Function at 0x4bbbd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x6282b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4b4
push ebx
mov ebx, dword [esp + 0x4c8]
mov eax, 0x24924925
push ebp
mov ecx, dword [ebx + 0x10]
push esi
sub ecx, 0xc
xor esi, esi
mul ecx
sub ecx, edx
mov si, word [ebx + 0x1a]
shr ecx, 1
add ecx, edx
xor eax, eax
shr ecx, 3
mov ebp, ecx
lea ecx, [esp + 0x24]
push edi
mov edi, dword [0x6d620c]
mov dword [esp + 0x50], eax
mov dword [esp + 0x20], eax
mov ax, word [ebx + 0x1e]
push ecx
mov ecx, 0x6d6208
mov dword [esp + 0xdc], ebp
mov dword [esp + 0x40], 1
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], esi
call fcn.00409380
mov ecx, dword [0x6d620c]
mov dword [esp + 0x40], eax
cmp eax, ecx
je 0x4bbc6b
mov edx, dword [esp + 0x28]
cmp edx, dword [eax + 0xc]
jb 0x4bbc6b
lea eax, [esp + 0x40]
jmp 0x4bbc73
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x14]
mov eax, dword [eax]
cmp eax, edi
je 0x4bbd0b
xor eax, eax
lea ecx, [esp + 0xdc]
mov ax, word [ebx + 0x1e]
mov dword [esp + 0x78], 0
mov dword [esp + 0x74], eax
lea eax, [esp + 0x74]
push eax
push ecx
mov ecx, 0x6d6208
call fcn.00408bd0
mov edx, dword [eax]
lea ecx, [esp + 0x48]
mov dword [esp + 0x44], edx
lea edx, [esp + 0x44]
mov eax, dword [eax + 4]
push ecx
push edx
lea ecx, [esp + 0xd4]
mov dword [esp + 0x50], eax
call fcn.0045bbb0
mov ecx, eax
push esi
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
mov edx, dword [ecx + 4]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
mov eax, dword [0x6d67a8]
mov dword [esp + 0xc8], edx
cmp ecx, eax
mov ecx, 0x68d9e0
jne 0x4bbd02
call fcn.00407a20
mov ecx, 0x68d9e0
call fcn.00407ed0
jmp 0x4bbd07
call fcn.00403bf0
mov dword [esp + 0x50], eax
xor eax, eax
test ebp, ebp
mov dword [esp + 0x40], eax
jle 0x4bdd24
jmp 0x4bbd22
mov ebx, dword [esp + 0x4d4]
xor edx, edx
mov dx, word [ebx + 0x1c]
cmp eax, edx
jge 0x4bdd24
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [ebx + ecx*2 + 0x26]
mov dword [esp + 0x44], eax
mov edi, eax
mov si, word [ebx + ecx*2 + 0x20]
mov edx, dword [ebx + ecx*2 + 0x22]
lea ebx, [ebx + ecx*2 + 0x20]
and eax, 0x7fffffff
mov dword [esp + 0x18], esi
and esi, 0xffff
mov ecx, dword [ebx + 0xa]
mov dword [ebx + 6], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x48], ecx
mov dword [ebx + 0xa], 0
mov ebp, dword [0x6d620c]
push eax
mov ecx, 0x6d6208
mov dword [esp + 0x14], edx
and edi, 0x80000000
mov dword [esp + 0x20], esi
call fcn.00409380
mov ecx, dword [0x6d620c]
mov dword [esp + 0x14], eax
cmp eax, ecx
je 0x4bbdb0
mov edx, dword [esp + 0x1c]
cmp edx, dword [eax + 0xc]
jb 0x4bbdb0
lea eax, [esp + 0x14]
jmp 0x4bbdbe
mov dword [esp + 0xc8], ecx
lea eax, [esp + 0xc8]
cmp dword [eax], ebp
je 0x4bdd0c
lea eax, [esp + 0xc0]
lea ecx, [esp + 0x1e4]
push eax
push ecx
mov ecx, 0x6d6208
mov dword [esp + 0xc8], esi
mov dword [esp + 0xcc], 0
call fcn.00408bd0
mov edx, dword [eax]
lea ecx, [esp + 0x78]
mov dword [esp + 0x74], edx
lea edx, [esp + 0x74]
mov eax, dword [eax + 4]
push ecx
push edx
lea ecx, [esp + 0x214]
mov dword [esp + 0x80], eax
call fcn.0045bbb0
mov ecx, eax
mov eax, dword [ecx]
mov ebp, dword [eax + 0x10]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx + 4]
test eax, eax
mov dword [esp + 0x30], edx
je 0x4bbe3f
push 1
mov ecx, ebp
call fcn.004779d0
test eax, eax
jne 0x4bdd0c
mov eax, dword [esp + 0x28]
cmp eax, 0x6000
jb 0x4bbec3
cmp eax, 0x7fff
ja 0x4bbec3
cmp word [esp + 0x18], 0x6000
jb 0x4bbec3
cmp word [esp + 0x18], 0x7fff
ja 0x4bbec3
mov eax, dword [ebp + 0x150]
test eax, eax
jne 0x4bbec3
mov eax, dword [ebp + 0x258]
xor ecx, ecx
and eax, 0x1000003
or eax, ecx
jne 0x4bbec3
cmp dword [esp + 0x50], 5
jne 0x4bbec3
test edi, edi
jne 0x4bbec3
call fcn.00473db0
test eax, eax
jne 0x4bbec3
call fcn.00473dc0
test eax, eax
jne 0x4bbec3
mov eax, dword [esp + 0x20]
mov edi, eax
add eax, 0x258
mov ecx, dword [eax]
or ecx, 2
mov dword [eax], ecx
mov edx, dword [eax + 4]
mov dword [eax + 4], edx
call fcn.005a44e0
add eax, 0x7530
mov dword [edi + 0x264], eax
mov eax, dword [esp + 0x18]
cmp ax, 0x4000
jb 0x4bdd0c
cmp ax, 0x7fff
ja 0x4bdd0c
cmp ax, 0x6000
jb 0x4bbf0e
mov eax, dword [esp + 0x10]
xor edi, edi
cmp eax, edi
jle 0x4bbf10
push esi
push edi
mov ecx, 0xa24690
call fcn.0047a840
test eax, eax
je 0x4bbf10
mov eax, dword [esp + 0x10]
mov ecx, 0xa24690
push eax
push esi
push edi
call fcn.0047abf0
jmp 0x4bbf10
xor edi, edi
mov byte [ebp + 0x4a0], 0
mov eax, dword [0x6d67a8]
cmp esi, eax
jne 0x4bbf55
mov ecx, dword [0x6d6790]
mov eax, dword [0xd0af88]
mov esi, 1
add ecx, 0x2710
cmp eax, edi
mov dword [0xa26e5c], esi
mov dword [0xcea2d4], ecx
jne 0x4bbf4f
push edi
call fcn.004e6ba0
add esp, 4
mov dword [0x6454a8], esi
mov edx, dword [ebp]
mov word [ebp + 0x80c], di
cmp edx, dword [0x6d67a8]
jne 0x4bc470
cmp dword [esp + 0x10], edi
jne 0x4bc04a
mov eax, dword [esp + 0x24]
mov ecx, 0x68d9e0
push eax
call fcn.00403bf0
cmp eax, 5
je 0x4bc1a0
xor esi, esi
lea ecx, [esp + 0x334]
push esi
push 0x645a20
push ecx
mov dword [esp + 0x330], esi
mov dword [esp + 0x3b0], esi
mov dword [esp + 0x334], 0xc
mov dword [esp + 0x338], esi
call fcn.006133d6
lea edi, [esp + 0x340]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x370]
mov dword [esp + 0x330], ecx
xor ecx, ecx
mov dword [edx - 0x30], esi
mov edi, dword [esp + 0x330]
mov eax, ecx
add edx, 4
sub eax, edi
lea eax, [eax + eax*4]
shl eax, 1
mov dword [edx - 4], eax
inc ecx
cmp ecx, 0xc
jl 0x4bbfe6
mov eax, dword [ebp + 0x2d8]
mov dword [esp + 0x3a0], 0x12c
cmp eax, esi
mov dword [esp + 0x3a8], 0x14
je 0x4bc1a0
mov eax, dword [ebp + 0x41c]
lea ecx, [ebp + 0x414]
lea edx, [esp + 0x324]
push edx
push 1
push eax
call fcn.004e2860
jmp 0x4bc1a0
mov eax, dword [0x6d6790]
mov esi, dword [esp + 0x10]
mov dword [0x6d7198], eax
push esi
lea ecx, [esp + 0x2b0]
xor eax, eax
push 0x645a20
push ecx
mov dword [esp + 0x2a8], esi
mov dword [esp + 0x328], eax
mov dword [esp + 0x2ac], 0xc
mov dword [esp + 0x2b0], eax
call fcn.006133d6
lea edi, [esp + 0x2b8]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edi, edi
mov dword [esp + 0x2a8], ecx
xor ecx, ecx
lea edx, [esp + 0x2e8]
mov eax, ecx
mov dword [edx - 0x30], edi
sub eax, dword [esp + 0x2a8]
add edx, 4
lea eax, [eax + eax*4]
shl eax, 1
mov dword [edx - 4], eax
inc ecx
cmp ecx, 0xc
jl 0x4bc0b3
mov eax, dword [ebp + 0x2d8]
mov dword [esp + 0x318], 0x12c
cmp eax, edi
mov dword [esp + 0x320], 0x14
je 0x4bc10c
mov eax, dword [ebp + 0x41c]
lea ecx, [ebp + 0x414]
lea edx, [esp + 0x29c]
push edx
push 1
push eax
call fcn.004e2860
mov eax, dword [0x6d6880]
mov ecx, 1
sub eax, esi
cmp eax, ecx
mov dword [0x6d6880], eax
jg 0x4bc127
mov dword [0x6d6880], ecx
cmp esi, 0x32
jge 0x4bc135
mov word [ebp + 0x80c], cx
jmp 0x4bc15d
cmp esi, 0x96
jge 0x4bc148
mov word [ebp + 0x80c], 2
jmp 0x4bc15d
xor eax, eax
cmp esi, 0x12c
setge al
add eax, 3
mov word [ebp + 0x80c], ax
push 0x6d67a8
mov ecx, 0xa234d8
call fcn.00475990
mov edi, dword [esp + 0x44]
xor esi, esi
and edi, 0x2000000
mov ecx, edi
or ecx, esi
jne 0x4bc188
mov ecx, 0x68d9e0
call fcn.004033a0
cmp word [ebp + 0x80c], 0
je 0x4bc1a0
or edi, esi
jne 0x4bc1a0
mov ecx, 0x68d9e0
call fcn.00406c30
mov eax, dword [esp + 0x44]
xor ecx, ecx
and eax, 0x100
xor edi, edi
or eax, ecx
je 0x4bc36f
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x4bc36f
mov eax, dword [eax]
cmp eax, 0x6000
jb 0x4bc36f
cmp eax, 0x7fff
ja 0x4bc36f
cmp dword [0x68f00c], edi
je 0x4bc23a
lea edx, [esp + 0x20]
mov ecx, 0x68f000
push edx
call fcn.00423f80
mov ecx, dword [0x68f004]
mov dword [esp + 0x14], eax
cmp eax, ecx
je 0x4bc20f
mov edx, dword [esp + 0x20]
mov esi, dword [eax + 0xc]
cmp edx, esi
jb 0x4bc20f
lea eax, [esp + 0x14]
jmp 0x4bc21d
mov dword [esp + 0xd4], ecx
lea eax, [esp + 0xd4]
mov eax, dword [eax]
cmp eax, ecx
je 0x4bc23a
mov esi, dword [eax + 0x10]
cmp esi, edi
je 0x4bc23a
mov ecx, esi
call fcn.005a07e0
push esi
call fcn.006066eb
add esp, 4
push 0x1c
call fcn.00613321
add esp, 4
mov dword [esp + 0x2c], eax
cmp eax, edi
mov dword [esp + 0x4cc], edi
je 0x4bc25e
mov ecx, eax
call fcn.0041d270
mov esi, eax
jmp 0x4bc260
xor esi, esi
cmp esi, edi
mov dword [esp + 0x4cc], 0xffffffff
je 0x4bc32b
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x390]
mov edx, dword [eax + 0x2d8]
mov ecx, dword [edx + ecx*4]
mov edx, dword [eax + 0x358]
lea ecx, [ecx + edx - 0x21d]
mov edx, dword [eax + 0x340]
sub edx, 0x4b
push ecx
push edx
mov ecx, esi
call fcn.0041d2a0
mov eax, dword [esp + 0x20]
push 0xcb
push eax
call fcn.00475730
mov ecx, dword [esp + 0x28]
push 0xcd
push ecx
call fcn.00475730
mov edx, dword [esp + 0x30]
push 0xcc
push edx
call fcn.00475730
mov eax, dword [esp + 0x38]
add esp, 0x18
lea ecx, [esp + 0xcc]
lea edx, [esp + 0x1ec]
push ecx
push edx
mov ecx, 0x68f000
mov dword [esp + 0xd4], eax
mov dword [esp + 0xd8], edi
call fcn.004e2730
mov ecx, eax
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov dword [eax + 0x10], esi
mov eax, dword [0x6d67a8]
mov ecx, dword [esp + 0x28]
cmp ecx, eax
mov dword [esp + 0x30], edx
jne 0x4bc36f
push 0x6d67a8
push eax
push 1
mov ecx, esi
call fcn.0041d2c0
mov eax, dword [esp + 0x28]
mov ecx, dword [0x6d67a8]
cmp eax, ecx
jne 0x4bc36f
mov ecx, 0x68ef70
call fcn.0041bb10
push 5
push 2
push 8
mov ecx, 0x68ef70
call fcn.0041b980
push 5
push 2
push 8
mov ecx, 0x68ef70
call fcn.0041b9b0
push 1
mov ecx, 0x68ef70
call fcn.0041bb60
mov ecx, dword [ebx + 6]
mov eax, dword [ebx + 0xa]
or ecx, eax
je 0x4bc397
mov edx, dword [esp + 0x24]
mov ecx, 0x68ec20
push edx
call fcn.00413e40
cmp eax, edi
je 0x4bc397
push eax
mov ecx, 0xce82a8
call fcn.004fcd20
mov ecx, dword [ebx + 6]
mov eax, dword [0x6d6a00]
mov edx, dword [ebx + 0xa]
or eax, ecx
mov ecx, dword [0x6d6a04]
mov dword [0x6d6a00], eax
or ecx, edx
or eax, ecx
mov dword [0x6d6a04], ecx
je 0x4bc426
mov ecx, dword [0x6d6fc0]
cmp ecx, edi
jne 0x4bc417
push 0xec
call fcn.00613321
add esp, 4
mov dword [esp + 0x2c], eax
cmp eax, edi
mov dword [esp + 0x4cc], 1
je 0x4bc3ee
mov ecx, eax
call fcn.0041d6c0
jmp 0x4bc3f0
xor eax, eax
cmp eax, edi
mov dword [esp + 0x4cc], 0xffffffff
je 0x4bc409
mov ecx, eax
mov dword [0x6d6fc0], ecx
jmp 0x4bc40f
mov ecx, dword [0x6d6fc0]
cmp ecx, edi
je 0x4bc914
push 0x6d67a8
call fcn.0041d730
jmp 0x4bc916
mov esi, dword [0x6d6fc0]
mov dword [0x6d6a10], edi
cmp esi, edi
mov dword [0x6d6a14], edi
mov byte [0x6d6c49], 4
mov byte [0x6d6c4a], 4
mov byte [0x6d6c4b], 4
je 0x4bc916
mov ecx, esi
call fcn.005a07e0
push esi
call fcn.006066eb
add esp, 4
mov dword [0x6d6fc0], edi
jmp 0x4bc916
mov eax, dword [ebx + 6]
mov esi, dword [ebp + 0x258]
mov ecx, dword [ebx + 0xa]
or esi, eax
mov dword [ebp + 0x258], esi
mov edx, dword [ebp + 0x25c]
or edx, ecx
mov dword [ebp + 0x25c], edx
mov edx, dword [ebp + 0x258]
or edx, dword [ebp + 0x25c]
je 0x4bc4fa
cmp dword [ebp + 0x818], edi
jne 0x4bc4e8
push 0xec
call fcn.00613321
add esp, 4
mov dword [esp + 0x2c], eax
cmp eax, edi
mov dword [esp + 0x4cc], 2
je 0x4bc4d1
mov ecx, eax
call fcn.0041d6c0
jmp 0x4bc4d3
xor eax, eax
cmp eax, edi
mov dword [esp + 0x4cc], 0xffffffff
je 0x4bc4e8
mov dword [ebp + 0x818], eax
mov ecx, dword [ebp + 0x818]
cmp ecx, edi
je 0x4bc53b
push ebp
call fcn.0041d730
jmp 0x4bc53b
mov esi, dword [ebp + 0x818]
mov dword [ebp + 0x268], edi
cmp esi, edi
mov dword [ebp + 0x26c], edi
mov byte [ebp + 0x4a1], 4
mov byte [ebp + 0x4a2], 4
mov byte [ebp + 0x4a3], 4
je 0x4bc53b
mov ecx, esi
call fcn.005a07e0
push esi
call fcn.006066eb
add esp, 4
mov dword [ebp + 0x818], edi
cmp dword [esp + 0x10], edi
jne 0x4bc61a
mov eax, dword [esp + 0x24]
mov ecx, 0x68d9e0
push eax
call fcn.00403bf0
cmp eax, 5
je 0x4bc734
xor esi, esi
lea ecx, [esp + 0x3bc]
push esi
push 0x645a20
push ecx
mov dword [esp + 0x3b8], esi
mov dword [esp + 0x438], esi
mov dword [esp + 0x3bc], 0xc
mov dword [esp + 0x3c0], esi
call fcn.006133d6
lea edi, [esp + 0x3c8]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x3f8]
mov dword [esp + 0x3b8], ecx
xor ecx, ecx
mov dword [edx - 0x30], esi
mov ebx, dword [esp + 0x3b8]
mov eax, ecx
add edx, 4
sub eax, ebx
lea eax, [eax + eax*4]
shl eax, 1
mov dword [edx - 4], eax
inc ecx
cmp ecx, 0xc
jl 0x4bc5b6
mov eax, dword [ebp + 0x2d8]
mov dword [esp + 0x428], 0x12c
cmp eax, esi
mov dword [esp + 0x430], 0x14
je 0x4bc736
mov eax, dword [ebp + 0x41c]
lea ecx, [ebp + 0x414]
lea edx, [esp + 0x3ac]
push edx
push 1
push eax
call fcn.004e2860
jmp 0x4bc736
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x224]
push ebx
xor esi, esi
push 0x645a20
push eax
mov dword [esp + 0x220], ebx
mov dword [esp + 0x2a0], esi
mov dword [esp + 0x224], 0xc
mov dword [esp + 0x228], esi
call fcn.006133d6
lea edi, [esp + 0x230]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x260]
mov dword [esp + 0x220], ecx
xor ecx, ecx
mov dword [edx - 0x30], esi
mov edi, dword [esp + 0x220]
mov eax, ecx
add edx, 4
sub eax, edi
lea eax, [eax + eax*4]
shl eax, 1
mov dword [edx - 4], eax
inc ecx
cmp ecx, 0xc
jl 0x4bc677
mov eax, dword [ebp + 0x2d8]
mov dword [esp + 0x290], 0x12c
cmp eax, esi
mov dword [esp + 0x298], 0x14
je 0x4bc6d2
mov eax, dword [ebp + 0x41c]
lea ecx, [ebp + 0x414]
lea edx, [esp + 0x214]
push edx
push 1
push eax
call fcn.004e2860
mov edx, dword [ebp + 0xd8]
mov eax, 5
sub edx, ebx
mov ecx, edx
mov dword [ebp + 0xd8], edx
cmp ecx, eax
jg 0x4bc6f1
mov dword [ebp + 0xd8], eax
cmp ebx, 0x32
jge 0x4bc701
mov word [ebp + 0x80c], 1
jmp 0x4bc729
cmp ebx, 0x96
jge 0x4bc714
mov word [ebp + 0x80c], 2
jmp 0x4bc729
xor eax, eax
cmp ebx, 0x12c
setge al
add eax, 3
mov word [ebp + 0x80c], ax
push ebp
mov ecx, 0xa234d8
call fcn.00475990
xor esi, esi
mov eax, dword [esp + 0x44]
xor ecx, ecx
and eax, 0x100
or eax, ecx
je 0x4bc914
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4bc914
mov eax, dword [eax]
cmp eax, 0x6000
jb 0x4bc914
cmp eax, 0x7fff
ja 0x4bc914
mov eax, dword [0x68f00c]
test eax, eax
je 0x4bc7cf
lea ecx, [esp + 0x20]
push ecx
mov ecx, 0x68f000
call fcn.00423f80
mov ecx, dword [0x68f004]
mov dword [esp + 0x14], eax
cmp eax, ecx
je 0x4bc7a4
mov edx, dword [esp + 0x20]
mov esi, dword [eax + 0xc]
cmp edx, esi
jb 0x4bc7a4
lea eax, [esp + 0x14]
jmp 0x4bc7b2
mov dword [esp + 0xbc], ecx
lea eax, [esp + 0xbc]
mov eax, dword [eax]
cmp eax, ecx
je 0x4bc7cf
mov esi, dword [eax + 0x10]
test esi, esi
je 0x4bc7cf
mov ecx, esi
call fcn.005a07e0
push esi
call fcn.006066eb
add esp, 4
push 0x1c
call fcn.00613321
add esp, 4
mov dword [esp + 0x2c], eax
test eax, eax
mov dword [esp + 0x4cc], 3
je 0x4bc7f7
mov ecx, eax
call fcn.0041d270
mov esi, eax
jmp 0x4bc7f9
xor esi, esi
test esi, esi
mov dword [esp + 0x4cc], 0xffffffff
je 0x4bc8cc
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x390]
mov edx, dword [eax + 0x2d8]
mov ecx, dword [edx + ecx*4]
mov edx, dword [eax + 0x358]
lea ecx, [ecx + edx - 0x21d]
mov edx, dword [eax + 0x340]
sub edx, 0x4b
push ecx
push edx
mov ecx, esi
call fcn.0041d2a0
mov eax, dword [esp + 0x20]
push 0xcb
push eax
call fcn.00475730
mov ecx, dword [esp + 0x28]
push 0xcd
push ecx
call fcn.00475730
mov edx, dword [esp + 0x30]
push 0xcc
push edx
call fcn.00475730
mov eax, dword [esp + 0x38]
add esp, 0x18
lea ecx, [esp + 0xdc]
lea edx, [esp + 0x1f4]
push ecx
push edx
mov ecx, 0x68f000
mov dword [esp + 0xe4], eax
mov dword [esp + 0xe8], 0
call fcn.004e2730
mov ecx, eax
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov dword [eax + 0x10], esi
mov eax, dword [0x6d67a8]
mov ecx, dword [esp + 0x28]
cmp ecx, eax
mov dword [esp + 0x30], edx
jne 0x4bc9c4
push 0x6d67a8
push eax
push 1
mov ecx, esi
call fcn.0041d2c0
mov eax, dword [esp + 0x28]
mov ecx, dword [0x6d67a8]
cmp eax, ecx
jne 0x4bc9c4
mov ecx, 0x68ef70
call fcn.0041bb10
push 5
push 2
push 8
mov ecx, 0x68ef70
call fcn.0041b980
push 5
push 2
push 8
mov ecx, 0x68ef70
call fcn.0041b9b0
push 1
mov ecx, 0x68ef70
call fcn.0041bb60
xor edi, edi
mov ecx, dword [0x6d67a8]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jne 0x4bc9c4
cmp word [esp + 0x18], 0x5fff
ja 0x4bc991
mov edx, dword [ebp + 0xb8]
mov ecx, dword [0x68e33c]
mov eax, dword [0x6d6860]
add edx, ecx
cmp edx, eax
jl 0x4bc991
mov esi, dword [esp + 0x10]
cmp esi, edi
jle 0x4bc991
mov eax, dword [ebp + 0xe4]
cmp eax, edi
je 0x4bc978
mov ecx, dword [0x68e338]
imul ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, esi
jge 0x4bc991
cmp dword [esp + 0x3c], edi
je 0x4bc991
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, 0x68d9e0
call fcn.00407a70
mov dword [esp + 0x3c], edi
mov esi, dword [esp + 0x24]
mov ecx, 0x68d9e0
push esi
call fcn.00403bf0
cmp eax, 5
jne 0x4bc9bc
cmp dword [esp + 0x3c], edi
je 0x4bc9c4
push esi
mov ecx, 0x68d9e0
call fcn.00407a70
mov dword [esp + 0x3c], edi
jmp 0x4bc9c4
mov dword [esp + 0x3c], 1
cmp dword [ebp + 0x250], 7
je 0x4bdd0c
mov ax, word [ebp + 0x80c]
xor ecx, ecx
cmp ax, cx
mov dword [esp + 0x10], ecx
jbe 0x4bd1d5
cmp ax, 5
jae 0x4bd1d5
mov eax, dword [esp + 0x44]
and eax, 0x2000000
or eax, ecx
jne 0x4bd154
mov edx, dword [0x6d67a8]
mov eax, dword [ebp]
cmp eax, edx
jne 0x4bca29
call fcn.005a44e0
add eax, 0x42
mov dword [0x68efb0], eax
call fcn.005a44e0
add eax, 0x42
mov dword [0x68efac], eax
push 1
push 1
mov ecx, ebp
mov dword [esp + 0x18], 1
call fcn.00451ca0
mov eax, dword [ebp]
cmp eax, 0x4000
jb 0x4bcdba
cmp eax, 0x5fff
ja 0x4bcdba
lea ebx, [ebp + 0x444]
lea edx, [ebp + 0x434]
mov eax, ebx
mov dword [esp + 0x1c], edx
mov esi, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0x8c], esi
mov esi, dword [edx + 4]
mov dword [esp + 0x54], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x90], esi
mov edi, dword [edx + 8]
mov dword [esp + 0x58], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x94], edi
mov edx, dword [edx + 0xc]
mov dword [esp + 0x5c], ecx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x98], edx
cmp eax, edx
mov dword [esp + 0x60], eax
jne 0x4bcac3
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov esi, edx
jmp 0x4bcb0e
sub eax, edx
sub esi, edi
sar eax, 2
mov edx, eax
shl eax, 4
add eax, edx
lea eax, [eax + eax*4]
lea edx, [edx + eax*4]
mov eax, dword [esp + 0x54]
sub ecx, eax
mov eax, 0x2aaaaaab
mov dword [esp + 0x14], edx
imul ecx
mov eax, dword [esp + 0x14]
sar edx, 1
mov ecx, edx
add edx, eax
shr ecx, 0x1f
mov eax, 0x2aaaaaab
add ecx, edx
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, ecx
lea esi, [eax + edx - 0x155]
mov edi, dword [esp + 0x1c]
mov ecx, edi
mov edx, dword [ecx]
mov dword [esp + 0x154], edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x158], eax
mov edx, dword [ecx + 8]
mov dword [esp + 0x15c], edx
mov eax, dword [ecx + 0xc]
lea ecx, [esp + 0x154]
push ecx
lea ecx, [esp + 0x90]
mov dword [esp + 0x164], eax
call fcn.0045b790
mov edx, ebx
mov dword [esp + 0x1c], eax
mov eax, dword [edx]
mov dword [esp + 0x194], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x198], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x19c], eax
mov ecx, dword [edx + 0xc]
lea edx, [esp + 0x54]
mov dword [esp + 0x1a0], ecx
push edx
lea ecx, [esp + 0x198]
call fcn.0045b790
cmp dword [esp + 0x1c], eax
jae 0x4bcc2e
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov dword [eax], ecx
mov ecx, dword [esp + 0x7c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x80]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0xac]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0xb0]
mov eax, esp
sub esp, 0x10
mov dword [eax], ecx
mov ecx, dword [esp + 0xc4]
mov dword [eax + 4], edx
mov edx, dword [esp + 0xc8]
mov dword [eax + 8], ecx
mov ecx, esp
mov dword [eax + 0xc], edx
mov eax, edi
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0x4c4]
push ecx
call fcn.0045cba0
add esp, 0x34
test esi, esi
jbe 0x4bccc3
lea ecx, [ebp + 0x430]
call fcn.0045b650
dec esi
jne 0x4bcc1b
jmp 0x4bccc3
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x90]
sub esp, 0x10
mov edx, esp
sub esp, 0x10
mov dword [edx], eax
mov eax, dword [esp + 0xb4]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0xb8]
mov dword [edx + 8], eax
mov eax, dword [ebx]
mov dword [edx + 0xc], ecx
mov ecx, dword [ebx + 4]
mov edx, esp
sub esp, 0x10
mov dword [edx], eax
mov eax, dword [ebx + 8]
mov dword [edx + 4], ecx
mov ecx, dword [ebx + 0xc]
mov dword [edx + 8], eax
mov eax, dword [esp + 0x84]
mov dword [edx + 0xc], ecx
mov ecx, dword [esp + 0x88]
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x8c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x90]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea edx, [esp + 0x494]
push edx
call fcn.0045cc40
add esp, 0x34
test esi, esi
jbe 0x4bccc3
lea ecx, [ebp + 0x430]
call fcn.0045a570
dec esi
jne 0x4bccb5
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4bcd07
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp + 0x174], ecx
mov ecx, dword [edi + 8]
push eax
mov dword [esp + 0x17c], edx
mov edx, dword [edi + 0xc]
lea eax, [esp + 0x458]
mov dword [esp + 0x180], ecx
push eax
lea ecx, [esp + 0x17c]
mov dword [esp + 0x188], edx
call fcn.0045b6e0
mov esi, dword [ebp + 0x468]
lea ecx, [ebp + 0x460]
mov eax, esi
mov edx, dword [ecx + 4]
cmp eax, esi
je 0x4bcd2a
mov edi, dword [eax]
add eax, 4
mov dword [edx], edi
add edx, 4
cmp eax, esi
jne 0x4bcd1c
mov eax, dword [ecx + 8]
mov dword [ecx + 8], edx
lea edx, [ebp + 0x424]
mov dword [esp + 0x2c], eax
mov eax, dword [ecx + 8]
push edx
push 1
push eax
call fcn.00478080
mov si, word [ebp + 0x254]
mov ecx, dword [ebp + 0x464]
push esi
mov dword [ebp + 0x470], ecx
call fcn.0040eed0
add esp, 4
and esi, 0xffff
mov ecx, ebp
mov dword [ebp + 0x7f8], eax
push esi
push 7
call fcn.00476c30
mov eax, dword [ebp + 0x4a4]
test al, 2
je 0x4bcd92
test al, 1
je 0x4bcd92
mov dword [ebp + 0x378], 0x21
jmp 0x4bcd9c
mov dword [ebp + 0x378], 0
mov edx, dword [ebp + 0x470]
push 2
mov ecx, ebp
mov eax, dword [edx]
push eax
call fcn.0040db40
mov ecx, ebp
call fcn.00476d00
jmp 0x4bd154
mov ecx, dword [esp + 0x24]
push 2
push ecx
mov ecx, 0x68ec20
call fcn.00410e40
test eax, eax
je 0x4bd140
lea ebx, [ebp + 0x444]
lea edx, [ebp + 0x434]
mov eax, ebx
mov dword [esp + 0x1c], edx
mov esi, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0x9c], esi
mov esi, dword [edx + 4]
mov dword [esp + 0x7c], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0xa0], esi
mov edi, dword [edx + 8]
mov dword [esp + 0x80], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0xa4], edi
mov edx, dword [edx + 0xc]
mov dword [esp + 0x84], ecx
mov eax, dword [eax + 0xc]
mov dword [esp + 0xa8], edx
cmp eax, edx
mov dword [esp + 0x88], eax
jne 0x4bce4a
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov esi, edx
jmp 0x4bce95
sub eax, edx
sub esi, edi
sar eax, 2
mov edx, eax
shl eax, 4
add eax, edx
lea eax, [eax + eax*4]
lea edx, [edx + eax*4]
mov eax, dword [esp + 0x7c]
sub ecx, eax
mov eax, 0x2aaaaaab
mov dword [esp + 0x14], edx
imul ecx
mov eax, dword [esp + 0x14]
sar edx, 1
mov ecx, edx
add edx, eax
shr ecx, 0x1f
mov eax, 0x2aaaaaab
add ecx, edx
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, ecx
lea esi, [eax + edx - 0x155]
mov edi, dword [esp + 0x1c]
mov ecx, edi
mov edx, dword [ecx]
mov dword [esp + 0x134], edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x138], eax
mov edx, dword [ecx + 8]
mov dword [esp + 0x13c], edx
mov eax, dword [ecx + 0xc]
lea ecx, [esp + 0x134]
push ecx
lea ecx, [esp + 0xa0]
mov dword [esp + 0x144], eax
call fcn.0045b790
mov edx, ebx
mov dword [esp + 0x1c], eax
mov eax, dword [edx]
mov dword [esp + 0x144], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x148], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x14c], eax
mov ecx, dword [edx + 0xc]
lea edx, [esp + 0x7c]
mov dword [esp + 0x150], ecx
push edx
lea ecx, [esp + 0x148]
call fcn.0045b790
cmp dword [esp + 0x1c], eax
jae 0x4bcfbb
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x80]
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov dword [eax], ecx
mov ecx, dword [esp + 0xa4]
mov dword [eax + 4], edx
mov edx, dword [esp + 0xa8]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0xbc]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0xc0]
mov eax, esp
sub esp, 0x10
mov dword [eax], ecx
mov ecx, dword [esp + 0xd4]
mov dword [eax + 4], edx
mov edx, dword [esp + 0xd8]
mov dword [eax + 8], ecx
mov ecx, esp
mov dword [eax + 0xc], edx
mov eax, edi
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0x4a4]
push ecx
call fcn.0045cba0
add esp, 0x34
test esi, esi
jbe 0x4bd050
lea ecx, [ebp + 0x430]
call fcn.0045b650
dec esi
jne 0x4bcfa8
jmp 0x4bd050
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0xa0]
sub esp, 0x10
mov edx, esp
sub esp, 0x10
mov dword [edx], eax
mov eax, dword [esp + 0xc4]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0xc8]
mov dword [edx + 8], eax
mov eax, dword [ebx]
mov dword [edx + 0xc], ecx
mov ecx, dword [ebx + 4]
mov edx, esp
sub esp, 0x10
mov dword [edx], eax
mov eax, dword [ebx + 8]
mov dword [edx + 4], ecx
mov ecx, dword [ebx + 0xc]
mov dword [edx + 8], eax
mov eax, dword [esp + 0xac]
mov dword [edx + 0xc], ecx
mov ecx, dword [esp + 0xb0]
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0xb4]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0xb8]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea edx, [esp + 0x464]
push edx
call fcn.0045cc40
add esp, 0x34
test esi, esi
jbe 0x4bd050
lea ecx, [ebp + 0x430]
call fcn.0045a570
dec esi
jne 0x4bd042
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4bd08c
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp + 0x164], ecx
mov ecx, dword [edi + 8]
mov dword [esp + 0x168], edx
mov edx, dword [edi + 0xc]
mov dword [esp + 0x16c], ecx
push eax
lea ecx, [esp + 0x168]
mov dword [esp + 0x174], edx
call fcn.00474d40
mov esi, dword [ebp + 0x468]
lea ecx, [ebp + 0x460]
mov eax, esi
mov edx, dword [ecx + 4]
cmp eax, esi
je 0x4bd0af
mov edi, dword [eax]
add eax, 4
mov dword [edx], edi
add edx, 4
cmp eax, esi
jne 0x4bd0a1
mov eax, dword [ecx + 8]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], edx
mov edx, dword [ecx + 8]
push eax
push 1
push edx
call fcn.00478080
mov si, word [ebp + 0x254]
mov eax, dword [ebp + 0x464]
push esi
mov dword [ebp + 0x470], eax
call fcn.0040eed0
add esp, 4
and esi, 0xffff
mov ecx, ebp
mov dword [ebp + 0x7f8], eax
push esi
push 7
call fcn.00476c30
mov eax, dword [ebp + 0x4a4]
test al, 2
je 0x4bd11d
test al, 1
je 0x4bd11d
mov dword [ebp + 0x378], 0x21
jmp 0x4bd127
mov dword [ebp + 0x378], 0
mov ecx, dword [ebp + 0x470]
push 2
mov edx, dword [ecx]
mov ecx, ebp
push edx
call fcn.0040db40
mov ecx, ebp
call fcn.00476d00
mov esi, dword [esp + 0x24]
mov ecx, 0x68d9e0
push esi
call fcn.00403bf0
cmp eax, 5
je 0x4bd181
mov esi, dword [esp + 0x24]
push 3
push esi
mov ecx, 0x68ec20
call fcn.00410e40
test eax, eax
je 0x4bd181
push 3
push esi
push ebp
mov ecx, 0x68ec20
call fcn.00413ac0
push eax
push ebp
call fcn.0041b370
add esp, 8
mov eax, dword [0x6729d0]
test eax, eax
je 0x4bd1c9
cmp word [esp + 0x18], 0x5fff
ja 0x4bd1a4
push ebp
call fcn.00413f10
add esp, 4
test eax, eax
jne 0x4bdd0c
xor eax, eax
push 0xd
mov ax, word [ebp + 0x80c]
mov ecx, 0x68ec20
push eax
push ebp
call fcn.00413ac0
push eax
push ebp
call fcn.0041b370
mov esi, dword [esp + 0x2c]
add esp, 8
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4bdcb2
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, 0x68d9e0
call fcn.00403bf0
cmp eax, 5
jne 0x4bdd0c
push 1
push 1
mov ecx, ebp
call fcn.00451ca0
cmp dword [ebp], 0x5fff
ja 0x4bd6f7
push ebp
call fcn.00413f10
add esp, 4
test eax, eax
jne 0x4bdd0c
lea eax, [ebp + 0x444]
lea edx, [ebp + 0x434]
mov word [ebp + 0x80c], 1
mov dword [esp + 0x14], eax
mov ecx, dword [eax]
mov dword [esp + 0x1c], edx
mov esi, dword [edx]
mov dword [esp + 0x64], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0xf4], esi
mov ebx, dword [edx + 4]
mov dword [esp + 0x68], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0xf8], ebx
mov esi, dword [edx + 8]
mov dword [esp + 0x6c], ecx
mov eax, dword [eax + 0xc]
mov edi, dword [edx + 0xc]
mov dword [esp + 0x70], eax
cmp eax, edi
jne 0x4bd283
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x18], edx
jmp 0x4bd2d9
sub eax, edi
sub ebx, esi
sar eax, 2
mov edx, eax
shl eax, 4
add eax, edx
lea eax, [eax + eax*4]
lea edx, [edx + eax*4]
mov eax, 0x2aaaaaab
mov dword [esp + 0x18], edx
imul ebx
mov eax, dword [esp + 0x18]
sar edx, 1
mov ebx, edx
add edx, eax
shr ebx, 0x1f
add ebx, edx
mov edx, dword [esp + 0x64]
sub ecx, edx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ebx
mov ebx, dword [esp + 0xf8]
lea edx, [ecx + edx - 0x155]
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov dword [esp + 0x114], edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x118], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x11c], eax
mov ecx, dword [ecx + 0xc]
cmp edi, ecx
jne 0x4bd31b
mov ecx, esi
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov dword [esp + 0x10], edx
jmp 0x4bd389
mov eax, edi
sub eax, ecx
sar eax, 2
mov ecx, eax
shl ecx, 4
add ecx, eax
lea edx, [ecx + ecx*4]
mov ecx, esi
lea edx, [eax + edx*4]
mov eax, dword [esp + 0xf4]
sub ecx, eax
mov eax, 0x2aaaaaab
mov dword [esp + 0x10], edx
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 1
mov ecx, edx
add edx, eax
mov eax, dword [esp + 0x118]
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0x11c]
sub eax, edx
mov dword [esp + 0x10], ecx
mov ecx, eax
mov eax, 0x2aaaaaab
imul ecx
mov eax, dword [esp + 0x10]
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, eax
lea ecx, [ecx + edx - 0x155]
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
mov dword [esp + 0x184], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x188], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x18c], eax
mov ecx, dword [edx + 0xc]
lea edx, [esp + 0x64]
mov dword [esp + 0x190], ecx
push edx
lea ecx, [esp + 0x188]
call fcn.0045b790
cmp dword [esp + 0x10], eax
jae 0x4bd497
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x6c]
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x1a4], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x1ac], edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1a8], ecx
mov ecx, dword [esp + 0xf4]
mov dword [esp + 0x1b0], eax
mov eax, dword [edx]
mov dword [esp + 0xe4], ecx
mov dword [esp + 0xf0], edi
mov dword [esp + 0xe8], ebx
mov ecx, dword [edx + 4]
mov dword [esp + 0xec], esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov edi, dword [edx + 8]
cmp edi, esi
mov edx, dword [edx + 0xc]
mov dword [esp + 0x38], edx
je 0x4bd476
lea ecx, [esp + 0xe4]
call fcn.0045cd90
mov esi, dword [eax + 8]
lea ecx, [esp + 0x1a4]
call fcn.0045cd90
mov eax, dword [eax + 8]
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 8]
mov dword [eax + 8], ecx
mov eax, dword [esp + 0xec]
cmp edi, eax
jne 0x4bd43d
mov eax, dword [esp + 0x18]
test eax, eax
jbe 0x4bd521
mov esi, eax
lea ecx, [ebp + 0x430]
call fcn.0045b650
dec esi
jne 0x4bd484
jmp 0x4bd521
mov eax, dword [esp + 0xf4]
sub esp, 0x10
mov edx, esp
sub esp, 0x10
mov ecx, esp
sub esp, 0x10
mov dword [edx], eax
mov eax, dword [esp + 0x44]
mov dword [edx + 4], ebx
mov dword [edx + 8], esi
mov dword [edx + 0xc], edi
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x94]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x98]
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [esp + 0x9c]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0xa0]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0x4e4]
push ecx
call fcn.0045cc40
mov eax, dword [esp + 0x4c]
add esp, 0x34
test eax, eax
jbe 0x4bd521
mov esi, eax
lea ecx, [ebp + 0x430]
call fcn.0045a570
dec esi
jne 0x4bd513
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4bd569
mov eax, dword [esp + 0x1c]
push ecx
lea ecx, [esp + 0x488]
mov edx, dword [eax]
push ecx
mov dword [esp + 0x1cc], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x1d0], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
lea ecx, [esp + 0x1cc]
mov dword [esp + 0x1d4], edx
mov dword [esp + 0x1d8], eax
call fcn.0045b6e0
mov edx, dword [ebp + 0x468]
lea esi, [ebp + 0x460]
mov eax, edx
mov ecx, dword [esi + 4]
cmp eax, edx
je 0x4bd58c
mov edi, dword [eax]
add eax, 4
mov dword [ecx], edi
add ecx, 4
cmp eax, edx
jne 0x4bd57e
mov edx, dword [esi + 8]
mov dword [esi + 8], ecx
mov eax, dword [esi + 0xc]
mov edi, ecx
sub eax, edi
mov dword [esp + 0x2c], edx
sar eax, 2
cmp eax, 1
lea ebx, [ebp + 0x424]
jae 0x4bd65f
mov ecx, esi
call fcn.00474340
cmp eax, 1
jbe 0x4bd5c6
mov ecx, esi
call fcn.00474340
mov ebx, eax
jmp 0x4bd5cb
mov ebx, 1
mov ecx, esi
call fcn.00474340
add eax, ebx
mov dword [esp + 0x1c], eax
jns 0x4bd5dc
xor eax, eax
lea ecx, [eax*4]
push ecx
call fcn.00613321
mov edx, dword [esi + 4]
add esp, 4
mov ebx, eax
mov ecx, esi
push ebx
push edi
push edx
call fcn.00478050
lea ecx, [ebp + 0x424]
mov dword [esp + 0x14], eax
push ecx
push 1
push eax
mov ecx, esi
call fcn.00478290
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 8]
add eax, 4
push eax
push ecx
push edi
mov ecx, esi
call fcn.00478050
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
push edx
push eax
mov ecx, esi
call fcn.004e2bb0
mov ecx, dword [esi + 4]
push ecx
call fcn.006066eb
mov edx, dword [esp + 0x20]
add esp, 4
mov ecx, esi
lea eax, [ebx + edx*4]
mov dword [esi + 0xc], eax
call fcn.00474340
lea ecx, [ebx + eax*4 + 4]
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
jmp 0x4bdc2c
mov eax, edi
sub eax, edi
sar eax, 2
cmp eax, 1
jae 0x4bd6ae
lea edx, [edi + 4]
mov ecx, esi
push edx
push edi
push edi
call fcn.00478050
mov eax, dword [esi + 8]
mov edx, 1
mov ecx, eax
push ebx
sub ecx, edi
sar ecx, 2
sub edx, ecx
mov ecx, esi
push edx
push eax
call fcn.00478290
mov eax, dword [esi + 8]
cmp edi, eax
je 0x4bdc28
mov ecx, dword [ebx]
mov dword [edi], ecx
add edi, 4
cmp edi, eax
jne 0x4bd69e
jmp 0x4bdc28
lea eax, [edi - 4]
push edi
push edi
push eax
mov ecx, esi
mov dword [esp + 0x38], eax
call fcn.00478050
mov ecx, dword [esi + 8]
lea eax, [ecx - 4]
cmp edi, eax
je 0x4bd6d8
mov edx, dword [eax - 4]
sub eax, 4
sub ecx, 4
cmp eax, edi
mov dword [ecx], edx
jne 0x4bd6c9
lea eax, [edi + 4]
cmp edi, eax
je 0x4bdc28
mov ecx, dword [ebp + 0x424]
mov dword [edi], ecx
add edi, 4
cmp edi, eax
jne 0x4bd6e3
jmp 0x4bdc28
mov edx, dword [esp + 0x24]
push 2
push edx
mov ecx, 0x68ec20
call fcn.00410e40
test eax, eax
je 0x4bdc9b
lea eax, [ebp + 0x444]
lea ecx, [ebp + 0x434]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], ecx
mov edx, dword [eax]
mov dword [esp + 0xac], edx
mov edx, dword [eax + 4]
mov dword [esp + 0xb0], edx
mov edx, dword [eax + 8]
mov dword [esp + 0xb4], edx
mov ebx, dword [eax + 0xc]
mov eax, dword [ecx]
mov dword [esp + 0x1d4], eax
mov edi, dword [ecx + 4]
mov esi, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
cmp ebx, ecx
jne 0x4bd76e
sub edx, esi
mov eax, 0x2aaaaaab
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
jmp 0x4bd7c5
mov eax, ebx
sub edi, esi
sub eax, ecx
sar eax, 2
mov edx, eax
shl edx, 4
add edx, eax
lea edx, [edx + edx*4]
lea edx, [eax + edx*4]
mov eax, 0x2aaaaaab
mov dword [esp + 0x14], edx
imul edi
mov eax, dword [esp + 0x14]
sar edx, 1
mov edi, edx
add edx, eax
mov eax, dword [esp + 0xac]
shr edi, 0x1f
add edi, edx
mov edx, dword [esp + 0xb4]
sub edx, eax
mov eax, 0x2aaaaaab
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, edi
lea edx, [eax + edx - 0x155]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], edx
mov edx, dword [eax]
mov dword [esp + 0x1fc], edx
mov edx, dword [eax + 4]
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
cmp ecx, eax
jne 0x4bd7fb
sub esi, edi
mov eax, 0x2aaaaaab
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x10], edx
jmp 0x4bd845
sub ecx, eax
sub edx, edi
sar ecx, 2
mov eax, ecx
shl eax, 4
add eax, ecx
lea eax, [eax + eax*4]
lea ecx, [ecx + eax*4]
mov eax, 0x2aaaaaab
imul edx
sar edx, 1
mov edi, edx
add edx, ecx
mov ecx, dword [esp + 0x1d4]
mov eax, 0x2aaaaaab
shr edi, 0x1f
sub esi, ecx
add edi, edx
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, edi
lea ecx, [eax + edx - 0x155]
mov dword [esp + 0x10], ecx
mov esi, dword [esp + 0x2c]
mov edx, esi
mov edi, dword [edx]
mov eax, dword [edx + 4]
mov dword [esp + 0x200], eax
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
cmp eax, ebx
jne 0x4bd87c
mov eax, dword [esp + 0xb4]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
jmp 0x4bd8cd
sub eax, ebx
sub ecx, edi
sar eax, 2
mov edx, eax
shl eax, 4
add eax, edx
lea eax, [eax + eax*4]
lea ebx, [edx + eax*4]
mov eax, dword [esp + 0xb0]
mov edx, dword [esp + 0xb4]
sub eax, edx
mov edx, eax
mov eax, 0x2aaaaaab
imul edx
mov eax, ebx
sar edx, 1
mov ebx, edx
add edx, eax
shr ebx, 0x1f
mov eax, 0x2aaaaaab
add ebx, edx
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ebx
lea edx, [ecx + edx - 0x155]
cmp dword [esp + 0x10], edx
jae 0x4bd9c0
mov edx, dword [esi]
mov ecx, dword [esi + 8]
mov ebx, dword [esp + 0x1c]
mov eax, dword [esi + 4]
mov dword [esp + 0x1b4], edx
mov edx, dword [esi + 0xc]
mov dword [esp + 0x1bc], ecx
mov ecx, ebx
mov dword [esp + 0x1c0], edx
mov dword [esp + 0x1b8], eax
mov edx, dword [ecx]
mov dword [esp + 0x104], edx
mov edx, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 0x108], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x10c], eax
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x110], ecx
mov ecx, dword [edx]
mov dword [esp + 0x2c], ecx
mov ecx, dword [edx + 4]
mov dword [esp + 0x30], ecx
mov edi, dword [edx + 8]
cmp edi, eax
mov edx, dword [edx + 0xc]
mov dword [esp + 0x38], edx
je 0x4bd981
lea ecx, [esp + 0x104]
call fcn.0045cd90
mov esi, dword [eax + 8]
lea ecx, [esp + 0x1b4]
call fcn.0045cd90
mov eax, dword [eax + 8]
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 8]
mov dword [eax + 8], ecx
mov eax, dword [esp + 0x10c]
cmp edi, eax
jne 0x4bd948
mov eax, dword [esp + 0x18]
test eax, eax
jbe 0x4bda3f
mov edi, eax
mov esi, 0xc
mov eax, dword [ebp + 0x43c]
mov edx, dword [ebp + 0x45c]
lea ecx, [ebp + 0x430]
add eax, esi
dec edx
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x2c], edx
je 0x4bd9b6
cmp eax, dword [ecx + 8]
jne 0x4bd9bb
call fcn.0045bed0
dec edi
jne 0x4bd994
jmp 0x4bda3f
mov ebx, dword [esp + 0x1c]
sub esp, 0x10
mov edx, ebx
mov eax, esp
sub esp, 0x10
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, esp
mov edx, dword [edx + 0xc]
sub esp, 0x10
mov dword [eax + 0xc], edx
mov eax, esi
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov edx, dword [esi]
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 4]
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [esi + 8]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0x4d4]
push ecx
call fcn.0045cc40
mov esi, dword [esp + 0x4c]
add esp, 0x34
test esi, esi
jbe 0x4bda3f
lea ecx, [ebp + 0x430]
call fcn.0045a570
dec esi
jne 0x4bda31
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4bda83
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x124], edx
mov edx, dword [ebx + 8]
mov dword [esp + 0x128], ecx
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0x12c], edx
lea edx, [esp + 0x444]
mov dword [esp + 0x130], ecx
push eax
push edx
lea ecx, [esp + 0x12c]
call fcn.0045b6e0
mov edx, dword [ebp + 0x468]
lea esi, [ebp + 0x460]
mov eax, edx
mov ecx, dword [esi + 4]
cmp eax, edx
je 0x4bdaa6
mov edi, dword [eax]
add eax, 4
mov dword [ecx], edi
add ecx, 4
cmp eax, edx
jne 0x4bda98
mov eax, dword [esi + 8]
mov dword [esi + 8], ecx
mov edx, dword [esi + 0xc]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 8]
sub edx, eax
mov dword [esp + 0x4c], ecx
sar edx, 2
cmp edx, 1
mov edi, eax
jae 0x4bdb9c
mov edx, dword [esi + 4]
test edx, edx
je 0x4bdae1
mov ecx, eax
sub ecx, edx
sar ecx, 2
cmp ecx, 1
ja 0x4bdae6
mov ecx, 1
test edx, edx
jne 0x4bdaee
xor eax, eax
jmp 0x4bdaf3
sub eax, edx
sar eax, 2
add eax, ecx
test eax, eax
mov dword [esp + 0x14], eax
jge 0x4bdaff
xor eax, eax
shl eax, 2
push eax
call fcn.00613321
mov ebx, dword [esi + 4]
add esp, 4
cmp ebx, edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], eax
je 0x4bdb3a
mov ecx, dword [esp + 0x18]
push ebx
push ecx
call fcn.0045cd40
mov edx, dword [esp + 0x20]
add ebx, 4
add esp, 8
add edx, 4
cmp ebx, edi
mov dword [esp + 0x18], edx
jne 0x4bdb1a
mov ebx, dword [esp + 0x18]
lea edx, [esp + 0x4c]
push edx
push 1
push ebx
mov ecx, esi
call fcn.00478290
mov eax, dword [esi + 8]
add ebx, 4
push ebx
push eax
push edi
mov ecx, esi
call fcn.00478050
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push ecx
push edx
mov ecx, esi
call fcn.004e2bb0
mov eax, dword [esi + 4]
push eax
call fcn.006066eb
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x18]
add esp, 4
lea edx, [edi + ecx*4]
mov ecx, esi
mov dword [esi + 0xc], edx
call fcn.00474340
lea eax, [edi + eax*4 + 4]
mov dword [esi + 4], edi
mov dword [esi + 8], eax
jmp 0x4bdc2c
mov ecx, eax
sub ecx, edi
sar ecx, 2
cmp ecx, 1
jae 0x4bdbea
lea ecx, [edi + 4]
push ecx
push eax
push edi
mov ecx, esi
call fcn.00478050
mov eax, dword [esi + 8]
lea edx, [esp + 0x4c]
mov ecx, eax
push edx
sub ecx, edi
mov edx, 1
sar ecx, 2
sub edx, ecx
mov ecx, esi
push edx
push eax
call fcn.00478290
mov eax, dword [esi + 8]
cmp edi, eax
je 0x4bdc28
mov ecx, dword [esp + 0x4c]
mov dword [edi], ecx
add edi, 4
cmp edi, eax
jne 0x4bdbdb
jmp 0x4bdc28
lea ecx, [eax - 4]
push eax
push eax
mov dword [esp + 0x34], ecx
push ecx
mov ecx, esi
call fcn.00478050
mov ecx, dword [esi + 8]
lea eax, [ecx - 4]
cmp edi, eax
je 0x4bdc14
mov edx, dword [eax - 4]
sub eax, 4
sub ecx, 4
cmp eax, edi
mov dword [ecx], edx
jne 0x4bdc05
lea eax, [edi + 4]
cmp edi, eax
je 0x4bdc28
mov ecx, dword [esp + 0x4c]
mov dword [edi], ecx
add edi, 4
cmp edi, eax
jne 0x4bdc1b
add dword [esi + 8], 4
mov si, word [ebp + 0x254]
mov edx, dword [ebp + 0x464]
push esi
mov dword [ebp + 0x470], edx
call fcn.0040eed0
add esp, 4
and esi, 0xffff
mov ecx, ebp
mov dword [ebp + 0x7f8], eax
push esi
push 7
call fcn.00476c30
mov eax, dword [ebp + 0x4a4]
test al, 2
je 0x4bdc78
test al, 1
je 0x4bdc78
mov dword [ebp + 0x378], 0x21
jmp 0x4bdc82
mov dword [ebp + 0x378], 0
mov eax, dword [ebp + 0x470]
push 2
mov ecx, dword [eax]
push ecx
mov ecx, ebp
call fcn.0040db40
mov ecx, ebp
call fcn.00476d00
mov edx, dword [esp + 0x24]
push 3
push edx
mov ecx, 0x68ec20
call fcn.00410e40
test eax, eax
je 0x4bdd0c
jmp 0x4bdcd7
push esi
mov ecx, 0x68d9e0
call fcn.00403bf0
cmp eax, 5
jne 0x4bdd0c
mov edx, dword [esp + 0x24]
push 3
push edx
mov ecx, 0x68ec20
call fcn.00410e40
test eax, eax
je 0x4bdd0c
mov esi, dword [esp + 0x24]
push 3
push esi
push ebp
mov ecx, 0x68ec20
call fcn.00413ac0
push eax
push ebp
call fcn.0041b370
mov ecx, dword [esp + 0x4dc]
xor eax, eax
add esp, 8
mov ax, word [ecx + 0x14]
mov ecx, 0x68d9e0
push eax
push esi
call fcn.00406d00
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0xd8]
inc eax
cmp eax, ecx
mov dword [esp + 0x40], eax
jl 0x4bbd1b
mov ecx, dword [esp + 0x4c4]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x4c0
ret