Function at 0x471450
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x524766
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x178
push ebx
push ebp
push esi
or ebp, 0xffffffff
xor esi, esi
push edi
mov dword [esp + 0x30], 0x530160
mov word [esp + 0x34], bp
mov word [esp + 0x36], si
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x190], esi
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x54b218
call fcn.004f58e0
mov ecx, dword [0x5540a8]
call fcn.004fa1d0
push 6
push 0x54b5e8
lea ecx, [esp + 0x2c]
call fcn.004f58e0
xor bl, bl
mov byte [esp + 0x190], 1
mov byte [esp + 0xb4], bl
mov eax, dword [esp + 0xb4]
lea ecx, [esp + 0x24]
push eax
push 5
call fcn.004f5c80
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.004f5850
mov ecx, dword [0x5540a8]
call fcn.004fa410
inc bl
cmp bl, 0xb
mov byte [esp + 0xb4], bl
jbe 0x4714d2
mov ecx, dword [0x5540a8]
lea eax, [esp + 0x30]
push eax
call fcn.004fa550
cmp ax, bp
je 0x472f21
push 8
push 0x54b19c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x68], 0x10
mov byte [esp + 0x69], 0x11
mov byte [esp + 0x6a], 0x12
mov byte [esp + 0x6b], 0x13
mov byte [esp + 0x6c], 0x14
mov byte [esp + 0x6d], 0x15
mov byte [esp + 0x6e], 0x1a
mov byte [esp + 0x6f], 0x20
mov byte [esp + 0x70], 0x23
mov byte [esp + 0x71], 0x24
mov byte [esp + 0x72], 0x70
mov byte [esp + 0x73], 0x71
mov byte [esp + 0x74], 0x1e
mov byte [esp + 0x75], 0x1f
mov byte [esp + 0x76], 0x22
mov byte [esp + 0x77], 0x28
mov byte [esp + 0x78], 0xfa
call fcn.004f58e0
lea ecx, [esp + 0x28]
mov byte [esp + 0x190], 2
call fcn.004f5840
movsx eax, word [esp + 0x34]
cmp eax, 0xb
mov byte [esp + 0x190], 3
ja case.default.0x4715b4
jmp dword [eax*4 + 0x472f50]
cmp eax, 6
ja case.0x4715c4.1
jmp dword [eax*4 + 0x472f80]
push esi
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 4
mov ecx, esp
mov dword [esp + 0x30], esp
push 6
push 0x54b5e0
jmp 0x4716b5
push esi
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 5
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x54b5d8
jmp 0x4716b5
push esi
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 6
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x54b5d0
jmp 0x4716b5
push esi
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 7
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x54b5c8
jmp 0x4716b5
push esi
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 8
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x54b5c0
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x1a0], 3
call fcn.004f91a0
mov dword [esp + 0xa4], 0x530160
mov word [esp + 0xa8], bp
mov word [esp + 0xaa], si
mov byte [esp + 0x190], 9
mov ecx, dword [esp + 0x34]
push ecx
push 5
lea ecx, [esp + 0x2c]
call fcn.004f5c80
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.004f5850
mov ecx, dword [0x5540a8]
call fcn.004fa1d0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x54b5b8
call fcn.004f58e0
mov ecx, dword [0x5540a8]
call fcn.004fa410
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x54b5b0
call fcn.004f58e0
mov ecx, dword [0x5540a8]
call fcn.004fa410
mov ecx, dword [0x5540a8]
lea eax, [esp + 0xa4]
push eax
call fcn.004fa550
cmp ax, bp
je 0x4718ac
movsx ecx, word [esp + 0x34]
mov dl, byte [esp + ecx + 0x60]
lea ecx, [esp + 0x14]
push edx
push 4
call fcn.004f5c80
cmp word [esp + 0xa8], si
lea ecx, [esp + 0x14]
setne al
dec eax
and eax, 0xff
push eax
push 6
call fcn.004f5c80
lea ecx, [esp + 0x14]
push ecx
call fcn.00473820
add esp, 4
push esi
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0xa
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x54b5a8
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x1a0], 9
call fcn.004f91a0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.004f5870
lea edx, [esp + 0x2c]
lea eax, [esp + 0x18]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x1a0], 0xb
call fcn.004f5850
mov byte [esp + 0x19c], 9
call fcn.00473d20
add esp, 0xc
mov bl, al
push 0x514
call edi
push esi
push 1
push ecx
test bl, bl
mov ecx, esp
jne 0x471884
mov dword [esp + 0x2c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0xc
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x54b5a0
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x1a0], 9
call fcn.004f91a0
jmp 0x4716ef
mov dword [esp + 0x2c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0xd
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x54b598
jmp 0x471868
mov dword [esp + 0xa4], 0x530160
jmp case.default.0x4715b4
push esi
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0xe
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x54b590
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x1a0], 3
call fcn.004f91a0
mov ecx, dword [esp + 0x34]
push ecx
push 5
lea ecx, [esp + 0x2c]
call fcn.004f5c80
lea ecx, [esp + 0x88]
call fcn.004f8480
mov dl, byte [esp + 0x2d]
sub esp, 0x10
mov ebx, esp
mov edi, 0x5491f0
or ecx, 0xffffffff
xor eax, eax
mov byte [ebx], dl
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x30], esp
mov ebp, ecx
push 1
push ebp
mov ecx, ebx
mov byte [esp + 0x1a8], 0xf
call fcn.004016f0
test al, al
je 0x471980
mov edi, dword [ebx + 4]
mov ecx, ebp
mov eax, ecx
mov esi, 0x5491f0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
add ebp, eax
xor esi, esi
mov byte [ebp], 0
sub esp, 0x10
lea edx, [esp + 0x4d]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
push 0x548328
mov byte [esp + 0x1b8], 0x10
call fcn.00401030
sub esp, 0x10
lea eax, [esp + 0xb0]
mov ecx, esp
mov dword [esp + 0xdc], esp
push eax
push 0x548324
mov byte [esp + 0x1c8], 0x11
call fcn.00401030
sub esp, 0x10
lea edx, [esp + 0x6f]
mov ecx, esp
mov dword [esp + 0xf0], esp
push edx
push 0x554048
mov byte [esp + 0x1d8], 0x12
call fcn.00401030
push ecx
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
mov byte [esp + 0x1d8], 0x13
call fcn.004f5850
push ecx
mov byte [esp + 0x1d8], 0x14
mov ecx, esp
mov dword [esp + 0x58], esp
push 6
push 0x54b588
call fcn.004f58e0
lea ecx, [esp + 0x194]
mov byte [esp + 0x1d8], 0xf
push ecx
mov ecx, 0x5540a8
call fcn.004f9710
mov ecx, dword [0x530168]
mov dx, word [eax]
push ecx
add eax, 4
push esi
push eax
lea ecx, [esp + 0x98]
mov byte [esp + 0x19c], 0x15
mov word [esp + 0x94], dx
call fcn.004011e0
mov eax, dword [esp + 0x154]
mov byte [esp + 0x190], 0xf
cmp eax, esi
je 0x471a92
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x471a89
cmp al, 0xff
je 0x471a89
dec al
mov byte [ecx], al
jmp 0x471a92
push ecx
call fcn.00514140
add esp, 4
lea ecx, [esp + 0x88]
mov dword [esp + 0x154], esi
mov dword [esp + 0x158], esi
mov dword [esp + 0x15c], esi
call fcn.004f86d0
cmp ax, 2
jne 0x471ae7
mov eax, dword [esp + 0x90]
cmp eax, esi
je 0x471dd1
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x471dc8
cmp al, 0xff
je 0x471dc8
dec al
mov byte [ecx], al
jmp 0x471dd1
lea edx, [esp + 0x11c]
lea ecx, [esp + 0x88]
push edx
call fcn.004f86e0
mov ecx, dword [eax + 8]
mov byte [esp + 0x190], 0x16
cmp ecx, 3
ja 0x471b68
lea eax, [esp + 0xfc]
lea ecx, [esp + 0x88]
push eax
call fcn.004f86e0
mov edx, dword [eax + 8]
mov eax, dword [esp + 0x100]
cmp edx, esi
sete bl
cmp eax, esi
je 0x471b4f
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x471b46
cmp al, 0xff
je 0x471b46
dec al
mov byte [ecx], al
jmp 0x471b4f
push ecx
call fcn.00514140
add esp, 4
test bl, bl
mov dword [esp + 0x100], esi
mov dword [esp + 0x104], esi
mov dword [esp + 0x108], esi
je 0x471b6a
mov bl, 1
mov eax, dword [esp + 0x120]
mov byte [esp + 0x190], 0xf
cmp eax, esi
je 0x471b9a
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x471b91
cmp al, 0xff
je 0x471b91
dec al
mov byte [ecx], al
jmp 0x471b9a
push ecx
call fcn.00514140
add esp, 4
test bl, bl
mov dword [esp + 0x120], esi
mov dword [esp + 0x124], esi
mov dword [esp + 0x128], esi
je 0x471bfb
push esi
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x17
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b580
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x1a0], 0xf
call fcn.004f91a0
jmp 0x471ab9
movsx ecx, word [esp + 0x34]
mov dl, byte [esp + ecx + 0x60]
lea ecx, [esp + 0x14]
push edx
push 4
call fcn.004f5c80
lea eax, [esp + 0xcc]
lea ecx, [esp + 0x88]
push eax
call fcn.004f86e0
mov eax, dword [eax + 4]
cmp eax, esi
jne 0x471c30
mov eax, 0x530164
push eax
call fcn.00514a57
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xd4]
add esp, 4
cmp eax, esi
je 0x471c65
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x471c5c
cmp al, 0xff
je 0x471c5c
dec al
mov byte [ecx], al
jmp 0x471c65
push ecx
call fcn.00514140
add esp, 4
fild dword [esp + 0x1c]
mov dword [esp + 0xd0], esi
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd8], esi
fmul qword [0x5308a0]
call fcn.00514a64
mov byte [esp + 0xb8], al
mov ecx, dword [esp + 0xb8]
push ecx
push 6
lea ecx, [esp + 0x1c]
call fcn.004f5c80
lea edx, [esp + 0x14]
push edx
call fcn.00473820
add esp, 4
push esi
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x18
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b5a8
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x1a0], 0xf
call fcn.004f91a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004f5870
lea eax, [esp + 0x2c]
lea edx, [esp + 0x18]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x1a0], 0x19
call fcn.004f5850
mov byte [esp + 0x19c], 0xf
call fcn.00473d20
add esp, 0xc
mov bl, al
push 0x514
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 1
push ecx
test bl, bl
mov ecx, esp
jne 0x471d6c
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x1a
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b5a0
jmp 0x471d92
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x1b
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b598
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x1a0], 0xf
call fcn.004f91a0
mov eax, dword [esp + 0x90]
cmp eax, esi
je 0x471dd1
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x471dc8
cmp al, 0xff
je 0x471dc8
dec al
mov byte [ecx], al
jmp 0x471dd1
push ecx
call fcn.00514140
add esp, 4
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], esi
mov dword [esp + 0x98], esi
jmp case.default.0x4715b4
mov eax, 0x530160
mov word [esp + 0x78], bp
mov dword [esp + 0x74], eax
mov word [esp + 0x7a], si
mov dword [esp + 0x9c], eax
mov word [esp + 0xa0], bp
mov word [esp + 0xa2], si
push 6
push 0x54b578
lea ecx, [esp + 0x8c]
mov byte [esp + 0x198], 0x1d
call fcn.004f58e0
mov byte [esp + 0x190], 0x1e
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x54b570
call fcn.004f58e0
mov ecx, dword [0x5540a8]
call fcn.004fa1d0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x54b578
call fcn.004f58e0
mov ecx, dword [0x5540a8]
call fcn.004fa410
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x54b568
call fcn.004f58e0
mov ecx, dword [0x5540a8]
call fcn.004fa410
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x54b560
call fcn.004f58e0
mov ecx, dword [0x5540a8]
call fcn.004fa410
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x54b558
call fcn.004f58e0
mov ecx, dword [0x5540a8]
call fcn.004fa410
mov ecx, dword [0x5540a8]
lea eax, [esp + 0x74]
push eax
call fcn.004fa550
cmp ax, bp
je 0x472112
mov ax, word [esp + 0x78]
cmp ax, si
jge 0x471efb
cmp ax, 3
jg 0x472112
mov cl, byte [esp + 0x78]
add cl, 0x40
push ecx
push 5
lea ecx, [esp + 0x8c]
call fcn.004f5c80
push esi
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x1f
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b550
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x1a0], 0x1e
call fcn.004f91a0
push ecx
lea edx, [esp + 0x88]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.004f5850
mov ecx, dword [0x5540a8]
call fcn.004fa1d0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x54b5b8
call fcn.004f58e0
mov ecx, dword [0x5540a8]
call fcn.004fa410
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x54b5b0
call fcn.004f58e0
mov ecx, dword [0x5540a8]
call fcn.004fa410
mov ecx, dword [0x5540a8]
lea eax, [esp + 0x9c]
push eax
call fcn.004fa550
cmp ax, bp
je 0x471e38
mov ax, word [esp + 0xa0]
cmp ax, si
jge 0x471fe2
cmp ax, 1
jg 0x471e38
push esi
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x20
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x548aac
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x1a0], 0x1e
call fcn.004f91a0
push 9
push 0x54b544
lea ecx, [esp + 0x1c]
call fcn.004f5de0
mov cx, word [esp + 0xa0]
neg cx
sbb cl, cl
and ecx, 0xff
push ecx
push 6
lea ecx, [esp + 0x1c]
call fcn.004f5c80
mov dl, byte [esp + 0x78]
lea ecx, [esp + 0x14]
inc dl
push edx
push 7
call fcn.004f5c80
lea eax, [esp + 0x14]
push eax
call fcn.00473820
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004f5870
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x18]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x1a0], 0x21
call fcn.004f5850
mov byte [esp + 0x19c], 0x1e
call fcn.00473d20
add esp, 0xc
mov bl, al
push 0x514
call edi
push esi
push 1
push ecx
test bl, bl
mov ecx, esp
jne 0x4720e7
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x22
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b5a0
jmp 0x471f3d
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x23
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b598
jmp 0x471f3d
lea ecx, [esp + 0x84]
mov byte [esp + 0x190], 0x1d
call fcn.004f5980
mov eax, 0x530160
mov dword [esp + 0x9c], eax
mov dword [esp + 0x74], eax
jmp case.default.0x4715b4
push esi
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x24
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b53c
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x1a0], 3
call fcn.004f91a0
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x24]
push eax
push 5
call fcn.004f5c80
lea ecx, [esp + 0x4c]
call fcn.004f8480
mov cl, byte [esp + 0x2f]
sub esp, 0x10
mov ebx, esp
mov edi, str.2550
xor eax, eax
mov dword [esp + 0x20], esp
mov byte [ebx], cl
or ecx, 0xffffffff
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], esi
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x1a4], 0x25
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.004016f0
test al, al
je 0x4721fb
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, str.2550
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx + 8], ebp
mov ebx, dword [ebx + 4]
add ebx, ebp
xor esi, esi
mov byte [ebx], 0
sub esp, 0x10
lea eax, [esp + 0xa3]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
push str.0000
mov byte [esp + 0x1b8], 0x26
call fcn.00401030
sub esp, 0x10
lea edx, [esp + 0xb1]
mov ecx, esp
mov dword [esp + 0xe0], esp
push edx
push 0x548324
mov byte [esp + 0x1c8], 0x27
call fcn.00401030
sub esp, 0x10
lea eax, [esp + 0x6e]
mov ecx, esp
mov dword [esp + 0xec], esp
push eax
push 0x554048
mov byte [esp + 0x1d8], 0x28
call fcn.00401030
push ecx
lea edx, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x64], esp
push edx
mov byte [esp + 0x1d8], 0x29
call fcn.004f5850
push ecx
mov byte [esp + 0x1d8], 0x2a
mov ecx, esp
mov dword [esp + 0x64], esp
push 6
push 0x54b52c
call fcn.004f58e0
lea eax, [esp + 0x1a8]
mov ecx, 0x5540a8
push eax
mov byte [esp + 0x1dc], 0x25
call fcn.004f9710
mov cx, word [eax]
lea edi, [eax + 4]
mov word [esp + 0x4c], cx
mov ecx, dword [0x530168]
mov eax, dword [edi + 8]
mov byte [esp + 0x190], 0x2b
mov ebx, eax
cmp ecx, ebx
jae 0x4722d9
mov ebx, ecx
lea edx, [esp + 0x50]
cmp edx, edi
jne 0x4722fc
push ecx
push ebx
lea ecx, [esp + 0x58]
call fcn.004015b0
push esi
push esi
lea ecx, [esp + 0x58]
call fcn.004015b0
jmp 0x472389
cmp ebx, esi
jbe 0x472349
cmp ebx, eax
jne 0x472349
mov eax, dword [edi + 4]
cmp eax, esi
jne 0x472310
mov eax, 0x530164
cmp byte [eax - 1], 0xfe
jae 0x472349
push 1
lea ecx, [esp + 0x54]
call fcn.004013e0
mov eax, dword [edi + 4]
cmp eax, esi
jne 0x47232d
mov eax, 0x530164
mov dword [esp + 0x54], eax
mov ecx, dword [edi + 8]
mov dword [esp + 0x58], ecx
mov edi, dword [edi + 0xc]
mov dword [esp + 0x5c], edi
mov cl, byte [eax - 1]
inc cl
mov byte [eax - 1], cl
jmp 0x472389
push 1
push ebx
lea ecx, [esp + 0x58]
call fcn.004016f0
test al, al
je 0x472389
mov edi, dword [edi + 4]
cmp edi, esi
mov esi, 0x530164
je 0x472367
mov esi, edi
mov edi, dword [esp + 0x54]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x58], ebx
xor esi, esi
mov byte [ecx + ebx], 0
mov eax, dword [esp + 0x168]
mov byte [esp + 0x190], 0x25
cmp eax, esi
je 0x4723b9
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x4723b0
cmp al, 0xff
je 0x4723b0
dec al
mov byte [ecx], al
jmp 0x4723b9
push ecx
call fcn.00514140
add esp, 4
lea ecx, [esp + 0x4c]
mov dword [esp + 0x168], esi
mov dword [esp + 0x16c], esi
mov dword [esp + 0x170], esi
call fcn.004f86d0
cmp ax, 2
jne 0x472408
mov eax, dword [esp + 0x54]
cmp eax, esi
je 0x4726d8
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x4726cf
cmp al, 0xff
je 0x4726cf
dec al
mov byte [ecx], al
jmp 0x4726d8
lea edx, [esp + 0x10c]
lea ecx, [esp + 0x4c]
push edx
call fcn.004f86e0
mov ecx, dword [eax + 8]
mov byte [esp + 0x190], 0x2c
cmp ecx, 4
ja 0x472483
lea eax, [esp + 0xec]
lea ecx, [esp + 0x4c]
push eax
call fcn.004f86e0
mov edx, dword [eax + 8]
mov eax, dword [esp + 0xf0]
cmp edx, esi
sete bl
cmp eax, esi
je 0x47246a
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x472461
cmp al, 0xff
je 0x472461
dec al
mov byte [ecx], al
jmp 0x47246a
push ecx
call fcn.00514140
add esp, 4
test bl, bl
mov dword [esp + 0xf0], esi
mov dword [esp + 0xf4], esi
mov dword [esp + 0xf8], esi
je 0x472485
mov bl, 1
mov eax, dword [esp + 0x110]
mov byte [esp + 0x190], 0x25
cmp eax, esi
je 0x4724b5
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x4724ac
cmp al, 0xff
je 0x4724ac
dec al
mov byte [ecx], al
jmp 0x4724b5
push ecx
call fcn.00514140
add esp, 4
test bl, bl
mov dword [esp + 0x110], esi
mov dword [esp + 0x114], esi
mov dword [esp + 0x118], esi
je 0x472516
push esi
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x2d
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b580
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x1a0], 0x25
call fcn.004f91a0
jmp 0x4723dd
movsx ecx, word [esp + 0x34]
mov dl, byte [esp + ecx + 0x60]
lea ecx, [esp + 0x14]
push edx
push 4
call fcn.004f5c80
lea eax, [esp + 0xdc]
lea ecx, [esp + 0x4c]
push eax
call fcn.004f86e0
mov eax, dword [eax + 4]
cmp eax, esi
jne 0x472548
mov eax, 0x530164
push eax
call fcn.00514a57
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xe4]
add esp, 4
cmp eax, esi
je 0x47257d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x472574
cmp al, 0xff
je 0x472574
dec al
mov byte [ecx], al
jmp 0x47257d
push ecx
call fcn.00514140
add esp, 4
fild dword [esp + 0x1c]
mov dword [esp + 0xe0], esi
mov dword [esp + 0xe4], esi
mov dword [esp + 0xe8], esi
fmul qword [0x530178]
call fcn.00514a64
push eax
push 6
lea ecx, [esp + 0x1c]
call fcn.004f5c80
lea ecx, [esp + 0x14]
push ecx
call fcn.00473820
add esp, 4
push esi
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x2e
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x548aac
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x1a0], 0x25
call fcn.004f91a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004f5870
lea edx, [esp + 0x2c]
lea eax, [esp + 0x18]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x1a0], 0x2f
call fcn.004f5850
mov byte [esp + 0x19c], 0x25
call fcn.00473d20
add esp, 0xc
mov bl, al
push 0x514
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 1
push ecx
test bl, bl
mov ecx, esp
jne 0x472676
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x30
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b5a0
jmp 0x47269c
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x31
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b598
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x1a0], 0x25
call fcn.004f91a0
mov eax, dword [esp + 0x54]
cmp eax, esi
je 0x4726d8
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x4726cf
cmp al, 0xff
je 0x4726cf
dec al
mov byte [ecx], al
jmp 0x4726d8
push ecx
call fcn.00514140
add esp, 4
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
jmp case.default.0x4715b4
push esi
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x32
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b5e0
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x1a0], 3
call fcn.004f91a0
push 7
push 0x54b524
lea ecx, [esp + 0x1c]
call fcn.004f5de0
lea ecx, [esp + 0x14]
push ecx
call fcn.00473820
add esp, 4
push esi
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x33
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b5a8
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x1a0], 3
call fcn.004f91a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004f5870
lea edx, [esp + 0x2c]
lea eax, [esp + 0x18]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x1a0], 0x34
call fcn.004f5850
mov byte [esp + 0x19c], 3
call fcn.00473d20
add esp, 0xc
mov bl, al
push 0x514
call edi
push esi
push 1
push ecx
test bl, bl
mov ecx, esp
jne 0x47281b
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x35
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b5a0
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x1a0], 3
call fcn.004f91a0
jmp case.default.0x4715b4
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x36
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b598
jmp 0x4727ff
push 7
push 0x54b51c
lea ecx, [esp + 0x1c]
call fcn.004f5de0
lea ecx, [esp + 0x14]
push ecx
call fcn.00473820
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004f5870
lea edx, [esp + 0x2c]
lea eax, [esp + 0x18]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x1a0], 0x37
call fcn.004f5850
mov byte [esp + 0x19c], 3
call fcn.00473d20
add esp, 0xc
test al, al
jne 0x4728e3
push esi
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x38
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b5a0
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x1a0], 3
call fcn.004f91a0
jmp case.default.0x4715b4
push 8
push 0x549098
lea ecx, [esp + 0x1c]
call fcn.004f5de0
movsx ecx, word [esp + 0x34]
mov dl, byte [esp + ecx + 0x60]
lea ecx, [esp + 0x14]
push edx
push 4
call fcn.004f5c80
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x24]
push eax
push 5
call fcn.004f5c80
lea ecx, [esp + 0x38]
call fcn.004f8480
mov cl, byte [esp + 0x2e]
sub esp, 0x10
mov ebx, esp
mov edi, 0x54b518
xor eax, eax
mov byte [esp + 0x1a0], 0x39
mov byte [ebx], cl
or ecx, 0xffffffff
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], esi
mov dword [esp + 0x20], esp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
mov ecx, ebx
call fcn.00401a70
cmp eax, ebp
jae 0x472962
call fcn.0051414b
mov ecx, dword [ebx + 4]
cmp ecx, esi
je 0x472987
mov al, byte [ecx - 1]
test al, al
je 0x472987
cmp al, 0xff
je 0x472987
cmp ebp, esi
jne 0x4729ab
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.004013e0
jmp 0x4729d8
cmp ebp, esi
jne 0x472996
push 1
mov ecx, ebx
call fcn.004013e0
jmp 0x4729d8
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x4729a2
cmp eax, ebp
jae 0x4729b3
push 1
mov ecx, ebx
call fcn.004013e0
push ebp
mov ecx, ebx
call fcn.00401a80
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x54b518
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx + 8], ebp
mov ebx, dword [ebx + 4]
add ebx, ebp
xor esi, esi
mov byte [ebx], 0
sub esp, 0x10
lea eax, [esp + 0x9f]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
push 0x548ec4
mov byte [esp + 0x1b8], 0x3a
call fcn.00401030
sub esp, 0x10
lea edx, [esp + 0xa3]
mov ecx, esp
mov dword [esp + 0xe0], esp
push edx
push 0x548324
mov byte [esp + 0x1c8], 0x3b
call fcn.00401030
sub esp, 0x10
lea eax, [esp + 0xc2]
mov ecx, esp
mov dword [esp + 0xec], esp
push eax
push 0x554048
mov byte [esp + 0x1d8], 0x3c
call fcn.00401030
push ecx
lea edx, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x64], esp
push edx
mov byte [esp + 0x1d8], 0x3d
call fcn.004f5850
push ecx
mov byte [esp + 0x1d8], 0x3e
mov ecx, esp
mov dword [esp + 0x64], esp
push 6
push 0x54b510
call fcn.004f58e0
lea eax, [esp + 0x1bc]
mov ecx, 0x5540a8
push eax
mov byte [esp + 0x1dc], 0x39
call fcn.004f9710
mov cx, word [eax]
mov ebp, dword [0x530168]
lea edi, [eax + 4]
mov word [esp + 0x38], cx
mov byte [esp + 0x190], 0x3f
mov eax, dword [edi + 8]
mov ebx, eax
cmp ebp, ebx
jae 0x472ab9
mov ebx, ebp
lea edx, [esp + 0x3c]
cmp edx, edi
jne 0x472b28
cmp dword [esp + 0x44], ebx
jae 0x472acc
call fcn.00514377
lea ecx, [esp + 0x3c]
call fcn.00401b90
mov eax, dword [esp + 0x44]
sub eax, ebx
cmp eax, ebp
jae 0x472ae1
mov ebp, eax
cmp ebp, esi
jbe 0x472b1a
mov ecx, dword [esp + 0x40]
sub eax, ebp
add ecx, ebx
push eax
lea edx, [ecx + ebp]
push edx
push ecx
call fcn.00514aa0
mov edi, dword [esp + 0x50]
add esp, 0xc
sub edi, ebp
lea ecx, [esp + 0x3c]
push esi
push edi
call fcn.004016f0
test al, al
je 0x472b1a
push edi
lea ecx, [esp + 0x40]
call fcn.004016d0
lea ecx, [esp + 0x3c]
call fcn.00401b90
jmp 0x472bb5
cmp ebx, esi
jbe 0x472b75
cmp ebx, eax
jne 0x472b75
mov eax, dword [edi + 4]
cmp eax, esi
jne 0x472b3c
mov eax, 0x530164
cmp byte [eax - 1], 0xfe
jae 0x472b75
push 1
lea ecx, [esp + 0x40]
call fcn.004013e0
mov eax, dword [edi + 4]
cmp eax, esi
jne 0x472b59
mov eax, 0x530164
mov dword [esp + 0x40], eax
mov ecx, dword [edi + 8]
mov dword [esp + 0x44], ecx
mov edi, dword [edi + 0xc]
mov dword [esp + 0x48], edi
mov cl, byte [eax - 1]
inc cl
mov byte [eax - 1], cl
jmp 0x472bb5
push 1
push ebx
lea ecx, [esp + 0x44]
call fcn.004016f0
test al, al
je 0x472bb5
mov edi, dword [edi + 4]
cmp edi, esi
mov esi, 0x530164
je 0x472b93
mov esi, edi
mov edi, dword [esp + 0x40]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x44], ebx
xor esi, esi
mov byte [ebx + eax], 0
mov eax, dword [esp + 0x17c]
mov byte [esp + 0x190], 0x39
cmp eax, esi
je 0x472be5
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x472bdc
cmp al, 0xff
je 0x472bdc
dec al
mov byte [ecx], al
jmp 0x472be5
push ecx
call fcn.00514140
add esp, 4
lea ecx, [esp + 0x38]
mov dword [esp + 0x17c], esi
mov dword [esp + 0x180], esi
mov dword [esp + 0x184], esi
call fcn.004f86d0
cmp ax, 2
je 0x472d16
lea ecx, [esp + 0xbc]
push ecx
lea ecx, [esp + 0x3c]
call fcn.004f86e0
mov ecx, dword [eax + 8]
mov byte [esp + 0x190], 0x40
cmp ecx, 2
ja 0x472c88
lea edx, [esp + 0x13c]
lea ecx, [esp + 0x38]
push edx
call fcn.004f86e0
mov edx, dword [eax + 8]
mov eax, dword [esp + 0x140]
cmp edx, esi
sete bl
cmp eax, esi
je 0x472c6f
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x472c66
cmp al, 0xff
je 0x472c66
dec al
mov byte [ecx], al
jmp 0x472c6f
push ecx
call fcn.00514140
add esp, 4
test bl, bl
mov dword [esp + 0x140], esi
mov dword [esp + 0x144], esi
mov dword [esp + 0x148], esi
je 0x472c8a
mov bl, 1
mov eax, dword [esp + 0xc0]
mov byte [esp + 0x190], 0x39
cmp eax, esi
je 0x472cba
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x472cb1
cmp al, 0xff
je 0x472cb1
dec al
mov byte [ecx], al
jmp 0x472cba
push ecx
call fcn.00514140
add esp, 4
test bl, bl
mov dword [esp + 0xc0], esi
mov dword [esp + 0xc4], esi
mov dword [esp + 0xc8], esi
je 0x472d41
push esi
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x41
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b580
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x1a0], 0x39
call fcn.004f91a0
mov eax, dword [esp + 0x40]
cmp eax, esi
je 0x472ed4
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x472ecb
cmp al, 0xff
je 0x472ecb
dec al
mov byte [ecx], al
jmp 0x472ed4
movsx eax, word [esp + 0x34]
mov cl, byte [esp + eax + 0x60]
push ecx
push 4
lea ecx, [esp + 0x1c]
call fcn.004f5c80
lea edx, [esp + 0x12c]
lea ecx, [esp + 0x38]
push edx
call fcn.004f86e0
mov eax, dword [eax + 4]
cmp eax, esi
jne 0x472d73
mov eax, 0x530164
push eax
call fcn.00514a57
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x134]
add esp, 4
cmp eax, esi
je 0x472da8
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x472d9f
cmp al, 0xff
je 0x472d9f
dec al
mov byte [ecx], al
jmp 0x472da8
push ecx
call fcn.00514140
add esp, 4
fild dword [esp + 0x1c]
mov dword [esp + 0x130], esi
mov dword [esp + 0x134], esi
mov dword [esp + 0x138], esi
fadd st(0), st(0)
call fcn.00514a64
push eax
push 6
lea ecx, [esp + 0x1c]
call fcn.004f5c80
lea eax, [esp + 0x14]
push eax
call fcn.00473820
add esp, 4
push esi
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x42
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b5a8
call fcn.004f58e0
mov ecx, 0x5540a8
mov byte [esp + 0x1a0], 0x39
call fcn.004f91a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004f5870
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x18]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x1a0], 0x43
call fcn.004f5850
mov byte [esp + 0x19c], 0x39
call fcn.00473d20
add esp, 0xc
mov bl, al
push 0x514
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 1
push ecx
test bl, bl
mov ecx, esp
jne 0x472ea0
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x44
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b5a0
jmp 0x472cff
mov dword [esp + 0x1c], esp
push 6
push 0x548208
call fcn.004f58e0
push ecx
mov byte [esp + 0x1a0], 0x45
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x54b598
jmp 0x472cff
push ecx
call fcn.00514140
add esp, 4
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
lea ecx, [esp + 0x28]
mov byte [esp + 0x190], 2
call fcn.004f5980
lea ecx, [esp + 0x14]
mov byte [esp + 0x190], 1
call fcn.004f5980
lea ecx, [esp + 0x24]
mov byte [esp + 0x190], 0
call fcn.004f5980
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
or ebp, 0xffffffff
jmp 0x471493
lea ecx, [esp + 0x24]
mov byte [esp + 0x190], 0
call fcn.004f5980
mov ecx, dword [esp + 0x188]
pop edi
pop esi
pop ebp
xor ax, ax
mov dword fs:[0], ecx
pop ebx
add esp, 0x184
ret