Function at 0x436664
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x455b08
mov eax, dword fs:[0]
push eax
sub esp, 0xb10
mov eax, dword [0x47a084]
xor eax, esp
mov dword [esp + 0xb08], eax
push ebx
push esi
push edi
mov eax, dword [0x47a084]
xor eax, esp
push eax
lea eax, [esp + 0xb20]
mov dword fs:[0], eax
and dword [esp + 0x58], 0
mov eax, dword [ebp + 8]
push dword [0x47b7b0]
mov dword [esp + 0x40], eax
call fcn.004129ea
pop ecx
mov dword [esp + 0x74], eax
and dword [esp + 0xb28], 0
push dword [0x47b20c]
lea eax, [esp + 0x130]
call fcn.004044c6
mov byte [esp + 0xb28], 1
push dword [0x47b598]
push eax
lea eax, [esp + 0x1a4]
call fcn.00408b22
mov byte [esp + 0xb30], 2
push dword [0x47b210]
push eax
lea eax, [esp + 0x1e4]
call fcn.00408b22
add esp, 0x10
mov byte [esp + 0xb28], 3
cmp dword [eax + 0x14], 0x10
jb 0x436723
mov eax, dword [eax]
mov ebx, dword [esp + 0x3c]
push ebx
push dword [0x47b7b0]
push eax
push 0
call fcn.0043cb93
add esp, 0x10
push 1
xor edi, edi
lea esi, [esp + 0x1d8]
call fcn.004049dc
push 1
lea esi, [esp + 0x1a0]
call fcn.004049dc
push 1
lea esi, [esp + 0x130]
mov byte [esp + 0xb2c], 0
call fcn.004049dc
mov dword [esp + 0x1c], 0x55
mov dword [esp + 0x2c], 0x3d
mov eax, dword [esp + 0x2c]
sub eax, 0x3c
mov dword [esp + 0x1c], eax
add dword [esp + 0x2c], 0xffffff9d
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
call dword [eax + 8]
push 0x7ff
mov ebx, eax
lea eax, [esp + 0x319]
push edi
push eax
mov byte [esp + 0x320], 0
call fcn.00412970
mov dword [esp + 0x28], 0x51
mov dword [esp + 0x34], 0x19
mov dword [esp + 0x24], 0x3c
mov dword [esp + 0x38], 0x20
mov eax, dword [esp + 0x24]
add esp, 0xc
cdq
push 0x27
pop ecx
idiv ecx
mov ecx, dword [esp + 0x18]
sub eax, ecx
add eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
sub eax, 0x31
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
cmp ecx, eax
jl 0x43680f
mov eax, dword [esp + 0x18]
add eax, 0x37
mov dword [esp + 0x2c], eax
fld qword [0x4749c8]
mov dword [esp + 0x7c], 0x800
fstp qword [esp + 0x1c]
fld qword [esp + 0x1c]
fmul qword [0x474a20]
fstp qword [esp + 0x1c]
fld qword [esp + 0x1c]
fsub qword [0x4749c0]
fadd qword [esp + 0x1c]
fsub qword [esp + 0x1c]
fsub qword [esp + 0x1c]
fstp qword [esp + 0x1c]
fld qword [esp + 0x1c]
fadd qword [0x4749b8]
fstp qword [esp + 0x1c]
fld qword [esp + 0x1c]
fadd qword [esp + 0x1c]
fstp qword [esp + 0x1c]
fld qword [esp + 0x1c]
fadd qword [esp + 0x1c]
fstp qword [esp + 0x1c]
fld qword [esp + 0x1c]
fadd qword [0x4749b0]
fstp qword [esp + 0x1c]
call fcn.0043d195
lea ecx, [esp + 0x7c]
push ecx
lea ecx, [esp + 0x318]
push ecx
push 0
call dword [eax + 0x1a4]
lea eax, [esp + 0x314]
push eax
call fcn.0043dca1
fld qword [0x474a08]
fstp qword [esp + 0x5c]
push 0x88
fld qword [0x474a00]
mov dword [esp + 0x2c], eax
fstp qword [esp + 0x20]
fld qword [0x4749f8]
fst qword [esp + 0x20]
fld qword [0x4749f0]
fstp qword [esp + 0x20]
fstp qword [esp + 0x68]
fld qword [0x4749e8]
fstp qword [esp + 0x20]
fld qword [0x4749e0]
fstp qword [esp + 0x30]
fld qword [0x4749d8]
fstp qword [esp + 0x30]
fld qword [esp + 0x20]
fld qword [esp + 0x68]
fmul qword [0x4749d0]
fsubp st(1)
fsub qword [esp + 0x60]
fadd qword [esp + 0x20]
fstp qword [esp + 0x20]
call fcn.004120b7
pop ecx
mov dword [esp + 0x1c], eax
mov byte [esp + 0xb28], 4
test eax, eax
je 0x436977
lea eax, [esp + 0xd8]
push eax
mov edx, 0xfde9
mov ecx, ebx
call fcn.0044ab98
pop ecx
push dword [esp + 0x28]
mov byte [esp + 0xb2c], 5
push eax
push dword [ebx + 0xb8]
mov eax, dword [esp + 0x48]
push dword [ebx + 0xb4]
mov dword [esp + 0x68], 1
push dword [ebx + 0xbc]
push dword [eax + 0x10]
push dword [esp + 0x34]
call fcn.00436068
jmp 0x436979
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0xb28], 8
test byte [esp + 0x58], 1
je 0x4369a8
and dword [esp + 0x58], 0xfffffffe
push 1
xor edi, edi
lea esi, [esp + 0xdc]
call fcn.004049dc
mov dword [esp + 0x1c], 0x55
mov dword [esp + 0x2c], 0x3d
mov eax, dword [esp + 0x2c]
sub eax, 0x3c
mov dword [esp + 0x1c], eax
add dword [esp + 0x2c], 0xffffff9d
and dword [esp + 0x210], 0
push 2
pop eax
mov dword [esp + 0x1f0], eax
mov dword [esp + 0x1f4], 5
mov dword [esp + 0x1f8], 6
mov dword [esp + 0x1fc], 7
mov dword [esp + 0x200], 8
mov dword [esp + 0x204], 0xb
mov dword [esp + 0x208], 0x31
mov dword [esp + 0x20c], 0x3f
lea esi, [esp + 0x1f0]
or dword [esp + 0x80], 0xffffffff
lea ecx, [esp + 0x80]
push ecx
push eax
push dword [esp + 0x30]
call fcn.0043dc4a
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x436a2e
lea eax, [esp + 0x164]
lea ecx, [ebx + 0x20]
push eax
mov edx, 0xfde9
call fcn.0044ab98
pop ecx
mov byte [esp + 0xb28], 9
cmp dword [eax + 0x14], 0x10
jb 0x436a77
mov eax, dword [eax]
push dword [esp + 0x18]
movzx ecx, word [ebx + 0x58]
push ecx
push eax
push dword [esp + 0x34]
call fcn.0043dc23
mov dword [esp + 0x48], eax
push 1
xor edi, edi
lea esi, [esp + 0x168]
mov byte [esp + 0xb2c], 0xb
call fcn.004049dc
mov dword [esp + 0x54], 0x29
mov dword [esp + 0x1c], 0x3f
mov dword [esp + 0x5c], 5
mov dword [esp + 0x28], 0x5d
mov dword [esp + 0x2c], 0x2c
mov dword [esp + 0x14], 0x2a
mov dword [esp + 0x64], 0x5a
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x54]
cmp eax, ecx
jg 0x436b74
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x1c]
imul eax, ecx
mov ecx, dword [esp + 0x2c]
imul ecx, ecx, 0x44
sub ecx, eax
mov dword [esp + 0x5c], ecx
mov eax, dword [esp + 0x64]
imul eax, eax, 0x4f
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
cdq
push 0x63
pop ecx
idiv ecx
mov ecx, dword [esp + 0x14]
push 0xfffffffffffffffa
imul eax, ecx
pop ecx
sub ecx, eax
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x28]
imul eax, edx
sub ecx, eax
mov eax, dword [esp + 0x14]
sub ecx, eax
mov eax, dword [esp + 0x14]
sub ecx, eax
add ecx, dword [esp + 0x54]
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
imul eax, eax, 6
imul ecx, ecx, 5
sub eax, ecx
mov ecx, dword [esp + 0x54]
sub eax, ecx
mov ecx, dword [esp + 0x2c]
sub eax, ecx
mov ecx, dword [esp + 0x28]
lea eax, [eax + ecx - 0x5d]
add eax, dword [esp + 0x54]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
imul eax, eax, 0x594
sub ecx, eax
add ecx, dword [esp + 0x64]
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x48], edi
jne 0x436c96
call fcn.0043d195
call dword [eax + 0x44]
test eax, eax
jle 0x436bac
and eax, 0xffff
or eax, 0x80070000
mov dword [esp + 0x3c], eax
lea eax, [esp + 0xf4]
mov esi, 0xfde9
push eax
mov edx, esi
mov ecx, ebx
call fcn.0044ab98
pop ecx
mov edi, eax
lea eax, [esp + 0x1b8]
push eax
mov edx, esi
lea ecx, [ebx + 0x20]
mov byte [esp + 0xb2c], 0xc
call fcn.0044ab98
pop ecx
mov byte [esp + 0xb28], 0xd
cmp dword [edi + 0x14], 0x10
jb 0x436bf4
mov edi, dword [edi]
cmp dword [eax + 0x14], 0x10
jb 0x436bfc
mov eax, dword [eax]
push edi
push eax
push dword [esp + 0x44]
mov eax, dword [ebx + 0xb8]
push dword [0x47b7b4]
or eax, 1
push eax
call fcn.0043cb93
add esp, 0x14
push 1
xor edi, edi
lea esi, [esp + 0x1bc]
call fcn.004049dc
push 1
lea esi, [esp + 0xf8]
call fcn.004049dc
mov byte [esp + 0xb28], 0
cmp dword [esp + 0x18], edi
je 0x436c59
push dword [esp + 0x18]
call fcn.00435ac5
push dword [esp + 0x18]
call fcn.0041088c
pop ecx
mov edi, dword [esp + 0x3c]
or dword [esp + 0xb28], 0xffffffff
lea esi, [esp + 0x74]
call fcn.0040458b
mov eax, edi
mov ecx, dword [esp + 0xb20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb08]
xor ecx, esp
call fcn.00410897
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebx + 0xe0]
or esi, 0x84000000
cmp dword [ebx + 0x1c], 4
jne 0x436cae
or esi, 0x800000
cmp byte [ebx + 0xc0], 0
je 0x436cbe
mov eax, dword [0x47b7b8]
jmp 0x436cd0
mov eax, dword [0x47b7bc]
cmp dword [ebx + 0xd4], edi
ja 0x436cd0
mov eax, dword [0x47b7c0]
push eax
lea eax, [esp + 0xc0]
call fcn.004044c6
lea eax, [esp + 0x110]
lea ecx, [ebx + 0x3c]
push eax
mov edx, 0xfde9
mov byte [esp + 0xb2c], 0xe
call fcn.0044ab98
pop ecx
mov byte [esp + 0xb28], 0xf
cmp dword [eax + 0x14], 0x10
jb 0x436d0b
mov eax, dword [eax]
cmp dword [esp + 0xd0], 0x10
mov ecx, dword [esp + 0xbc]
jae 0x436d23
lea ecx, [esp + 0xbc]
push dword [esp + 0x18]
push esi
push dword [0x47b7c4]
push eax
push ecx
push dword [esp + 0x5c]
call fcn.0043dbfb
mov dword [esp + 0x4c], eax
push 1
xor edi, edi
lea esi, [esp + 0x114]
mov byte [esp + 0xb2c], 0x11
call fcn.004049dc
cmp dword [esp + 0x4c], edi
jne 0x436df2
call fcn.0043d195
call dword [eax + 0x44]
test eax, eax
jle 0x436d75
and eax, 0xffff
or eax, 0x80070000
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x148]
push eax
mov edx, 0xfde9
mov ecx, ebx
call fcn.0044ab98
pop ecx
mov byte [esp + 0xb28], 0x12
cmp dword [eax + 0x14], 0x10
jb 0x436d9e
mov eax, dword [eax]
push eax
push dword [esp + 0x40]
mov eax, dword [ebx + 0xb8]
push dword [0x47b7c8]
or eax, 1
push eax
call fcn.0043cb93
add esp, 0x10
push 1
xor edi, edi
lea esi, [esp + 0x14c]
call fcn.004049dc
push 1
xor edi, edi
lea esi, [esp + 0xc0]
call fcn.004049dc
mov byte [esp + 0xb28], 8
push dword [esp + 0x48]
call fcn.0040a2ad
pop ecx
jmp 0x436c38
push dword [0x47b7cc]
lea eax, [esp + 0x88]
call fcn.004044c6
mov eax, ebx
mov byte [esp + 0xb28], 0x13
call fcn.00437952
test al, al
je 0x437218
xor esi, esi
mov dword [esp + 0xb4], 0xf
mov dword [esp + 0xb0], esi
mov byte [esp + 0xa0], 0
mov eax, dword [esp + 0x3c]
lea edi, [esp + 0x3b]
push edi
lea edi, [esp + 0xa4]
push edi
lea edi, [esp + 0x78]
push edi
mov byte [esp + 0xb34], 0x14
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
lea edi, [esp + 0x5c]
push edi
push eax
call dword [edx + 0xc]
cmp dword [esp + 0x50], esi
jbe 0x437200
cmp dword [esp + 0xb0], esi
jne 0x436fcc
lea eax, [esp + 0x180]
push eax
mov edx, 0xfde9
mov ecx, ebx
call fcn.0044ab98
pop ecx
mov byte [esp + 0xb28], 0x15
cmp dword [eax + 0x14], 0x10
jb 0x436e9f
mov eax, dword [eax]
push eax
movzx eax, byte [esp + 0x3f]
push eax
push dword [esp + 0x78]
mov eax, dword [ebx + 0xb8]
push dword [esp + 0x5c]
or eax, 1
push dword [0x47b7d0]
push eax
call fcn.0043cb93
add esp, 0x18
push 1
xor edi, edi
lea esi, [esp + 0x184]
call fcn.004049dc
fld qword [0x474a48]
fstp qword [esp + 0x1c]
fld qword [0x474a40]
fst qword [esp + 0x64]
fld qword [0x474a38]
fstp qword [esp + 0x3c]
fld qword [0x474a30]
fstp qword [esp + 0x3c]
fld qword [0x474a28]
fstp qword [esp + 0x5c]
fld qword [esp + 0x5c]
fld qword [esp + 0x1c]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x436f4f
fadd qword [esp + 0x1c]
fstp qword [esp + 0x3c]
fld qword [esp + 0x64]
fmul qword [0x474a18]
fmul qword [esp + 0x1c]
fld qword [esp + 0x64]
fmul qword [0x474a20]
fsubp st(1)
fstp qword [esp + 0x3c]
fld qword [esp + 0x5c]
fmul qword [0x474a10]
fstp qword [esp + 0x1c]
jmp 0x436f51
fstp st(0)
push 1
xor edi, edi
lea esi, [esp + 0xa4]
call fcn.004049dc
push 1
lea esi, [esp + 0x88]
call fcn.004049dc
mov byte [esp + 0xb28], 0xe
push dword [esp + 0x4c]
call fcn.0040a2ad
pop ecx
push 1
lea esi, [esp + 0xc0]
call fcn.004049dc
mov byte [esp + 0xb28], 8
push dword [esp + 0x48]
call fcn.0040a2ad
pop ecx
mov byte [esp + 0xb28], 0
cmp dword [esp + 0x18], edi
je 0x436fc2
push dword [esp + 0x18]
call fcn.00435ac5
push dword [esp + 0x18]
call fcn.0041088c
pop ecx
mov edi, 0x8000ffff
jmp 0x436c5d
cmp dword [esp + 0xb4], 0x10
mov eax, dword [esp + 0xa0]
jae 0x436fe4
lea eax, [esp + 0xa0]
push eax
push dword [esp + 0x74]
push dword [esp + 0x58]
push dword [0x47b7d4]
push esi
call fcn.0043cb93
add esp, 0x14
push 0xff
lea eax, [esp + 0x219]
push esi
push eax
mov byte [esp + 0x220], 0
call fcn.00412970
mov dword [esp + 0x20], 0x22
mov eax, dword [esp + 0x20]
cdq
add esp, 0xc
push 0x13
pop ecx
idiv ecx
mov ecx, dword [esp + 0x14]
push 0x2c
mov esi, 0x100
imul eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
imul eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
pop ecx
sub ecx, eax
mov eax, dword [esp + 0x14]
sub ecx, eax
mov eax, dword [esp + 0x14]
sub ecx, eax
add ecx, dword [esp + 0x14]
add ecx, dword [esp + 0x14]
add ecx, dword [esp + 0x14]
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
imul eax, eax, 0x62
sub eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
imul eax, eax, 0x14
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
push dword [esp + 0x50]
sub eax, ecx
push dword [0x47b7d8]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x21c]
push esi
push eax
call fcn.00412c8e
mov edi, eax
mov eax, dword [esp + 0x80]
add esp, 0x10
cmp eax, dword [esp + 0x50]
jbe 0x4370e3
dec eax
push eax
push dword [0x47b7dc]
mov eax, esi
sub eax, edi
push eax
lea eax, [esp + edi + 0x220]
push eax
call fcn.00412c8e
add esp, 0x10
add edi, eax
push dword [0x47b19c]
sub esi, edi
lea eax, [esp + edi + 0x218]
push esi
push eax
call fcn.00412c8e
lea eax, [esp + 0x220]
add esp, 0xc
push eax
call fcn.00412a80
pop ecx
lea ecx, [esp + 0x214]
mov edi, eax
push ecx
lea eax, [esp + 0x88]
call fcn.00403c40
cmp byte [esp + 0x3b], 0
mov esi, dword [0x47b7e0]
jne 0x437133
mov esi, dword [str.Xw_Cp]
push esi
call fcn.00412a80
pop ecx
mov edi, eax
push esi
lea eax, [esp + 0x88]
call fcn.00403c40
push 0
lea eax, [esp + 0xa4]
push eax
or eax, 0xffffffff
lea esi, [esp + 0x8c]
call fcn.00403cef
mov dword [esp + 0x1c], 0x55
mov dword [esp + 0x2c], 0x3d
mov eax, dword [esp + 0x2c]
sub eax, 0x3c
mov dword [esp + 0x1c], eax
add dword [esp + 0x2c], 0xffffff9d
mov eax, dword [0x47b19c]
push eax
mov esi, eax
call fcn.00412a80
pop ecx
mov edi, eax
push esi
lea eax, [esp + 0x88]
call fcn.00403c40
mov dword [esp + 0x14], 0x1c
add dword [esp + 0x14], 0xfffffff1
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
imul eax, ecx
mov ecx, dword [esp + 0x14]
imul eax, eax, 0x51
sub eax, ecx
add eax, dword [esp + 0x14]
add eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
add dword [esp + 0x14], 0x4e
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
sub eax, ecx
mov ecx, dword [esp + 0x14]
sub eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
imul eax, eax, 0x43
add eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
push 1
xor edi, edi
lea esi, [esp + 0xa4]
mov byte [esp + 0xb2c], 0x13
call fcn.004049dc
mov eax, dword [esp + 0x84]
push 0x10
pop edi
cmp dword [esp + 0x98], edi
jae 0x437232
lea eax, [esp + 0x84]
push dword [esp + 0x94]
push eax
push dword [esp + 0x54]
call fcn.0043dbdb
test eax, eax
jne 0x4372c2
call fcn.0043d195
call dword [eax + 0x44]
test eax, eax
jle 0x43725d
and eax, 0xffff
or eax, 0x80070000
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x84]
cmp dword [esp + 0x98], edi
jae 0x437278
lea eax, [esp + 0x84]
push eax
push dword [esp + 0x40]
mov eax, dword [ebx + 0xb8]
push dword [0x47b7ec]
or eax, 1
push dword [0x47b7e8]
push eax
call fcn.0043cb93
add esp, 0x14
push 1
xor edi, edi
lea esi, [esp + 0x88]
call fcn.004049dc
mov byte [esp + 0xb28], 0xe
push dword [esp + 0x4c]
call fcn.0040a2ad
pop ecx
jmp 0x436dcb
mov dword [esp + 0x1c], 0x51
mov dword [esp + 0x1c], 0x19
mov dword [esp + 0x28], 0x3c
mov dword [esp + 0x2c], 0x20
mov eax, dword [esp + 0x28]
cdq
push 0x27
pop ecx
idiv ecx
mov ecx, dword [esp + 0x28]
sub eax, ecx
add eax, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1c]
sub eax, 0x31
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
cmp ecx, eax
jl 0x43731c
mov eax, dword [esp + 0x28]
add eax, 0x37
mov dword [esp + 0x2c], eax
mov ecx, dword [ebx + 0xf4]
test ecx, ecx
je 0x43737f
lea esi, [ebx + 0xe4]
cmp dword [esi + 0x14], edi
jb 0x437335
mov eax, dword [esi]
jmp 0x437337
mov eax, esi
push ecx
push eax
push dword [esp + 0x54]
call fcn.0043dbdb
test eax, eax
jne 0x43737f
call fcn.0043d195
call dword [eax + 0x44]
test eax, eax
jle 0x43735c
and eax, 0xffff
or eax, 0x80070000
cmp dword [esi + 0x14], edi
jb 0x437363
mov esi, dword [esi]
push esi
push eax
push dword [0x47b7f0]
push dword [0x47b7e8]
push dword [ebx + 0xb8]
call fcn.0043cb93
add esp, 0x14
mov dword [esp + 0x14], 0x1c
add dword [esp + 0x14], 0xfffffff1
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
imul eax, ecx
mov ecx, dword [esp + 0x14]
imul eax, eax, 0x51
sub eax, ecx
add eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add eax, dword [esp + 0x14]
lea esi, [esp + 0x4c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
add dword [esp + 0x14], 0x4e
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
sub eax, ecx
mov ecx, dword [esp + 0x14]
sub eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
imul eax, eax, 0x43
add eax, dword [esp + 0x14]
lea ecx, [esp + 0x48]
mov dword [esp + 0x14], eax
call fcn.00433280
push 1
xor edi, edi
lea esi, [esp + 0x88]
call fcn.004049dc
mov byte [esp + 0xb28], 0xe
cmp dword [esp + 0x4c], edi
je 0x437419
push dword [esp + 0x4c]
call fcn.0040a2ad
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xc0]
call fcn.004049dc
mov byte [esp + 0xb28], 8
cmp dword [esp + 0x48], edi
je 0x437441
push dword [esp + 0x48]
call fcn.0040a2ad
pop ecx
push dword [esp + 0x3c]
mov esi, dword [esp + 0x1c]
lea eax, [ebx + 0xc4]
push eax
movzx eax, byte [ebx + 0xc0]
push eax
push esi
call fcn.004352a5
and dword [esp + 0x78], 0
mov edi, eax
call fcn.00433f2f
jmp 0x436c5d