Function at 0x471180
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6180e6
mov eax, dword fs:[0]
push eax
sub esp, 0x3b8
push ebx
push esi
push edi
mov eax, dword [0x7161c0]
xor eax, esp
push eax
lea eax, [esp + 0x3c8]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x30], edi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x28], 0
jne 0x4711d8
push 0x6b3364
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 0x63cc40
call fcn.005da4c5
call fcn.005bc35c
mov ecx, dword [eax + 4]
mov edx, dword [edi + 0x1ec]
mov eax, dword [edi + 0xec]
mov dword [esp + 0x1c], ecx
mov ecx, dword [edx + 0x20]
push ecx
push eax
lea ecx, [esp + 0xbc]
call fcn.004276b0
mov dword [esp + 0x3d0], 0
mov ebx, dword [esi + 0x20]
test ebx, ebx
mov byte [esp + 0x28], 1
je 0x471434
lea esp, [esp]
xor eax, eax
test ebx, ebx
setne al
test eax, eax
je 0x471464
mov eax, ebx
mov eax, dword [eax + 8]
mov ebx, dword [ebx]
sub eax, 0x10
push eax
call fcn.00402800
add eax, 0x10
add esp, 4
mov dword [esp + 0x24], eax
mov byte [esp + 0x3d0], 2
lea ecx, [esp + 0x24]
call fcn.00407f30
mov ecx, eax
call fcn.00407e90
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], 0
jne 0x471276
cmp byte [esp + 0x28], 0
je 0x47146e
push eax
lea ecx, [esp + 0x24]
call fcn.00401eb0
mov byte [esp + 0x3d0], 4
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x24]
call fcn.00408070
mov edi, eax
mov byte [esp + 0x3d0], 5
mov eax, dword [edi]
mov esi, dword [eax - 0xc]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or eax, ecx
jge 0x4712be
push esi
mov ecx, edi
call fcn.00401990
mov eax, dword [edi]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.005da00d
push eax
call fcn.00401300
add esp, 0xc
test esi, esi
jl 0x47149b
mov eax, dword [edi]
cmp esi, dword [eax - 8]
jg 0x47149b
mov dword [eax - 0xc], esi
mov edx, dword [edi]
mov byte [esi + edx], 0
mov eax, dword [edi]
push ecx
sub eax, 0x10
mov esi, esp
mov dword [esp + 0x80], esp
push eax
mov dword [esp + 0x88], esi
call fcn.00402800
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov byte [esp + 0x3d4], 7
mov eax, dword [esp + 0x28]
push eax
mov byte [esp + 0x3d8], 5
lea ecx, [esp + 0xbc]
call fcn.0042b3c0
mov esi, eax
mov byte [esp + 0x3d0], 4
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47135e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x3d0], 2
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x471386
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
jge 0x471395
cmp byte [esp + 0x28], 0
jne 0x471481
mov esi, dword [esp + 0x1c]
cmp byte [esi + 0x218], 0
je 0x4713d7
cmp byte [esp + 0x28], 0
je 0x4713b1
add esi, 0x15c
jmp 0x4713b7
add esi, 0x17c
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [esp + 0x24]
mov edx, dword [edx + 4]
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
mov ecx, esi
call edx
cmp byte [esp + 0x28], 0
je 0x4713ee
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x24]
add ecx, 4
push eax
call fcn.00403020
mov ecx, dword [esp + 0x30]
cmp byte [ecx + 0x198], 0
mov byte [esp + 0x28], 0
jne 0x47146e
mov byte [esp + 0x3d0], 0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x471428
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, ebx
jne 0x471220
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
cmp byte [eax + 0x1e9], 0
je 0x4715ec
mov eax, dword [esp + 0x134]
test eax, eax
jle 0x4715ec
ja 0x4715a3
push 0x80070057
call fcn.00401470
push 0x80004005
call fcn.00401470
mov byte [esp + 0x3d0], 0
lea ecx, [esp + 0x24]
call fcn.00401a50
jmp 0x471430
mov ecx, dword [esp + 0x1c]
cmp byte [ecx + 0x1e9], 0
je 0x4714d2
mov eax, dword [esp + 0x134]
test eax, eax
jle 0x4714d2
ja 0x4714a5
push 0x80070057
call fcn.00401470
mov edx, dword [esp + 0x130]
cmp dword [edx], 0
je 0x4714d2
cmp dword [esp + 0x10c], 0
jne 0x4714d2
push 0x6b3364
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], str.Cannot_render_any_of_the_streams
call fcn.005da4c5
lea ecx, [esp + 0x14]
call fcn.004019e0
mov byte [esp + 0x3d0], 0xb
cmp esi, 0x80040240
jg 0x47153a
je 0x471533
cmp esi, 0x80040217
jg 0x47151c
je 0x471515
cmp esi, 0x80004004
je 0x47150e
cmp esi, 0x80040216
jne 0x471571
push 0x6314f8
jmp 0x47157d
push 0x6314ec
jmp 0x47157d
push 0x6314dc
jmp 0x47157d
cmp esi, 0x80040218
je 0x471571
cmp esi, 0x8004022f
jne 0x471571
push 0x6314cc
jmp 0x47157d
push 0x6314bc
jmp 0x47157d
cmp esi, 0x8007000e
jg 0x471569
je 0x471562
cmp esi, 0x80040241
je 0x47155b
cmp esi, 0x80040265
jne 0x471571
push 0x6314ac
jmp 0x47157d
push 0x631498
jmp 0x47157d
push 0x631488
jmp 0x47157d
cmp esi, 0x80070057
je 0x471578
push 0x631478
jmp 0x47157d
push 0x63146c
lea ecx, [esp + 0x18]
call fcn.00401e30
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x24]
call fcn.00402bc0
push 0x6b34bc
lea edx, [esp + 0x24]
push edx
call fcn.005da4c5
mov ecx, dword [esp + 0x130]
cmp dword [ecx], 0
je 0x4715ec
push edi
lea edx, [esp + 0xb8]
push edx
lea ecx, [esp + 0x150]
call fcn.00436a80
mov byte [esp + 0x3d0], 0xd
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x144]
call eax
mov byte [esp + 0x3d0], 0
lea ecx, [esp + 0x148]
call fcn.00436c30
cmp byte [edi + 0x198], 0
jne 0x47160d
lea ecx, [edi + 0x188]
push ecx
push 0x63688c
lea ecx, [esp + 0xbc]
call fcn.0041b560
mov eax, dword [edi + 0xec]
mov esi, dword [edi + 0x110]
cmp esi, eax
lea ebx, [edi + 0x110]
je 0x471648
test eax, eax
mov dword [ebx], 0
je 0x47163a
mov edx, dword [eax]
push ebx
push 0x631388
push eax
mov eax, dword [edx]
call eax
test esi, esi
je 0x471646
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov esi, dword [ebx]
test esi, esi
jne 0x471710
lea ecx, [esp + 0x18]
call fcn.00406ac0
mov byte [esp + 0x3d0], 0xe
mov eax, dword [edi + 0xec]
cmp eax, esi
je 0x4716fd
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
test eax, eax
jl 0x4716fd
lea ecx, [esp + 0x10]
call fcn.00406a00
mov byte [esp + 0x3d0], 0xf
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x14]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x4716ec
lea esp, [esp]
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.004069c0
test eax, eax
jne 0x4716ec
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x4716d4
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x14]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
je 0x4716b0
mov byte [esp + 0x3d0], 0xe
lea ecx, [esp + 0x10]
call fcn.00406510
mov byte [esp + 0x3d0], 0
lea ecx, [esp + 0x18]
call fcn.00406860
jmp 0x471712
xor esi, esi
mov eax, dword [edi + 0x104]
lea edx, [esp + 0x54]
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x28]
call eax
mov dword [esp + 0x1c], esi
mov byte [esp + 0x3d0], 0x11
mov eax, dword [edi + 0xec]
cmp eax, esi
je 0x471a70
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
test eax, eax
jl 0x471a70
lea ecx, [esp + 0x18]
call fcn.00406a00
mov byte [esp + 0x3d0], 0x12
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x1c]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x471a58
cmp dword [edi + 0x1ac], esi
jne 0x471a58
mov ecx, dword [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
call fcn.00465580
mov byte [esp + 0x3d0], 0x13
cmp dword [esp + 0x10], esi
jne 0x4717c7
mov byte [esp + 0x3d0], 0x12
lea ecx, [esp + 0x10]
call fcn.00464d90
jmp 0x471a28
push 3
lea edx, [esp + 0x18]
push edx
push 0x59
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.0049a4f0
add esp, 8
mov byte [esp + 0x3d0], 0x14
mov edx, dword [esp + 0x2c]
cmp dword [edx - 0xc], 3
jge 0x47180d
push 0x63cb74
lea ecx, [esp + 0x30]
call fcn.00401e30
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push esi
push eax
call edx
cmp eax, 1
mov dword [esp + 0x38], eax
mov dword [esp + 0x20], 1
jb 0x4719f9
nop
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push edx
push 0
push eax
mov eax, dword [ecx + 0x10]
call eax
xor ebx, ebx
mov esi, eax
mov word [esp + 0x9c], 0x17
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x3d0], 0x15
mov eax, dword [esp + 0x2c]
cmp dword [eax - 0xc], ebx
jl 0x47149b
mov cl, byte [eax]
mov byte [esp + 0x28], cl
cmp dword [eax - 0xc], 1
jl 0x47149b
mov dl, byte [eax + 1]
mov byte [esp + 0x29], dl
cmp dword [eax - 0xc], 2
jl 0x47149b
mov al, byte [eax + 2]
mov dl, byte [0x63cb72]
mov cx, word [0x63cb70]
mov byte [esp + 0x26], dl
mov byte [esp + 0x2a], al
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x9c]
push edx
mov word [esp + 0x28], cx
mov ecx, dword [eax]
push esi
push eax
mov eax, dword [ecx + 0x18]
call eax
test eax, eax
je 0x4719d5
lea ecx, [esp + 0x3c]
call fcn.00466380
mov byte [esp + 0x3d0], 0x16
mov ecx, dword [esp + 0xa3]
mov edx, dword [esp + 0xa7]
mov edi, dword [esp + 0xab]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0xaf]
cmp ecx, edx
jl 0x47190c
mov eax, dword [esp + 0x54]
jg 0x471910
cmp eax, edi
ja 0x471910
mov eax, edi
mov ecx, edx
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x50], ecx
mov ecx, dword [eax]
push esi
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov esi, eax
test esi, esi
je 0x471943
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ebx, esi
mov dword [esp + 0x5c], ebx
push ebx
lea ecx, [esp + 0x68]
call fcn.0041fed0
mov byte [esp + 0x3d0], 0x17
push eax
lea ecx, [esp + 0x50]
call fcn.00403020
mov byte [esp + 0x3d0], 0x16
lea ecx, [esp + 0x64]
call fcn.00401a50
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx + 0x1ac]
test eax, eax
jle 0x4719ad
add eax, 0xffffffff
js 0x471b20
cmp eax, dword [ecx + 0x1ac]
jge 0x471b20
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0x1a8]
lea eax, [eax + edx*8]
mov edx, dword [esp + 0x3c]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x40]
mov dword [eax + 0xc], edx
mov eax, dword [ecx + 0x1ac]
add ecx, 0x1a4
lea edx, [esp + 0x3c]
push edx
push eax
call fcn.0046cbe0
mov byte [esp + 0x3d0], 0x15
lea ecx, [esp + 0x4c]
call fcn.00401a50
mov byte [esp + 0x3d0], 0x14
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x20]
add eax, 1
cmp eax, dword [esp + 0x38]
mov dword [esp + 0x20], eax
jbe 0x471830
mov byte [esp + 0x3d0], 0x13
lea ecx, [esp + 0x2c]
call fcn.00401a50
mov byte [esp + 0x3d0], 0x12
mov eax, dword [esp + 0x10]
xor esi, esi
cmp eax, esi
je 0x471a24
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x471a3c
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x1c]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
je 0x471789
mov byte [esp + 0x3d0], 0x11
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x471a70
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x3d0], 0
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x471a88
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x2c], esi
mov byte [esp + 0x3d0], 0x1e
mov eax, dword [edi + 0xec]
cmp eax, esi
je 0x471d3e
mov ecx, dword [eax]
lea edx, [esp + 0x2c]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
test eax, eax
jl 0x471d3e
mov dword [esp + 0x18], esi
mov byte [esp + 0x3d0], 0x20
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x1c]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x471d26
nop
cmp dword [edi + 0x1ac], esi
jne 0x471d26
mov ecx, dword [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
call fcn.004655f0
mov byte [esp + 0x3d0], 0x21
mov eax, dword [esp + 0x10]
cmp eax, esi
jne 0x471b25
mov byte [esp + 0x3d0], 0x20
lea ecx, [esp + 0x10]
call fcn.00464de0
jmp 0x471cf6
call fcn.005bb967
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
mov edx, dword [eax]
mov edx, dword [edx + 0x20]
push ecx
push eax
call edx
test eax, eax
jl 0x471cde
mov ebx, 1
cmp dword [esp + 0x14], ebx
jl 0x471cde
lea ecx, [ecx]
mov eax, dword [esp + 0x10]
fldz
lea edx, [esp + 0x84]
fstp qword [esp + 0x84]
mov ecx, dword [eax]
push edx
push ebx
push eax
mov eax, dword [ecx + 0x28]
call eax
test eax, eax
jl 0x471cd1
lea ecx, [esp + 0x1c]
call fcn.004019e0
mov byte [esp + 0x3d0], 0x22
push ebx
lea ecx, [esp + 0x20]
push str.Chapter__d
push ecx
call fcn.004030a0
add esp, 0xc
mov dword [esp + 0x20], esi
mov byte [esp + 0x3d0], 0x23
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov edx, dword [edx + 0x2c]
lea ecx, [esp + 0x20]
push ecx
push ebx
push eax
call edx
test eax, eax
jne 0x471bed
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x3c]
call fcn.0041fed0
mov byte [esp + 0x3d0], 0x24
push eax
lea ecx, [esp + 0x20]
call fcn.00403020
mov byte [esp + 0x3d0], 0x23
lea ecx, [esp + 0x38]
call fcn.00401a50
lea ecx, [esp + 0x4c]
call fcn.004019e0
mov byte [esp + 0x3d0], 0x26
fld qword [esp + 0x84]
fmul qword [0x632b98]
call fcn.005dc8d6
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], edx
mov ecx, dword [esp + 0x58]
cmp ecx, edx
jl 0x471c32
mov esi, dword [esp + 0x54]
jg 0x471c2a
cmp esi, eax
jbe 0x471c30
mov eax, esi
xor esi, esi
jmp 0x471c34
xor esi, esi
mov ecx, edx
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x50]
mov dword [esp + 0x48], eax
call fcn.00403020
mov eax, dword [edi + 0x1ac]
cmp eax, esi
jle 0x471c85
add eax, 0xffffffff
cmp eax, esi
jl 0x471b20
cmp eax, dword [edi + 0x1ac]
jge 0x471b20
mov ecx, dword [esp + 0x3c]
lea edx, [eax + eax*2]
mov eax, dword [edi + 0x1a8]
lea eax, [eax + edx*8]
mov dword [eax + 8], ecx
mov edx, dword [esp + 0x40]
mov dword [eax + 0xc], edx
mov eax, dword [edi + 0x1ac]
lea ecx, [edi + 0x1a4]
lea edx, [esp + 0x3c]
push edx
push eax
call fcn.0046cbe0
mov byte [esp + 0x3d0], 0x23
lea ecx, [esp + 0x4c]
call fcn.00401a50
mov byte [esp + 0x3d0], 0x22
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [esp + 0x3d0], 0x21
lea ecx, [esp + 0x1c]
call fcn.00401a50
add ebx, 1
cmp ebx, dword [esp + 0x14]
jle 0x471b50
mov byte [esp + 0x3d0], 0x20
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x471cf6
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x471d0a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x1c]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
je 0x471ae0
mov byte [esp + 0x3d0], 0x1e
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x471d3e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x3d0], 0
mov eax, dword [esp + 0x2c]
cmp eax, esi
je 0x471d56
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x2c], esi
mov byte [esp + 0x3d0], 0x2d
mov eax, dword [edi + 0xec]
cmp eax, esi
je 0x472288
mov ecx, dword [eax]
lea edx, [esp + 0x2c]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
test eax, eax
jl 0x472288
mov dword [esp + 0x10], esi
mov byte [esp + 0x3d0], 0x2f
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x14]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x47226a
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [esp + 0x30]
cmp dword [ecx + 0x1ac], 0
jne 0x47226a
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0xa0]
push eax
call fcn.00497320
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x94], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x98], edx
mov edx, dword [eax + 0xc]
lea eax, [esp + 0x94]
push 0x63c19c
push eax
mov dword [esp + 0xa4], ecx
mov dword [esp + 0xa8], edx
call fcn.00401250
add esp, 0x10
test eax, eax
je 0x472235
mov dword [esp + 0x1c], 0
mov byte [esp + 0x3d0], 0x31
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47221d
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0x28]
call eax
test eax, eax
jl 0x47221d
mov dword [esp + 0x18], 0
mov byte [esp + 0x3d0], 0x33
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push 0
lea edx, [esp + 0x1c]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x472205
jmp 0x471e80
mov ecx, dword [esp + 0x18]
push ecx
lea ecx, [esp + 0x28]
call fcn.0041d9d0
mov byte [esp + 0x3d0], 0x34
cmp dword [esp + 0x24], 0
je 0x4721ab
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 1
call fcn.00419b70
mov byte [esp + 0x3d0], 0x35
lea edx, [esp + 0x6c]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x3d0], 0x36
lea eax, [esp + 0x6c]
push eax
call edi
push 1
lea ecx, [esp + 0x18]
push str.CHAPTER_02d
push ecx
call fcn.00469400
mov eax, dword [esp + 0x30]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
add esp, 0xc
push 0
lea ecx, [esp + 0x70]
push ecx
mov ecx, dword [esp + 0x1c]
push ecx
push eax
call edx
test eax, eax
jne 0x472163
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x3c]
call fcn.0046c9a0
mov byte [esp + 0x3d0], 0x38
mov eax, dword [eax]
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x88]
push ecx
push edx
lea ecx, [esp + 0x6c]
push ecx
push edx
lea ecx, [esp + 0x7c]
push ecx
push 0x63cb20
push eax
call fcn.005dedeb
add esp, 0x24
cmp eax, 7
setne bl
mov byte [esp + 0x3d0], 0x36
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x471f7a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jne 0x472174
lea ecx, [esp + 0x4c]
call fcn.004019e0
mov byte [esp + 0x3d0], 0x3c
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x5c]
mov ecx, eax
shl ecx, 4
sub ecx, eax
lea eax, [edx + ecx*4]
mov edx, dword [esp + 0x80]
mov ecx, eax
shl ecx, 4
sub ecx, eax
lea eax, [edx + ecx*4]
imul eax, eax, 0x3e8
add eax, dword [esp + 0x7c]
push 0
cdq
push 0x2710
push edx
push eax
call fcn.005d9dc0
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], edx
mov esi, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov ebx, esi
or ebx, ecx
je 0x471fe9
mov eax, esi
jmp 0x471feb
mov ecx, edx
mov dword [esp + 0x44], eax
lea eax, [esp + 0x6c]
push eax
mov dword [esp + 0x4c], ecx
call edi
push 4
push str.NAME
lea ecx, [esp + 0x1c]
call fcn.00444d80
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
push 0
lea edx, [esp + 0x70]
push edx
mov edx, dword [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x472034
lea ecx, [esp + 0x6c]
push ecx
lea ecx, [esp + 0x50]
call fcn.00469370
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx + 0x1ac]
test eax, eax
jle 0x472071
add eax, 0xffffffff
js 0x471b20
cmp eax, dword [ecx + 0x1ac]
jge 0x471b20
lea edx, [eax + eax*2]
mov eax, dword [ecx + 0x1a8]
lea eax, [eax + edx*8]
mov edx, dword [esp + 0x3c]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x40]
mov dword [eax + 0xc], edx
mov eax, dword [ecx + 0x1ac]
add ecx, 0x1a4
lea edx, [esp + 0x3c]
push edx
push eax
call fcn.0046cbe0
mov byte [esp + 0x3d0], 0x36
lea eax, [esp + 0x4c]
mov dword [esp + 0x84], eax
mov byte [esp + 0x3d0], 0x36
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4720c3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x3d0], 0x35
lea ecx, [esp + 0x6c]
push ecx
call edi
mov byte [esp + 0x3d0], 0x34
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4720fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x20]
add esi, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], esi
call fcn.00419b70
mov byte [esp + 0x3d0], 0x35
lea ecx, [esp + 0x6c]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x3d0], 0x36
lea edx, [esp + 0x6c]
push edx
call edi
push esi
lea eax, [esp + 0x18]
push str.CHAPTER_02d
push eax
call fcn.00469400
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
add esp, 0xc
push 0
lea edx, [esp + 0x70]
push edx
mov edx, dword [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
je 0x471f08
mov byte [esp + 0x3d0], 0x35
lea ecx, [esp + 0x6c]
push ecx
call edi
jmp 0x472183
mov byte [esp + 0x3d0], 0x35
lea ecx, [esp + 0x6c]
push ecx
call edi
mov byte [esp + 0x3d0], 0x34
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4721ab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x3d0], 0x33
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4721c3
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x30]
cmp dword [eax + 0x1ac], 0
jne 0x472205
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4721e8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push 0
lea edx, [esp + 0x1c]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
je 0x471e80
mov byte [esp + 0x3d0], 0x31
mov eax, dword [esp + 0x18]
test eax, eax
je 0x47221d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x3d0], 0x2f
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x472235
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47224d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
push 0
lea edx, [esp + 0x14]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
je 0x471db3
mov byte [esp + 0x3d0], 0x2d
mov eax, dword [esp + 0x10]
xor esi, esi
cmp eax, esi
je 0x472284
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov edi, dword [esp + 0x30]
mov byte [esp + 0x3d0], 0
mov eax, dword [esp + 0x2c]
cmp eax, esi
je 0x4722a0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x34], esi
mov byte [esp + 0x3d0], 0x48
mov dword [esp + 0x1c], esi
mov bl, 0x4a
mov byte [esp + 0x3d0], bl
mov eax, dword [edi + 0xec]
cmp eax, esi
je 0x472384
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
test eax, eax
jl 0x472384
mov dword [esp + 0x10], esi
mov byte [esp + 0x3d0], 0x4c
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x14]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x47236d
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x10]
cmp esi, eax
je 0x47233d
test eax, eax
mov dword [esp + 0x34], 0
je 0x47232d
mov ecx, dword [eax]
lea edx, [esp + 0x34]
push edx
push 0x63c5b4
push eax
mov eax, dword [ecx]
call eax
mov eax, dword [esp + 0x10]
test esi, esi
je 0x47233d
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [esp + 0x10]
xor esi, esi
cmp dword [esp + 0x34], esi
jne 0x47236d
cmp eax, esi
je 0x472355
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x14]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
je 0x472300
mov byte [esp + 0x3d0], bl
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x472384
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x3d0], 0x48
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x47239c
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x34]
cmp eax, esi
mov dword [esp + 0x68], esi
mov dword [esp + 0x60], esi
je 0x47240f
mov ecx, dword [eax]
lea edx, [esp + 0x68]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x47240f
mov eax, dword [esp + 0x68]
test eax, eax
jbe 0x47240f
push 0xffffffffffffffff
lea esi, [edi + 0x278]
push eax
mov ecx, esi
mov dword [esp + 0x68], eax
call fcn.00440420
mov eax, dword [edi + 0x27c]
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx]
lea ebx, [esp + 0x60]
push ebx
push eax
mov eax, dword [edx + 0x10]
push 0x63399c
push ecx
call eax
test eax, eax
jne 0x472404
mov ecx, dword [esp + 0x60]
cmp ecx, dword [esp + 0x68]
je 0x47240f
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.00440420
mov dword [edi + 0x22c], 1
mov byte [esp + 0x3d0], 0
mov eax, dword [esp + 0x34]
test eax, eax
je 0x472431
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esp + 0x3d0], 0xffffffff
lea ecx, [esp + 0xb4]
call fcn.00421750
mov ecx, dword [esp + 0x3c8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4