Function at 0x475a40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x6c]
cmp eax, dword [ecx + 8]
jbe 0x476f87
sub esp, 0xec
mov eax, 0
lea edi, [esp + 0xd8]
call fcn.0044c88b
mov edi, esp
lea esi, [esp + 0xf0]
call fcn.0044cd6e
call fcn.0047c330
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x6c], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x54], edx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x70], ebx
mov ebp, dword [esp + 0x14]
mov dword [esp + 0xc8], ebp
mov esi, dword [esp + 0x110]
mov edi, dword [esp + 0x114]
mov esi, 0xffffffff
mov dword [esp + 0x34], esi
mov dword [esp + 0x64], esi
xor edi, edi
mov dword [esp + 0x58], edi
mov dword [esp + 0xb0], eax
xor eax, eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x48], eax
mov esi, dword [esp + 0x110]
mov edi, dword [esp + 0x114]
mov eax, dword [esp + 0xb0]
jmp 0x475b39
mov ebp, dword [esp + 0xc8]
mov esi, edi
mov edi, dword [esp + 0x3c]
mov esi, dword [esp + 0x38]
mov dword [esp + 0x34], esi
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], edx
mov dword [esp + 0x10c], ecx
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x54]
mov ebx, dword [esp + 0x70]
mov esi, dword [esp + 0xbc]
test edi, edi
je 0x476f19
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.004742d0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x14]
mov dword [esp + 0xbc], edx
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x3c], ebp
test ebx, ebx
jne 0x476e46
mov ecx, dword [esp + 0x10c]
mov ebx, dword [esp + 0x104]
mov esi, dword [esp + 0x108]
test eax, eax
je 0x476e2a
mov dword [esp + 0xac], ecx
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xa8], esi
mov edi, edx
mov edx, dword [esp + 0x34]
test edx, edx
jge 0x475bbf
test eax, 0x100
jne 0x476dd4
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x64]
test edx, edx
jge 0x475bd6
test eax, 0x200
jne 0x476d3b
mov dword [esp + 0x64], edx
and eax, 0xffff
cmp eax, 0x108
jg 0x476817
cmp eax, 0x102
jg 0x47641c
cmp eax, 0x1f
jg 0x4761e6
cmp eax, 0x15
je 0x475f9e
lea edx, [eax - 0x16]
cmp edx, 9
ja 0x475f93
mov edx, dword [esp + 0x6c]
test edx, edx
jne 0x475f88
mov eax, edx
mov edx, dword [esp + 0x40]
cmp edx, 0x16
jne 0x475c7f
lea edx, [esi + 1]
cmp edx, ecx
jg 0x475c3a
mov byte [ebx + esi], 0x5a
jmp 0x475afc
lea eax, [0x6cb000]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
call fcn.004391a0
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea edx, [eax + 1]
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov esi, dword [esp + 0xa8]
mov edi, dword [esp + 0xbc]
jmp 0x475c31
cmp edx, 0x19
je 0x475c2a
cmp edx, 0x17
je 0x475c2a
cmp edx, 0x18
je 0x475c2a
cmp edx, 0x1a
je 0x475c2a
mov eax, 0x88888889
mov ebp, dword [esp + 0x6c]
imul ebp
add edx, ebp
mov eax, ebp
sar ebp, 0x1f
sar edx, 5
mov dword [esp + 0xa4], edx
sub edx, ebp
test edx, edx
jge 0x475f23
lea edx, [esi + 1]
cmp edx, ecx
jg 0x475ed1
mov byte [ebx + esi], 0x2d
mov esi, dword [esp + 0xa4]
sub ebp, esi
neg eax
mov dword [esp + 0x30], ebp
mov dword [esp + 0xa4], eax
mov eax, 0x88888889
mov edi, edx
imul ebp
add edx, ebp
sar ebp, 0x1f
sar edx, 5
sub edx, ebp
mov dword [esp + 0xa0], edx
mov dword [esp + 0xc], edx
mov dword [esp], ebx
mov dword [esp + 4], edi
mov dword [esp + 8], ecx
mov dword [esp + 0x10], 2
call fcn.004750d0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x40]
cmp ebp, 0x19
jne 0x475eaf
lea esi, [edx + 1]
cmp esi, ecx
jg 0x475e6b
mov byte [ebx + edx], 0x3a
cmp ebp, 0x1d
je 0x475d4a
cmp ebp, 0x18
jne 0x475e2a
cmp ebp, 0x17
je 0x475d74
cmp ebp, 0x1c
je 0x475d74
cmp ebp, 0x1f
je 0x475d74
cmp ebp, 0x1a
je 0x475d74
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
mov edx, esi
jmp 0x475afc
cmp ebp, 0x1f
jne 0x475e1a
lea edx, [esi + 1]
cmp edx, ecx
jg 0x475dda
mov byte [ebx + esi], 0x3a
mov eax, dword [esp + 0xa4]
mov ebp, 0x88888889
mov esi, edx
imul ebp
mov edi, dword [esp + 0xa4]
add edx, edi
mov eax, edi
sar edi, 0x1f
sar edx, 5
sub edx, edi
imul edx, edx, 0x3c
sub eax, edx
mov dword [esp + 0xc], eax
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp + 0x10], 2
call fcn.004750d0
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
jmp 0x475d5e
mov dword [esp + 0x9c], esi
lea eax, [0x6cb000]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
call fcn.004391a0
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea edx, [eax + 1]
mov esi, dword [esp + 0x9c]
jmp 0x475d84
cmp ebp, 0x1a
je 0x475d7d
mov edx, esi
jmp 0x475d88
mov eax, dword [esp + 0xa0]
imul eax, eax, 0x3c
mov edx, dword [esp + 0x30]
sub edx, eax
mov dword [esp + 0xc], edx
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp + 0x10], 2
call fcn.004750d0
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x40]
jmp 0x475d4a
mov dword [esp + 0x98], edx
lea eax, [0x6cb000]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], esi
call fcn.004391a0
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea esi, [eax + 1]
mov edx, dword [esp + 0x98]
mov ebp, dword [esp + 0x40]
jmp 0x475d38
cmp ebp, 0x1e
je 0x475d2d
cmp ebp, 0x1a
je 0x475d2d
cmp ebp, 0x1f
je 0x475d2d
mov esi, edx
jmp 0x475d3c
mov dword [esp + 0xa0], ebp
lea eax, [0x6cb000]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
call fcn.004391a0
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea edx, [eax + 1]
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0xa0]
mov esi, dword [esp + 0xa8]
mov edi, dword [esp + 0xbc]
jmp 0x475cc4
lea ebp, [esi + 1]
cmp ebp, ecx
jg 0x475f39
mov byte [ebx + esi], 0x2b
mov esi, edx
mov edx, ebp
mov ebp, esi
jmp 0x475cd3
mov dword [esp + 0x94], edx
lea eax, [0x6cb000]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebp
call fcn.004391a0
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea ebp, [eax + 1]
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x94]
mov esi, dword [esp + 0xa8]
mov edi, dword [esp + 0xbc]
jmp 0x475f2a
mov eax, edx
mov edx, dword [esp + 0x40]
jmp 0x475c93
mov eax, dword [esp + 0x6c]
mov edx, esi
jmp 0x475afc
mov edx, dword [esp + 0x54]
test edx, edx
je 0x476059
lea eax, [edx + esi]
mov dword [esp + 0x108], eax
cmp eax, ecx
ja 0x476011
cmp eax, ecx
ja 0x476f33
mov dword [esp + 0x10c], ecx
mov dword [esp + 0x104], ebx
lea eax, [ebx + esi]
mov dword [esp], eax
mov eax, dword [esp + 0xc8]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0044cf90
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
mov ecx, dword [esp + 0x10c]
mov ebx, dword [esp + 0x104]
mov edx, dword [esp + 0x108]
jmp 0x475afc
lea edx, [0x6cb000]
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call fcn.004391a0
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x108]
mov edx, dword [esp + 0x54]
mov ebp, dword [esp + 0x3c]
mov esi, dword [esp + 0xa8]
mov edi, dword [esp + 0xbc]
jmp 0x475fb8
mov eax, 0x88888889
mov edx, dword [esp + 0x6c]
imul edx
mov eax, ebp
mov ebp, dword [esp + 0x6c]
add edx, ebp
sar ebp, 0x1f
sar edx, 5
mov dword [esp + 0xa4], edx
sub edx, ebp
test edx, edx
jge 0x476181
lea edx, [esi + 1]
cmp edx, ecx
jg 0x47612f
mov byte [ebx + esi], 0x2d
mov esi, dword [esp + 0xa4]
sub ebp, esi
mov dword [esp + 0x2c], ebp
mov eax, 0x88888889
mov esi, edx
imul ebp
mov edi, ebp
sar ebp, 0x1f
add edx, edi
sar edx, 5
sub edx, ebp
mov dword [esp + 0xa4], edx
mov dword [esp + 0xc], edx
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp + 0x10], 2
call fcn.004750d0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0xa4]
imul ebp, ebp, 0x3c
mov esi, dword [esp + 0x2c]
sub esi, ebp
mov dword [esp + 0xc], esi
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0x10], 2
call fcn.004750d0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
jmp 0x475afc
mov dword [esp + 0xa0], ebp
lea eax, [0x6cb000]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
call fcn.004391a0
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea edx, [eax + 1]
mov eax, dword [esp + 0x3c]
mov ebp, dword [esp + 0xa0]
mov esi, dword [esp + 0xa8]
mov edi, dword [esp + 0xbc]
jmp 0x47608e
lea ebp, [esi + 1]
cmp ebp, ecx
jg 0x476197
mov byte [ebx + esi], 0x2b
mov esi, edx
mov edx, ebp
mov ebp, esi
jmp 0x47609b
mov dword [esp + 0x90], edx
lea eax, [0x6cb000]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebp
call fcn.004391a0
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea ebp, [eax + 1]
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x90]
mov esi, dword [esp + 0xa8]
mov edi, dword [esp + 0xbc]
jmp 0x476188
lea edx, [eax - 0x20]
cmp edx, 1
jbe 0x4763aa
cmp eax, 0x101
je 0x4762cc
cmp eax, 0x102
jne 0x475f93
mov eax, dword [esp + 0x58]
mov dword [esp], eax
call fcn.0047c060
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
cmp eax, 3
jb 0x476f79
mov eax, dword [esp + 0xa8]
lea edx, [eax + 3]
mov ebx, dword [esp + 0xac]
cmp edx, ebx
ja 0x476277
mov ebp, dword [esp + 0xd4]
cmp edx, ebx
ja 0x476f79
movzx esi, word [ecx]
mov edi, esi
movzx esi, byte [ecx + 2]
mov word [ebp + eax], di
xchg esi, ebx
mov byte [ebp + eax + 2], bl
xchg esi, ebx
mov eax, dword [esp + 0x6c]
mov edi, dword [esp + 0xbc]
mov ecx, ebx
mov ebx, ebp
mov ebp, dword [esp + 0x3c]
jmp 0x475afc
mov dword [esp + 0x8c], edx
mov dword [esp + 0xd0], ecx
lea ecx, [0x6cb000]
mov dword [esp], ecx
mov ebp, dword [esp + 0xd4]
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
call fcn.004391a0
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xd0]
mov edx, dword [esp + 0x8c]
jmp 0x476241
mov eax, dword [esp + 0x58]
mov dword [esp], eax
call fcn.0047c060
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xa8]
lea ebx, [eax + edx]
mov dword [esp + 0x108], ebx
mov ebp, dword [esp + 0xac]
cmp ebx, ebp
ja 0x476354
mov esi, dword [esp + 0xd4]
cmp ebx, ebp
ja 0x476f72
mov dword [esp + 0x104], esi
mov dword [esp + 0x10c], ebp
add edx, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0044cf90
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
mov ecx, dword [esp + 0x10c]
mov ebx, dword [esp + 0x104]
mov edx, dword [esp + 0x108]
jmp 0x475afc
mov dword [esp + 0x60], eax
mov dword [esp + 0xcc], ecx
lea eax, [0x6cb000]
mov dword [esp], eax
mov ecx, dword [esp + 0xd4]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
call fcn.004391a0
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0xcc]
mov edx, dword [esp + 0xa8]
mov ebx, dword [esp + 0x108]
jmp 0x476303
lea edi, [esp + 0xd8]
mov edx, esi
lea esi, [esp + 0xf0]
call fcn.0044cd6e
mov ecx, dword [esp + 0xd8]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov edx, dword [esp + 0xac]
mov dword [esp + 8], edx
and ecx, 0x3fffffff
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x40]
sar ecx, 0x10
mov dword [esp + 0x10], ecx
cmp eax, 0x21
sete al
mov byte [esp + 0x14], al
call fcn.004753d0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
jmp 0x475afc
cmp eax, 0x105
jg 0x476603
cmp eax, 0x103
je 0x4765c3
cmp eax, 0x104
jne 0x476479
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x58]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 2
call fcn.004750d0
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
jmp 0x475afc
mov eax, dword [esp + 0x70]
add eax, 0x15180
mov dword [esp], eax
mov eax, dword [esp + 0x74]
adc eax, 0
mov dword [esp + 4], eax
mov dword [esp + 8], 0x93a80
mov dword [esp + 0xc], 0
call fcn.00447bc0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov ecx, 0xc22e4507
imul ecx
mov eax, dword [esp + 0x44]
add edx, eax
sar eax, 0x1f
sar edx, 0x10
sub edx, eax
cmp edx, 7
jae 0x476f5d
lea eax, [0x995a60]
lea edx, [eax + edx*8]
mov ebx, dword [edx + 4]
mov ebp, dword [esp + 0xa8]
lea esi, [ebx + ebp]
mov dword [esp + 0x108], esi
mov edx, dword [edx]
mov edi, dword [esp + 0xac]
cmp esi, edi
ja 0x47655b
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x104], eax
lea eax, [0x995a60]
cmp esi, edi
ja 0x476f56
mov dword [esp + 0x10c], edi
mov eax, dword [esp + 0x104]
lea ecx, [eax + ebp]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
call fcn.0044cf90
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
mov ecx, dword [esp + 0x10c]
mov ebx, dword [esp + 0x104]
mov edx, dword [esp + 0x108]
jmp 0x475afc
mov dword [esp + 0x4c], ebx
mov dword [esp + 0xc0], edx
lea eax, [0x6cb000]
mov dword [esp], eax
mov ecx, dword [esp + 0xd4]
mov dword [esp + 4], ecx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], esi
call fcn.004391a0
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, 0xc22e4507
mov edx, dword [esp + 0xc0]
mov ebx, dword [esp + 0x4c]
mov ebp, dword [esp + 0xa8]
mov esi, dword [esp + 0x108]
mov dword [esp + 0x104], eax
lea eax, [0x995a60]
jmp 0x476509
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x58]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.004750d0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
jmp 0x475afc
cmp eax, 0x106
je 0x4766fc
cmp eax, 0x107
je 0x4766bc
mov eax, dword [esp + 0x68]
cmp eax, 0xa
jge 0x4766b5
lea edx, [esi + 1]
cmp edx, ecx
jg 0x47666d
mov byte [ebx + esi], 0x20
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.004750d0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
jmp 0x475afc
lea eax, [0x6cb000]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
call fcn.004391a0
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea edx, [eax + 1]
mov eax, dword [esp + 0x68]
mov ebp, dword [esp + 0x3c]
mov esi, dword [esp + 0xa8]
mov edi, dword [esp + 0xbc]
jmp 0x47662d
mov edx, esi
jmp 0x476631
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x68]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.004750d0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
jmp 0x475afc
mov eax, dword [esp + 0x70]
add eax, 0x15180
mov dword [esp], eax
mov eax, dword [esp + 0x74]
adc eax, 0
mov dword [esp + 4], eax
mov dword [esp + 8], 0x93a80
mov dword [esp + 0xc], 0
call fcn.00447bc0
mov eax, dword [esp + 0x10]
mov ecx, eax
mov eax, 0xc22e4507
imul ecx
lea eax, [edx + ecx]
sar ecx, 0x1f
sar eax, 0x10
sub eax, ecx
cmp eax, 7
jae 0x476f6b
lea ecx, [0x995a60]
lea eax, [ecx + eax*8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
cmp edx, 3
jb 0x476f64
mov edx, dword [esp + 0xa8]
lea ebx, [edx + 3]
mov ebp, dword [esp + 0xac]
cmp ebx, ebp
ja 0x4767bc
mov esi, dword [esp + 0xd4]
cmp ebx, ebp
ja 0x476f64
mov edi, esi
movzx esi, byte [eax + 2]
xchg esi, eax
mov byte [esp + 0x2b], al
xchg esi, eax
movzx esi, word [eax]
mov word [edi + edx], si
movzx esi, byte [esp + 0x2b]
xchg esi, eax
mov byte [edi + edx + 2], al
xchg esi, eax
mov eax, dword [esp + 0x6c]
mov ecx, ebp
mov edx, ebx
mov ebp, dword [esp + 0x3c]
mov ebx, edi
mov edi, dword [esp + 0xbc]
jmp 0x475afc
mov dword [esp + 0x88], ebx
mov dword [esp + 0xb8], eax
lea eax, [0x6cb000]
mov dword [esp], eax
mov ecx, dword [esp + 0xd4]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
call fcn.004391a0
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0xb8]
lea ecx, [0x995a60]
mov edx, dword [esp + 0xa8]
mov ebx, dword [esp + 0x88]
jmp 0x47677c
cmp eax, 0x20c
jg 0x476a4d
cmp eax, 0x112
jg 0x476928
cmp eax, 0x109
je 0x4768e8
cmp eax, 0x111
je 0x4768a8
cmp eax, 0x112
jne 0x475f93
mov edx, dword [esp + 0x38]
test edx, edx
jge 0x476854
neg edx
mov eax, 0x51eb851f
mov ebp, edx
imul edx
mov edi, ebp
sar ebp, 0x1f
sar edx, 5
sub edx, ebp
imul edx, edx, 0x64
sub edi, edx
mov dword [esp + 0xc], edi
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp + 0x10], 2
call fcn.004750d0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
jmp 0x475afc
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 4
call fcn.004750d0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
jmp 0x475afc
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x68]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 2
call fcn.004750d0
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
jmp 0x475afc
cmp eax, 0x20a
je 0x476a11
cmp eax, 0x20b
je 0x4769ab
cmp eax, 0x20c
jne 0x475f93
mov eax, edx
mov ebp, 0xaaaaaaab
imul ebp
mov ebp, dword [esp + 0x64]
add edx, ebp
mov eax, ebp
sar ebp, 0x1f
sar edx, 3
sub edx, ebp
lea edx, [edx + edx*2]
shl edx, 2
sub eax, edx
test eax, eax
jne 0x47696f
mov eax, 0xc
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 2
call fcn.004750d0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
jmp 0x475afc
mov eax, edx
mov ebp, 0xaaaaaaab
imul ebp
mov ebp, dword [esp + 0x64]
add edx, ebp
mov eax, ebp
sar ebp, 0x1f
sar edx, 3
sub edx, ebp
lea edx, [edx + edx*2]
shl edx, 2
sub eax, edx
test eax, eax
jne 0x4769d5
mov eax, 0xc
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.004750d0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
jmp 0x475afc
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 2
call fcn.004750d0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
jmp 0x475afc
cmp eax, 0x20f
jle 0x476c69
cmp eax, 0x210
je 0x476c29
cmp eax, 0x213
jne 0x476b4c
cmp edx, 0xc
jl 0x476ae4
lea eax, [esi + 2]
cmp eax, ecx
ja 0x476a98
cmp eax, ecx
ja 0x476f4f
movzx edx, word [0x719f60]
mov word [ebx + esi], dx
mov edx, eax
mov eax, dword [esp + 0x6c]
jmp 0x475afc
mov dword [esp + 0x84], eax
lea edx, [0x6cb000]
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call fcn.004391a0
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x84]
mov edx, dword [esp + 0x64]
mov ebp, dword [esp + 0x3c]
mov esi, dword [esp + 0xa8]
mov edi, dword [esp + 0xbc]
jmp 0x476a7a
lea eax, [esi + 2]
cmp eax, ecx
ja 0x476b00
cmp eax, ecx
ja 0x476f48
movzx edx, word [0x719f26]
mov word [ebx + esi], dx
jmp 0x476a8d
mov dword [esp + 0x80], eax
lea edx, [0x6cb000]
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call fcn.004391a0
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x80]
mov edx, dword [esp + 0x64]
mov ebp, dword [esp + 0x3c]
mov esi, dword [esp + 0xa8]
mov edi, dword [esp + 0xbc]
jmp 0x476aeb
cmp eax, 0x214
jne 0x475f93
cmp edx, 0xc
jl 0x476bc7
lea eax, [esi + 2]
cmp eax, ecx
ja 0x476b81
cmp eax, ecx
ja 0x476f41
movzx edx, word [0x71a000]
mov word [ebx + esi], dx
mov edx, eax
mov eax, dword [esp + 0x6c]
jmp 0x475afc
mov dword [esp + 0x7c], eax
lea edx, [0x6cb000]
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call fcn.004391a0
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x7c]
mov edx, dword [esp + 0x64]
mov ebp, dword [esp + 0x3c]
mov esi, dword [esp + 0xa8]
mov edi, dword [esp + 0xbc]
jmp 0x476b63
lea eax, [esi + 2]
cmp eax, ecx
ja 0x476be3
cmp eax, ecx
ja 0x476f3a
movzx edx, word [0x719fe2]
mov word [ebx + esi], dx
jmp 0x476b76
mov dword [esp + 0x78], eax
lea edx, [0x6cb000]
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call fcn.004391a0
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x78]
mov edx, dword [esp + 0x64]
mov ebp, dword [esp + 0x3c]
mov esi, dword [esp + 0xa8]
mov edi, dword [esp + 0xbc]
jmp 0x476bce
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x48]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 2
call fcn.004750d0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
jmp 0x475afc
cmp eax, 0x20d
je 0x476cfb
cmp eax, 0x20e
jne 0x476cbb
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 2
call fcn.004750d0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
jmp 0x475afc
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x48]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.004750d0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
jmp 0x475afc
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.004750d0
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0xbc]
jmp 0x475afc
mov eax, dword [esp + 0x70]
mov dword [esp], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x15180
mov dword [esp + 0xc], 0
call fcn.00447bc0
mov eax, dword [esp + 0x10]
mov ecx, eax
mov eax, 0x91a2b3c5
imul ecx
add edx, ecx
mov eax, ecx
sar ecx, 0x1f
sar edx, 0xb
sub edx, ecx
mov ecx, edx
imul edx, edx, 0xe10
sub eax, edx
mov edx, eax
mov eax, 0x88888889
mov ebx, edx
imul edx
lea eax, [ebx + edx]
mov edx, ebx
sar ebx, 0x1f
sar eax, 5
sub eax, ebx
mov ebx, eax
imul eax, eax, 0x3c
sub edx, eax
mov eax, dword [esp + 0x40]
mov ebp, dword [esp + 0x3c]
mov esi, dword [esp + 0xa8]
mov edi, dword [esp + 0xbc]
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x48], edx
mov edx, ecx
mov ecx, dword [esp + 0xac]
mov ebx, dword [esp + 0xd4]
jmp 0x475bd6
mov eax, dword [esp + 0x70]
mov dword [esp], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 4], ecx
mov byte [esp + 8], 1
call fcn.0047d5f0
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0xd4]
mov ebp, dword [esp + 0x3c]
mov esi, dword [esp + 0xa8]
mov edi, dword [esp + 0xbc]
mov dword [esp + 0x58], eax
mov dword [esp + 0x68], ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0xac]
jmp 0x475bbf
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], esi
mov dword [esp + 0x120], ecx
add esp, 0xec
ret
mov esi, dword [esp + 0x108]
lea edi, [ebx + esi]
mov dword [esp + 0xa4], edi
mov edx, dword [esp + 0x10c]
cmp edi, edx
ja 0x476eb4
cmp edi, edx
ja 0x476f80
mov dword [esp + 0x10c], edx
mov eax, dword [esp + 0x104]
lea edx, [eax + esi]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
call fcn.0044cf90
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0xbc]
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x10c]
mov ebx, dword [esp + 0x104]
mov esi, dword [esp + 0xa4]
jmp 0x475b8d
mov dword [esp + 0xc4], ecx
mov dword [esp + 0x50], ebx
lea eax, [0x6cb000]
mov dword [esp], eax
mov ecx, dword [esp + 0x104]
mov dword [esp + 4], ecx
mov dword [esp + 8], esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], edi
call fcn.004391a0
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc4]
mov ebx, dword [esp + 0x50]
mov ebp, dword [esp + 0x3c]
mov esi, dword [esp + 0x108]
mov edi, dword [esp + 0xa4]
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x40]
jmp 0x476e62
mov ebx, dword [esp + 0x104]
mov esi, dword [esp + 0x108]
mov ecx, dword [esp + 0x10c]
jmp 0x476e2a
call fcn.004260c0
ud2
call fcn.004260c0
ud2
call fcn.004260c0
ud2
call fcn.004260c0
ud2
call fcn.004260c0
ud2
call fcn.004260c0
ud2
call fcn.00426060
ud2
call fcn.004260c0
ud2
call fcn.00426060
ud2
call fcn.004260c0
ud2
call fcn.004260c0
ud2
call fcn.004260c0
ud2
call fcn.0044ae20
jmp fcn.00475a40