Function at 0x4bf940
Capabilities:
Access peb ldr_data
Check os version
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x528096
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x568fd0]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x568fd0]
xor eax, esp
push eax
lea eax, [esp + 0x134]
mov dword fs:[0], eax
mov eax, dword [esp + 0x160]
fld dword [esp + 0x160]
mov esi, dword [esp + 0x144]
mov ebp, dword [esp + 0x14c]
mov edi, edx
mov edx, dword [esp + 0x164]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x168]
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x16c]
mov dword [esp + 0x44], eax
fstp dword [esp + 0x44]
mov dword [esp + 0x48], edx
fld dword [esp + 0x48]
fld dword [esp + 0x15c]
mov dword [esp + 0x38], edi
fcom st(1)
mov dword [esp + 0x30], esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], ebp
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x4bf9ee
fstp dword [esp + 0x48]
jmp 0x4bf9f0
fstp st(0)
mov eax, dword [ecx]
mov eax, dword [eax + 8]
lea edx, [esp + 0x80]
push edx
call eax
mov ecx, dword [ebp + 0x48]
sub ecx, dword [ebp + 0x44]
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0x21
ja 0x4bfa20
call fcn.00501daa
mov eax, dword [ebp + 0x44]
add eax, 0x948
xor ecx, ecx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x70], vtable.FontAlias.0
mov edx, dword [eax + 0x44]
mov dword [esp + 0x74], edx
mov dword [esp + 0x13c], ecx
mov dword [esp + 0x6c], ecx
jmp 0x4bfa58
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
lea eax, [ecx + ecx*4 + 0x1bd]
mov eax, dword [ebp + eax*4]
mov dword [esp + 0x1c], eax
test eax, eax
jle 0x4c07fb
fld dword [esp + 0x44]
lea ecx, [ecx + ecx*4]
mov eax, dword [ebp + ecx*4 + 0x6f0]
fst dword [esp + 0x3c]
fiadd dword [esp + 0x1c]
lea ebx, [ebp + ecx*4]
mov dword [esp + 0x4c], ebx
fstp dword [esp + 0x44]
cmp eax, 1
je 0x4bfb70
test dword [ebx + 0x6f8], 0xfe000000
je 0x4bfaf0
fld dword [esp + 0x84]
fnstcw word [esp + 0x54]
movzx eax, word [esp + 0x54]
or eax, 0xc00
mov dword [esp + 0x1c], eax
fldcw word [esp + 0x1c]
fistp dword [esp + 0x1c]
mov dl, byte [esp + 0x1c]
and dl, 1
fldcw word [esp + 0x54]
je 0x4bfae2
mov eax, dword [edi + 4]
mov edx, dword [esi]
mov edx, dword [edx + 0x34]
push eax
jmp 0x4bfba0
mov eax, dword [edi + 8]
mov edx, dword [esi]
mov edx, dword [edx + 0x34]
push eax
jmp 0x4bfba0
mov ecx, dword [ebp + 0x48]
sub ecx, dword [ebp + 0x44]
sub eax, 2
je 0x4bfb49
sub eax, 1
mov eax, 0x38e38e39
je 0x4bfb27
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x21
ja 0x4bfb1b
call fcn.00501daa
mov ecx, dword [ebp + 0x44]
mov eax, dword [ecx + 0x978]
push eax
jmp 0x4bfb9b
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x20
ja 0x4bfb3d
call fcn.00501daa
mov ecx, dword [ebp + 0x44]
mov eax, dword [ecx + 0x92c]
push eax
jmp 0x4bfb9b
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x20
ja 0x4bfb64
call fcn.00501daa
mov ecx, dword [ebp + 0x44]
mov eax, dword [ecx + 0x930]
push eax
jmp 0x4bfb9b
mov ecx, dword [ebp + 0x48]
sub ecx, dword [ebp + 0x44]
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x21
ja 0x4bfb91
call fcn.00501daa
mov eax, dword [ebp + 0x44]
mov ecx, dword [eax + 0x978]
push ecx
mov edx, dword [esi]
mov edx, dword [edx + 0x38]
mov ecx, dword [esp + 0x40]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x54]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x58]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x5c]
mov dword [eax + 0xc], ecx
mov ecx, esi
call edx
fld dword [esp + 0x164]
fadd dword [esp + 0x84]
call fcn.00505040
cdq
idiv dword [ebp + 0x65c]
mov ecx, dword [esp + 0x24]
mov esi, eax
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
fld dword [esp + 0x84]
mov edi, dword [ebp + 0x65c]
add eax, esi
imul edi, esi
mov dword [esp + 0x2c], eax
call fcn.00505040
sub edi, eax
test dword [ebx + 0x6f8], 0xfe000000
mov dword [esp + 0x50], edi
mov byte [esp + 0x1a], 0
je 0x4bfdb6
mov edi, dword [esp + 0x24]
add edi, 0x2a4
cmp dword [edi + 4], 0
jne 0x4bfc37
mov eax, dword [esp + 0x2c]
jmp 0x4bfc66
mov esi, dword [esp + 0x2c]
test esi, esi
jg 0x4bfc43
xor eax, eax
jmp 0x4bfc66
mov eax, edi
call fcn.004beda0
cmp esi, eax
jle 0x4bfc5c
mov eax, edi
call fcn.004beda0
push eax
mov eax, dword [edi + 0x10]
push eax
jmp 0x4bfc61
mov ecx, dword [edi + 0x10]
push esi
push ecx
call fcn.004a5280
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 0x2c8]
mov edx, dword [ecx + 4]
add ecx, 4
push eax
mov eax, dword [edx + 0x1c]
push ecx
call eax
mov ebx, eax
test ebx, 0x1000
je 0x4bfd06
cmp dword [edi + 4], 0
mov esi, dword [esp + 0x2c]
je 0x4bfcc2
test esi, esi
jg 0x4bfc99
xor esi, esi
jmp 0x4bfcc2
mov eax, edi
call fcn.004beda0
cmp esi, eax
jle 0x4bfcb2
mov eax, edi
call fcn.004beda0
mov ecx, dword [edi + 0x10]
push eax
push ecx
jmp 0x4bfcbb
mov edx, dword [esp + 0x2c]
mov eax, dword [edi + 0x10]
push edx
push eax
call fcn.004a5280
mov esi, eax
mov eax, ebx
test esi, esi
jle 0x4bfceb
test eax, 0x1000
je 0x4bfceb
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx + 0x2c8]
mov edx, dword [eax + 4]
add eax, 4
dec esi
push esi
push eax
mov eax, dword [edx + 0x1c]
call eax
test esi, esi
jg 0x4bfcc8
test eax, 0x2000
jne 0x4bfd06
and eax, 0xfff
and ebx, 0xfff
cmp ebx, eax
jge 0x4bfd06
mov byte [esp + 0x1a], 1
mov ecx, dword [esp + 0x38]
cmp byte [ecx + 0x1c], 0
je 0x4bfdb6
mov ebx, dword [esp + 0x24]
mov edx, dword [ebx]
mov eax, dword [edx + 0xc]
mov ecx, ebx
call eax
mov esi, eax
add esi, dword [esp + 0x148]
cmp dword [edi + 4], 0
jne 0x4bfd34
mov eax, esi
jmp 0x4bfd5f
test esi, esi
jg 0x4bfd3c
xor eax, eax
jmp 0x4bfd5f
mov eax, edi
call fcn.004beda0
cmp esi, eax
jle 0x4bfd55
mov eax, edi
call fcn.004beda0
mov ecx, dword [edi + 0x10]
push eax
push ecx
jmp 0x4bfd5a
mov edx, dword [edi + 0x10]
push esi
push edx
call fcn.004a5280
mov esi, dword [ebx + 0x290]
lea edi, [eax + 1]
mov eax, dword [ebx + 0x260]
sub eax, dword [ebx + 0x25c]
sar eax, 4
cmp esi, eax
jb 0x4bfd80
call fcn.00501daa
mov ecx, dword [ebx + 0x25c]
mov eax, dword [ebx + 0x2c8]
mov edx, dword [eax + 4]
shl esi, 4
mov esi, dword [esi + ecx]
add eax, 4
push esi
push eax
mov eax, dword [edx + 0x14]
call eax
mov ecx, dword [esp + 0x38]
mov edx, dword [ebx + 0x2c8]
push eax
add ecx, 0xc
push ecx
push edx
mov eax, edi
call fcn.0049d5a0
push ebp
push 0x1f
mov eax, 0x1a
call fcn.004bf920
mov dword [esp + 0x90], eax
push ebp
push 0x1e
mov eax, 0x19
call fcn.004bf920
add esp, 0x10
mov dword [esp + 0x8c], eax
mov edi, dword [esp + 0x24]
add edi, 0x2a4
cmp dword [edi + 4], 0
jne 0x4bfdf6
mov eax, dword [edi + 0x14]
jmp 0x4bfe38
mov edx, dword [edi + 0x10]
mov eax, dword [edx + 8]
mov eax, dword [eax + 8]
add eax, 0xfffffffe
js 0x4bfe34
mov ecx, dword [edx + 8]
cmp eax, dword [ecx + 8]
jge 0x4bfe34
cmp eax, dword [ecx + 0xc]
jge 0x4bfe18
mov ecx, dword [ecx]
mov ecx, dword [ecx + eax*4]
jmp 0x4bfe2b
cmp eax, dword [ecx + 8]
jl 0x4bfe21
xor ecx, ecx
jmp 0x4bfe2b
mov esi, dword [ecx + 0x10]
mov ecx, dword [ecx]
add esi, eax
mov ecx, dword [ecx + esi*4]
cmp eax, dword [edx]
jle 0x4bfe36
add ecx, dword [edx + 4]
jmp 0x4bfe36
xor ecx, ecx
mov eax, ecx
cmp dword [esp + 0x2c], eax
jge 0x4c07fb
fild dword [esp + 0x50]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fld dword [esp + 0x15c]
fcompp
fnstsw ax
test ah, 0x41
jne 0x4c07fb
cmp dword [edi + 4], 0
jne 0x4bfe72
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x34], ebp
jmp 0x4bfee9
mov edx, dword [esp + 0x2c]
test edx, edx
jg 0x4bfe82
xor ebp, ebp
mov dword [esp + 0x34], ebp
jmp 0x4bfee9
mov esi, dword [edi + 0x10]
mov eax, dword [esi + 8]
mov eax, dword [eax + 8]
add eax, 0xfffffffe
js 0x4bfec0
mov ecx, dword [esi + 8]
cmp eax, dword [ecx + 8]
jge 0x4bfec0
cmp eax, dword [ecx + 0xc]
jge 0x4bfea4
mov ecx, dword [ecx]
mov ecx, dword [ecx + eax*4]
jmp 0x4bfeb7
cmp eax, dword [ecx + 8]
jl 0x4bfead
xor ecx, ecx
jmp 0x4bfeb7
mov ebx, dword [ecx + 0x10]
mov ecx, dword [ecx]
add ebx, eax
mov ecx, dword [ecx + ebx*4]
cmp eax, dword [esi]
jle 0x4bfec2
add ecx, dword [esi + 4]
jmp 0x4bfec2
xor ecx, ecx
cmp edx, ecx
jle 0x4bfedc
mov eax, edi
call fcn.004beda0
push eax
push esi
call fcn.004a5280
mov ebp, eax
mov dword [esp + 0x34], ebp
jmp 0x4bfee9
push edx
push esi
call fcn.004a5280
mov ebp, eax
mov dword [esp + 0x34], eax
cmp dword [edi + 4], 0
mov ecx, ebp
jne 0x4bfefc
mov eax, dword [edi + 0x14]
cmp ebp, eax
jg 0x4bff45
mov eax, ebp
jmp 0x4bff45
mov edx, dword [edi + 0x10]
mov eax, dword [edx + 8]
mov eax, dword [eax + 8]
lea esi, [eax - 1]
cmp ebp, esi
jle 0x4bff0f
lea ecx, [eax - 1]
test ecx, ecx
jl 0x4bff43
mov eax, dword [edx + 8]
cmp ecx, dword [eax + 8]
jge 0x4bff43
cmp ecx, dword [eax + 0xc]
jge 0x4bff27
mov eax, dword [eax]
mov eax, dword [eax + ecx*4]
jmp 0x4bff3a
cmp ecx, dword [eax + 8]
jl 0x4bff30
xor eax, eax
jmp 0x4bff3a
mov esi, dword [eax + 0x10]
mov eax, dword [eax]
add esi, ecx
mov eax, dword [eax + esi*4]
cmp ecx, dword [edx]
jle 0x4bff45
add eax, dword [edx + 4]
jmp 0x4bff45
xor eax, eax
mov esi, dword [esp + 0x2c]
cmp esi, eax
mov ebx, ebp
sete byte [esp + 0x1b]
call fcn.004bee50
mov ecx, dword [esp + 0x24]
cmp esi, eax
mov esi, dword [ecx + 0x2c8]
mov eax, dword [esi + 0x1c8]
mov ecx, dword [eax + 0xc]
sete byte [esp + 0x54]
test ecx, ecx
je 0x4bffd5
test ebp, ebp
jl 0x4bffd5
cmp ebp, ecx
jge 0x4bffd5
cmp ebp, dword [eax + 0x10]
mov edx, dword [eax + 4]
jge 0x4bff8a
lea ecx, [edx + ebp*4]
jmp 0x4bff92
mov ecx, dword [eax + 0x14]
add ecx, ebp
lea ecx, [edx + ecx*4]
cmp dword [ecx], 0
je 0x4bffd5
cmp ebp, dword [eax + 0x10]
jge 0x4bffa4
mov eax, dword [eax + 4]
lea eax, [eax + ebp*4]
jmp 0x4bffaf
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 4]
add ecx, ebp
lea eax, [edx + ecx*4]
mov eax, dword [eax]
mov eax, dword [eax]
xor edx, edx
test eax, eax
je 0x4bffd7
lea esp, [esp]
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
mov edi, 1
shl edi, cl
or edx, edi
test eax, eax
jne 0x4bffc0
jmp 0x4bffd7
xor edx, edx
cmp byte [esp + 0x1b], 0
mov dword [esp + 0x14], edx
jne 0x4bffea
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x4c]
test dword [eax + 0x6f8], 0xfe000000
mov byte [esp + 0x2b], 0
je 0x4c01aa
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x1c]
lea eax, [esi + 4]
push ebp
push eax
call edx
mov edi, eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x2c8]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x1c]
add eax, 4
lea ebx, [ebp + 1]
push ebx
push eax
call edx
mov esi, edi
mov ecx, eax
and esi, 0xfff
and ecx, 0xfff
test edi, 0x2000
je 0x4c02c1
cmp byte [esp + 0x1b], 0
je 0x4c00b2
cmp esi, ecx
jge 0x4c00c9
mov eax, dword [esp + 0x24]
push ebp
add eax, 0x2a4
call fcn.004bf290
test al, al
je 0x4c008c
cmp esi, 0x400
jne 0x4c0078
or dword [esp + 0x14], 0x80000000
jmp 0x4c00d9
mov ecx, dword [esp + 0x88]
mov eax, 1
shl eax, cl
or dword [esp + 0x14], eax
jmp 0x4c00d9
cmp esi, 0x400
jne 0x4c009e
or dword [esp + 0x14], 0x40000000
jmp 0x4c00d9
mov ecx, dword [esp + 0x8c]
mov edx, 1
shl edx, cl
or dword [esp + 0x14], edx
jmp 0x4c00d9
cmp esi, ecx
jge 0x4c00c9
mov eax, dword [esp + 0x24]
push ebp
add eax, 0x2a4
call fcn.004bf290
test al, al
jne 0x4c00d1
cmp esi, 0x400
jle 0x4c00d9
or dword [esp + 0x14], 0x20000000
mov ebp, dword [esp + 0x24]
add ebp, 0x2a4
mov eax, ebx
mov ecx, ebp
mov byte [esp + 0x1a], 0
call fcn.004bedf0
cmp dword [ebp + 4], 0
mov ebx, eax
je 0x4c0126
test ebx, ebx
jg 0x4c0101
xor ebx, ebx
jmp 0x4c0126
mov eax, ebp
call fcn.004beda0
cmp ebx, eax
jle 0x4c011a
mov eax, ebp
call fcn.004beda0
push eax
mov eax, dword [ebp + 0x10]
push eax
jmp 0x4c011f
mov ecx, dword [ebp + 0x10]
push ebx
push ecx
call fcn.004a5280
mov ebx, eax
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 0x2c8]
mov edx, dword [eax + 4]
add eax, 4
push ebx
push eax
mov eax, dword [edx + 0x1c]
call eax
mov dword [esp + 0x54], eax
mov eax, dword [edi + 0x2c8]
mov ecx, dword [eax + 4]
add eax, 4
lea edx, [ebx + 1]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov ecx, dword [esp + 0x34]
mov edi, eax
push ecx
mov eax, ebp
and edi, 0xfff
call fcn.004bf290
test al, al
jne 0x4c01a6
test dword [esp + 0x54], 0x1000
je 0x4c0182
cmp esi, edi
jle 0x4c0182
mov byte [esp + 0x1a], 1
mov edx, dword [esp + 0x38]
cmp byte [edx + 0x1c], 0
je 0x4c01a6
mov eax, edx
mov eax, dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4c01a6
cmp eax, ebx
jg 0x4c01a6
mov ecx, edx
cmp ebx, dword [ecx + 0x10]
jg 0x4c01a6
mov byte [esp + 0x2b], 1
mov ebp, dword [esp + 0x34]
mov eax, dword [esp + 0x4c]
fld dword [esp + 0x1c]
mov edx, dword [eax + 0x6f8]
and dword [esp + 0x14], edx
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x48]
mov eax, dword [eax + 0x6f0]
mov esi, dword [esp + 0x3c]
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x60], ecx
fstp dword [esp + 0x60]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x68], edx
mov edx, dword [ecx + 0x65c]
add edx, dword [esp + 0x50]
mov dword [esp + 0x5c], esi
mov dword [esp + 0x1c], edx
fild dword [esp + 0x1c]
mov dword [esp + 0x64], ebx
fstp dword [esp + 0x68]
cmp eax, 1
jne 0x4c058d
cmp byte [esp + 0x1b], 0
je 0x4c04bf
push 0x63
lea eax, [esp + 0xc9]
push 0
push eax
mov byte [esp + 0xd0], 0
call fcn.005033b0
add esp, 0xc
test ebp, ebp
jl 0x4c024d
lea ecx, [ebp + 1]
push ecx
lea edx, [esp + 0xc8]
push 0x54e4d0
push edx
call fcn.00502582
add esp, 0xc
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx + 0x2a0]
test al, 0xc0
je 0x4c0376
test al, 0x40
mov eax, dword [ecx + 0x2c8]
push ebp
je 0x4c0354
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x1c]
add eax, 4
push eax
call edx
mov ecx, eax
sar ecx, 0x10
push ecx
mov ecx, eax
shr ecx, 9
not cl
mov edx, eax
and eax, 0x2000
and edx, 0xfff
push edx
lea edx, [esp + 0xcc]
and ecx, 8
or ecx, 0x57
neg eax
sbb eax, eax
push ecx
and eax, 0xffffffe9
add eax, 0x5f
push eax
push str._c_c__03X__03X
push edx
call fcn.00502582
add esp, 0x18
jmp 0x4c0376
test edi, 0x1000
je 0x4c031d
cmp byte [esp + 0x1a], 0
je 0x4c02fe
test eax, 0x1000
je 0x4c02e4
or dword [esp + 0x14], 0x20000000
jmp 0x4c01aa
mov byte [esp + 0x1a], 0
cmp ecx, 0x400
jle 0x4c0310
or dword [esp + 0x14], 0x8000000
jmp 0x4c01aa
cmp esi, 0x400
jle 0x4c01a6
cmp ecx, esi
jge 0x4c02d7
jmp 0x4c02e9
or dword [esp + 0x14], 0x10000000
jmp 0x4c01aa
cmp esi, 0x400
jle 0x4c01a6
cmp ecx, esi
jge 0x4c02d7
mov byte [esp + 0x1a], 0
test eax, 0x1000
je 0x4c034b
or dword [esp + 0x14], 0x20000000
mov byte [esp + 0x1a], 1
jmp 0x4c01aa
cmp byte [esp + 0x54], 0
je 0x4c02d7
jmp 0x4c02e9
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x24]
add eax, 4
push eax
call edx
push eax
lea eax, [esp + 0xc8]
push 0x5551cc
push eax
call fcn.00502582
add esp, 0xc
mov edi, dword [esp + 0x60]
mov ebp, dword [esp + 0x68]
lea eax, [esp + 0xc4]
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c0396
mov ecx, dword [esp + 0x30]
sub eax, edx
mov edx, dword [ecx]
mov edx, dword [edx + 0x60]
push eax
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x78]
push eax
call edx
fstp dword [esp + 0x1c]
fld dword [esp + 0x64]
mov eax, dword [esp + 0x20]
fsub dword [esp + 0x1c]
fisub dword [eax + 0x7c8]
lea eax, [esp + 0xc4]
lea edx, [eax + 1]
fstp dword [esp + 0x90]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c03e0
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x48]
sub eax, edx
mov edx, dword [esp + 0x20]
sub ecx, dword [edx + 0x44]
mov esi, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x21
ja 0x4c0414
call fcn.00501daa
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x664]
fild dword [eax + 0x664]
test ecx, ecx
jge 0x4c042e
fadd dword [0x556040]
mov eax, dword [eax + 0x44]
fadd dword [esp + 0x94]
mov edx, dword [eax + 0x98c]
add eax, 0x948
fstp dword [esp + 0x1c]
mov dword [esp + 0x78], vtable.FontAlias.0
mov dword [esp + 0x7c], edx
fld dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
mov byte [esp + 0x13c], 1
mov edx, dword [ecx]
mov ecx, dword [eax + 0x30]
mov eax, dword [eax + 0x2c]
mov edx, dword [edx + 0x50]
push ecx
push eax
push esi
lea ecx, [esp + 0xd0]
push ecx
push ecx
mov ecx, dword [esp + 0xa4]
fstp dword [esp]
lea eax, [esp + 0x8c]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x58]
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
call edx
mov byte [esp + 0x13c], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x78], vtable.Font.0
jmp 0x4c06f2
test byte [ecx + 0x7d8], 4
je 0x4c06f6
fld dword [esp + 0x64]
mov edi, dword [esp + 0x68]
fsub qword [0x5560e0]
mov eax, ecx
mov ecx, dword [eax + 0x48]
sub ecx, dword [eax + 0x44]
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0xb4], esi
mov esi, dword [esp + 0x60]
mov dword [esp + 0xbc], ebx
fstp dword [esp + 0xbc]
cmp eax, 0x21
ja 0x4c0516
call fcn.00501daa
mov ebx, dword [esp + 0x20]
fld dword [esp + 0xbc]
mov ecx, dword [ebx + 0x44]
fsub dword [ecx + 0x968]
mov ecx, dword [ebx + 0x48]
sub ecx, dword [ebx + 0x44]
mov eax, 0x38e38e39
imul ecx
fstp dword [esp + 0xb4]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x21
ja 0x4c0552
call fcn.00501daa
mov ecx, dword [ebx + 0x44]
mov edx, dword [ecx + 0x974]
mov ecx, dword [esp + 0xb4]
push edx
mov edx, dword [esp + 0xc0]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], esi
mov esi, dword [esp + 0x44]
mov dword [eax + 8], edx
mov dword [eax + 0xc], edi
xor al, al
call fcn.004bf490
add esp, 0x14
jmp 0x4c06f6
cmp eax, 4
je 0x4c059b
cmp eax, 5
jne 0x4c06f6
cmp byte [esp + 0x1b], 0
je 0x4c06f6
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x2c8]
mov ecx, ebp
lea edi, [esp + 0xa0]
call fcn.004a0f30
cmp dword [esp + 0xa4], 0
je 0x4c06f6
mov eax, dword [esp + 0x20]
mov edi, dword [eax + 0x7a8]
push edi
lea ecx, [esp + 0xa4]
call fcn.004b5290
add esp, 4
test al, al
je 0x4c06f6
cmp byte [esp + 0xa8], 0
je 0x4c0604
mov ecx, dword [esp + 0xb0]
movzx eax, byte [ecx]
jmp 0x4c060b
mov eax, dword [esp + 0xac]
add edi, eax
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x48]
sub ecx, dword [eax + 0x44]
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x4c0631
call fcn.00501daa
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov ebp, dword [esp + 0x68]
mov edx, dword [edx + 0x38]
lea eax, [edi + edi*8]
mov edi, dword [esp + 0x20]
mov edi, dword [edi + 0x44]
mov eax, dword [edi + eax*8 + 0x30]
mov edi, dword [esp + 0x60]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
call edx
mov eax, dword [esp + 0x4c]
cmp dword [eax + 0x6f0], 5
jne 0x4c06b3
mov eax, dword [esp + 0x20]
fld dword [esp + 0x64]
mov edx, dword [eax + 0x7a8]
fstp qword [esp + 0x54]
lea ecx, [esp + 0xa0]
push ecx
push edx
push eax
mov eax, dword [esp + 0x3c]
push eax
call fcn.004b5420
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
add esp, 0x10
fsubr qword [esp + 0x54]
fsub qword [0x5560e0]
fstp dword [esp + 0x5c]
mov esi, dword [esp + 0x5c]
mov ecx, dword [esp + 0xa0]
sub esp, 0x10
mov eax, esp
push 0x1ff
mov dword [eax], esi
push ecx
mov ecx, dword [esp + 0x48]
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
mov ebx, dword [esp + 0x38]
push 0
lea edx, [esp + 0xbc]
mov dword [eax + 0xc], ebp
mov eax, dword [ebx + 0x7a8]
push edx
push eax
push ecx
call fcn.004b56a0
add esp, 0x28
mov ebp, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4c07e2
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x38]
xor edi, edi
add ebx, 0x54
test eax, eax
je 0x4c07e2
test al, 1
je 0x4c07cb
mov edx, dword [esp + 0x4c]
xor eax, eax
test dword [edx + 0x6f8], 0xfe000000
je 0x4c07ab
cmp byte [esi + 0x1c], al
je 0x4c07ab
mov ecx, dword [esi + 0xc]
cmp ecx, 0xffffffff
je 0x4c07ab
cmp ecx, ebp
jg 0x4c07ab
cmp ebp, dword [esi + 0x10]
jg 0x4c07ab
cmp ecx, 0xffffffff
je 0x4c075c
cmp ecx, ebp
jge 0x4c075e
cmp ebp, dword [esi + 0x10]
jge 0x4c075c
mov eax, 2
jmp 0x4c07ab
cmp ecx, ebp
jne 0x4c0798
cmp ebp, dword [esi + 0x10]
jge 0x4c0798
cmp byte [esp + 0x1b], 0
je 0x4c077b
movzx eax, byte [esp + 0x2b]
neg eax
sbb eax, eax
and eax, 3
inc eax
jmp 0x4c07ab
mov eax, dword [esp + 0x24]
push ebp
add eax, 0x2a4
call fcn.004bf290
test al, al
jne 0x4c0755
cmp byte [esp + 0x2b], al
jne 0x4c0755
xor eax, eax
jmp 0x4c07ab
cmp ecx, 0xffffffff
je 0x4c07ab
cmp ecx, ebp
jge 0x4c07ab
cmp ebp, dword [esi + 0x10]
jne 0x4c07ab
mov eax, 3
mov ecx, dword [esp + 0x4c]
mov edx, dword [ecx + 0x6f0]
push edx
push eax
lea eax, [esp + 0x78]
push eax
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x68]
push ecx
push ebx
call fcn.004b2fd0
mov eax, dword [esp + 0x14]
sar eax, 1
inc edi
add ebx, 0x1c
cmp edi, 0x20
mov dword [esp + 0x14], eax
jl 0x4c070f
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x65c]
inc dword [esp + 0x2c]
add dword [esp + 0x50], eax
mov ebp, edx
jmp 0x4bfde1
mov ecx, dword [esp + 0x6c]
inc ecx
cmp ecx, 4
mov dword [esp + 0x6c], ecx
jle 0x4bfa50
mov ecx, dword [esp + 0x160]
fld dword [esp + 0x44]
mov esi, dword [esp + 0x164]
mov edi, dword [esp + 0x168]
mov ebx, dword [esp + 0x16c]
mov dword [esp + 0x90], ecx
fstp dword [esp + 0x90]
mov ecx, dword [ebp + 0x48]
sub ecx, dword [ebp + 0x44]
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x20
ja 0x4c085c
call fcn.00501daa
mov eax, dword [ebp + 0x44]
mov eax, dword [eax + 0x930]
mov ecx, dword [esp + 0x30]
mov ebp, dword [esp + 0x90]
mov edx, dword [ecx]
mov edx, dword [edx + 0x38]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], ebp
mov dword [eax + 4], esi
mov dword [eax + 8], edi
mov dword [eax + 0xc], ebx
call edx
mov ecx, dword [esp + 0x134]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.00501b9a
add esp, 0x12c
ret 0x2c