Function at 0x4756a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x58]
cmp eax, dword [ecx + 8]
jbe 0x476bd3
sub esp, 0xd8
mov eax, 0
lea edi, [esp + 0xc4]
call fcn.0044cadb
mov edi, esp
lea esi, [esp + 0xdc]
call fcn.0044cfbe
call fcn.0047c0b0
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x64], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x4c], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0xb4], edx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x6c], ebx
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x68], ebp
mov esi, dword [esp + 0xfc]
mov edi, dword [esp + 0x100]
mov esi, 0xffffffff
mov dword [esp + 0x30], esi
mov edi, 0xffffffff
mov dword [esp + 0x5c], edi
xor edi, edi
mov dword [esp + 0x50], edi
xor esi, esi
mov dword [esp + 0x60], esi
xor esi, esi
mov dword [esp + 0x54], esi
xor esi, esi
mov dword [esp + 0x40], esi
mov esi, dword [esp + 0xfc]
mov edi, dword [esp + 0x100]
jmp 0x475792
mov edx, dword [esp + 0xb4]
mov ebp, dword [esp + 0x68]
mov ebp, dword [esp + 0x34]
mov dword [esp + 0x30], ebp
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xf4], ecx
mov dword [esp + 0xf8], esi
mov ecx, dword [esp + 0x4c]
mov ebx, dword [esp + 0x6c]
mov esi, dword [esp + 0xa8]
mov ebp, dword [esp + 0x68]
test edi, edi
je 0x476b73
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.00473df0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0xa8], edx
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 8]
test ebx, ebx
jne 0x476a95
mov ebx, dword [esp + 0xf0]
mov ebp, dword [esp + 0xf4]
mov esi, dword [esp + 0xf8]
test eax, eax
je 0x476a79
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xa4], ebp
mov dword [esp + 0xa0], esi
mov edi, ecx
mov ecx, dword [esp + 0x30]
test ecx, ecx
jge 0x475818
test eax, 0x100
jne 0x476a23
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x5c]
test ecx, ecx
jge 0x47582f
test eax, 0x200
jne 0x47698f
mov dword [esp + 0x5c], ecx
and eax, 0xffff
cmp eax, 0x108
jg 0x476465
cmp eax, 0x102
jg 0x476096
cmp eax, 0x1f
jg 0x475e4d
cmp eax, 0x15
je 0x475c09
lea ecx, [eax - 0x16]
cmp ecx, 9
ja 0x475bfe
mov ecx, dword [esp + 0x64]
test ecx, ecx
jne 0x475bf3
mov eax, ecx
mov ecx, dword [esp + 0x3c]
cmp ecx, 0x16
jne 0x4758d8
lea ecx, [ebp + 1]
cmp ecx, esi
jg 0x475893
mov byte [ebx + ebp], 0x5a
jmp 0x475757
lea eax, [0x731080]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ecx
call fcn.00438b40
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
lea ecx, [eax + 1]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov ebp, dword [esp + 0xa4]
mov edi, dword [esp + 0x38]
jmp 0x47588a
cmp ecx, 0x19
je 0x475883
cmp ecx, 0x17
je 0x475883
cmp ecx, 0x18
je 0x475883
cmp ecx, 0x1a
je 0x475883
mov eax, 0x88888889
mov edx, dword [esp + 0x64]
imul edx
mov eax, edi
mov edi, dword [esp + 0x64]
add edx, edi
sar edi, 0x1f
sar edx, 5
mov dword [esp + 0x9c], edx
sub edx, edi
test edx, edx
jge 0x475b89
lea edx, [ebp + 1]
cmp edx, esi
jg 0x475b3a
mov byte [ebx + ebp], 0x2d
mov ebp, dword [esp + 0x9c]
sub edi, ebp
mov ebp, dword [esp + 0x64]
xchg ebp, ebx
neg ebx
xchg ebp, ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x9c], ebp
mov eax, 0x88888889
mov ecx, edx
imul edi
add edx, edi
sar edx, 5
sar edi, 0x1f
sub edx, edi
mov dword [esp + 0x98], edx
mov dword [esp + 0xc], edx
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], esi
mov dword [esp + 0x10], 2
call fcn.00474d00
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x3c]
cmp ebp, 0x19
jne 0x475b18
lea esi, [edx + 1]
cmp esi, ecx
jg 0x475ad4
mov byte [ebx + edx], 0x3a
cmp ebp, 0x1d
je 0x4759af
cmp ebp, 0x18
jne 0x475a93
cmp ebp, 0x17
je 0x4759dd
cmp ebp, 0x1c
je 0x4759dd
cmp ebp, 0x1f
je 0x4759dd
cmp ebp, 0x1a
je 0x4759dd
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
mov ebp, ecx
mov ecx, esi
mov esi, ebp
jmp 0x475757
cmp ebp, 0x1f
jne 0x475a83
lea edx, [esi + 1]
cmp edx, ecx
jg 0x475a43
mov byte [ebx + esi], 0x3a
mov eax, dword [esp + 0x9c]
mov ebp, 0x88888889
mov esi, edx
imul ebp
mov edi, dword [esp + 0x9c]
add edx, edi
mov eax, edi
sar edi, 0x1f
sar edx, 5
sub edx, edi
imul edx, edx, 0x3c
sub eax, edx
mov dword [esp + 0xc], eax
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp + 0x10], 2
call fcn.00474d00
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
jmp 0x4759c3
mov dword [esp + 0x94], esi
lea eax, [0x731080]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
call fcn.00438b40
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea edx, [eax + 1]
mov esi, dword [esp + 0x94]
jmp 0x4759ed
cmp ebp, 0x1a
je 0x4759e6
mov edx, esi
jmp 0x4759f1
mov eax, dword [esp + 0x98]
imul eax, eax, 0x3c
mov edx, dword [esp + 0x28]
sub edx, eax
mov dword [esp + 0xc], edx
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp + 0x10], 2
call fcn.00474d00
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x3c]
jmp 0x4759af
mov dword [esp + 0x90], edx
lea eax, [0x731080]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], esi
call fcn.00438b40
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea esi, [eax + 1]
mov edx, dword [esp + 0x90]
mov ebp, dword [esp + 0x3c]
jmp 0x47599d
cmp ebp, 0x1e
je 0x475992
cmp ebp, 0x1a
je 0x475992
cmp ebp, 0x1f
je 0x475992
mov esi, edx
jmp 0x4759a1
mov dword [esp + 0x98], edi
lea eax, [0x731080]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edx
call fcn.00438b40
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
lea edx, [eax + 1]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov ebp, dword [esp + 0xa4]
mov edi, dword [esp + 0x98]
jmp 0x475921
lea edi, [ebp + 1]
cmp edi, esi
jg 0x475ba7
mov byte [ebx + ebp], 0x2b
mov ebp, dword [esp + 0x64]
mov ebp, edx
mov edx, edi
mov edi, ebp
mov ebp, dword [esp + 0x64]
jmp 0x475938
mov dword [esp + 0x8c], edx
lea eax, [0x731080]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
call fcn.00438b40
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
lea edi, [eax + 1]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x8c]
mov ebp, dword [esp + 0xa4]
jmp 0x475b90
mov eax, ecx
mov ecx, dword [esp + 0x3c]
jmp 0x4758ec
mov eax, dword [esp + 0x64]
mov ecx, ebp
jmp 0x475757
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x475ccc
lea eax, [ecx + ebp]
mov dword [esp + 0xf4], eax
cmp eax, esi
ja 0x475c84
test eax, eax
jl 0x476b8d
cmp eax, esi
ja 0x476b8d
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xf8], esi
lea eax, [ebx + ebp]
mov dword [esp], eax
mov eax, dword [esp + 0xb4]
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.0044d1e0
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov esi, dword [esp + 0xf8]
jmp 0x475757
lea ecx, [0x731080]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], eax
call fcn.00438b40
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0xa8]
mov ebp, dword [esp + 0xa4]
mov edi, dword [esp + 0x38]
jmp 0x475c23
mov eax, 0x88888889
mov ecx, dword [esp + 0x64]
imul ecx
add edx, ecx
mov eax, ecx
sar ecx, 0x1f
sar edx, 5
mov dword [esp + 0x9c], edx
sub edx, ecx
test edx, edx
jge 0x475deb
lea edx, [ebp + 1]
cmp edx, esi
jg 0x475d9c
mov byte [ebx + ebp], 0x2d
mov ebp, dword [esp + 0x9c]
sub ecx, ebp
mov dword [esp + 0x2c], ecx
mov eax, 0x88888889
mov ebp, edx
imul ecx
add edx, ecx
sar ecx, 0x1f
sar edx, 5
sub edx, ecx
mov dword [esp + 0x9c], edx
mov dword [esp + 0xc], edx
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov dword [esp + 0x10], 2
call fcn.00474d00
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x9c]
imul ebp, ebp, 0x3c
mov esi, dword [esp + 0x2c]
sub esi, ebp
mov dword [esp + 0xc], esi
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [esp + 0x10], 2
call fcn.00474d00
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
jmp 0x475757
mov dword [esp + 0x98], ecx
lea eax, [0x731080]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edx
call fcn.00438b40
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
lea edx, [eax + 1]
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x98]
mov ebp, dword [esp + 0xa4]
mov edi, dword [esp + 0x38]
jmp 0x475cfd
lea ecx, [ebp + 1]
cmp ecx, esi
jg 0x475e01
mov byte [ebx + ebp], 0x2b
mov ebp, edx
mov edx, ecx
mov ecx, ebp
jmp 0x475d0a
mov dword [esp + 0x88], edx
lea eax, [0x731080]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ecx
call fcn.00438b40
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
lea ecx, [eax + 1]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x88]
mov ebp, dword [esp + 0xa4]
mov edi, dword [esp + 0x38]
jmp 0x475df2
lea ecx, [eax - 0x20]
cmp ecx, 1
jbe 0x476026
cmp eax, 0x101
je 0x475f40
cmp eax, 0x102
jne 0x475bfe
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call fcn.0047bca0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
cmp eax, 3
jb 0x476bc5
mov eax, dword [esp + 0xa4]
lea edx, [eax + 3]
mov ebx, dword [esp + 0xa0]
cmp edx, ebx
ja 0x475eeb
mov ebp, dword [esp + 0xc0]
test edx, edx
jl 0x476bc5
cmp edx, ebx
ja 0x476bc5
mov esi, ebp
movzx ebp, word [ecx]
mov edi, ebp
movzx ebp, byte [ecx + 2]
mov word [esi + eax], di
xchg ebp, ebx
mov byte [esi + eax + 2], bl
xchg ebp, ebx
mov eax, dword [esp + 0x64]
mov edi, dword [esp + 0x38]
mov ecx, edx
mov edx, dword [esp + 0xa8]
mov ebp, ebx
mov ebx, esi
mov esi, ebp
jmp 0x475757
mov dword [esp + 0x84], edx
mov dword [esp + 0xbc], ecx
lea ecx, [0x731080]
mov dword [esp], ecx
mov ebp, dword [esp + 0xc0]
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
call fcn.00438b40
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0xa4]
mov ecx, dword [esp + 0xbc]
mov edx, dword [esp + 0x84]
jmp 0x475ea8
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call fcn.0047bca0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xa4]
lea ebx, [eax + edx]
mov dword [esp + 0xf4], ebx
mov ebp, dword [esp + 0xa0]
cmp ebx, ebp
ja 0x475fd0
mov esi, dword [esp + 0xc0]
test ebx, ebx
jl 0x476bbe
cmp ebx, ebp
ja 0x476bbe
mov dword [esp + 0xf8], ebp
mov dword [esp + 0xf0], esi
add edx, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0044d1e0
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov esi, dword [esp + 0xf8]
jmp 0x475757
mov dword [esp + 0x58], eax
mov dword [esp + 0xb8], ecx
lea eax, [0x731080]
mov dword [esp], eax
mov ecx, dword [esp + 0xc0]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
call fcn.00438b40
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0xa4]
mov ebx, dword [esp + 0xf4]
jmp 0x475f77
lea edi, [esp + 0xc4]
lea esi, [esp + 0xdc]
call fcn.0044cfbe
mov ecx, dword [esp + 0xc4]
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov edx, dword [esp + 0xa0]
mov dword [esp + 8], edx
and ecx, 0x3fffffff
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x3c]
sar ecx, 0x10
mov dword [esp + 0x10], ecx
cmp eax, 0x21
sete al
mov byte [esp + 0x14], al
call fcn.00475020
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
jmp 0x475757
cmp eax, 0x105
jg 0x47625a
cmp eax, 0x103
je 0x47621a
cmp eax, 0x104
jne 0x4760f3
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov eax, dword [esp + 0x50]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 2
call fcn.00474d00
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
jmp 0x475757
mov eax, dword [esp + 0x68]
add eax, 0x15180
mov dword [esp], eax
mov eax, dword [esp + 0x6c]
adc eax, 0
mov dword [esp + 4], eax
mov dword [esp + 8], 0x93a80
mov dword [esp + 0xc], 0
call fcn.00448430
mov eax, dword [esp + 0x10]
mov ecx, eax
mov eax, 0xc22e4507
imul ecx
mov eax, ecx
sar ecx, 0x1f
add eax, edx
sar eax, 0x10
sub eax, ecx
mov dword [esp], eax
call fcn.0047bda0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xa4]
lea ebx, [eax + edx]
mov dword [esp + 0xf4], ebx
mov ebp, dword [esp + 0xa0]
cmp ebx, ebp
ja 0x4761c4
mov esi, dword [esp + 0xc0]
test ebx, ebx
jl 0x476bb0
cmp ebx, ebp
ja 0x476bb0
mov dword [esp + 0xf8], ebp
mov dword [esp + 0xf0], esi
add edx, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0044d1e0
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov esi, dword [esp + 0xf8]
jmp 0x475757
mov dword [esp + 0x44], eax
mov dword [esp + 0xac], ecx
lea eax, [0x731080]
mov dword [esp], eax
mov ecx, dword [esp + 0xc0]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
call fcn.00438b40
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0xac]
mov edx, dword [esp + 0xa4]
mov ebx, dword [esp + 0xf4]
jmp 0x47616b
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov eax, dword [esp + 0x50]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.00474d00
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
jmp 0x475757
cmp eax, 0x106
je 0x476353
cmp eax, 0x107
je 0x476313
mov eax, dword [esp + 0x60]
cmp eax, 0xa
jge 0x47630c
lea ecx, [ebp + 1]
cmp ecx, esi
jg 0x4762c4
mov byte [ebx + ebp], 0x20
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.00474d00
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
jmp 0x475757
lea eax, [0x731080]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ecx
call fcn.00438b40
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
lea ecx, [eax + 1]
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0xa8]
mov ebp, dword [esp + 0xa4]
mov edi, dword [esp + 0x38]
jmp 0x476284
mov ecx, ebp
jmp 0x476288
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov eax, dword [esp + 0x60]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.00474d00
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
jmp 0x475757
mov eax, dword [esp + 0x68]
add eax, 0x15180
mov dword [esp], eax
mov eax, dword [esp + 0x6c]
adc eax, 0
mov dword [esp + 4], eax
mov dword [esp + 8], 0x93a80
mov dword [esp + 0xc], 0
call fcn.00448430
mov eax, dword [esp + 0x10]
mov ecx, eax
mov eax, 0xc22e4507
imul ecx
mov eax, ecx
sar ecx, 0x1f
add eax, edx
sar eax, 0x10
sub eax, ecx
mov dword [esp], eax
call fcn.0047bda0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
cmp eax, 3
jb 0x476bb7
mov eax, dword [esp + 0xa4]
lea edx, [eax + 3]
mov ebx, dword [esp + 0xa0]
cmp edx, ebx
ja 0x476410
mov ebp, dword [esp + 0xc0]
test edx, edx
jl 0x476bb7
cmp edx, ebx
ja 0x476bb7
mov esi, ebp
movzx ebp, word [ecx]
mov edi, ebp
movzx ebp, byte [ecx + 2]
mov word [esi + eax], di
xchg ebp, ebx
mov byte [esi + eax + 2], bl
xchg ebp, ebx
mov eax, dword [esp + 0x64]
mov edi, dword [esp + 0x38]
mov ecx, edx
mov edx, dword [esp + 0xa8]
mov ebp, ebx
mov ebx, esi
mov esi, ebp
jmp 0x475757
mov dword [esp + 0x80], edx
mov dword [esp + 0xbc], ecx
lea ecx, [0x731080]
mov dword [esp], ecx
mov ebp, dword [esp + 0xc0]
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
call fcn.00438b40
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0xa4]
mov ecx, dword [esp + 0xbc]
mov edx, dword [esp + 0x80]
jmp 0x4763cd
cmp eax, 0x20c
jg 0x47668d
cmp eax, 0x112
jg 0x476574
cmp eax, 0x109
je 0x476534
cmp eax, 0x111
je 0x4764f4
cmp eax, 0x112
jne 0x475bfe
mov ecx, dword [esp + 0x34]
test ecx, ecx
jge 0x4764a2
neg ecx
mov eax, 0x51eb851f
imul ecx
mov edi, ecx
sar ecx, 0x1f
sar edx, 5
sub edx, ecx
imul ecx, edx, 0x64
sub edi, ecx
mov dword [esp + 0xc], edi
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov dword [esp + 0x10], 2
call fcn.00474d00
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
jmp 0x475757
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 4
call fcn.00474d00
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
jmp 0x475757
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov eax, dword [esp + 0x60]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 2
call fcn.00474d00
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
jmp 0x475757
cmp eax, 0x20a
je 0x476651
cmp eax, 0x20b
je 0x4765f1
cmp eax, 0x20c
jne 0x475bfe
mov eax, 0xaaaaaaab
imul ecx
add edx, ecx
sar edx, 3
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea ecx, [edx + edx*2]
shl ecx, 2
sub eax, ecx
test eax, eax
jne 0x4765b5
mov eax, 0xc
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 2
call fcn.00474d00
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
jmp 0x475757
mov eax, 0xaaaaaaab
imul ecx
add edx, ecx
mov eax, ecx
sar ecx, 0x1f
sar edx, 3
sub edx, ecx
lea ecx, [edx + edx*2]
shl ecx, 2
sub eax, ecx
test eax, eax
jne 0x476615
mov eax, 0xc
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.00474d00
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
jmp 0x475757
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 2
call fcn.00474d00
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
jmp 0x475757
cmp eax, 0x20f
jle 0x4768bd
cmp eax, 0x210
je 0x47687d
cmp eax, 0x213
jne 0x476790
cmp ecx, 0xc
jl 0x476726
lea eax, [ebp + 2]
cmp eax, esi
ja 0x4766e0
test eax, eax
jl 0x476ba9
cmp eax, esi
ja 0x476ba9
movzx ecx, word [0x78f75f]
mov word [ebx + ebp], cx
mov ecx, eax
mov eax, dword [esp + 0x64]
jmp 0x475757
mov dword [esp + 0x7c], eax
lea ecx, [0x731080]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], eax
call fcn.00438b40
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0xa8]
mov ebp, dword [esp + 0xa4]
mov edi, dword [esp + 0x38]
jmp 0x4766ba
lea eax, [ebp + 2]
cmp eax, esi
ja 0x47674a
test eax, eax
jl 0x476ba2
cmp eax, esi
ja 0x476ba2
movzx ecx, word [0x78f733]
mov word [ebx + ebp], cx
jmp 0x4766d5
mov dword [esp + 0x78], eax
lea ecx, [0x731080]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], eax
call fcn.00438b40
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0xa8]
mov ebp, dword [esp + 0xa4]
mov edi, dword [esp + 0x38]
jmp 0x47672d
cmp eax, 0x214
jne 0x475bfe
cmp ecx, 0xc
jl 0x476813
lea eax, [ebp + 2]
cmp eax, esi
ja 0x4767cd
test eax, eax
jl 0x476b9b
cmp eax, esi
ja 0x476b9b
movzx ecx, word [0x78f827]
mov word [ebx + ebp], cx
mov ecx, eax
mov eax, dword [esp + 0x64]
jmp 0x475757
mov dword [esp + 0x74], eax
lea ecx, [0x731080]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], eax
call fcn.00438b40
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0xa8]
mov ebp, dword [esp + 0xa4]
mov edi, dword [esp + 0x38]
jmp 0x4767a7
lea eax, [ebp + 2]
cmp eax, esi
ja 0x476837
test eax, eax
jl 0x476b94
cmp eax, esi
ja 0x476b94
movzx ecx, word [0x78f7f5]
mov word [ebx + ebp], cx
jmp 0x4767c2
mov dword [esp + 0x70], eax
lea ecx, [0x731080]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], eax
call fcn.00438b40
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0xa8]
mov ebp, dword [esp + 0xa4]
mov edi, dword [esp + 0x38]
jmp 0x47681a
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov eax, dword [esp + 0x40]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 2
call fcn.00474d00
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
jmp 0x475757
cmp eax, 0x20d
je 0x47694f
cmp eax, 0x20e
jne 0x47690f
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 2
call fcn.00474d00
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
jmp 0x475757
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov eax, dword [esp + 0x40]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.00474d00
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
jmp 0x475757
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.00474d00
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xa8]
mov edi, dword [esp + 0x38]
jmp 0x475757
mov eax, dword [esp + 0x68]
mov dword [esp], eax
mov ecx, dword [esp + 0x6c]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x15180
mov dword [esp + 0xc], 0
call fcn.00448430
mov eax, dword [esp + 0x10]
mov ecx, eax
mov eax, 0x91a2b3c5
imul ecx
lea eax, [edx + ecx]
mov edx, ecx
sar ecx, 0x1f
sar eax, 0xb
sub eax, ecx
imul ecx, eax, 0xe10
sub edx, ecx
mov ecx, eax
mov eax, 0x88888889
mov ebx, edx
imul edx
lea eax, [ebx + edx]
mov edx, ebx
sar ebx, 0x1f
sar eax, 5
sub eax, ebx
imul ebx, eax, 0x3c
sub edx, ebx
mov ebx, dword [esp + 0xc0]
mov ebp, dword [esp + 0xa4]
mov esi, dword [esp + 0xa0]
mov edi, dword [esp + 0x38]
mov dword [esp + 0x54], eax
mov dword [esp + 0x40], edx
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0xa8]
jmp 0x47582f
mov eax, dword [esp + 0x68]
mov dword [esp], eax
mov ecx, dword [esp + 0x6c]
mov dword [esp + 4], ecx
mov byte [esp + 8], 1
call fcn.0047dc30
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0xc0]
mov ebp, dword [esp + 0xa4]
mov esi, dword [esp + 0xa0]
mov edi, dword [esp + 0x38]
mov dword [esp + 0x50], eax
mov dword [esp + 0x60], edx
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0xa8]
jmp 0x475818
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebp
mov dword [esp + 0x10c], esi
add esp, 0xd8
ret
mov esi, dword [esp + 0xf4]
lea edi, [ebx + esi]
mov dword [esp + 0x9c], edi
mov ecx, dword [esp + 0xf8]
cmp edi, ecx
ja 0x476b0b
test edi, edi
jl 0x476bcc
cmp edi, ecx
ja 0x476bcc
mov dword [esp + 0xf8], ecx
mov eax, dword [esp + 0xf0]
lea ecx, [eax + esi]
mov dword [esp], ecx
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
call fcn.0044d1e0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0xa8]
mov ebx, dword [esp + 0xf0]
mov ebp, dword [esp + 0x9c]
mov esi, dword [esp + 0xf8]
jmp 0x4757e6
mov dword [esp + 0x48], ebx
mov dword [esp + 0xb0], ebp
lea eax, [0x731080]
mov dword [esp], eax
mov edx, dword [esp + 0xf0]
mov dword [esp + 4], edx
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edi
call fcn.00438b40
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xa8]
mov ebx, dword [esp + 0x48]
mov ebp, dword [esp + 0xb0]
mov esi, dword [esp + 0xf4]
mov edi, dword [esp + 0x9c]
mov dword [esp + 0xf0], eax
mov eax, dword [esp + 0x3c]
jmp 0x476ab1
mov ebp, dword [esp + 0xf4]
mov esi, dword [esp + 0xf8]
mov ebx, dword [esp + 0xf0]
jmp 0x476a79
call fcn.004267e0
ud2
call fcn.004267e0
ud2
call fcn.004267e0
ud2
call fcn.004267e0
ud2
call fcn.004267e0
ud2
call fcn.004267e0
ud2
call fcn.004267e0
ud2
call fcn.004267e0
ud2
call fcn.004267e0
ud2
call fcn.004267e0
ud2
call fcn.0044b280
jmp fcn.004756a0