Function at 0x474fb0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe0be
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x100
mov eax, dword [0x534090]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10c], esi
xor edi, edi
mov dword [ebp - 0xfc], edi
mov dword [ebp - 0x100], edi
call fcn.00433fc0
mov eax, dword [eax]
cmp dword [eax], edi
je 0x4750af
lea eax, [ebp - 0x2c]
push eax
call fcn.004762f0
mov dword [ebp - 4], edi
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x100], 1
jb 0x475034
mov eax, dword [eax]
lea edx, [ebp - 0x104]
mov dword [ebp - 0x104], eax
lea ecx, [ebp - 0x44]
call fcn.00417750
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xb0]
push eax
mov dword [ebp - 0x100], 3
call fcn.0043a3c0
mov dword [ebp - 4], 2
lea esi, [ebp - 0xb0]
cmp dword [ebp - 0x9c], 8
mov edi, 0x10007
mov dword [ebp - 0xfc], edi
cmovae esi, dword [ebp - 0xb0]
mov dword [ebp - 0x100], edi
call fcn.00433fc0
push esi
push 0
push 0x518d78
push 0
push eax
call fcn.00436d10
mov esi, dword [ebp - 0x10c]
add esp, 0x14
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xfc]
test al, 4
je 0x47512c
mov edx, dword [ebp - 0x9c]
and eax, 0xfffffffb
mov dword [ebp - 0xfc], eax
cmp edx, 8
jb 0x47510f
mov ecx, dword [ebp - 0xb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4750ff
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762b9
push edx
push ecx
call fcn.004cb66f
mov eax, dword [ebp - 0xfc]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 7
mov word [ebp - 0xb0], cx
mov dword [ebp - 4], 0
test al, 2
je 0x475194
mov edx, dword [ebp - 0x30]
and eax, 0xfffffffd
mov dword [ebp - 0xfc], eax
cmp edx, 8
jb 0x475180
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x475170
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762b9
push edx
push ecx
call fcn.004cb66f
mov eax, dword [ebp - 0xfc]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], cx
mov dword [ebp - 4], 0xffffffff
test al, 1
je 0x4751e2
mov edx, dword [ebp - 0x18]
and eax, 0xfffffffe
mov dword [ebp - 0xfc], eax
cmp edx, 8
jb 0x4751e2
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4751d8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762b9
push edx
push ecx
call fcn.004cb66f
add esp, 8
mov eax, dword [esi + 0x34fc]
push 0x3a98
mov eax, dword [eax]
push dword [eax + 0x19904]
call dword [0x50409c]
mov esi, eax
test esi, esi
jne 0x4753dd
lea edx, [ebp - 0x90]
mov dword [ebp - 0x90], 0x80728050
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x8c], 0x8063806f
mov dword [ebp - 0x88], 0x80738065
mov dword [ebp - 0x84], 0x80208073
mov dword [ebp - 0x80], 0x80658074
mov dword [ebp - 0x7c], 0x806d8072
mov dword [ebp - 0x78], 0x806e8069
mov dword [ebp - 0x74], 0x80748061
mov dword [ebp - 0x70], 0x80648065
mov dword [ebp - 0x6c], 0x806f8020
mov dword [ebp - 0x68], 0x8020806e
mov dword [ebp - 0x64], 0x80748069
mov dword [ebp - 0x60], 0x80738027
mov dword [ebp - 0x5c], 0x806f8020
mov dword [ebp - 0x58], 0x806e8077
mov dword [ebp - 0x54], 0x8000
call fcn.00416fb0
mov dword [ebp - 4], 3
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
lea edx, [ebp - 0x104]
lea ecx, [ebp - 0x44]
cmovae eax, dword [ebp - 0x2c]
mov dword [ebp - 0x104], eax
call fcn.00417750
push eax
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 4
call fcn.0043a3c0
mov byte [ebp - 4], 5
lea esi, [ebp - 0xb0]
cmp dword [ebp - 0x9c], 8
cmovae esi, dword [ebp - 0xb0]
call fcn.00433fc0
push esi
push 0
push 0x518d78
push 8
push eax
call fcn.00436d10
mov edx, dword [ebp - 0x9c]
add esp, 0x14
cmp edx, 8
jb 0x475335
mov ecx, dword [ebp - 0xb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47532b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762be
push edx
push ecx
call fcn.004cb66f
add esp, 8
mov edx, dword [ebp - 0x30]
xor eax, eax
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 7
mov word [ebp - 0xb0], ax
cmp edx, 8
jb 0x47538c
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x475382
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762be
push edx
push ecx
call fcn.004cb66f
add esp, 8
mov edx, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
cmp edx, 8
jb 0x4761e2
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4761d8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762be
jmp 0x4761d8
call dword [0x504188]
mov edi, eax
lea eax, [ebp - 0x68]
push eax
call fcn.004763d0
mov edx, eax
mov dword [ebp - 4], 6
cmp dword [edx + 0x14], 8
jb 0x4753ff
mov edx, dword [edx]
mov eax, dword [ebp - 0x104]
mov ecx, edx
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0xa8], edi
lea esi, [ecx + 2]
mov dword [ebp - 0x9c], eax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x475430
sub ecx, esi
sub esp, 0x10
mov eax, esp
sar ecx, 1
lea esi, [ebp - 0xa8]
push ecx
push edx
lea ecx, [ebp - 0x44]
mov dword [eax], 0x22
mov dword [eax + 4], 0
mov dword [eax + 8], esi
call fcn.0041d9e0
mov edi, dword [ebp - 0xfc]
add esp, 0x18
or edi, 0x100000
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x2c]
call fcn.0043a3c0
or edi, 0x200000
mov dword [ebp - 0xfc], edi
mov byte [ebp - 4], 8
lea esi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae esi, dword [ebp - 0x2c]
call fcn.00433fc0
push esi
push 0
push 0x518d78
push 8
push eax
call fcn.00436d10
mov byte [ebp - 4], 7
add esp, 0x14
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x4754f4
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4754ea
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762c3
push edx
push ecx
call fcn.004cb66f
add esp, 8
xor eax, eax
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
cmp edx, 8
jb 0x475546
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47553c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762c3
push edx
push ecx
call fcn.004cb66f
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
cmp edx, 8
jb 0x47559b
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x475591
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762c3
push edx
push ecx
call fcn.004cb66f
add esp, 8
call fcn.00433fc0
mov edx, 0x8020
mov dword [ebp - 0x104], 0x8074
mov eax, dword [eax]
cmp dword [eax], 0
je 0x47571d
mov word [ebp - 0x7a], dx
lea ecx, [ebp - 0xb0]
mov eax, 0x8041
mov dword [ebp - 0x92], 0x806d8065
mov edx, 0x8061
mov word [ebp - 0x98], ax
mov eax, dword [ebp - 0x104]
mov edi, 0x8070
mov word [ebp - 0x66], dx
lea edx, [ebp - 0x98]
mov word [ebp - 0x96], ax
mov word [ebp - 0x94], ax
mov word [ebp - 0x8e], di
mov word [ebp - 0x8c], ax
mov dword [ebp - 0x8a], 0x806e8069
mov dword [ebp - 0x86], 0x80208067
mov dword [ebp - 0x82], 0x80618063
mov dword [ebp - 0x7e], 0x806c806c
mov word [ebp - 0x78], ax
mov dword [ebp - 0x76], 0x8020806f
mov dword [ebp - 0x72], 0x80658054
mov dword [ebp - 0x6e], 0x806d8072
mov dword [ebp - 0x6a], 0x806e8069
mov word [ebp - 0x64], ax
mov dword [ebp - 0x62], 0x80508065
mov dword [ebp - 0x5e], 0x806f8072
mov dword [ebp - 0x5a], 0x80658063
mov dword [ebp - 0x56], 0x80738073
mov dword [ebp - 0x52], 0x8000
call fcn.00416fb0
mov edi, dword [ebp - 0xfc]
or edi, 0x400000
mov dword [ebp - 4], 9
lea eax, [ebp - 0xb0]
or edi, 8
lea edx, [ebp - 0xfc]
cmp dword [ebp - 0x9c], 8
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x100], edi
cmovae eax, dword [ebp - 0xb0]
mov dword [ebp - 0xfc], eax
call fcn.00417750
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x2c]
or edi, 0x10
push eax
mov dword [ebp - 0x100], edi
call fcn.0043a3c0
or edi, 0x800000
mov dword [ebp - 4], 0xb
lea esi, [ebp - 0x2c]
or edi, 0x20
cmp dword [ebp - 0x18], 8
mov dword [ebp - 0xfc], edi
cmovae esi, dword [ebp - 0x2c]
mov dword [ebp - 0x100], edi
call fcn.00433fc0
push esi
push 0
push 0x518d78
push 0
push eax
call fcn.00436d10
add esp, 0x14
mov dword [ebp - 4], 0xa
mov eax, dword [ebp - 0xfc]
test al, 0x20
je 0x47578b
mov edx, dword [ebp - 0x18]
and eax, 0xffffffdf
mov dword [ebp - 0xfc], eax
cmp edx, 8
jb 0x475777
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x475767
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762c8
push edx
push ecx
call fcn.004cb66f
mov eax, dword [ebp - 0xfc]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], cx
mov dword [ebp - 4], 9
test al, 0x10
je 0x4757f3
mov edx, dword [ebp - 0x30]
and eax, 0xffffffef
mov dword [ebp - 0xfc], eax
cmp edx, 8
jb 0x4757df
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4757cf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762c8
push edx
push ecx
call fcn.004cb66f
mov eax, dword [ebp - 0xfc]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], cx
mov dword [ebp - 4], 0xffffffff
test al, 8
je 0x475847
mov edx, dword [ebp - 0x9c]
and eax, 0xfffffff7
mov dword [ebp - 0xfc], eax
cmp edx, 8
jb 0x475847
mov ecx, dword [ebp - 0xb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47583d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762c8
push edx
push ecx
call fcn.004cb66f
add esp, 8
mov edi, dword [ebp - 0x10c]
push 0x3e9
mov eax, dword [edi + 0x34fc]
mov eax, dword [eax]
push dword [eax + 0x19904]
call dword [0x504158]
test eax, eax
je 0x475bf5
call fcn.00433fc0
mov eax, dword [eax]
cmp dword [eax], 0
je 0x47591d
lea eax, [ebp - 0x68]
push eax
call fcn.004764e0
mov dword [ebp - 4], 0xc
mov edi, dword [ebp - 0xfc]
or edi, 0x40
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x100], edi
jb 0x4758a5
mov eax, dword [eax]
lea edx, [ebp - 0xfc]
mov dword [ebp - 0xfc], eax
lea ecx, [ebp - 0x44]
call fcn.00417750
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0x2c]
or edi, 0x80
push eax
mov dword [ebp - 0x100], edi
call fcn.0043a3c0
or edi, 0x1000000
mov dword [ebp - 4], 0xe
lea esi, [ebp - 0x2c]
or edi, 0x100
cmp dword [ebp - 0x18], 8
mov dword [ebp - 0xfc], edi
cmovae esi, dword [ebp - 0x2c]
mov dword [ebp - 0x100], edi
call fcn.00433fc0
push esi
push 0
push 0x518d78
push 0
push eax
call fcn.00436d10
mov edi, dword [ebp - 0x10c]
add esp, 0x14
mov dword [ebp - 4], 0xd
mov eax, dword [ebp - 0xfc]
test eax, 0x100
je 0x475990
mov edx, dword [ebp - 0x18]
and eax, 0xfffffeff
mov dword [ebp - 0xfc], eax
cmp edx, 8
jb 0x47597c
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47596c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762cd
push edx
push ecx
call fcn.004cb66f
mov eax, dword [ebp - 0xfc]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], cx
mov dword [ebp - 4], 0xc
test al, al
jns 0x4759fa
mov edx, dword [ebp - 0x30]
and eax, 0xffffff7f
mov dword [ebp - 0xfc], eax
cmp edx, 8
jb 0x4759e6
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4759d6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762cd
push edx
push ecx
call fcn.004cb66f
mov eax, dword [ebp - 0xfc]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], cx
mov dword [ebp - 4], 0xffffffff
test al, 0x40
je 0x475a3f
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x475a3f
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x475a35
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762cd
push edx
push ecx
call fcn.004cb66f
add esp, 8
mov eax, dword [edi + 0x34fc]
push 0x36ee80
mov eax, dword [eax]
push dword [eax + 0x19904]
mov eax, dword [0x50409c]
call eax
test eax, eax
jne 0x476299
mov ecx, 0x8069
mov dword [ebp - 0x70], 0x80728050
mov word [ebp - 0x5c], cx
lea edx, [ebp - 0x70]
mov ecx, dword [ebp - 0x104]
mov word [ebp - 0x5a], cx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x6c], 0x8063806f
mov dword [ebp - 0x68], 0x80738065
mov dword [ebp - 0x64], 0x80208073
mov dword [ebp - 0x60], 0x80788065
mov dword [ebp - 0x58], 0x80648065
mov dword [ebp - 0x54], 0x8000
call fcn.00416fb0
mov dword [ebp - 4], 0xf
lea eax, [ebp - 0xb0]
cmp dword [ebp - 0x9c], 8
lea edx, [ebp - 0x104]
lea ecx, [ebp - 0x44]
cmovae eax, dword [ebp - 0xb0]
mov dword [ebp - 0x104], eax
call fcn.00417750
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x10
call fcn.0043a3c0
mov byte [ebp - 4], 0x11
lea esi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae esi, dword [ebp - 0x2c]
call fcn.00433fc0
push esi
push 0
push 0x518d78
push 8
push eax
call fcn.00436d10
mov edx, dword [ebp - 0x18]
add esp, 0x14
cmp edx, 8
jb 0x475b50
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x475b46
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762d2
push edx
push ecx
call fcn.004cb66f
add esp, 8
mov edx, dword [ebp - 0x30]
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
cmp edx, 8
jb 0x475b9e
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x475b94
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762d2
push edx
push ecx
call fcn.004cb66f
add esp, 8
mov edx, dword [ebp - 0x9c]
xor eax, eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
cmp edx, 8
jb 0x4761e2
mov ecx, dword [ebp - 0xb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4761d8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762d2
jmp 0x4761d8
call dword [0x504188]
mov dword [ebp - 0x100], eax
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x104]
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x98], 0x80728045
mov dword [ebp - 0x94], 0x806f8072
mov dword [ebp - 0x90], 0x802c8072
mov dword [ebp - 0x8c], 0x80638020
mov dword [ebp - 0x88], 0x806c8061
mov dword [ebp - 0x84], 0x8069806c
mov dword [ebp - 0x80], 0x8067806e
mov dword [ebp - 0x7c], 0x80548020
mov dword [ebp - 0x78], 0x80728065
mov dword [ebp - 0x74], 0x8069806d
mov dword [ebp - 0x70], 0x8061806e
mov word [ebp - 0x6c], ax
mov dword [ebp - 0x6a], 0x80508065
mov dword [ebp - 0x66], 0x806f8072
mov dword [ebp - 0x62], 0x80658063
mov dword [ebp - 0x5e], 0x80738073
mov dword [ebp - 0x5a], 0x8020803a
mov dword [ebp - 0x56], 0x807d807b
mov dword [ebp - 0x52], 0x8000
call fcn.00416fb0
mov edi, dword [ebp - 0xfc]
or edi, 0x8000000
mov dword [ebp - 4], 0x12
lea eax, [ebp - 0xb0]
cmp dword [ebp - 0x9c], 8
lea edx, [ebp - 0x104]
lea ecx, [ebp - 0x44]
cmovae eax, dword [ebp - 0xb0]
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x100]
push eax
call fcn.00417e30
add esp, 4
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x13
call fcn.0043a3c0
or edi, 0x10000000
mov dword [ebp - 0xfc], edi
mov byte [ebp - 4], 0x14
lea esi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae esi, dword [ebp - 0x2c]
call fcn.00433fc0
push esi
push 0
push 0x518d78
push 8
push eax
call fcn.00436d10
mov byte [ebp - 4], 0x13
add esp, 0x14
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x475d6f
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x475d65
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762d7
push edx
push ecx
call fcn.004cb66f
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
cmp edx, 8
jb 0x475dc1
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x475db7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762d7
push edx
push ecx
call fcn.004cb66f
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
cmp edx, 8
jb 0x475e1c
mov ecx, dword [ebp - 0xb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x475e12
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762d7
push edx
push ecx
call fcn.004cb66f
add esp, 8
call fcn.00433fc0
mov eax, dword [eax]
cmp dword [eax], 0
je 0x475ec2
lea eax, [ebp - 0x68]
push eax
call fcn.00476600
mov dword [ebp - 4], 0x15
or edi, 0x200
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x100], edi
jb 0x475e50
mov eax, dword [eax]
lea edx, [ebp - 0x104]
mov dword [ebp - 0x104], eax
lea ecx, [ebp - 0x44]
call fcn.00417750
mov dword [ebp - 4], 0x16
lea ecx, [ebp - 0x2c]
or edi, 0x400
push eax
mov dword [ebp - 0x100], edi
call fcn.0043a3c0
or edi, 0x20000000
mov dword [ebp - 4], 0x17
lea esi, [ebp - 0x2c]
or edi, 0x800
cmp dword [ebp - 0x18], 8
mov dword [ebp - 0xfc], edi
cmovae esi, dword [ebp - 0x2c]
mov dword [ebp - 0x100], edi
call fcn.00433fc0
push esi
push 0
push 0x518d78
push 0
push eax
call fcn.00436d10
add esp, 0x14
mov dword [ebp - 4], 0x16
mov eax, dword [ebp - 0xfc]
test eax, 0x800
je 0x475f35
mov edx, dword [ebp - 0x18]
and eax, 0xfffff7ff
mov dword [ebp - 0xfc], eax
cmp edx, 8
jb 0x475f21
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x475f11
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762dc
push edx
push ecx
call fcn.004cb66f
mov eax, dword [ebp - 0xfc]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], cx
mov dword [ebp - 4], 0x15
test eax, 0x400
je 0x475fa2
mov edx, dword [ebp - 0x30]
and eax, 0xfffffbff
mov dword [ebp - 0xfc], eax
cmp edx, 8
jb 0x475f8e
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x475f7e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762dc
push edx
push ecx
call fcn.004cb66f
mov eax, dword [ebp - 0xfc]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], cx
mov dword [ebp - 4], 0xffffffff
test eax, 0x200
je 0x475ff5
mov edx, dword [ebp - 0x54]
and eax, 0xfffffdff
mov dword [ebp - 0xfc], eax
cmp edx, 8
jb 0x475ff5
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x475feb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762dc
push edx
push ecx
call fcn.004cb66f
add esp, 8
mov eax, dword [ebp - 0x10c]
push 0x7d0
mov eax, dword [eax + 0x34fc]
mov eax, dword [eax]
push dword [eax + 0x19904]
mov eax, dword [0x50409c]
call eax
mov dword [ebp - 0x104], eax
test eax, eax
jne 0x4761e9
call fcn.00433fc0
mov eax, dword [eax]
cmp dword [eax], 0
je 0x4760cf
lea eax, [ebp - 0x68]
push eax
call fcn.00476710
mov dword [ebp - 4], 0x18
mov edi, dword [ebp - 0xfc]
or edi, 0x1000
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x100], edi
jb 0x47605d
mov eax, dword [eax]
lea edx, [ebp - 0x104]
mov dword [ebp - 0x104], eax
lea ecx, [ebp - 0x44]
call fcn.00417750
mov dword [ebp - 4], 0x19
lea ecx, [ebp - 0x2c]
or edi, 0x2000
push eax
mov dword [ebp - 0x100], edi
call fcn.0043a3c0
or edi, 0x40000000
mov dword [ebp - 4], 0x1a
lea esi, [ebp - 0x2c]
or edi, 0x4000
cmp dword [ebp - 0x18], 8
mov dword [ebp - 0xfc], edi
cmovae esi, dword [ebp - 0x2c]
mov dword [ebp - 0x100], edi
call fcn.00433fc0
push esi
push 0
push 0x518d78
push 0
push eax
call fcn.00436d10
add esp, 0x14
mov eax, dword [ebp - 0xfc]
test eax, 0x4000
je 0x47613b
mov edx, dword [ebp - 0x18]
and eax, 0xffffbfff
mov dword [ebp - 0xfc], eax
cmp edx, 8
jb 0x476127
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x476117
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762e1
push edx
push ecx
call fcn.004cb66f
mov eax, dword [ebp - 0xfc]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], cx
test eax, 0x2000
je 0x4761a1
mov edx, dword [ebp - 0x30]
and eax, 0xffffdfff
mov dword [ebp - 0xfc], eax
cmp edx, 8
jb 0x47618d
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47617d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762e1
push edx
push ecx
call fcn.004cb66f
mov eax, dword [ebp - 0xfc]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], cx
test eax, 0x1000
je 0x4761e2
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x4761e2
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4761d8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4762e1
push edx
push ecx
call fcn.004cb66f
add esp, 8
mov al, 1
jmp 0x47629b
call dword [0x504188]
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0xf8]
push eax
call fcn.00476850
mov dword [ebp - 4], 0x1b
cmp dword [eax + 0x14], 8
jb 0x476210
mov eax, dword [eax]
mov dword [ebp - 0x100], eax
lea edx, [ebp - 0x100]
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0047f7e0
add esp, 8
push eax
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x1c
call fcn.0043a3c0
mov byte [ebp - 4], 0x1d
lea esi, [ebp - 0xc8]
cmp dword [ebp - 0xb4], 8
cmovae esi, dword [ebp - 0xc8]
call fcn.00433fc0
push esi
push 0
push 0x518d78
push 8
push eax
call fcn.00436d10
add esp, 0x14
lea ecx, [ebp - 0xc8]
call fcn.0043b020
lea ecx, [ebp - 0xe0]
call fcn.0043b020
lea ecx, [ebp - 0xf8]
call fcn.0043b020
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004cb63e
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004d05ef
call fcn.004d05ef
call fcn.004d05ef
call fcn.004d05ef
call fcn.004d05ef
call fcn.004d05ef
call fcn.004d05ef
call fcn.004d05ef
call fcn.004d05ef
int3