Function at 0x47af20
Capabilities:
Access peb ldr_data
Check os version
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe8
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x578560
mov dword [ebp - 0xec], ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x9c], 0x80000000
mov dword [ebp - 0x20], edx
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [edx + 0xfc]
mov ecx, dword [edx + 0x100]
cmp dword [edx + 0xe4], 0x80000000
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], ecx
jne 0x47afa2
mov dword [ebp - 0x3c], 0x80000000
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0xf0], 0x80000000
jne 0x47b006
jmp 0x47b064
mov eax, dword [edx + 0xec]
mov esi, dword [edx + 0xe8]
test eax, eax
mov dword [ebp - 0x3c], eax
je 0x47afde
js 0x47c24f
movzx eax, byte [0x5fd2ec]
mov edi, dword [ebp - 0x3c]
xor ecx, ecx
mov edx, edi
call fcn.0056a9f0
test eax, eax
jne 0x47afe6
mov ecx, 1
mov edx, edi
call fcn.0057f230
mov edi, dword [ebp - 0x3c]
mov eax, 1
push edi
push esi
mov dword [ebp - 0xa4], eax
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0xf0], 0x80000000
je 0x47af9d
mov edx, dword [eax + 0xf8]
mov esi, dword [eax + 0xf4]
test edx, edx
je 0x47b048
js 0x47c254
movzx eax, byte [0x5fd2ec]
xor ecx, ecx
mov edi, edx
call fcn.0056a9f0
mov edx, edi
test eax, eax
jne 0x47b04d
mov ecx, 1
mov dword [ebp - 0x10], 0
call fcn.0057f230
jmp 0x47c260
mov eax, 1
mov dword [ebp - 0x9c], edx
push edx
push esi
mov dword [ebp - 0xa0], eax
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x20]
movzx ecx, byte [eax + 0x118]
mov byte [ebp - 0x5d], cl
mov ecx, dword [eax + 0x28]
cmp ecx, 5
jne 0x47b085
mov dword [ebp - 0xb8], 5
jmp 0x47b0bc
cmp ecx, 4
jb 0x47b0a7
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x10], 1
mov eax, dword [ecx + 0x2c]
mov ecx, dword [ecx + 0x30]
push eax
call dword [ecx + 0x24]
add esp, 4
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xb0], edx
mov eax, dword [eax + 0x44]
mov ecx, 4
mov ebx, 4
test eax, eax
mov dword [ebp - 0x6c], eax
je 0x47b1af
cmp eax, 0xfffffff
ja 0x47bf50
lea ebx, [eax*8]
test ebx, ebx
js 0x47bf61
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov edx, ebx
xor esi, esi
mov edi, dword [eax + 0x40]
movzx eax, byte [0x5fd2ec]
call fcn.0056a9f0
test eax, eax
mov dword [ebp - 0x24], eax
je 0x47bf83
mov ebx, dword [ebp - 0x6c]
mov ecx, ebx
lea eax, [ebx - 1]
and ecx, 0x1fffffff
mov edx, eax
cmp ecx, eax
cmovb edx, ecx
cmp edx, 0xa
jae 0x47b134
mov eax, ebx
mov ebx, dword [ebp - 0x24]
mov ecx, edi
jmp 0x47b17f
mov ebx, dword [ebp - 0x24]
cmp ecx, eax
cmovb eax, ecx
lea ecx, [edi + eax*8 + 8]
cmp ebx, ecx
jae 0x47b151
lea eax, [ebx + eax*8 + 8]
mov ecx, edi
cmp edi, eax
mov eax, dword [ebp - 0x6c]
jb 0x47b17f
inc edx
mov ecx, 2
mov eax, edx
mov esi, edx
and eax, 1
cmovne ecx, eax
mov eax, dword [ebp - 0x6c]
xor edx, edx
sub esi, ecx
lea ecx, [edi + esi*8]
sub eax, esi
nop dword [eax]
movups xmm0, xmmword [edi + edx*8]
movups xmmword [ebx + edx*8], xmm0
add edx, 2
cmp esi, edx
jne 0x47b170
mov edx, dword [ebp - 0x6c]
lea esi, [ebx + esi*8 + 4]
lea edx, [edi + edx*8]
nop dword [eax]
cmp ecx, edx
je 0x47b1aa
mov edi, dword [ecx]
mov ebx, dword [ecx + 4]
add ecx, 8
dec eax
mov dword [esi - 4], edi
mov dword [esi], ebx
mov ebx, dword [ebp - 0x24]
lea esi, [esi + 8]
jne 0x47b190
mov ecx, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], ebx
mov edx, dword [eax + 0x104]
mov eax, dword [eax + 0x50]
test eax, eax
mov dword [ebp - 0xe0], edx
mov dword [ebp - 0x58], eax
je 0x47b2ad
mov eax, dword [ebp - 0x58]
cmp eax, 0xfffffff
ja 0x47bf72
lea esi, [eax*8]
test esi, esi
js 0x47bf9b
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov edx, esi
xor ebx, ebx
mov edi, dword [eax + 0x4c]
movzx eax, byte [0x5fd2ec]
call fcn.0056a9f0
test eax, eax
mov dword [ebp - 0x30], eax
je 0x47bfbd
mov esi, dword [ebp - 0x58]
mov ecx, esi
lea eax, [esi - 1]
and ecx, 0x1fffffff
mov edx, eax
cmp ecx, eax
cmovb edx, ecx
cmp edx, 0xa
jae 0x47b232
mov eax, esi
mov esi, dword [ebp - 0x30]
mov ecx, edi
jmp 0x47b27f
mov esi, dword [ebp - 0x30]
cmp ecx, eax
cmovb eax, ecx
lea ecx, [edi + eax*8 + 8]
cmp esi, ecx
jae 0x47b24f
lea eax, [esi + eax*8 + 8]
mov ecx, edi
cmp edi, eax
mov eax, dword [ebp - 0x58]
jb 0x47b27f
inc edx
mov ecx, 2
mov eax, edx
mov ebx, edx
and eax, 1
cmovne ecx, eax
mov eax, dword [ebp - 0x58]
xor edx, edx
sub ebx, ecx
lea ecx, [edi + ebx*8]
sub eax, ebx
nop dword [eax + eax]
movups xmm0, xmmword [edi + edx*8]
movups xmmword [esi + edx*8], xmm0
add edx, 2
cmp ebx, edx
jne 0x47b270
mov edx, dword [ebp - 0x58]
lea esi, [esi + ebx*8 + 4]
lea edx, [edi + edx*8]
nop dword [eax]
cmp ecx, edx
je 0x47b2a7
mov edi, dword [ecx]
mov ebx, dword [ecx + 4]
add ecx, 8
dec eax
mov dword [esi - 4], edi
mov dword [esi], ebx
lea esi, [esi + 8]
jne 0x47b290
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x98], 4
mov ecx, dword [eax + 0x5c]
mov dword [ebp - 0x70], ecx
test ecx, ecx
mov ecx, 4
je 0x47b3b0
mov ecx, dword [ebp - 0x70]
cmp ecx, 0xfffffff
ja 0x47bfac
lea esi, [ecx*8]
test esi, esi
js 0x47bfd5
mov edi, dword [eax + 0x58]
movzx eax, byte [0x5fd2ec]
xor ecx, ecx
mov edx, esi
xor ebx, ebx
call fcn.0056a9f0
test eax, eax
mov dword [ebp - 0x34], eax
je 0x47bff7
mov esi, dword [ebp - 0x70]
mov ecx, esi
lea eax, [esi - 1]
and ecx, 0x1fffffff
mov edx, eax
cmp ecx, eax
cmovb edx, ecx
cmp edx, 0xa
jae 0x47b32e
mov eax, esi
mov ecx, edi
jmp 0x47b382
cmp ecx, eax
cmovb eax, ecx
lea ecx, [edi + eax*8 + 8]
cmp dword [ebp - 0x34], ecx
jae 0x47b34b
mov ecx, dword [ebp - 0x34]
lea eax, [ecx + eax*8 + 8]
mov ecx, edi
cmp edi, eax
mov eax, esi
jb 0x47b382
inc edx
mov ecx, 2
mov eax, edx
mov ebx, edx
and eax, 1
cmovne ecx, eax
mov eax, esi
mov esi, dword [ebp - 0x34]
xor edx, edx
sub ebx, ecx
sub eax, ebx
lea ecx, [edi + ebx*8]
nop dword [eax]
movups xmm0, xmmword [edi + edx*8]
movups xmmword [esi + edx*8], xmm0
add edx, 2
cmp ebx, edx
jne 0x47b370
mov esi, dword [ebp - 0x70]
lea edx, [edi + esi*8]
mov esi, dword [ebp - 0x34]
lea esi, [esi + ebx*8 + 4]
nop dword [eax]
cmp ecx, edx
je 0x47b3a7
mov edi, dword [ecx]
mov ebx, dword [ecx + 4]
add ecx, 8
dec eax
mov dword [esi - 4], edi
mov dword [esi], ebx
lea esi, [esi + 8]
jne 0x47b390
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x34]
mov edx, dword [eax + 0x68]
mov dword [ebp - 0x34], ecx
test edx, edx
mov dword [ebp - 0x84], edx
je 0x47b458
mov esi, dword [ebp - 0x84]
cmp esi, 0x7ffffff
ja 0x47bfe6
shl esi, 4
js 0x47c00f
mov edi, dword [eax + 0x64]
movzx eax, byte [0x5fd2ec]
xor ecx, ecx
mov edx, esi
xor ebx, ebx
call fcn.0056a9f0
test eax, eax
mov dword [ebp - 0x98], eax
je 0x47c031
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x5c], esi
nop dword [eax + eax]
cmp esi, ebx
je 0x47b452
mov eax, dword [edi]
mov esi, dword [edi + 8]
dec ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [edi + 4]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [edi + 0xc]
lea edi, [edi + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x98]
mov dword [eax + ebx], edx
mov edx, dword [ebp - 0x28]
mov dword [eax + ebx + 4], edx
mov edx, dword [ebp - 0x38]
mov dword [eax + ebx + 8], esi
mov esi, dword [ebp - 0x5c]
mov dword [eax + ebx + 0xc], edx
lea ebx, [ebx + 0x10]
jne 0x47b410
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x74]
mov dword [ebp - 0x90], 4
mov dword [ebp - 0x94], 4
test ecx, ecx
mov dword [ebp - 0x80], ecx
je 0x47b508
mov esi, dword [ebp - 0x80]
cmp esi, 0x7ffffff
ja 0x47c020
shl esi, 4
js 0x47c049
mov edi, dword [eax + 0x70]
movzx eax, byte [0x5fd2ec]
xor ecx, ecx
mov edx, esi
xor ebx, ebx
call fcn.0056a9f0
test eax, eax
mov dword [ebp - 0x94], eax
je 0x47c06b
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x5c], esi
nop dword [eax + eax]
cmp esi, ebx
je 0x47b502
mov eax, dword [edi]
mov esi, dword [edi + 8]
dec ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [edi + 4]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [edi + 0xc]
lea edi, [edi + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x94]
mov dword [eax + ebx], edx
mov edx, dword [ebp - 0x28]
mov dword [eax + ebx + 4], edx
mov edx, dword [ebp - 0x38]
mov dword [eax + ebx + 8], esi
mov esi, dword [ebp - 0x5c]
mov dword [eax + ebx + 0xc], edx
lea ebx, [ebx + 0x10]
jne 0x47b4c0
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x80]
test ecx, ecx
mov dword [ebp - 0x7c], ecx
je 0x47b5a8
mov esi, dword [ebp - 0x7c]
cmp esi, 0x7ffffff
ja 0x47c05a
shl esi, 4
js 0x47c083
mov edi, dword [eax + 0x7c]
movzx eax, byte [0x5fd2ec]
xor ecx, ecx
mov edx, esi
xor ebx, ebx
call fcn.0056a9f0
test eax, eax
mov dword [ebp - 0x90], eax
je 0x47c0a5
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0x5c], esi
nop word [eax + eax]
cmp esi, ebx
je 0x47b5a2
mov eax, dword [edi]
mov esi, dword [edi + 8]
dec ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [edi + 4]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [edi + 0xc]
lea edi, [edi + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x90]
mov dword [eax + ebx], edx
mov edx, dword [ebp - 0x28]
mov dword [eax + ebx + 4], edx
mov edx, dword [ebp - 0x38]
mov dword [eax + ebx + 8], esi
mov esi, dword [ebp - 0x5c]
mov dword [eax + ebx + 0xc], edx
lea ebx, [ebx + 0x10]
jne 0x47b560
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x8c]
mov esi, 4
mov edx, 4
test ecx, ecx
mov dword [ebp - 0x68], ecx
je 0x47b6a5
cmp ecx, 0xfffffff
ja 0x47c094
lea esi, [ecx*8]
test esi, esi
js 0x47c0bd
mov edi, dword [eax + 0x88]
movzx eax, byte [0x5fd2ec]
xor ecx, ecx
mov edx, esi
xor ebx, ebx
call fcn.0056a9f0
test eax, eax
mov dword [ebp - 0x4c], eax
je 0x47c0df
mov esi, dword [ebp - 0x68]
mov ecx, esi
lea eax, [esi - 1]
and ecx, 0x1fffffff
mov edx, eax
cmp ecx, eax
cmovb edx, ecx
cmp edx, 0xa
jae 0x47b624
mov eax, esi
mov esi, dword [ebp - 0x4c]
mov ecx, edi
jmp 0x47b66f
mov esi, dword [ebp - 0x4c]
cmp ecx, eax
cmovb eax, ecx
lea ecx, [edi + eax*8 + 8]
cmp esi, ecx
jae 0x47b641
lea eax, [esi + eax*8 + 8]
mov ecx, edi
cmp edi, eax
mov eax, dword [ebp - 0x68]
jb 0x47b66f
inc edx
mov ecx, 2
mov eax, edx
mov ebx, edx
and eax, 1
cmovne ecx, eax
mov eax, dword [ebp - 0x68]
xor edx, edx
sub ebx, ecx
lea ecx, [edi + ebx*8]
sub eax, ebx
nop dword [eax]
movups xmm0, xmmword [edi + edx*8]
movups xmmword [esi + edx*8], xmm0
add edx, 2
cmp ebx, edx
jne 0x47b660
mov edx, dword [ebp - 0x68]
lea esi, [esi + ebx*8 + 4]
lea edx, [edi + edx*8]
nop dword [eax]
cmp ecx, edx
je 0x47b697
mov edi, dword [ecx]
mov ebx, dword [ecx + 4]
add ecx, 8
dec eax
mov dword [esi - 4], edi
mov dword [esi], ebx
lea esi, [esi + 8]
jne 0x47b680
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x4c]
mov esi, 4
mov ecx, dword [eax + 0x98]
mov dword [ebp - 0x4c], edx
test ecx, ecx
mov dword [ebp - 0x54], ecx
je 0x47b7a0
mov ecx, dword [ebp - 0x54]
cmp ecx, 0xfffffff
ja 0x47c0ce
lea esi, [ecx*8]
test esi, esi
js 0x47c0f7
mov edi, dword [eax + 0x94]
movzx eax, byte [0x5fd2ec]
xor ecx, ecx
mov edx, esi
xor ebx, ebx
call fcn.0056a9f0
test eax, eax
mov dword [ebp - 0x48], eax
je 0x47c119
mov esi, dword [ebp - 0x54]
mov ecx, esi
lea eax, [esi - 1]
and ecx, 0x1fffffff
mov edx, eax
cmp ecx, eax
cmovb edx, ecx
cmp edx, 0xa
jae 0x47b71d
mov eax, esi
mov esi, dword [ebp - 0x48]
mov ecx, edi
jmp 0x47b76f
mov esi, dword [ebp - 0x48]
cmp ecx, eax
cmovb eax, ecx
lea ecx, [edi + eax*8 + 8]
cmp esi, ecx
jae 0x47b73a
lea eax, [esi + eax*8 + 8]
mov ecx, edi
cmp edi, eax
mov eax, dword [ebp - 0x54]
jb 0x47b76f
inc edx
mov ecx, 2
mov eax, edx
mov ebx, edx
and eax, 1
cmovne ecx, eax
mov eax, dword [ebp - 0x54]
xor edx, edx
sub ebx, ecx
lea ecx, [edi + ebx*8]
sub eax, ebx
nop word cs:[eax + eax]
movups xmm0, xmmword [edi + edx*8]
movups xmmword [esi + edx*8], xmm0
add edx, 2
cmp ebx, edx
jne 0x47b760
mov edx, dword [ebp - 0x54]
lea esi, [esi + ebx*8 + 4]
lea edx, [edi + edx*8]
nop dword [eax]
cmp ecx, edx
je 0x47b797
mov edi, dword [ecx]
mov ebx, dword [ecx + 4]
add ecx, 8
dec eax
mov dword [esi - 4], edi
mov dword [esi], ebx
lea esi, [esi + 8]
jne 0x47b780
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x48]
mov edx, dword [eax + 0x108]
mov ecx, dword [eax + 0x34]
mov edi, dword [eax + 0x10c]
mov dword [ebp - 0x8c], 4
mov dword [ebp - 0x48], esi
mov dword [ebp - 0xd8], edx
mov edx, dword [eax + 0xa4]
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0xd4], edi
test edx, edx
mov dword [ebp - 0x78], edx
je 0x47b873
mov eax, dword [ebp - 0x78]
cmp eax, 0xaaaaaaa
ja 0x47c108
lea eax, [eax*4]
lea esi, [eax + eax*2]
test esi, esi
js 0x47c131
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov edx, esi
xor ebx, ebx
mov edi, dword [eax + 0xa0]
movzx eax, byte [0x5fd2ec]
call fcn.0056a9f0
test eax, eax
mov dword [ebp - 0x8c], eax
je 0x47c153
mov eax, dword [ebp - 0x78]
nop dword [eax + eax]
cmp esi, ebx
je 0x47b86d
mov ecx, dword [edi]
dec eax
mov dword [ebp - 0x2c], ecx
mov ecx, dword [edi + 4]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
movzx ecx, byte [edi + 8]
lea edi, [edi + 0xc]
mov byte [ebp - 0x38], cl
mov ecx, esi
mov esi, dword [ebp - 0x8c]
mov dword [esi + ebx], edx
mov edx, dword [ebp - 0x28]
mov dword [esi + ebx + 4], edx
mov dh, byte [ebp - 0x38]
mov byte [esi + ebx + 8], dh
mov esi, ecx
lea ebx, [ebx + 0xc]
jne 0x47b830
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov edi, dword [eax + 0xac]
mov eax, dword [eax + 0xb0]
test eax, eax
mov dword [ebp - 0xac], eax
je 0x47b8cf
cmp eax, 0xfffffff
ja 0x47c142
lea esi, [eax*8]
test esi, esi
js 0x47c16b
movzx eax, byte [0x5fd2ec]
xor ecx, ecx
mov edx, esi
call fcn.0056a9f0
test eax, eax
jne 0x47b8d6
mov ecx, 4
mov edx, esi
mov dword [ebp - 0x10], 0xb
call fcn.0057f230
jmp 0x47c260
xor esi, esi
mov eax, 4
push esi
push edi
mov dword [ebp - 0xa8], eax
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x20]
mov esi, 4
mov edx, 4
mov ecx, dword [eax]
mov dword [ebp - 0xd0], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xcc], ecx
mov ecx, dword [eax + 0xbc]
test ecx, ecx
mov dword [ebp - 0x64], ecx
je 0x47b9f5
cmp ecx, 0xfffffff
ja 0x47c17c
lea esi, [ecx*8]
test esi, esi
js 0x47c18d
mov edi, dword [eax + 0xb8]
movzx eax, byte [0x5fd2ec]
xor ecx, ecx
mov edx, esi
xor ebx, ebx
call fcn.0056a9f0
test eax, eax
mov dword [ebp - 0x44], eax
je 0x47c1af
mov esi, dword [ebp - 0x64]
mov ecx, esi
lea eax, [esi - 1]
and ecx, 0x1fffffff
mov edx, eax
cmp ecx, eax
cmovb edx, ecx
cmp edx, 0xa
jae 0x47b977
mov eax, esi
mov esi, dword [ebp - 0x44]
mov ecx, edi
jmp 0x47b9bf
mov esi, dword [ebp - 0x44]
cmp ecx, eax
cmovb eax, ecx
lea ecx, [edi + eax*8 + 8]
cmp esi, ecx
jae 0x47b994
lea eax, [esi + eax*8 + 8]
mov ecx, edi
cmp edi, eax
mov eax, dword [ebp - 0x64]
jb 0x47b9bf
inc edx
mov ecx, 2
mov eax, edx
mov ebx, edx
and eax, 1
cmovne ecx, eax
mov eax, dword [ebp - 0x64]
xor edx, edx
sub ebx, ecx
lea ecx, [edi + ebx*8]
sub eax, ebx
movups xmm0, xmmword [edi + edx*8]
movups xmmword [esi + edx*8], xmm0
add edx, 2
cmp ebx, edx
jne 0x47b9b0
mov edx, dword [ebp - 0x64]
lea esi, [esi + ebx*8 + 4]
lea edx, [edi + edx*8]
nop dword [eax]
cmp ecx, edx
je 0x47b9e7
mov edi, dword [ecx]
mov ebx, dword [ecx + 4]
add ecx, 8
dec eax
mov dword [esi - 4], edi
mov dword [esi], ebx
lea esi, [esi + 8]
jne 0x47b9d0
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x44]
mov esi, 4
mov dword [ebp - 0x44], edx
mov edx, dword [eax + 0x10]
mov edi, dword [eax + 0xc]
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc0], edx
mov edx, dword [eax + 0xc8]
mov dword [ebp - 0xc4], edi
mov edi, dword [eax + 0x38]
mov dword [ebp - 0xc8], ecx
test edx, edx
mov dword [ebp - 0xbc], edi
mov dword [ebp - 0x50], edx
je 0x47bb10
mov ecx, dword [ebp - 0x50]
cmp ecx, 0xfffffff
ja 0x47c19e
lea esi, [ecx*8]
test esi, esi
js 0x47c1c7
mov edi, dword [eax + 0xc4]
movzx eax, byte [0x5fd2ec]
xor ecx, ecx
mov edx, esi
xor ebx, ebx
call fcn.0056a9f0
test eax, eax
mov dword [ebp - 0x40], eax
je 0x47c1e6
mov esi, dword [ebp - 0x50]
mov ecx, esi
lea eax, [esi - 1]
and ecx, 0x1fffffff
mov edx, eax
cmp ecx, eax
cmovb edx, ecx
cmp edx, 0xa
jae 0x47ba91
mov eax, esi
mov esi, dword [ebp - 0x40]
mov ecx, edi
jmp 0x47badf
mov esi, dword [ebp - 0x40]
cmp ecx, eax
cmovb eax, ecx
lea ecx, [edi + eax*8 + 8]
cmp esi, ecx
jae 0x47baae
lea eax, [esi + eax*8 + 8]
mov ecx, edi
cmp edi, eax
mov eax, dword [ebp - 0x50]
jb 0x47badf
inc edx
mov ecx, 2
mov eax, edx
mov ebx, edx
and eax, 1
cmovne ecx, eax
mov eax, dword [ebp - 0x50]
xor edx, edx
sub ebx, ecx
lea ecx, [edi + ebx*8]
sub eax, ebx
nop word [eax + eax]
movups xmm0, xmmword [edi + edx*8]
movups xmmword [esi + edx*8], xmm0
add edx, 2
cmp ebx, edx
jne 0x47bad0
mov edx, dword [ebp - 0x50]
lea esi, [esi + ebx*8 + 4]
lea edx, [edi + edx*8]
nop dword [eax]
cmp ecx, edx
je 0x47bb07
mov edi, dword [ecx]
mov ebx, dword [ecx + 4]
add ecx, 8
dec eax
mov dword [esi - 4], edi
mov dword [esi], ebx
lea esi, [esi + 8]
jne 0x47baf0
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x40]
mov ecx, dword [eax + 0xd4]
mov dword [ebp - 0x88], 4
mov dword [ebp - 0x40], esi
test ecx, ecx
mov dword [ebp - 0x74], ecx
je 0x47bbeb
mov eax, dword [ebp - 0x74]
cmp eax, 0x5555555
ja 0x47c1d8
lea eax, [eax*8]
lea edi, [eax + eax*2]
test edi, edi
js 0x47c1fb
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov edx, edi
xor ebx, ebx
mov esi, dword [eax + 0xd0]
movzx eax, byte [0x5fd2ec]
call fcn.0056a9f0
test eax, eax
mov dword [ebp - 0x88], eax
je 0x47c217
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0xf0], edi
cmp edi, ebx
je 0x47bbe5
mov eax, dword [esi]
mov edi, dword [esi + 8]
dec ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 4]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x5c], eax
mov eax, dword [esi + 0x14]
lea esi, [esi + 0x18]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0x88]
mov dword [eax + ebx], edx
mov edx, dword [ebp - 0x28]
mov dword [eax + ebx + 4], edx
mov edx, dword [ebp - 0x38]
mov dword [eax + ebx + 8], edi
mov edi, dword [ebp - 0xf0]
mov dword [eax + ebx + 0xc], edx
mov edx, dword [ebp - 0x5c]
mov dword [eax + ebx + 0x10], edx
mov edx, dword [ebp - 0xf4]
mov dword [eax + ebx + 0x14], edx
lea ebx, [ebx + 0x18]
jne 0x47bb80
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov edi, dword [eax + 0xe0]
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], 4
test edi, edi
je 0x47bcf3
cmp edi, 0xfffffff
ja 0x47c209
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], edi
lea edi, [edi*8]
test edi, edi
js 0x47c22c
mov esi, dword [eax + 0xdc]
movzx eax, byte [0x5fd2ec]
xor ecx, ecx
mov edx, edi
xor ebx, ebx
call fcn.0056a9f0
test eax, eax
mov dword [ebp - 0x2c], eax
je 0x47c23a
mov edi, dword [ebp - 0x28]
mov ecx, edi
lea eax, [edi - 1]
and ecx, 0x1fffffff
mov edx, eax
cmp ecx, eax
cmovb edx, ecx
cmp edx, 0xa
jae 0x47bc6d
mov eax, edi
mov edi, dword [ebp - 0x2c]
mov ecx, esi
jmp 0x47bcbf
mov edi, dword [ebp - 0x2c]
cmp ecx, eax
cmovb eax, ecx
lea ecx, [esi + eax*8 + 8]
cmp edi, ecx
jae 0x47bc8a
lea eax, [edi + eax*8 + 8]
mov ecx, esi
cmp esi, eax
mov eax, dword [ebp - 0x28]
jb 0x47bcbf
inc edx
mov ecx, 2
mov eax, edx
mov ebx, edx
and eax, 1
cmovne ecx, eax
mov eax, dword [ebp - 0x28]
xor edx, edx
sub ebx, ecx
lea ecx, [esi + ebx*8]
sub eax, ebx
nop word cs:[eax + eax]
movups xmm0, xmmword [esi + edx*8]
movups xmmword [edi + edx*8], xmm0
add edx, 2
cmp ebx, edx
jne 0x47bcb0
mov edx, dword [ebp - 0x28]
lea edx, [esi + edx*8]
lea esi, [edi + ebx*8 + 4]
nop dword [eax]
cmp ecx, edx
je 0x47bce7
mov edi, dword [ecx]
mov ebx, dword [ecx + 4]
add ecx, 8
dec eax
mov dword [esi - 4], edi
mov dword [esi], ebx
lea esi, [esi + 8]
jne 0x47bcd0
mov eax, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x30]
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0xec]
mov ecx, dword [ebp - 0xe8]
movsd xmm0, qword [ebp - 0xb8]
mov dword [esi + 0xfc], ecx
mov ecx, dword [ebp - 0xe4]
mov dword [esi + 0x100], ecx
mov ecx, dword [ebp - 0xa4]
mov dword [esi + 0xe4], eax
mov dword [esi + 0xe8], ecx
mov dword [esi + 0xec], eax
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xa0]
mov dword [esi + 0xf0], eax
mov dword [esi + 0xf4], ecx
mov dword [esi + 0xf8], eax
movzx eax, byte [ebp - 0x5d]
mov ecx, dword [ebp - 0x34]
mov byte [esi + 0x118], al
mov eax, dword [ebp - 0xb0]
movsd qword [esi + 0x28], xmm0
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 0x6c]
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], eax
mov eax, dword [ebp - 0xe0]
mov ebx, dword [ebp - 0x74]
mov dword [esi + 0x104], eax
mov eax, dword [ebp - 0x58]
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], edx
mov dword [esi + 0x50], eax
mov eax, dword [ebp - 0x70]
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], ecx
mov dword [esi + 0x5c], eax
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x98]
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], ecx
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x94]
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], ecx
mov dword [esi + 0x74], eax
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x90]
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x4c]
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], ecx
mov dword [esi + 0x8c], eax
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x48]
mov dword [esi + 0x90], ecx
mov dword [esi + 0x94], eax
mov eax, dword [ebp - 0xdc]
mov dword [esi + 0x98], ecx
mov ecx, dword [ebp - 0x8c]
mov dword [esi + 0x34], eax
mov eax, dword [ebp - 0xd8]
mov dword [esi + 0x108], eax
mov eax, dword [ebp - 0xd4]
mov dword [esi + 0x10c], eax
mov eax, dword [ebp - 0x78]
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], ecx
mov dword [esi + 0xa4], eax
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa8]
mov dword [esi + 0xa8], ecx
mov dword [esi + 0xac], eax
mov eax, dword [ebp - 0xd0]
mov dword [esi + 0xb0], ecx
mov ecx, dword [ebp - 0x44]
mov dword [esi], eax
mov eax, dword [ebp - 0xcc]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x64]
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], ecx
mov dword [esi + 0xbc], eax
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x50]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0xc4]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0xc0]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0xbc]
mov dword [esi + 0x38], eax
mov eax, dword [ebp - 0x40]
mov dword [esi + 0xc0], ecx
mov dword [esi + 0xc4], eax
mov dword [esi + 0xc8], ecx
mov ecx, dword [ebp - 0x88]
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], ecx
mov ecx, dword [ebp - 0x2c]
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd8], edi
mov dword [esi + 0xdc], ecx
mov ecx, dword [ebp - 0x20]
mov dword [esi + 0xe0], edi
mov edi, dword [ecx + 0x110]
mov ebx, dword [ecx + 0x114]
movzx edx, byte [ecx + 0x119]
mov dword [esi + 0x110], edi
mov edi, dword [ecx + 0x14]
mov dword [esi + 0x114], ebx
mov ebx, dword [ecx + 0x18]
mov dword [esi + 0x14], edi
mov edi, dword [ecx + 0x1c]
mov dword [esi + 0x18], ebx
mov ebx, dword [ecx + 0x20]
mov dword [esi + 0x1c], edi
mov edi, dword [ecx + 0x24]
mov ecx, dword [ebp - 0x18]
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], edi
mov byte [esi + 0x119], dl
mov dword fs:[0], ecx
add esp, 0xe8
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 2
call fcn.004634e0
jmp 0x47c260
mov dword [ebp - 0x10], 2
call fcn.004634e0
jmp 0x47c260
mov dword [ebp - 0x10], 3
call fcn.004634e0
jmp 0x47c260
mov ecx, 4
mov edx, ebx
mov dword [ebp - 0x10], 2
call fcn.0057f230
jmp 0x47c260
mov dword [ebp - 0x10], 3
call fcn.004634e0
jmp 0x47c260
mov dword [ebp - 0x10], 4
call fcn.004634e0
jmp 0x47c260
mov ecx, 4
mov edx, esi
mov dword [ebp - 0x10], 3
call fcn.0057f230
jmp 0x47c260
mov dword [ebp - 0x10], 4
call fcn.004634e0
jmp 0x47c260
mov dword [ebp - 0x10], 5
call fcn.004634e0
jmp 0x47c260
mov ecx, 4
mov edx, esi
mov dword [ebp - 0x10], 4
call fcn.0057f230
jmp 0x47c260
mov dword [ebp - 0x10], 5
call fcn.004634e0
jmp 0x47c260
mov dword [ebp - 0x10], 6
call fcn.004634e0
jmp 0x47c260
mov ecx, 4
mov edx, esi
mov dword [ebp - 0x10], 5
call fcn.0057f230
jmp 0x47c260
mov dword [ebp - 0x10], 6
call fcn.004634e0
jmp 0x47c260
mov dword [ebp - 0x10], 7
call fcn.004634e0
jmp 0x47c260
mov ecx, 4
mov edx, esi
mov dword [ebp - 0x10], 6
call fcn.0057f230
jmp 0x47c260
mov dword [ebp - 0x10], 7
call fcn.004634e0
jmp 0x47c260
mov dword [ebp - 0x10], 8
call fcn.004634e0
jmp 0x47c260
mov ecx, 4
mov edx, esi
mov dword [ebp - 0x10], 7
call fcn.0057f230
jmp 0x47c260
mov dword [ebp - 0x10], 8
call fcn.004634e0
jmp 0x47c260
mov dword [ebp - 0x10], 9
call fcn.004634e0
jmp 0x47c260
mov ecx, 4
mov edx, esi
mov dword [ebp - 0x10], 8
call fcn.0057f230
jmp 0x47c260
mov dword [ebp - 0x10], 9
call fcn.004634e0
jmp 0x47c260
mov dword [ebp - 0x10], 0xa
call fcn.004634e0
jmp 0x47c260
mov ecx, 4
mov edx, esi
mov dword [ebp - 0x10], 9
call fcn.0057f230
jmp 0x47c260
mov dword [ebp - 0x10], 0xa
call fcn.004634e0
jmp 0x47c260
mov dword [ebp - 0x10], 0xb
call fcn.004634e0
jmp 0x47c260
mov ecx, 4
mov edx, esi
mov dword [ebp - 0x10], 0xa
call fcn.0057f230
jmp 0x47c260
mov dword [ebp - 0x10], 0xb
call fcn.004634e0
jmp 0x47c260
mov dword [ebp - 0x10], 0xc
call fcn.004634e0
jmp 0x47c260
mov dword [ebp - 0x10], 0xc
call fcn.004634e0
jmp 0x47c260
mov dword [ebp - 0x10], 0xd
call fcn.004634e0
jmp 0x47c260
mov ecx, 4
mov edx, esi
mov dword [ebp - 0x10], 0xc
call fcn.0057f230
jmp 0x47c260
mov dword [ebp - 0x10], 0xd
call fcn.004634e0
jmp 0x47c260
mov dword [ebp - 0x10], 0xe
call fcn.004634e0
jmp 0x47c260
mov ecx, 4
mov edx, esi
mov dword [ebp - 0x10], 0xd
call fcn.0057f230
jmp 0x47c260
mov dword [ebp - 0x10], 0xe
call fcn.004634e0
jmp 0x47c260
mov dword [ebp - 0x10], 0xf
call fcn.004634e0
jmp 0x47c260
mov ecx, 4
mov edx, edi
mov dword [ebp - 0x10], 0xe
call fcn.0057f230
jmp 0x47c260
mov dword [ebp - 0x10], 0xf
call fcn.004634e0
jmp 0x47c260
mov ecx, 4
mov edx, edi
mov dword [ebp - 0x10], 0xf
call fcn.0057f230
jmp 0x47c260
call fcn.004634e0
mov dword [ebp - 0x10], 0
call fcn.004634e0
ud2