Function at 0x4fb271
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push esi
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
call 0x4fab60
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffd2
jne 0x42f582
mov ecx, 0x6fd13c
call fcn.0042eab0
mov ecx, eax
call fcn.0045bfa0
test eax, eax
jne 0x42f580
push 4
call fcn.00524591
push 0
mov esi, eax
push 0x80000
push 0x8000
mov dword [esp + 0x14], esi
call fcn.00518da0
add esp, 0x10
mov dword [esi], eax
mov ecx, 0x6fd13c
call fcn.0042eab0
push esi
mov ecx, eax
call fcn.0045c020
pop esi
add esp, 4
jmp 0x4fab60
mov eax, esi
pop esi
pop ecx
ret
sub esp, 0x164
mov eax, dword [0x6fb4c0]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [esp + 0x180]
mov edx, dword [esp + 0x190]
mov eax, dword [esp + 0x18c]
mov ebp, dword [esp + 0x17c]
xor ebx, ebx
mov esi, dword [esp + 0x178]
mov dword [esp + 0x28], ecx
xor ecx, ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x58], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x60], 0
mov edi, dword [esp + 0x184]
mov dword [esp + 0x34], edi
test ebp, ebp
jne 0x4fac02
test ecx, ecx
mov eax, 0x591a00
cmovne eax, ebp
mov ebp, eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
test dword [esp + 0x188], 0x1fff9fc0
jne 0x4fbf29
test esi, esi
je 0x4fbf22
test ebp, ebp
je 0x4fbf22
test eax, eax
je 0x4fbf22
lea esi, [edi*2]
add esi, ebp
mov dword [esp + 0x2c], esi
lea eax, [esi - 2]
mov dword [esp + 0x68], eax
cmp ecx, 0xffffffff
jne 0x4fac5f
push ebp
call fcn.0051e0c0
mov edx, dword [esp + 0x40]
mov ecx, eax
add esp, 4
mov dword [esp + 0x28], ecx
mov dword [esp + 0x60], 1
lea eax, [ecx*2]
add eax, ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0x5c], eax
cmp edi, ecx
jbe 0x4fac7e
mov eax, 0xffffffdf
jmp 0x4fbf2e
mov ebp, dword [esp + 0x24]
cmp dword [ebp + 0x38], 0x50435245
je 0x4fac95
mov eax, 0xffffffe1
jmp 0x4fbf2e
mov ecx, dword [ebp + 0x48]
mov eax, ecx
and al, 7
cmp al, 2
je 0x4facaa
mov eax, 0xffffffe0
jmp 0x4fbf2e
mov eax, dword [esp + 0x188]
shr ecx, 0xe
and ecx, 0xc
or eax, ecx
mov dword [esp + 0x188], eax
cmp dword [ebp + 0x10], ebx
je 0x4facd3
test eax, 0xbfffbfc0
jne 0x4facd3
mov edi, 1
jmp 0x4facd5
xor edi, edi
mov ecx, dword [ebp + 0x40]
mov eax, ecx
shr eax, 0x13
and eax, 1
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x188]
test al, 0x20
je 0x4facfa
mov eax, 2
jmp 0x4fad00
shr eax, 4
and eax, 1
movzx eax, ax
mov word [esp + 0x108], ax
test ax, ax
je 0x4fad24
mov eax, ecx
or eax, dword [esp + 0x188]
test eax, 0x20000000
jne 0x4fbf29
test edx, edx
je 0x4fad40
cmp dword [edx + 0x24], 0xffffffff
je 0x4fad40
test ecx, 0x800000
jne 0x4fad40
mov eax, 0xffffffc8
jmp 0x4fbf2e
mov edx, dword [esp + 0x20]
test byte [edx + 0x2d], 1
je 0x4fad64
push dword [edx + 8]
mov eax, dword [edx + 4]
push dword [edx + 0x10]
call eax
mov edx, dword [esp + 0x28]
add esp, 8
mov ecx, dword [esp + 0x1c]
and byte [edx + 0x2d], 0xfe
mov dword [edx + 0x10], ebx
lea ebp, [edx + 0x28]
mov dword [ebp], ebx
mov dword [esp + 0x48], 0xfc00
mov dword [esp + 0x4c], 0xdc00
test edi, edi
je 0x4faec6
cmp dword [esp + 0x18], ebx
je 0x4fae4a
test dword [esp + 0x188], 0x40000000
jne 0x4fae4a
test ecx, 0x4000000
jne 0x4fae4a
mov ebx, 0xfc00
mov edi, 0xdc00
cmp esi, dword [esp + 0x10]
jae 0x4fadda
mov ax, word [esi]
and ax, bx
cmp ax, di
jne 0x4fadda
xor eax, eax
cmp eax, dword [esp + 0x34]
sbb eax, eax
and eax, 0xfffffff6
add eax, 0xffffffe6
jmp 0x4fbf2e
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
movzx ecx, word [eax + 0x64]
test ecx, ecx
je 0x4fae1b
nop word [eax + eax]
cmp esi, edx
jbe 0x4fae17
sub esi, 2
cmp esi, edx
jbe 0x4fae12
nop dword [eax + eax]
mov ax, word [esi]
and ax, bx
cmp ax, di
jne 0x4fae12
sub esi, 2
cmp esi, edx
ja 0x4fae00
sub ecx, 1
jne 0x4fadf0
mov dword [esp + 0x2c], esi
mov eax, dword [esp + 0x28]
mov edi, esi
sub edi, edx
sar edi, 1
push ebp
sub eax, edi
push eax
push esi
call fcn.005214c0
mov edx, dword [esp + 0x2c]
add esp, 0xc
mov dword [edx + 0x30], eax
test eax, eax
je 0x4fae45
add dword [edx + 0x28], edi
jmp 0x4fbf2e
mov ebx, 1
push dword [esp + 0x3c]
push edx
push dword [esp + 0x190]
push dword [esp + 0x40]
push dword [esp + 0x38]
push dword [esp + 0x28]
push dword [esp + 0x3c]
call fcn.00518be0
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffd3
je 0x4faec6
test edi, edi
js 0x4faebf
test dword [esp + 0x188], 0x4000
je 0x4faebf
mov ecx, dword [esp + 0x60]
mov esi, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
lea esi, [esi + ecx]
push dword [ebx + 8]
mov eax, dword [ebx]
add esi, esi
push esi
call eax
add esp, 8
mov dword [ebx + 0x10], eax
test eax, eax
je 0x4fb34c
push esi
push dword [esp + 0x18]
push eax
call fcn.00526230
add esp, 0xc
or byte [ebx + 0x2d], 1
mov eax, edi
jmp 0x4fbf2e
cmp dword [esp + 0x18], 0
mov edi, dword [esp + 0x14]
mov dword [esp + 0x11c], edi
je 0x4fb096
test ebx, ebx
jne 0x4fb096
test dword [esp + 0x188], 0x40000000
mov ebx, dword [esp + 0x1c]
je 0x4faf01
test ebx, 0x4000000
je 0x4fb096
mov edx, dword [esp + 0x10]
mov eax, ebx
xor ecx, ecx
and eax, 0x4000000
cmp esi, edx
jae 0x4faf5a
test eax, eax
je 0x4faf41
nop word [eax + eax]
mov ax, word [esi]
and ax, word [esp + 0x48]
cmp ax, word [esp + 0x4c]
jne 0x4faf5a
add esi, 2
mov ecx, 1
mov dword [esp + 0x2c], esi
cmp esi, edx
jb 0x4faf20
jmp 0x4faf5a
mov ax, word [esi]
mov edx, 0xfc00
and ax, dx
mov edx, 0xdc00
cmp ax, dx
je 0x4fadc7
mov edx, esi
mov dword [esp + 0x11c], edx
test ecx, ecx
jne 0x4fafb2
mov eax, dword [esp + 0x24]
movzx ecx, word [eax + 0x64]
test ecx, ecx
je 0x4fafb2
cmp edx, edi
jbe 0x4fafb2
sub edx, 2
mov dword [esp + 0x11c], edx
cmp edx, edi
jbe 0x4fafad
nop word [eax + eax]
mov ax, word [edx]
and ax, word [esp + 0x48]
cmp ax, word [esp + 0x4c]
jne 0x4fafad
sub edx, 2
mov dword [esp + 0x11c], edx
cmp edx, edi
ja 0x4faf90
sub ecx, 1
jne 0x4faf73
mov eax, dword [esp + 0x28]
mov ecx, edx
sub ecx, edi
sar ecx, 1
push ebp
sub eax, ecx
push eax
push edx
call fcn.005214c0
mov edx, eax
add esp, 0xc
mov eax, dword [esp + 0x20]
mov dword [eax + 0x30], edx
test edx, edx
je 0x4fb096
lea edi, [eax + 0x28]
nop dword [eax]
mov ecx, dword [esp + 0x11c]
mov ebp, dword [esp + 0x14]
sub ecx, ebp
mov eax, dword [edi]
sar ecx, 1
add eax, ecx
mov dword [edi], eax
test ebx, 0x4000000
je 0x4fb08f
test edx, edx
jg 0x4fb08f
lea ebp, [ebp + eax*2]
mov dword [esp + 0x10], ebp
cmp ebp, esi
jae 0x4fb081
lea edx, [ebp + 2]
mov dword [esp + 0x11c], edx
cmp edx, esi
jae 0x4fb049
mov ecx, 0xfc00
mov ebp, 0xdc00
nop dword [eax]
mov ax, word [edx]
and ax, cx
cmp ax, bp
jne 0x4fb049
add edx, 2
mov dword [esp + 0x11c], edx
cmp edx, esi
jb 0x4fb030
mov eax, dword [esp + 0x28]
mov ecx, edx
sub ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x5c]
sar ecx, 1
push edi
sub eax, ecx
mov dword [esp + 0x14], ebp
push eax
push edx
call fcn.005214c0
mov edx, eax
add esp, 0xc
mov eax, dword [esp + 0x20]
mov dword [eax + 0x30], edx
test edx, edx
jne 0x4fafe0
mov edi, dword [esp + 0x14]
jmp 0x4fb09a
mov edi, dword [esp + 0x14]
mov dword [esp + 0x58], 2
jmp 0x4fb09a
mov eax, edx
jmp 0x4fbf2e
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x3c]
test ecx, ecx
jne 0x4fb0af
mov eax, dword [esp + 0x24]
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
jmp 0x4fb0b6
movq xmm0, qword [ecx]
mov eax, dword [ecx + 8]
test ecx, ecx
mov dword [esp + 0xd4], eax
mov ebx, 0x6a10cc
movq qword [esp + 0xcc], xmm0
cmovne ebx, ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0x40]
mov eax, edx
or eax, dword [esp + 0x188]
mov ecx, dword [ecx + 0x48]
shr eax, 0x1f
mov dword [esp + 0x48], eax
mov eax, edx
shr eax, 8
and eax, 1
mov dword [esp + 0x70], eax
mov eax, ecx
shr eax, 9
and eax, 1
mov dword [esp + 0x4c], eax
mov eax, dword [ebx + 0x24]
cmp eax, 0xffffffff
jne 0x4fb110
mov eax, dword [esp + 0x5c]
jmp 0x4fb113
lea eax, [edi + eax*2]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x8c]
mov dword [esp + 0x164], eax
mov eax, ebp
mov ebp, dword [esp + 0x34]
sub eax, edi
sar eax, 1
mov dword [esp + 0xa8], eax
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x16c], eax
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x168], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x120], eax
mov eax, ecx
shr eax, 0xc
and eax, 1
mov dword [esp + 0x8c], 2
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0xa4], edi
mov dword [esp + 0xc8], 0
mov dword [esp + 0x118], edi
cmp word [eax + 0x64], 0
mov dword [esp + 0x100], ebp
ja 0x4fb1a6
test ecx, 0x2000
jne 0x4fb1a6
xor eax, eax
jmp 0x4fb1ab
mov eax, 1
mov dword [esp + 0xf0], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x148], edx
mov dword [esp + 0x150], 0
mov dword [esp + 0x134], 0
movzx edx, word [eax + 0x6e]
lea edi, [eax + 0x70]
movzx eax, word [eax + 0x6c]
mov word [esp + 0x10e], ax
imul eax, edx
mov dword [esp + 0x110], edi
mov dword [esp + 0x130], 0
mov word [esp + 0x10c], dx
mov dword [esp + 0x154], 0
lea eax, [edi + eax*2]
mov edi, dword [esp + 0x24]
mov dword [esp + 0x114], eax
mov ax, word [edi + 0x60]
mov word [esp + 0x10a], ax
movzx eax, word [edi + 0x62]
dec eax
cmp eax, 5
ja case.default.0x4fb236
jmp dword [eax*4 + 0x4fbf48]
mov eax, 0xd
mov dword [esp + 0x158], 1
mov word [esp + 0x15c], ax
jmp 0x4fb2b8
mov eax, 0xa
mov dword [esp + 0x158], 1
mov word [esp + 0x15c], ax
jmp 0x4fb2b8
xor eax, eax
mov dword [esp + 0x158], 1
mov word [esp + 0x15c], ax
jmp 0x4fb2b8
mov dword [esp + 0x158], 2
mov dword [esp + 0x15c], 0xa000d
jmp 0x4fb2b8
mov dword [esp + 0x154], 1
jmp 0x4fb2b8
mov dword [esp + 0x154], 2
movzx eax, word [edi + 0x68]
mov edx, dword [ebx + 0x28]
mov ecx, dword [ebx + 0x2c]
lea eax, [eax*8 + 0x57]
and eax, 0xfffffffc
cmp edx, dword [edi + 0x4c]
mov dword [esp + 0x3c], eax
cmovae edx, dword [edi + 0x4c]
shl edx, 0xa
cmp ecx, dword [edi + 0x50]
mov dword [esp + 0xd8], edx
cmovae ecx, dword [edi + 0x50]
mov dword [esp + 0xdc], ecx
mov ecx, dword [ebx + 0x30]
cmp ecx, dword [edi + 0x54]
cmovae ecx, dword [edi + 0x54]
lea edi, [eax + eax*4]
add edi, edi
mov dword [esp + 0xe0], ecx
mov ecx, 0x5000
cmp edi, ecx
cmovb edi, ecx
cmp edi, edx
jbe 0x4fb323
cmp eax, edx
jbe 0x4fb321
mov eax, 0xffffffc1
jmp 0x4fbf2e
mov edi, edx
mov ebx, dword [esp + 0x20]
cmp dword [ebx + 0x1c], edi
jae 0x4fb35d
push dword [ebx + 8]
mov eax, dword [ebx + 4]
push dword [ebx + 0x18]
call eax
push dword [ebx + 8]
mov eax, dword [ebx]
push edi
call eax
add esp, 0x10
mov dword [ebx + 0x18], eax
test eax, eax
jne 0x4fb356
mov dword [ebx + 0x1c], eax
mov eax, 0xffffffd0
jmp 0x4fbf2e
mov eax, dword [esp + 0x3c]
mov dword [ebx + 0x1c], edi
add eax, 0xffffffac
push eax
mov eax, dword [ebx + 0x18]
add eax, 0x54
push 0xff
push eax
call fcn.00526970
mov ecx, dword [esp + 0x30]
add esp, 0xc
mov dword [esp + 0x34], 0xff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x48]
mov dword [esp + 0xf4], eax
lea edi, [eax + 0x100]
add eax, 0x340
mov dword [esp + 0xf8], edi
mov dword [esp + 0xfc], eax
test dl, 0x10
je 0x4fb446
movzx ebx, word [ecx + 0x58]
movzx eax, bx
mov dword [esp + 0x54], 1
mov dword [esp + 0x40], ebx
mov dword [esp + 0x38], eax
test dl, 0x20
je 0x4fb45f
mov ecx, 0xff
cmp bx, cx
ja 0x4fb3ef
movzx eax, bx
movzx eax, byte [eax + edi]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x38]
cmp ax, 0x7f
jbe 0x4fb45f
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test ecx, ecx
jne 0x4fb403
test ebx, 0x20000
je 0x4fb467
movzx ecx, ax
mov eax, ecx
shr eax, 7
movzx eax, word [eax*2 + 0x6a80c8]
shl eax, 7
and ecx, 0x8000007f
jns 0x4fb423
dec ecx
or ecx, 0xffffff80
inc ecx
add eax, ecx
movzx eax, word [eax*2 + 0x6ac4c8]
lea eax, [eax + eax*2]
mov ax, word [eax*4 + 0x6a3ebc]
add ax, word [esp + 0x38]
movzx ecx, ax
mov dword [esp + 0x40], ecx
jmp 0x4fb463
cmp dword [esp + 0x4c], 0
jne 0x4fb45f
mov ebx, dword [esp + 0x1c]
test dl, 0x40
je 0x4fb463
add ecx, 0x14
mov dword [esp + 0x50], ecx
jmp 0x4fb463
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x40]
movzx esi, ax
mov eax, dword [esp + 0x38]
movzx eax, ax
mov dword [esp + 0x78], esi
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x74], eax
test dl, dl
jns 0x4fb51b
mov eax, dword [esp + 0x24]
mov dword [esp + 0x64], 1
movzx eax, word [eax + 0x5c]
mov dword [esp + 0x30], eax
movzx eax, ax
mov dword [esp + 0x44], eax
test edx, 0x100
je 0x4fb51d
mov edx, dword [esp + 0x30]
cmp dx, word [esp + 0x34]
ja 0x4fb4cc
movzx eax, dx
movzx eax, byte [eax + edi]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x44]
cmp ax, 0x7f
jbe 0x4fb51d
test ecx, ecx
jne 0x4fb4d8
test ebx, 0x20000
je 0x4fb51d
movzx ecx, ax
mov eax, ecx
shr eax, 7
movzx eax, word [eax*2 + 0x6a80c8]
shl eax, 7
and ecx, 0x8000007f
jns 0x4fb4f8
dec ecx
or ecx, 0xffffff80
inc ecx
add eax, ecx
movzx eax, word [eax*2 + 0x6ac4c8]
lea eax, [eax + eax*2]
mov ax, word [eax*4 + 0x6a3ebc]
add ax, word [esp + 0x44]
movzx eax, ax
mov dword [esp + 0x30], eax
jmp 0x4fb51d
xor eax, eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
movzx eax, ax
mov dword [esp + 0x80], eax
lea eax, [ebp*2]
mov dword [esp + 0x7c], eax
add eax, ecx
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x20]
add eax, 0x28
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x120]
nop dword [eax]
xor ebp, ebp
xor edi, edi
mov dword [esp + 0x34], ebp
mov ebp, dword [esp + 0x154]
mov dword [esp + 0x1c], edi
mov dword [esp + 0xe8], edi
nop word [eax + eax]
mov ebx, dword [esp + 0x24]
test dword [ebx + 0x40], 0x10000
mov ebx, dword [esp + 0x20]
jne 0x4fbb41
cmp dword [esp + 0x70], 0
je 0x4fb70f
mov edi, esi
cmp esi, edx
jae 0x4fb709
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4fb687
jmp 0x4fb5c7
mov eax, dword [esp + 0x120]
test ebp, ebp
je 0x4fb601
cmp edi, eax
jae 0x4fb5f5
push ecx
lea ecx, [esp + 0x15c]
push ecx
push eax
push ebp
push edi
call fcn.0051fb30
mov ebp, dword [esp + 0x168]
add esp, 0x14
test eax, eax
je 0x4fb5f5
mov eax, 1
jmp 0x4fb5f7
xor eax, eax
test eax, eax
jne 0x4fb709
jmp 0x4fb640
mov edx, dword [esp + 0x158]
mov ecx, dword [esp + 0x120]
lea eax, [edx + edx]
sub ecx, eax
cmp edi, ecx
ja 0x4fb640
mov ax, word [edi]
cmp ax, word [esp + 0x15c]
jne 0x4fb640
cmp edx, 1
je 0x4fb709
mov ax, word [edi + 2]
cmp ax, word [esp + 0x15e]
je 0x4fb709
mov edx, dword [esp + 0x10]
add edi, 2
cmp edi, edx
jae 0x4fb709
mov ax, word [edi]
mov ecx, 0xfc00
and ax, cx
mov ecx, 0xdc00
cmp ax, cx
mov ecx, dword [esp + 0x18]
jne 0x4fb5c0
add edi, 2
cmp edi, edx
jae 0x4fb709
jmp 0x4fb5c0
mov eax, dword [esp + 0x120]
test ebp, ebp
je 0x4fb6bd
cmp edi, eax
jae 0x4fb6b5
push ecx
lea ecx, [esp + 0x15c]
push ecx
push eax
push ebp
push edi
call fcn.0051fb30
mov ebp, dword [esp + 0x168]
add esp, 0x14
test eax, eax
je 0x4fb6b5
mov eax, 1
jmp 0x4fb6b7
xor eax, eax
test eax, eax
jne 0x4fb705
jmp 0x4fb6f4
mov edx, dword [esp + 0x158]
mov ecx, dword [esp + 0x120]
lea eax, [edx + edx]
sub ecx, eax
cmp edi, ecx
ja 0x4fb6f4
mov ax, word [edi]
cmp ax, word [esp + 0x15c]
jne 0x4fb6f4
cmp edx, 1
je 0x4fb705
mov ax, word [edi + 2]
cmp ax, word [esp + 0x15e]
je 0x4fb705
mov ecx, dword [esp + 0x18]
add edi, 2
cmp edi, dword [esp + 0x10]
jb 0x4fb680
mov esi, dword [esp + 0x2c]
mov edx, edi
mov dword [esp + 0x10], edx
mov edi, dword [esp + 0x48]
test edi, edi
je 0x4fb808
mov ecx, dword [esp + 0x54]
mov ebp, dword [esp + 0x50]
test ecx, ecx
jne 0x4fb72f
test ebp, ebp
je 0x4fba72
cmp esi, edx
sbb eax, eax
neg eax
cmp esi, edx
jae 0x4fb782
movzx eax, word [esi]
test ecx, ecx
je 0x4fb756
cmp ax, word [esp + 0x38]
je 0x4fba72
cmp ax, word [esp + 0x40]
je 0x4fba72
test ebp, ebp
je case.0x4fbbff.997
mov ecx, 0xff
cmp ax, cx
cmova eax, ecx
movzx edx, ax
mov eax, 1
mov ecx, edx
shr edx, 3
and ecx, 7
shl eax, cl
test byte [edx + ebp], al
mov eax, 0
setne al
test eax, eax
jne 0x4fba72
xor ebx, ebx
cmp dword [esp + 0x18], 0
mov edx, dword [esp + 0x10]
je 0x4fbe00
mov ebp, dword [esp + 0x5c]
cmp edx, ebp
je 0x4fbe00
test ebx, ebx
je 0x4fb7b4
cmp ebx, 0xfffffffe
jne 0x4fbe00
mov ebx, dword [esp + 0x88]
mov edi, 0xdc00
lea esi, [edx + 2]
mov dword [esp + 0x2c], esi
cmp esi, ebp
jae 0x4fb7ea
mov ecx, 0xfc00
mov ax, word [esi]
and ax, cx
cmp ax, di
jne 0x4fbd87
add esi, 2
mov dword [esp + 0x2c], esi
cmp esi, ebp
jb 0x4fb7d0
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x134]
mov byte [edi + 0x2c], 0
mov dword [edi + 0x14], eax
jmp 0x4fbed7
cmp dword [esp + 0x54], 0
je 0x4fb86f
cmp esi, edx
jae 0x4fb84c
mov eax, dword [esp + 0x74]
cmp ax, word [esp + 0x78]
je 0x4fb83c
mov ecx, dword [esp + 0x38]
mov ebp, dword [esp + 0x40]
movzx eax, word [esi]
cmp ax, cx
je 0x4fb84c
cmp ax, bp
je 0x4fb84c
add esi, 2
cmp esi, edx
jb 0x4fb826
jmp 0x4fb84c
mov eax, dword [esp + 0x38]
cmp word [esi], ax
je 0x4fb84c
add esi, 2
cmp esi, edx
jb 0x4fb840
cmp word [esp + 0x108], 0
mov eax, dword [esp + 0x120]
jne 0x4fba79
cmp esi, eax
jae case.0x4fbbff.997
jmp 0x4fba79
cmp dword [esp + 0x4c], 0
je 0x4fba28
mov eax, dword [esp + 0x7c]
mov ebx, dword [esp + 0x118]
add eax, ebx
cmp esi, eax
jbe 0x4fba6e
cmp esi, edx
jae 0x4fb8e3
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4fb992
nop
test ebp, ebp
je 0x4fb921
cmp esi, ebx
jbe 0x4fb8d5
push eax
lea eax, [esp + 0x15c]
push eax
push ebx
push ebp
push esi
call fcn.0051fbf0
mov ebp, dword [esp + 0x168]
add esp, 0x14
mov ebx, dword [esp + 0x118]
test eax, eax
je 0x4fb8d5
mov eax, 1
jmp 0x4fb8d7
xor eax, eax
test eax, eax
je 0x4fb956
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x48]
cmp word [esi - 2], 0xd
jne 0x4fba6e
cmp ebp, 1
je 0x4fb8fc
cmp ebp, 2
jne 0x4fba6e
cmp esi, edx
jae 0x4fba6e
cmp word [esi], 0xa
mov eax, dword [esp + 0x120]
mov ebx, dword [esp + 0x20]
jne 0x4fba79
add esi, 2
jmp 0x4fba79
mov edx, dword [esp + 0x158]
lea edi, [edx + edx]
lea eax, [ebx + edi]
cmp esi, eax
jb 0x4fb956
mov ecx, esi
sub ecx, edi
mov ax, word [ecx]
cmp ax, word [esp + 0x15c]
jne 0x4fb956
cmp edx, 1
je 0x4fb8db
mov ax, word [ecx + 2]
cmp ax, word [esp + 0x15e]
je 0x4fb8db
mov edx, dword [esp + 0x10]
add esi, 2
cmp esi, edx
jae 0x4fb8df
mov ax, word [esi]
mov ecx, 0xfc00
and ax, cx
mov ecx, 0xdc00
cmp ax, cx
mov eax, dword [esp + 0x18]
jne 0x4fb8a0
add esi, 2
cmp esi, edx
jae 0x4fb8df
jmp 0x4fb8a0
test ebp, ebp
je 0x4fb9d3
cmp esi, ebx
jbe 0x4fb9c7
push eax
lea eax, [esp + 0x15c]
push eax
push ebx
push ebp
push esi
call fcn.0051fbf0
mov ebp, dword [esp + 0x168]
add esp, 0x14
mov ebx, dword [esp + 0x118]
test eax, eax
je 0x4fb9c7
mov eax, 1
jmp 0x4fb9c9
xor eax, eax
test eax, eax
jne 0x4fb8db
jmp 0x4fba10
mov edx, dword [esp + 0x158]
lea edi, [edx + edx]
lea eax, [ebx + edi]
cmp esi, eax
jb 0x4fba10
mov ecx, esi
sub ecx, edi
mov ax, word [ecx]
cmp ax, word [esp + 0x15c]
jne 0x4fba10
cmp edx, 1
je 0x4fb8db
mov ax, word [ecx + 2]
cmp ax, word [esp + 0x15e]
je 0x4fb8db
mov edx, dword [esp + 0x10]
add esi, 2
mov eax, dword [esp + 0x18]
cmp esi, edx
jb 0x4fb992
jmp 0x4fb8df
mov ebp, dword [esp + 0x50]
test ebp, ebp
je 0x4fba72
cmp esi, edx
jae 0x4fb84c
mov ebx, 0xff
nop dword [eax]
movzx edx, word [esi]
mov eax, 1
cmp edx, ebx
cmova edx, ebx
mov ecx, edx
shr edx, 3
and ecx, 7
shl eax, cl
test byte [edx + ebp], al
jne 0x4fba65
add esi, 2
cmp esi, dword [esp + 0x10]
jb 0x4fba40
mov ebx, dword [esp + 0x20]
jmp 0x4fb84c
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x120]
cmp word [esp + 0x108], 0
mov edx, eax
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x10], edx
jne 0x4fbc20
movzx eax, word [ebp + 0x66]
sub edx, esi
sar edx, 1
cmp edx, eax
jl case.0x4fbbff.997
cmp dword [esp + 0x64], 0
mov eax, dword [esp + 0x54]
lea ecx, [esi + eax*2]
je 0x4fbc20
cmp ecx, dword [esp + 0x68]
jbe 0x4fbc20
cmp edx, 0x7d0
jb 0x4fbada
test edi, edi
jne 0x4fbc20
cmp edx, 0x1e8480
jae 0x4fbc20
mov edx, dword [esp + 0x120]
cmp ecx, edx
jae case.0x4fbbff.997
mov ebp, dword [esp + 0x30]
movzx eax, bp
mov ebp, dword [esp + 0x44]
cmp word [esp + 0x80], ax
je 0x4fbc06
movzx eax, word [ecx]
mov edi, ecx
add ecx, 2
mov edx, eax
cmp ax, bp
je 0x4fbb26
cmp dx, word [esp + 0x30]
je 0x4fbb26
cmp ecx, dword [esp + 0x120]
jb 0x4fbb02
jmp case.0x4fbbff.997
mov edx, dword [esp + 0x120]
cmp edi, edx
jae case.0x4fbbff.997
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x68], edi
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x24]
cmp esi, dword [esp + 0x6c]
ja case.0x4fbbff.997
or dword [esp + 0xc8], 1
mov eax, esi
sub eax, ecx
mov dword [esp + 0x128], esi
sar eax, 1
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0x58]
or eax, dword [esp + 0x188]
mov dword [esp + 0x144], eax
lea eax, [esp + 0xcc]
push eax
movzx eax, word [ebp + 0x68]
push ebx
push dword [esp + 0x44]
mov dword [esp + 0x138], esi
push eax
push dword [esp + 0x124]
mov dword [esp + 0xf8], 0
push esi
mov dword [esp + 0x11c], 0
mov dword [esp + 0x164], 0
call fcn.004ef6f0
add esp, 0x18
mov ebx, eax
cmp dword [esp + 0xe8], 0
je 0x4fbbe6
test edi, edi
jne 0x4fbbe6
mov eax, dword [esp + 0x128]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x34], esi
test ebx, ebx
jg case.default.0x4fbbff
je case.0x4fbbff.996
lea eax, [ebx + 0x3e5]
cmp eax, 4
ja case.default.0x4fbbff
jmp dword [eax*4 + 0x4fbf60]
mov ax, word [ecx]
mov edi, ecx
add ecx, 2
cmp ax, bp
je 0x4fbb2d
cmp ecx, edx
jb 0x4fbc06
jmp case.0x4fbbff.997
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
jmp 0x4fbb45
mov eax, dword [esp + 0x14c]
mov edi, esi
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x150], eax
jmp 0x4fbc88
mov edi, dword [esp + 0x13c]
cmp edi, esi
jbe case.0x4fbbff.996
mov ecx, dword [esp + 0x18]
jmp 0x4fbc88
mov ecx, dword [esp + 0x18]
lea edi, [esi + 2]
mov dword [esp + 0x150], 0
test ecx, ecx
je 0x4fbc88
cmp edi, dword [esp + 0x10]
jae 0x4fbc88
mov ax, word [edi]
mov edx, 0xfc00
and ax, dx
mov edx, 0xdc00
cmp ax, dx
jne 0x4fbc88
add edi, 2
mov ebp, dword [esp + 0x154]
xor ebx, ebx
cmp dword [esp + 0x70], ebx
je 0x4fbd0e
mov eax, dword [esp + 0x120]
test ebp, ebp
je 0x4fbcd6
cmp esi, eax
jae 0x4fbcca
push ecx
lea ecx, [esp + 0x15c]
push ecx
push eax
push ebp
push esi
call fcn.0051fb30
mov ebp, dword [esp + 0x168]
add esp, 0x14
test eax, eax
je 0x4fbcca
lea eax, [ebx + 1]
jmp 0x4fbccc
xor eax, eax
test eax, eax
jne case.default.0x4fbbff
jmp 0x4fbd0e
mov edx, dword [esp + 0x158]
lea ecx, [edx + edx]
sub eax, ecx
cmp esi, eax
ja 0x4fbd0e
mov ax, word [esi]
cmp ax, word [esp + 0x15c]
jne 0x4fbd0e
cmp edx, 1
je case.default.0x4fbbff
mov ax, word [esi + 2]
cmp ax, word [esp + 0x15e]
je case.default.0x4fbbff
mov esi, edi
mov dword [esp + 0x2c], esi
cmp dword [esp + 0x48], ebx
jne case.default.0x4fbbff
mov edx, dword [esp + 0x10]
cmp edi, edx
ja case.default.0x4fbbff
cmp edi, dword [esp + 0x84]
jbe 0x4fbd6c
cmp word [edi - 2], 0xd
jne 0x4fbd6c
cmp edi, edx
jae 0x4fbd6c
cmp word [edi], 0xa
jne 0x4fbd6c
mov eax, dword [esp + 0x24]
test dword [eax + 0x48], 0x800
jne 0x4fbd6c
cmp ebp, 1
je 0x4fbd65
cmp ebp, 2
je 0x4fbd65
cmp dword [esp + 0x158], 2
jne 0x4fbd6c
lea esi, [edi + 2]
mov dword [esp + 0x2c], esi
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x130], ebx
jmp 0x4fb580
mov eax, dword [esp + 0x28]
mov ecx, esi
sub ecx, dword [esp + 0x14]
sar ecx, 1
push ebx
sub eax, ecx
mov dword [esp + 0x120], esi
push eax
push esi
call fcn.005214c0
add esp, 0xc
test eax, eax
je 0x4fbde0
mov edx, dword [esp + 0x10]
jns 0x4fb7c0
mov eax, dword [ebx]
lea edx, [esi + eax*2]
mov dword [esp + 0x10], edx
mov eax, edx
mov dword [esp + 0x120], eax
cmp edx, esi
jbe 0x4fb7c0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x58], 3
jmp 0x4fb560
mov ecx, dword [esp + 0x14]
mov edx, ebp
mov eax, ebp
mov dword [esp + 0x10], edx
mov dword [esp + 0x120], eax
mov dword [esp + 0x58], 1
jmp 0x4fb560
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x130]
mov dword [edi + 0x14], eax
mov byte [edi + 0x2c], 0
cmp ebx, 1
jne 0x4fbec4
movzx eax, word [edi + 0x2e]
mov ecx, dword [esp + 0x104]
add eax, eax
cmp ecx, eax
jl 0x4fbe37
xor eax, eax
jmp 0x4fbe3f
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
inc eax
mov ebx, dword [esp + 0x14]
sub esi, ebx
mov ecx, dword [esp + 0x124]
mov dword [edi + 0x30], eax
mov eax, dword [esp + 0x128]
sub eax, ebx
sar esi, 1
sar eax, 1
cmp dword [esp + 0x12c], ecx
mov dword [edi + 0x28], esi
cmova ecx, dword [esp + 0x12c]
sub ecx, ebx
mov dword [edi + 0x20], eax
sar ecx, 1
test dword [esp + 0x188], 0x4000
mov dword [edi + 0x24], ecx
je 0x4fbebc
mov ecx, dword [esp + 0x60]
mov esi, dword [esp + 0x28]
push dword [edi + 8]
mov eax, dword [edi]
lea esi, [esi + ecx]
add esi, esi
push esi
call eax
add esp, 8
mov dword [edi + 0x10], eax
test eax, eax
je 0x4fb34c
push esi
push ebx
push eax
call fcn.00526230
mov eax, dword [edi + 0x30]
add esp, 0xc
or byte [edi + 0x2d], 1
jmp 0x4fbf2e
mov eax, dword [edi + 0x30]
mov dword [edi + 0x10], ebx
jmp 0x4fbf2e
mov eax, dword [esp + 0x134]
mov dword [edi + 0x14], eax
test ebx, ebx
je 0x4fbed7
cmp ebx, 0xfffffffe
jne 0x4fbf14
mov ebp, dword [esp + 0x34]
test ebp, ebp
je 0x4fbf11
mov eax, dword [esp + 0x14]
mov ebx, 0xfffffffe
mov ecx, dword [esp + 0x1c]
sub ebp, eax
sub edx, eax
sar ebp, 1
sar edx, 1
sub ecx, eax
sar ecx, 1
mov dword [edi + 0x10], eax
mov eax, ebx
mov dword [edi + 0x34], ebp
mov dword [edi + 0x38], edx
mov dword [edi + 0x28], ebp
mov dword [edi + 0x20], ecx
mov dword [edi + 0x24], edx
mov dword [edi + 0x30], ebx
jmp 0x4fbf2e
or ebx, 0xffffffff
mov dword [edi + 0x30], ebx
mov eax, ebx
jmp 0x4fbf2e
mov eax, 0xffffffd4
jmp 0x4fbf2e
mov eax, 0xffffffcd
jmp 0x4fbf2e
mov eax, 0xffffffde
mov ecx, dword [esp + 0x170]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00524900
add esp, 0x164
ret