Function at 0x47054a
Capabilities:
Check for peb ntglobalflag flag
Check os version
Enumerate pe sections
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x688deb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18c
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
mov ecx, dword [edi + 0x53]
mov esi, dword [eax + 0x10]
mov ax, word [edi + 8]
mov edx, dword [ecx]
push eax
mov dword [esp + 0x54], eax
call dword [edx + 0x260]
mov dword [esp + 0x54], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xcc]
lea ecx, [esp + 0xb8]
mov dword [esp + 0x30], eax
call fcn.004ff6fd
lea ecx, [esp + 0x48]
lea ebp, [edi + 0x10c6]
lea edx, [esp + 0x8c]
xor ebx, ebx
push ecx
push edx
mov ecx, ebp
mov dword [esp + 0x1ac], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0x18], ebx
mov byte [esp + 0xa7], 0xff
mov byte [esp + 0xa4], 0xff
mov byte [esp + 0xa5], 0xff
mov byte [esp + 0xa6], 0xff
mov dword [esp + 0x50], 0x14
mov dword [esp + 0x54], 0x5b4
call fcn.00574ca7
mov ecx, dword [eax]
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x8c]
mov edx, dword [eax + 4]
lea eax, [esp + 0x1c]
push eax
push ecx
mov ecx, ebp
mov dword [esp + 0x54], edx
mov dword [esp + 0x24], 0x534
mov dword [esp + 0x28], 0x5c8
call fcn.00574ca7
mov edx, eax
mov eax, dword [edx]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x188], eax
mov ecx, dword [edx + 4]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x8c]
mov dword [esp + 0x20], ecx
push edx
push eax
mov ecx, ebp
mov dword [esp + 0x24], 0x658
mov dword [esp + 0x28], 0x6ec
call fcn.00574ca7
mov ecx, eax
mov eax, dword [ecx]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x190], eax
mov edx, dword [ecx + 4]
mov dword [esp + 0x20], edx
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x8c]
push eax
push ecx
mov ecx, ebp
mov dword [esp + 0x24], 8
mov dword [esp + 0x28], ebx
call fcn.00574ca7
mov edx, dword [eax]
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], edx
lea edx, [esp + 0x8c]
mov eax, dword [eax + 4]
push ecx
push edx
mov ecx, ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], 0x208
mov dword [esp + 0x20], 8
call fcn.00574ca7
mov ecx, dword [eax]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x8c]
mov edx, dword [eax + 4]
lea eax, [esp + 0x60]
push eax
push ecx
mov ecx, ebp
mov dword [esp + 0x20], edx
mov dword [esp + 0x68], 8
mov dword [esp + 0x6c], 0x28
call fcn.00574ca7
mov edx, dword [eax]
mov dword [esp + 0x60], edx
mov eax, dword [eax + 4]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x30]
cmp eax, 1
je 0x470758
cmp eax, 2
jne 0x471804
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x8c]
push ecx
push edx
mov ecx, ebp
mov dword [esp + 0x24], 0x80
mov dword [esp + 0x28], 0x8c
call fcn.00574ca7
mov edx, dword [esp + 0x54]
mov ecx, eax
mov eax, dword [ecx]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], eax
mov ecx, dword [ecx + 4]
mov dword [esp + 0x20], ecx
mov ax, word [edx + 0x134]
and eax, 0xffff
mov dword [esp + 0x28], ecx
mov dword [esp + 0x58], eax
cmp byte [eax + 0x6cbb20], bl
je 0x471804
mov eax, dword [eax*4 + 0x6ccb20]
mov dword [esp + 0x38], eax
cmp dword [eax + 0x12], ebx
jne 0x471804
mov cx, word [esp + 0x50]
cmp word [eax + 0x28], cx
jne 0x471804
mov edx, dword [eax + 0x370]
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push ebx
mov dword [esp + 0x54], edx
call fcn.0045cc6c
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0xc4]
add eax, 0x510
push eax
call fcn.004ff89c
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x8c]
push ecx
push edx
mov ecx, ebp
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0x24], 0x26c
mov dword [esp + 0x28], 8
call fcn.00574ca7
mov ecx, dword [eax]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0xb8]
mov edx, dword [eax + 4]
push ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x1c]
mov eax, dword [esi]
push 1
push edx
push ecx
mov ecx, esi
call dword [eax + 0x5c]
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x190]
add edx, eax
mov eax, dword [esp + 0x188]
add ecx, edx
push 1
push ebx
push ecx
mov dword [esp + 0x20], ecx
sub ebp, eax
mov ecx, esp
mov dword [esp + 0x3c], esp
push ebx
mov dword [esp + 0xcc], ebp
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
call fcn.0045cc6c
mov ecx, dword [edi + 0x12b6]
add ecx, 0x747
push ecx
lea ecx, [esp + 0xc8]
call fcn.004ff89c
mov ecx, dword [esp + 0x18]
mov edx, dword [esi]
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x18]
push 3
push ecx
push eax
mov ecx, esi
call dword [edx + 0x5c]
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push ebx
call fcn.0045cc6c
mov ecx, dword [edi + 0x12b6]
add ecx, 0xc06
push ecx
lea ecx, [esp + 0xc8]
call fcn.004ff89c
mov ecx, dword [esp + 0x18]
mov edx, dword [esi]
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x18]
push 1
push ecx
push eax
mov ecx, esi
call dword [edx + 0x5c]
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 0x40]
mov al, byte [eax + 0x403]
cmp al, 1
mov byte [esp + 0x30], al
jne 0x47095b
mov edx, dword [esp + 0x44]
xor eax, eax
mov ax, word [edx + 0x692]
mov dword [esp + 0x3c], eax
jmp 0x4709a1
mov eax, dword [esp + 0x30]
mov edx, dword [0x6c2734]
and eax, 0xff
movsx eax, word [edx + eax*2 + 0xe1]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x44]
xor edx, edx
mov dx, word [eax + 0x692]
mov eax, edx
mov edx, dword [esp + 0x30]
imul edx, eax
mov eax, 0x51eb851f
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
sub edx, eax
lea eax, [ecx + ecx*4]
mov dword [esp + 0x30], edx
xor edx, edx
lea eax, [eax + eax*4]
mov dword [esp + 0x34], ebx
shl eax, 2
div dword [esp + 0x3c]
fild qword [esp + 0x30]
fstp dword [esp + 0x24]
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebx
fild qword [esp + 0x30]
mov dword [esp + 0x40], ebx
fsub dword [esp + 0x24]
fstp dword [esp + 0x30]
mov dword [esp + 0x3c], eax
fild qword [esp + 0x3c]
fmul dword [esp + 0x30]
fmul dword [0x7d9320]
fcom dword [esp + 0x30]
fnstsw ax
test ah, 0x41
jne 0x470a05
fstp st(0)
fld dword [esp + 0x30]
call fcn.00674a84
mov ecx, dword [esp + 0x60]
mov dword [esp + 0xbc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], eax
lea edx, [ecx + ecx]
fild qword [esp + 0x30]
mov dword [esp + 0x3c], edx
fst dword [esp + 0x30]
fsub dword [esp + 0x24]
fisub dword [esp + 0x3c]
call fcn.00674a84
push 1
push ebx
push ecx
mov dword [esp + 0xcc], eax
mov ecx, esp
mov dword [esp + 0x48], esp
push ebx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
call fcn.0045cc6c
mov eax, dword [edi + 0x12b6]
lea ecx, [esp + 0xc4]
add eax, 0xbeb
push eax
call fcn.004ff89c
fld dword [esp + 0x24]
fmul dword [0x7d9330]
fiadd dword [esp + 0x18]
mov ebp, dword [esi]
lea ecx, [esp + 0xb8]
push ecx
push 2
fiadd dword [esp + 0x68]
call fcn.00674a84
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x6c]
mov ecx, esi
add eax, edx
push eax
call dword [ebp + 0x5c]
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x190]
mov ebp, dword [esp + 0x188]
mov eax, dword [esp + 0x44]
add ecx, edx
mov edx, dword [esp + 0x14]
sub ecx, ebp
push eax
add edx, ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x18], edx
call fcn.004d9dc2
mov ebp, dword [esp + 0x58]
mov dword [esp + 0x24], eax
cmp byte [ebp + 0x6cbb20], bl
je 0x470bf1
mov eax, dword [ebp*4 + 0x6ccb20]
cmp dword [eax + 0x12], ebx
jne 0x470bf1
mov cx, word [esp + 0x50]
cmp word [eax + 0x28], cx
jne 0x470bf1
lea edx, [esp + 0x68]
lea eax, [esp + 0x8c]
push edx
push eax
lea ecx, [edi + 0x10c6]
mov dword [esp + 0x70], 0x100
mov dword [esp + 0x74], 0x1f0
call fcn.00574ca7
mov ecx, dword [eax]
push 1
push ebx
mov dword [esp + 0x70], ecx
mov edx, dword [eax + 4]
mov eax, dword [ebp*4 + 0x6ccb20]
push ecx
mov dword [esp + 0x78], edx
mov ecx, esp
mov dword [esp + 0x5c], esp
push ebx
mov dword [esp + 0x68], eax
call fcn.0045cc6c
mov ecx, dword [edi + 0x12b6]
add ecx, 0xf4b
push ecx
lea ecx, [esp + 0xc8]
call fcn.004ff89c
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
sub eax, ebp
mov dword [esp + 0xbc], eax
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc4], ebp
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
mov edx, dword [esi]
push 7
add eax, ebp
push ecx
push eax
mov ecx, esi
call dword [edx + 0x5c]
mov eax, 0xaaaaaaab
mov ecx, dword [esp + 0x14]
mul ebp
mov eax, dword [esp + 0x18]
push ebx
shr edx, 1
add edx, eax
push 0xa
lea eax, [esp + 0xa4]
push 1
push eax
push edx
push ecx
mov ecx, dword [esp + 0x70]
mov edx, dword [ecx + 0x3fb]
mov ecx, edi
push edx
call fcn.004650de
jmp 0x470bf5
mov ebp, dword [esp + 0x2c]
mov ecx, dword [edi + 0x53]
push 1
mov eax, dword [ecx]
call dword [eax + 0x98]
push 1
push ebx
push ecx
mov dword [esp + 0x64], eax
mov ecx, esp
mov dword [esp + 0x5c], esp
push ebx
call fcn.0045cc6c
mov ecx, dword [esp + 0x64]
push ecx
lea ecx, [esp + 0xc8]
call fcn.004ff89c
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc0], ebp
mov dword [esp + 0xc4], ebp
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
mov edx, dword [esi]
push 1
push ecx
push eax
mov ecx, esi
call dword [edx + 0x5c]
mov ecx, dword [esp + 0x6c]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x14]
sub ecx, eax
add edx, ecx
mov dword [esp + 0xbc], ebp
mov dword [esp + 0x14], edx
mov dl, byte [edi + 0x13d9]
and dl, 1
mov dword [esp + 0xc0], ebp
cmp dl, 1
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
jne 0x470cdf
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push ebx
call fcn.0045cc6c
mov eax, dword [edi + 0x12b6]
lea ecx, [esp + 0xc4]
add eax, 0x123f
push eax
call fcn.004ff89c
mov ecx, dword [esp + 0x18]
mov edx, dword [esi]
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x18]
push 1
push ecx
push eax
mov ecx, esi
call dword [edx + 0x5c]
mov ecx, dword [esp + 0x44]
push 1
add ecx, 0x57c
push ebx
push ecx
mov dword [esp + 0x48], ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push ebx
call fcn.0045cc6c
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0xc4]
push edx
call fcn.004ff89c
mov eax, dword [esp + 0x24]
cmp eax, 0x64
jne 0x470d37
mov edx, dword [esp + 0x18]
mov eax, dword [esi]
lea ecx, [esp + 0xb8]
push ecx
mov ecx, dword [esp + 0x18]
push 2
push edx
push ecx
mov ecx, esi
call dword [eax + 0x5c]
jmp 0x470e48
fld dword [0x7d930c]
fadd st(0), st(0)
fld dword [0x7d930c]
fmul dword [0x7d9318]
fxch st(1)
fmul dword [0x7d9320]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ebx
fild qword [esp + 0x58]
fld dword [0x7d9314]
fxch st(1)
fmulp st(2)
fld dword [0x7d9314]
fld dword [0x7d9314]
fxch st(4)
fstp dword [esp + 0x24]
fxch st(2)
fsubr dword [esp + 0x24]
fxch st(1)
fstp dword [esp + 0x80]
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x24]
fxch st(1)
fstp dword [esp + 0x84]
fxch st(1)
fstp dword [esp + 0x88]
mov ecx, dword [eax + 0xf]
lea eax, [esp + 0x80]
fstp dword [esp + 0x24]
fild dword [esp + 0x18]
push ebx
push eax
fild dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x30]
push 0x3e4ccccd
push edx
mov edx, dword [esp + 0x44]
push ecx
mov ecx, edi
push edx
push ecx
fxch st(1)
fstp dword [esp]
push ecx
fstp dword [esp]
call fcn.0046e83c
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x80], 0x3ecccccd
fld dword [0x7d930c]
fmul dword [0x7d9318]
mov dword [esp + 0x84], 0x3ecccccd
mov dword [esp + 0x88], 0x3ecccccd
mov edx, dword [ecx + 0xf]
lea eax, [esp + 0x80]
push ebx
push eax
mov eax, dword [esp + 0x2c]
push edx
push 0x3e4ccccd
push eax
push ecx
mov ecx, dword [esp + 0x48]
fstp dword [esp]
fild dword [esp + 0x30]
fild dword [esp + 0x2c]
push ecx
mov ecx, edi
push ecx
fxch st(1)
fstp dword [esp]
push ecx
fstp dword [esp]
call fcn.0046e83c
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x14]
add edx, ebp
add eax, edx
xor ebp, ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x3c], ebp
mov ecx, dword [esp + 0x44]
push ebp
call fcn.004e150d
mov ecx, dword [esp + 0x38]
mov al, byte [eax + 1]
cmp al, byte [ecx + 0x403]
ja 0x471075
mov ecx, dword [esp + 0x44]
push ebp
call fcn.004e150d
mov al, byte [eax]
cmp al, bl
mov byte [esp + 0x58], al
je 0x471075
mov ecx, dword [edi + 0x53]
mov eax, dword [esp + 0x58]
push eax
mov edx, dword [ecx]
call dword [edx + 0xe8]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov ebp, eax
call fcn.004d9c73
mov dword [esp + 0x24], eax
mov al, byte [edi + 0x13d9]
test al, 1
jne 0x470f19
mov ecx, dword [esp + 0x3c]
and eax, 0xff
shr eax, 3
cmp ecx, eax
jne 0x470f19
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x5c], esp
push ebx
call fcn.0045cc6c
mov eax, dword [edi + 0x12b6]
lea ecx, [esp + 0xc4]
add eax, 0x1275
push eax
call fcn.004ff89c
mov ecx, dword [esp + 0x18]
mov edx, dword [esi]
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x18]
push 1
push ecx
push eax
mov ecx, esi
call dword [edx + 0x5c]
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x5c], esp
push ebx
call fcn.0045cc6c
push ebp
lea ecx, [esp + 0xc8]
call fcn.004ff89c
mov eax, dword [esp + 0x24]
cmp eax, 0x64
jne 0x470f5f
mov ecx, dword [esp + 0x18]
mov edx, dword [esi]
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x18]
push 2
push ecx
push eax
mov ecx, esi
call dword [edx + 0x5c]
jmp 0x471071
fld dword [0x7d930c]
fadd st(0), st(0)
fld dword [0x7d930c]
fmul dword [0x7d9318]
fxch st(1)
fmul dword [0x7d9320]
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ebx
fild qword [esp + 0x8c]
fld dword [0x7d9314]
fxch st(1)
fmulp st(2)
fld dword [0x7d9314]
fld dword [0x7d9314]
fxch st(4)
fstp dword [esp + 0x24]
fxch st(2)
fsubr dword [esp + 0x24]
fxch st(1)
fstp dword [esp + 0x80]
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x80]
fxch st(1)
fstp dword [esp + 0x84]
fxch st(1)
fstp dword [esp + 0x88]
mov edx, dword [ebp + 0xf]
push ebx
fstp dword [esp + 0x28]
fild dword [esp + 0x1c]
push eax
push edx
mov edx, dword [esp + 0x3c]
push 0x3e4ccccd
fild dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x38]
push ecx
mov ecx, edi
push edx
push ecx
fxch st(1)
fstp dword [esp]
push ecx
fstp dword [esp]
call fcn.0046e83c
fld dword [0x7d930c]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x80], 0x3ecccccd
fmul dword [0x7d9318]
mov dword [esp + 0x84], 0x3ecccccd
mov dword [esp + 0x88], 0x3ecccccd
mov ecx, dword [ebp + 0xf]
lea eax, [esp + 0x80]
push ebx
push eax
mov eax, dword [esp + 0x38]
push ecx
push 0x3e4ccccd
push edx
push ecx
mov ecx, edi
fstp dword [esp]
fild dword [esp + 0x30]
fild dword [esp + 0x2c]
push eax
push ecx
fxch st(1)
fstp dword [esp]
push ecx
fstp dword [esp]
call fcn.0046e83c
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x2c]
add ecx, edx
mov edx, dword [esp + 0x14]
add edx, ecx
inc ebp
cmp ebp, 3
mov dword [esp + 0x14], edx
mov dword [esp + 0x3c], ebp
jb 0x470e5e
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x18], eax
call fcn.004e1782
and eax, 0xff
dec eax
cmp eax, 6
ja case.0x4710c0.4
jmp dword [eax*4 + 0x471cd0]
mov eax, dword [esp + 0x54]
mov ebp, 1
cmp word [eax + 0x136], bx
je 0x47114e
push ebp
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0045cc6c
mov edx, dword [edi + 0x12b6]
lea ecx, [esp + 0xc4]
add edx, 0x123f
push edx
call fcn.004ff89c
mov edx, dword [esp + 0x4c]
lea ecx, [esp + 0xb8]
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0x20]
push ebp
push edx
mov edx, dword [esp + 0x34]
sub ecx, edx
push ecx
mov ecx, esi
call dword [eax + 0x5c]
push ebp
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0045cc6c
mov edx, dword [edi + 0x12b6]
lea ecx, [esp + 0xc4]
add edx, 0xa3b
push edx
call fcn.004ff89c
jmp 0x47141f
mov eax, dword [eax + 0x76]
push 1
and eax, 2
push ebx
push ecx
cmp al, 2
mov ecx, esp
jne 0x4711d0
mov dword [esp + 0x1c], esp
push ebx
call fcn.0045cc6c
mov ecx, dword [edi + 0x12b6]
add ecx, 0x123f
push ecx
lea ecx, [esp + 0xc8]
call fcn.004ff89c
mov ecx, dword [esp + 0x4c]
mov edx, dword [esi]
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x20]
push 1
push ecx
mov ecx, dword [esp + 0x34]
sub eax, ecx
mov ecx, esi
push eax
call dword [edx + 0x5c]
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0045cc6c
mov ecx, dword [edi + 0x12b6]
add ecx, 0xa20
push ecx
lea ecx, [esp + 0xc8]
call fcn.004ff89c
jmp 0x47141f
mov dword [esp + 0x1c], esp
push ebx
call fcn.0045cc6c
mov edx, dword [edi + 0x12b6]
lea ecx, [esp + 0xc4]
add edx, 0xa05
push edx
call fcn.004ff89c
jmp 0x47141f
mov eax, dword [esp + 0x38]
test dword [eax + 0x3e6], 0x80000000
je 0x471252
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0045cc6c
mov ecx, dword [edi + 0x12b6]
add ecx, 0x123f
push ecx
lea ecx, [esp + 0xc8]
call fcn.004ff89c
mov ebp, dword [esp + 0x28]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esi]
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x20]
push 1
sub eax, ebp
push ecx
push eax
mov ecx, esi
call dword [edx + 0x5c]
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0045cc6c
mov ecx, dword [edi + 0x12b6]
add ecx, 0x9ea
push ecx
lea ecx, [esp + 0xc8]
call fcn.004ff89c
mov ebp, 1
jmp 0x47141f
mov edx, dword [esp + 0x38]
mov ebp, 1
mov eax, dword [edx + 0x3e6]
test ah, 8
je 0x4712e0
push ebp
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0045cc6c
mov eax, dword [edi + 0x12b6]
lea ecx, [esp + 0xc4]
add eax, 0x123f
push eax
call fcn.004ff89c
mov ecx, dword [esp + 0x4c]
mov edx, dword [esi]
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x20]
push ebp
push ecx
mov ecx, dword [esp + 0x34]
sub eax, ecx
mov ecx, esi
push eax
call dword [edx + 0x5c]
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0045cc6c
mov ecx, dword [edi + 0x12b6]
add ecx, 0x97e
push ecx
lea ecx, [esp + 0xc8]
call fcn.004ff89c
jmp 0x47141f
mov edx, dword [esp + 0x38]
mov ebp, 1
cmp word [edx + 0x4a3], bx
je 0x471367
push ebp
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0045cc6c
mov eax, dword [edi + 0x12b6]
lea ecx, [esp + 0xc4]
add eax, 0x123f
push eax
call fcn.004ff89c
mov ecx, dword [esp + 0x4c]
mov edx, dword [esi]
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x20]
push ebp
push ecx
mov ecx, dword [esp + 0x34]
sub eax, ecx
mov ecx, esi
push eax
call dword [edx + 0x5c]
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0045cc6c
mov ecx, dword [edi + 0x12b6]
add ecx, 0x9cf
push ecx
lea ecx, [esp + 0xc8]
call fcn.004ff89c
jmp 0x47141f
mov edx, dword [esp + 0x38]
mov ebp, 1
mov eax, dword [edx + 0x3e6]
test ah, 0x20
je 0x4713f0
push ebp
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0045cc6c
mov eax, dword [edi + 0x12b6]
lea ecx, [esp + 0xc4]
add eax, 0x123f
push eax
call fcn.004ff89c
mov ecx, dword [esp + 0x4c]
mov edx, dword [esi]
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x20]
push ebp
push ecx
mov ecx, dword [esp + 0x34]
sub eax, ecx
mov ecx, esi
push eax
call dword [edx + 0x5c]
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0045cc6c
mov ecx, dword [edi + 0x12b6]
add ecx, 0x9b4
push ecx
lea ecx, [esp + 0xc8]
call fcn.004ff89c
jmp 0x47141f
mov ebp, dword [esp + 0x10]
cmp ebp, 1
jne 0x471445
mov ebp, dword [esp + 0x28]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esi]
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x20]
push 2
sub eax, ebp
push ecx
push eax
mov ecx, esi
call dword [edx + 0x5c]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
add eax, ecx
mov ecx, dword [esp + 0x44]
push 1
xor ebp, ebp
mov dword [esp + 0x1c], eax
call fcn.004e1782
cmp al, 5
jne 0x4714ea
mov edx, dword [esp + 0x38]
mov ebp, 1
cmp word [edx + 0x4a7], bx
je 0x4714c1
push ebp
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0045cc6c
mov eax, dword [edi + 0x12b6]
lea ecx, [esp + 0xc4]
add eax, 0x123f
push eax
call fcn.004ff89c
mov ecx, dword [esp + 0x18]
mov edx, dword [esi]
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x20]
push ebp
push ecx
mov ecx, dword [esp + 0x34]
sub eax, ecx
mov ecx, esi
push eax
call dword [edx + 0x5c]
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0045cc6c
mov ecx, dword [edi + 0x12b6]
add ecx, 0x1842
push ecx
lea ecx, [esp + 0xc8]
call fcn.004ff89c
cmp ebp, 1
jne 0x471510
mov ebp, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov edx, dword [esi]
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x20]
push 2
sub eax, ebp
push ecx
push eax
mov ecx, esi
call dword [edx + 0x5c]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
add eax, ecx
lea edx, [esp + 0xa8]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x8c]
lea ebp, [edi + 0x10c6]
push edx
push eax
mov ecx, ebp
mov dword [esp + 0xb0], 0xb8
mov dword [esp + 0xb4], 0xc
call fcn.00574ca7
mov ecx, eax
mov eax, dword [ecx]
mov dword [esp + 0xa8], eax
mov edx, dword [ecx + 4]
mov dword [esp + 0xc0], eax
mov al, byte [edi + 0x13d9]
mov dword [esp + 0xac], edx
test al, 1
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
jne 0x4715d4
and al, 0xf8
cmp al, 0x18
jne 0x4715d4
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0045cc6c
mov eax, dword [edi + 0x12b6]
lea ecx, [esp + 0xc4]
add eax, 0x18ff
push eax
call fcn.004ff89c
mov ecx, dword [esp + 0x18]
mov edx, dword [esi]
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x20]
push 1
push ecx
mov ecx, dword [esp + 0x34]
sub eax, ecx
mov ecx, esi
push eax
call dword [edx + 0x5c]
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0045cc6c
mov ecx, dword [edi + 0x12b6]
add ecx, 0x999
push ecx
lea ecx, [esp + 0xc8]
call fcn.004ff89c
mov ecx, dword [esp + 0x18]
mov edx, dword [esi]
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x20]
push 2
push ecx
mov ecx, dword [esp + 0x34]
sub eax, ecx
mov ecx, esi
push eax
call dword [edx + 0x5c]
call fcn.005f9703
mov ecx, dword [edi + 0x4f25]
cmp ecx, ebx
je 0x47175c
cmp ecx, eax
jbe 0x47175c
mov edx, dword [edi + 0x4f29]
push 1
sub eax, edx
sub ecx, edx
shl eax, 7
cdq
idiv ecx
push ebx
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc8], eax
lea ecx, [eax + eax*2]
push ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0xc8], ecx
mov ecx, esp
mov dword [esp + 0x5c], esp
push ebx
call fcn.0045cc6c
mov ecx, dword [edi + 0x12b6]
add ecx, 0x747
push ecx
lea ecx, [esp + 0xc8]
call fcn.004ff89c
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0xb8]
push ecx
mov ecx, dword [esp + 0x24]
lea eax, [edx + edx]
mov edx, dword [esi]
add ecx, eax
push 2
push ecx
mov ecx, dword [esp + 0x28]
add ecx, eax
push ecx
mov ecx, esi
call dword [edx + 0x5c]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
push 1
push ebx
lea ecx, [edx + edx]
lea eax, [eax + eax*4]
sub eax, ecx
push ecx
imul eax, dword [esp + 0x1c]
cdq
and edx, 0x7f
mov dword [esp + 0x1c], esp
add eax, edx
mov dword [esp + 0xd8], ebx
sar eax, 7
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0x64]
sub eax, ecx
mov ecx, esp
push ebx
mov dword [esp + 0xd0], eax
mov dword [esp + 0xe0], ebx
call fcn.0045cc6c
mov eax, dword [edi + 0x12b6]
lea ecx, [esp + 0xc4]
add eax, 0xbeb
push eax
call fcn.004ff89c
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x30]
mov edx, dword [esi]
add ecx, eax
mov eax, dword [esp + 0x2c]
push 1
add ecx, eax
mov eax, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x28]
add ecx, eax
add ecx, dword [esp + 0x34]
push ecx
mov ecx, esi
call dword [edx + 0x5c]
mov eax, dword [esp + 0x38]
mov cl, byte [eax + 0x36f]
mov byte [esp + 0x10], cl
mov ecx, dword [eax + 0x3e6]
test ecx, 0x80000000
je 0x4717dc
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push ebx
call fcn.0045cc6c
mov edx, dword [edi + 0x12b6]
lea ecx, [esp + 0xc4]
add edx, 0xbb5
push edx
call fcn.004ff89c
mov eax, dword [edi + 0x10ca]
mov ecx, dword [edi + 0x10ce]
mov dword [esp + 0xbc], eax
lea eax, [esp + 0xb8]
push eax
mov dword [esp + 0xc4], ecx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
mov edx, dword [esi]
push 9
push ebx
push ebx
mov ecx, esi
call dword [edx + 0x5c]
mov ecx, dword [esp + 0x10]
and ecx, 0xff
push ecx
mov ecx, edi
call fcn.0046012a
mov edx, dword [esp + 0x38]
cmp word [edx + 0x447], bx
je 0x471804
push 0x70
mov ecx, edi
call fcn.004601cf
lea eax, [esp + 0x68]
lea ecx, [esp + 0x8c]
push eax
push ecx
mov ecx, ebp
mov dword [esp + 0x70], 0x100
mov dword [esp + 0x74], 0x200
call fcn.00574ca7
mov edx, dword [eax]
lea ecx, [esp + 0xb0]
mov dword [esp + 0x68], edx
lea edx, [esp + 0x8c]
mov eax, dword [eax + 4]
push ecx
push edx
mov ecx, ebp
mov dword [esp + 0x74], eax
mov dword [esp + 0xb8], 0x1c0
mov dword [esp + 0xbc], 0x1b8
call fcn.00574ca7
mov edx, dword [esp + 0x48]
mov ecx, eax
mov eax, dword [ecx]
mov dword [esp + 0xb0], eax
mov ecx, dword [ecx + 4]
mov dword [esp + 0x178], edx
add edx, eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x17c], eax
add eax, ecx
mov dword [esp + 0x184], eax
mov dword [esp + 0xb4], ecx
mov dword [esp + 0x180], edx
mov edx, dword [esi]
lea eax, [esp + 0x178]
mov ecx, esi
push eax
call dword [edx + 0x6c]
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.0045cc6c
mov ecx, dword [edi + 0x12b6]
add ecx, 0x18ae
push ecx
lea ecx, [esp + 0xc8]
call fcn.004ff89c
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], eax
lea eax, [esp + 0xb8]
mov dword [esp + 0xcc], ebx
push eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0xd4], ebx
mov edx, dword [esi]
push 7
push ecx
push eax
mov ecx, esi
call dword [edx + 0x5c]
mov ecx, dword [edi + 0x10ca]
mov edx, dword [edi + 0x10ce]
mov dword [esp + 0x180], ecx
lea ecx, [esp + 0x178]
mov dword [esp + 0x178], ebx
mov dword [esp + 0x17c], ebx
mov dword [esp + 0x184], edx
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x6c]
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x78], 0x80
mov dword [esp + 0x7c], 0x108
lea edx, [esp + 0x78]
lea eax, [esp + 0x8c]
push edx
push eax
mov ecx, ebp
call fcn.00574ca7
mov ecx, dword [eax]
mov dword [esp + 0x78], ecx
lea ecx, [esp + 0x8c]
mov edx, dword [eax + 4]
lea eax, [esp + 0x70]
push eax
push ecx
mov ecx, ebp
mov dword [esp + 0x84], edx
mov dword [esp + 0x78], 8
mov dword [esp + 0x7c], 0xc
call fcn.00574ca7
mov edx, dword [eax]
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x70], edx
mov edx, dword [esp + 0x7c]
mov eax, dword [eax + 4]
mov dword [esp + 0xbc], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x74], eax
xor eax, eax
mov dword [esp + 0xc0], edx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
mov ax, word [ecx + 6]
mov eax, dword [eax*4 + 0x6ccb20]
cmp eax, ebx
mov dword [esp + 0x54], eax
je 0x471a94
jmp 0x471a01
mov eax, dword [esp + 0x54]
cmp word [eax + 0x482], bx
je 0x471a7b
mov ebp, dword [eax + 0x370]
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
add ebp, 0x52b
call fcn.0045cc6c
push ebp
lea ecx, [esp + 0xc8]
call fcn.004ff89c
mov ecx, dword [esp + 0xac]
lea eax, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x194]
mov ebp, dword [esp + 0x40]
add ecx, eax
mov eax, dword [esp + 0x74]
push 7
push ecx
mov ecx, dword [esp + 0x84]
add ecx, eax
mov edx, dword [esi]
imul ecx, ebp
add ecx, eax
mov eax, dword [esp + 0x28]
add ecx, eax
push ecx
mov ecx, esi
call dword [edx + 0x5c]
mov eax, dword [esp + 0x54]
inc ebp
mov dword [esp + 0x3c], ebp
xor edx, edx
mov dx, word [eax + 0x10]
mov eax, dword [edx*4 + 0x6ccb20]
cmp eax, ebx
mov dword [esp + 0x54], eax
jne 0x4719fd
lea eax, [esp + 0x78]
lea ecx, [esp + 0x8c]
push eax
lea ebp, [edi + 0x10c6]
push ecx
mov ecx, ebp
mov dword [esp + 0x80], 0xa00
mov dword [esp + 0x84], 0x58
call fcn.00574ca7
mov edx, eax
mov eax, dword [edx]
mov dword [esp + 0x78], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0xbc], eax
mov dword [esp + 0x7c], ecx
mov dword [esp + 0xc0], ecx
lea eax, [esp + 0x70]
lea ecx, [esp + 0x8c]
push eax
push ecx
mov ecx, ebp
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], 0x700
call fcn.00574ca7
mov edx, dword [eax]
push 1
push ebx
push ecx
mov dword [esp + 0x7c], edx
mov eax, dword [eax + 4]
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
mov dword [esp + 0x84], eax
call fcn.0045cc6c
mov ecx, dword [edi + 0x12b6]
add ecx, 0x798
push ecx
lea ecx, [esp + 0xc8]
call fcn.004ff89c
mov ecx, dword [esp + 0x74]
mov edx, dword [esi]
lea eax, [esp + 0xb8]
push eax
push 9
push ecx
push ebx
mov ecx, esi
call dword [edx + 0x5c]
lea edx, [esp + 0x168]
lea eax, [esp + 0x8c]
push edx
push eax
mov ecx, ebp
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
mov dword [esp + 0x170], ebx
mov dword [esp + 0x178], 0x5a0
mov dword [esp + 0x174], 0x14
mov dword [esp + 0x17c], 0x58
call fcn.00574d22
mov ecx, dword [eax]
mov dword [esp + 0x168], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x16c], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x170], ecx
lea ecx, [esp + 0x8c]
mov edx, dword [eax + 0xc]
lea eax, [esp + 0xa0]
push eax
push ecx
mov ecx, ebp
mov dword [esp + 0x17c], edx
mov dword [esp + 0xa8], 0x200
mov dword [esp + 0xac], 0x58
call fcn.00574ca7
mov edx, eax
mov eax, dword [edx]
mov dword [esp + 0xa0], eax
mov ecx, dword [edx + 4]
push 1
push ebx
push ecx
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xcc], ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
mov dword [esp + 0xcc], eax
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
call fcn.0045cc6c
mov eax, dword [edi + 0x12b6]
lea ecx, [esp + 0xc4]
add eax, 0x798
push eax
call fcn.004ff89c
mov eax, dword [edi + 0x10ca]
xor ebp, ebp
cmp eax, ebx
mov dword [esp + 0x10], eax
jbe 0x471c94
mov ecx, dword [esp + 0x16c]
mov edx, dword [esi]
lea eax, [esp + 0xb8]
push eax
push 9
push ecx
push ebx
mov ecx, esi
call dword [edx + 0x5c]
mov ebx, dword [esp + 0xa0]
inc ebp
imul ebx, ebp
cmp ebx, dword [esp + 0x10]
jb 0x471c69
mov ecx, edi
call fcn.0047774a
lea ecx, [esp + 0xb8]
mov dword [esp + 0x1a4], 0xffffffff
call fcn.004ff821
mov ecx, dword [esp + 0x19c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x198
ret