Function at 0x4fa990
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0xb4]
cmp eax, dword [ecx + 8]
jbe 0x4fc1ad
sub esp, 0x134
mov eax, dword [esp + 0x138]
mov dword [esp], eax
mov ecx, dword [esp + 0x13c]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x140]
mov dword [esp + 8], edx
mov ebx, dword [esp + 0x144]
mov dword [esp + 0xc], ebx
mov byte [esp + 0x10], 0
call fcn.004f9c10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xbc], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0xc0], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x3c], ebx
mov ebp, dword [esp + 0x28]
mov dword [esp + 0xb4], ebp
mov esi, dword [esp + 0x24]
mov dword [esp + 0xa8], esi
test ecx, ecx
jne 0x4fc13d
test eax, eax
jne 0x4fc02b
mov eax, ebx
and ebx, 0x1f
mov dword [esp + 0x90], ebx
cmp ebx, 0x14
je 0x4fbf8f
cmp ebx, 0x15
je 0x4fbd2d
cmp ebx, 0x19
jne 0x4fbc30
xor ecx, ecx
xor edx, edx
xor edi, edi
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xa4], edx
mov dword [esp + 0x38], edi
mov ecx, dword [esp + 0x138]
mov dword [esp], ecx
mov dword [esp + 4], 9
call fcn.004f97e0
mov eax, dword [esp + 8]
cmp eax, 5
je 0x4fb117
cmp eax, 1
jne 0x4fbc08
mov eax, dword [esp + 0x138]
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x8c], ecx
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004f97e0
mov eax, dword [esp + 0x8c]
lea ecx, [eax - 1]
mov edx, dword [esp + 8]
mov dword [esp + 0x4c], edx
mov ebx, dword [esp + 0x138]
mov ebp, dword [ebx + 0xc]
mov esi, dword [ebx + 8]
mov edi, dword [ebx]
dec ebp
cmp ecx, ebp
ja 0x4fbc01
cmp ebp, esi
ja 0x4fbc01
sub esi, ecx
mov dword [esp + 0x74], esi
lea eax, [esi - 1]
sar eax, 0x1f
xor eax, 0xffffffff
and eax, ecx
add eax, edi
mov dword [esp + 0xf8], eax
mov dword [esp], eax
sub ebp, ecx
mov dword [esp + 0x70], ebp
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
call fcn.004ff040
movzx eax, byte [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x6c], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0xf4], edx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x68], ebx
test al, al
je 0x4fbbc0
mov eax, dword [esp + 0x90]
cmp eax, 0x15
je 0x4fbacc
mov ebp, dword [esp + 0xa8]
mov dword [esp], ebp
mov esi, dword [esp + 0xb4]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x3c]
mov dword [esp + 8], edi
call fcn.00490190
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.005010c0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x80], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0xfc], ecx
xor edx, edx
xor ebx, ebx
mov dword [esp + 0x7c], edx
mov dword [esp + 0x104], ebx
cmp edx, eax
jge 0x4fac59
jae 0x4fbac5
imul edx, edx, 0x34
mov dword [esp + 0x88], edx
mov esi, dword [ecx + edx + 8]
mov edi, dword [ecx + edx + 0xc]
mov eax, dword [ecx + edx + 0x10]
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov eax, dword [esp + 0xf4]
mov dword [esp + 0xc], eax
mov esi, dword [esp + 0x68]
mov dword [esp + 0x10], esi
mov edi, dword [esp + 0x6c]
mov dword [esp + 0x14], edi
call fcn.00449f60
mov eax, dword [esp + 0xfc]
mov ecx, dword [esp + 0x88]
lea edx, [ecx + eax]
mov dword [esp + 0x100], edx
movzx ebx, byte [esp + 0x18]
test bl, bl
jne 0x4fac5b
mov ebx, dword [esp + 0x104]
test ebx, ebx
je 0x4fba59
mov ebp, dword [esp + 0x7c]
lea edx, [ebp + 1]
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0xfc]
mov dword [esp + 0x7c], edx
mov dword [esp + 0x104], ebx
cmp edx, eax
jl 0x4fabba
mov edx, ebx
mov dword [esp + 0x104], edx
test edx, edx
je 0x4fba45
movzx eax, byte [edx + 0x31]
mov byte [esp + 0x33], al
mov ecx, dword [edx + 0x1c]
mov ebx, dword [edx + 0x20]
mov dword [esp + 0x88], ebx
xor ebp, ebp
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0xb4]
mov esi, dword [esp + 0xa8]
mov dword [esp + 0xac], esi
mov esi, dword [esp + 0x3c]
mov dword [esp + 0x84], ebp
mov dword [esp + 0x114], ecx
mov dword [esp + 0x34], esi
mov dword [esp + 0xb8], edi
cmp ebp, ebx
jge 0x4fae40
mov eax, dword [ecx]
mov dword [esp + 0x78], eax
and esi, 0x1f
cmp esi, 0x16
je 0x4fad3d
mov esi, dword [esp + 0x34]
mov esi, dword [esp + 0xac]
mov dword [esp + 0xcc], esi
mov esi, dword [esp + 0x34]
mov edx, dword [esp + 0xcc]
mov dword [esp], edx
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
call fcn.0048df10
mov eax, dword [esp + 0x114]
lea ecx, [eax + 4]
mov eax, dword [esp + 0x84]
lea ebp, [eax + 1]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x104]
mov ebx, dword [esp + 0x88]
mov dword [esp + 0xac], eax
movzx eax, byte [esp + 0x33]
jmp 0x4fac9e
mov esi, dword [esp + 0xac]
mov dword [esp], esi
mov dword [esp + 4], edi
mov edx, dword [esp + 0x34]
mov dword [esp + 8], edx
call fcn.0048e730
movzx eax, byte [esp + 0xc]
test al, al
jne 0x4fadbb
mov eax, dword [esp + 0xac]
mov dword [esp], eax
mov eax, dword [esp + 0xb8]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 8], eax
call fcn.0048dd70
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x114]
mov edx, dword [esp + 0x104]
mov ebx, dword [esp + 0x88]
mov ebp, dword [esp + 0x84]
mov dword [esp + 0xcc], eax
mov eax, dword [esp + 0x78]
jmp 0x4face3
mov eax, dword [esp + 0xac]
mov dword [esp], eax
mov ecx, dword [esp + 0xb8]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x34]
mov dword [esp + 8], edx
call fcn.00490190
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x2c]
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
call eax
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00491120
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ebx, dword [esp + 0xac]
mov dword [esp], ebx
mov ebp, dword [esp + 0xb8]
mov dword [esp + 4], ebp
mov esi, dword [esp + 0x34]
mov dword [esp + 8], esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
call fcn.0048f3c0
jmp 0x4fad61
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov ebx, dword [esp + 0x138]
mov dword [ebx + 0x7c], edx
mov edx, dword [0x884700]
lea ebp, [ebx + 0x78]
test edx, edx
jne 0x4fba1d
mov dword [ebx + 0x78], ecx
mov ecx, dword [esp + 0xa8]
mov dword [esp], ecx
mov edx, dword [esp + 0xb4]
mov dword [esp + 4], edx
mov ebp, dword [esp + 0x3c]
mov dword [esp + 8], ebp
call fcn.00490190
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x64]
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
call eax
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x138]
mov dword [edx + 0x74], ecx
mov ecx, dword [0x884700]
lea ebx, [edx + 0x70]
test ecx, ecx
jne 0x4fba05
mov dword [edx + 0x70], eax
movzx eax, byte [esp + 0x33]
mov ecx, dword [esp + 0x34]
mov ebx, dword [esp + 0xb8]
mov ebp, dword [esp + 0xac]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0xb0]
mov esi, dword [esp + 0xa4]
mov dword [esp + 0xdc], esi
mov esi, dword [esp + 0x38]
mov dword [esp + 0x60], esi
mov dword [esp + 0xe0], edi
mov byte [esp + 0x33], al
mov dword [esp + 0x40], ecx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xcc], ebp
mov esi, dword [esp + 0x4c]
cmp esi, 9
je 0x4fb9c7
cmp esi, 3
jne 0x4fb981
test al, al
je 0x4fb95e
mov dword [esp], edx
call fcn.004f9ad0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
test eax, eax
je 0x4fb8ff
mov edx, dword [eax + 8]
cmp edx, 0xe0ff5cb4
jne 0x4fb8f4
lea edx, [0x6b4960]
cmp edx, eax
jne 0x4fb8e5
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
je 0x4fb878
mov eax, dword [esp + 0xcc]
mov dword [esp], eax
mov ecx, dword [esp + 0xd0]
mov dword [esp + 4], ecx
mov ebx, dword [esp + 0x40]
mov dword [esp + 8], ebx
call fcn.00490190
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4faf9f
mov ecx, dword [ecx + 4]
mov dword [esp + 0x120], 0
mov dword [esp + 0x124], 0
mov dword [esp + 0x120], ecx
mov dword [esp + 0x124], eax
lea eax, [0x718529]
mov dword [esp], eax
mov dword [esp + 4], 0x53
lea ecx, [esp + 0x120]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.0049a940
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x138]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004f9520
mov eax, dword [esp + 0x90]
cmp eax, 0x15
je 0x4fb11e
mov ecx, dword [esp + 0x138]
mov dword [esp], ecx
mov dword [esp + 4], 9
call fcn.004f97e0
mov eax, dword [esp + 8]
cmp eax, 5
je 0x4fb117
cmp eax, 4
jne 0x4fb0ef
mov eax, dword [esp + 0x138]
mov dword [eax + 0x74], 0
mov ecx, dword [0x884700]
lea edx, [eax + 0x70]
test ecx, ecx
jne 0x4fb0d6
mov dword [eax + 0x70], 0
mov dword [eax + 0x7c], 0
mov ecx, dword [0x884700]
lea edx, [eax + 0x78]
test ecx, ecx
jne 0x4fb0bd
mov dword [eax + 0x78], 0
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0x90]
mov ebp, dword [esp + 0xb4]
mov esi, dword [esp + 0xa8]
mov ecx, dword [esp + 0xe0]
mov edx, dword [esp + 0xdc]
mov edi, dword [esp + 0x60]
jmp 0x4faa5d
mov dword [esp], edx
mov dword [esp + 4], 0
call fcn.0040d5a0
mov eax, dword [esp + 0x138]
jmp 0x4fb08d
mov dword [esp], edx
mov dword [esp + 4], 0
call fcn.0040d5a0
mov eax, dword [esp + 0x138]
jmp 0x4fb072
mov eax, dword [esp + 0x138]
mov dword [esp], eax
mov ecx, dword [0x8727ac]
mov edx, dword [0x8727a8]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.004f94c0
jmp 0x4fb050
add esp, 0x134
ret
mov ecx, dword [esp + 0xa8]
mov dword [esp], ecx
mov edx, dword [esp + 0xb4]
mov dword [esp + 4], edx
mov ebx, dword [esp + 0x3c]
mov dword [esp + 8], ebx
call fcn.00490190
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x50]
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
call eax
mov eax, dword [esp + 4]
mov dword [esp + 0xec], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0xf0], ecx
mov edx, dword [eax + 0x54]
mov dword [esp], ecx
call edx
mov eax, dword [esp + 4]
cmp eax, 0x18
jne 0x4fb262
mov eax, dword [esp + 0xf4]
mov dword [esp + 0x128], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x12c], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x130], eax
lea eax, [0x6a56a0]
mov dword [esp], eax
lea ecx, [esp + 0x128]
mov dword [esp + 4], ecx
call fcn.0040a880
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00490f20
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [esp + 0xec]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xf0]
mov dword [esp + 0x10], eax
call fcn.004914a0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0xa8]
mov dword [esp], ebx
mov ebp, dword [esp + 0xb4]
mov dword [esp + 4], ebp
mov esi, dword [esp + 0x3c]
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xd0]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
call fcn.0048fa30
mov eax, dword [esp + 0x90]
jmp 0x4fb023
mov eax, dword [esp + 0xec]
mov dword [esp], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 4], ecx
call fcn.00488fe0
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x44]
mov ecx, dword [esp + 0xc]
mov edx, dword [0x8727c8]
mov ebx, dword [0x8727cc]
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp], ecx
call eax
movzx eax, byte [esp + 0xc]
test al, al
je 0x4fb37f
mov eax, dword [esp + 0xa8]
mov dword [esp], eax
mov ecx, dword [esp + 0xb4]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], edx
call fcn.00490190
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x50]
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
call eax
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00491120
mov eax, dword [esp + 0x10]
mov dword [esp + 0x64], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0xe8], ecx
mov edx, dword [esp + 8]
mov dword [esp + 0xe4], edx
mov ebx, dword [esp + 0x138]
mov dword [esp], ebx
mov ebp, dword [esp + 0xf8]
mov dword [esp + 4], ebp
mov ebp, dword [esp + 0x70]
mov dword [esp + 8], ebp
mov ebp, dword [esp + 0x74]
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], 1
call fcn.004fc4b0
mov eax, dword [esp + 0xe4]
mov dword [esp], eax
mov eax, dword [esp + 0xe8]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 8], eax
call fcn.0048dd70
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
jmp 0x4fb20a
mov eax, dword [esp + 0xec]
mov ecx, dword [eax + 0x54]
mov edx, dword [esp + 0xf0]
mov dword [esp], edx
call ecx
mov eax, dword [esp + 4]
lea ecx, [eax - 2]
cmp ecx, 4
jbe 0x4fb63c
add eax, 0xfffffff9
cmp eax, 5
ja 0x4fb5f5
mov dword [esp], 0
mov eax, dword [esp + 0xf4]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], eax
call fcn.0043a9c0
mov eax, dword [esp + 0x10]
mov dword [esp + 0xd4], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x44], ecx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xa
mov dword [esp + 0xc], 0x40
call fcn.00450700
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x50], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x58], edx
test eax, eax
jne 0x4fb504
mov eax, dword [esp + 0xec]
mov dword [esp], eax
mov ebx, dword [esp + 0xf0]
mov dword [esp + 4], ebx
call fcn.00491010
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov eax, dword [esp + 0x50]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x10], ecx
call fcn.0048f140
movzx eax, byte [esp + 0x14]
test al, al
jne 0x4fb504
mov eax, dword [esp + 0x50]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x98], eax
lea eax, [0x6b4b20]
mov dword [esp], eax
lea ecx, [esp + 0x94]
mov dword [esp + 4], ecx
call fcn.0040a880
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00490f20
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov eax, dword [esp + 0xec]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xf0]
mov dword [esp + 0x10], eax
call fcn.004914a0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebx, eax
mov eax, edx
mov edx, ecx
mov ecx, ebx
jmp 0x4fb20a
lea eax, [0x6dc220]
mov dword [esp], eax
call fcn.0040cd70
mov eax, dword [esp + 4]
mov dword [esp + 0x110], eax
mov dword [esp], 0
lea ecx, [0x705898]
mov dword [esp + 4], ecx
mov dword [esp + 8], 7
mov ecx, dword [esp + 0xd4]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x10], ecx
call fcn.0043a840
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x110]
mov dword [edx + 4], ecx
mov ecx, dword [0x884700]
test ecx, ecx
jne 0x4fb5dd
mov dword [edx], eax
mov eax, dword [esp + 0xec]
mov dword [edx + 8], eax
mov eax, dword [0x884700]
lea ecx, [edx + 0xc]
test eax, eax
jne 0x4fb5c1
mov eax, dword [esp + 0xf0]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x8c]
mov dword [edx + 0x10], eax
sar eax, 0x1f
mov dword [edx + 0x14], eax
mov eax, dword [esp + 0x138]
mov dword [esp], eax
lea eax, [0x847c60]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.004f9520
add esp, 0x134
ret
mov dword [esp], ecx
mov eax, dword [esp + 0xf0]
mov dword [esp + 4], eax
call fcn.0040d5a0
mov edx, dword [esp + 0x110]
jmp 0x4fb58d
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0040d5a0
mov edx, dword [esp + 0x110]
jmp 0x4fb56c
lea eax, [0x70cf9f]
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], 0x19
lea eax, [0x6b4960]
mov dword [esp], eax
lea eax, [esp + 0x118]
mov dword [esp + 4], eax
call fcn.0040a880
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004254e0
ud2
mov dword [esp], 0
mov eax, dword [esp + 0xf4]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], eax
call fcn.0043a9c0
mov eax, dword [esp + 0x10]
mov dword [esp + 0xd8], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x48], ecx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xa
mov dword [esp + 0xc], 0x40
call fcn.00450bf0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x5c], eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x54], edx
test ecx, ecx
jne 0x4fb787
mov ecx, dword [esp + 0xec]
mov dword [esp], ecx
mov ebx, dword [esp + 0xf0]
mov dword [esp + 4], ebx
call fcn.00491010
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x10], ecx
call fcn.0048eff0
movzx eax, byte [esp + 0x14]
test al, al
jne 0x4fb787
mov eax, dword [esp + 0x54]
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xa0], eax
lea eax, [0x6b4320]
mov dword [esp], eax
lea ecx, [esp + 0x9c]
mov dword [esp + 4], ecx
call fcn.0040a880
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00490f20
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov eax, dword [esp + 0xec]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xf0]
mov dword [esp + 0x10], eax
call fcn.004914a0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
jmp 0x4fb4f7
lea eax, [0x6dc220]
mov dword [esp], eax
call fcn.0040cd70
mov eax, dword [esp + 4]
mov dword [esp + 0x110], eax
mov dword [esp], 0
lea ecx, [0x705898]
mov dword [esp + 4], ecx
mov dword [esp + 8], 7
mov ecx, dword [esp + 0xd8]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ecx
call fcn.0043a840
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x110]
mov dword [edx + 4], ecx
mov ecx, dword [0x884700]
test ecx, ecx
jne 0x4fb860
mov dword [edx], eax
mov eax, dword [esp + 0xec]
mov dword [edx + 8], eax
mov eax, dword [0x884700]
lea ecx, [edx + 0xc]
test eax, eax
jne 0x4fb844
mov eax, dword [esp + 0xf0]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x8c]
mov dword [edx + 0x10], eax
sar eax, 0x1f
mov dword [edx + 0x14], eax
mov eax, dword [esp + 0x138]
mov dword [esp], eax
lea eax, [0x847c60]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.004f9520
add esp, 0x134
ret
mov dword [esp], ecx
mov eax, dword [esp + 0xf0]
mov dword [esp + 4], eax
call fcn.0040d5a0
mov edx, dword [esp + 0x110]
jmp 0x4fb810
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0040d5a0
mov edx, dword [esp + 0x110]
jmp 0x4fb7ef
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.0043aae0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x138]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0xd0]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x18], edx
mov byte [esp + 0x1c], 1
call fcn.004fc4b0
mov eax, dword [esp + 0x90]
cmp eax, 0x15
jmp 0x4fb01d
mov ecx, 0
mov eax, 0
jmp 0x4faf68
lea edx, [0x6b4960]
jmp 0x4faf6e
mov eax, dword [esp + 0x138]
mov dword [esp], eax
mov ecx, dword [0x86e6f0]
mov edx, dword [0x86e6f4]
mov ebx, dword [0x86e6f8]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov ecx, dword [esp + 0xcc]
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0xd0]
mov dword [esp + 0x14], edx
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x18], ebx
mov byte [esp + 0x1c], 0
call fcn.004fc4b0
mov eax, dword [esp + 0x90]
cmp eax, 0x15
jmp 0x4fb01d
mov dword [esp], edx
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
call fcn.004f9860
mov eax, dword [esp + 0x90]
cmp eax, 0x15
jmp 0x4fb01d
mov dword [esp], edx
mov esi, dword [0x8727a8]
mov edi, dword [0x8727ac]
mov dword [esp + 4], esi
mov dword [esp + 8], edi
call fcn.004f94c0
movzx eax, byte [esp + 0x33]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x138]
mov ebx, dword [esp + 0xd0]
mov ebp, dword [esp + 0xcc]
mov edi, dword [esp + 0xe0]
jmp 0x4faf26
mov dword [esp], edx
mov dword [esp + 4], 9
call fcn.004f97e0
mov esi, dword [esp + 8]
movzx eax, byte [esp + 0x33]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x138]
mov ebx, dword [esp + 0xd0]
mov ebp, dword [esp + 0xcc]
mov edi, dword [esp + 0xe0]
jmp 0x4faf1d
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0040d5a0
mov edx, dword [esp + 0x138]
jmp 0x4faebb
mov dword [esp], ebp
mov dword [esp + 4], ecx
call fcn.0040d5a0
movzx eax, byte [esp + 0x33]
mov ebx, dword [esp + 0x138]
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0xb8]
jmp 0x4fae63
mov edx, dword [esp + 0x138]
xor eax, eax
xor ecx, ecx
xor ebx, ebx
xor ebp, ebp
jmp 0x4faed2
mov ebp, dword [eax + ecx + 0x14]
mov esi, dword [eax + ecx + 0x10]
mov edi, dword [eax + ecx + 8]
mov ecx, dword [eax + ecx + 0xc]
mov dword [esp], edi
mov dword [esp + 4], ecx
mov dword [esp + 8], esi
mov ecx, dword [esp + 0xf4]
mov dword [esp + 0xc], ecx
mov esi, dword [esp + 0x68]
mov dword [esp + 0x10], esi
mov edi, dword [esp + 0x6c]
mov dword [esp + 0x14], edi
mov edi, dword [ebp]
mov edx, ebp
call edi
movzx eax, byte [esp + 0x18]
test al, al
je 0x4fbab2
mov eax, dword [esp + 0xfc]
mov ebx, dword [esp + 0x100]
jmp 0x4fac31
mov eax, dword [esp + 0xfc]
mov ebx, dword [esp + 0x104]
jmp 0x4fac31
call fcn.00424680
ud2
mov ebp, dword [esp + 0xa8]
mov dword [esp], ebp
mov esi, dword [esp + 0xb4]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x3c]
mov dword [esp + 8], edi
call fcn.00490190
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x2c]
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
call eax
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x38]
test edx, edx
je 0x4fbb8a
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00491010
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ebx, dword [esp + 0xa4]
mov dword [esp], ebx
mov ebp, dword [esp + 0xb0]
mov dword [esp + 4], ebp
mov esi, dword [esp + 0x38]
mov dword [esp + 8], esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
call fcn.0048f3c0
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0xa4]
mov edx, dword [esp + 0x38]
mov esi, edx
mov edi, eax
mov dword [esp + 0xdc], ecx
xor eax, eax
mov ecx, esi
mov ebx, edi
mov ebp, dword [esp + 0xdc]
mov edx, dword [esp + 0x138]
jmp 0x4faeef
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00491120
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0048dd70
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
jmp 0x4fbb66
mov eax, dword [esp + 0x138]
mov dword [esp], eax
mov ebp, dword [0x8727ac]
mov esi, dword [0x8727a8]
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
call fcn.004f94c0
mov eax, dword [esp + 0x90]
cmp eax, 0x15
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0xf4]
mov ebx, dword [esp + 0x68]
jmp 0x4fab51
call fcn.004246e0
ud2
mov eax, dword [esp + 0x138]
mov dword [esp], eax
mov ecx, dword [0x8727ac]
mov edx, dword [0x8727a8]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.004f94c0
jmp 0x4faa9c
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
call fcn.00490190
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10c], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x108], ecx
lea edx, [0x6dc220]
mov dword [esp], edx
call fcn.0040cd70
mov eax, dword [esp + 4]
mov dword [esp + 0x110], eax
mov dword [eax + 4], 6
mov ecx, dword [0x884700]
test ecx, ecx
jne 0x4fbd0f
lea ecx, [0x705386]
mov dword [eax], ecx
mov ecx, dword [esp + 0x10c]
mov dword [eax + 8], ecx
mov ecx, dword [0x884700]
lea edx, [eax + 0xc]
test ecx, ecx
jne 0x4fbcf3
mov ecx, dword [esp + 0x108]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x138]
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x10], edx
sar edx, 0x1f
mov dword [eax + 0x14], edx
mov dword [esp], ecx
lea edx, [0x847c60]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.004f9520
mov eax, dword [esp + 0x138]
mov ecx, dword [eax + 0xc]
dec ecx
mov dword [eax + 0xc], ecx
mov dword [esp], eax
call fcn.004f96b0
add esp, 0x134
ret
mov dword [esp], edx
mov ecx, dword [esp + 0x108]
mov dword [esp + 4], ecx
call fcn.0040d5a0
mov eax, dword [esp + 0x110]
jmp 0x4fbcad
mov dword [esp], eax
lea ecx, [0x705386]
mov dword [esp + 4], ecx
call fcn.0040d5a0
mov eax, dword [esp + 0x110]
jmp 0x4fbc8c
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
call fcn.00490190
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc4], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc8], ecx
mov edx, dword [eax + 0x50]
mov dword [esp], ecx
call edx
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x54]
mov ecx, dword [esp + 8]
mov dword [esp], ecx
call eax
mov eax, dword [esp + 4]
lea ecx, [eax - 2]
cmp ecx, 0xa
ja 0x4fbe1a
mov eax, dword [esp + 0xa8]
mov dword [esp], eax
mov ecx, dword [esp + 0xb4]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], edx
call fcn.0048e730
movzx eax, byte [esp + 0xc]
test al, al
jne 0x4fbdc4
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0x90]
mov ebp, dword [esp + 0xb4]
mov esi, dword [esp + 0xa8]
jmp 0x4faa57
mov eax, dword [esp + 0xc4]
mov dword [esp], eax
mov eax, dword [esp + 0xc8]
mov dword [esp + 4], eax
call fcn.00490e30
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ebx, dword [esp + 0xa8]
mov dword [esp], ebx
mov ebp, dword [esp + 0xb4]
mov dword [esp + 4], ebp
mov esi, dword [esp + 0x3c]
mov dword [esp + 8], esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
call fcn.0048f3c0
jmp 0x4fbda6
cmp eax, 0x18
jne 0x4fbe24
jmp 0x4fbd7b
mov eax, dword [esp + 0xc4]
mov ecx, dword [eax + 0x50]
mov edx, dword [esp + 0xc8]
mov dword [esp], edx
call ecx
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00488fe0
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x44]
mov ecx, dword [esp + 0xc]
mov edx, dword [0x8727cc]
mov ebx, dword [0x8727c8]
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [esp], ecx
call eax
movzx eax, byte [esp + 0xc]
test al, al
je 0x4fbe80
jmp 0x4fbd7b
mov eax, dword [esp + 0xa8]
mov dword [esp], eax
mov eax, dword [esp + 0xb4]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
call fcn.00490190
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10c], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x108], ecx
lea edx, [0x6dc220]
mov dword [esp], edx
call fcn.0040cd70
mov eax, dword [esp + 4]
mov dword [esp + 0x110], eax
mov dword [eax + 4], 6
mov ecx, dword [0x884700]
test ecx, ecx
jne 0x4fbf71
lea ecx, [0x705386]
mov dword [eax], ecx
mov ecx, dword [esp + 0x10c]
mov dword [eax + 8], ecx
mov ecx, dword [0x884700]
lea edx, [eax + 0xc]
test ecx, ecx
jne 0x4fbf55
mov ecx, dword [esp + 0x108]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x138]
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x10], edx
sar edx, 0x1f
mov dword [eax + 0x14], edx
mov dword [esp], ecx
lea edx, [0x847c60]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.004f9520
mov eax, dword [esp + 0x138]
mov ecx, dword [eax + 0xc]
dec ecx
mov dword [eax + 0xc], ecx
mov dword [esp], eax
call fcn.004f96b0
add esp, 0x134
ret
mov dword [esp], edx
mov ecx, dword [esp + 0x108]
mov dword [esp + 4], ecx
call fcn.0040d5a0
mov eax, dword [esp + 0x110]
jmp 0x4fbf0f
mov dword [esp], eax
lea ecx, [0x705386]
mov dword [esp + 4], ecx
call fcn.0040d5a0
mov eax, dword [esp + 0x110]
jmp 0x4fbeee
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
call fcn.0048ee00
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4fbfc5
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0x90]
mov ebp, dword [esp + 0xb4]
mov esi, dword [esp + 0xa8]
jmp 0x4faa45
mov eax, dword [esp + 0x138]
mov dword [esp], eax
call fcn.004fe9d0
mov eax, dword [esp + 4]
lea ecx, [0x6b7120]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00490f20
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ebx, dword [esp + 0xa8]
mov dword [esp], ebx
mov ebx, dword [esp + 0xb4]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x3c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
call fcn.0048f3c0
add esp, 0x134
ret
mov eax, dword [esp + 0x13c]
mov dword [esp], eax
mov eax, dword [esp + 0x140]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x144]
mov dword [esp + 8], eax
call fcn.00490190
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10c], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x108], ecx
lea edx, [0x6dc220]
mov dword [esp], edx
call fcn.0040cd70
mov eax, dword [esp + 4]
mov dword [esp + 0x110], eax
mov dword [eax + 4], 6
mov ecx, dword [0x884700]
test ecx, ecx
jne 0x4fc11f
lea ecx, [0x705386]
mov dword [eax], ecx
mov ecx, dword [esp + 0x10c]
mov dword [eax + 8], ecx
mov ecx, dword [0x884700]
lea edx, [eax + 0xc]
test ecx, ecx
jne 0x4fc103
mov ecx, dword [esp + 0x108]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x138]
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x10], edx
sar edx, 0x1f
mov dword [eax + 0x14], edx
mov dword [esp], ecx
lea edx, [0x847c60]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.004f9520
mov eax, dword [esp + 0x138]
mov ecx, dword [eax + 0xc]
dec ecx
mov dword [eax + 0xc], ecx
mov dword [esp], eax
call fcn.004f96b0
add esp, 0x134
ret
mov dword [esp], edx
mov ecx, dword [esp + 0x108]
mov dword [esp + 4], ecx
call fcn.0040d5a0
mov eax, dword [esp + 0x110]
jmp 0x4fc0bd
mov dword [esp], eax
lea ecx, [0x705386]
mov dword [esp + 4], ecx
call fcn.0040d5a0
mov eax, dword [esp + 0x110]
jmp 0x4fc09c
mov eax, dword [esp + 0x138]
mov ebx, dword [eax + 0xc]
dec ebx
mov dword [eax + 0xc], ebx
mov dword [esp], eax
call fcn.004f96b0
mov eax, dword [esp + 0xbc]
mov eax, dword [eax + 0x14]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
mov ebx, dword [esp + 8]
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc0]
mov dword [esp], ecx
call eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x4fc194
add esp, 0x134
ret
mov edx, dword [esp + 0x138]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004f94c0
jmp 0x4fc18d
call fcn.004486b0
jmp fcn.004fa990