Function at 0x4af9d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x130
cmp byte [esp + 0x144], 0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x140]
push edi
mov dword [esp + 0x30], 0
je 0x4afa2c
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
mov ecx, esi
call edx
test eax, eax
je 0x4afa2c
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
mov ecx, esi
call edx
call fcn.0045ea70
test al, al
jne 0x4b0e64
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
mov ecx, esi
call edx
call fcn.0045ea90
test al, al
jne 0x4b0e64
lea eax, [esi + 0x78]
mov dword [esp + 0x88], eax
call fcn.00495a20
fstp qword [esp + 0x80]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov byte [esi + 0x22c], 0
call edi
lea ecx, [esp + 0x64]
mov dword [esp + 0x5c], eax
call fcn.00458110
mov ebp, eax
cmp ebp, 1
mov dword [esp + 0x60], ebp
je 0x4afa77
mov edx, dword [esp + 0x5c]
xor eax, eax
lea ecx, [eax + 1]
call fcn.004580e0
mov ecx, dword [0x6fa380]
mov ebx, dword [0x6fa37c]
mov dword [esp + 0x74], ecx
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, ebx
je 0x4afaa0
mov edx, dword [esp + 0x5c]
xor eax, eax
mov ecx, ebp
call fcn.004580e0
cmp dword [esi + 0x234], 0
je 0x4afab7
mov byte [esi + 0x238], 1
mov ecx, ebp
jmp 0x4b0e3b
fldz
mov ecx, 1
fcom dword [esi + 0x17c]
add dword [esi + 0x188], ecx
fnstsw ax
test ah, 5
jp 0x4afaec
fcom dword [esp + 0x150]
fnstsw ax
test ah, 0x44
jp 0x4afafa
fld dword [esi + 0x17c]
fstp dword [esp + 0x150]
fcom dword [esp + 0x150]
fnstsw ax
test ah, 0x44
jnp 0x4afb2b
lea edx, [esp + 0x50]
fstp st(0)
push edx
lea eax, [esp + 0x3c]
push eax
mov eax, str.UITransitions
mov dword [esp + 0x38], ecx
mov dword [esp + 0x58], ecx
call fcn.00406220
lea eax, [esp + 0x38]
call fcn.004029c0
fldz
test eax, eax
jne 0x4afb2b
mov bl, 1
jmp 0x4afb2d
xor bl, bl
test byte [esp + 0x30], 1
je 0x4afb52
lea edi, [esp + 0x40]
fstp st(0)
call fcn.00401700
lea edi, [esp + 0x3c]
mov dword [esp + 0x40], 0
call fcn.00401700
fldz
test bl, bl
je 0x4afb5d
fst dword [esp + 0x150]
fstp dword [esi + 0x17c]
mov ecx, dword [esi + 0x134]
cmp ecx, dword [esi + 0x13c]
jge 0x4afab0
mov edx, dword [esi + 0x138]
cmp edx, dword [esi + 0x140]
jge 0x4afab0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov eax, dword [esi + 0x18]
test eax, eax
je 0x4afba0
cmp eax, edi
jne 0x4afba0
add dword [esi + 0x1c], 1
jmp 0x4afbc5
cmp byte [esi + 7], 0
je 0x4afbb2
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x4afbbb
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], edi
cmp dword [esi + 0x144], 0
je 0x4b0df1
mov ebp, dword [esp + 0x158]
or eax, 0xffffffff
cmp ebp, eax
jne 0x4afc2e
cmp dword [esp + 0x160], eax
jne 0x4afc2e
cmp dword [esp + 0x164], eax
mov ebx, esi
jne 0x4afc30
cmp dword [esp + 0x15c], eax
jne 0x4afc30
mov eax, esi
mov ecx, dword [eax + 0x138]
mov edx, dword [eax + 0x13c]
mov ebp, dword [eax + 0x134]
mov eax, dword [eax + 0x140]
mov dword [esp + 0x15c], ecx
mov dword [esp + 0x160], edx
mov dword [esp + 0x164], eax
jmp 0x4afc30
mov ebx, esi
fld1
mov dl, byte [esp + 0x148]
mov edi, dword [ebx + 0x13c]
fst dword [esp + 0xd4]
fldz
xor esi, esi
fst dword [esp + 0xd8]
mov dword [esp + 0xc8], esi
fst dword [esp + 0xdc]
mov dword [esp + 0xcc], esi
fst dword [esp + 0xe0]
mov dword [esp + 0xd0], esi
mov esi, dword [ebx + 0x138]
fst dword [esp + 0xe8]
fst dword [esp + 0xec]
xor ecx, ecx
fst dword [esp + 0xf0]
mov byte [esp + 0x24], dl
mov edx, dword [ebx + 0x134]
fxch st(1)
fst dword [esp + 0xe4]
xor eax, eax
cmp edx, ebp
fst dword [esp + 0xf4]
fst dword [esp + 0xfc]
mov dword [esp + 0x74], esi
mov esi, dword [ebx + 0x140]
fst dword [esp + 0x10c]
fst dword [esp + 0x11c]
mov dword [esp + 0x1c], eax
fxch st(1)
mov dword [esp + 0x20], ecx
fst dword [esp + 0x100]
mov byte [esp + 0xf8], 1
fst dword [esp + 0x104]
mov byte [esp + 0x120], 1
fst dword [esp + 0x108]
mov byte [esp + 0x13c], cl
fst dword [esp + 0x110]
mov dword [esp + 0x70], edx
fst dword [esp + 0x114]
mov dword [esp + 0x78], edi
fst dword [esp + 0x118]
mov dword [esp + 0x7c], esi
jge 0x4afd2d
mov edx, ebp
mov dword [esp + 0x70], edx
mov ebp, dword [esp + 0x15c]
cmp dword [esp + 0x74], ebp
jge 0x4afd3e
mov dword [esp + 0x74], ebp
mov ebp, dword [esp + 0x160]
cmp edi, ebp
jle 0x4afd4f
mov edi, ebp
mov dword [esp + 0x78], edi
mov ebp, dword [esp + 0x164]
cmp esi, ebp
jle 0x4afd60
mov esi, ebp
mov dword [esp + 0x7c], esi
mov dword [esp + 0x128], edx
mov edx, dword [esp + 0x74]
mov dword [esp + 0x12c], edx
lea edx, [ebx + 0xa8]
mov dword [esp + 0x130], edi
mov dword [esp + 0x134], esi
mov dword [esp + 0x124], 0x100
mov dword [esp + 0x138], edx
mov esi, 9
xor edi, edi
test byte [esp + 0x20], 1
jne 0x4afe19
mov edx, ecx
fstp st(0)
shr edx, 1
fstp st(0)
lea ebp, [edx - 1]
test edx, ebp
jne 0x4afde4
lea ecx, [edx + edx]
cmp ecx, edi
jne 0x4afdc1
mov ecx, 1
mov edx, ecx
shl edx, 4
sub edx, ecx
add edx, edx
add edx, edx
add edx, edx
push edx
push eax
call fcn.0045d790
mov ecx, dword [esp + 0x28]
add esp, 8
cmp eax, edi
mov dword [esp + 0x1c], eax
je 0x4afe15
shr ecx, 1
mov edx, ecx
shl edx, 4
sub edx, ecx
lea eax, [eax + edx*8]
lea edx, [esp + 0xc8]
call fcn.004a1200
mov eax, dword [esp + 0x20]
mov ecx, eax
and ecx, 0xfffffffe
and eax, 1
add ecx, 2
xor ecx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], ecx
fld1
fldz
mov ebp, 1
sub esi, ebp
jne 0x4afd9f
shr ecx, 1
fxch st(1)
mov edx, ecx
fst dword [esp + 0xa0]
shl edx, 4
fst dword [esp + 0xb0]
sub edx, ecx
fstp dword [esp + 0xc0]
mov cl, byte [esp + 0x148]
lea eax, [eax + edx*8 - 0x78]
fst dword [esp + 0xa4]
mov byte [esp + 0x40], cl
fst dword [esp + 0xa8]
push edi
fst dword [esp + 0xb0]
mov dword [esp + 0x2c], edi
fst dword [esp + 0xb8]
mov dword [esp + 0x30], edi
fst dword [esp + 0xbc]
mov dword [esp + 0x3c], edi
fstp dword [esp + 0xc0]
mov dword [esp + 0x40], edi
lea edx, [esp + 0x2c]
mov dword [eax], edx
lea ecx, [esp + 0x3c]
mov dword [eax + 4], ecx
mov ecx, dword [ebx + 0x144]
push edi
lea eax, [esp + 0xa8]
push eax
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov byte [esp + 0xd4], 1
mov edx, dword [ecx]
mov edx, dword [edx + 0x3c]
lea eax, [esp + 0x20]
push eax
call edx
lea eax, [esp + 0x70]
lea esi, [esp + 0x10]
call fcn.00485e40
mov eax, esi
push eax
call fcn.00485ed0
mov ecx, esi
add esp, 4
push ecx
call fcn.00485280
mov edx, esi
add esp, 4
push edx
call fcn.00485ed0
mov esi, dword [esp + 0x18]
mov ecx, esi
add esp, 4
shr ecx, 1
jne 0x4affac
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x4aff22
push eax
call fcn.0045da90
add esp, 4
and dword [esp + 0x14], ebp
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x38]
cmp eax, edi
je 0x4aff3b
push eax
call fcn.0045da90
add esp, 4
and dword [esp + 0x3c], ebp
mov dword [esp + 0x38], edi
mov eax, dword [esp + 0x28]
cmp eax, edi
je 0x4aff54
push eax
call fcn.0045da90
add esp, 4
and dword [esp + 0x2c], ebp
mov dword [esp + 0x28], edi
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x4aff6d
push eax
call fcn.0045da90
add esp, 4
and dword [esp + 0x20], ebp
mov dword [esp + 0x1c], edi
cmp dword [ebx + 0x1c], edi
je 0x4aff8b
cmp dword [ebx + 0x18], edi
je 0x4aff8b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebx + 0x18], eax
jne 0x4aff8b
add dword [ebx + 0x1c], 0xffffffff
jmp 0x4b0e37
cmp byte [ebx + 7], 0
mov dword [ebx + 0x18], edi
je 0x4affa3
add ebx, 0x20
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4b0e37
mov eax, dword [ebx]
mov ecx, ebx
jmp 0x4b0e32
fldz
mov dword [esp + 0x70], edi
fcom dword [esp + 0x150]
mov dword [esp + 0x68], edi
fnstsw ax
test ah, 0x44
jnp 0x4b043f
cmp ecx, 0x3333333
ja 0x4b004c
cmp ecx, ebp
mov esi, ebp
jb 0x4affdc
add esi, esi
cmp esi, ecx
jbe 0x4affd6
fstp dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
shr ecx, 0x17
and ecx, 0xff
sub ecx, 0x7f
js 0x4afff8
mov eax, ebp
shl eax, cl
jmp 0x4afffa
xor eax, eax
cmp eax, esi
je 0x4b004e
xor edi, edi
test esi, esi
je 0x4b0046
xor ecx, ecx
mov eax, esi
mov edx, 0x28
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
mov edi, eax
call fcn.00457990
test eax, eax
je 0x4b004e
lea edi, [eax + 4]
mov dword [eax], esi
push 0x28
mov ebx, 0x411310
mov eax, esi
mov ecx, edi
call fcn.00401380
test edi, edi
je 0x4b004e
mov dword [esp + 0x70], edi
jmp 0x4b004e
fstp st(0)
mov eax, dword [esp + 0x14]
shr eax, 1
cmp eax, 0x3333333
ja 0x4b00f4
test eax, eax
je 0x4b00f4
cmp eax, 1
mov esi, ebp
jb 0x4b0076
mov edi, edi
add esi, esi
cmp esi, eax
jbe 0x4b0070
fldz
fstp dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
shr ecx, 0x17
and ecx, 0xff
sub ecx, 0x7f
js 0x4b0094
mov eax, ebp
shl eax, cl
jmp 0x4b0096
xor eax, eax
cmp eax, esi
je 0x4b00f4
xor edi, edi
test esi, esi
je 0x4b00f0
xor ecx, ecx
mov eax, esi
mov edx, 0x28
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
mov edi, eax
call fcn.00457990
test eax, eax
je 0x4b00f4
lea edi, [eax + 4]
mov dword [eax], esi
push 0x28
mov ebx, 0x411310
mov eax, esi
mov ecx, edi
call fcn.00401380
test edi, edi
je 0x4b00f4
jmp 0x4b00f0
mov dword [esp + 0x68], edi
test dword [esp + 0x14], 0xfffffffe
mov edx, dword [esp + 0x10]
mov dword [esp + 0x50], 0
jbe 0x4b0209
mov edi, dword [esp + 0x70]
mov eax, dword [esp + 0x68]
xor ebx, ebx
sub eax, edi
mov ebp, edi
mov dword [esp + 0x30], eax
jmp 0x4b0126
mov edi, dword [esp + 0x70]
mov ecx, dword [ebx + edx + 4]
mov eax, dword [ebx + edx + 8]
mov esi, dword [ebx + edx]
mov edx, dword [ebx + edx + 0xc]
mov dword [esp + 0x94], ecx
mov ecx, eax
sub ecx, esi
test cl, 1
mov dword [esp + 0x90], esi
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], edx
je 0x4b0164
add eax, 1
mov dword [esp + 0x98], eax
lea esi, [esp + 0x90]
mov eax, ebp
call fcn.0047a0b0
test eax, eax
mov dword [esp + 0x18], eax
jne 0x4b022f
mov edx, dword [esp + 0x30]
lea eax, [edx + ebp]
call fcn.0047a0b0
mov edi, eax
test edi, edi
jne 0x4b0337
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + edx]
cmp eax, dword [ebx + edx + 8]
jge 0x4b01ea
mov ecx, dword [ebx + edx + 4]
cmp ecx, dword [ebx + edx + 0xc]
jge 0x4b01ea
mov edx, dword [ebx + edx]
mov edi, dword [esp + 0x144]
mov eax, ecx
neg eax
add edi, 0xa8
or ecx, 0xffffffff
neg edx
sub esp, 0x10
mov dword [edi + 0x1c], eax
mov eax, esp
mov dword [eax], ecx
mov dword [edi + 0x18], edx
or edx, ecx
or esi, ecx
mov dword [eax + 4], edx
or ecx, ecx
mov dword [eax + 8], esi
push ebp
mov dword [eax + 0xc], ecx
call fcn.0047aa80
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x14]
add eax, 1
shr ecx, 1
add ebx, 0x10
add ebp, 0x28
cmp eax, ecx
mov dword [esp + 0x50], eax
jb 0x4b0122
mov eax, dword [esp + 0x144]
mov ebx, dword [esp + 0x144]
mov esi, dword [esp + 0x14]
add eax, 0xa8
xor ecx, ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
xor edi, edi
jmp 0x4b0445
mov eax, dword [esp + 0x68]
xor ebx, ebx
cmp eax, ebx
je 0x4b023e
call fcn.004578f0
cmp edi, ebx
je 0x4b0249
mov eax, edi
call fcn.004578f0
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4b0269
push eax
call fcn.0045da90
mov esi, 1
add esp, 4
and dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
jmp 0x4b026e
mov esi, 1
mov eax, dword [esp + 0x38]
cmp eax, ebx
je 0x4b0287
push eax
call fcn.0045da90
add esp, 4
and dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4b02a0
push eax
call fcn.0045da90
add esp, 4
and dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4b02b9
push eax
call fcn.0045da90
add esp, 4
and dword [esp + 0x20], esi
mov dword [esp + 0x1c], ebx
mov esi, dword [esp + 0x144]
cmp dword [esi + 0x1c], ebx
je 0x4b02db
cmp dword [esi + 0x18], ebx
je 0x4b02db
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0x18], eax
jne 0x4b02db
add dword [esi + 0x1c], 0xffffffff
jmp 0x4b02f9
cmp byte [esi + 7], 0
mov dword [esi + 0x18], ebx
je 0x4b02f0
add esi, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4b02f9
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
xor eax, eax
call fcn.004580e0
call fcn.00495a20
fsub qword [esp + 0x80]
mov eax, dword [esp + 0x88]
sub esp, 8
fstp qword [esp]
call fcn.004aceb0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x130
ret 0x24
mov eax, dword [esp + 0x68]
xor ebx, ebx
cmp eax, ebx
je 0x4b0346
call fcn.004578f0
mov eax, dword [esp + 0x70]
cmp eax, ebx
je 0x4b0353
call fcn.004578f0
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4b0373
push eax
call fcn.0045da90
mov esi, 1
add esp, 4
and dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
jmp 0x4b0378
mov esi, 1
mov eax, dword [esp + 0x38]
cmp eax, ebx
je 0x4b0391
push eax
call fcn.0045da90
add esp, 4
and dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4b03aa
push eax
call fcn.0045da90
add esp, 4
and dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4b03c3
push eax
call fcn.0045da90
add esp, 4
and dword [esp + 0x20], esi
mov dword [esp + 0x1c], ebx
mov esi, dword [esp + 0x144]
cmp dword [esi + 0x1c], ebx
je 0x4b03e5
cmp dword [esi + 0x18], ebx
je 0x4b03e5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0x18], eax
jne 0x4b03e5
add dword [esi + 0x1c], 0xffffffff
jmp 0x4b0403
cmp byte [esi + 7], 0
mov dword [esi + 0x18], ebx
je 0x4b03fa
add esi, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4b0403
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
xor eax, eax
call fcn.004580e0
call fcn.00495a20
fsub qword [esp + 0x80]
mov eax, dword [esp + 0x88]
sub esp, 8
fstp qword [esp]
call fcn.004aceb0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x130
ret 0x24
mov edx, dword [esp + 0x10]
fstp st(0)
test esi, 0xfffffffe
mov dword [esp + 0x50], edi
jbe 0x4b062f
mov dword [esp + 0x30], edi
mov ecx, dword [edi + edx]
cmp ecx, dword [edi + edx + 8]
lea eax, [edi + edx]
jge 0x4b0600
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 0xc]
jge 0x4b0600
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x144]
shr ecx, 1
mov edx, ecx
shl edx, 4
sub edx, ecx
mov ecx, dword [esp + 0x1c]
lea ecx, [ecx + edx*8 - 0x18]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
lea edx, [esp + 0x1c]
mov dword [ecx + 0xc], eax
mov ecx, dword [esi + 0x144]
push edx
call fcn.0049e430
mov ebx, eax
xor edi, edi
cmp ebx, edi
jne 0x4b0798
mov edi, dword [esp + 0x3c]
mov eax, edi
shr eax, 1
je 0x4b05fc
mov ebp, dword [esp + 0x38]
mov ecx, eax
shl ecx, 4
sub ecx, eax
mov ecx, dword [ebp + ecx*8 - 0x70]
test ecx, ecx
je 0x4b04f6
lea edx, [esp + 0x38]
push edx
call fcn.0049e430
mov edi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
mov ebx, edi
shr ebx, 1
je 0x4b05f2
lea esi, [ebx - 1]
cmp esi, 0x1111111
jbe 0x4b052e
test ebp, ebp
je 0x4b05f2
push ebp
call fcn.0045da90
mov edi, dword [esp + 0x40]
xor ebp, ebp
add esp, 4
mov dword [esp + 0x38], ebp
and edi, 1
jmp 0x4b05ee
mov eax, edi
and eax, 1
cmp esi, ebx
je 0x4b05f2
test eax, eax
je 0x4b056d
mov eax, esi
shl eax, 4
sub eax, esi
add eax, eax
add eax, eax
add eax, eax
push eax
push ebp
call fcn.0045d790
mov ecx, dword [esp + 0x44]
mov ebp, eax
lea edi, [esi + esi]
and ecx, 1
add esp, 8
mov dword [esp + 0x38], ebp
or edi, ecx
jmp 0x4b05ee
mov edx, 1
cmp esi, edx
jb 0x4b057c
add edx, edx
cmp edx, esi
jbe 0x4b0576
mov eax, ebx
test eax, eax
mov dword [esp + 0x90], eax
fild dword [esp + 0x90]
jge 0x4b0596
fadd dword [0x6c0a38]
fstp dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
shr ecx, 0x17
and ecx, 0xff
sub ecx, 0x7f
js 0x4b05b5
mov eax, 1
shl eax, cl
jmp 0x4b05b7
xor eax, eax
cmp eax, ebx
jae 0x4b05bd
add eax, eax
cmp eax, edx
je 0x4b05e6
mov ecx, edx
shl ecx, 4
sub ecx, edx
add ecx, ecx
add ecx, ecx
add ecx, ecx
push ecx
push ebp
call fcn.0045d790
mov edi, dword [esp + 0x44]
mov ebp, eax
add esp, 8
test ebp, ebp
mov dword [esp + 0x38], ebp
je 0x4b05f2
lea edx, [esi + esi]
and edi, 1
or edi, edx
mov dword [esp + 0x3c], edi
mov eax, edi
shr eax, 1
jne 0x4b04d5
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x30]
mov ecx, esi
add eax, 1
add edi, 0x10
shr ecx, 1
cmp eax, ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x30], edi
jb 0x4b0459
mov ebx, dword [esp + 0x144]
xor edi, edi
fldz
fcomp dword [esp + 0x150]
fnstsw ax
test ah, 0x44
jnp 0x4b06ea
test esi, 0xfffffffe
mov dword [esp + 0x50], edi
jbe 0x4b06de
mov ecx, dword [esp + 0x68]
xor esi, esi
mov dword [esp + 0x30], ecx
lea ecx, [ecx]
mov eax, dword [esi + edx]
cmp eax, dword [esi + edx + 8]
jge 0x4b06c1
mov ecx, dword [esi + edx + 4]
cmp ecx, dword [esi + edx + 0xc]
jge 0x4b06c1
mov edx, dword [esi + edx]
mov ebp, dword [esp + 0x144]
mov eax, ecx
neg eax
add ebp, 0xa8
or ecx, 0xffffffff
neg edx
sub esp, 0x10
mov dword [ebp + 0x1c], eax
mov eax, esp
mov dword [eax], ecx
mov dword [ebp + 0x18], edx
or edx, ecx
or edi, ecx
mov dword [eax + 4], edx
mov dword [eax + 8], edi
or ebx, ecx
mov dword [eax + 0xc], ebx
mov eax, dword [esp + 0x40]
push eax
mov edi, ebp
call fcn.0047aa80
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x144]
xor edi, edi
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x14]
add dword [esp + 0x30], 0x28
add eax, 1
shr ecx, 1
add esi, 0x10
cmp eax, ecx
mov dword [esp + 0x50], eax
jb 0x4b0660
lea eax, [ebx + 0xa8]
mov dword [eax + 0x18], edi
mov dword [eax + 0x1c], edi
mov ebx, dword [esp + 0x20]
mov ebp, ebx
shr ebp, 1
je 0x4b0725
lea esi, [ebp - 1]
cmp esi, 0x1111111
jbe 0x4b08f5
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4b0725
push eax
call fcn.0045da90
add esp, 4
and dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0
mov edx, dword [esp + 0x10]
cmp byte [esp + 0x14c], 0
je 0x4b0a61
cmp byte [esp + 0x148], 0
mov edi, dword [esp + 0x144]
sete cl
push ecx
call fcn.004adab0
mov ebx, eax
xor esi, esi
cmp ebx, esi
je 0x4b0a5d
mov eax, dword [esp + 0x68]
cmp eax, esi
je 0x4b0764
call fcn.004578f0
mov eax, dword [esp + 0x70]
cmp eax, esi
je 0x4b0771
call fcn.004578f0
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x4b09ce
push eax
call fcn.0045da90
mov ebp, 1
add esp, 4
and dword [esp + 0x14], ebp
mov dword [esp + 0x10], esi
jmp 0x4b09d3
cmp dword [esp + 0x68], edi
je 0x4b07d2
mov edi, dword [esp + 0x68]
mov esi, dword [edi - 4]
lea ebp, [edi - 4]
lea edx, [esi + esi*4]
sub esi, 1
lea edi, [edi + edx*8]
js 0x4b07c2
sub edi, 0x28
mov eax, edi
call fcn.00479430
sub esi, 1
jns 0x4b07b3
mov eax, ebp
call fcn.00457930
mov esi, dword [esp + 0x144]
xor edi, edi
cmp dword [esp + 0x70], edi
je 0x4b0810
mov ebp, dword [esp + 0x70]
mov esi, dword [ebp - 4]
mov ecx, dword [esp + 0x70]
add ebp, 0xfffffffc
lea eax, [esi + esi*4]
sub esi, 1
lea edi, [ecx + eax*8]
js 0x4b0800
sub edi, 0x28
mov eax, edi
call fcn.00479430
sub esi, 1
jns 0x4b07f1
mov eax, ebp
call fcn.00457930
mov esi, dword [esp + 0x144]
xor edi, edi
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x4b0830
push eax
call fcn.0045da90
mov ebp, 1
add esp, 4
and dword [esp + 0x14], ebp
mov dword [esp + 0x10], edi
jmp 0x4b0835
mov ebp, 1
mov eax, dword [esp + 0x38]
cmp eax, edi
je 0x4b084e
push eax
call fcn.0045da90
add esp, 4
and dword [esp + 0x3c], ebp
mov dword [esp + 0x38], edi
mov eax, dword [esp + 0x28]
cmp eax, edi
je 0x4b0867
push eax
call fcn.0045da90
add esp, 4
and dword [esp + 0x2c], ebp
mov dword [esp + 0x28], edi
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x4b0880
push eax
call fcn.0045da90
add esp, 4
and dword [esp + 0x20], ebp
mov dword [esp + 0x1c], edi
cmp dword [esi + 0x1c], edi
je 0x4b089b
cmp dword [esi + 0x18], edi
je 0x4b089b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0x18], eax
jne 0x4b089b
add dword [esi + 0x1c], 0xffffffff
jmp 0x4b08b9
cmp byte [esi + 7], 0
mov dword [esi + 0x18], edi
je 0x4b08b0
add esi, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4b08b9
mov edx, dword [esi]
mov ecx, esi
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
xor eax, eax
call fcn.004580e0
call fcn.00495a20
fsub qword [esp + 0x80]
mov eax, dword [esp + 0x88]
sub esp, 8
fstp qword [esp]
call fcn.004aceb0
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x130
ret 0x24
mov eax, ebx
and eax, 1
cmp esi, ebp
je 0x4b0725
test eax, eax
je 0x4b093a
mov eax, dword [esp + 0x1c]
mov edx, esi
shl edx, 4
sub edx, esi
add edx, edx
add edx, edx
add edx, edx
push edx
push eax
call fcn.0045d790
mov edx, dword [esp + 0x28]
lea ecx, [esi + esi]
and edx, 1
add esp, 8
or ecx, edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jmp 0x4b0721
mov edi, 1
cmp esi, edi
jb 0x4b0949
add edi, edi
cmp edi, esi
jbe 0x4b0943
mov eax, ebp
test eax, eax
mov dword [esp + 0x90], eax
fild dword [esp + 0x90]
jge 0x4b0963
fadd dword [0x6c0a38]
fstp dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
shr ecx, 0x17
and ecx, 0xff
sub ecx, 0x7f
js 0x4b0982
mov eax, 1
shl eax, cl
jmp 0x4b0984
xor eax, eax
cmp eax, ebp
jae 0x4b098a
add eax, eax
cmp eax, edi
je 0x4b09bd
mov edx, dword [esp + 0x1c]
mov ecx, edi
shl ecx, 4
sub ecx, edi
add ecx, ecx
add ecx, ecx
add ecx, ecx
push ecx
push edx
call fcn.0045d790
add esp, 8
test eax, eax
mov dword [esp + 0x1c], eax
je 0x4b0721
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
lea eax, [esi + esi]
and ebx, 1
or eax, ebx
mov dword [esp + 0x20], eax
jmp 0x4b0725
mov ebp, 1
mov eax, dword [esp + 0x38]
cmp eax, esi
je 0x4b09ec
push eax
call fcn.0045da90
add esp, 4
and dword [esp + 0x3c], ebp
mov dword [esp + 0x38], esi
mov eax, dword [esp + 0x28]
cmp eax, esi
je 0x4b0a05
push eax
call fcn.0045da90
add esp, 4
and dword [esp + 0x2c], ebp
mov dword [esp + 0x28], esi
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x4b0a1e
push eax
call fcn.0045da90
add esp, 4
and dword [esp + 0x20], ebp
mov dword [esp + 0x1c], esi
cmp dword [edi + 0x1c], esi
je 0x4b0a3c
cmp dword [edi + 0x18], esi
je 0x4b0a3c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 0x18], eax
jne 0x4b0a3c
add dword [edi + 0x1c], 0xffffffff
jmp 0x4b08b9
cmp byte [edi + 7], 0
mov dword [edi + 0x18], esi
je 0x4b0a54
add edi, 0x20
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4b08b9
mov edx, dword [edi]
mov ecx, edi
jmp 0x4b08b4
mov edx, dword [esp + 0x10]
fldz
fcomp dword [esp + 0x150]
fnstsw ax
test ah, 0x44
jnp 0x4b0c51
lea esi, [esp + 0x90]
call fcn.00495ae0
fld dword [esp + 0x150]
mov ecx, esi
fstp qword [esp + 0x30]
push ecx
call fcn.004959f0
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fcomp qword [esp + 0x30]
fnstsw ax
test ah, 5
jp 0x4b0c01
mov ebp, dword [esp + 0x144]
lea edx, [esp + 0x90]
push edx
call fcn.004959f0
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fdiv dword [esp + 0x150]
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fld st(0)
fxch st(1)
fadd st(0), st(0)
fsubr qword [0x6c0d68]
fld st(1)
fmulp st(2)
fmulp st(1)
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fmul qword [0x6c0b80]
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fistp dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
xor ebx, ebx
test ecx, 0xfffffffe
jbe 0x4b0b71
mov esi, dword [esp + 0x70]
mov ebp, dword [esp + 0x68]
xor edi, edi
sub ebp, esi
mov edx, dword [edi + eax]
cmp edx, dword [edi + eax + 8]
jge 0x4b0b59
mov edx, dword [edi + eax + 4]
cmp edx, dword [edi + eax + 0xc]
jge 0x4b0b59
mov ecx, dword [esp + 0x30]
lea eax, [esi + ebp]
push eax
mov eax, dword [esp + 0x148]
add eax, 0xa8
push eax
push ecx
call fcn.004c0450
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov edx, ecx
add ebx, 1
shr edx, 1
add edi, 0x10
add esi, 0x28
cmp ebx, edx
jb 0x4b0b20
mov ebp, dword [esp + 0x144]
xor edi, edi
test ecx, 0xfffffffe
jbe 0x4b0bd2
xor esi, esi
lea ecx, [ecx]
mov edx, dword [esi + eax]
cmp edx, dword [esi + eax + 8]
jge 0x4b0bc4
mov edx, dword [esi + eax + 4]
cmp edx, dword [esi + eax + 0xc]
jge 0x4b0bc4
mov ebx, dword [esi + eax]
mov edx, dword [ebp]
mov edx, dword [edx + 0x1c]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], ebx
mov ebx, dword [esi + eax + 4]
mov dword [ecx + 4], ebx
mov ebx, dword [esi + eax + 8]
mov eax, dword [esi + eax + 0xc]
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], eax
mov ecx, ebp
call edx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov edx, ecx
add edi, 1
shr edx, 1
add esi, 0x10
cmp edi, edx
jb 0x4b0b80
fld dword [esp + 0x150]
lea eax, [esp + 0x90]
push eax
fstp qword [esp + 0x54]
call fcn.004959f0
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fcomp qword [esp + 0x50]
fnstsw ax
test ah, 5
jnp 0x4b0ab2
xor esi, esi
test dword [esp + 0x14], 0xfffffffe
jbe 0x4b0c4d
mov edi, dword [esp + 0x68]
or ebx, 0xffffffff
or ebp, ebx
sub esp, 0x10
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebp
or ecx, 0xffffffff
mov dword [eax + 8], ecx
or ecx, ecx
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x154]
add eax, 0xa8
push eax
call fcn.0047aa80
mov ecx, dword [esp + 0x14]
add esi, 1
shr ecx, 1
add edi, 0x28
cmp esi, ecx
jb 0x4b0c16
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x144]
xor ebp, ebp
test dword [esp + 0x14], 0xfffffffe
jbe 0x4b0d02
xor ebx, ebx
mov eax, dword [edi + 0x104]
test al, 1
lea esi, [ebx + edx]
jne 0x4b0cee
shr eax, 1
lea edx, [eax - 1]
test eax, edx
jne 0x4b0caa
add eax, eax
jne 0x4b0c8d
mov eax, 1
shl eax, 4
push eax
mov eax, dword [edi + 0x100]
push eax
call fcn.0045d790
add esp, 8
test eax, eax
mov dword [edi + 0x100], eax
je 0x4b0cea
mov eax, dword [edi + 0x104]
mov ecx, dword [esi]
shr eax, 1
shl eax, 4
add eax, dword [edi + 0x100]
mov dword [eax], ecx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 8]
mov dword [eax + 8], ecx
mov edx, dword [esi + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [edi + 0x104]
mov ecx, eax
and ecx, 0xfffffffe
add ecx, 2
and eax, 1
xor ecx, eax
mov dword [edi + 0x104], ecx
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
add ebp, 1
shr eax, 1
add ebx, 0x10
cmp ebp, eax
jb 0x4b0c6a
cmp byte [esp + 0x148], 0
je 0x4b0d1b
mov edx, dword [edi]
mov eax, dword [edx + 0x5c]
push 1
mov ecx, edi
call eax
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x68]
test edi, edi
je 0x4b0d4e
mov esi, dword [edi - 4]
lea ebx, [edi - 4]
lea ecx, [esi + esi*4]
sub esi, 1
lea edi, [edi + ecx*8]
js 0x4b0d43
sub edi, 0x28
mov eax, edi
call fcn.00479430
sub esi, 1
jns 0x4b0d34
mov eax, ebx
call fcn.00457930
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x70]
test edi, edi
je 0x4b0d8a
mov esi, dword [edi - 4]
lea ebx, [edi - 4]
lea edx, [esi + esi*4]
sub esi, 1
lea edi, [edi + edx*8]
js 0x4b0d7f
jmp 0x4b0d70
sub edi, 0x28
mov eax, edi
call fcn.00479430
sub esi, 1
jns 0x4b0d70
mov eax, ebx
call fcn.00457930
mov edx, dword [esp + 0x10]
test edx, edx
je 0x4b0da4
push edx
call fcn.0045da90
add esp, 4
and dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x38]
test eax, eax
je 0x4b0dc2
push eax
call fcn.0045da90
add esp, 4
and dword [esp + 0x3c], 1
mov dword [esp + 0x38], 0
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4b0de0
push eax
call fcn.0045da90
add esp, 4
and dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4b0df1
push eax
call fcn.0045da90
add esp, 4
mov esi, dword [esp + 0x144]
cmp dword [esi + 0x1c], 0
je 0x4b0e15
cmp dword [esi + 0x18], 0
je 0x4b0e15
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0x18], eax
jne 0x4b0e15
add dword [esi + 0x1c], 0xffffffff
jmp 0x4b0e37
cmp byte [esi + 7], 0
mov dword [esi + 0x18], 0
je 0x4b0e2e
add esi, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4b0e37
mov eax, dword [esi]
mov ecx, esi
mov edx, dword [eax + 0x18]
call edx
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
xor eax, eax
call fcn.004580e0
call fcn.00495a20
fsub qword [esp + 0x80]
mov eax, dword [esp + 0x88]
sub esp, 8
fstp qword [esp]
call fcn.004aceb0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x130
ret 0x24