Function at 0x4cef70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xde4]
xor ebx, ebx
cmp eax, ebx
jg 0x4cfc1b
mov al, byte [esi + 0xc71]
test al, al
push ebp
mov ebp, 1
je 0x4cefc8
mov al, byte [esi + 0xc72]
test al, al
jne 0x4cefba
push ebx
push 0x5fbea8
mov byte [esi + 0xc72], 1
call fcn.004fd170
mov ecx, esi
call fcn.004ca030
mov al, byte [esi + 0xc71]
test al, al
jne 0x4cfc1a
cmp dword [esi + 0x72c], ebx
jne 0x4cefdb
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 4]
call fcn.00401140
mov al, byte [esi + 0x738]
test al, al
je 0x4cf03b
mov eax, dword [esi + 0x73c]
cmp eax, ebx
je 0x4cfc1a
mov cl, byte [eax + 0x18]
test cl, cl
je 0x4cfc1a
cmp dword [eax + 0x14], ebp
jne 0x4cfc1a
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [esi + 0x73c]
mov edx, dword [ecx + 0x10]
and eax, 0x7fffffff
sub eax, edx
cmp eax, 0x3a98
jl 0x4cfc1a
push ebx
push esi
call fcn.004197a0
add esp, 8
pop ebp
pop esi
pop ebx
add esp, 0x64
ret 4
cmp dword [esi + 0x898], ebx
je 0x4cf064
mov edx, dword [esi]
mov ecx, esi
mov dword [esi + 0x898], ebx
call dword [edx + 0x5c]
xor ecx, ecx
cmp eax, ebx
sete cl
push ebp
push ecx
mov ecx, dword [esi + 0x7fc]
call fcn.0041d400
cmp dword [esi + 0x8a8], ebx
je 0x4cf0f2
mov ecx, dword [esi + 0x8b0]
mov edx, dword [esi]
xor eax, eax
mov al, byte [esi + 0x8b4]
mov dword [esi + 0x8a8], ebx
push eax
mov eax, dword [esi + 0x8ac]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x6c]
cmp eax, 2
jne 0x4cf0ab
mov ecx, dword [esi + 0x8ac]
push ecx
lea ecx, [esi + 0x868]
call fcn.00486ad0
mov eax, dword [esi + 0x8ac]
cmp eax, ebx
je 0x4cf0c4
push eax
call fcn.005ddc00
add esp, 4
mov dword [esi + 0x8ac], ebx
mov eax, dword [esi + 0x8b0]
cmp eax, ebx
je 0x4cf0dd
push eax
call fcn.005ddc00
add esp, 4
mov dword [esi + 0x8b0], ebx
mov ecx, dword [esi + 0x7fc]
push 2
push ebx
mov byte [esi + 0x8b4], 0
call fcn.0041d400
cmp dword [esi + 0x8a4], ebx
je 0x4cf123
mov eax, dword [esi + 0x744]
mov edx, dword [esi]
push eax
mov ecx, esi
mov dword [esi + 0x8a4], ebx
call dword [edx + 0x60]
xor ecx, ecx
test al, al
sete cl
push 3
push ecx
mov ecx, dword [esi + 0x7fc]
call fcn.0041d400
lea ecx, [esi + 0x24]
call fcn.0045c8c0
test eax, eax
jne 0x4cfc1a
mov edx, dword [esi + 0x7fc]
cmp dword [edx + 0x14], ebx
jne 0x4cfc1a
cmp dword [esi + 0x72c], ebx
jne 0x4cfc1a
mov al, byte [esi + 0x730]
test al, al
jne 0x4cfc1a
cmp dword [esi + 0x7b8], ebx
je 0x4cfc1a
cmp dword [esi + 0x79c], ebx
jne 0x4cfc1a
push edi
mov edi, dword [sym.imp.WINMM.dll_timeGetTime]
call edi
and eax, 0x7fffffff
mov dword [esp + 0x14], eax
cmp dword [esi + 0x5e8], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x28], ebx
je 0x4cf1cf
lea eax, [esp + 0x30]
push eax
call fcn.00504790
add esp, 4
test eax, eax
je 0x4cf1cf
mov ecx, dword [esi + 0x860]
cmp ecx, ebx
je 0x4cf1ba
call fcn.00485e30
test eax, eax
jne 0x4cf1cf
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
push edx
lea ecx, [esi + 0x5e0]
call fcn.004605c0
call edi
mov edi, eax
mov eax, dword [esi + 0x8f8]
and edi, 0x7fffffff
cmp eax, ebx
je 0x4cf207
cmp dword [esi + 0x8f4], ebx
je 0x4cf207
call dword [0x5f64d8]
sub edi, dword [esi + 0x8f8]
cmp edi, eax
jle 0x4cf207
mov dword [esi + 0x8f8], ebx
mov dword [esi + 0x8f4], ebx
mov dword [esp + 0x18], esi
call fcn.0041d180
mov ecx, dword [esi + 0xc28]
call fcn.00509970
mov ecx, dword [esi + 0xc2c]
mov dword [esp + 0x20], eax
call fcn.005117b0
mov ecx, dword [esi + 0xc24]
call fcn.00514db0
lea eax, [esi + 0xc3c]
push ebx
push eax
call fcn.0050ec70
mov eax, dword [esi + 0xc34]
lea edi, [esi + 0xc34]
add esp, 8
cmp eax, ebx
je 0x4cf377
mov ecx, dword [esi + 0x1c]
push 0x80
push ecx
lea ecx, [esp + 0x6c]
call fcn.004c03c0
lea edx, [esp + 0x64]
mov dword [esi + 0xc38], edx
mov ecx, dword [edi]
cmp ecx, ebx
je 0x4cf291
jmp 0x4cf280
call fcn.0051e840
mov edi, dword [edi]
mov ecx, dword [edi + 0xc]
add edi, 0xc
cmp ecx, ebx
jne 0x4cf280
mov eax, dword [esi + 0xc34]
cmp eax, ebx
lea edi, [esi + 0xc34]
je 0x4cf368
mov eax, dword [edi]
cmp dword [eax + 0xb4], ebx
je 0x4cf2b7
lea edi, [eax + 0xc]
jmp 0x4cf360
mov eax, dword [eax + 4]
push eax
push esi
lea ecx, [esp + 0x58]
call fcn.004880e0
mov ecx, dword [edi]
call fcn.0051d2f0
mov ecx, dword [edi]
call fcn.0051c9f0
mov ecx, dword [edi]
call fcn.0051c960
mov ecx, dword [edi]
call fcn.0051e660
mov ecx, dword [edi]
cmp dword [ecx + 0xb8], ebx
je 0x4cf50e
mov ebp, dword [ecx + 0x94]
cmp ebp, ebx
je 0x4cf4ed
lea ecx, [ecx]
mov ecx, dword [ebp + 0xb8]
cmp ecx, ebx
je 0x4cf30f
call fcn.00522300
mov ebp, dword [ebp + 0x14]
cmp ebp, ebx
jne 0x4cf300
mov eax, dword [edi]
mov ebp, dword [eax + 0x94]
cmp ebp, ebx
je 0x4cf341
mov al, byte [ebp + 0x221]
test al, al
je 0x4cf33a
mov ecx, ebp
call fcn.00523e70
mov byte [ebp + 0x221], 0
mov ebp, dword [ebp + 0x14]
cmp ebp, ebx
jne 0x4cf322
mov ecx, dword [edi]
call fcn.0051ca30
mov ecx, dword [esp + 0x20]
mov edi, dword [edi]
or ecx, eax
mov dword [esp + 0x20], ecx
add edi, 0xc
lea ecx, [esp + 0x50]
call fcn.00486bf0
cmp dword [edi], ebx
jne 0x4cf2a5
lea ecx, [esp + 0x64]
mov dword [esi + 0xc38], ebx
call fcn.00552d30
cmp dword [esp + 0x20], ebx
mov ebp, dword [esp + 0x78]
je 0x4cf3ab
cmp ebp, ebx
je 0x4cf3ab
fld qword [esi + 0x7b0]
fstp qword [esp + 0x20]
fld qword [esp + 0x20]
fistp dword [esp + 0x78]
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x78]
jge 0x4cf3ab
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x98]
mov ecx, dword [esi + 0xc44]
cmp ecx, ebx
je 0x4cf3ba
call fcn.00443c30
mov ecx, dword [esi + 0xc40]
cmp ecx, ebx
je 0x4cf3ca
push esi
call fcn.00438d30
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 8]
cmp ecx, ebx
je 0x4cf45f
call fcn.0048c250
lea eax, [esi + 0x288]
push eax
lea ecx, [esp + 0x3c]
call fcn.00477a80
lea ecx, [esp + 0x38]
call fcn.00477ad0
cmp eax, ebx
mov dword [esp + 0x78], eax
je 0x4cf456
mov edi, edi
mov ecx, dword [esp + 0x78]
mov eax, dword [ecx + 0xa4]
test eax, eax
je 0x4cf443
mov edi, ecx
call fcn.004a63e0
mov ebx, dword [eax + 0x28]
test ebx, ebx
je 0x4cf443
mov ecx, ebx
call fcn.004b2270
test eax, eax
je 0x4cf443
mov al, byte [ebx + 0x12f]
test al, al
jne 0x4cf443
mov edx, dword [edi + 0x2c]
mov eax, dword [edx + 0x5c0]
test ah, 8
je 0x4cf55e
lea ecx, [esp + 0x38]
call fcn.00477ad0
test eax, eax
mov dword [esp + 0x78], eax
jne 0x4cf400
xor ebx, ebx
lea ecx, [esp + 0x38]
call fcn.00477aa0
cmp ebp, ebx
je 0x4cf6ae
fld qword [esi + 0x7b0]
fstp qword [esp + 0x20]
fld qword [esp + 0x20]
fistp dword [esp + 0x78]
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x78]
jge 0x4cf6ae
mov ecx, dword [esi + 0x594]
call fcn.00440f70
mov ecx, esi
call fcn.004c70b0
cmp dword [esi + 0x5e8], ebx
je 0x4cf4da
lea ecx, [esp + 0x30]
push ecx
call fcn.00504790
add esp, 4
test eax, eax
je 0x4cf4da
mov ecx, dword [esi + 0x860]
cmp ecx, ebx
je 0x4cf4c5
call fcn.00485e30
test eax, eax
jne 0x4cf4da
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push edx
push eax
lea ecx, [esi + 0x5e0]
call fcn.00460620
lea ecx, [esp + 0x18]
call fcn.004b8060
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x64
ret 4
cmp dword [ecx + 4], ebx
jne 0x4cf316
cmp ecx, ebx
mov edx, dword [ecx + 0xc]
mov dword [edi], edx
je 0x4cf357
mov eax, dword [ecx]
push 1
call dword [eax]
jmp 0x4cf357
mov ecx, dword [ecx + 0x5c]
call fcn.0050c810
test eax, eax
jne 0x4cf316
mov ebp, dword [edi]
mov ecx, dword [ebp + 0xc]
mov dword [edi], ecx
cmp dword [ebp + 4], ebx
je 0x4cf550
mov ecx, ebp
call fcn.0051d060
test eax, eax
mov ecx, ebp
je 0x4cf54a
call fcn.0051cb20
mov edx, dword [ebp]
push 1
mov ecx, ebp
call dword [edx]
jmp 0x4cf357
push ebx
call fcn.0051ca90
mov edx, dword [ebp]
push 1
mov ecx, ebp
call dword [edx]
jmp 0x4cf357
mov edi, dword [edi + 0x40]
mov ecx, ebx
call fcn.00489830
sub eax, edi
mov ecx, esi
mov dword [esp + 0x10], eax
call fcn.004b5360
cmp eax, 5
jle 0x4cf67d
fld qword [esi + 0x7b0]
fstp qword [esp + 0x20]
fld qword [esp + 0x20]
fistp dword [esp + 0x28]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 0x680]
sub eax, edx
mov dword [esi + ecx*4 + 0x66c], eax
mov eax, dword [esi + 0x680]
inc eax
cdq
mov ecx, 5
idiv ecx
xor eax, eax
xor ebp, ebp
mov edi, ecx
mov dword [esi + 0x680], edx
lea edx, [esi + 0x66c]
mov ecx, dword [edx]
cmp ebp, ecx
jg 0x4cf5d0
mov ebp, ecx
add eax, ecx
add edx, 4
dec edi
jne 0x4cf5c8
sub eax, ebp
cdq
and edx, 3
add eax, edx
mov edi, eax
sar edi, 2
cmp edi, 0xa
jle 0x4cf659
cmp edi, 0x3e8
jge 0x4cf659
mov ebp, dword [esi + 0x584]
fld qword [ebp + 0x208]
call fcn.004fb6b0
fld qword [ebp + 0x208]
add edi, eax
fmul qword [0x5f66e8]
mov eax, dword [ebx + 0x38]
mov edx, dword [eax]
mov eax, dword [eax + 4]
fstp qword [esp + 0x20]
sar edx, 2
and edx, 3
mov ecx, dword [edx*4 + 0x5fb068]
shl eax, cl
lea ecx, [eax + eax*4]
shl ecx, 1
mov eax, 0x4a4dc96f
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
fld qword [esp + 0x20]
fistp dword [esp + 0x28]
mov eax, dword [esp + 0x28]
add eax, edi
cdq
idiv ecx
add dword [esp + 0x10], eax
jmp 0x4cf67d
test ebp, ebp
jle 0x4cf67d
xor ecx, ecx
mov dword [esi + 0x66c], ecx
mov dword [esi + 0x670], ecx
mov dword [esi + 0x674], ecx
mov dword [esi + 0x678], ecx
mov dword [esi + 0x67c], ecx
mov eax, dword [esp + 0x10]
test eax, eax
mov edx, dword [esp + 0x78]
mov dword [esp + 0x28], edx
lea ecx, [esp + 0x38]
jg 0x4cf6a9
call fcn.00477aa0
lea ecx, [esp + 0x18]
call fcn.004b8060
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x64
ret 4
call fcn.00477aa0
lea ecx, [esp + 0x18]
call fcn.004b8060
fild dword [esp + 0x14]
mov ecx, dword [esi + 0x584]
mov ebx, dword [esp + 0x10]
fadd qword [ecx + 0x208]
xor ebp, ebp
cmp ebx, ebp
fstp qword [esi + 0x7b0]
je 0x4cfa26
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], ebp
lea eax, [esi + 0x280]
push eax
lea ecx, [esp + 0x48]
call fcn.00477a80
lea ecx, [esp + 0x44]
call fcn.00477ad0
mov edi, eax
test edi, edi
je 0x4cf78c
mov eax, dword [edi + 0xa4]
test eax, eax
je 0x4cf76e
mov ecx, edi
call fcn.004a63e0
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x4cf76e
cmp edi, dword [esp + 0x28]
je 0x4cf76e
mov ecx, edi
call fcn.004a63e0
mov eax, dword [eax + 0x28]
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x4cf76e
mov ecx, dword [eax + 0x28]
test ecx, ecx
jne 0x4cf76e
mov edx, dword [edi + 0x2c]
mov eax, dword [edx + 0x5c0]
test ah, 8
jne 0x4cf76e
mov ebx, dword [edi + 0x40]
mov ecx, edi
call fcn.004a63e0
mov ecx, dword [eax + 0x28]
call fcn.00489830
cmp eax, ebx
jge 0x4cf76e
mov ecx, edi
call fcn.004a63e0
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x4cf779
push 0
mov ecx, edi
push 1
call fcn.004ada60
lea ecx, [esp + 0x44]
call fcn.00477ad0
mov edi, eax
test edi, edi
jne 0x4cf706
lea ecx, [esp + 0x44]
call fcn.00477aa0
mov al, byte [esi + 0xc55]
test al, al
je 0x4cf7e4
lea eax, [esi + 0x280]
push eax
lea ecx, [esp + 0x54]
mov byte [esi + 0xc55], 0
call fcn.00477a80
lea ecx, [esp + 0x50]
call fcn.00477ad0
test eax, eax
je 0x4cf7db
mov ecx, dword [eax + 0xb4]
call fcn.004abaa0
lea ecx, [esp + 0x50]
call fcn.00477ad0
test eax, eax
jne 0x4cf7c3
lea ecx, [esp + 0x50]
call fcn.00477aa0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x4cf7f0
call fcn.005530d0
mov ecx, dword [esi + 0x594]
call fcn.004413c0
mov ecx, esi
call fcn.004c70b0
mov eax, dword [esi + 0x558]
mov ecx, dword [esi + 0x554]
push eax
call fcn.00479d50
mov eax, dword [esi + 0x5e8]
test eax, eax
je 0x4cf861
mov eax, dword [esi + 0x7f8]
test eax, eax
jne 0x4cf861
lea ecx, [esp + 0x18]
push ecx
call fcn.00504790
add esp, 4
test eax, eax
je 0x4cf861
mov ecx, dword [esi + 0x860]
test ecx, ecx
je 0x4cf84c
call fcn.00485e30
test eax, eax
jne 0x4cf861
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
lea ecx, [esi + 0x5e0]
call fcn.00460680
push 0
mov ecx, esi
call fcn.00485d70
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x4cf876
call fcn.00553870
lea eax, [esi + 0x290]
push eax
lea ecx, [esp + 0x68]
call fcn.00477a80
lea ecx, [esp + 0x64]
call fcn.00477ad0
mov ebp, eax
test ebp, ebp
je 0x4cf9c0
lea esp, [esp]
mov ecx, dword [ebp + 0x2c]
call fcn.0049e430
test eax, eax
je 0x4cf9ad
mov ecx, dword [ebp + 0x2c]
call fcn.0049e460
test al, al
jne 0x4cf9ad
mov ecx, dword [ebp + 0x2c]
call fcn.0049e430
push ebp
lea ecx, [esi + 0x290]
mov ebx, eax
call fcn.004792c0
mov eax, dword [esi + 0x864]
test eax, eax
jne 0x4cf8fb
mov eax, dword [esi + 0xc74]
test eax, eax
je 0x4cf909
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x4cf909
mov eax, dword [eax + 0x2c]
test eax, eax
je 0x4cf909
mov eax, dword [eax + 0xac]
test eax, eax
je 0x4cf909
mov edi, eax
jmp 0x4cf912
mov ecx, dword [esi + 0x584]
mov edi, dword [ecx + 0x54]
lea edx, [esp + 0x38]
push edx
mov ecx, ebx
call fcn.0040dba0
mov eax, dword [eax]
push 0
push eax
push edi
mov ecx, esi
call fcn.004c2b80
mov edi, eax
mov eax, dword [esp + 0x38]
push eax
call fcn.005ddc00
xor eax, eax
add esp, 4
cmp edi, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
jne 0x4cf94f
mov edi, dword [ebp + 0x2c]
mov ebx, dword [ebx + 0x28]
push 0x405bc0
push 1
push 4
lea ecx, [esp + 0x84]
push ecx
call entry0
push edi
lea ecx, [esp + 0x7c]
call fcn.00476a20
mov ecx, dword [ebp + 0x2c]
call fcn.0049e450
test ebx, ebx
je 0x4cf997
push 0
push 1
lea edx, [esp + 0x80]
push edx
push str.onLoadInit
push ebx
mov ecx, esi
call fcn.004c82e0
push 0x401400
push 1
push 4
lea eax, [esp + 0x84]
push eax
call fcn.00401030
lea ecx, [esp + 0x64]
call fcn.00477ad0
mov ebp, eax
test ebp, ebp
jne 0x4cf8a0
mov eax, dword [esi + 0x5e8]
test eax, eax
je 0x4cfa0d
mov eax, dword [esi + 0x7f8]
test eax, eax
jne 0x4cfa0d
lea ecx, [esp + 0x18]
push ecx
call fcn.00504790
add esp, 4
test eax, eax
je 0x4cfa0d
mov ecx, dword [esi + 0x860]
test ecx, ecx
je 0x4cf9f8
call fcn.00485e30
test eax, eax
jne 0x4cfa0d
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
lea ecx, [esi + 0x5e0]
call fcn.004606e0
lea ecx, [esp + 0x64]
call fcn.00477aa0
dec dword [esp + 0x20]
jne 0x4cf6e3
mov ebx, dword [esp + 0x10]
xor ebp, ebp
mov ecx, dword [esi + 0xc30]
push ebp
push 2
dec ebx
call fcn.0051bff0
mov edi, dword [esi + 0xc34]
cmp edi, ebp
je 0x4cfa56
nop
mov ecx, dword [edi + 0xbc]
cmp ecx, ebp
je 0x4cfa4f
call fcn.00435310
mov edi, dword [edi + 0xc]
cmp edi, ebp
jne 0x4cfa40
push ebp
push esi
lea ecx, [esi + 0x820]
call fcn.004b5b70
push ebp
mov ecx, esi
call fcn.004ccc90
lea ecx, [esi + 0x640]
call fcn.004cc940
mov ecx, esi
call fcn.004b7fe0
cmp dword [esi + 0x780], ebp
je 0x4cfa99
lea ecx, [esi + 0x7c4]
push ecx
mov ecx, esi
call fcn.004bf150
mov dword [esi + 0x780], ebp
cmp dword [esi + 0x538], ebp
jne 0x4cfad6
cmp dword [esi + 0x6b4], ebp
jne 0x4cfad6
mov eax, dword [esi + 0x7c0]
cmp eax, ebp
jl 0x4cfad6
push ebp
push eax
lea edi, [esi + 0x7c4]
push edi
mov ecx, esi
call fcn.004ce180
mov edx, dword [esi + 0x7c8]
mov eax, dword [edi]
push edx
push eax
push 2
mov ecx, esi
call fcn.004ba8d0
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x98]
cmp dword [esi + 0x658], ebp
je 0x4cfbb4
call dword [sym.imp.WINMM.dll_timeGetTime]
mov edx, dword [esi + 0x584]
mov ecx, eax
mov eax, dword [esp + 0x14]
and ecx, 0x7fffffff
sub ecx, eax
mov dword [esp + 0x78], ecx
fild dword [esp + 0x78]
fcomp qword [edx + 0x208]
fnstsw ax
test ah, 0x41
je 0x4cfb46
cmp ebx, 1
jg 0x4cfb46
fld qword [edx + 0x208]
fmul qword [0x5f7998]
fstp qword [esp + 0x28]
fld qword [esp + 0x28]
fistp dword [esp + 0x78]
cmp ecx, dword [esp + 0x78]
jge 0x4cfb4c
inc dword [esi + 0x688]
jmp 0x4cfb4c
inc dword [esi + 0x684]
mov edx, dword [esi + 0x68c]
inc edx
mov eax, edx
cmp eax, 4
mov dword [esi + 0x68c], edx
jle 0x4cfbae
cmp dword [esi + 0x65c], 0xa
jle 0x4cfbae
mov ecx, dword [esi + 0x654]
mov edx, 2
cmp ecx, edx
jne 0x4cfb8d
mov ecx, dword [esi + 0x684]
lea ecx, [ecx + ecx*2]
cmp ecx, eax
jle 0x4cfbae
mov dword [esi + 0x654], ebp
jmp 0x4cfba0
mov ecx, dword [esi + 0x688]
lea ecx, [ecx + ecx*2]
cmp ecx, eax
jle 0x4cfbae
mov dword [esi + 0x654], edx
mov ecx, esi
push edx
mov dword [esi + 0x65c], ebp
call fcn.004c8770
inc dword [esi + 0x65c]
mov ecx, dword [esi + 0x1c]
add ecx, 0x340
call fcn.005dc4b0
mov edx, dword [esi + 0x1c]
mov ecx, dword [edx + 0x324]
call fcn.005da820
lea ecx, [esi + 0x24]
call fcn.00457e90
cmp dword [esi + 0x5e8], ebp
je 0x4cfc19
lea eax, [esp + 0x30]
push eax
call fcn.00504790
add esp, 4
test eax, eax
je 0x4cfc19
mov ecx, dword [esi + 0x860]
cmp ecx, ebp
je 0x4cfc04
call fcn.00485e30
test eax, eax
jne 0x4cfc19
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
push edx
lea ecx, [esi + 0x5e0]
call fcn.00460620
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x64
ret 4