Function at 0x4ba640
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x62826c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x384
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x3a4]
mov eax, 0x24924925
mov esi, dword [0x6d620c]
xor ebx, ebx
mov ecx, dword [edi + 0x10]
mov dword [esp + 0x18], ebx
sub ecx, 6
mul ecx
mov ax, word [edi + 0x14]
sub ecx, edx
shr ecx, 1
add ecx, edx
mov dx, word [edi + 0x18]
shr ecx, 3
mov dword [esp + 0x64], ecx
mov cx, word [edi + 0x16]
mov ebp, eax
lea eax, [esp + 0x1c]
mov word [esp + 0x20], cx
and ebp, 0xffff
push eax
mov ecx, 0x6d6208
mov word [esp + 0x94], dx
mov dword [esp + 0x44], ebp
mov dword [esp + 0x20], ebp
call fcn.00409380
mov ecx, dword [0x6d620c]
mov dword [esp + 0x10], eax
cmp eax, ecx
je 0x4ba6e1
mov edx, dword [esp + 0x1c]
cmp edx, dword [eax + 0xc]
jb 0x4ba6e1
lea eax, [esp + 0x10]
jmp 0x4ba6e9
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x1c]
cmp dword [eax], esi
je 0x4bbabb
lea eax, [esp + 0x28]
lea ecx, [esp + 0x88]
push eax
push ecx
mov ecx, 0x6d6208
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebx
call fcn.00408bd0
mov edx, dword [eax]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x38], edx
lea edx, [esp + 0x38]
mov eax, dword [eax + 4]
push ecx
push edx
lea ecx, [esp + 0xa4]
mov dword [esp + 0x44], eax
call fcn.0045bbb0
mov ecx, eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
mov edx, dword [ecx + 4]
mov dword [esp + 0x18], eax
mov eax, dword [0x6d67a8]
cmp ebp, eax
mov dword [esp + 0x7c], edx
jne 0x4ba763
mov ecx, dword [esp + 0x20]
and ecx, 0xffff
push ecx
mov ecx, 0x68d9e0
call fcn.00407a20
mov ecx, dword [esp + 0x64]
xor eax, eax
cmp ecx, ebx
mov dword [esp + 0x1c], eax
jbe 0x4bbabb
jmp 0x4ba782
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x3a4]
lea edx, [eax*8]
sub edx, eax
mov si, word [edi + edx*2 + 0x1a]
mov ecx, dword [edi + edx*2 + 0x1c]
lea eax, [edi + edx*2 + 0x1a]
mov edi, dword [0x6d620c]
mov dword [esp + 0x34], esi
lea edx, [esp + 0x10]
mov eax, dword [eax + 6]
mov dword [esp + 0x14], ecx
and eax, 0x7fffffff
and esi, 0xffff
push edx
mov ecx, 0x6d6208
mov dword [esp + 0x3c], eax
mov dword [esp + 0x14], esi
call fcn.00409380
mov ecx, dword [0x6d620c]
mov dword [esp + 0x24], eax
cmp eax, ecx
je 0x4ba7ea
mov edx, dword [esp + 0x10]
mov ebp, dword [eax + 0xc]
cmp edx, ebp
jb 0x4ba7ea
lea eax, [esp + 0x24]
jmp 0x4ba7f8
mov dword [esp + 0x98], ecx
lea eax, [esp + 0x98]
cmp dword [eax], edi
je 0x4bbaa6
lea eax, [esp + 0x9c]
lea ecx, [esp + 0x11c]
push eax
push ecx
mov ecx, 0x6d6208
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa8], ebx
call fcn.00408bd0
cmp word [esp + 0x34], 0x4000
mov edx, eax
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x10]
mov dword [esp + 0x2c], ecx
jb 0x4bbaa6
cmp word [esp + 0x34], 0x7fff
ja 0x4bbaa6
mov eax, dword [ebp]
cmp eax, 0x6000
jb 0x4ba886
cmp eax, 0x7fff
ja 0x4ba886
mov edi, dword [esp + 0x14]
cmp edi, ebx
jle 0x4ba886
push esi
push ebx
mov ecx, 0xa24690
call fcn.0047a840
test eax, eax
je 0x4ba886
push edi
push esi
push ebx
mov ecx, 0xa24690
call fcn.0047abf0
cmp dword [esp + 0x14], ebx
je 0x4ba89d
push 1
mov ecx, ebp
call fcn.004779d0
test eax, eax
jne 0x4bbaa6
mov edi, dword [esp + 0x38]
xor ecx, ecx
mov eax, edi
mov byte [ebp + 0x4a0], 0
and eax, 0x100
mov word [ebp + 0x80c], bx
or eax, ecx
je 0x4baa79
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x4baa79
mov eax, dword [eax]
cmp eax, 0x6000
jb 0x4baa79
cmp eax, 0x7fff
ja 0x4baa79
cmp dword [0x68f00c], ebx
je 0x4ba945
lea edx, [esp + 0x18]
mov ecx, 0x68f000
push edx
call fcn.00423f80
mov ecx, dword [0x68f004]
mov dword [esp + 0x10], eax
cmp eax, ecx
je 0x4ba91a
mov edx, dword [esp + 0x18]
mov esi, dword [eax + 0xc]
cmp edx, esi
jb 0x4ba91a
lea eax, [esp + 0x10]
jmp 0x4ba928
mov dword [esp + 0x94], ecx
lea eax, [esp + 0x94]
mov eax, dword [eax]
cmp eax, ecx
je 0x4ba945
mov esi, dword [eax + 0x10]
cmp esi, ebx
je 0x4ba945
mov ecx, esi
call fcn.005a07e0
push esi
call fcn.006066eb
add esp, 4
push 0x1c
call fcn.00613321
add esp, 4
mov dword [esp + 0x28], eax
cmp eax, ebx
mov dword [esp + 0x39c], ebx
je 0x4ba969
mov ecx, eax
call fcn.0041d270
mov esi, eax
jmp 0x4ba96b
xor esi, esi
cmp esi, ebx
mov dword [esp + 0x39c], 0xffffffff
je 0x4baa36
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x390]
mov edx, dword [eax + 0x2d8]
mov ecx, dword [edx + ecx*4]
mov edx, dword [eax + 0x358]
lea ecx, [ecx + edx - 0x21d]
mov edx, dword [eax + 0x340]
sub edx, 0x4b
push ecx
push edx
mov ecx, esi
call fcn.0041d2a0
mov eax, dword [esp + 0x18]
push 0xcb
push eax
call fcn.00475730
mov ecx, dword [esp + 0x20]
push 0xcd
push ecx
call fcn.00475730
mov edx, dword [esp + 0x28]
push 0xcc
push edx
call fcn.00475730
mov eax, dword [esp + 0x30]
add esp, 0x18
lea ecx, [esp + 0x88]
lea edx, [esp + 0x114]
push ecx
push edx
mov ecx, 0x68f000
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], ebx
call fcn.004e2730
mov ecx, eax
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov ecx, dword [esp + 0x40]
mov dword [eax + 0x10], esi
mov eax, dword [0x6d67a8]
cmp ecx, eax
mov dword [esp + 0x2c], edx
jne 0x4baa36
push 0x6d67a8
push eax
push 1
mov ecx, esi
call fcn.0041d2c0
mov eax, dword [0x6d67a8]
mov ecx, dword [esp + 0x40]
cmp eax, ecx
jne 0x4baa79
mov ecx, 0x68ef70
call fcn.0041bb10
push 5
push 2
push 8
mov ecx, 0x68ef70
call fcn.0041b980
push 5
push 2
push 8
mov ecx, 0x68ef70
call fcn.0041b9b0
push 1
mov ecx, 0x68ef70
call fcn.0041bb60
mov eax, edi
xor ecx, ecx
and eax, 0x4000000
or eax, ecx
je 0x4baa94
push 0x95b
push ebp
call fcn.0041b470
add esp, 8
mov eax, edi
xor ecx, ecx
and eax, 0x8000000
or eax, ecx
je 0x4baabe
push 0x95d
push ebp
call fcn.0041b470
mov ecx, dword [esp + 0x20]
push 0x95e
push ecx
call fcn.0041b470
add esp, 0x10
mov eax, edi
xor ecx, ecx
and eax, 0x10000000
or eax, ecx
je 0x4baad9
push 0x95c
push ebp
call fcn.0041b470
add esp, 8
mov edx, dword [ebp + 0x258]
xor eax, eax
or edx, edi
mov dword [ebp + 0x258], edx
mov ecx, dword [ebp + 0x25c]
or ecx, eax
mov dword [ebp + 0x25c], ecx
mov edx, dword [ebp + 0x258]
mov eax, ecx
or edx, eax
je 0x4bab5d
cmp dword [ebp + 0x818], ebx
jne 0x4bab4b
push 0xec
call fcn.00613321
add esp, 4
mov dword [esp + 0x28], eax
cmp eax, ebx
mov dword [esp + 0x39c], 1
je 0x4bab34
mov ecx, eax
call fcn.0041d6c0
jmp 0x4bab36
xor eax, eax
cmp eax, ebx
mov dword [esp + 0x39c], 0xffffffff
je 0x4bab4b
mov dword [ebp + 0x818], eax
mov ecx, dword [ebp + 0x818]
cmp ecx, ebx
je 0x4bab9e
push ebp
call fcn.0041d730
jmp 0x4bab9e
mov esi, dword [ebp + 0x818]
mov dword [ebp + 0x268], ebx
cmp esi, ebx
mov dword [ebp + 0x26c], ebx
mov byte [ebp + 0x4a1], 4
mov byte [ebp + 0x4a2], 4
mov byte [ebp + 0x4a3], 4
je 0x4bab9e
mov ecx, esi
call fcn.005a07e0
push esi
call fcn.006066eb
add esp, 4
mov dword [ebp + 0x818], ebx
mov eax, dword [ebp]
mov ecx, dword [0x6d67a8]
cmp eax, ecx
jne 0x4bae50
mov ecx, dword [0x6d6790]
mov eax, dword [0xd0af88]
mov esi, 1
add ecx, 0x2710
cmp eax, ebx
mov dword [0xa26e5c], esi
mov dword [0xcea2d4], ecx
jne 0x4babde
push ebx
call fcn.004e6ba0
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [0x6454a8], esi
cmp eax, ebx
jne 0x4bacc9
mov edx, dword [esp + 0x20]
mov ecx, 0x68d9e0
and edx, 0xffff
push edx
call fcn.00403bf0
cmp eax, 5
je 0x4bae15
push ebx
lea eax, [esp + 0x148]
push 0x645a20
push eax
mov dword [esp + 0x140], ebx
mov dword [esp + 0x1c0], ebx
mov dword [esp + 0x144], 0xc
mov dword [esp + 0x148], ebx
call fcn.006133d6
lea edi, [esp + 0x150]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x180]
mov dword [esp + 0x140], ecx
xor ecx, ecx
mov dword [edx - 0x30], ebx
mov edi, dword [esp + 0x140]
mov eax, ecx
add edx, 4
sub eax, edi
lea eax, [eax + eax*4]
shl eax, 1
mov dword [edx - 4], eax
inc ecx
cmp ecx, 0xc
jl 0x4bac65
mov eax, dword [ebp + 0x2d8]
mov dword [esp + 0x1b0], 0x12c
cmp eax, ebx
mov dword [esp + 0x1b8], 0x14
je 0x4bae15
mov eax, dword [ebp + 0x41c]
lea ecx, [ebp + 0x414]
lea edx, [esp + 0x134]
push edx
push 1
push eax
call fcn.004e2860
jmp 0x4bae15
mov esi, dword [esp + 0x14]
mov ecx, dword [0x6d6790]
push esi
lea edx, [esp + 0x1d0]
push 0x645a20
push edx
mov dword [0x6d7198], ecx
mov dword [esp + 0x1c8], esi
mov dword [esp + 0x248], ebx
mov dword [esp + 0x1cc], 0xc
mov dword [esp + 0x1d0], ebx
call fcn.006133d6
lea edi, [esp + 0x1d8]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x208]
mov dword [esp + 0x1c8], ecx
xor ecx, ecx
mov dword [edx - 0x30], ebx
mov edi, dword [esp + 0x1c8]
mov eax, ecx
add edx, 4
sub eax, edi
lea eax, [eax + eax*4]
shl eax, 1
mov dword [edx - 4], eax
inc ecx
cmp ecx, 0xc
jl 0x4bad30
mov eax, dword [ebp + 0x2d8]
mov dword [esp + 0x238], 0x12c
cmp eax, ebx
mov dword [esp + 0x240], 0x14
je 0x4bad8b
mov eax, dword [ebp + 0x41c]
lea ecx, [ebp + 0x414]
lea edx, [esp + 0x1bc]
push edx
push 1
push eax
call fcn.004e2860
mov eax, dword [0x6d6880]
mov ecx, 1
sub eax, esi
cmp eax, ecx
mov dword [0x6d6880], eax
jg 0x4bada6
mov dword [0x6d6880], ecx
cmp esi, 0x32
jl 0x4badcc
cmp esi, 0x96
jge 0x4badbe
mov word [ebp + 0x80c], 2
jmp 0x4badd3
xor ecx, ecx
cmp esi, 0x12c
setge cl
add ecx, 3
mov word [ebp + 0x80c], cx
push 0x6d67a8
mov ecx, 0xa234d8
call fcn.00475990
mov esi, dword [esp + 0x38]
xor edi, edi
and esi, 0x2000000
mov edx, esi
or edx, edi
jne 0x4badfe
mov ecx, 0x68d9e0
call fcn.004033a0
cmp word [ebp + 0x80c], bx
je 0x4bae15
or esi, edi
jne 0x4bae15
mov ecx, 0x68d9e0
call fcn.00406c30
mov ecx, dword [esp + 0x38]
xor eax, eax
or ecx, eax
je 0x4bb062
mov edx, dword [esp + 0x20]
mov ecx, 0x68ec20
and edx, 0xffff
push edx
call fcn.00413e40
cmp eax, ebx
je 0x4bb062
push eax
mov ecx, 0xce82a8
call fcn.004fcd20
jmp 0x4bb062
cmp dword [esp + 0x14], ebx
jne 0x4baf32
mov eax, dword [esp + 0x20]
mov ecx, 0x68d9e0
and eax, 0xffff
push eax
call fcn.00403bf0
cmp eax, 5
je 0x4bb062
push ebx
lea ecx, [esp + 0x2e0]
push 0x645a20
push ecx
mov dword [esp + 0x2d8], ebx
mov dword [esp + 0x358], ebx
mov dword [esp + 0x2dc], 0xc
mov dword [esp + 0x2e0], ebx
call fcn.006133d6
lea edi, [esp + 0x2e8]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x318]
mov dword [esp + 0x2d8], ecx
xor ecx, ecx
mov dword [edx - 0x30], ebx
mov edi, dword [esp + 0x2d8]
mov eax, ecx
add edx, 4
sub eax, edi
lea eax, [eax + eax*4]
shl eax, 1
mov dword [edx - 4], eax
inc ecx
cmp ecx, 0xc
jl 0x4baece
mov eax, dword [ebp + 0x2d8]
mov dword [esp + 0x348], 0x12c
cmp eax, ebx
mov dword [esp + 0x350], 0x14
je 0x4bb062
mov eax, dword [ebp + 0x41c]
lea ecx, [ebp + 0x414]
lea edx, [esp + 0x2cc]
push edx
push 1
push eax
call fcn.004e2860
jmp 0x4bb062
mov ecx, dword [ebp + 0x258]
mov eax, dword [ebp + 0x25c]
or ecx, eax
je 0x4bb062
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x254]
push esi
push 0x645a20
push edx
mov dword [esp + 0x250], esi
mov dword [esp + 0x2d0], ebx
mov dword [esp + 0x254], 0xc
mov dword [esp + 0x258], ebx
call fcn.006133d6
lea edi, [esp + 0x260]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x290]
mov dword [esp + 0x250], ecx
xor ecx, ecx
mov dword [edx - 0x30], ebx
mov edi, dword [esp + 0x250]
mov eax, ecx
add edx, 4
sub eax, edi
lea eax, [eax + eax*4]
shl eax, 1
mov dword [edx - 4], eax
inc ecx
cmp ecx, 0xc
jl 0x4bafa1
mov eax, dword [ebp + 0x2d8]
mov dword [esp + 0x2c0], 0x12c
cmp eax, ebx
mov dword [esp + 0x2c8], 0x14
je 0x4bb002
mov eax, dword [ebp + 0x41c]
lea ecx, [ebp + 0x414]
lea edx, [esp + 0x244]
mov edi, 1
push edx
push edi
push eax
call fcn.004e2860
jmp 0x4bb007
mov edi, 1
mov ecx, dword [ebp + 0xd8]
sub ecx, esi
mov eax, ecx
mov dword [ebp + 0xd8], ecx
cmp eax, edi
jg 0x4bb021
mov dword [ebp + 0xd8], edi
cmp esi, 0x32
jge 0x4bb02f
mov word [ebp + 0x80c], di
jmp 0x4bb057
cmp esi, 0x96
jge 0x4bb042
mov word [ebp + 0x80c], 2
jmp 0x4bb057
xor ecx, ecx
cmp esi, 0x12c
setge cl
add ecx, 3
mov word [ebp + 0x80c], cx
push ebp
mov ecx, 0xa234d8
call fcn.00475990
mov edx, dword [0x6d67a8]
mov eax, dword [esp + 0x40]
cmp eax, edx
jne 0x4bb0d6
cmp word [esp + 0x34], 0x5fff
ja 0x4bb0d6
mov eax, dword [ebp + 0xb8]
mov edx, dword [0x68e33c]
mov ecx, dword [0x6d6860]
add eax, edx
cmp eax, ecx
jl 0x4bb0d6
mov esi, dword [esp + 0x14]
cmp esi, ebx
jle 0x4bb0d6
mov eax, dword [ebp + 0xe4]
cmp eax, ebx
je 0x4bb0c1
mov ecx, dword [0x68e338]
imul ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
cmp edx, esi
jge 0x4bb0d6
mov edx, dword [esp + 0x20]
mov ecx, 0x68d9e0
and edx, 0xffff
push edx
call fcn.00407a70
cmp dword [ebp + 0x250], 7
je 0x4bbaa6
mov ax, word [ebp + 0x80c]
cmp ax, bx
jbe 0x4bbaa6
cmp ax, 5
jae 0x4bbaa6
mov eax, dword [esp + 0x38]
xor ecx, ecx
and eax, 0x2000000
or eax, ecx
jne 0x4bb9fe
mov eax, dword [0x6d67a8]
mov ecx, dword [ebp]
cmp ecx, eax
jne 0x4bb136
call fcn.005a44e0
add eax, 0x42
mov dword [0x68efb0], eax
call fcn.005a44e0
add eax, 0x42
mov dword [0x68efac], eax
push 1
push 1
mov ecx, ebp
call fcn.00451ca0
mov eax, dword [ebp]
cmp eax, 0x4000
jb 0x4bb49e
cmp eax, 0x5fff
ja 0x4bb49e
push ebp
call fcn.00413f10
add esp, 4
test eax, eax
jne 0x4bbaa6
lea ebx, [ebp + 0x444]
lea edx, [ebp + 0x434]
mov eax, ebx
mov dword [esp + 0x24], edx
mov esi, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0x54], esi
mov esi, dword [edx + 4]
mov dword [esp + 0x44], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x58], esi
mov edi, dword [edx + 8]
mov dword [esp + 0x48], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x5c], edi
mov edx, dword [edx + 0xc]
mov dword [esp + 0x4c], ecx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x60], edx
cmp eax, edx
mov dword [esp + 0x50], eax
jne 0x4bb1cd
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov esi, edx
jmp 0x4bb218
sub eax, edx
sub esi, edi
sar eax, 2
mov edx, eax
shl eax, 4
add eax, edx
lea eax, [eax + eax*4]
lea edx, [edx + eax*4]
mov eax, dword [esp + 0x44]
sub ecx, eax
mov eax, 0x2aaaaaab
mov dword [esp + 0x10], edx
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 1
mov ecx, edx
add edx, eax
shr ecx, 0x1f
mov eax, 0x2aaaaaab
add ecx, edx
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, ecx
lea esi, [eax + edx - 0x155]
mov edi, dword [esp + 0x24]
mov ecx, edi
mov edx, dword [ecx]
mov dword [esp + 0xd4], edx
mov eax, dword [ecx + 4]
mov dword [esp + 0xd8], eax
mov edx, dword [ecx + 8]
mov dword [esp + 0xdc], edx
mov eax, dword [ecx + 0xc]
lea ecx, [esp + 0xd4]
push ecx
lea ecx, [esp + 0x58]
mov dword [esp + 0xe4], eax
call fcn.0045b790
mov edx, ebx
mov dword [esp + 0x10], eax
mov eax, dword [edx]
mov dword [esp + 0xb4], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0xb8], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0xbc], eax
mov ecx, dword [edx + 0xc]
lea edx, [esp + 0x44]
mov dword [esp + 0xc0], ecx
push edx
lea ecx, [esp + 0xb8]
call fcn.0045b790
cmp dword [esp + 0x10], eax
jae 0x4bb32c
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov dword [eax], ecx
mov ecx, dword [esp + 0x6c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x70]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x74]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x78]
mov eax, esp
sub esp, 0x10
mov dword [eax], ecx
mov ecx, dword [esp + 0x8c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x90]
mov dword [eax + 8], ecx
mov ecx, esp
mov dword [eax + 0xc], edx
mov eax, edi
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0x3a4]
push ecx
call fcn.0045cba0
add esp, 0x34
test esi, esi
jbe 0x4bb3af
lea ecx, [ebp + 0x430]
call fcn.0045b650
dec esi
jne 0x4bb319
jmp 0x4bb3af
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
sub esp, 0x10
mov edx, esp
sub esp, 0x10
mov dword [edx], eax
mov eax, dword [esp + 0x7c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x80]
mov dword [edx + 8], eax
mov eax, dword [ebx]
mov dword [edx + 0xc], ecx
mov ecx, dword [ebx + 4]
mov edx, esp
sub esp, 0x10
mov dword [edx], eax
mov eax, dword [ebx + 8]
mov dword [edx + 4], ecx
mov ecx, dword [ebx + 0xc]
mov dword [edx + 8], eax
mov eax, dword [esp + 0x74]
mov dword [edx + 0xc], ecx
mov ecx, dword [esp + 0x78]
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x7c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x80]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea edx, [esp + 0x3b4]
push edx
call fcn.0045cc40
add esp, 0x34
test esi, esi
jbe 0x4bb3af
lea ecx, [ebp + 0x430]
call fcn.0045a570
dec esi
jne 0x4bb3a1
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4bb3eb
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp + 0xc4], ecx
mov ecx, dword [edi + 8]
mov dword [esp + 0xc8], edx
mov edx, dword [edi + 0xc]
mov dword [esp + 0xcc], ecx
push eax
lea ecx, [esp + 0xc8]
mov dword [esp + 0xd4], edx
call fcn.00474d40
mov esi, dword [ebp + 0x468]
lea ecx, [ebp + 0x460]
mov eax, esi
mov edx, dword [ecx + 4]
cmp eax, esi
je 0x4bb40e
mov edi, dword [eax]
add eax, 4
mov dword [edx], edi
add edx, 4
cmp eax, esi
jne 0x4bb400
mov eax, dword [ecx + 8]
mov dword [ecx + 8], edx
lea edx, [ebp + 0x424]
mov dword [esp + 0x28], eax
mov eax, dword [ecx + 8]
push edx
push 1
push eax
call fcn.00478080
mov si, word [ebp + 0x254]
mov ecx, dword [ebp + 0x464]
push esi
mov dword [ebp + 0x470], ecx
call fcn.0040eed0
add esp, 4
and esi, 0xffff
mov ecx, ebp
mov dword [ebp + 0x7f8], eax
push esi
push 7
call fcn.00476c30
mov eax, dword [ebp + 0x4a4]
test al, 2
je 0x4bb484
test al, 1
je 0x4bb484
mov edx, dword [ebp + 0x470]
mov dword [ebp + 0x378], 0x21
push 2
mov eax, dword [edx]
push eax
jmp 0x4bb9ee
mov edx, dword [ebp + 0x470]
mov dword [ebp + 0x378], 0
push 2
mov eax, dword [edx]
push eax
jmp 0x4bb9ee
mov eax, dword [esp + 0x20]
push 2
and eax, 0xffff
mov ecx, 0x68ec20
push eax
mov dword [esp + 0x30], eax
call fcn.00410e40
test eax, eax
je 0x4bb9fe
lea eax, [ebp + 0x444]
lea ecx, [ebp + 0x434]
mov dword [esp + 0x78], eax
mov dword [esp + 0x14], ecx
mov edx, dword [eax]
mov dword [esp + 0x68], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x6c], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x70], edx
mov ebx, dword [eax + 0xc]
mov eax, dword [ecx]
mov dword [esp + 0x74], ebx
mov dword [esp + 0x124], eax
mov edi, dword [ecx + 4]
mov esi, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
cmp ebx, ecx
jne 0x4bb51d
sub edx, esi
mov eax, 0x2aaaaaab
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x24], edx
jmp 0x4bb570
mov eax, ebx
sub edi, esi
sub eax, ecx
sar eax, 2
mov edx, eax
shl edx, 4
add edx, eax
lea edx, [edx + edx*4]
lea ebx, [eax + edx*4]
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x68]
sub edx, eax
mov eax, 0x2aaaaaab
imul edx
mov eax, ebx
sar edx, 1
mov ebx, edx
add edx, eax
shr ebx, 0x1f
mov eax, 0x2aaaaaab
add ebx, edx
imul edi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, ebx
mov ebx, dword [esp + 0x74]
lea edx, [eax + edx - 0x155]
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
mov dword [esp + 0x104], edx
mov edi, dword [eax + 4]
mov edx, dword [eax + 8]
mov dword [esp + 0x10c], edx
mov eax, dword [eax + 0xc]
cmp ecx, eax
jne 0x4bb5ab
mov eax, edx
sub esi, eax
mov eax, 0x2aaaaaab
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x10], edx
jmp 0x4bb5fc
sub ecx, eax
sar ecx, 2
mov eax, ecx
shl eax, 4
add eax, ecx
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x124]
sub esi, eax
mov eax, 0x2aaaaaab
lea ecx, [ecx + edx*4]
imul esi
sar edx, 1
mov esi, edx
add edx, ecx
mov ecx, dword [esp + 0x10c]
mov eax, 0x2aaaaaab
shr esi, 0x1f
sub edi, ecx
add esi, edx
imul edi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, esi
lea ecx, [eax + edx - 0x155]
mov dword [esp + 0x10], ecx
mov esi, dword [esp + 0x78]
mov edx, esi
mov edi, dword [edx]
mov eax, dword [edx + 4]
mov dword [esp + 0x7c], eax
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
cmp eax, ebx
jne 0x4bb62d
mov eax, dword [esp + 0x70]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
jmp 0x4bb676
sub eax, ebx
sub ecx, edi
sar eax, 2
mov edx, eax
shl eax, 4
add eax, edx
lea eax, [eax + eax*4]
lea ebx, [edx + eax*4]
mov eax, 0x2aaaaaab
imul ecx
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
sar edx, 1
mov edi, edx
sub eax, ecx
shr edi, 0x1f
add edx, ebx
mov ecx, eax
mov eax, 0x2aaaaaab
add edi, edx
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, edi
lea edx, [ecx + edx - 0x155]
cmp dword [esp + 0x10], edx
jae 0x4bb749
mov edx, dword [esi]
mov ecx, dword [esi + 8]
mov ebx, dword [esp + 0x14]
mov eax, dword [esi + 4]
mov dword [esp + 0xe4], edx
mov edx, dword [esi + 0xc]
mov dword [esp + 0xec], ecx
mov ecx, ebx
mov dword [esp + 0xf0], edx
mov dword [esp + 0xe8], eax
mov edx, dword [ecx]
mov dword [esp + 0xa4], edx
mov edx, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 0xa8], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0xac], eax
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0xb0], ecx
mov ecx, dword [edx]
mov dword [esp + 0x78], ecx
mov ecx, dword [edx + 4]
mov dword [esp + 0x7c], ecx
mov edi, dword [edx + 8]
cmp edi, eax
mov edx, dword [edx + 0xc]
mov dword [esp + 0x84], edx
je 0x4bb72d
lea ecx, [esp + 0xa4]
call fcn.0045cd90
mov esi, dword [eax + 8]
lea ecx, [esp + 0xe4]
call fcn.0045cd90
mov eax, dword [eax + 8]
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 8]
mov dword [eax + 8], ecx
mov eax, dword [esp + 0xac]
cmp edi, eax
jne 0x4bb6f4
mov esi, dword [esp + 0x24]
test esi, esi
jbe 0x4bb7c8
lea ecx, [ebp + 0x430]
call fcn.0045b650
dec esi
jne 0x4bb739
jmp 0x4bb7c8
mov ebx, dword [esp + 0x14]
sub esp, 0x10
mov edx, ebx
mov eax, esp
sub esp, 0x10
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, esp
mov edx, dword [edx + 0xc]
sub esp, 0x10
mov dword [eax + 0xc], edx
mov eax, esi
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov edx, dword [esi]
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 4]
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [esi + 8]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0x384]
push ecx
call fcn.0045cc40
mov esi, dword [esp + 0x58]
add esp, 0x34
test esi, esi
jbe 0x4bb7c8
lea ecx, [ebp + 0x430]
call fcn.0045a570
dec esi
jne 0x4bb7ba
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4bb80c
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 0xf4], edx
mov edx, dword [ebx + 8]
mov dword [esp + 0xf8], ecx
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0xfc], edx
lea edx, [esp + 0x364]
mov dword [esp + 0x100], ecx
push eax
push edx
lea ecx, [esp + 0xfc]
call fcn.0045b6e0
mov edx, dword [ebp + 0x468]
lea esi, [ebp + 0x460]
mov eax, edx
mov ecx, dword [esi + 4]
cmp eax, edx
je 0x4bb82f
mov edi, dword [eax]
add eax, 4
mov dword [ecx], edi
add ecx, 4
cmp eax, edx
jne 0x4bb821
mov eax, dword [esi + 8]
mov dword [esi + 8], ecx
mov edx, dword [esi + 0xc]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x78], eax
mov eax, dword [esi + 8]
sub edx, eax
mov dword [esp + 0x30], ecx
sar edx, 2
cmp edx, 1
mov edi, eax
jae 0x4bb8fd
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4bb86a
sub eax, ecx
sar eax, 2
cmp eax, 1
mov ebx, eax
ja 0x4bb86f
mov ebx, 1
mov ecx, esi
call fcn.00474340
add eax, ebx
mov dword [esp + 0x78], eax
jns 0x4bb880
xor eax, eax
shl eax, 2
push eax
call fcn.00613321
mov ecx, dword [esi + 4]
add esp, 4
mov ebx, eax
push ebx
push edi
push ecx
mov ecx, esi
call fcn.00478050
lea edx, [esp + 0x30]
mov ecx, esi
push edx
push 1
push eax
mov dword [esp + 0x34], eax
call fcn.00478290
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 8]
add eax, 4
push eax
push ecx
push edi
mov ecx, esi
call fcn.00478050
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
push edx
push eax
mov ecx, esi
call fcn.004e2bb0
mov ecx, dword [esi + 4]
push ecx
call fcn.006066eb
mov edx, dword [esp + 0x7c]
add esp, 4
mov ecx, esi
lea eax, [ebx + edx*4]
mov dword [esi + 0xc], eax
call fcn.00474340
lea ecx, [ebx + eax*4 + 4]
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
jmp 0x4bb98d
mov ecx, eax
sub ecx, edi
sar ecx, 2
cmp ecx, 1
jae 0x4bb94b
lea edx, [edi + 4]
mov ecx, esi
push edx
push eax
push edi
call fcn.00478050
mov eax, dword [esi + 8]
lea ecx, [esp + 0x30]
mov edx, eax
push ecx
sub edx, edi
mov ecx, 1
sar edx, 2
sub ecx, edx
push ecx
push eax
mov ecx, esi
call fcn.00478290
mov eax, dword [esi + 8]
cmp edi, eax
je 0x4bb989
mov edx, dword [esp + 0x30]
mov dword [edi], edx
add edi, 4
cmp edi, eax
jne 0x4bb93c
jmp 0x4bb989
lea ecx, [eax - 4]
push eax
push eax
mov dword [esp + 0x30], ecx
push ecx
mov ecx, esi
call fcn.00478050
mov ecx, dword [esi + 8]
lea eax, [ecx - 4]
cmp edi, eax
je 0x4bb975
mov edx, dword [eax - 4]
sub eax, 4
sub ecx, 4
cmp eax, edi
mov dword [ecx], edx
jne 0x4bb966
lea eax, [edi + 4]
cmp edi, eax
je 0x4bb989
mov ecx, dword [esp + 0x30]
mov dword [edi], ecx
add edi, 4
cmp edi, eax
jne 0x4bb97c
add dword [esi + 8], 4
mov si, word [ebp + 0x254]
mov edx, dword [ebp + 0x464]
push esi
mov dword [ebp + 0x470], edx
call fcn.0040eed0
add esp, 4
and esi, 0xffff
mov ecx, ebp
mov dword [ebp + 0x7f8], eax
push esi
push 7
call fcn.00476c30
mov eax, dword [ebp + 0x4a4]
test al, 2
je 0x4bb9d9
test al, 1
je 0x4bb9d9
mov dword [ebp + 0x378], 0x21
jmp 0x4bb9e3
mov dword [ebp + 0x378], 0
mov eax, dword [ebp + 0x470]
push 2
mov ecx, dword [eax]
push ecx
mov ecx, ebp
call fcn.0040db40
mov ecx, ebp
call fcn.00476d00
xor ebx, ebx
mov esi, dword [esp + 0x20]
push 3
and esi, 0xffff
mov ecx, 0x68ec20
push esi
call fcn.00410e40
test eax, eax
je 0x4bba31
push 3
push esi
push ebp
mov ecx, 0x68ec20
call fcn.00413ac0
push eax
push ebp
call fcn.0041b370
add esp, 8
mov esi, dword [esp + 0x90]
push 3
and esi, 0xffff
mov ecx, 0x68ec20
push esi
call fcn.00410e40
test eax, eax
je 0x4bba67
push 3
push esi
push ebp
mov ecx, 0x68ec20
call fcn.00413ac0
push eax
push ebp
call fcn.0041b370
add esp, 8
cmp dword [0x6729d0], ebx
je 0x4bbaa6
cmp word [esp + 0x34], 0x5fff
ja 0x4bba85
push ebp
call fcn.00413f10
add esp, 4
test eax, eax
jne 0x4bbaa6
xor edx, edx
push 0xd
mov dx, word [ebp + 0x80c]
mov ecx, 0x68ec20
push edx
push ebp
call fcn.00413ac0
push eax
push ebp
call fcn.0041b370
add esp, 8
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x64]
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jb 0x4ba777
mov ecx, dword [esp + 0x394]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x390
ret