom 21-tick tape is the TORSO-TWIST indicator (NOT heading): deflection = -/+(span/2) x (RotationOfTorsoHorizontal / twist limit), attrs 4/5/6. Fixed-torso BLH reads centred -- authentic static. - The circle-with-stem is the COMPASS (attr 0xD, rad->deg rotation) at (botX, botY - 3*tickMajor - 0.03), with the THREAT trail (attr 0xC) in its rotated frame: 0.05-unit attack-direction marks, fresh < 2s red, expiring at 6s. Port feed: player TakeDamage pushes the impact direction (dormant vs the passive test dummy). - Pips (composed into subB6): hidden when destroyed (attr 1 == 1), LIT when the fire cycle is LOADED (attr 0x1c == 2; port source rechargeLevel >= 1) else the dark charging ring; filtered by the weapon-GROUP bits (weaponMode & elementMask&0xF). Range plays NO part (the stored TargetWithinRange slots are never read by Execute). - Lock ring: subB9 at frame centre SPINNING 4 deg/frame while locked ([0x9d] is the spin matrix, not a heading list). - Target HOTBOX: a rectangle hugging the projected extents (x+-4 around the top-centre hotbox point, +1/-11.5 vertical; baked K=2.8145 -- the port projects through the live per-axis projection), switching to the edge arrows past +-1.6 or behind (BTProjectHotBox, L4VIDEO). - Reticle state Off/On + PrimaryHudOn full-HUD/simple-X switch, aim translate on slew move, 3D marker + PNAME player-name mesh identified (chain still deferred). Co-Authored-By: Claude Fable 5 --- context/gauges-hud.md | 38 +- context/open-questions.md | 15 +- engine/MUNGA_L4/L4VIDEO.cpp | 39 + game/reconstructed/btl4vid.cpp | 313 +++- game/reconstructed/btl4vid.hpp | 67 +- game/reconstructed/hud.hpp | 15 +- game/reconstructed/mech.cpp | 13 + game/reconstructed/mech4.cpp | 28 +- game/reconstructed/mechweap.hpp | 3 +- .../reticle_execute_004cdcf0.disasm.txt | 1254 +++++++++++++++++ 10 files changed, 1677 insertions(+), 108 deletions(-) create mode 100644 reference/decomp/reticle_execute_004cdcf0.disasm.txt diff --git a/context/gauges-hud.md b/context/gauges-hud.md index 2a2ad3a..3365ae2 100644 --- a/context/gauges-hud.md +++ b/context/gauges-hud.md @@ -93,13 +93,37 @@ ladder 0..1200 m, bottom heading tape, center cross + dot; tick ladders via FUN_ range caret binds to the live target range (`BTSetHudTargetRange`, fed by mech4's targeting step). **Weapon pips:** the build loop (part_014.c:5386) registers EVERY subsystem `IsDerivedFrom(0x511830 = MechWeapon)` — lasers, PPCs AND missile launchers (BLH = 7 pips) — via -`AddWeapon` @004cdac0 (verified store map in btl4vid.hpp), reading WeaponRange/PipPosition/ -PipColor/PipExtendedRange/TargetWithinRange/SimulationState(attrs 1+0x1c)/RearFiring. Pip A (lit, -authored PipColor) when TargetWithinRange, else the dark ring B. [T2 geometry+wiring] -The binary's per-frame `Execute` @004cdcf0 sits in an UN-EXPORTED decomp gap — the Draw dynamics -(caret slide, pip lit/dark; lock rings/turn arrows built but static) are best-effort [T3]. -Deferred: PNAME1-8.bgf 3D pip meshes + the 3D marker chain; the `blx_cop` canopy shell renders -black and is hidden by name filter (`BT_INSIDE_COCKPIT=1` shows it) — see [[open-questions]]. +`AddWeapon` @004cdac0 (verified store map in btl4vid.hpp). + +**The per-frame `Execute` @004cdcf0 is RECOVERED (task #37, capstone disasm via +`tools/disas2.py` — the full annotated read: the task-37 commit + btl4vid.cpp comments) [T1], +and every instrument is now live [T2]:** +- **Right ladder** = range 0–1200 m: a BAR from ladder-top to the caret + the yellow caret + translate (`-scaleY·frac`); pegs at 1200 with no target. +- **Bottom 21-tick tape = the TORSO-TWIST indicator** (NOT a heading tape): deflection line + + carets at `∓(span/2)·(RotationOfTorsoHorizontal / HorizontalTorsoLimit)` (HUD attrs 4/5/6). + Fixed-torso BLH: centred (authentic static). +- **Circle-with-stem = the COMPASS** (HUD attr 0xD CompassHeading, rad→deg rotation) at + `(botX, botY−3·tickMajor−0.03)`; the **THREAT trail** (attr 0xC ThreatVector) draws inside its + rotated frame: 0.05-unit attack-direction marks, fresh <2 s red, expiring at 6 s, 1 s blink tick. + Port feed: the player's TakeDamage handler pushes the impact direction. +- **Pips** (composed into subB6, master-called): hidden when the weapon's DAMAGE state == 1 + (destroyed, attr 1); LIT (A) when the FIRE-CYCLE state == 2 (loaded, attr 0x1c; port source + rechargeLevel ≥ 1) else dark ring (B, charging); filtered by `weaponMode & elementMask&0xF` + (the weapon-GROUP bits Front/Rear/Left/Right). **Range plays NO part** — Execute never reads + the stored TargetWithinRange slots. +- **Lock ring** = subB9 (ring+cross) at frame centre, **SPINNING 4°/frame** while the Lock attr + (0xA) is up (port: while a target is locked); the binary also hangs the PNAMEx.bgf player-name + mesh on the 3D marker here (3D chain still deferred). +- **Target HOTBOX** (attr 0xB HotBoxVector) = a rectangle hugging the projected extents — x±4 + around the hotbox point, +1/−11.5 vertical (K=2.8145 baked projection; the port uses the live + per-axis projection) — switching to the left/right edge ARROW past ±1.6 or behind. +- Reticle state Off/On + `PrimaryHudOn` (mask 0x20) picks full HUD vs the "simple X" list; + the aim group translates by `reticlePosition` (SetMatrix, rebuilt on slew move). +This recovery also CONFIRMS the HUD attr-table ids 4/5/6/8/0xA/0xB/0xC/0xD name↔use pairings +(hud.hpp had flagged them uncertain). Deferred: PNAME1-8.bgf 3D marker chain; the `blx_cop` +canopy shell renders black and is hidden by name filter (`BT_INSIDE_COCKPIT=1` shows it) — see +[[open-questions]]. ## Key Relationships - Full history: `docs/GAUGE_COMPOSITE.md`; reticle recovery: `phases/phase-02-dpl2d-reticle.md`. diff --git a/context/open-questions.md b/context/open-questions.md index 388148b..1744fbf 100644 --- a/context/open-questions.md +++ b/context/open-questions.md @@ -60,15 +60,16 @@ authentic path scoped. by the mouse — wire the real channel when pod hardware lands; (c) pre-burial, the pick still tests the sinking wreck's collision box at its parked position (pre-existing wreck-targeting behavior). -- **Cockpit HUD leftovers (task #35 residue, 2026-07-08)** — the reticle + 7 weapon pips are LIVE - (see [[gauges-hud]] + `phases/phase-02-dpl2d-reticle.md`), but three pieces remain: (a) the +- **Cockpit HUD leftovers (tasks #35-#37 residue, 2026-07-08)** — the reticle + 7 weapon pips + + ALL the instrument dynamics are LIVE (the Execute @004cdcf0 gap was RECOVERED via capstone + disasm, task #37 — see [[gauges-hud]] for the full instrument map). Remaining: (a) the **blx_cop canopy shell** renders BLACK (untextured/unlit in our inside view) so it's hidden by a name filter — `BT_INSIDE_COCKPIT=1` shows it; the authentic look needs its material/lighting - path; (b) the **PNAME1-8.bgf 3D pip meshes** + the 3D target-designator marker chain (the ctor's - 15-arg form binds 8 HUD-subsystem attrs we bypass); (c) the binary per-frame **Execute - @004cdcf0** is in an un-exported decomp gap — the Draw dynamics (lock rings, off-screen turn - arrows, blink states, the 3 cached "SimulationState" constants 2/3/1) are best-effort [T3]; - a Ghidra re-export of the 0x4cdcf0 region would let us transcribe it properly. + path; (b) the **3D marker chain** ([0x31c]/[0x320] dpl objects + the PNAME1-8.bgf player-name + meshes the Execute hangs over the locked target); (c) the "simple X" list [0x264] + (PrimaryHudOn off — the minimal reticle mode) is built empty in the port; (d) the HUD Lock + attr's (0xA) own HudSimulation producer (port analog: locked == designated) and the compass + rotation SIGN are [T3]. - **StatusMessagePool (NULL stub, btstubs.cpp:62)** — the per-player status-message queue. BTPlayer+0x1dc is never populated → MessageBoard is empty (authentic for bring-up). What resolves it: wire the pool + decode `AddStatusMessage @0042e580` + the `Player__StatusMessage` diff --git a/engine/MUNGA_L4/L4VIDEO.cpp b/engine/MUNGA_L4/L4VIDEO.cpp index cce38ed..fab5749 100644 --- a/engine/MUNGA_L4/L4VIDEO.cpp +++ b/engine/MUNGA_L4/L4VIDEO.cpp @@ -231,6 +231,45 @@ int BTProjectToReticle(const float world[3], float *rx, float *ry) return 1; } +// +// The target HOTBOX projection (the recovered reticle Execute @4cdff7-4ce0f9 +// [T1]): project the box hugging the target's extents -- x +-4 around the +// hotbox point (the target's top-centre), +1 above / -11.5 below it (the +// authored pod mech envelope; constants @4cee7c/4ceea0/4ceeac). Returns 1 +// with the reticle-frame edges when the box is displayable; 0 when the target +// is BEHIND or both x-edges pass +-1.6 (constants @4cee88/90) -- then *side +// carries the arrow side (-1 left / +1 right). +// +int BTProjectHotBox(const float top[3], float *xl, float *xr, + float *yt, float *yb, int *side) +{ + *side = 0; + if (!gBTAimCamValid || gBTAimP11 <= 0.0f || gBTAimP22 <= 0.0f + || gBTAimVpH <= 0.0f) + return 0; + float rel[3]; + for (int i = 0; i < 3; ++i) + rel[i] = top[i] - gBTAimCamPos[i]; + const float xc = rel[0]*gBTAimCamX[0] + rel[1]*gBTAimCamX[1] + rel[2]*gBTAimCamX[2]; + const float yc = rel[0]*gBTAimCamY[0] + rel[1]*gBTAimCamY[1] + rel[2]*gBTAimCamY[2]; + const float zc = rel[0]*gBTAimCamZ[0] + rel[1]*gBTAimCamZ[1] + rel[2]*gBTAimCamZ[2]; + const float depth = -zc; // camera looks down -Z + if (depth < 0.1f) + { + *side = (xc >= 0.0f) ? 1 : -1; + return 0; + } + const float xs = (gBTAimP11 / depth) * (gBTAimVpW / gBTAimVpH); + const float ys = gBTAimP22 / depth; + *xl = (xc - 4.0f) * xs; + *xr = (xc + 4.0f) * xs; + *yt = -(yc + 1.0f) * ys; // 1 above the hotbox point + *yb = -(yc - 11.5f) * ys; // 11.5 below it + if (*xl > 1.6f && *xr > 1.6f) { *side = 1; return 0; } + if (*xl < -1.6f && *xr < -1.6f) { *side = -1; return 0; } + return 1; +} + void BTPushBeamKind(float fx, float fy, float fz, float tx, float ty, float tz, unsigned color, float ttl, float width, int kind) { diff --git a/game/reconstructed/btl4vid.cpp b/game/reconstructed/btl4vid.cpp index 3f2988d..69872e5 100644 --- a/game/reconstructed/btl4vid.cpp +++ b/game/reconstructed/btl4vid.cpp @@ -61,6 +61,7 @@ #include #include +#include // clock() -- the threat-trail ages (task #37) // @@ -1043,6 +1044,9 @@ BTReticleRenderable::BTReticleRenderable(Entity *entity, Scalar *range_attr) maxRange = kRetMaxRange; minRange = 0.0f; rangeScale= maxRange - minRange; // [0x8d] -- AddWeapon divides by it rangeAttr2= range_attr; + pipsBuilt = 0; // recovered-Execute dynamic state + lockShown = 0; + lockSpinDeg= 0.0f; masterList = dpl2d_NewDisplayList(); aimDotList = dpl2d_NewDisplayList(); @@ -1136,19 +1140,25 @@ BTReticleRenderable::BTReticleRenderable(Entity *entity, Scalar *range_attr) dpl2d_ClosePolyline(m); dpl2d_PopState(m); } - // bottom-anchor group: a small arc + drop line under the centre + // COMPASS group (Execute @4ce6e0-4ce7e4 [T1]): [0x278] bottomAnchor holds a + // rotate(CompassHeading rad->deg) + translate to (botX, botY - 3*tickMajor + // - 0.03) -- the compass rose (circle + north stem, authored at the origin) + // spins with the mech heading at the bottom-left of the twist tape. The + // THREAT trail [0x2e8] draws in the same frame: 0.05-unit direction marks + // from the compass centre toward recent damage sources (fresh = red, aging + // = yellow, expired at 6s -- Execute @4ce3e2-4ce6ce [T1]). dpl2d_PushState(m); - dpl2d_CallList(m, bottomAnchor); - dpl2d_Circle(m, 0.0f, 0.0f, 0.03f, 0); // 0x3cf5c28f-family arc [T3 radius] + dpl2d_CallList(m, bottomAnchor); // [0x9e] the compass rotate+translate + dpl2d_Circle(m, 0.0f, 0.0f, 0.03f, 0); // the rose ring [T3 radius] dpl2d_OpenLines(m); - dpl2d_AddPoint(m, 0.0f, -0.04f); + dpl2d_AddPoint(m, 0.0f, -0.04f); // the north stem dpl2d_AddPoint(m, 0.0f, -0.005f); dpl2d_CloseLines(m); - dpl2d_CallList(m, subBA); + dpl2d_CallList(m, subBA); // [0xba] the threat-direction trail dpl2d_PopState(m); - dpl2d_CallList(m, subB6); - dpl2d_CallList(m, headingList); - dpl2d_CallList(m, subB7); + dpl2d_CallList(m, subB6); // [0xb6] the composed weapon pips + dpl2d_CallList(m, headingList); // [0x9d] the LOCK-RING SPIN matrix (4 deg/frame) + dpl2d_CallList(m, subB7); // [0xb7] the lock-ring slot (subB9 when locked) dpl2d_End(m); dpl2d_Compile(m); @@ -1230,14 +1240,24 @@ void if (range < minRange) range = minRange; if (range > maxRange) range = maxRange; Scalar frac = (range - minRange) / (maxRange - minRange); - Scalar six[6] = { 1, 0, 0, 1, 0, -scaleY * frac }; + // [0x26c] = the range BAR (a line from the ladder TOP down to the caret + // height) + the caret translate (Execute @4ceb16-4cebf8: AddPoint(originX, + // originY-scaleY), AddPoint(originX, originY-scaleY*frac), then the + // SetMatrix(translate(0, -scaleY*frac)) the caret triangles ride). dpl2d_Begin(rangeCaretR, 1); - dpl2d_ConcatMatrix(rangeCaretR, six); + dpl2d_OpenLines(rangeCaretR); + dpl2d_AddPoint(rangeCaretR, originX, originY - scaleY); + dpl2d_AddPoint(rangeCaretR, originX, originY - scaleY * frac); + dpl2d_CloseLines(rangeCaretR); + { + Scalar six[6] = { 1, 0, 0, 1, 0, -scaleY * frac }; + dpl2d_ConcatMatrix(rangeCaretR, six); + } dpl2d_End(rangeCaretR); dpl2d_Compile(rangeCaretR); - // the AIM translate [0x9a] (task #36): the slewed crosshair position, in - // reticle coordinates (fed by the mouse / stick free-aim in mech4). + // the AIM translate [0x9a] (Execute @4cde59-4cdedd [T1]: rebuilt on slew + // move with SetMatrix(translate(reticlePosition))). { extern float gBTAimX, gBTAimY; Scalar t6[6] = { 1, 0, 0, 1, gBTAimX, gBTAimY }; @@ -1247,32 +1267,182 @@ void dpl2d_Compile(aimDotList); } - // the TARGET DESIGNATOR slot [0xa1] (task #36, Reticle::TargetDesignatorOn - // [T0]): the designated target's projected screen point gets the lock ring - // (subB9 ring+cross while the crosshair is ON it, subB8 plain ring while - // designated); off-screen / behind, the edge turn ARROW points the way back. + // the TORSO-TWIST TAPE carets [0x9c] (Execute @4ce7e5-4cea9a [T1]): the + // bottom 21-tick tape is the TWIST indicator -- a deflection line from the + // tape centre plus the over/under carets translated by + // offset = -/+(span/2) * (RotationOfTorsoHorizontal / twist limit) + // (attrs 4/5/6: the live twist over the per-side limits; full deflection = + // the torso hard against its stop). The fixed-torso BLH reads 0 (centred). { - extern int gBTHudLockState; // 0 none / 1 designated / 2 hot - extern float gBTHudLockWorld[3]; - extern int BTProjectToReticle(const float world[3], float *rx, float *ry); + extern float gBTHudTwist, gBTHudTwistLimit; + float off = 0.0f; + if (gBTHudTwistLimit > 1e-4f) + { + off = -(kRetBotSpan * 0.5f) * (gBTHudTwist / gBTHudTwistLimit); + if (off < -kRetBotSpan * 0.5f) off = -kRetBotSpan * 0.5f; + if (off > kRetBotSpan * 0.5f) off = kRetBotSpan * 0.5f; + } + const float cx = kRetBotX + kRetBotSpan * 0.5f; + dpl2d_Begin(rangeCaretB, 1); + dpl2d_OpenLines(rangeCaretB); + dpl2d_AddPoint(rangeCaretB, cx, kRetBotY); + dpl2d_AddPoint(rangeCaretB, cx + off, kRetBotY); + dpl2d_CloseLines(rangeCaretB); + { + Scalar t6[6] = { 1, 0, 0, 1, off, 0 }; + dpl2d_ConcatMatrix(rangeCaretB, t6); + } + dpl2d_End(rangeCaretB); + dpl2d_Compile(rangeCaretB); + } + // the COMPASS rotate [0x9e] (Execute @4ce6e0-4ce7e4 [T1]): the rose spins + // by CompassHeading (radians; the binary converts x57.2958 for its degree + // recorder) and sits at (botX, botY - 3*tickMajor - 0.03). + { + extern float gBTHudHeading; + const float c = (float)cos((double)gBTHudHeading); + const float s = (float)sin((double)gBTHudHeading); + Scalar r6[6] = { c, s, -s, c, + kRetBotX, kRetBotY - 3.0f * kRetTickMajor - 0.03f }; + dpl2d_Begin(bottomAnchor, 1); + dpl2d_ConcatMatrix(bottomAnchor, r6); + dpl2d_End(bottomAnchor); + dpl2d_Compile(bottomAnchor); + } + + // the THREAT trail [0xba] (Execute @4ce3e2-4ce6ce [T1]): direction marks + // from the compass centre toward recent damage sources. Each mark is a + // 0.05-unit line along the (mech-local x,z) attack direction; FRESH marks + // (< 2s) draw red, aging ones yellow, expired (> 6s) drop. + { + extern int BTTakeHudThreats(float out_xz[][2], float out_age[], int max_n); + float txz[16][2]; float tage[16]; + const int n = BTTakeHudThreats(txz, tage, 16); + dpl2d_Begin(subBA, 1); + if (n > 0) + { + // stale (yellow) first, then fresh (red) -- the binary's color split + dpl2d_SetColor(subBA, 0.75f, 0.75f, 0.0f); + for (int pass = 0; pass < 2; ++pass) + { + const int wantFresh = (pass == 1); + if (pass == 1) + dpl2d_SetColor(subBA, 0.75f, 0.0f, 0.0f); + for (int i = 0; i < n; ++i) + { + const int isFresh = (tage[i] < 2.0f); + if (isFresh != wantFresh) + continue; + dpl2d_OpenLines(subBA); + dpl2d_AddPoint(subBA, 0.0f, 0.0f); + dpl2d_AddPoint(subBA, txz[i][0] * 0.05f, txz[i][1] * 0.05f); + dpl2d_CloseLines(subBA); + } + } + dpl2d_SetColor(subBA, 0.0f, 0.75f, 0.0f); // restore green + } + dpl2d_End(subBA); + dpl2d_Compile(subBA); + } + + // the WEAPON PIPS [0xb6] (Execute @4ce2c2-4ce3e1 [T1]): the composed pip + // list the master calls. Per weapon: skip unless its GROUP is displayed + // (weaponMode & elementMask low bits); HIDE it when destroyed (attr 1 == + // 1); the LIT pip (A) when the fire cycle is LOADED (attr 0x1c == 2, our + // source: rechargeLevel >= 1), else the dark ring (B, charging). Range + // plays NO part -- the binary never reads TargetWithinRange here. + { + extern int gBTHudGroupMask; // element-mask low bits (0xF = all) + int dirty = 0; + for (int i = 0; i < weaponCount; ++i) + { + const int destroyed = (simStateAttr[i] != 0 && *simStateAttr[i] == 1); + const int loaded = (cycleReady[i] != 0 && *cycleReady[i] >= 0.999f); + if (destroyed != simStateCache[i] || loaded != alarmCache[i]) + { + simStateCache[i] = destroyed; + alarmCache[i] = loaded; + dirty = 1; + } + } + static int s_lastMask = -1; + if (gBTHudGroupMask != s_lastMask) { s_lastMask = gBTHudGroupMask; dirty = 1; } + if (dirty || !pipsBuilt) + { + pipsBuilt = 1; + dpl2d_Begin(subB6, 1); + for (int i = 0; i < weaponCount; ++i) + { + if ((weaponMode[i] & gBTHudGroupMask) == 0) + continue; // group not displayed + if (simStateCache[i]) + continue; // destroyed: no pip at all + dpl2d_CallList(subB6, + alarmCache[i] ? pipDisplayListA[i] : pipDisplayListB[i]); + } + dpl2d_End(subB6); + dpl2d_Compile(subB6); + } + } + + // the LOCK RING [0xb7] + its SPIN [0x9d] (Execute @4cebf9-4cee54 [T1]): + // while a target is locked the ring+cross (subB9) draws at the reticle + // frame centre, spinning 4 degrees per frame; unlocked it clears. (The + // binary also hangs the PNAMEx.bgf player-name mesh on the 3D marker here + // -- the 3D marker chain remains deferred.) + { + extern int gBTHudLockState; + const int locked = (gBTHudLockState != 0); + if (locked != lockShown) + { + lockShown = locked; + dpl2d_Begin(subB7, 1); + if (locked) + dpl2d_CallList(subB7, subB9); + dpl2d_End(subB7); + dpl2d_Compile(subB7); + } + if (locked) + { + lockSpinDeg += 4.0f; // per FRAME, the binary's rate + if (lockSpinDeg >= 360.0f) lockSpinDeg -= 360.0f; + const float a = lockSpinDeg * 0.0174532925f; + const float c = (float)cos((double)a), s = (float)sin((double)a); + Scalar r6[6] = { c, s, -s, c, 0, 0 }; + dpl2d_Begin(headingList, 1); + dpl2d_ConcatMatrix(headingList, r6); + dpl2d_End(headingList); + dpl2d_Compile(headingList); + } + } + + // the TARGET HOTBOX / edge arrows [0xa1] (Execute @4cdf6f-4ce28b [T1]): + // the box is a RECTANGLE hugging the target's projected extents -- x +-4 + // around the hotbox point, +1 above / -11.5 below it (the authored pod + // mech envelope) -- switching to the left/right edge arrow when both + // edges pass +-1.6 or the target is behind. + { + extern int gBTHudLockState; + extern float gBTHudLockWorld[3]; // the target's hotbox point (top) + extern int BTProjectHotBox(const float top[3], float *xl, float *xr, + float *yt, float *yb, int *side); dpl2d_Begin(crossList, 1); if (gBTHudLockState != 0) { - float tx = 0.0f, ty = 0.0f; - const int onScreen = BTProjectToReticle(gBTHudLockWorld, &tx, &ty); - const float xLimit = 1.55f; // past the ladders = off-screen - if (onScreen && tx > -xLimit && tx < xLimit && ty > -1.0f && ty < 1.0f) + float xl, xr, yt, yb; int side; + if (BTProjectHotBox(gBTHudLockWorld, &xl, &xr, &yt, &yb, &side)) { - Scalar d6[6] = { 1, 0, 0, 1, tx, ty }; - dpl2d_PushState(crossList); - dpl2d_ConcatMatrix(crossList, d6); - dpl2d_CallList(crossList, (gBTHudLockState == 2) ? subB9 : subB8); - dpl2d_PopState(crossList); + dpl2d_OpenPolyline(crossList); // the closed hotbox rectangle + dpl2d_AddPoint(crossList, xl, yt); + dpl2d_AddPoint(crossList, xl, yb); + dpl2d_AddPoint(crossList, xr, yb); + dpl2d_AddPoint(crossList, xr, yt); + dpl2d_ClosePolyline(crossList); } else { - dpl2d_CallList(crossList, (tx < 0.0f) ? leftArrow : rightArrow); + dpl2d_CallList(crossList, (side < 0) ? leftArrow : rightArrow); } } dpl2d_End(crossList); @@ -1280,14 +1450,6 @@ void } dpl2d_ExecuteList(masterList, device); - - for (int i = 0; i < weaponCount; ++i) - { - int inRange = 0; - if (withinRangePtr[i] != 0) // [0x18c] TargetWithinRange - inRange = (*withinRangePtr[i] != 0); - dpl2d_ExecuteList(inRange ? pipDisplayListA[i] : pipDisplayListB[i], device); - } } // @@ -1338,11 +1500,11 @@ BTReticleRenderable *BTBuildReticle(Entity *mech) (int *)wp->WithinRangePtr(), wp->PipExtendedRange(), r, g, b, - (int *)wp->SimulationStatePtr(), // attr 0x1c "SimulationState" + wp->RechargeLevelPtr(), // attr 0x1c analog: loaded when >= 1 2, 3, - (int *)wp->SimulationStatePtr(), // attr 1 "SimulationState" + (int *)wp->SimulationStatePtr(), // attr 1: damage state (1 = destroyed) 1, - 1 /* front (RearFiring==0 on every BLH weapon) */); + 1 /* Front group (RearFiring==0 on every BLH weapon) */); } DEBUG_STREAM << "[hud] reticle built: " << gBTReticle->WeaponCount() << " weapon pip(s) registered\n" << std::flush; @@ -1352,6 +1514,56 @@ BTReticleRenderable *BTBuildReticle(Entity *mech) // the live target-range storage the reticle's caret binds to Scalar gBTHudRangeStorage = 0.0f; +// +// THREAT trail store (recovered Execute @4ce3e2-4ce6ce): timestamped attack +// directions pushed on player damage (mech.cpp handler); Draw ages them -- +// fresh < 2s (red), expired > 6s (dropped). World-frame (x,z) directions: +// they draw inside the compass's rotated frame, so the marks stay +// world-referenced on the rose like a true compass bearing. +// +struct BTHudThreat { float x, z; clock_t born; }; +static BTHudThreat gBTHudThreats[16]; +static int gBTHudThreatCount = 0; + +void BTPushHudThreat(float wx, float wz) +{ + float len = sqrtf(wx * wx + wz * wz); + if (len < 1e-4f) + return; + if (gBTHudThreatCount >= 16) // drop the oldest + { + for (int i = 1; i < 16; ++i) + gBTHudThreats[i - 1] = gBTHudThreats[i]; + gBTHudThreatCount = 15; + } + BTHudThreat &t = gBTHudThreats[gBTHudThreatCount++]; + t.x = wx / len; + t.z = wz / len; + t.born = clock(); +} + +int BTTakeHudThreats(float out_xz[][2], float out_age[], int max_n) +{ + const clock_t now = clock(); + int n = 0; + for (int i = 0; i < gBTHudThreatCount; ++i) + { + const float age = (float)(now - gBTHudThreats[i].born) / (float)CLOCKS_PER_SEC; + if (age > 6.0f) + continue; // expired + gBTHudThreats[n] = gBTHudThreats[i]; // compact in place + if (n < max_n) + { + out_xz[n][0] = gBTHudThreats[n].x; + out_xz[n][1] = gBTHudThreats[n].z; + out_age[n] = age; + } + ++n; + } + gBTHudThreatCount = n; + return (n < max_n) ? n : max_n; +} + // //############################################################################# // BTReticleRenderable::AddWeapon @@ -1373,12 +1585,12 @@ void Scalar pip_red, // param_6..8 PipColor Scalar pip_green, Scalar pip_blue, - int *alarm_value, // param_9 weapon attr 0x1c - int const2, // param_10 (constant 2) - int const3, // param_11 (constant 3) + Scalar *cycle_ready, // param_9 (port: rechargeLevel) + int const2, // param_10 (2 = loaded) + int const3, // param_11 (3 = charging) int *sim_state_value, // param_12 weapon attr 1 - int const1, // param_13 (constant 1) - int weapon_mode) // param_14 (1 front / 2 rear) + int const1, // param_13 (1 = destroyed) + int weapon_mode) // param_14 (group bit) { if (this->weaponCount /* [0x38] */ >= 10) { @@ -1389,16 +1601,17 @@ void // // Record this weapon's control state in the parallel arrays -- the exact - // store order of @004cdac0 (part_014.c:4827-4837). The binary read the - // two attr objects' values at +0x14; the port takes value pointers direct. + // store order of @004cdac0 (part_014.c:4827-4837). The caches hold the + // pip's DERIVED display flags (loaded / destroyed) for the Execute-style + // change detection in Draw. // this->stateConst3[n] /* [0x64+n*4] = param_11 */ = const3; this->stateConst2[n] /* [0x8c+n*4] = param_10 */ = const2; this->stateConst1[n] /* [0xb4+n*4] = param_13 */ = const1; - this->alarmAttr[n] /* [0x130+n*4] = param_9 */ = alarm_value; - this->alarmCache[n] /* [0xdc+n*4] = *(param_9+0x14) */ = *alarm_value; + this->cycleReady[n] /* [0x130+n*4] = param_9 */ = cycle_ready; + this->alarmCache[n] /* [0xdc+n*4] */ = (*cycle_ready >= 0.999f); this->simStateAttr[n] /* [0x158+n*4] = param_12 */ = sim_state_value; - this->simStateCache[n] /* [0x104+n*4] = *(param_12+0x14) */ = *sim_state_value; + this->simStateCache[n] /* [0x104+n*4] */ = (*sim_state_value == const1); this->withinRangePtr[n] /* [0x18c+n*4] = param_4 */ = within_range_value; this->withinRangeCache[n] /* [0x1b4+n*4] = *param_4 */ = *within_range_value; this->weaponMode[n] /* [0x3c+n*4] = param_14 */ = weapon_mode; diff --git a/game/reconstructed/btl4vid.hpp b/game/reconstructed/btl4vid.hpp index 319ec0a..a4c1487 100644 --- a/game/reconstructed/btl4vid.hpp +++ b/game/reconstructed/btl4vid.hpp @@ -482,12 +482,15 @@ class BTReticleRenderable: // // Append a weapon range/pip marker to the reticle. @004cdac0 - // Parameter order/count is the binary's; the two attr-object args - // (param_9 / param_12 -- weapon attrs 0x1c and 1, BOTH named - // "SimulationState" per the caller's abort strings @51d526/51d577) - // are adapted to direct value pointers (the binary read the value at - // attr+0x14; we have no 1995 attr-object layout -- databinding trap). - // The caller passes the constants 2 / 3 / 1 verbatim. + // Parameter order/count is the binary's. The RECOVERED Execute + // (@004cdcf0, task #37) fixed the two state attrs' semantics: + // param_9 = weapon attr 0x1c, the FIRE-CYCLE state: == const2 (2) + // -> LOADED (lit pip A); == const3 (3) -> charging (dark + // ring B). Port source: rechargeLevel (>= 1.0 == loaded). + // param_12 = weapon attr 1, the DAMAGE state: == const1 (1) + // -> Destroyed (the pip is HIDDEN entirely). + // weapon_mode is a GROUP BIT (Front=1/Rear=2/Left=4/Right=8) tested + // against the Reticle element mask's low nibble. // void AddWeapon( @@ -498,31 +501,32 @@ class BTReticleRenderable: Scalar pip_red, // param_6..8 PipColor Scalar pip_green, Scalar pip_blue, - int *alarm_value, // param_9 weapon attr 0x1c - int const2, // param_10 (constant 2) - int const3, // param_11 (constant 3) + Scalar *cycle_ready, // param_9 (port: rechargeLevel) + int const2, // param_10 (2 = loaded) + int const3, // param_11 (3 = charging) int *sim_state_value, // param_12 weapon attr 1 - int const1, // param_13 (constant 1) - int weapon_mode); // param_14 (1 front / 2 rear) + int const1, // param_13 (1 = destroyed) + int weapon_mode); // param_14 (group bit) protected: // // Per-weapon parallel arrays (cap 10). Slot mapping is the verified - // store order of AddWeapon @004cdac0 (part_014.c:4827-4837) [T1]; the - // three caller constants and the cached attr values are consumed by the - // UN-EXPORTED Execute @004cdcf0, so their semantics are [T4]. + // store order of AddWeapon @004cdac0 (part_014.c:4827-4837) [T1]; + // semantics RECOVERED from the disassembled Execute @004cdcf0 (task + // #37 [T1]): the caches are the change-detect state driving the pip + // list rebuild; the constants are the fire-cycle/damage enum values. // int weaponCount; // +0x38 - int weaponMode[10]; // +0x3c param_14 - int stateConst3[10]; // +0x64 param_11 (3) - int stateConst2[10]; // +0x8c param_10 (2) - int stateConst1[10]; // +0xb4 param_13 (1) - int alarmCache[10]; // +0xdc *param_9 at add time - int simStateCache[10]; // +0x104 *param_12 at add time - int *alarmAttr[10]; // +0x130 param_9 - int *simStateAttr[10]; // +0x158 param_12 - int *withinRangePtr[10]; // +0x18c param_4 - int withinRangeCache[10]; // +0x1b4 *param_4 at add time + int weaponMode[10]; // +0x3c group bit (F/R/L/R) + int stateConst3[10]; // +0x64 3 = charging (dark) + int stateConst2[10]; // +0x8c 2 = loaded (lit) + int stateConst1[10]; // +0xb4 1 = destroyed (hidden) + int alarmCache[10]; // +0xdc port: LOADED flag cache + int simStateCache[10]; // +0x104 port: DESTROYED flag cache + Scalar *cycleReady[10]; // +0x130 port: rechargeLevel source + int *simStateAttr[10]; // +0x158 damage state (attr 1) + int *withinRangePtr[10]; // +0x18c param_4 (stored; Execute + int withinRangeCache[10]; // +0x1b4 never reads it -- T1) dpl2d_DISPLAY *pipDisplayListB[10]; // +0x288 dpl2d_DISPLAY *pipDisplayListA[10]; // +0x2b0 @@ -551,11 +555,16 @@ class BTReticleRenderable: dpl2d_DISPLAY *leftArrow; // [0x9f] left range arrow dpl2d_DISPLAY *rightArrow; // [0xa0] right range arrow dpl2d_DISPLAY *crossList; // [0xa1] the dotted cross - dpl2d_DISPLAY *subB6; // [0xb6..0xba] aux sub-lists - dpl2d_DISPLAY *subB7; - dpl2d_DISPLAY *subB8; // [0xb8] green centre ring - dpl2d_DISPLAY *subB9; // [0xb9] green ring + cross - dpl2d_DISPLAY *subBA; + dpl2d_DISPLAY *subB6; // [0xb6] the composed weapon pips + dpl2d_DISPLAY *subB7; // [0xb7] the lock-ring slot + dpl2d_DISPLAY *subB8; // [0xb8] plain ring (simple-X mode) + dpl2d_DISPLAY *subB9; // [0xb9] ring + cross (the LOCK ring) + dpl2d_DISPLAY *subBA; // [0xba] the threat-direction trail + + // Recovered-Execute dynamic state (task #37) + int pipsBuilt; // subB6 composed at least once + int lockShown; // subB7 holds the ring (this[0x1dc]) + float lockSpinDeg; // the ring spin angle (this[0x240]) }; // diff --git a/game/reconstructed/hud.hpp b/game/reconstructed/hud.hpp index 0edadc4..f586390 100644 --- a/game/reconstructed/hud.hpp +++ b/game/reconstructed/hud.hpp @@ -109,13 +109,14 @@ // id 13 "CompassHeading" -> @0x208 (Vec3) // (FlickerRate name ptr @005110bc heads the table as the category label.) // - // UNCERTAIN: several of these attribute name<->offset bindings do not line - // up cleanly with the way the ctor/HudSimulation actually use the same - // offsets (e.g. the ctor seeds @0x1D8 from the resource FlickerRate, while - // HudSimulation treats @0x1EC as the computed range-to-target and @0x1F8 as - // a boolean visibility flag). The names below follow usage where it is - // unambiguous and are flagged where it is not. A human should reconcile - // the gauge attribute map against the original HUD.HPP. + // CONFIRMED (task #37): the recovered reticle Execute @004cdcf0 binds and + // USES ids 4/5/6/8/0xA/0xB/0xC/0xD exactly per these names -- + // RotationOfTorsoHorizontal drives the twist tape over the + // HorizontalTorsoLimit full-scales, RangeToTarget the range caret, Lock + // the spinning lock ring, HotBoxVector the target box (eye-space vec3), + // ThreatVector the compass threat trail, CompassHeading the rose + // rotation. (The earlier note about @0x1D8/@0x1EC/@0x1F8 usage remains + // for the ctor-side seeds only.) // public: enum { diff --git a/game/reconstructed/mech.cpp b/game/reconstructed/mech.cpp index d4a0746..31ac9d6 100644 --- a/game/reconstructed/mech.cpp +++ b/game/reconstructed/mech.cpp @@ -554,6 +554,19 @@ void // WRITTEN -- a reconstruction gap; the natural authentic write site is // this handler (every damage message carries the inflictor). [T3] lastInflictingID = message->inflictingEntity; + + // THREAT feed (task #37, the recovered reticle Execute's ThreatVector + // attr 0xC): when the PLAYER takes a hit, push the attack direction -- + // world (x,z) from the mech toward the impact point -- onto the HUD's + // compass-rose threat trail (fresh marks red, fading over 6s). + if (application != 0 && (Entity *)this == application->GetViewpointEntity()) + { + extern void BTPushHudThreat(float wx, float wz); + BTPushHudThreat( + (float)(message->damageData.impactPoint.x - localOrigin.linearPosition.x), + (float)(message->damageData.impactPoint.z - localOrigin.linearPosition.z)); + } + DamageLookupTable *table = (DamageLookupTable *)damageLookupTable; // named member (Wword absorbs!) if (message->invalidDamageZone && table != 0) { diff --git a/game/reconstructed/mech4.cpp b/game/reconstructed/mech4.cpp index 33517da..ee1ead2 100644 --- a/game/reconstructed/mech4.cpp +++ b/game/reconstructed/mech4.cpp @@ -551,11 +551,18 @@ static Scalar gDriveHeading = 0.0f; // yaw about world up (Y) // the HUD Draw (crosshair position) and the pick-ray each sim frame. float gBTAimX = 0.0f; float gBTAimY = 0.0f; -// The HUD designator feed (mech4 -> btl4vid Draw): the designated target's -// world chest point + the lock state (0 = none, 1 = designated, 2 = HOT -- -// the crosshair is ON it right now). +// The HUD designator feed (mech4 -> btl4vid Draw): the locked target's +// HOTBOX point (its top-centre; the recovered Execute frames x+-4 around it, +// +1 above / -11.5 below) + the lock state (0 = none, 2 = locked). int gBTHudLockState = 0; float gBTHudLockWorld[3] = { 0, 0, 0 }; +// Recovered-Execute instrument feeds (task #37): the compass heading, the +// torso-twist tape (deflection over the per-mech twist limit), and the +// weapon-group display mask (the Reticle element mask's low nibble). +float gBTHudHeading = 0.0f; +float gBTHudTwist = 0.0f; +float gBTHudTwistLimit = 0.0f; +int gBTHudGroupMask = 0xF; // BT_GOTO beeline harness outputs (consumed by the mapper bridge, mechmppr.cpp) int gBTGotoActive = 0; float gBTGotoTurn = 0.0f; @@ -2364,19 +2371,21 @@ void } } - // HUD feeds: the range caret + the designator box (world point + state). + // HUD feeds: the range caret + the hotbox (world point + state) + the + // recovered-Execute instruments (compass, twist tape, group mask). { extern void BTSetHudTargetRange(Scalar range); Entity *des = MECH_TARGET_ENTITY(this); if (des != 0) { - Point3D dp = ((Mech *)des)->localOrigin.linearPosition; + Mech *dm = (Mech *)des; + Point3D dp = dm->localOrigin.linearPosition; float hddx = dp.x - localOrigin.linearPosition.x; float hddz = dp.z - localOrigin.linearPosition.z; BTSetHudTargetRange((Scalar)sqrtf(hddx*hddx + hddz*hddz)); gBTHudLockState = 2; // locked == crosshair on it - gBTHudLockWorld[0] = dp.x; - gBTHudLockWorld[1] = dp.y + kMuzzleHeight; + gBTHudLockWorld[0] = dp.x; // the HOTBOX point: top-centre + gBTHudLockWorld[1] = dp.y + (float)dm->CylinderReferenceHeight(); gBTHudLockWorld[2] = dp.z; } else @@ -2384,6 +2393,11 @@ void BTSetHudTargetRange(1200.0f); // no target: the binary default gBTHudLockState = 0; // (0x44960000 @part_013.c:5637) } + + gBTHudHeading = gDriveHeading; // CompassHeading (attr 0xD) + gBTHudTwist = (float)TorsoHeading(); // RotationOfTorsoHorizontal (attr 4) + gBTHudTwistLimit = (float)GetHorizontalFiringReach();// HorizontalTorsoLimit (attrs 5/6) + gBTHudGroupMask = (int)targetReticle.reticleElementMask & 0xF; } if (gEnemyMech != 0) diff --git a/game/reconstructed/mechweap.hpp b/game/reconstructed/mechweap.hpp index 99ceda7..346dc9e 100644 --- a/game/reconstructed/mechweap.hpp +++ b/game/reconstructed/mechweap.hpp @@ -251,7 +251,8 @@ class CockpitHud; int PipExtendedRange() const { return pipExtendedRange; } void *WithinRangePtr() { return &targetWithinRange; } void *WeaponAlarmPtr() { return &weaponAlarm; } - void *SimulationStatePtr() { return &simulationState; } // attr 1 / 0x1c ("SimulationState") + void *SimulationStatePtr() { return &simulationState; } // attr 1 ("SimulationState" -- damage state; 1 = Destroyed) + Scalar *RechargeLevelPtr() { return &rechargeLevel; } // the pip ready source (1.0 == loaded/ready) protected: diff --git a/reference/decomp/reticle_execute_004cdcf0.disasm.txt b/reference/decomp/reticle_execute_004cdcf0.disasm.txt new file mode 100644 index 0000000..054f9a3 --- /dev/null +++ b/reference/decomp/reticle_execute_004cdcf0.disasm.txt @@ -0,0 +1,1254 @@ +=== disasm @0x4cdcf0 len=0x11dc === +0x4cdcf0: push ebp +0x4cdcf1: mov ebp, esp +0x4cdcf3: add esp, 0xffffff4c +0x4cdcf9: push ebx +0x4cdcfa: push esi +0x4cdcfb: push edi +0x4cdcfc: mov ebx, dword ptr [ebp + 8] +0x4cdcff: mov eax, dword ptr [ebx + 0x254] +0x4cdd05: mov edx, dword ptr [eax + 8] +0x4cdd08: mov ecx, dword ptr [ebx + 0x24c] +0x4cdd0e: cmp edx, ecx +0x4cdd10: jne 0x4cdd2c ; [0x4cdd2c]=1.56131e-37f +0x4cdd12: mov eax, dword ptr [ebx + 0x254] +0x4cdd18: mov ecx, dword ptr [ebx + 0x20] +0x4cdd1b: and ecx, 0x20 +0x4cdd1e: mov edx, dword ptr [eax + 0x24] +0x4cdd21: and edx, 0x20 +0x4cdd24: cmp edx, ecx +0x4cdd26: je 0x4cde17 ; [0x4cde17]=1.50276e-37f +0x4cdd2c: mov eax, dword ptr [ebx + 0x254] +0x4cdd32: mov edx, dword ptr [eax + 8] +0x4cdd35: mov dword ptr [ebx + 0x24c], edx +0x4cdd3b: mov eax, dword ptr [ebx + 0x254] +0x4cdd41: mov ecx, dword ptr [ebx + 0x20] +0x4cdd44: and ecx, 0xffffffdf +0x4cdd47: mov edx, dword ptr [eax + 0x24] +0x4cdd4a: and edx, 0x20 +0x4cdd4d: or ecx, edx +0x4cdd4f: mov dword ptr [ebx + 0x20], ecx +0x4cdd52: push 1 +0x4cdd54: mov ecx, dword ptr [ebx + 0x25c] +0x4cdd5a: push ecx +0x4cdd5b: call 0x487fbc +0x4cdd60: add esp, 8 +0x4cdd63: mov eax, dword ptr [ebx + 0x24c] +0x4cdd69: sub eax, 1 +0x4cdd6c: jb 0x4cdd75 ; [0x4cdd75]=-3.50889e-27f +0x4cdd6e: je 0x4cdd9d ; [0x4cdd9d]=1.56176e-37f +0x4cdd70: jmp 0x4cddfd ; [0x4cddfd]=1.62008e-37f +0x4cdd75: push 0 +0x4cdd77: mov edx, dword ptr [ebx + 0x320] +0x4cdd7d: push edx +0x4cdd7e: call 0x48ac30 +0x4cdd83: add esp, 8 +0x4cdd86: mov ecx, dword ptr [ebx + 0x320] +0x4cdd8c: push ecx +0x4cdd8d: call 0x48d5d4 +0x4cdd92: pop ecx +0x4cdd93: xor eax, eax +0x4cdd95: mov dword ptr [ebx + 0x1e0], eax +0x4cdd9b: jmp 0x4cddfd ; [0x4cddfd]=1.62008e-37f +0x4cdd9d: mov edx, dword ptr [ebx + 0x254] +0x4cdda3: test byte ptr [edx + 0x24], 0x20 +0x4cdda7: je 0x4cddc1 ; [0x4cddc1]=1.67931e-37f +0x4cdda9: mov ecx, dword ptr [ebx + 0x260] +0x4cddaf: push ecx +0x4cddb0: mov eax, dword ptr [ebx + 0x25c] +0x4cddb6: push eax +0x4cddb7: call 0x488850 +0x4cddbc: add esp, 8 +0x4cddbf: jmp 0x4cddfd ; [0x4cddfd]=1.62008e-37f +0x4cddc1: mov edx, dword ptr [ebx + 0x264] +0x4cddc7: push edx +0x4cddc8: mov ecx, dword ptr [ebx + 0x25c] +0x4cddce: push ecx +0x4cddcf: call 0x488850 +0x4cddd4: add esp, 8 +0x4cddd7: push 0 +0x4cddd9: mov eax, dword ptr [ebx + 0x320] +0x4cdddf: push eax +0x4cdde0: call 0x48ac30 +0x4cdde5: add esp, 8 +0x4cdde8: mov edx, dword ptr [ebx + 0x320] +0x4cddee: push edx +0x4cddef: call 0x48d5d4 +0x4cddf4: pop ecx +0x4cddf5: xor ecx, ecx +0x4cddf7: mov dword ptr [ebx + 0x1e0], ecx +0x4cddfd: mov eax, dword ptr [ebx + 0x25c] +0x4cde03: push eax +0x4cde04: call 0x488030 +0x4cde09: pop ecx +0x4cde0a: mov edx, dword ptr [ebx + 0x25c] +0x4cde10: push edx +0x4cde11: call 0x488054 +0x4cde16: pop ecx +0x4cde17: mov ecx, dword ptr [ebx + 0x24c] +0x4cde1d: dec ecx +0x4cde1e: jne 0x4cee55 ; [0x4cee55]=253.908f +0x4cde24: call 0x414b60 +0x4cde29: mov esi, eax +0x4cde2b: fild dword ptr [esi] +0x4cde2d: fdiv dword ptr [0x52140c] +0x4cde33: fstp dword ptr [ebp - 4] +0x4cde36: mov esi, dword ptr [ebx + 0x254] +0x4cde3c: push 0x38d1b717 +0x4cde41: push esi +0x4cde42: lea eax, [ebx + 0x244] +0x4cde48: push eax +0x4cde49: call 0x45961f +0x4cde4e: add esp, 0xc +0x4cde51: test eax, eax +0x4cde53: jne 0x4cdf5f ; [0x4cdf5f]=1.56153e-37f +0x4cde59: mov edx, dword ptr [ebx + 0x254] +0x4cde5f: mov ecx, dword ptr [edx] +0x4cde61: mov dword ptr [ebx + 0x244], ecx +0x4cde67: mov ecx, dword ptr [edx + 4] +0x4cde6a: mov dword ptr [ebx + 0x248], ecx +0x4cde70: lea eax, [ebp - 0x88] +0x4cde76: push eax +0x4cde77: call 0x488b80 +0x4cde7c: mov edx, dword ptr [ebx + 0x254] +0x4cde82: pop ecx +0x4cde83: lea ecx, [ebp - 0x88] +0x4cde89: push dword ptr [edx + 4] +0x4cde8c: mov eax, dword ptr [ebx + 0x254] +0x4cde92: push dword ptr [eax] +0x4cde94: push ecx +0x4cde95: call 0x488bac +0x4cde9a: add esp, 0xc +0x4cde9d: push 1 +0x4cde9f: mov eax, dword ptr [ebx + 0x268] +0x4cdea5: push eax +0x4cdea6: call 0x487fbc +0x4cdeab: add esp, 8 +0x4cdeae: lea edx, [ebp - 0x88] +0x4cdeb4: push edx +0x4cdeb5: mov ecx, dword ptr [ebx + 0x268] +0x4cdebb: push ecx +0x4cdebc: call 0x488718 +0x4cdec1: add esp, 8 +0x4cdec4: mov eax, dword ptr [ebx + 0x268] +0x4cdeca: push eax +0x4cdecb: call 0x488030 +0x4cded0: pop ecx +0x4cded1: mov edx, dword ptr [ebx + 0x268] +0x4cded7: push edx +0x4cded8: call 0x488054 +0x4cdedd: pop ecx +0x4cdede: mov ecx, dword ptr [ebx + 0x31c] +0x4cdee4: push ecx +0x4cdee5: call 0x491c2c +0x4cdeea: pop ecx +0x4cdeeb: push 0x3df5c28f +0x4cdef0: push 0x3df5c28f +0x4cdef5: push 0x3df5c28f +0x4cdefa: mov eax, dword ptr [ebx + 0x31c] +0x4cdf00: push eax +0x4cdf01: call 0x491cc4 +0x4cdf06: add esp, 0x10 +0x4cdf09: push 0xbf800000 +0x4cdf0e: fld xword ptr [0x4cee64] ; [0x4cee64]=3.29642e-23f +0x4cdf14: mov edx, dword ptr [ebx + 0x254] +0x4cdf1a: fmul dword ptr [edx + 4] +0x4cdf1d: fadd dword ptr [0x4cee70] ; [0x4cee70]=-0.08f +0x4cdf23: add esp, -4 +0x4cdf26: fstp dword ptr [esp] +0x4cdf29: fld xword ptr [0x4cee64] ; [0x4cee64]=3.29642e-23f +0x4cdf2f: mov ecx, dword ptr [ebx + 0x254] +0x4cdf35: fmul dword ptr [ecx] +0x4cdf37: fadd dword ptr [0x4cee74] ; [0x4cee74]=-0f +0x4cdf3d: add esp, -4 +0x4cdf40: fstp dword ptr [esp] +0x4cdf43: mov eax, dword ptr [ebx + 0x31c] +0x4cdf49: push eax +0x4cdf4a: call 0x491c58 +0x4cdf4f: add esp, 0x10 +0x4cdf52: mov edx, dword ptr [ebx + 0x31c] +0x4cdf58: push edx +0x4cdf59: call 0x48d3e8 +0x4cdf5e: pop ecx +0x4cdf5f: mov ecx, dword ptr [ebx + 0x254] +0x4cdf65: test byte ptr [ecx + 0x24], 0x20 +0x4cdf69: je 0x4cee55 ; [0x4cee55]=253.908f +0x4cdf6f: lea esi, [ebx + 0x328] +0x4cdf75: push 0x38d1b717 +0x4cdf7a: push esi +0x4cdf7b: mov eax, dword ptr [ebx + 0x324] +0x4cdf81: push eax +0x4cdf82: call 0x4084fc +0x4cdf87: add esp, 0xc +0x4cdf8a: test eax, eax +0x4cdf8c: jne 0x4ce28e ; [0x4ce28e]=1.56131e-37f +0x4cdf92: push 0x38d1b717 +0x4cdf97: push 0x4e0f74 ; [0x4e0f74]=0f +0x4cdf9c: mov edx, dword ptr [ebx + 0x324] +0x4cdfa2: push edx +0x4cdfa3: call 0x4084fc +0x4cdfa8: add esp, 0xc +0x4cdfab: test eax, eax +0x4cdfad: jne 0x4cdfbb ; [0x4cdfbb]=-7.34749e-36f +0x4cdfaf: mov ecx, dword ptr [ebx + 0x254] +0x4cdfb5: test byte ptr [ecx + 0x24], 0x10 +0x4cdfb9: je 0x4cdff7 ; [0x4cdff7]=4.83555e-37f +0x4cdfbb: mov eax, dword ptr [ebx + 0x1c] +0x4cdfbe: test eax, eax +0x4cdfc0: je 0x4cdfed ; [0x4cdfed]=1.18387e+12f +0x4cdfc2: push 1 +0x4cdfc4: mov edx, dword ptr [ebx + 0x284] +0x4cdfca: push edx +0x4cdfcb: call 0x487fbc +0x4cdfd0: add esp, 8 +0x4cdfd3: mov ecx, dword ptr [ebx + 0x284] +0x4cdfd9: push ecx +0x4cdfda: call 0x488030 +0x4cdfdf: pop ecx +0x4cdfe0: mov eax, dword ptr [ebx + 0x284] +0x4cdfe6: push eax +0x4cdfe7: call 0x488054 +0x4cdfec: pop ecx +0x4cdfed: xor edx, edx +0x4cdfef: mov dword ptr [ebx + 0x1c], edx +0x4cdff2: jmp 0x4ce278 ; [0x4ce278]=4.83463e-37f +0x4cdff7: mov ecx, dword ptr [ebx + 0x324] +0x4cdffd: fld dword ptr [ecx + 8] +0x4ce000: fcomp dword ptr [0x4cee78] ; [0x4cee78]=0f +0x4ce006: fnstsw ax +0x4ce008: sahf +0x4ce009: je 0x4ce04b ; [0x4ce04b]=4.83555e-37f +0x4ce00b: mov edx, dword ptr [ebx + 0x324] +0x4ce011: fld dword ptr [edx] +0x4ce013: fsub dword ptr [0x4cee7c] ; [0x4cee7c]=4f +0x4ce019: mov ecx, dword ptr [ebx + 0x324] +0x4ce01f: fdiv dword ptr [ecx + 8] +0x4ce022: fmul qword ptr [0x4cee80] ; [0x4cee80]=-3.089e-27f +0x4ce028: fstp dword ptr [ebp - 8] +0x4ce02b: mov eax, dword ptr [ebx + 0x324] +0x4ce031: fld dword ptr [eax] +0x4ce033: fadd dword ptr [0x4cee7c] ; [0x4cee7c]=4f +0x4ce039: mov edx, dword ptr [ebx + 0x324] +0x4ce03f: fdiv dword ptr [edx + 8] +0x4ce042: fmul qword ptr [0x4cee80] ; [0x4cee80]=-3.089e-27f +0x4ce048: fstp dword ptr [ebp - 0x10] +0x4ce04b: mov ecx, dword ptr [ebx + 0x324] +0x4ce051: fld dword ptr [ecx + 8] +0x4ce054: fcomp dword ptr [0x4cee78] ; [0x4cee78]=0f +0x4ce05a: fnstsw ax +0x4ce05c: sahf +0x4ce05d: jae 0x4ce09f ; [0x4ce09f]=4.83646e-37f +0x4ce05f: fld dword ptr [ebp - 8] +0x4ce062: fcomp qword ptr [0x4cee88] ; [0x4cee88]=-1.58819e-23f +0x4ce068: fnstsw ax +0x4ce06a: sahf +0x4ce06b: jbe 0x4ce07b ; [0x4ce07b]=-5.59061e+17f +0x4ce06d: fld dword ptr [ebp - 0x10] +0x4ce070: fcomp qword ptr [0x4cee88] ; [0x4cee88]=-1.58819e-23f +0x4ce076: fnstsw ax +0x4ce078: sahf +0x4ce079: ja 0x4ce09f ; [0x4ce09f]=4.83646e-37f +0x4ce07b: fld dword ptr [ebp - 8] +0x4ce07e: fcomp qword ptr [0x4cee90] ; [0x4cee90]=-1.58819e-23f +0x4ce084: fnstsw ax +0x4ce086: sahf +0x4ce087: jae 0x4ce181 ; [0x4ce181]=2.87013e-38f +0x4ce08d: fld dword ptr [ebp - 0x10] +0x4ce090: fcomp qword ptr [0x4cee90] ; [0x4cee90]=-1.58819e-23f +0x4ce096: fnstsw ax +0x4ce098: sahf +0x4ce099: jae 0x4ce181 ; [0x4ce181]=2.87013e-38f +0x4ce09f: mov edx, dword ptr [ebx + 0x324] +0x4ce0a5: fld dword ptr [edx] +0x4ce0a7: fcomp dword ptr [0x4cee98] ; [0x4cee98]=-0.0001f +0x4ce0ad: fnstsw ax +0x4ce0af: sahf +0x4ce0b0: jae 0x4ce0b7 ; [0x4ce0b7]=4.83555e-37f +0x4ce0b2: or edx, 0xffffffff +0x4ce0b5: jmp 0x4ce0ce ; [0x4ce0ce]=4.95221e-37f +0x4ce0b7: mov ecx, dword ptr [ebx + 0x324] +0x4ce0bd: fld dword ptr [ecx] +0x4ce0bf: fcomp dword ptr [0x4cee9c] ; [0x4cee9c]=0.0001f +0x4ce0c5: fnstsw ax +0x4ce0c7: sahf +0x4ce0c8: seta dl +0x4ce0cb: and edx, 1 +0x4ce0ce: fld dword ptr [ebx + 0x328] +0x4ce0d4: fcomp dword ptr [0x4cee98] ; [0x4cee98]=-0.0001f +0x4ce0da: fnstsw ax +0x4ce0dc: sahf +0x4ce0dd: jae 0x4ce0e4 ; [0x4ce0e4]=4.95221e-37f +0x4ce0df: or ecx, 0xffffffff +0x4ce0e2: jmp 0x4ce0f9 ; [0x4ce0f9]=1.89371e-31f +0x4ce0e4: fld dword ptr [ebx + 0x328] +0x4ce0ea: fcomp dword ptr [0x4cee9c] ; [0x4cee9c]=0.0001f +0x4ce0f0: fnstsw ax +0x4ce0f2: sahf +0x4ce0f3: seta cl +0x4ce0f6: and ecx, 1 +0x4ce0f9: cmp edx, ecx +0x4ce0fb: jne 0x4ce109 ; [0x4ce109]=1.14805e-37f +0x4ce0fd: mov edx, dword ptr [ebx + 0x1c] +0x4ce100: cmp edx, 2 +0x4ce103: je 0x4ce278 ; [0x4ce278]=4.83463e-37f +0x4ce109: mov dword ptr [ebx + 0x1c], 2 +0x4ce110: push 1 +0x4ce112: mov eax, dword ptr [ebx + 0x284] +0x4ce118: push eax +0x4ce119: call 0x487fbc +0x4ce11e: add esp, 8 +0x4ce121: mov edx, dword ptr [ebx + 0x324] +0x4ce127: fld dword ptr [edx] +0x4ce129: fcomp dword ptr [0x4cee78] ; [0x4cee78]=0f +0x4ce12f: fnstsw ax +0x4ce131: sahf +0x4ce132: jbe 0x4ce14c ; [0x4ce14c]=1.85518e-37f +0x4ce134: mov edx, dword ptr [ebx + 0x280] +0x4ce13a: push edx +0x4ce13b: mov ecx, dword ptr [ebx + 0x284] +0x4ce141: push ecx +0x4ce142: call 0x488850 +0x4ce147: add esp, 8 +0x4ce14a: jmp 0x4ce162 ; [0x4ce162]=1.94758e-37f +0x4ce14c: mov eax, dword ptr [ebx + 0x27c] +0x4ce152: push eax +0x4ce153: mov edx, dword ptr [ebx + 0x284] +0x4ce159: push edx +0x4ce15a: call 0x488850 +0x4ce15f: add esp, 8 +0x4ce162: mov ecx, dword ptr [ebx + 0x284] +0x4ce168: push ecx +0x4ce169: call 0x488030 +0x4ce16e: pop ecx +0x4ce16f: mov eax, dword ptr [ebx + 0x284] +0x4ce175: push eax +0x4ce176: call 0x488054 +0x4ce17b: pop ecx +0x4ce17c: jmp 0x4ce278 ; [0x4ce278]=4.83463e-37f +0x4ce181: mov dword ptr [ebx + 0x1c], 1 +0x4ce188: mov edx, dword ptr [ebx + 0x324] +0x4ce18e: fld dword ptr [edx + 4] +0x4ce191: fsub dword ptr [0x4ceea0] ; [0x4ceea0]=1f +0x4ce197: mov ecx, dword ptr [ebx + 0x324] +0x4ce19d: fdiv dword ptr [ecx + 8] +0x4ce1a0: fmul qword ptr [0x4ceea4] ; [0x4ceea4]=-3.089e-27f +0x4ce1a6: fstp dword ptr [ebp - 0xc] +0x4ce1a9: mov eax, dword ptr [ebx + 0x324] +0x4ce1af: fld dword ptr [eax + 4] +0x4ce1b2: fadd dword ptr [0x4ceeac] ; [0x4ceeac]=11.5f +0x4ce1b8: mov edx, dword ptr [ebx + 0x324] +0x4ce1be: fdiv dword ptr [edx + 8] +0x4ce1c1: fmul qword ptr [0x4ceea4] ; [0x4ceea4]=-3.089e-27f +0x4ce1c7: fstp dword ptr [ebp - 0x14] +0x4ce1ca: push 1 +0x4ce1cc: mov ecx, dword ptr [ebx + 0x284] +0x4ce1d2: push ecx +0x4ce1d3: call 0x487fbc +0x4ce1d8: add esp, 8 +0x4ce1db: mov eax, dword ptr [ebx + 0x284] +0x4ce1e1: push eax +0x4ce1e2: call 0x4880e8 +0x4ce1e7: pop ecx +0x4ce1e8: push dword ptr [ebp - 0xc] +0x4ce1eb: push dword ptr [ebp - 8] +0x4ce1ee: mov eax, dword ptr [ebx + 0x284] +0x4ce1f4: push eax +0x4ce1f5: call 0x488408 +0x4ce1fa: add esp, 0xc +0x4ce1fd: push dword ptr [ebp - 0x14] +0x4ce200: push dword ptr [ebp - 8] +0x4ce203: mov eax, dword ptr [ebx + 0x284] +0x4ce209: push eax +0x4ce20a: call 0x488408 +0x4ce20f: add esp, 0xc +0x4ce212: push dword ptr [ebp - 0x14] +0x4ce215: push dword ptr [ebp - 0x10] +0x4ce218: mov eax, dword ptr [ebx + 0x284] +0x4ce21e: push eax +0x4ce21f: call 0x488408 +0x4ce224: add esp, 0xc +0x4ce227: push dword ptr [ebp - 0xc] +0x4ce22a: push dword ptr [ebp - 0x10] +0x4ce22d: mov eax, dword ptr [ebx + 0x284] +0x4ce233: push eax +0x4ce234: call 0x488408 +0x4ce239: add esp, 0xc +0x4ce23c: push dword ptr [ebp - 0xc] +0x4ce23f: push dword ptr [ebp - 8] +0x4ce242: mov eax, dword ptr [ebx + 0x284] +0x4ce248: push eax +0x4ce249: call 0x488408 +0x4ce24e: add esp, 0xc +0x4ce251: mov edx, dword ptr [ebx + 0x284] +0x4ce257: push edx +0x4ce258: call 0x48814c +0x4ce25d: pop ecx +0x4ce25e: mov ecx, dword ptr [ebx + 0x284] +0x4ce264: push ecx +0x4ce265: call 0x488030 +0x4ce26a: pop ecx +0x4ce26b: mov eax, dword ptr [ebx + 0x284] +0x4ce271: push eax +0x4ce272: call 0x488054 +0x4ce277: pop ecx +0x4ce278: mov eax, dword ptr [ebx + 0x324] +0x4ce27e: lea esi, [ebx + 0x328] +0x4ce284: push eax +0x4ce285: push esi +0x4ce286: call 0x408440 +0x4ce28b: add esp, 8 +0x4ce28e: mov eax, dword ptr [ebx + 0x254] +0x4ce294: mov ecx, dword ptr [ebx + 0x20] +0x4ce297: and ecx, 0xf +0x4ce29a: mov edx, dword ptr [eax + 0x24] +0x4ce29d: and edx, 0xf +0x4ce2a0: cmp edx, ecx +0x4ce2a2: je 0x4ce2c2 ; [0x4ce2c2]=-8.34376e-37f +0x4ce2a4: mov edx, dword ptr [ebx + 0x254] +0x4ce2aa: mov eax, dword ptr [ebx + 0x20] +0x4ce2ad: and eax, 0xfffffff0 +0x4ce2b0: mov ecx, dword ptr [edx + 0x24] +0x4ce2b3: and ecx, 0xf +0x4ce2b6: or eax, ecx +0x4ce2b8: mov dword ptr [ebx + 0x20], eax +0x4ce2bb: mov dword ptr [ebx + 0x34], 0xffffffff +0x4ce2c2: xor esi, esi +0x4ce2c4: lea eax, [ebx + 0x130] +0x4ce2ca: jmp 0x4ce2f6 ; [0x4ce2f6]=0.0028126f +0x4ce2cc: mov edx, dword ptr [eax] +0x4ce2ce: mov ecx, dword ptr [eax + 0x28] +0x4ce2d1: mov edi, dword ptr [eax - 0x54] +0x4ce2d4: mov edx, dword ptr [edx + 0x14] +0x4ce2d7: cmp edx, edi +0x4ce2d9: mov ecx, dword ptr [ecx + 0x14] +0x4ce2dc: jne 0x4ce2e5 ; [0x4ce2e5]=-4.14832e-33f +0x4ce2de: mov edi, dword ptr [eax - 0x2c] +0x4ce2e1: cmp ecx, edi +0x4ce2e3: je 0x4ce2f2 ; [0x4ce2f2]=4.52595e-36f +0x4ce2e5: mov dword ptr [eax - 0x54], edx +0x4ce2e8: mov dword ptr [eax - 0x2c], ecx +0x4ce2eb: mov dword ptr [ebx + 0x34], 0xffffffff +0x4ce2f2: inc esi +0x4ce2f3: add eax, 4 +0x4ce2f6: mov edx, dword ptr [ebx + 0x38] +0x4ce2f9: cmp esi, edx +0x4ce2fb: jl 0x4ce2cc ; [0x4ce2cc]=284804f +0x4ce2fd: mov eax, dword ptr [ebx + 0x34] +0x4ce300: mov ecx, dword ptr [ebx + 0x38] +0x4ce303: cmp eax, ecx +0x4ce305: je 0x4ce3e2 ; [0x4ce3e2]=5.66298e-37f +0x4ce30b: push 1 +0x4ce30d: mov eax, dword ptr [ebx + 0x2d8] +0x4ce313: push eax +0x4ce314: call 0x487fbc +0x4ce319: add esp, 8 +0x4ce31c: xor edx, edx +0x4ce31e: mov dword ptr [ebx + 0x34], edx +0x4ce321: jmp 0x4ce3ba ; [0x4ce3ba]=-3.47176e-32f +0x4ce326: mov ecx, dword ptr [ebx + eax*4 + 0x3c] +0x4ce32a: mov edx, dword ptr [ebx + 0x20] +0x4ce32d: and ecx, edx +0x4ce32f: je 0x4ce3b7 ; [0x4ce3b7]=-3.47179e-32f +0x4ce335: mov ecx, dword ptr [ebx + eax*4 + 0x104] +0x4ce33c: mov edx, dword ptr [ebx + eax*4 + 0xb4] +0x4ce343: cmp ecx, edx +0x4ce345: je 0x4ce3b7 ; [0x4ce3b7]=-3.47179e-32f +0x4ce347: mov ecx, dword ptr [ebx + eax*4 + 0xdc] +0x4ce34e: mov edx, dword ptr [ebx + eax*4 + 0x64] +0x4ce352: cmp ecx, edx +0x4ce354: jne 0x4ce36f ; [0x4ce36f]=-3.47176e-32f +0x4ce356: mov eax, dword ptr [ebx + eax*4 + 0x288] +0x4ce35d: push eax +0x4ce35e: mov ecx, dword ptr [ebx + 0x2d8] +0x4ce364: push ecx +0x4ce365: call 0x488850 +0x4ce36a: add esp, 8 +0x4ce36d: jmp 0x4ce3b7 ; [0x4ce3b7]=-3.47179e-32f +0x4ce36f: mov eax, dword ptr [ebx + 0x34] +0x4ce372: mov edx, dword ptr [ebx + eax*4 + 0xdc] +0x4ce379: mov ecx, dword ptr [ebx + eax*4 + 0x8c] +0x4ce380: cmp edx, ecx +0x4ce382: jne 0x4ce39d ; [0x4ce39d]=-3.47236e-32f +0x4ce384: mov eax, dword ptr [ebx + eax*4 + 0x2b0] +0x4ce38b: push eax +0x4ce38c: mov edx, dword ptr [ebx + 0x2d8] +0x4ce392: push edx +0x4ce393: call 0x488850 +0x4ce398: add esp, 8 +0x4ce39b: jmp 0x4ce3b7 ; [0x4ce3b7]=-3.47179e-32f +0x4ce39d: mov ecx, dword ptr [ebx + 0x34] +0x4ce3a0: mov eax, dword ptr [ebx + ecx*4 + 0x288] +0x4ce3a7: push eax +0x4ce3a8: mov edx, dword ptr [ebx + 0x2d8] +0x4ce3ae: push edx +0x4ce3af: call 0x488850 +0x4ce3b4: add esp, 8 +0x4ce3b7: inc dword ptr [ebx + 0x34] +0x4ce3ba: mov eax, dword ptr [ebx + 0x34] +0x4ce3bd: mov edx, dword ptr [ebx + 0x38] +0x4ce3c0: cmp eax, edx +0x4ce3c2: jl 0x4ce326 ; [0x4ce326]=0.0160277f +0x4ce3c8: mov ecx, dword ptr [ebx + 0x2d8] +0x4ce3ce: push ecx +0x4ce3cf: call 0x488030 +0x4ce3d4: pop ecx +0x4ce3d5: mov eax, dword ptr [ebx + 0x2d8] +0x4ce3db: push eax +0x4ce3dc: call 0x488054 +0x4ce3e1: pop ecx +0x4ce3e2: mov esi, dword ptr [ebx + 0x340] +0x4ce3e8: push 0x38d1b717 +0x4ce3ed: push esi +0x4ce3ee: lea edx, [ebx + 0x334] +0x4ce3f4: push edx +0x4ce3f5: call 0x4084fc +0x4ce3fa: add esp, 0xc +0x4ce3fd: test eax, eax +0x4ce3ff: je 0x4ce413 ; [0x4ce413]=-2.21902e+15f +0x4ce401: fld dword ptr [ebp - 4] +0x4ce404: fcomp dword ptr [ebx + 0x12c] +0x4ce40a: fnstsw ax +0x4ce40c: sahf +0x4ce40d: jbe 0x4ce6e0 ; [0x4ce6e0]=8.98891e-38f +0x4ce413: fld dword ptr [ebp - 4] +0x4ce416: fadd dword ptr [0x4ceea0] ; [0x4ceea0]=1f +0x4ce41c: fstp dword ptr [ebx + 0x12c] +0x4ce422: push 0x38d1b717 +0x4ce427: push 0x4e0f74 ; [0x4e0f74]=0f +0x4ce42c: mov eax, dword ptr [ebx + 0x340] +0x4ce432: xor edi, edi +0x4ce434: push eax +0x4ce435: call 0x4084fc +0x4ce43a: add esp, 0xc +0x4ce43d: test eax, eax +0x4ce43f: jne 0x4ce513 ; [0x4ce513]=5.65747e-37f +0x4ce445: mov edx, dword ptr [ebx + 0x340] +0x4ce44b: mov dword ptr [ebp - 0x18], edx +0x4ce44e: push 0x38d1b717 +0x4ce453: mov ecx, dword ptr [ebp - 0x18] +0x4ce456: push ecx +0x4ce457: lea eax, [ebx + 0x334] +0x4ce45d: push eax +0x4ce45e: call 0x4084fc +0x4ce463: add esp, 0xc +0x4ce466: test eax, eax +0x4ce468: jne 0x4ce513 ; [0x4ce513]=5.65747e-37f +0x4ce46e: mov edx, dword ptr [ebx + 0x340] +0x4ce474: mov ecx, dword ptr [edx] +0x4ce476: mov dword ptr [ebp - 0x20], ecx +0x4ce479: lea ecx, [ebp - 0x20] +0x4ce47c: mov eax, dword ptr [ebx + 0x340] +0x4ce482: mov edx, dword ptr [eax + 8] +0x4ce485: lea eax, [ebp - 0x28] +0x4ce488: mov dword ptr [ebp - 0x1c], edx +0x4ce48b: push ecx +0x4ce48c: push eax +0x4ce48d: call 0x4039e3 +0x4ce492: add esp, 8 +0x4ce495: push 0x3d4ccccd +0x4ce49a: lea edx, [ebp - 0x28] +0x4ce49d: push edx +0x4ce49e: lea ecx, [ebp - 0x28] +0x4ce4a1: push ecx +0x4ce4a2: call 0x403973 +0x4ce4a7: add esp, 0xc +0x4ce4aa: push 0x1c +0x4ce4ac: call 0x402298 ; operator new +0x4ce4b1: pop ecx +0x4ce4b2: mov esi, eax +0x4ce4b4: test eax, eax +0x4ce4b6: je 0x4ce4ec ; [0x4ce4ec]=1.89443e+13f +0x4ce4b8: mov edx, dword ptr [ebp - 4] +0x4ce4bb: mov dword ptr [ebp - 0x30], edx +0x4ce4be: push 1 +0x4ce4c0: push esi +0x4ce4c1: call 0x415e90 +0x4ce4c6: add esp, 8 +0x4ce4c9: mov dword ptr [esi], 0x51db40 ; [0x51db40]=7.07817e-39f +0x4ce4cf: mov ecx, dword ptr [ebp - 0x30] +0x4ce4d2: mov dword ptr [esi + 0x14], ecx +0x4ce4d5: mov eax, dword ptr [ebp - 0x28] +0x4ce4d8: mov dword ptr [esi + 0xc], eax +0x4ce4db: mov eax, dword ptr [ebp - 0x24] +0x4ce4de: mov dword ptr [esi + 0x10], eax +0x4ce4e1: mov dword ptr [esi + 0x18], 1 +0x4ce4e8: mov edx, esi +0x4ce4ea: jmp 0x4ce4ee ; [0x4ce4ee]=-8.17881e-32f +0x4ce4ec: mov edx, esi +0x4ce4ee: mov dword ptr [ebp - 0x2c], edx +0x4ce4f1: mov eax, dword ptr [ebp - 0x2c] +0x4ce4f4: mov dword ptr [ebp - 0x34], eax +0x4ce4f7: lea eax, [ebx + 0x344] +0x4ce4fd: mov ecx, dword ptr [ebp - 0x34] +0x4ce500: push ecx +0x4ce501: push eax +0x4ce502: mov edx, dword ptr [ebx + 0x344] +0x4ce508: call dword ptr [edx + 4] +0x4ce50b: add esp, 8 +0x4ce50e: mov edi, 1 +0x4ce513: mov eax, dword ptr [ebx + 0x340] +0x4ce519: lea edx, [ebx + 0x334] +0x4ce51f: mov dword ptr [ebp - 0x38], eax +0x4ce522: mov dword ptr [ebp - 0x3c], edx +0x4ce525: mov ecx, dword ptr [ebp - 0x38] +0x4ce528: push ecx +0x4ce529: mov eax, dword ptr [ebp - 0x3c] +0x4ce52c: push eax +0x4ce52d: call 0x408440 +0x4ce532: add esp, 8 +0x4ce535: lea edx, [ebx + 0x344] +0x4ce53b: push edx +0x4ce53c: lea ecx, [ebp - 0x9c] +0x4ce542: push ecx +0x4ce543: call 0x4d1286 ; [0x4d1286]=2.0319e+12f +0x4ce548: add esp, 8 +0x4ce54b: jmp 0x4ce596 ; [0x4ce596]=-3.03757e+38f +0x4ce54d: fld dword ptr [ebp - 4] +0x4ce550: fsub dword ptr [esi + 0x14] +0x4ce553: fstp dword ptr [ebp - 0x40] +0x4ce556: fld dword ptr [ebp - 0x40] +0x4ce559: fcomp dword ptr [0x4ceeb0] ; [0x4ceeb0]=2f +0x4ce55f: fnstsw ax +0x4ce561: sahf +0x4ce562: jbe 0x4ce575 ; [0x4ce575]=-1.69125e+15f +0x4ce564: mov edx, dword ptr [esi + 0x18] +0x4ce567: test edx, edx +0x4ce569: je 0x4ce575 ; [0x4ce575]=-1.69125e+15f +0x4ce56b: xor ecx, ecx +0x4ce56d: mov edi, 1 +0x4ce572: mov dword ptr [esi + 0x18], ecx +0x4ce575: fld dword ptr [ebp - 0x40] +0x4ce578: fcomp dword ptr [0x4ceeb4] ; [0x4ceeb4]=6f +0x4ce57e: fnstsw ax +0x4ce580: sahf +0x4ce581: jbe 0x4ce596 ; [0x4ce596]=-3.03757e+38f +0x4ce583: test esi, esi +0x4ce585: je 0x4ce591 ; [0x4ce591]=6.2638e-43f +0x4ce587: push 3 +0x4ce589: push esi +0x4ce58a: mov edx, dword ptr [esi] +0x4ce58c: call dword ptr [edx] +0x4ce58e: add esp, 8 +0x4ce591: mov edi, 1 +0x4ce596: lea eax, [ebp - 0x9c] +0x4ce59c: push eax +0x4ce59d: mov edx, dword ptr [ebp - 0x9c] +0x4ce5a3: call dword ptr [edx + 0x28] +0x4ce5a6: pop ecx +0x4ce5a7: mov esi, eax +0x4ce5a9: test eax, eax +0x4ce5ab: jne 0x4ce54d ; [0x4ce54d]=-2.21902e+15f +0x4ce5ad: test edi, edi +0x4ce5af: je 0x4ce6cf ; [0x4ce6cf]=-8.69038e-31f +0x4ce5b5: mov dword ptr [ebp - 0x44], 1 +0x4ce5bc: push 1 +0x4ce5be: mov edx, dword ptr [ebx + 0x2e8] +0x4ce5c4: push edx +0x4ce5c5: call 0x487fbc +0x4ce5ca: add esp, 8 +0x4ce5cd: push 0 +0x4ce5cf: push 0x3f400000 +0x4ce5d4: push 0x3f400000 +0x4ce5d9: mov ecx, dword ptr [ebx + 0x2e8] +0x4ce5df: push ecx +0x4ce5e0: call 0x488630 +0x4ce5e5: add esp, 0x10 +0x4ce5e8: mov eax, dword ptr [ebx + 0x2e8] +0x4ce5ee: push eax +0x4ce5ef: call 0x488278 +0x4ce5f4: pop ecx +0x4ce5f5: lea edx, [ebp - 0x9c] +0x4ce5fb: push edx +0x4ce5fc: mov ecx, dword ptr [ebp - 0x9c] +0x4ce602: call dword ptr [ecx + 4] +0x4ce605: pop ecx +0x4ce606: jmp 0x4ce675 ; [0x4ce675]=-3.0384e+38f +0x4ce608: mov eax, dword ptr [esi + 0x18] +0x4ce60b: test eax, eax +0x4ce60d: je 0x4ce64d ; [0x4ce64d]=9.73471e-39f +0x4ce60f: mov edx, dword ptr [ebp - 0x44] +0x4ce612: test edx, edx +0x4ce614: je 0x4ce64d ; [0x4ce64d]=9.73471e-39f +0x4ce616: mov ecx, dword ptr [ebx + 0x2e8] +0x4ce61c: push ecx +0x4ce61d: call 0x4882dc +0x4ce622: pop ecx +0x4ce623: push 0 +0x4ce625: push 0 +0x4ce627: push 0x3f400000 +0x4ce62c: mov eax, dword ptr [ebx + 0x2e8] +0x4ce632: push eax +0x4ce633: call 0x488630 +0x4ce638: add esp, 0x10 +0x4ce63b: mov edx, dword ptr [ebx + 0x2e8] +0x4ce641: push edx +0x4ce642: call 0x488278 +0x4ce647: pop ecx +0x4ce648: xor ecx, ecx +0x4ce64a: mov dword ptr [ebp - 0x44], ecx +0x4ce64d: push 0 +0x4ce64f: push 0 +0x4ce651: mov eax, dword ptr [ebx + 0x2e8] +0x4ce657: push eax +0x4ce658: call 0x488408 +0x4ce65d: add esp, 0xc +0x4ce660: push dword ptr [esi + 0x10] +0x4ce663: push dword ptr [esi + 0xc] +0x4ce666: mov eax, dword ptr [ebx + 0x2e8] +0x4ce66c: push eax +0x4ce66d: call 0x488408 +0x4ce672: add esp, 0xc +0x4ce675: lea edx, [ebp - 0x9c] +0x4ce67b: push edx +0x4ce67c: mov ecx, dword ptr [ebp - 0x9c] +0x4ce682: call dword ptr [ecx + 0x28] +0x4ce685: pop ecx +0x4ce686: mov esi, eax +0x4ce688: test eax, eax +0x4ce68a: jne 0x4ce608 ; [0x4ce608]=-7.15996e-36f +0x4ce690: mov edx, dword ptr [ebx + 0x2e8] +0x4ce696: push edx +0x4ce697: call 0x4882dc +0x4ce69c: pop ecx +0x4ce69d: push 0 +0x4ce69f: push 0x3f400000 +0x4ce6a4: push 0 +0x4ce6a6: mov ecx, dword ptr [ebx + 0x2e8] +0x4ce6ac: push ecx +0x4ce6ad: call 0x488630 +0x4ce6b2: add esp, 0x10 +0x4ce6b5: mov eax, dword ptr [ebx + 0x2e8] +0x4ce6bb: push eax +0x4ce6bc: call 0x488030 +0x4ce6c1: pop ecx +0x4ce6c2: mov edx, dword ptr [ebx + 0x2e8] +0x4ce6c8: push edx +0x4ce6c9: call 0x488054 +0x4ce6ce: pop ecx +0x4ce6cf: push 2 +0x4ce6d1: lea ecx, [ebp - 0x9c] +0x4ce6d7: push ecx +0x4ce6d8: call 0x4d12e3 ; [0x4d12e3]=2.0319e+12f +0x4ce6dd: add esp, 8 +0x4ce6e0: mov esi, dword ptr [ebx + 0x1f4] +0x4ce6e6: mov eax, dword ptr [esi] +0x4ce6e8: mov dword ptr [ebp - 0x48], eax +0x4ce6eb: mov edx, dword ptr [ebx + 0x1f8] +0x4ce6f1: mov dword ptr [ebp - 0x4c], edx +0x4ce6f4: fld dword ptr [ebp - 0x4c] +0x4ce6f7: fsub dword ptr [ebp - 0x48] +0x4ce6fa: add esp, -8 +0x4ce6fd: fstp qword ptr [esp] +0x4ce700: call 0x4dcd00 ; [0x4dcd00]=-3.9133e-22f +0x4ce705: add esp, 8 +0x4ce708: fcomp dword ptr [0x4cee9c] ; [0x4cee9c]=0.0001f +0x4ce70e: fnstsw ax +0x4ce710: sahf +0x4ce711: setbe dl +0x4ce714: and edx, 1 +0x4ce717: test edx, edx +0x4ce719: jne 0x4ce7e5 ; [0x4ce7e5]=8.40116e-38f +0x4ce71f: mov ecx, dword ptr [ebx + 0x1f4] +0x4ce725: lea eax, [ebx + 0x1f8] +0x4ce72b: mov dword ptr [ebp - 0x54], ecx +0x4ce72e: mov dword ptr [ebp - 0x58], eax +0x4ce731: mov edx, dword ptr [ebp - 0x54] +0x4ce734: mov eax, dword ptr [ebp - 0x58] +0x4ce737: mov ecx, dword ptr [edx] +0x4ce739: mov dword ptr [eax], ecx +0x4ce73b: lea ecx, [ebp - 0x88] +0x4ce741: mov edx, dword ptr [ebx + 0x1f8] +0x4ce747: mov dword ptr [ebp - 0x50], edx +0x4ce74a: push ecx +0x4ce74b: call 0x488b80 +0x4ce750: pop ecx +0x4ce751: fld dword ptr [0x4ceeb8] ; [0x4ceeb8]=57.2958f +0x4ce757: fmul dword ptr [ebp - 0x50] +0x4ce75a: add esp, -4 +0x4ce75d: lea eax, [ebp - 0x88] +0x4ce763: fstp dword ptr [esp] +0x4ce766: push eax +0x4ce767: call 0x488bc8 +0x4ce76c: add esp, 8 +0x4ce76f: fld dword ptr [ebx + 0x21c] +0x4ce775: fmul dword ptr [0x4ceebc] ; [0x4ceebc]=3f +0x4ce77b: fsubr dword ptr [ebx + 0x214] +0x4ce781: fsub dword ptr [0x4ceec0] ; [0x4ceec0]=0.03f +0x4ce787: add esp, -4 +0x4ce78a: lea ecx, [ebp - 0x88] +0x4ce790: fstp dword ptr [esp] +0x4ce793: push dword ptr [ebx + 0x210] +0x4ce799: push ecx +0x4ce79a: call 0x488bac +0x4ce79f: add esp, 0xc +0x4ce7a2: push 1 +0x4ce7a4: mov eax, dword ptr [ebx + 0x278] +0x4ce7aa: push eax +0x4ce7ab: call 0x487fbc +0x4ce7b0: add esp, 8 +0x4ce7b3: lea edx, [ebp - 0x88] +0x4ce7b9: push 0 +0x4ce7bb: push edx +0x4ce7bc: mov ecx, dword ptr [ebx + 0x278] +0x4ce7c2: push ecx +0x4ce7c3: call 0x4887b0 +0x4ce7c8: add esp, 0xc +0x4ce7cb: mov eax, dword ptr [ebx + 0x278] +0x4ce7d1: push eax +0x4ce7d2: call 0x488030 +0x4ce7d7: pop ecx +0x4ce7d8: mov edx, dword ptr [ebx + 0x278] +0x4ce7de: push edx +0x4ce7df: call 0x488054 +0x4ce7e4: pop ecx +0x4ce7e5: mov esi, dword ptr [ebx + 0x1e4] +0x4ce7eb: mov ecx, dword ptr [esi] +0x4ce7ed: mov dword ptr [ebp - 0x5c], ecx +0x4ce7f0: mov eax, dword ptr [ebx + 0x1e8] +0x4ce7f6: mov dword ptr [ebp - 0x60], eax +0x4ce7f9: fld dword ptr [ebp - 0x60] +0x4ce7fc: fsub dword ptr [ebp - 0x5c] +0x4ce7ff: add esp, -8 +0x4ce802: fstp qword ptr [esp] +0x4ce805: call 0x4dcd00 ; [0x4dcd00]=-3.9133e-22f +0x4ce80a: add esp, 8 +0x4ce80d: fcomp dword ptr [0x4cee9c] ; [0x4cee9c]=0.0001f +0x4ce813: fnstsw ax +0x4ce815: sahf +0x4ce816: setbe dl +0x4ce819: and edx, 1 +0x4ce81c: test edx, edx +0x4ce81e: jne 0x4cea9b ; [0x4cea9b]=1.20912e-37f +0x4ce824: mov ecx, dword ptr [ebx + 0x1e4] +0x4ce82a: mov dword ptr [ebp - 0x64], ecx +0x4ce82d: lea eax, [ebx + 0x1e8] +0x4ce833: mov edx, dword ptr [ebp - 0x64] +0x4ce836: mov ecx, dword ptr [edx] +0x4ce838: mov dword ptr [eax], ecx +0x4ce83a: mov eax, dword ptr [ebx + 0x1e8] +0x4ce840: mov dword ptr [ebp - 0x68], eax +0x4ce843: fld dword ptr [ebp - 0x68] +0x4ce846: fsub dword ptr [0x4cee78] ; [0x4cee78]=0f +0x4ce84c: add esp, -8 +0x4ce84f: fstp qword ptr [esp] +0x4ce852: call 0x4dcd00 ; [0x4dcd00]=-3.9133e-22f +0x4ce857: add esp, 8 +0x4ce85a: fcomp dword ptr [0x4cee9c] ; [0x4cee9c]=0.0001f +0x4ce860: fnstsw ax +0x4ce862: sahf +0x4ce863: setbe dl +0x4ce866: and edx, 1 +0x4ce869: test edx, edx +0x4ce86b: je 0x4ce8c2 ; [0x4ce8c2]=1.1205e-37f +0x4ce86d: lea ecx, [ebp - 0x88] +0x4ce873: push ecx +0x4ce874: call 0x488b80 +0x4ce879: pop ecx +0x4ce87a: push 1 +0x4ce87c: mov eax, dword ptr [ebx + 0x270] +0x4ce882: push eax +0x4ce883: call 0x487fbc +0x4ce888: add esp, 8 +0x4ce88b: lea edx, [ebp - 0x88] +0x4ce891: push 0 +0x4ce893: push edx +0x4ce894: mov ecx, dword ptr [ebx + 0x270] +0x4ce89a: push ecx +0x4ce89b: call 0x4887b0 +0x4ce8a0: add esp, 0xc +0x4ce8a3: mov eax, dword ptr [ebx + 0x270] +0x4ce8a9: push eax +0x4ce8aa: call 0x488030 +0x4ce8af: pop ecx +0x4ce8b0: mov edx, dword ptr [ebx + 0x270] +0x4ce8b6: push edx +0x4ce8b7: call 0x488054 +0x4ce8bc: pop ecx +0x4ce8bd: jmp 0x4cea9b ; [0x4cea9b]=1.20912e-37f +0x4ce8c2: fld dword ptr [ebx + 0x218] +0x4ce8c8: fmul dword ptr [0x4ceec4] ; [0x4ceec4]=0.5f +0x4ce8ce: fadd dword ptr [ebx + 0x210] +0x4ce8d4: fstp dword ptr [ebp - 0x6c] +0x4ce8d7: fld dword ptr [ebx + 0x1e8] +0x4ce8dd: fcomp dword ptr [0x4cee78] ; [0x4cee78]=0f +0x4ce8e3: fnstsw ax +0x4ce8e5: sahf +0x4ce8e6: jbe 0x4ce9c7 ; [0x4ce9c7]=1.1205e-37f +0x4ce8ec: fld dword ptr [ebx + 0x218] +0x4ce8f2: fmul dword ptr [0x4ceec4] ; [0x4ceec4]=0.5f +0x4ce8f8: fchs +0x4ce8fa: fld dword ptr [ebx + 0x1e8] +0x4ce900: fdiv dword ptr [ebx + 0x1f0] +0x4ce906: fmulp st(1) +0x4ce908: lea edx, [ebp - 0x88] +0x4ce90e: fstp dword ptr [ebp - 0x70] +0x4ce911: push edx +0x4ce912: call 0x488b80 +0x4ce917: pop ecx +0x4ce918: push 0 +0x4ce91a: push dword ptr [ebp - 0x70] +0x4ce91d: lea eax, [ebp - 0x88] +0x4ce923: push eax +0x4ce924: call 0x488bac +0x4ce929: add esp, 0xc +0x4ce92c: push 1 +0x4ce92e: mov edx, dword ptr [ebx + 0x270] +0x4ce934: push edx +0x4ce935: call 0x487fbc +0x4ce93a: add esp, 8 +0x4ce93d: mov ecx, dword ptr [ebx + 0x270] +0x4ce943: push ecx +0x4ce944: call 0x488278 +0x4ce949: pop ecx +0x4ce94a: push dword ptr [ebx + 0x214] +0x4ce950: push dword ptr [ebp - 0x6c] +0x4ce953: mov ecx, dword ptr [ebx + 0x270] +0x4ce959: push ecx +0x4ce95a: call 0x488408 +0x4ce95f: add esp, 0xc +0x4ce962: push dword ptr [ebx + 0x214] +0x4ce968: fld dword ptr [ebp - 0x6c] +0x4ce96b: fadd dword ptr [ebp - 0x70] +0x4ce96e: add esp, -4 +0x4ce971: fstp dword ptr [esp] +0x4ce974: mov edx, dword ptr [ebx + 0x270] +0x4ce97a: push edx +0x4ce97b: call 0x488408 +0x4ce980: add esp, 0xc +0x4ce983: mov ecx, dword ptr [ebx + 0x270] +0x4ce989: push ecx +0x4ce98a: call 0x4882dc +0x4ce98f: pop ecx +0x4ce990: lea eax, [ebp - 0x88] +0x4ce996: push 0 +0x4ce998: push eax +0x4ce999: mov edx, dword ptr [ebx + 0x270] +0x4ce99f: push edx +0x4ce9a0: call 0x4887b0 +0x4ce9a5: add esp, 0xc +0x4ce9a8: mov ecx, dword ptr [ebx + 0x270] +0x4ce9ae: push ecx +0x4ce9af: call 0x488030 +0x4ce9b4: pop ecx +0x4ce9b5: mov eax, dword ptr [ebx + 0x270] +0x4ce9bb: push eax +0x4ce9bc: call 0x488054 +0x4ce9c1: pop ecx +0x4ce9c2: jmp 0x4cea9b ; [0x4cea9b]=1.20912e-37f +0x4ce9c7: fld dword ptr [ebx + 0x218] +0x4ce9cd: fmul dword ptr [0x4ceec4] ; [0x4ceec4]=0.5f +0x4ce9d3: fld dword ptr [ebx + 0x1e8] +0x4ce9d9: fdiv dword ptr [ebx + 0x1ec] +0x4ce9df: fmulp st(1) +0x4ce9e1: lea edx, [ebp - 0x88] +0x4ce9e7: fstp dword ptr [ebp - 0x70] +0x4ce9ea: push edx +0x4ce9eb: call 0x488b80 +0x4ce9f0: pop ecx +0x4ce9f1: push 0 +0x4ce9f3: push dword ptr [ebp - 0x70] +0x4ce9f6: lea eax, [ebp - 0x88] +0x4ce9fc: push eax +0x4ce9fd: call 0x488bac +0x4cea02: add esp, 0xc +0x4cea05: push 1 +0x4cea07: mov edx, dword ptr [ebx + 0x270] +0x4cea0d: push edx +0x4cea0e: call 0x487fbc +0x4cea13: add esp, 8 +0x4cea16: mov ecx, dword ptr [ebx + 0x270] +0x4cea1c: push ecx +0x4cea1d: call 0x488278 +0x4cea22: pop ecx +0x4cea23: push dword ptr [ebx + 0x214] +0x4cea29: push dword ptr [ebp - 0x6c] +0x4cea2c: mov ecx, dword ptr [ebx + 0x270] +0x4cea32: push ecx +0x4cea33: call 0x488408 +0x4cea38: add esp, 0xc +0x4cea3b: push dword ptr [ebx + 0x214] +0x4cea41: fld dword ptr [ebp - 0x6c] +0x4cea44: fadd dword ptr [ebp - 0x70] +0x4cea47: add esp, -4 +0x4cea4a: fstp dword ptr [esp] +0x4cea4d: mov edx, dword ptr [ebx + 0x270] +0x4cea53: push edx +0x4cea54: call 0x488408 +0x4cea59: add esp, 0xc +0x4cea5c: mov ecx, dword ptr [ebx + 0x270] +0x4cea62: push ecx +0x4cea63: call 0x4882dc +0x4cea68: pop ecx +0x4cea69: lea eax, [ebp - 0x88] +0x4cea6f: push 0 +0x4cea71: push eax +0x4cea72: mov edx, dword ptr [ebx + 0x270] +0x4cea78: push edx +0x4cea79: call 0x4887b0 +0x4cea7e: add esp, 0xc +0x4cea81: mov ecx, dword ptr [ebx + 0x270] +0x4cea87: push ecx +0x4cea88: call 0x488030 +0x4cea8d: pop ecx +0x4cea8e: mov eax, dword ptr [ebx + 0x270] +0x4cea94: push eax +0x4cea95: call 0x488054 +0x4cea9a: pop ecx +0x4cea9b: mov edx, dword ptr [ebx + 0x224] +0x4ceaa1: fld dword ptr [ebx + 0x228] +0x4ceaa7: fcomp dword ptr [edx] +0x4ceaa9: fnstsw ax +0x4ceaab: sahf +0x4ceaac: je 0x4cebf9 ; [0x4cebf9]=1.56153e-37f +0x4ceab2: mov edx, dword ptr [ebx + 0x224] +0x4ceab8: mov ecx, dword ptr [edx] +0x4ceaba: mov dword ptr [ebx + 0x228], ecx +0x4ceac0: fld dword ptr [ebx + 0x228] +0x4ceac6: fcomp dword ptr [ebx + 0x230] +0x4ceacc: fnstsw ax +0x4ceace: sahf +0x4ceacf: jae 0x4cead9 ; [0x4cead9]=1.23805e-37f +0x4cead1: fld dword ptr [ebx + 0x230] +0x4cead7: jmp 0x4ceaf8 ; [0x4ceaf8]=1.23874e-37f +0x4cead9: fld dword ptr [ebx + 0x228] +0x4ceadf: fcomp dword ptr [ebx + 0x22c] +0x4ceae5: fnstsw ax +0x4ceae7: sahf +0x4ceae8: jbe 0x4ceaf2 ; [0x4ceaf2]=1.23805e-37f +0x4ceaea: fld dword ptr [ebx + 0x22c] +0x4ceaf0: jmp 0x4ceaf8 ; [0x4ceaf8]=1.23874e-37f +0x4ceaf2: fld dword ptr [ebx + 0x228] +0x4ceaf8: fstp dword ptr [ebx + 0x228] +0x4ceafe: fld dword ptr [ebx + 0x228] +0x4ceb04: fsub dword ptr [ebx + 0x230] +0x4ceb0a: fdiv dword ptr [ebx + 0x234] +0x4ceb10: fstp dword ptr [ebx + 0x23c] +0x4ceb16: lea edx, [ebp - 0xb4] +0x4ceb1c: push edx +0x4ceb1d: call 0x488b80 +0x4ceb22: pop ecx +0x4ceb23: fld dword ptr [ebx + 0x204] +0x4ceb29: fchs +0x4ceb2b: fmul dword ptr [ebx + 0x23c] +0x4ceb31: add esp, -4 +0x4ceb34: fstp dword ptr [esp] +0x4ceb37: push 0 +0x4ceb39: lea ecx, [ebp - 0xb4] +0x4ceb3f: push ecx +0x4ceb40: call 0x488bac +0x4ceb45: add esp, 0xc +0x4ceb48: push 1 +0x4ceb4a: mov eax, dword ptr [ebx + 0x26c] +0x4ceb50: push eax +0x4ceb51: call 0x487fbc +0x4ceb56: add esp, 8 +0x4ceb59: mov edx, dword ptr [ebx + 0x26c] +0x4ceb5f: push edx +0x4ceb60: call 0x488278 +0x4ceb65: pop ecx +0x4ceb66: fld dword ptr [ebx + 0x200] +0x4ceb6c: fsub dword ptr [ebx + 0x204] +0x4ceb72: add esp, -4 +0x4ceb75: fstp dword ptr [esp] +0x4ceb78: push dword ptr [ebx + 0x1fc] +0x4ceb7e: mov eax, dword ptr [ebx + 0x26c] +0x4ceb84: push eax +0x4ceb85: call 0x488408 +0x4ceb8a: fld dword ptr [ebx + 0x204] +0x4ceb90: fmul dword ptr [ebx + 0x23c] +0x4ceb96: add esp, 0xc +0x4ceb99: add esp, -4 +0x4ceb9c: fsubr dword ptr [ebx + 0x200] +0x4ceba2: fstp dword ptr [esp] +0x4ceba5: push dword ptr [ebx + 0x1fc] +0x4cebab: mov ecx, dword ptr [ebx + 0x26c] +0x4cebb1: push ecx +0x4cebb2: call 0x488408 +0x4cebb7: add esp, 0xc +0x4cebba: mov eax, dword ptr [ebx + 0x26c] +0x4cebc0: push eax +0x4cebc1: call 0x4882dc +0x4cebc6: pop ecx +0x4cebc7: lea edx, [ebp - 0xb4] +0x4cebcd: push 0 +0x4cebcf: push edx +0x4cebd0: mov ecx, dword ptr [ebx + 0x26c] +0x4cebd6: push ecx +0x4cebd7: call 0x4887b0 +0x4cebdc: add esp, 0xc +0x4cebdf: mov eax, dword ptr [ebx + 0x26c] +0x4cebe5: push eax +0x4cebe6: call 0x488030 +0x4cebeb: pop ecx +0x4cebec: mov edx, dword ptr [ebx + 0x26c] +0x4cebf2: push edx +0x4cebf3: call 0x488054 +0x4cebf8: pop ecx +0x4cebf9: mov ecx, dword ptr [ebx + 0x254] +0x4cebff: mov eax, dword ptr [ecx + 0x1c] +0x4cec02: mov edx, dword ptr [ebx + 0x1e0] +0x4cec08: cmp eax, edx +0x4cec0a: jne 0x4cec22 ; [0x4cec22]=4.86894e-38f +0x4cec0c: mov ecx, dword ptr [ebx + 0x184] +0x4cec12: mov eax, dword ptr [ecx] +0x4cec14: mov edx, dword ptr [ebx + 0x188] +0x4cec1a: cmp eax, edx +0x4cec1c: je 0x4cedad ; [0x4cedad]=8.1027e-38f +0x4cec22: mov ecx, dword ptr [ebx + 0x184] +0x4cec28: mov eax, dword ptr [ecx] +0x4cec2a: mov dword ptr [ebx + 0x188], eax +0x4cec30: mov edx, dword ptr [ebx + 0x254] +0x4cec36: mov ecx, dword ptr [edx + 0x1c] +0x4cec39: mov dword ptr [ebx + 0x1e0], ecx +0x4cec3f: mov eax, dword ptr [ebx + 0x188] +0x4cec45: test eax, eax +0x4cec47: je 0x4ced40 ; [0x4ced40]=8.1027e-38f +0x4cec4d: mov edx, dword ptr [ebx + 0x1dc] +0x4cec53: test edx, edx +0x4cec55: jne 0x4ceca2 ; [0x4ceca2]=8.24963e-38f +0x4cec57: push 1 +0x4cec59: mov ecx, dword ptr [ebx + 0x2dc] +0x4cec5f: push ecx +0x4cec60: call 0x487fbc +0x4cec65: add esp, 8 +0x4cec68: mov eax, dword ptr [ebx + 0x2e4] +0x4cec6e: push eax +0x4cec6f: mov edx, dword ptr [ebx + 0x2dc] +0x4cec75: push edx +0x4cec76: call 0x488850 +0x4cec7b: add esp, 8 +0x4cec7e: mov ecx, dword ptr [ebx + 0x2dc] +0x4cec84: push ecx +0x4cec85: call 0x488030 +0x4cec8a: pop ecx +0x4cec8b: mov eax, dword ptr [ebx + 0x2dc] +0x4cec91: push eax +0x4cec92: call 0x488054 +0x4cec97: pop ecx +0x4cec98: mov dword ptr [ebx + 0x1dc], 1 +0x4ceca2: mov edx, dword ptr [ebx + 0x1e0] +0x4ceca8: test edx, edx +0x4cecaa: je 0x4cecba ; [0x4cecba]=-4.17971f +0x4cecac: mov ecx, dword ptr [ebx + 0x1e0] +0x4cecb2: mov eax, dword ptr [ecx + 0x190] +0x4cecb8: jmp 0x4cecbc ; [0x4cecbc]=4.01002e+06f +0x4cecba: xor eax, eax +0x4cecbc: test eax, eax +0x4cecbe: je 0x4ced0a ; [0x4ced0a]=4.72085e-38f +0x4cecc0: mov edx, dword ptr [eax + 0x1e0] +0x4cecc6: mov ecx, dword ptr [ebx + edx*4 + 0x2e8] +0x4ceccd: push ecx +0x4cecce: mov eax, dword ptr [ebx + 0x320] +0x4cecd4: push eax +0x4cecd5: call 0x48ab0c +0x4cecda: add esp, 8 +0x4cecdd: push 1 +0x4cecdf: mov edx, dword ptr [ebx + 0x320] +0x4cece5: push edx +0x4cece6: call 0x48ac30 +0x4ceceb: add esp, 8 +0x4cecee: mov ecx, dword ptr [ebx + 0x320] +0x4cecf4: push ecx +0x4cecf5: call 0x48d5d4 +0x4cecfa: pop ecx +0x4cecfb: mov dword ptr [ebx + 0x180], 1 +0x4ced05: jmp 0x4cedad ; [0x4cedad]=8.1027e-38f +0x4ced0a: mov eax, dword ptr [ebx + 0x180] +0x4ced10: test eax, eax +0x4ced12: je 0x4cedad ; [0x4cedad]=8.1027e-38f +0x4ced18: push 0 +0x4ced1a: mov edx, dword ptr [ebx + 0x320] +0x4ced20: push edx +0x4ced21: call 0x48ac30 +0x4ced26: add esp, 8 +0x4ced29: mov ecx, dword ptr [ebx + 0x320] +0x4ced2f: push ecx +0x4ced30: call 0x48d5d4 +0x4ced35: pop ecx +0x4ced36: xor eax, eax +0x4ced38: mov dword ptr [ebx + 0x180], eax +0x4ced3e: jmp 0x4cedad ; [0x4cedad]=8.1027e-38f +0x4ced40: mov edx, dword ptr [ebx + 0x1dc] +0x4ced46: test edx, edx +0x4ced48: je 0x4ced7d ; [0x4ced7d]=4.72085e-38f +0x4ced4a: xor ecx, ecx +0x4ced4c: mov dword ptr [ebx + 0x1dc], ecx +0x4ced52: push 1 +0x4ced54: mov eax, dword ptr [ebx + 0x2dc] +0x4ced5a: push eax +0x4ced5b: call 0x487fbc +0x4ced60: add esp, 8 +0x4ced63: mov edx, dword ptr [ebx + 0x2dc] +0x4ced69: push edx +0x4ced6a: call 0x488030 +0x4ced6f: pop ecx +0x4ced70: mov ecx, dword ptr [ebx + 0x2dc] +0x4ced76: push ecx +0x4ced77: call 0x488054 +0x4ced7c: pop ecx +0x4ced7d: mov eax, dword ptr [ebx + 0x180] +0x4ced83: test eax, eax +0x4ced85: je 0x4cedad ; [0x4cedad]=8.1027e-38f +0x4ced87: push 0 +0x4ced89: mov edx, dword ptr [ebx + 0x320] +0x4ced8f: push edx +0x4ced90: call 0x48ac30 +0x4ced95: add esp, 8 +0x4ced98: mov ecx, dword ptr [ebx + 0x320] +0x4ced9e: push ecx +0x4ced9f: call 0x48d5d4 +0x4ceda4: pop ecx +0x4ceda5: xor eax, eax +0x4ceda7: mov dword ptr [ebx + 0x180], eax +0x4cedad: mov edx, dword ptr [ebx + 0x1dc] +0x4cedb3: test edx, edx +0x4cedb5: je 0x4cee55 ; [0x4cee55]=253.908f +0x4cedbb: fld dword ptr [ebx + 0x240] +0x4cedc1: fadd dword ptr [0x4cee7c] ; [0x4cee7c]=4f +0x4cedc7: fstp dword ptr [ebx + 0x240] +0x4cedcd: fld dword ptr [ebx + 0x240] +0x4cedd3: fcomp dword ptr [0x4ceec8] ; [0x4ceec8]=360f +0x4cedd9: fnstsw ax +0x4ceddb: sahf +0x4ceddc: jb 0x4cedf0 ; [0x4cedf0]=-3.30425e+38f +0x4cedde: fld dword ptr [ebx + 0x240] +0x4cede4: fsub dword ptr [0x4ceec8] ; [0x4ceec8]=360f +0x4cedea: fstp dword ptr [ebx + 0x240] +0x4cedf0: lea edx, [ebp - 0x88] +0x4cedf6: push edx +0x4cedf7: call 0x488b80 +0x4cedfc: pop ecx +0x4cedfd: lea eax, [ebp - 0x88] +0x4cee03: push dword ptr [ebx + 0x240] +0x4cee09: push eax +0x4cee0a: call 0x488bc8 +0x4cee0f: add esp, 8 +0x4cee12: push 1 +0x4cee14: mov edx, dword ptr [ebx + 0x274] +0x4cee1a: push edx +0x4cee1b: call 0x487fbc +0x4cee20: add esp, 8 +0x4cee23: lea ecx, [ebp - 0x88] +0x4cee29: push 0 +0x4cee2b: push ecx +0x4cee2c: mov eax, dword ptr [ebx + 0x274] +0x4cee32: push eax +0x4cee33: call 0x4887b0 +0x4cee38: add esp, 0xc +0x4cee3b: mov edx, dword ptr [ebx + 0x274] +0x4cee41: push edx +0x4cee42: call 0x488030 +0x4cee47: pop ecx +0x4cee48: mov ecx, dword ptr [ebx + 0x274] +0x4cee4e: push ecx +0x4cee4f: call 0x488054 +0x4cee54: pop ecx +0x4cee55: push ebx +0x4cee56: call 0x4531d8 +0x4cee5b: pop ecx +0x4cee5c: pop edi +0x4cee5d: pop esi +0x4cee5e: pop ebx +0x4cee5f: mov esp, ebp +0x4cee61: pop ebp +0x4cee62: ret