Function at 0x4336d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x76b8
call fcn.0047f1f0
mov eax, dword [0x4a0080]
xor eax, esp
mov dword [esp + 0x76b4], eax
mov eax, dword [0x4bc58c]
push esi
push edi
cmp eax, dword [0x4bc590]
je 0x4364aa
movss xmm0, dword [0x492488]
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movss dword [esp + 0x58], xmm0
mov dword [0x4bc108], 0
mov dword [esp + 0x5c], eax
nop dword [eax + eax]
shl eax, 4
add eax, dword [0x4bc58c]
movups xmm0, xmmword [eax]
movd eax, xmm0
movaps xmmword [esp + 0x60], xmm0
mov dword [esp + 0x30], eax
cmp eax, dword [0x4bc11c]
jne 0x43375c
cmp dword [esp + 0x64], 0
je 0x436472
cmp byte [0x4bc09c], 0
je 0x43378f
push 0
push 4
lea eax, [esp + 0x350]
mov dword [esp + 0x350], 0x42960000
push eax
mov eax, dword [0x4bc11c]
add eax, 0xdfd8
push eax
push dword [0x4bc090]
call esi
cmp byte [0x4bc0fe], 0
push 0
push 4
je 0x4337b6
movss xmm0, dword [0x4a0380]
lea eax, [esp + 0x360]
movss dword [esp + 0x360], xmm0
jmp 0x4337c8
mov dword [esp + 0x370], 0x3fe66666
lea eax, [esp + 0x370]
push eax
mov eax, dword [0x4bc11c]
add eax, 0xdfd4
push eax
push dword [0x4bc090]
call esi
cmp byte [0x4bc0af], 0
je 0x43381c
push 0x20
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x43381c
push 0
push 4
lea eax, [esp + 0x37c]
mov dword [esp + 0x37c], 0x41880000
push eax
mov eax, dword [0x4bc11c]
add eax, 0xe980
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
test eax, eax
jne 0x433877
push eax
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0x90
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2bf]
mov byte [esp + 0x2bf], 0xae
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 1
jne 0x4338ce
push 0
push eax
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0xa0
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2c0]
mov byte [esp + 0x2c0], 0xae
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 2
jne 0x433926
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0xb0
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2c1]
mov byte [esp + 0x2c1], 0xae
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 3
jne 0x43397e
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0xc0
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2c2]
mov byte [esp + 0x2c2], 0xae
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 4
jne 0x4339d6
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0xd0
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2c3]
mov byte [esp + 0x2c3], 0xae
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 5
jne 0x433a2e
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0xe0
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2c4]
mov byte [esp + 0x2c4], 0xae
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 6
jne 0x433a86
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0xf0
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2c5]
mov byte [esp + 0x2c5], 0xae
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 7
jne 0x433ade
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2c6]
mov byte [esp + 0x2c6], 0xaf
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 8
jne 0x433b36
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0x10
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2c7]
mov byte [esp + 0x2c7], 0xaf
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 9
jne 0x433b8e
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0x20
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2c8]
mov byte [esp + 0x2c8], 0xaf
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 0xa
jne 0x433be6
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0x30
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2c9]
mov byte [esp + 0x2c9], 0xaf
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 0xb
jne 0x433c3e
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0x40
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2ca]
mov byte [esp + 0x2ca], 0xaf
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 0xc
jne 0x433c96
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0x80
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2cb]
mov byte [esp + 0x2cb], 0xae
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 0xd
jne 0x433cee
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0x70
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2cc]
mov byte [esp + 0x2cc], 0xae
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 0xe
jne 0x433d46
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0x60
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2cd]
mov byte [esp + 0x2cd], 0xae
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 0xf
jne 0x433d9e
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0x50
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2d1]
mov byte [esp + 0x2d1], 0xae
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 0x10
jne 0x433df6
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0x40
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2d2]
mov byte [esp + 0x2d2], 0xae
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 0x11
jne 0x433e4e
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0x30
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2d3]
mov byte [esp + 0x2d3], 0xae
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 0x12
jne 0x433ea6
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0x20
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2d4]
mov byte [esp + 0x2d4], 0xae
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 0x13
jne 0x433efe
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0x10
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2d0]
mov byte [esp + 0x2d0], 0xae
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 0x14
jne 0x433f56
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2d5]
mov byte [esp + 0x2d5], 0xae
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 0x15
jne 0x433fae
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0xf0
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2d7]
mov byte [esp + 0x2d7], 0xad
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 0x16
jne 0x434006
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0xe0
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2d8]
mov byte [esp + 0x2d8], 0xaf
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 0x17
jne 0x43405e
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0xd0
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2d6]
mov byte [esp + 0x2d6], 0xad
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
mov eax, dword [0x4a0384]
cmp eax, 0x18
jne 0x4340b1
push 0
push 1
lea eax, [esp + 0x2ae]
mov byte [esp + 0x2ae], 0xc0
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f92
push eax
push dword [0x4bc090]
call esi
push 0
push 1
lea eax, [esp + 0x2d9]
mov byte [esp + 0x2d9], 0xad
push eax
mov eax, dword [0x4bc128]
add eax, 0x7d4f93
push eax
push dword [0x4bc090]
call esi
cmp byte [0x4bc09f], 0
je 0x4340ff
push 0x42
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0
push 1
test ax, ax
je 0x4340dc
mov byte [esp + 0x2da], 1
lea eax, [esp + 0x2da]
jmp 0x4340eb
mov byte [esp + 0x2db], 0
lea eax, [esp + 0x2db]
push eax
mov eax, dword [0x4bc128]
add eax, 0x43e357
push eax
push dword [0x4bc090]
call esi
cmp byte [0x4bc0fc], 0
push 0
push 4
je 0x434120
mov dword [esp + 0x380], 0xc22a0000
lea eax, [esp + 0x380]
jmp 0x434132
mov dword [esp + 0x378], 0
lea eax, [esp + 0x378]
push eax
mov eax, dword [0x4bc11c]
add eax, 0xdcd0
push eax
push dword [0x4bc090]
call esi
push 0
push 4
lea eax, [esp + 0x34c]
push eax
mov eax, dword [0x4bc128]
add eax, 0x1224db8
push eax
push dword [0x4bc090]
call edi
mov eax, dword [esp + 0x344]
mov dword [esp + 0x14], eax
add eax, 0x58
cmp byte [0x4bc0a5], 0
push 0
push 4
je 0x43419a
movss xmm0, dword [0x4a0108]
lea ecx, [esp + 0x354]
movss dword [esp + 0x354], xmm0
jmp 0x4341ac
mov dword [esp + 0x358], 0x3b23d70a
lea ecx, [esp + 0x358]
push ecx
push eax
push dword [0x4bc090]
call esi
cmp byte [0x4bc10d], 0
push 0
push 4
je 0x4341d7
mov dword [esp + 0x374], 2
lea eax, [esp + 0x374]
jmp 0x4341e9
mov dword [esp + 0x348], 3
lea eax, [esp + 0x348]
push eax
mov eax, dword [0x4bc128]
add eax, 0x484ddf
push eax
push dword [0x4bc090]
call esi
cmp byte [0x4bc064], 0
push 0
push 1
je 0x43421b
mov byte [esp + 0x2ce], 1
lea eax, [esp + 0x2ce]
jmp 0x43422a
mov byte [esp + 0x2cf], 0
lea eax, [esp + 0x2cf]
push eax
mov eax, dword [0x4bc128]
add eax, 0x43deda
push eax
push dword [0x4bc090]
call esi
mov ecx, dword [esp + 0x14]
add ecx, 0x4c
cmp byte [0x4bc10e], 0
push 0
push 4
je 0x434266
mov dword [esp + 0x344], 0x34a10fb0
lea eax, [esp + 0x344]
jmp 0x434278
mov dword [esp + 0x340], 0x42700000
lea eax, [esp + 0x340]
push eax
push ecx
push dword [0x4bc090]
call esi
mov eax, dword [esp + 0x14]
add eax, 0xc
cmp byte [0x4bc0ad], 0
push 0
push 4
je 0x4342aa
mov dword [esp + 0x33c], 0
lea ecx, [esp + 0x33c]
jmp 0x4342bc
mov dword [esp + 0x338], 0x3f8ccccd
lea ecx, [esp + 0x338]
push ecx
push eax
push dword [0x4bc090]
call esi
mov eax, dword [esp + 0x14]
add eax, 0x1c
cmp byte [0x4bc096], 0
push 0
push 4
je 0x4342ee
mov dword [esp + 0x334], 0
lea ecx, [esp + 0x334]
jmp 0x434300
mov dword [esp + 0x330], 0x3f99999a
lea ecx, [esp + 0x330]
push ecx
push eax
push dword [0x4bc090]
call esi
cmp byte [0x4bc096], 0
push 0
push 4
je 0x43432b
mov dword [esp + 0x35c], 0
lea eax, [esp + 0x35c]
jmp 0x43433d
mov dword [esp + 0x32c], 0x3f99999a
lea eax, [esp + 0x32c]
push eax
mov eax, dword [esp + 0x20]
add eax, 0x1c
push eax
push dword [0x4bc090]
call esi
cmp byte [0x4bc0ff], 0
je 0x434381
push 0
push 4
lea eax, [esp + 0x328]
mov dword [esp + 0x328], 0x3f99999a
push eax
mov eax, dword [0x4bc11c]
add eax, 0xdf00
push eax
push dword [0x4bc090]
call esi
mov esi, dword [esp + 0x30]
lea eax, [esp + 0x31c]
push 0
push 4
push eax
lea eax, [esi + 0x2df4]
push eax
push dword [0x4bc090]
call edi
movss xmm0, dword [esp + 0x31c]
mov eax, esi
or eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x68]
movss dword [esp + 0x18], xmm0
je 0x4352a7
cmp ecx, 0x20
je 0x4343cd
cmp ecx, 0x21
jne 0x4352a7
comiss xmm0, dword [0x4923ac]
jb 0x4352a7
movss xmm1, dword [0x492450]
comiss xmm1, xmm0
jb 0x4352a7
push 0
push 4
lea eax, [esp + 0x320]
push eax
mov eax, dword [0x4bc128]
add eax, 0xf46f14
xor eax, dword [0x4bc104]
push eax
push dword [0x4bc090]
call edi
push 0
push 4
lea eax, [esp + 0x31c]
push eax
mov eax, dword [esp + 0x324]
add eax, 0xfe8
xor eax, dword [0x4bc118]
push eax
push dword [0x4bc090]
call edi
push 0
push 0xc
lea eax, [esp + 0x384]
push eax
mov eax, dword [esp + 0x320]
add eax, 0xe38
push eax
push dword [0x4bc090]
call edi
push 0
push 0xc
lea eax, [esp + 0x9c]
push eax
lea eax, [esi + 0xe38]
push eax
push dword [0x4bc090]
call edi
movss xmm1, dword [esp + 0x94]
movss xmm2, dword [esp + 0x98]
subss xmm2, dword [esp + 0x380]
subss xmm1, dword [esp + 0x37c]
movq xmm0, qword [esp + 0x94]
mov eax, dword [esp + 0x9c]
movq qword [0x4bc570], xmm0
movss xmm0, dword [esp + 0x9c]
subss xmm0, dword [esp + 0x384]
mulss xmm2, xmm2
mov dword [0x4bc578], eax
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm2, xmm1
xorps xmm1, xmm1
addss xmm2, xmm0
cvtps2pd xmm0, xmm2
ucomisd xmm1, xmm0
ja 0x4344ec
sqrtsd xmm0, xmm0
jmp 0x4344f1
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sqrt_precise
cvtsd2ss xmm0, xmm0
push 6
mov edx, esi
lea ecx, [esp + 0x260]
movss dword [esp + 0x58], xmm0
call fcn.004327b0
mov eax, dword [0x4bc0c0]
add esp, 4
sub eax, 0
je 0x434528
sub eax, 1
jne 0x434533
mov eax, 3
mov dword [esp + 0x7c], eax
jmp 0x434537
mov eax, 6
mov dword [esp + 0x7c], eax
jmp 0x434537
mov eax, dword [esp + 0x7c]
push eax
mov edx, esi
lea ecx, [esp + 0x254]
call fcn.004327b0
movq xmm0, qword [esp + 0x254]
sub esp, 8
mov eax, dword [esp + 0x264]
mov ecx, esp
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
mov ecx, 0x4bc580
call fcn.00432990
movq xmm0, qword [0x4bc570]
mov ecx, esp
mov eax, dword [0x4bc578]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea ecx, [esp + 0x2e0]
call fcn.00432990
movq xmm0, qword [esp + 0x268]
mov ecx, esp
mov eax, dword [esp + 0x270]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
mov ecx, 0x4bc598
call fcn.00432990
add esp, 0xc
test al, al
je 0x4352a3
push 0xff
lea eax, [esp + 0x3bc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [0x4a0374]
add esp, 0xc
movss xmm1, dword [esp + 0x54]
comiss xmm0, xmm1
jb 0x434e55
movss xmm3, dword [0x4bc59c]
movss xmm0, dword [esp + 0x2d8]
subss xmm0, xmm3
movss dword [esp + 0x10], xmm3
cvttss2si eax, xmm0
mov dword [esp + 0x1c], eax
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
cmp byte [0x4bc066], 0
mov dword [esp + 0x48], ecx
je 0x4346fc
movss xmm0, dword [esp + 0x54]
lea eax, [esp + 0x80]
cvtps2pd xmm0, xmm0
sub esp, 8
mov dword [esp + 0x1e8], 0x7f93a996
mov dword [esp + 0x1ec], 0x3336c3c7
mov dword [esp + 0x1f0], 0x9cad3d74
mov dword [esp + 0x1f4], 0xda480b97
mov dword [esp + 0x1f8], 0x19bd99b3
movaps xmm1, xmmword [esp + 0x1e8]
movsd qword [esp], xmm0
push eax
movaps xmmword [esp + 0x8c], xmm1
lea eax, [esp + 0x3c4]
mov dword [esp + 0x200], 0x3336c3aa
mov dword [esp + 0x204], 0x9cad3d74
mov dword [esp + 0x208], 0xda480b97
xorps xmm1, xmmword [esp + 0x1fc]
push eax
movaps xmmword [esp + 0x90], xmm1
call fcn.004137a0
cvttss2si edx, dword [esp + 0x2e8]
lea eax, [esp + 0x3c8]
push eax
push 0x4b5260
cvttss2si ecx, dword [esp + 0x2ec]
call fcn.0042e9f0
movss xmm3, dword [0x4bc59c]
add esp, 0x18
mov ecx, dword [esp + 0x48]
movss dword [esp + 0x10], xmm3
cmp byte [0x4bc0fd], 0
je 0x434df2
mov eax, 0x55555556
movss xmm2, dword [esp + 0x2d4]
imul ecx
movss dword [esp + 0x100], xmm3
mov eax, 0x55555556
mov esi, edx
shr esi, 0x1f
add esi, edx
imul dword [esp + 0x1c]
mov eax, ecx
mov edi, edx
shr edi, 0x1f
add edi, edx
cdq
sub eax, edx
sar eax, 1
movd xmm1, edi
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0xf4]
cvtdq2ps xmm0, xmm0
subss xmm2, xmm0
movd xmm0, ecx
mov ecx, dword [0x4bbf50]
cvtdq2ps xmm0, xmm0
add ecx, 0x1be4
push ecx
mov dword [esp], 0x40400000
push 0xff010202
push eax
movss dword [esp + 0x30], xmm0
lea eax, [esp + 0x108]
movd xmm0, dword [esp + 0x28]
cvtdq2ps xmm0, xmm0
push eax
movss dword [esp + 0x24], xmm2
movss dword [esp + 0x38], xmm0
movaps xmm0, xmm3
addss xmm0, xmm1
movss dword [esp + 0x104], xmm2
movss dword [esp + 0x10c], xmm2
movss dword [esp + 0x88], xmm0
movss dword [esp + 0x108], xmm0
call fcn.0041d620
mov ecx, dword [0x4bbf50]
lea eax, [esp + 0x104]
movss xmm2, dword [esp + 0x14]
add ecx, 0x1be4
movd xmm0, esi
movaps xmm1, xmm2
cvtdq2ps xmm0, xmm0
push ecx
mov dword [esp], 0x40400000
push 0xff010202
push eax
lea eax, [esp + 0x118]
movss dword [esp + 0x118], xmm2
addss xmm1, xmm0
movss xmm0, dword [esp + 0x1c]
push eax
movss dword [esp + 0x118], xmm0
movss dword [esp + 0x120], xmm0
movss dword [esp + 0x84], xmm1
movss dword [esp + 0x114], xmm1
call fcn.0041d620
movss xmm1, dword [esp + 0x24]
addss xmm1, dword [esp + 0x14]
mov ecx, dword [0x4bbf50]
movss xmm2, dword [esp + 0x10]
add ecx, 0x1be4
movd xmm0, esi
cvtdq2ps xmm0, xmm0
push ecx
mov dword [esp], 0x40400000
movss dword [esp + 0x28], xmm1
movss dword [esp + 0x118], xmm1
subss xmm1, xmm0
movss dword [esp + 0x11c], xmm2
movss dword [esp + 0x124], xmm2
movss dword [esp + 0x30], xmm1
movss dword [esp + 0x120], xmm1
push 0xff010202
lea eax, [esp + 0x11c]
push eax
lea eax, [esp + 0x128]
push eax
call fcn.0041d620
mov ecx, dword [0x4bbf50]
lea eax, [esp + 0x124]
movss xmm0, dword [esp + 0x78]
add ecx, 0x1be4
movss xmm1, dword [esp + 0x24]
push ecx
mov dword [esp], 0x40400000
push 0xff010202
push eax
movss dword [esp + 0x134], xmm0
lea eax, [esp + 0x1b0]
movss xmm0, dword [esp + 0x1c]
push eax
movss dword [esp + 0x134], xmm1
movss dword [esp + 0x1b4], xmm1
movss dword [esp + 0x1b8], xmm0
call fcn.0041d620
movss xmm0, dword [esp + 0x14]
lea eax, [esp + 0x134]
movss xmm1, dword [esp + 0x28]
addss xmm1, dword [esp + 0x10]
mov ecx, dword [0x4bbf50]
movss dword [esp + 0x134], xmm0
add ecx, 0x1be4
movss dword [esp + 0xec], xmm0
movd xmm0, edi
cvtdq2ps xmm0, xmm0
push ecx
mov dword [esp], 0x40400000
push 0xff010202
push eax
movss dword [esp + 0x34], xmm1
lea eax, [esp + 0xf8]
movss dword [esp + 0x144], xmm1
subss xmm1, xmm0
push eax
movss dword [esp + 0x30], xmm1
movss dword [esp + 0x100], xmm1
call fcn.0041d620
mov ecx, dword [0x4bbf50]
lea eax, [esp + 0xe4]
movss xmm0, dword [esp + 0x74]
add ecx, 0x1be4
movss xmm1, dword [esp + 0x28]
push ecx
mov dword [esp], 0x40400000
push 0xff010202
push eax
movss dword [esp + 0xf0], xmm0
lea eax, [esp + 0xe8]
movss xmm0, dword [esp + 0x20]
push eax
movss dword [esp + 0xf8], xmm1
movss dword [esp + 0xec], xmm0
movss dword [esp + 0xf0], xmm1
call fcn.0041d620
mov ecx, dword [0x4bbf50]
lea eax, [esp + 0xd4]
movss xmm0, dword [esp + 0x24]
add ecx, 0x1be4
movss xmm1, dword [esp + 0x28]
push ecx
mov dword [esp], 0x40400000
push 0xff010202
push eax
movss dword [esp + 0xe0], xmm0
lea eax, [esp + 0xd8]
movss xmm0, dword [esp + 0x38]
push eax
movss dword [esp + 0xe8], xmm1
movss dword [esp + 0xdc], xmm0
movss dword [esp + 0xe0], xmm1
call fcn.0041d620
mov ecx, dword [0x4bbf50]
add ecx, 0x1be4
movss xmm0, dword [esp + 0x28]
lea eax, [esp + 0xc4]
movss xmm1, dword [esp + 0x24]
push ecx
mov dword [esp], 0x40400000
push 0xff010202
push eax
movss dword [esp + 0xd4], xmm0
lea eax, [esp + 0x1d8]
movss xmm0, dword [esp + 0x2c]
push eax
movss dword [esp + 0xd4], xmm1
movss dword [esp + 0x1dc], xmm1
movss dword [esp + 0x1e0], xmm0
call fcn.0041d620
movss xmm0, dword [esp + 0x78]
lea eax, [esp + 0x1c4]
movss xmm1, dword [esp + 0x14]
push ecx
mov ecx, dword [0x4bbf50]
mov dword [esp], 0x3f800000
add ecx, 0x1be4
push 0xff00ff00
push eax
movss dword [esp + 0x1d4], xmm0
lea eax, [esp + 0x1c8]
movss xmm0, dword [esp + 0x1c]
push eax
movss dword [esp + 0x1d4], xmm1
movss dword [esp + 0x1cc], xmm1
movss dword [esp + 0x1d0], xmm0
call fcn.0041d620
movss xmm0, dword [esp + 0x74]
lea eax, [esp + 0x1b4]
movss xmm1, dword [esp + 0x10]
push ecx
mov ecx, dword [0x4bbf50]
mov dword [esp], 0x3f800000
add ecx, 0x1be4
push 0xff00ff00
push eax
movss dword [esp + 0x1c0], xmm0
lea eax, [esp + 0x1b8]
movss xmm0, dword [esp + 0x20]
push eax
movss dword [esp + 0x1c8], xmm1
movss dword [esp + 0x1bc], xmm0
movss dword [esp + 0x1c0], xmm1
call fcn.0041d620
movss xmm0, dword [esp + 0x24]
lea eax, [esp + 0x19c]
movss xmm1, dword [esp + 0x10]
push ecx
mov ecx, dword [0x4bbf50]
mov dword [esp], 0x3f800000
add ecx, 0x1be4
push 0xff00ff00
push eax
movss dword [esp + 0x1a8], xmm0
lea eax, [esp + 0x1a0]
movss xmm0, dword [esp + 0x38]
push eax
movss dword [esp + 0x1b0], xmm1
movss dword [esp + 0x1a4], xmm0
movss dword [esp + 0x1a8], xmm1
call fcn.0041d620
movss xmm0, dword [esp + 0x78]
lea eax, [esp + 0x18c]
movss xmm1, dword [esp + 0x24]
push ecx
mov ecx, dword [0x4bbf50]
mov dword [esp], 0x3f800000
push 0xff00ff00
push eax
movss dword [esp + 0x19c], xmm0
lea eax, [esp + 0x190]
movss xmm0, dword [esp + 0x1c]
movss dword [esp + 0x198], xmm1
movss dword [esp + 0x190], xmm1
movss dword [esp + 0x194], xmm0
push eax
add ecx, 0x1be4
call fcn.0041d620
movss xmm0, dword [esp + 0x14]
lea eax, [esp + 0x17c]
movss xmm1, dword [esp + 0x28]
push ecx
mov ecx, dword [0x4bbf50]
mov dword [esp], 0x3f800000
add ecx, 0x1be4
push 0xff00ff00
push eax
movss dword [esp + 0x188], xmm0
lea eax, [esp + 0x180]
movss dword [esp + 0x180], xmm0
movss xmm0, dword [esp + 0x2c]
push eax
movss dword [esp + 0x190], xmm1
movss dword [esp + 0x188], xmm0
call fcn.0041d620
movss xmm0, dword [esp + 0x74]
lea eax, [esp + 0x16c]
movss xmm1, dword [esp + 0x28]
push ecx
mov ecx, dword [0x4bbf50]
mov dword [esp], 0x3f800000
add ecx, 0x1be4
push 0xff00ff00
push eax
movss dword [esp + 0x178], xmm0
lea eax, [esp + 0x170]
movss xmm0, dword [esp + 0x20]
push eax
movss dword [esp + 0x180], xmm1
movss dword [esp + 0x174], xmm0
movss dword [esp + 0x178], xmm1
call fcn.0041d620
movss xmm0, dword [esp + 0x24]
lea eax, [esp + 0x12c]
movss xmm1, dword [esp + 0x28]
push ecx
mov ecx, dword [0x4bbf50]
mov dword [esp], 0x3f800000
add ecx, 0x1be4
push 0xff00ff00
push eax
movss dword [esp + 0x138], xmm0
lea eax, [esp + 0x168]
movss xmm0, dword [esp + 0x38]
push eax
movss dword [esp + 0x140], xmm1
movss dword [esp + 0x16c], xmm0
movss dword [esp + 0x170], xmm1
call fcn.0041d620
movss xmm0, dword [esp + 0x28]
lea eax, [esp + 0x154]
movss xmm1, dword [esp + 0x24]
push ecx
mov ecx, dword [0x4bbf50]
mov dword [esp], 0x3f800000
push 0xff00ff00
push eax
movss dword [esp + 0x164], xmm0
lea eax, [esp + 0x158]
movss xmm0, dword [esp + 0x2c]
lea ecx, [ecx + 0x1be4]
push eax
movss dword [esp + 0x164], xmm1
movss dword [esp + 0x15c], xmm1
movss dword [esp + 0x160], xmm0
call fcn.0041d620
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [esp + 0x30]
cmp byte [0x4bc0a8], 0
je 0x434e07
mov edx, 0x4b5260
mov ecx, esi
call fcn.004333d0
cmp byte [0x4bc0aa], 0
je 0x434e4f
movd xmm1, dword [esp + 0x48]
cvtdq2ps xmm1, xmm1
movss xmm0, dword [esp + 0x2d4]
divss xmm1, dword [0x4923d0]
movd xmm3, dword [esp + 0x1c]
cvttss2si edx, dword [esp + 0x2d8]
movss xmm2, dword [esp + 0x18]
subss xmm0, xmm1
cvtdq2ps xmm3, xmm3
cvttss2si ecx, xmm0
call fcn.00432f90
movss xmm1, dword [esp + 0x54]
movss xmm0, dword [0x4a0300]
comiss xmm0, xmm1
jb 0x4352a3
mov eax, dword [0x4bc57c]
movss xmm2, dword [0x4bc580]
movss xmm1, dword [0x4bc584]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
mov eax, dword [0x4bc12c]
cvtdq2ps xmm0, xmm0
cdq
sub eax, edx
sar eax, 1
cmp byte [0x4bc0ae], 0
subss xmm2, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm2, xmm2
subss xmm1, xmm0
mulss xmm1, xmm1
addss xmm1, xmm2
cvtps2pd xmm0, xmm1
xorps xmm1, xmm1
je 0x434ef6
ucomisd xmm1, xmm0
ja 0x434ec7
sqrtsd xmm0, xmm0
jmp 0x434ecc
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sqrt_precise
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movd xmm0, dword [0x4b5510]
cvtdq2ps xmm0, xmm0
comiss xmm0, xmm1
jbe 0x434f22
movss xmm0, dword [esp + 0x58]
comiss xmm0, xmm1
jbe 0x434f22
movss dword [esp + 0x58], xmm1
jmp 0x434f1c
ucomisd xmm1, xmm0
ja 0x434f02
sqrtsd xmm0, xmm0
jmp 0x434f07
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sqrt_precise
movss xmm1, dword [esp + 0x58]
cvtsd2ss xmm0, xmm0
comiss xmm1, xmm0
jbe 0x434f22
movss dword [esp + 0x58], xmm0
mov dword [0x4bc108], esi
cmp byte [0x4bc09d], 0
je 0x43504d
push 0
push 4
lea eax, [esp + 0x2e8]
push eax
lea eax, [esi + 0x2f88]
push eax
push dword [0x4bc090]
call edi
cmp dword [esp + 0x2e0], 0
je 0x43504d
push 0x400
lea eax, [esp + 0x6bc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0xab8]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov edx, dword [esp + 0x2ec]
lea ecx, [esp + 0x2a4]
add esp, 0xc
mov dword [esp + 0x2a0], 0
xorps xmm0, xmm0
movq qword [esp + 0x298], xmm0
call fcn.0042f140
push dword [esp + 0x298]
lea eax, [esp + 0x6bc]
push 0x48ccf8
push eax
call fcn.004463f0
add esp, 0xc
lea eax, [esp + 0xab8]
push str.WEAPON:
push eax
call fcn.004463f0
movss xmm0, dword [esp + 0x2e0]
lea eax, [esp + 0x6c0]
addss xmm0, dword [0x492420]
cvttss2si ecx, dword [esp + 0x2dc]
push eax
push 0x4b5260
cvttss2si edx, xmm0
call fcn.0042e9f0
movss xmm0, dword [esp + 0x2e8]
lea eax, [esp + 0xac8]
addss xmm0, dword [0x492420]
push eax
push 0x4b5090
cvttss2si edx, xmm0
movss xmm0, dword [esp + 0x2ec]
subss xmm0, dword [0x492440]
cvttss2si ecx, xmm0
call fcn.0042e9f0
add esp, 0x18
cmp byte [0x4bbf4e], 0
je 0x435178
push 0
push 4
lea eax, [esp + 0x2f0]
push eax
lea eax, [esi + 0x3110]
push eax
push dword [0x4bc090]
call edi
cmp dword [esp + 0x2e8], 0
je 0x435178
push 0x400
lea eax, [esp + 0xebc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x12b8]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov edx, dword [esp + 0x2f4]
lea ecx, [esp + 0x298]
add esp, 0xc
mov dword [esp + 0x294], 0
xorps xmm0, xmm0
movq qword [esp + 0x28c], xmm0
call fcn.0042f140
push dword [esp + 0x28c]
lea eax, [esp + 0xebc]
push 0x48ccf8
push eax
call fcn.004463f0
add esp, 0xc
lea eax, [esp + 0x12b8]
push str.HELMET:
push eax
call fcn.004463f0
movss xmm0, dword [esp + 0x2e0]
lea eax, [esp + 0xec0]
addss xmm0, dword [0x492430]
cvttss2si ecx, dword [esp + 0x2dc]
push eax
push 0x4b5260
cvttss2si edx, xmm0
call fcn.0042e9f0
movss xmm0, dword [esp + 0x2e8]
lea eax, [esp + 0x12c8]
addss xmm0, dword [0x492430]
push eax
push 0x4b5090
cvttss2si edx, xmm0
movss xmm0, dword [esp + 0x2ec]
subss xmm0, dword [0x492440]
cvttss2si ecx, xmm0
call fcn.0042e9f0
add esp, 0x18
cmp byte [0x4bc10c], 0
je 0x4352a3
push 0
push 4
lea eax, [esp + 0x2ec]
push eax
lea eax, [esi + 0x30d8]
push eax
push dword [0x4bc090]
call edi
cmp dword [esp + 0x2e4], 0
je 0x4352a3
push 0x400
lea eax, [esp + 0x16bc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x1ab8]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov edx, dword [esp + 0x2f0]
lea ecx, [esp + 0x28c]
add esp, 0xc
mov dword [esp + 0x288], 0
xorps xmm0, xmm0
movq qword [esp + 0x280], xmm0
call fcn.0042f140
push dword [esp + 0x280]
lea eax, [esp + 0x16bc]
push 0x48ccf8
push eax
call fcn.004463f0
add esp, 0xc
lea eax, [esp + 0x1ab8]
push str.ARMOR:
push eax
call fcn.004463f0
movss xmm0, dword [esp + 0x2e0]
lea eax, [esp + 0x16c0]
addss xmm0, dword [0x492438]
cvttss2si ecx, dword [esp + 0x2dc]
push eax
push 0x4b5260
cvttss2si edx, xmm0
call fcn.0042e9f0
movss xmm0, dword [esp + 0x2e8]
lea eax, [esp + 0x1ac8]
addss xmm0, dword [0x492438]
push eax
push 0x4b5090
cvttss2si edx, xmm0
movss xmm0, dword [esp + 0x2ec]
subss xmm0, dword [0x492440]
cvttss2si ecx, xmm0
call fcn.0042e9f0
add esp, 0x18
mov ecx, dword [esp + 0x68]
cmp ecx, 0x240005
jne 0x435cc6
push 0
push 0xc
lea eax, [esp + 0x364]
push eax
lea eax, [esi + 0xe38]
push eax
push dword [0x4bc090]
call edi
push 0
push 4
lea eax, [esp + 0x318]
push eax
lea eax, [esi + 0xfc8]
push eax
push dword [0x4bc090]
call edi
mov esi, dword [esp + 0x310]
lea eax, [esp + 0x30c]
push 0
push 4
push eax
mov eax, dword [0x4bc128]
add eax, 0xf46f14
xor eax, dword [0x4bc104]
push eax
push dword [0x4bc090]
call edi
push 0
push 4
lea eax, [esp + 0x310]
push eax
mov eax, dword [esp + 0x318]
add eax, 0xfe8
xor eax, dword [0x4bc118]
push eax
push dword [0x4bc090]
call edi
push 0
push 0xc
lea eax, [esp + 0x1dc]
push eax
mov eax, dword [esp + 0x314]
add eax, 0xe38
push eax
push dword [0x4bc090]
call edi
movss xmm0, dword [esp + 0x1d4]
lea ecx, [esp + 0x274]
subss xmm0, dword [esp + 0x35c]
mov edx, esi
mov dword [esp + 0x27c], 0
movss dword [esp + 0x18], xmm0
movss xmm0, dword [esp + 0x1d8]
subss xmm0, dword [esp + 0x360]
movss dword [esp + 0x48], xmm0
movss xmm0, dword [esp + 0x1dc]
subss xmm0, dword [esp + 0x364]
movss dword [esp + 0x1c], xmm0
xorps xmm0, xmm0
movq qword [esp + 0x274], xmm0
call fcn.0042f140
movss xmm1, dword [esp + 0x18]
movss xmm0, dword [esp + 0x48]
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm1, xmm0
movss xmm0, dword [esp + 0x1c]
mulss xmm0, xmm0
addss xmm1, xmm0
cvtps2pd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm1, xmm0
ja 0x435402
sqrtsd xmm0, xmm0
jmp 0x435407
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sqrt_precise
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
comiss xmm1, dword [0x4a0374]
movss dword [esp + 0x10], xmm1
ja 0x43646c
movss xmm0, dword [0x492444]
comiss xmm0, xmm1
jb 0x435cc2
movq xmm0, qword [esp + 0x35c]
sub esp, 0xc
mov eax, dword [esp + 0x370]
mov ecx, esp
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea ecx, [esp + 0x2b4]
call fcn.00432990
add esp, 0xc
test al, al
je 0x435cc2
cmp byte [0x4bc09e], 0
je 0x43552d
push 0x400
lea eax, [esp + 0x4abc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x1eb8]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x1c]
lea eax, [esp + 0x1ec4]
cvtps2pd xmm0, xmm0
add esp, 4
movsd qword [esp], xmm0
push dword [esp + 0x27c]
push str._s____0.fm_
push eax
call fcn.004463f0
cvttss2si edx, dword [esp + 0x2c0]
add esp, 0x14
lea eax, [esp + 0x1eb8]
push eax
push 0x4b5260
cvttss2si ecx, dword [esp + 0x2b0]
call fcn.0042e9f0
movss xmm0, dword [esp + 0x2e0]
lea eax, [esp + 0x4ac0]
addss xmm0, dword [0x492430]
push eax
push 0x4b5090
cvttss2si edx, xmm0
movss xmm0, dword [esp + 0x2e4]
subss xmm0, dword [0x492440]
cvttss2si ecx, xmm0
call fcn.0042e9f0
add esp, 0x10
cmp byte [0x4bc122], 0
je 0x4355f7
cmp dword [esp + 0x27c], 7
jne 0x4355f7
push 0x400
lea eax, [esp + 0x4ebc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x22b8]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x1c]
lea eax, [esp + 0x22c4]
cvtps2pd xmm0, xmm0
add esp, 4
movsd qword [esp], xmm0
push dword [esp + 0x27c]
push str._s____0.fm_
push eax
call fcn.004463f0
movss xmm0, dword [esp + 0x2bc]
lea eax, [esp + 0x4ecc]
subss xmm0, dword [0x492444]
cvttss2si edx, dword [esp + 0x2c0]
add esp, 0x14
push eax
push 0x4b5090
cvttss2si ecx, xmm0
call fcn.0042e9f0
cvttss2si edx, dword [esp + 0x2b4]
lea eax, [esp + 0x22c0]
push eax
push 0x4b50d0
cvttss2si ecx, dword [esp + 0x2b8]
call fcn.0042e9f0
add esp, 0x10
cmp byte [0x4bc10f], 0
je 0x4356c1
cmp dword [esp + 0x27c], 8
jne 0x4356c1
push 0x400
lea eax, [esp + 0x52bc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x26b8]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x1c]
lea eax, [esp + 0x26c4]
cvtps2pd xmm0, xmm0
add esp, 4
movsd qword [esp], xmm0
push dword [esp + 0x27c]
push str._s____0.fm_
push eax
call fcn.004463f0
movss xmm0, dword [esp + 0x2bc]
lea eax, [esp + 0x52cc]
subss xmm0, dword [0x492444]
cvttss2si edx, dword [esp + 0x2c0]
add esp, 0x14
push eax
push 0x4b5190
cvttss2si ecx, xmm0
call fcn.0042e9f0
cvttss2si edx, dword [esp + 0x2b4]
lea eax, [esp + 0x26c0]
push eax
push 0x4b5110
cvttss2si ecx, dword [esp + 0x2b8]
call fcn.0042e9f0
add esp, 0x10
cmp byte [0x4bc095], 0
je 0x43578b
cmp dword [esp + 0x27c], 9
jne 0x43578b
push 0x400
lea eax, [esp + 0x56bc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x2ab8]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x2b4]
lea eax, [esp + 0x56c4]
subss xmm0, dword [0x49244c]
cvttss2si edx, dword [esp + 0x2b8]
add esp, 0xc
push eax
push 0x4b51e0
cvttss2si ecx, xmm0
call fcn.0042e9f0
movss xmm0, dword [esp + 0x18]
lea eax, [esp + 0x2ac0]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [esp + 0x27c]
push str._s____0.fm_
push eax
call fcn.004463f0
cvttss2si edx, dword [esp + 0x2c0]
add esp, 0x14
lea eax, [esp + 0x2ab8]
push eax
push 0x4b5180
cvttss2si ecx, dword [esp + 0x2b0]
call fcn.0042e9f0
add esp, 8
cmp byte [0x4bc0ab], 0
je 0x435855
cmp dword [esp + 0x27c], 0xa
jne 0x435855
push 0x400
lea eax, [esp + 0x5abc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x2eb8]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x2b4]
lea eax, [esp + 0x5ac4]
subss xmm0, dword [0x492444]
cvttss2si edx, dword [esp + 0x2b8]
add esp, 0xc
push eax
push 0x4b5140
cvttss2si ecx, xmm0
call fcn.0042e9f0
movss xmm0, dword [esp + 0x18]
lea eax, [esp + 0x2ec0]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [esp + 0x27c]
push str._s____0.fm_
push eax
call fcn.004463f0
cvttss2si edx, dword [esp + 0x2c0]
add esp, 0x14
lea eax, [esp + 0x2eb8]
push eax
push 0x4b50b0
cvttss2si ecx, dword [esp + 0x2b0]
call fcn.0042e9f0
add esp, 8
cmp byte [0x4bbf4d], 0
je 0x43591f
cmp dword [esp + 0x27c], 2
jne 0x43591f
push 0x400
lea eax, [esp + 0x5ebc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x32b8]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x2b4]
lea eax, [esp + 0x5ec4]
subss xmm0, dword [0x492444]
cvttss2si edx, dword [esp + 0x2b8]
add esp, 0xc
push eax
push 0x4b5110
cvttss2si ecx, xmm0
call fcn.0042e9f0
movss xmm0, dword [esp + 0x18]
lea eax, [esp + 0x32c0]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [esp + 0x27c]
push str._s____0.fm_
push eax
call fcn.004463f0
cvttss2si edx, dword [esp + 0x2c0]
add esp, 0x14
lea eax, [esp + 0x32b8]
push eax
push 0x4b5240
cvttss2si ecx, dword [esp + 0x2b0]
call fcn.0042e9f0
add esp, 8
cmp byte [0x4bc065], 0
je 0x4359e9
cmp dword [esp + 0x27c], 0
jne 0x4359e9
push 0x400
lea eax, [esp + 0x62bc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x36b8]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x2b4]
lea eax, [esp + 0x62c4]
subss xmm0, dword [0x492444]
cvttss2si edx, dword [esp + 0x2b8]
add esp, 0xc
push eax
push 0x4b50d0
cvttss2si ecx, xmm0
call fcn.0042e9f0
movss xmm0, dword [esp + 0x18]
lea eax, [esp + 0x36c0]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [esp + 0x27c]
push str._s____0.fm_
push eax
call fcn.004463f0
cvttss2si edx, dword [esp + 0x2c0]
add esp, 0x14
lea eax, [esp + 0x36b8]
push eax
push 0x4b5100
cvttss2si ecx, dword [esp + 0x2b0]
call fcn.0042e9f0
add esp, 8
cmp byte [0x4bc0a9], 0
je 0x435ab3
cmp dword [esp + 0x27c], 4
jne 0x435ab3
push 0x400
lea eax, [esp + 0x66bc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x3ab8]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x2b4]
lea eax, [esp + 0x66c4]
subss xmm0, dword [0x49244c]
cvttss2si edx, dword [esp + 0x2b8]
add esp, 0xc
push eax
push 0x4b5160
cvttss2si ecx, xmm0
call fcn.0042e9f0
movss xmm0, dword [esp + 0x18]
lea eax, [esp + 0x3ac0]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [esp + 0x27c]
push str._s____0.fm_
push eax
call fcn.004463f0
cvttss2si edx, dword [esp + 0x2c0]
add esp, 0x14
lea eax, [esp + 0x3ab8]
push eax
push 0x4b5140
cvttss2si ecx, dword [esp + 0x2b0]
call fcn.0042e9f0
add esp, 8
cmp byte [0x4bbf4f], 0
je 0x435b2e
cmp dword [esp + 0x27c], 5
jne 0x435b2e
push 0x400
lea eax, [esp + 0x3ebc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x1c]
lea eax, [esp + 0x3ec4]
cvtps2pd xmm0, xmm0
add esp, 4
movsd qword [esp], xmm0
push dword [esp + 0x27c]
push str._s____0.fm_
push eax
call fcn.004463f0
cvttss2si edx, dword [esp + 0x2c0]
add esp, 0x14
lea eax, [esp + 0x3eb8]
push eax
push 0x4b5210
cvttss2si ecx, dword [esp + 0x2b0]
call fcn.0042e9f0
add esp, 8
cmp byte [0x4bc0a4], 0
je 0x435bf8
cmp dword [esp + 0x27c], 0xb
jne 0x435bf8
push 0x400
lea eax, [esp + 0x6abc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x42b8]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x2b4]
lea eax, [esp + 0x6ac4]
subss xmm0, dword [0x492444]
cvttss2si edx, dword [esp + 0x2b8]
add esp, 0xc
push eax
push 0x4b5110
cvttss2si ecx, xmm0
call fcn.0042e9f0
movss xmm0, dword [esp + 0x18]
lea eax, [esp + 0x42c0]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [esp + 0x27c]
push str._s____0.fm_
push eax
call fcn.004463f0
cvttss2si edx, dword [esp + 0x2c0]
add esp, 0x14
lea eax, [esp + 0x42b8]
push eax
push 0x4b5390
cvttss2si ecx, dword [esp + 0x2b0]
call fcn.0042e9f0
add esp, 8
cmp byte [0x4bc0ac], 0
je 0x435cc2
cmp dword [esp + 0x27c], 0xe
jne 0x435cc2
push 0x400
lea eax, [esp + 0x6ebc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x46b8]
push 0x400
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movss xmm0, dword [esp + 0x2b4]
lea eax, [esp + 0x6ec4]
subss xmm0, dword [0x492444]
cvttss2si edx, dword [esp + 0x2b8]
add esp, 0xc
push eax
push 0x4b5180
cvttss2si ecx, xmm0
call fcn.0042e9f0
movss xmm0, dword [esp + 0x18]
lea eax, [esp + 0x46c0]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [esp + 0x27c]
push str._s____0.fm_
push eax
call fcn.004463f0
cvttss2si edx, dword [esp + 0x2c0]
add esp, 0x14
lea eax, [esp + 0x46b8]
push eax
push 0x4b5410
cvttss2si ecx, dword [esp + 0x2b0]
call fcn.0042e9f0
add esp, 8
mov ecx, dword [esp + 0x68]
cmp byte [0x4bc121], 0
jne 0x435cdc
cmp byte [0x4bc120], 0
je 0x4362b6
mov esi, dword [esp + 0x30]
mov eax, esi
or eax, dword [esp + 0x64]
je 0x4362ba
cmp ecx, 0x20001
je 0x435d00
cmp ecx, 0x20000
jne 0x4362ba
push 0
push 0xc
lea eax, [esp + 0x24c]
add esi, 0xe38
push eax
push esi
push dword [0x4bc090]
call edi
movq xmm0, qword [esp + 0x244]
lea eax, [esp + 0x304]
mov edi, dword [esp + 0x24c]
push 0
push 4
push eax
mov eax, dword [0x4bc128]
add eax, 0xf46f14
movq qword [esp + 0x54], xmm0
xor eax, dword [0x4bc104]
push eax
push dword [0x4bc090]
movq qword [esp + 0xcc], xmm0
mov dword [esp + 0xd4], edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
lea eax, [esp + 0x308]
push eax
mov eax, dword [esp + 0x310]
add eax, 0xfe8
xor eax, dword [0x4bc118]
push eax
push dword [0x4bc090]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0xc
lea eax, [esp + 0x390]
push eax
mov eax, dword [esp + 0x30c]
add eax, 0xe38
push eax
push dword [0x4bc090]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0xc
lea eax, [esp + 0xa8]
push eax
push esi
push dword [0x4bc090]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movq xmm0, qword [esp + 0xa0]
xorps xmm3, xmm3
movq qword [0x4bc570], xmm0
sub esp, 0xc
movss xmm0, dword [esp + 0xac]
mov ecx, esp
subss xmm0, dword [esp + 0x394]
movss xmm2, dword [esp + 0xc4]
movss xmm1, dword [esp + 0xc8]
addss xmm2, xmm3
addss xmm1, dword [0x4923b4]
mov eax, dword [esp + 0xb4]
movss dword [esp + 0x24], xmm0
movss xmm0, dword [esp + 0xb0]
subss xmm0, dword [esp + 0x398]
unpcklps xmm2, xmm1
mov dword [0x4bc578], eax
movq qword [ecx], xmm2
movss dword [esp + 0x2c], xmm0
movss xmm0, dword [esp + 0xb4]
subss xmm0, dword [esp + 0x39c]
movss dword [esp + 0x38], xmm0
movss xmm0, dword [esp + 0xcc]
addss xmm0, xmm3
movss dword [esp + 0x27c], xmm0
mov eax, dword [esp + 0x27c]
mov dword [ecx + 8], eax
lea ecx, [esp + 0x3a0]
call fcn.00432990
movq xmm0, qword [esp + 0x54]
mov ecx, esp
mov byte [esp + 0x2b2], al
movq qword [ecx], xmm0
mov dword [ecx + 8], edi
lea ecx, [esp + 0x2f8]
call fcn.00432990
mov cl, byte [esp + 0x2b2]
add esp, 0xc
or cl, al
mov esi, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
je 0x4362ba
push 0
push 1
lea eax, [esp + 0x2af]
push eax
lea eax, [esi + 0xf40]
push eax
push dword [0x4bc090]
call edi
movss xmm0, dword [esp + 0x2f0]
subss xmm0, dword [esp + 0x398]
movss xmm1, dword [esp + 0x20]
mulss xmm1, xmm1
cvttss2si eax, xmm0
movss xmm0, dword [esp + 0x18]
mulss xmm0, xmm0
mov dword [esp + 0x48], eax
cdq
sub eax, edx
addss xmm0, xmm1
sar eax, 1
movss xmm1, dword [esp + 0x2c]
mulss xmm1, xmm1
mov dword [esp + 0x1c], eax
addss xmm0, xmm1
xorps xmm1, xmm1
cvtps2pd xmm0, xmm0
ucomisd xmm1, xmm0
ja 0x435f45
sqrtsd xmm0, xmm0
jmp 0x435f4a
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sqrt_precise
xorps xmm2, xmm2
cvtsd2ss xmm2, xmm0
movss xmm0, dword [0x4a030c]
comiss xmm0, xmm2
movss dword [esp + 0x2c], xmm2
jb 0x4362ba
cmp byte [0x4bc121], 0
mov al, byte [esp + 0x2a7]
je 0x436118
test al, al
jne 0x436118
cvtps2pd xmm0, xmm2
sub esp, 8
mov dword [esp + 0x208], 0x7bd0f6e9
lea eax, [esp + 0x88]
mov dword [esp + 0x20c], 0x1616a6c3
mov dword [esp + 0x210], 0xf1cb1344
mov dword [esp + 0x214], 0xda480b97
mov dword [esp + 0x218], 0x19bd99b3
movaps xmm1, xmmword [esp + 0x208]
movsd qword [esp], xmm0
push eax
movaps xmmword [esp + 0x8c], xmm1
lea eax, [esp + 0x4c4]
mov dword [esp + 0x220], 0x3336c3aa
mov dword [esp + 0x224], 0x9cad3d74
mov dword [esp + 0x228], 0xda480b97
xorps xmm1, xmmword [esp + 0x21c]
push eax
movaps xmmword [esp + 0x90], xmm1
call fcn.004137a0
cvttss2si edx, dword [esp + 0x300]
lea eax, [esp + 0x4c8]
push eax
push 0x4b5090
cvttss2si ecx, dword [esp + 0x304]
call fcn.0042e9f0
mov eax, dword [0x4bbf50]
lea ecx, [esp + 0x4d0]
movss xmm3, dword [0x492488]
add esp, 0x14
movss xmm0, dword [eax + 0x18bc]
mov eax, dword [eax + 0x18b8]
movaps xmm2, xmm0
push 0
push ecx
push ecx
lea ecx, [esp + 0x154]
mov dword [esp], 0xbf800000
push ecx
mov ecx, eax
movss dword [esp + 0x2c], xmm0
mov dword [esp + 0x34], eax
call fcn.0041fee0
movss xmm0, dword [esp + 0x144]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x4360af
mov eax, dword [esp + 0x20]
movss xmm1, dword [esp + 0x18]
divss xmm1, dword [eax]
subss xmm0, xmm1
addss xmm0, dword [0x4923a8]
movd xmm3, dword [esp + 0x48]
mov ecx, 0x4b5180
cvtdq2ps xmm3, xmm3
cvttss2si eax, xmm0
movd xmm0, eax
mov eax, dword [esp + 0x1c]
cvtdq2ps xmm0, xmm0
movd xmm2, eax
cdq
sub eax, edx
movss dword [esp + 0x144], xmm0
movss xmm0, dword [esp + 0x2ec]
sar eax, 1
cvtdq2ps xmm2, xmm2
movd xmm1, eax
cvtdq2ps xmm1, xmm1
subss xmm0, xmm1
movss xmm1, dword [esp + 0x398]
call fcn.0042edf0
movss xmm2, dword [esp + 0x2c]
mov al, byte [esp + 0x2a7]
cmp byte [0x4bc120], 0
je 0x4362ba
cmp al, 1
jne 0x4362ba
cvtps2pd xmm0, xmm2
sub esp, 8
mov dword [esp + 0x228], 0x4aeed6f1
lea eax, [esp + 0x88]
mov dword [esp + 0x22c], 0x1d06e68a
mov dword [esp + 0x230], 0x9cad5012
mov dword [esp + 0x234], 0xda480b97
mov dword [esp + 0x238], 0x19bd99b3
movaps xmm1, xmmword [esp + 0x228]
movsd qword [esp], xmm0
push eax
movaps xmmword [esp + 0x8c], xmm1
lea eax, [esp + 0x5c4]
mov dword [esp + 0x240], 0x3336c3aa
mov dword [esp + 0x244], 0x9cad3d74
mov dword [esp + 0x248], 0xda480b97
xorps xmm1, xmmword [esp + 0x23c]
push eax
movaps xmmword [esp + 0x90], xmm1
call fcn.004137a0
cvttss2si edx, dword [esp + 0x300]
lea eax, [esp + 0x5c8]
push eax
push 0x4b50d0
cvttss2si ecx, dword [esp + 0x304]
call fcn.0042e9f0
mov eax, dword [0x4bbf50]
lea ecx, [esp + 0x5d0]
movss xmm3, dword [0x492488]
add esp, 0x14
movss xmm0, dword [eax + 0x18bc]
mov eax, dword [eax + 0x18b8]
movaps xmm2, xmm0
push 0
push ecx
push ecx
lea ecx, [esp + 0x14c]
mov dword [esp], 0xbf800000
push ecx
mov ecx, eax
movss dword [esp + 0x2c], xmm0
mov dword [esp + 0x34], eax
call fcn.0041fee0
movss xmm0, dword [esp + 0x13c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x436258
mov eax, dword [esp + 0x20]
movss xmm1, dword [esp + 0x18]
divss xmm1, dword [eax]
subss xmm0, xmm1
addss xmm0, dword [0x4923a8]
mov eax, dword [esp + 0x1c]
movd xmm3, dword [esp + 0x48]
cvtdq2ps xmm3, xmm3
cvttss2si ecx, xmm0
movd xmm2, eax
cdq
sub eax, edx
sar eax, 1
movd xmm0, ecx
mov ecx, 0x4b5110
cvtdq2ps xmm0, xmm0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss dword [esp + 0x13c], xmm0
movss xmm0, dword [esp + 0x2ec]
cvtdq2ps xmm2, xmm2
subss xmm0, xmm1
movss xmm1, dword [esp + 0x398]
call fcn.0042edf0
jmp 0x4362ba
mov esi, dword [esp + 0x30]
cmp dword [esp + 0x68], 0x250005
jne 0x43646c
push 0
push 4
lea eax, [esp + 0x304]
push eax
mov eax, dword [0x4bc128]
add eax, 0xf46f14
xor eax, dword [0x4bc104]
push eax
push dword [0x4bc090]
call edi
push 0
push 4
lea eax, [esp + 0x300]
push eax
mov eax, dword [esp + 0x308]
add eax, 0xfe8
xor eax, dword [0x4bc118]
push eax
push dword [0x4bc090]
call edi
push 0
push 0xc
lea eax, [esp + 0x3a8]
push eax
mov eax, dword [esp + 0x304]
add eax, 0xe38
push eax
push dword [0x4bc090]
call edi
push 0
push 0xc
lea eax, [esp + 0xb4]
push eax
lea eax, [esi + 0xe38]
push eax
push dword [0x4bc090]
call edi
movss xmm1, dword [esp + 0xac]
sub esp, 0xc
subss xmm1, dword [esp + 0x3ac]
movq xmm0, qword [esp + 0xb8]
mov eax, esp
mov ecx, dword [esp + 0xc0]
mov dword [0x4bc578], ecx
movq qword [0x4bc570], xmm0
movss dword [esp + 0x24], xmm1
movss xmm1, dword [esp + 0xbc]
subss xmm1, dword [esp + 0x3b0]
movq qword [eax], xmm0
mov dword [eax + 8], ecx
lea ecx, [esp + 0x3b8]
movss dword [esp + 0x54], xmm1
movss xmm1, dword [esp + 0xc0]
subss xmm1, dword [esp + 0x3b4]
movss dword [esp + 0x28], xmm1
call fcn.00432990
add esp, 0xc
test al, al
je 0x43646c
cmp byte [0x4bc097], 0
je 0x43646c
movss xmm0, dword [esp + 0x18]
movss xmm1, dword [esp + 0x48]
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm0, xmm1
movss xmm1, dword [esp + 0x1c]
mulss xmm1, xmm1
addss xmm0, xmm1
xorps xmm1, xmm1
cvtps2pd xmm0, xmm0
ucomisd xmm1, xmm0
ja 0x43641e
sqrtsd xmm0, xmm0
jmp 0x436423
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sqrt_precise
cvtsd2ss xmm0, xmm0
sub esp, 8
lea eax, [esp + 0x72c0]
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
push str.Vehicle___0.1f_
push eax
call fcn.004463f0
cvttss2si edx, dword [esp + 0x3c0]
lea eax, [esp + 0x72c8]
push eax
push 0x4b5180
cvttss2si ecx, dword [esp + 0x3c4]
call fcn.0042e9f0
add esp, 0x18
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x4bc590]
sub eax, dword [0x4bc58c]
mov ecx, dword [esp + 0x5c]
inc ecx
sar eax, 4
cmp ecx, eax
mov dword [esp + 0x5c], ecx
mov eax, ecx
jbe 0x433730
cmp dword [0x4bc108], 0
je 0x4364aa
cmp byte [0x4bc0a7], 0
je 0x4364aa
call fcn.00433140
mov ecx, dword [esp + 0x76bc]
pop edi
pop esi
xor ecx, esp
call fcn.0047e4e7
mov esp, ebp
pop ebp
ret