Function at 0x475490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x148]
cmp eax, dword [ecx + 8]
jbe 0x4775f2
sub esp, 0x1c8
mov dword [esp + 0x1f4], 0
mov dword [esp + 0x1f8], 0
mov dword [esp + 0x1fc], 0
mov dword [esp + 0x148], 0
mov dword [esp + 0x14c], 0
lea edi, [esp]
lea esi, [esp + 0x1cc]
call fcn.0045df9e
call fcn.00477d90
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x148], ecx
mov dword [esp + 0x14c], edx
mov dword [esp + 0xdc], eax
mov dword [esp + 0xec], ebp
mov dword [esp + 0xe8], ebx
mov eax, dword [esp + 0x148]
mov ecx, dword [esp + 0x14c]
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], ecx
mov eax, dword [esp + 0xdc]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0xe8]
mov ecx, dword [esp + 0xec]
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe4], ecx
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x50], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x60], 0xffffffff
mov dword [esp + 0x54], 0
mov dword [esp + 0x48], 0
jmp 0x4755b2
mov eax, dword [esp + 0x1f0]
test eax, eax
jne 0x4755c2
jmp 0x4775aa
mov dword [esp + 0x148], 0
mov dword [esp + 0x14c], 0
mov dword [esp + 0x140], 0
mov dword [esp + 0x144], 0
mov eax, dword [esp + 0x1ec]
mov ecx, dword [esp + 0x1f0]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00471df0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x148], ecx
mov dword [esp + 0x14c], edx
mov dword [esp + 0xdc], eax
mov dword [esp + 0x140], ebx
mov dword [esp + 0x144], ebp
mov eax, dword [esp + 0x14c]
mov ecx, dword [esp + 0x148]
mov dword [esp + 0x128], ecx
mov dword [esp + 0x12c], eax
mov eax, dword [esp + 0xdc]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x144]
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], ecx
mov eax, dword [esp + 0x12c]
test eax, eax
jne 0x475692
jmp 0x4757aa
mov eax, dword [esp + 0x1e4]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e8]
mov dword [esp + 0x1bc], ecx
mov dword [esp + 0x1c0], eax
mov dword [esp + 0x1c4], edx
mov ecx, dword [esp + 0x12c]
add eax, ecx
mov dword [esp + 0xc8], eax
cmp dword [esp + 0x1c4], eax
jb 0x4756d7
jmp 0x47572d
mov ecx, dword [esp + 0x1bc]
mov edx, dword [esp + 0x1c0]
mov ebx, dword [esp + 0x1c4]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1bc], eax
mov dword [esp + 0x1c0], ecx
mov dword [esp + 0x1c4], edx
jmp 0x47572f
jmp 0x47572f
mov eax, dword [esp + 0xc8]
mov dword [esp + 0x1c0], eax
mov eax, dword [esp + 0x12c]
mov dword [esp + 0xc4], eax
mov eax, dword [esp + 0x1bc]
add eax, dword [esp + 0x1e4]
mov dword [esp + 0x114], eax
mov ecx, dword [esp + 0xc4]
mov edx, dword [esp + 0x128]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.0045e1c0
mov eax, dword [esp + 0x1bc]
mov ecx, dword [esp + 0x1c0]
mov edx, dword [esp + 0x1c4]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4757ac
jmp 0x4757ac
mov ecx, dword [esp + 0x44]
test ecx, ecx
je 0x4757b6
jmp 0x4757bb
jmp 0x4775ac
mov ecx, dword [esp + 0x118]
mov edx, dword [esp + 0x11c]
mov dword [esp + 0x1ec], ecx
mov dword [esp + 0x1f0], edx
mov ecx, dword [esp + 0x38]
test ecx, ecx
setl cl
mov byte [esp + 0x2f], cl
jl 0x4757e8
jmp 0x4757fb
mov ecx, dword [esp + 0x44]
test ecx, 0x100
setne cl
mov byte [esp + 0x2f], cl
jmp 0x4757fd
jmp 0x4757fd
movzx ecx, byte [esp + 0x2f]
test cl, cl
jne 0x47580b
jmp 0x47588d
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xe4]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov byte [esp + 8], 1
call fcn.00478500
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0xdc], eax
mov dword [esp + 0xd8], ecx
mov dword [esp + 0xd4], edx
mov dword [esp + 0xd0], ebx
mov eax, dword [esp + 0xdc]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0xd8]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0xd0]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
inc eax
mov dword [esp + 0x3c], eax
jmp 0x47588f
jmp 0x47588f
mov ecx, dword [esp + 0x60]
test ecx, ecx
setl cl
mov byte [esp + 0x2f], cl
jl 0x4758a0
jmp 0x4758b3
mov ecx, dword [esp + 0x44]
test ecx, 0x200
setne cl
mov byte [esp + 0x2f], cl
jmp 0x4758b5
jmp 0x4758b5
movzx ecx, byte [esp + 0x2f]
test cl, cl
jne 0x4758c0
jmp 0x47591e
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xe4]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00478130
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp + 0xdc], eax
mov dword [esp + 0xd0], ecx
mov dword [esp + 0xd4], edx
mov eax, dword [esp + 0xdc]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0xd0]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x48], eax
jmp 0x475920
jmp 0x475920
mov ecx, dword [esp + 0x44]
and ecx, 0xffff
mov dword [esp + 0xc0], ecx
cmp ecx, 0x109
jle 0x47593e
jmp 0x476b44
cmp ecx, 0x103
jle 0x47594b
jmp 0x47660c
cmp ecx, 0x23
jle 0x475955
jmp 0x4762e4
cmp ecx, 0x17
je 0x47595f
jmp 0x475c71
jmp 0x475961
mov ecx, dword [esp + 0x134]
test ecx, ecx
jne 0x475971
jmp 0x475a80
mov eax, dword [esp + 0x1e4]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e8]
mov dword [esp + 0x150], ecx
mov dword [esp + 0x154], eax
mov dword [esp + 0x158], edx
mov ecx, dword [esp + 0x134]
add eax, ecx
mov dword [esp + 0x7c], eax
cmp dword [esp + 0x158], eax
jb 0x4759b3
jmp 0x475a09
mov ecx, dword [esp + 0x150]
mov edx, dword [esp + 0x154]
mov ebx, dword [esp + 0x158]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], ecx
mov dword [esp + 0x158], edx
jmp 0x475a0b
jmp 0x475a0b
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x154], eax
mov eax, dword [esp + 0x134]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x150]
add eax, dword [esp + 0x1e4]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x130]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.0045e1c0
mov eax, dword [esp + 0x150]
mov ecx, dword [esp + 0x154]
mov edx, dword [esp + 0x158]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
mov ecx, dword [esp + 0x4c]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
sar ecx, 0x1f
sub edx, ecx
mov dword [esp + 0x34], edx
test edx, edx
jl 0x475a9f
jmp 0x475b1c
mov ecx, dword [esp + 0x1e4]
lea edx, [ecx + 1]
mov ebx, dword [esp + 0x1e8]
mov ebp, dword [esp + 0x1e0]
cmp ebx, edx
jae 0x475abd
jmp 0x475abf
jmp 0x475af6
mov dword [esp + 0x6c], ecx
lea eax, [0x4a7ea0]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
call fcn.00448330
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
lea edx, [eax + 1]
mov ecx, dword [esp + 0x6c]
jmp 0x475af6
add ecx, ebp
mov byte [ecx], 0x2d
mov dword [esp + 0x1e0], ebp
mov dword [esp + 0x1e4], edx
mov dword [esp + 0x1e8], ebx
mov ecx, dword [esp + 0x34]
neg ecx
mov dword [esp + 0x34], ecx
jmp 0x475b8f
mov ecx, dword [esp + 0x1e4]
lea edx, [ecx + 1]
mov ebx, dword [esp + 0x1e8]
mov ebp, dword [esp + 0x1e0]
cmp ebx, edx
jae 0x475b3a
jmp 0x475b3c
jmp 0x475b73
mov dword [esp + 0x6c], ecx
lea eax, [0x4a7ea0]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
call fcn.00448330
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
lea edx, [eax + 1]
mov ecx, dword [esp + 0x6c]
jmp 0x475b73
add ecx, ebp
mov byte [ecx], 0x2b
mov dword [esp + 0x1e0], ebp
mov dword [esp + 0x1e4], edx
mov dword [esp + 0x1e8], ebx
jmp 0x475b8f
mov ecx, dword [esp + 0x34]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
sar ecx, 0x1f
sub edx, ecx
mov dword [esp + 0x74], edx
mov ecx, dword [esp + 0x1e0]
mov ebx, dword [esp + 0x1e4]
mov ebp, dword [esp + 0x1e8]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 2
call fcn.00474730
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], ecx
mov dword [esp + 0x1e4], edx
mov dword [esp + 0x1e8], ebx
mov ecx, dword [esp + 0x34]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov ebx, ecx
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x3c
sub ebx, ecx
mov dword [esp + 0x70], ebx
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e4]
mov ebp, dword [esp + 0x1e8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 2
call fcn.00474730
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], ecx
mov dword [esp + 0x1e4], edx
mov dword [esp + 0x1e8], ebx
jmp 0x4775a3
cmp ecx, 0x18
jge 0x475c7b
jmp 0x47624c
cmp ecx, 0x21
jle 0x475c85
jmp 0x47624a
jmp 0x475c87
mov ecx, dword [esp + 0x4c]
test ecx, ecx
sete cl
mov byte [esp + 0x2f], cl
je 0x475c9b
jmp 0x475d23
cmp dword [esp + 0x44], 0x18
sete cl
mov byte [esp + 0x2b], cl
je 0x475cab
jmp 0x475cad
jmp 0x475cbb
cmp dword [esp + 0x44], 0x1b
sete cl
mov byte [esp + 0x2b], cl
jmp 0x475cbb
movzx ecx, byte [esp + 0x2b]
mov byte [esp + 0x2c], cl
test cl, cl
jne 0x475cca
jmp 0x475ccc
jmp 0x475cda
cmp dword [esp + 0x44], 0x19
sete cl
mov byte [esp + 0x2c], cl
jmp 0x475cda
movzx ecx, byte [esp + 0x2c]
mov byte [esp + 0x2d], cl
test cl, cl
jne 0x475ce9
jmp 0x475ceb
jmp 0x475cf9
cmp dword [esp + 0x44], 0x1a
sete cl
mov byte [esp + 0x2d], cl
jmp 0x475cf9
movzx ecx, byte [esp + 0x2d]
mov byte [esp + 0x2e], cl
test cl, cl
jne 0x475d08
jmp 0x475d0a
jmp 0x475d18
cmp dword [esp + 0x44], 0x1c
sete cl
mov byte [esp + 0x2e], cl
jmp 0x475d18
movzx ecx, byte [esp + 0x2e]
mov byte [esp + 0x2f], cl
jmp 0x475d25
jmp 0x475d25
movzx ecx, byte [esp + 0x2f]
test cl, cl
jne 0x475d30
jmp 0x475da6
mov eax, dword [esp + 0x1e4]
lea ecx, [eax + 1]
mov edx, dword [esp + 0x1e8]
mov ebx, dword [esp + 0x1e0]
cmp edx, ecx
jae 0x475d4e
jmp 0x475d50
jmp 0x475d87
mov dword [esp + 0x6c], eax
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
call fcn.00448330
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea ecx, [eax + 1]
mov eax, dword [esp + 0x6c]
jmp 0x475d87
add eax, ebx
mov byte [eax], 0x5a
mov dword [esp + 0x1e0], ebx
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
jmp 0x475da8
mov ecx, dword [esp + 0x4c]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
sar ecx, 0x1f
sub edx, ecx
mov dword [esp + 0x30], edx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x68], ecx
mov ecx, dword [esp + 0x30]
test ecx, ecx
jl 0x475dd6
jmp 0x475e5d
mov ecx, dword [esp + 0x1e4]
lea edx, [ecx + 1]
mov ebx, dword [esp + 0x1e8]
mov ebp, dword [esp + 0x1e0]
cmp ebx, edx
jae 0x475df4
jmp 0x475df6
jmp 0x475e2d
mov dword [esp + 0x6c], ecx
lea eax, [0x4a7ea0]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
call fcn.00448330
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
lea edx, [eax + 1]
mov ecx, dword [esp + 0x6c]
jmp 0x475e2d
add ecx, ebp
mov byte [ecx], 0x2d
mov dword [esp + 0x1e0], ebp
mov dword [esp + 0x1e4], edx
mov dword [esp + 0x1e8], ebx
mov ecx, dword [esp + 0x30]
neg ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x68]
neg ecx
mov dword [esp + 0x68], ecx
jmp 0x475ed0
mov ecx, dword [esp + 0x1e4]
lea edx, [ecx + 1]
mov ebx, dword [esp + 0x1e8]
mov ebp, dword [esp + 0x1e0]
cmp ebx, edx
jae 0x475e7b
jmp 0x475e7d
jmp 0x475eb4
mov dword [esp + 0x6c], ecx
lea eax, [0x4a7ea0]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
call fcn.00448330
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
lea edx, [eax + 1]
mov ecx, dword [esp + 0x6c]
jmp 0x475eb4
add ecx, ebp
mov byte [ecx], 0x2b
mov dword [esp + 0x1e0], ebp
mov dword [esp + 0x1e4], edx
mov dword [esp + 0x1e8], ebx
jmp 0x475ed0
mov ecx, dword [esp + 0x30]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
sar ecx, 0x1f
sub edx, ecx
mov dword [esp + 0x88], edx
mov ecx, dword [esp + 0x1e0]
mov ebx, dword [esp + 0x1e4]
mov ebp, dword [esp + 0x1e8]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 2
call fcn.00474730
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], ecx
mov dword [esp + 0x1e4], edx
mov dword [esp + 0x1e8], ebx
cmp dword [esp + 0x44], 0x1b
sete cl
mov byte [esp + 0x2b], cl
je 0x475f4e
jmp 0x475f50
jmp 0x475f5e
cmp dword [esp + 0x44], 0x20
sete cl
mov byte [esp + 0x2b], cl
jmp 0x475f5e
movzx ecx, byte [esp + 0x2b]
mov byte [esp + 0x2f], cl
test cl, cl
jne 0x475f6d
jmp 0x475f6f
jmp 0x475f7d
cmp dword [esp + 0x44], 0x1c
sete cl
mov byte [esp + 0x2f], cl
jmp 0x475f7d
movzx ecx, byte [esp + 0x2f]
mov byte [esp + 0x2e], cl
test cl, cl
jne 0x475f8c
jmp 0x475f8e
jmp 0x475f9c
cmp dword [esp + 0x44], 0x21
sete cl
mov byte [esp + 0x2e], cl
jmp 0x475f9c
movzx ecx, byte [esp + 0x2e]
test cl, cl
jne 0x475fa7
jmp 0x47601a
mov ecx, dword [esp + 0x1e4]
lea edx, [ecx + 1]
mov ebx, dword [esp + 0x1e8]
mov ebp, dword [esp + 0x1e0]
cmp ebx, edx
jae 0x475fc5
jmp 0x475fc7
jmp 0x475ffe
mov dword [esp + 0x6c], ecx
lea eax, [0x4a7ea0]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
call fcn.00448330
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
lea edx, [eax + 1]
mov ecx, dword [esp + 0x6c]
jmp 0x475ffe
add ecx, ebp
mov byte [ecx], 0x3a
mov dword [esp + 0x1e0], ebp
mov dword [esp + 0x1e4], edx
mov dword [esp + 0x1e8], ebx
jmp 0x47601c
jmp 0x47601c
cmp dword [esp + 0x44], 0x1f
setne cl
mov byte [esp + 0x2c], cl
jne 0x47602c
jmp 0x47603a
cmp dword [esp + 0x44], 0x1a
setne cl
mov byte [esp + 0x2c], cl
jmp 0x47603c
jmp 0x47603c
movzx ecx, byte [esp + 0x2c]
test cl, cl
jne 0x476047
jmp 0x4760be
mov ecx, dword [esp + 0x30]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov ebx, ecx
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x3c
sub ebx, ecx
mov dword [esp + 0x84], ebx
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e4]
mov ebp, dword [esp + 0x1e8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 2
call fcn.00474730
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], ecx
mov dword [esp + 0x1e4], edx
mov dword [esp + 0x1e8], ebx
jmp 0x4760c0
jmp 0x4760c0
cmp dword [esp + 0x44], 0x19
sete cl
mov byte [esp + 0x2f], cl
je 0x4760d0
jmp 0x4760d2
jmp 0x4760e0
cmp dword [esp + 0x44], 0x1e
sete cl
mov byte [esp + 0x2f], cl
jmp 0x4760e0
movzx ecx, byte [esp + 0x2f]
mov byte [esp + 0x2c], cl
test cl, cl
jne 0x4760ef
jmp 0x4760f1
jmp 0x4760ff
cmp dword [esp + 0x44], 0x21
sete cl
mov byte [esp + 0x2c], cl
jmp 0x4760ff
movzx ecx, byte [esp + 0x2c]
mov byte [esp + 0x2b], cl
test cl, cl
jne 0x47610e
jmp 0x476110
jmp 0x47611e
cmp dword [esp + 0x44], 0x1c
sete cl
mov byte [esp + 0x2b], cl
jmp 0x47611e
movzx ecx, byte [esp + 0x2b]
test cl, cl
jne 0x47612c
jmp 0x476243
cmp dword [esp + 0x44], 0x21
sete cl
mov byte [esp + 0x2e], cl
je 0x47613c
jmp 0x47613e
jmp 0x47614c
cmp dword [esp + 0x44], 0x1c
sete cl
mov byte [esp + 0x2e], cl
jmp 0x47614c
movzx ecx, byte [esp + 0x2e]
test cl, cl
jne 0x476157
jmp 0x4761ca
mov ecx, dword [esp + 0x1e4]
lea edx, [ecx + 1]
mov ebx, dword [esp + 0x1e8]
mov ebp, dword [esp + 0x1e0]
cmp ebx, edx
jae 0x476175
jmp 0x476177
jmp 0x4761ae
mov dword [esp + 0x6c], ecx
lea eax, [0x4a7ea0]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
call fcn.00448330
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
lea edx, [eax + 1]
mov ecx, dword [esp + 0x6c]
jmp 0x4761ae
add ecx, ebp
mov byte [ecx], 0x3a
mov dword [esp + 0x1e0], ebp
mov dword [esp + 0x1e4], edx
mov dword [esp + 0x1e8], ebx
jmp 0x4761cc
jmp 0x4761cc
mov ecx, dword [esp + 0x68]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov ebx, ecx
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x3c
sub ebx, ecx
mov dword [esp + 0x80], ebx
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e4]
mov ebp, dword [esp + 0x1e8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 2
call fcn.00474730
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], ecx
mov dword [esp + 0x1e4], edx
mov dword [esp + 0x1e8], ebx
jmp 0x476245
jmp 0x476245
jmp 0x4775a3
jmp 0x47624e
jmp 0x47624e
cmp ecx, 0x22
jge 0x476258
jmp 0x4762d9
cmp ecx, 0x23
jle 0x47625f
jmp 0x4762d7
jmp 0x476261
lea edi, [esp]
lea esi, [esp + 0x1cc]
call fcn.0045df9e
call fcn.004781f0
mov eax, dword [esp + 0x14]
mov dword [esp + 0xdc], eax
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x1e0]
mov ebx, dword [esp + 0x1e4]
mov ebp, dword [esp + 0x1e8]
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.00474b40
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
jmp 0x4762db
jmp 0x4762db
jmp 0x4762dd
jmp 0x4762df
jmp 0x476607
cmp ecx, 0x101
je 0x4762f1
jmp 0x476430
jmp 0x4762f3
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call fcn.004778c0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], ecx
mov eax, dword [esp + 0x1e4]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e8]
mov dword [esp + 0x1a4], ecx
mov dword [esp + 0x1a8], eax
mov dword [esp + 0x1ac], edx
mov ecx, dword [esp + 0x13c]
add eax, ecx
mov dword [esp + 0xb0], eax
cmp dword [esp + 0x1ac], eax
jb 0x47635a
jmp 0x4763b0
mov ecx, dword [esp + 0x1a4]
mov edx, dword [esp + 0x1a8]
mov ebx, dword [esp + 0x1ac]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1a4], eax
mov dword [esp + 0x1a8], ecx
mov dword [esp + 0x1ac], edx
jmp 0x4763b2
jmp 0x4763b2
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x1a8], eax
mov eax, dword [esp + 0x13c]
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0x1a4]
add eax, dword [esp + 0x1e4]
mov dword [esp + 0x10c], eax
mov ecx, dword [esp + 0xac]
mov edx, dword [esp + 0x138]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.0045e1c0
mov eax, dword [esp + 0x1a4]
mov ecx, dword [esp + 0x1a8]
mov edx, dword [esp + 0x1ac]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
cmp ecx, 0x102
je 0x47643d
jmp 0x47659a
jmp 0x47643f
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call fcn.004778c0
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
mov dword [esp + 0x148], eax
mov dword [esp + 0x14c], edx
cmp edx, 3
jae 0x47646b
jmp 0x4775e7
jmp 0x47646d
mov dword [esp + 0x140], eax
mov dword [esp + 0x144], 3
mov eax, dword [esp + 0x1e4]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e8]
mov dword [esp + 0x1b0], ecx
mov dword [esp + 0x1b4], eax
mov dword [esp + 0x1b8], edx
mov ecx, dword [esp + 0x144]
add eax, ecx
mov dword [esp + 0xb8], eax
cmp dword [esp + 0x1b8], eax
jb 0x4764c4
jmp 0x47651a
mov ecx, dword [esp + 0x1b0]
mov edx, dword [esp + 0x1b4]
mov ebx, dword [esp + 0x1b8]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1b0], eax
mov dword [esp + 0x1b4], ecx
mov dword [esp + 0x1b8], edx
jmp 0x47651c
jmp 0x47651c
mov eax, dword [esp + 0xb8]
mov dword [esp + 0x1b4], eax
mov eax, dword [esp + 0x144]
mov dword [esp + 0xb4], eax
mov eax, dword [esp + 0x1b0]
add eax, dword [esp + 0x1e4]
mov dword [esp + 0x110], eax
mov ecx, dword [esp + 0xb4]
mov edx, dword [esp + 0x140]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.0045e1c0
mov eax, dword [esp + 0x1b0]
mov ecx, dword [esp + 0x1b4]
mov edx, dword [esp + 0x1b8]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
cmp ecx, 0x103
je 0x4765a4
jmp 0x476601
jmp 0x4765a6
mov eax, dword [esp + 0x1e0]
mov ecx, dword [esp + 0x1e4]
mov edx, dword [esp + 0x1e8]
mov ebx, dword [esp + 0x50]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0
call fcn.00474730
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
jmp 0x476603
jmp 0x476605
jmp 0x476607
jmp 0x476b3f
cmp ecx, 0x106
jle 0x476619
jmp 0x476981
cmp ecx, 0x104
je 0x476623
jmp 0x476680
jmp 0x476625
mov eax, dword [esp + 0x1e0]
mov ecx, dword [esp + 0x1e4]
mov edx, dword [esp + 0x1e8]
mov ebx, dword [esp + 0x50]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 2
call fcn.00474730
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
cmp ecx, 0x105
je 0x47668d
jmp 0x4767ed
jmp 0x47668f
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xe4]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.004780b0
mov eax, dword [esp + 8]
mov dword [esp + 0xcc], eax
mov dword [esp], eax
call fcn.00477a30
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], ecx
mov eax, dword [esp + 0x1e4]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e8]
mov dword [esp + 0x18c], ecx
mov dword [esp + 0x190], eax
mov dword [esp + 0x194], edx
mov ecx, dword [esp + 0x124]
add eax, ecx
mov dword [esp + 0xa0], eax
cmp dword [esp + 0x194], eax
jb 0x476717
jmp 0x47676d
mov ecx, dword [esp + 0x18c]
mov edx, dword [esp + 0x190]
mov ebx, dword [esp + 0x194]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x18c], eax
mov dword [esp + 0x190], ecx
mov dword [esp + 0x194], edx
jmp 0x47676f
jmp 0x47676f
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0x124]
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x18c]
add eax, dword [esp + 0x1e4]
mov dword [esp + 0x104], eax
mov ecx, dword [esp + 0x9c]
mov edx, dword [esp + 0x120]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.0045e1c0
mov eax, dword [esp + 0x18c]
mov ecx, dword [esp + 0x190]
mov edx, dword [esp + 0x194]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
cmp ecx, 0x106
je 0x4767fa
jmp 0x476978
jmp 0x4767fc
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xe4]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.004780b0
mov eax, dword [esp + 8]
mov dword [esp + 0xcc], eax
mov dword [esp], eax
call fcn.00477a30
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
mov dword [esp + 0x148], eax
mov dword [esp + 0x14c], edx
cmp edx, 3
jae 0x476849
jmp 0x4775dd
jmp 0x47684b
mov dword [esp + 0x140], eax
mov dword [esp + 0x144], 3
mov eax, dword [esp + 0x1e4]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e8]
mov dword [esp + 0x198], ecx
mov dword [esp + 0x19c], eax
mov dword [esp + 0x1a0], edx
mov ecx, dword [esp + 0x144]
add eax, ecx
mov dword [esp + 0xa8], eax
cmp dword [esp + 0x1a0], eax
jb 0x4768a2
jmp 0x4768f8
mov ecx, dword [esp + 0x198]
mov edx, dword [esp + 0x19c]
mov ebx, dword [esp + 0x1a0]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x198], eax
mov dword [esp + 0x19c], ecx
mov dword [esp + 0x1a0], edx
jmp 0x4768fa
jmp 0x4768fa
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x19c], eax
mov eax, dword [esp + 0x144]
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x198]
add eax, dword [esp + 0x1e4]
mov dword [esp + 0x108], eax
mov ecx, dword [esp + 0xa4]
mov edx, dword [esp + 0x140]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.0045e1c0
mov eax, dword [esp + 0x198]
mov ecx, dword [esp + 0x19c]
mov edx, dword [esp + 0x1a0]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
jmp 0x47697a
jmp 0x47697c
jmp 0x476b3d
cmp ecx, 0x107
je 0x47698b
jmp 0x4769e8
jmp 0x47698d
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e4]
mov ebx, dword [esp + 0x1e8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.00474730
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
cmp ecx, 0x108
je 0x4769f5
jmp 0x476ad0
jmp 0x4769f7
cmp dword [esp + 0x64], 0xa
jl 0x476a00
jmp 0x476a73
mov eax, dword [esp + 0x1e4]
lea ecx, [eax + 1]
mov edx, dword [esp + 0x1e8]
mov ebx, dword [esp + 0x1e0]
cmp edx, ecx
jae 0x476a1e
jmp 0x476a20
jmp 0x476a57
mov dword [esp + 0x6c], eax
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
call fcn.00448330
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea ecx, [eax + 1]
mov eax, dword [esp + 0x6c]
jmp 0x476a57
add eax, ebx
mov byte [eax], 0x20
mov dword [esp + 0x1e0], ebx
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x476a75
jmp 0x476a75
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e4]
mov ebx, dword [esp + 0x1e8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.00474730
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
cmp ecx, 0x109
je 0x476ada
jmp 0x476b37
jmp 0x476adc
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e4]
mov ebx, dword [esp + 0x1e8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 2
call fcn.00474730
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
jmp 0x476b39
jmp 0x476b3b
jmp 0x476b3d
jmp 0x476b3f
jmp 0x4775a1
cmp ecx, 0x20d
jle 0x476b51
jmp 0x476f37
cmp ecx, 0x113
jle 0x476b5e
jmp 0x476d87
cmp ecx, 0x10a
je 0x476b6b
jmp 0x476cb0
jmp 0x476b6d
cmp dword [esp + 0x3c], 0x64
jl 0x476b79
jmp 0x476c53
mov eax, dword [esp + 0x1e4]
lea ecx, [eax + 1]
mov edx, dword [esp + 0x1e8]
mov ebx, dword [esp + 0x1e0]
cmp edx, ecx
jae 0x476b97
jmp 0x476b99
jmp 0x476bd0
mov dword [esp + 0x6c], eax
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
call fcn.00448330
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea ecx, [eax + 1]
mov eax, dword [esp + 0x6c]
jmp 0x476bd0
add eax, ebx
mov byte [eax], 0x20
mov dword [esp + 0x1e0], ebx
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
cmp dword [esp + 0x3c], 0xa
jl 0x476bf3
jmp 0x476c4f
lea eax, [ecx + 1]
cmp edx, eax
jae 0x476bfc
jmp 0x476bfe
jmp 0x476c33
mov dword [esp + 0x6c], ecx
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
call fcn.00448330
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
inc eax
mov ecx, dword [esp + 0x6c]
jmp 0x476c33
add ecx, ebx
mov byte [ecx], 0x20
mov dword [esp + 0x1e0], ebx
mov dword [esp + 0x1e4], eax
mov dword [esp + 0x1e8], edx
jmp 0x476c51
jmp 0x476c51
jmp 0x476c55
jmp 0x476c55
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e4]
mov ebx, dword [esp + 0x1e8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.00474730
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
cmp ecx, 0x10b
je 0x476cba
jmp 0x476d17
jmp 0x476cbc
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e4]
mov ebx, dword [esp + 0x1e8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 3
call fcn.00474730
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
cmp ecx, 0x113
je 0x476d21
jmp 0x476d7e
jmp 0x476d23
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e4]
mov ebx, dword [esp + 0x1e8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 4
call fcn.00474730
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
jmp 0x476d80
jmp 0x476d82
jmp 0x476f32
cmp ecx, 0x114
je 0x476d94
jmp 0x476e26
jmp 0x476d96
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x40], ecx
test ecx, ecx
jl 0x476da4
jmp 0x476dac
neg ecx
mov dword [esp + 0x40], ecx
jmp 0x476dae
jmp 0x476dae
mov ecx, dword [esp + 0x40]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov ebx, ecx
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x64
sub ebx, ecx
mov dword [esp + 0xbc], ebx
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e4]
mov ebp, dword [esp + 0x1e8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 2
call fcn.00474730
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], ecx
mov dword [esp + 0x1e4], edx
mov dword [esp + 0x1e8], ebx
jmp 0x4775a3
cmp ecx, 0x20c
je 0x476e30
jmp 0x476e8d
jmp 0x476e32
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e4]
mov ebx, dword [esp + 0x1e8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 2
call fcn.00474730
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
cmp ecx, 0x20d
je 0x476e9a
jmp 0x476f2c
jmp 0x476e9c
mov ecx, dword [esp + 0x60]
mov eax, 0xaaaaaaab
imul ecx
add edx, ecx
sar edx, 3
mov ebx, ecx
sar ecx, 0x1f
sub edx, ecx
lea ecx, [edx + edx*2]
shl ecx, 2
sub ebx, ecx
mov dword [esp + 0x58], ebx
test ebx, ebx
je 0x476ec5
jmp 0x476ecf
mov dword [esp + 0x58], 0xc
jmp 0x476ed1
jmp 0x476ed1
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e4]
mov ebx, dword [esp + 0x1e8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.00474730
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
jmp 0x476f2e
jmp 0x476f30
jmp 0x476f32
jmp 0x47759f
cmp ecx, 0x210
jle 0x476f44
jmp 0x4770ba
cmp ecx, 0x20e
je 0x476f51
jmp 0x476fe3
jmp 0x476f53
mov ecx, dword [esp + 0x60]
mov eax, 0xaaaaaaab
imul ecx
add edx, ecx
sar edx, 3
mov ebx, ecx
sar ecx, 0x1f
sub edx, ecx
lea ecx, [edx + edx*2]
shl ecx, 2
sub ebx, ecx
mov dword [esp + 0x5c], ebx
test ebx, ebx
je 0x476f7c
jmp 0x476f86
mov dword [esp + 0x5c], 0xc
jmp 0x476f88
jmp 0x476f88
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e4]
mov ebx, dword [esp + 0x1e8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 2
call fcn.00474730
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
cmp ecx, 0x20f
je 0x476fed
jmp 0x47704a
jmp 0x476fef
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e4]
mov ebx, dword [esp + 0x1e8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.00474730
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
cmp ecx, 0x210
je 0x477054
jmp 0x4770b1
jmp 0x477056
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e4]
mov ebx, dword [esp + 0x1e8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 2
call fcn.00474730
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
jmp 0x4770b3
jmp 0x4770b5
jmp 0x47759d
cmp ecx, 0x212
jle 0x4770c7
jmp 0x47719c
cmp ecx, 0x211
je 0x4770d1
jmp 0x47712e
jmp 0x4770d3
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e4]
mov ebx, dword [esp + 0x1e8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call fcn.00474730
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
cmp ecx, 0x212
je 0x477138
jmp 0x477195
jmp 0x47713a
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e4]
mov ebx, dword [esp + 0x1e8]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 2
call fcn.00474730
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x4775a3
jmp 0x477197
jmp 0x47759b
cmp ecx, 0x215
je 0x4771a9
jmp 0x47739b
jmp 0x4771ab
cmp dword [esp + 0x60], 0xc
jge 0x4771b7
jmp 0x4772a8
mov eax, dword [esp + 0x1e4]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e8]
mov dword [esp + 0x180], ecx
mov dword [esp + 0x184], eax
mov dword [esp + 0x188], edx
add eax, 2
mov dword [esp + 0x98], eax
lea ecx, [esp + 0x180]
cmp dword [ecx + 8], eax
jb 0x4771f9
jmp 0x47724f
mov ecx, dword [esp + 0x180]
mov edx, dword [esp + 0x184]
mov ebx, dword [esp + 0x188]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x180], eax
mov dword [esp + 0x184], ecx
mov dword [esp + 0x188], edx
jmp 0x477251
jmp 0x477251
mov eax, dword [esp + 0x98]
mov dword [esp + 0x184], eax
mov eax, dword [esp + 0x180]
add eax, dword [esp + 0x1e4]
mov dword [esp + 0x100], eax
mov word [eax], 0x4d50
mov eax, dword [esp + 0x180]
mov ecx, dword [esp + 0x184]
mov edx, dword [esp + 0x188]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x477396
mov eax, dword [esp + 0x1e4]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e8]
mov dword [esp + 0x174], ecx
mov dword [esp + 0x178], eax
mov dword [esp + 0x17c], edx
add eax, 2
mov dword [esp + 0x94], eax
lea ecx, [esp + 0x174]
cmp dword [ecx + 8], eax
jb 0x4772ea
jmp 0x477340
mov ecx, dword [esp + 0x174]
mov edx, dword [esp + 0x178]
mov ebx, dword [esp + 0x17c]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], ecx
mov dword [esp + 0x17c], edx
jmp 0x477342
jmp 0x477342
mov eax, dword [esp + 0x94]
mov dword [esp + 0x178], eax
mov eax, dword [esp + 0x174]
add eax, dword [esp + 0x1e4]
mov dword [esp + 0xfc], eax
mov word [eax], 0x4d41
mov eax, dword [esp + 0x174]
mov ecx, dword [esp + 0x178]
mov edx, dword [esp + 0x17c]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x477396
jmp 0x4775a3
cmp ecx, 0x216
je 0x4773a8
jmp 0x477597
jmp 0x4773aa
cmp dword [esp + 0x60], 0xc
jge 0x4773b6
jmp 0x4774a7
mov eax, dword [esp + 0x1e4]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e8]
mov dword [esp + 0x168], ecx
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], edx
add eax, 2
mov dword [esp + 0x90], eax
lea ecx, [esp + 0x168]
cmp dword [ecx + 8], eax
jb 0x4773f8
jmp 0x47744e
mov ecx, dword [esp + 0x168]
mov edx, dword [esp + 0x16c]
mov ebx, dword [esp + 0x170]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], ecx
mov dword [esp + 0x170], edx
jmp 0x477450
jmp 0x477450
mov eax, dword [esp + 0x90]
mov dword [esp + 0x16c], eax
mov eax, dword [esp + 0x168]
add eax, dword [esp + 0x1e4]
mov dword [esp + 0xf8], eax
mov word [eax], 0x6d70
mov eax, dword [esp + 0x168]
mov ecx, dword [esp + 0x16c]
mov edx, dword [esp + 0x170]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x477595
mov eax, dword [esp + 0x1e4]
mov ecx, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e8]
mov dword [esp + 0x15c], ecx
mov dword [esp + 0x160], eax
mov dword [esp + 0x164], edx
add eax, 2
mov dword [esp + 0x8c], eax
lea ecx, [esp + 0x15c]
cmp dword [ecx + 8], eax
jb 0x4774e9
jmp 0x47753f
mov ecx, dword [esp + 0x15c]
mov edx, dword [esp + 0x160]
mov ebx, dword [esp + 0x164]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x15c], eax
mov dword [esp + 0x160], ecx
mov dword [esp + 0x164], edx
jmp 0x477541
jmp 0x477541
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x160], eax
mov eax, dword [esp + 0x15c]
add eax, dword [esp + 0x1e4]
mov dword [esp + 0xf4], eax
mov word [eax], 0x6d61
mov eax, dword [esp + 0x15c]
mov ecx, dword [esp + 0x160]
mov edx, dword [esp + 0x164]
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], ecx
mov dword [esp + 0x1e8], edx
jmp 0x477595
jmp 0x4775a3
jmp 0x477599
jmp 0x47759b
jmp 0x47759d
jmp 0x47759f
jmp 0x4775a1
jmp 0x4775a3
jmp 0x4775a5
jmp 0x4755b2
jmp 0x4775ac
mov eax, dword [esp + 0x1e0]
mov ecx, dword [esp + 0x1e4]
mov edx, dword [esp + 0x1e8]
mov dword [esp + 0x1f4], eax
mov dword [esp + 0x1f8], ecx
mov dword [esp + 0x1fc], edx
add esp, 0x1c8
ret
mov ecx, 3
call fcn.0045d980
mov ecx, 3
call fcn.0045d980
nop
call fcn.0045c4a0
jmp fcn.00475490