Function at 0x474db0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x4088
call fcn.00499f40
sub esp, eax
mov edi, ecx
mov eax, dword [esp + eax]
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ecx
mov esi, eax
mov dword [esp + 0x30], eax
movzx eax, byte [eax + 0x98]
movzx ebp, byte [esi + 0x9a]
mov byte [esp + 0x40], al
mov eax, dword [esi + 0x94]
mov dword [esp + 0x44], eax
movzx eax, byte [esi + 0x99]
mov byte [esp + 0x3c], al
mov eax, dword [esp + 0x40a0]
mov dword [eax], 0
mov dword [esp], 0x6ab660
call fcn.00472cd0
test edi, edi
je 0x476239
lea eax, [esp + 0x80]
mov dword [esp + 0x34], 0
xor edi, edi
mov ebx, ebp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x34]
mov edx, dword [eax + esi*8]
mov eax, dword [eax + esi*8 + 4]
mov dword [esp + 0x28], eax
mov eax, dword [0x63a044]
mov dword [esp + 0x24], edx
test eax, eax
jne 0x474e5b
test edx, edx
jne 0x475145
mov eax, dword [esp + 0x24]
xor ebp, ebp
test eax, eax
je 0x474f07
mov edx, ebx
movzx ebx, byte [esp + 0x40]
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x44]
nop
lea esi, [esi]
mov eax, dword [esp + 0x28]
test bl, bl
movzx eax, byte [eax + ebp]
jne 0x474f40
test al, al
jne 0x474fb0
test dl, dl
je 0x4752c0
cmp dl, 2
mov edi, 0xfffd
je 0x4764b1
test dl, 4
je 0x474f70
mov ebx, edx
and ebx, 0x10
jne 0x475135
lea eax, [edi - 0x30]
cmp eax, 9
ja 0x4750e0
mov eax, dword [esp + 0x30]
test dl, 0x20
movzx eax, byte [eax + 0x9b]
jne 0x4752e0
cmp al, 3
jbe 0x475368
or edx, 0x10
lea esi, [esi]
add ebp, 1
cmp dword [esp + 0x24], ebp
ja 0x474e80
mov dword [esp + 0x44], edi
mov edi, dword [esp + 0x2c]
mov byte [esp + 0x40], bl
mov ebx, edx
add dword [esp + 0x34], 1
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x4c], eax
jne 0x474e33
mov eax, dword [esp + 0x30]
mov ebp, ebx
mov dword [esp + 0x50], 0
add eax, 0x90
mov dword [esp + 0x24], eax
jmp 0x47520b
mov ecx, eax
and ecx, 0xffffffc0
cmp cl, 0x80
je 0x475030
sub ebp, 1
test dl, dl
je 0x474ff0
cmp dl, 2
je 0x474ff0
test dl, 4
mov edi, 0xfffd
jne 0x474eb7
test dl, 8
je 0x4764a0
mov ebx, edx
and ebx, 0x40
je 0x475080
test dl, dl
js 0x4752d0
cmp edi, 0x22
je 0x475350
mov eax, edx
xor ebx, ebx
or edx, 0xffffff80
cmp edi, 0x5c
cmovne edx, eax
jmp 0x474ef0
mov ecx, eax
mov ebx, 0x1f
movzx edi, al
not ecx
movzx ecx, cl
bsr ecx, ecx
xor ecx, 0x1f
sub ebx, ecx
cmp ebx, 7
je 0x475043
cmp ebx, 5
ja 0x474f51
sub ecx, 0x17
mov esi, 0xff
sar esi, cl
and esi, eax
mov eax, 6
sub eax, ebx
mov edi, esi
mov ebx, eax
jmp 0x474ef0
mov ebx, 0xfffffffd
mov edi, 0xfffd
cmp dword [esp + 0x2c], 0x2000
je 0x4750b0
mov esi, dword [esp + 0x2c]
mov eax, esi
add esi, 1
mov dword [esp + 0x2c], esi
mov word [esp + eax*2 + 0x80], bx
xor edx, edx
xor ebx, ebx
mov byte [esp + 0x3c], 0
jmp 0x474ef0
shl edi, 6
and eax, 0x3f
or eax, edi
sub bl, 1
mov edi, eax
jne 0x474ef0
test dl, dl
jne 0x475463
cmp edi, 0x1b
je 0x475073
cmp edi, 0x9b
jne 0x4764a5
mov eax, dword [esp + 0x30]
xor ebx, ebx
mov edx, 4
mov byte [eax + 0x9b], 0
jmp 0x474ef0
xor ebx, ebx
mov edx, 2
jmp 0x474ef0
cmp edi, 7
je case.0x47511e.73
cmp edi, 0x5c
je 0x475125
cmp edi, 0x1b
je 0x475360
cmp edi, 0x22
je 0x47538b
and edx, 0xfffffffd
jmp 0x474ef0
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x40a0]
mov ecx, 0x2000
mov edx, dword [esp + 0x38]
add eax, 0x90
mov dword [esp], esi
call fcn.00474970
mov dword [esp + 0x2c], 1
xor eax, eax
jmp 0x475015
cmp edi, 0x3b
je 0x475310
cmp edi, 0x3f
je 0x47539e
lea eax, [edi - 0x40]
cmp eax, 0x3e
ja 0x474eea
mov eax, dword [esp + 0x30]
movzx ecx, byte [eax + 0x9b]
test cl, cl
jne 0x475116
cmp edi, 0x5b
je 0x474eea
lea eax, [edi - 0x41]
cmp eax, 0x34
ja case.0x47511e.73
jmp dword [eax*4 + 0x6468e8]
test dl, 2
je 0x4750a4
xor edx, edx
jmp 0x474ef0
lea eax, [edi - 0x40]
xor ebx, ebx
cmp eax, 0x3f
cmovb edx, ebx
jmp 0x474ef0
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
call esi
sub esp, 0x18
test eax, eax
mov edi, eax
je 0x47620e
lea edx, [eax + eax + 2]
xor eax, eax
cmp edx, 0x2000
mov dword [esp + 0x2c], edx
seta al
mov dword [esp + 0x50], eax
ja 0x475430
mov eax, dword [esp + 0x38]
mov dword [esp + 0x14], edi
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
call esi
sub esp, 0x18
mov esi, dword [esp + 0x30]
add esi, 0x90
test eax, eax
mov dword [esp + 0x24], esi
jne 0x4753bd
cmp dword [esp + 0x2c], 0x2000
mov ebp, ebx
ja 0x475452
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x40a0]
mov dword [esi], eax
mov eax, ebp
mov ebp, dword [esp + 0x38]
xor esi, esi
mov byte [esp + 0x28], al
mov esi, esi
lea edi, [edi]
mov ebx, edi
mov eax, 0x2000
lea edx, [ebp + esi*2]
sub ebx, esi
cmp ebx, 0x2000
cmova ebx, eax
mov eax, dword [esp + 0x40a0]
mov ecx, ebx
add esi, ebx
mov dword [esp], eax
mov eax, dword [esp + 0x24]
call fcn.00474970
cmp edi, esi
ja 0x475220
mov edx, dword [esp + 0x50]
movzx ebp, byte [esp + 0x28]
test edx, edx
jne 0x475441
movzx eax, byte [esp + 0x40]
mov edi, dword [esp + 0x30]
mov byte [edi + 0x98], al
mov eax, dword [esp + 0x44]
mov dword [edi + 0x94], eax
movzx eax, byte [esp + 0x3c]
mov byte [edi + 0x99], al
mov eax, ebp
mov byte [edi + 0x9a], al
mov dword [esp], 0x6ab660
call fcn.00472c90
mov eax, dword [esp + 0x40a0]
mov eax, dword [eax]
test eax, eax
setne al
add esp, 0x408c
movzx eax, al
pop ebx
neg eax
pop esi
pop edi
pop ebp
ret
mov edi, 0xfffd
mov ebx, edi
jmp 0x474ffa
and edx, 0x7f
xor ebx, ebx
jmp 0x474ef0
mov esi, dword [esp + 0x30]
lea ecx, [esi + eax*2]
movzx eax, word [ecx + 0x9a]
lea eax, [eax + eax*4]
add eax, eax
cmp eax, 0xffff
jg 0x474eea
lea eax, [eax + edi - 0x30]
mov word [ecx + 0x9a], ax
jmp 0x474ef0
test dl, 0x20
jne 0x475396
mov eax, dword [esp + 0x30]
movzx eax, byte [eax + 0x9b]
cmp al, 3
ja 0x474eea
mov esi, dword [esp + 0x30]
add eax, 1
xor ecx, ecx
mov byte [esi + 0x9b], al
movzx eax, al
mov word [esi + eax*2 + 0x9a], cx
jmp 0x474ef0
and edx, 0xffffffbf
xor ebx, ebx
jmp 0x474ef0
or edx, 2
jmp 0x474ef0
mov esi, dword [esp + 0x30]
add eax, 1
lea ecx, [edi - 0x30]
or edx, 0x20
mov byte [esi + 0x9b], al
movzx eax, al
mov word [esi + eax*2 + 0x9a], cx
jmp 0x474ef0
and edx, 0x7d
or edx, 0x40
jmp 0x474ef0
and edx, 0xffffffdf
jmp 0x474ef0
test dl, 0x20
jne 0x474eea
mov eax, dword [esp + 0x30]
cmp byte [eax + 0x9b], 0
jne 0x474eea
jmp 0x474ef0
xor esi, esi
mov ebp, 0x2000
mov byte [esp + 0x28], bl
nop
lea esi, [esi]
mov eax, dword [esp + 0x38]
mov ebx, edi
sub ebx, esi
cmp ebx, 0x2000
lea edx, [eax + esi*2]
mov eax, dword [esp + 0x40a0]
cmova ebx, ebp
mov ecx, ebx
add esi, ebx
mov dword [esp], eax
mov eax, dword [esp + 0x24]
call fcn.00474970
cmp edi, esi
ja 0x4753d0
xor edi, edi
cmp dword [esp + 0x2c], 0x2000
movzx ebx, byte [esp + 0x28]
jbe 0x474f07
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.00458a40
lea eax, [esp + 0x80]
mov dword [esp + 0x38], eax
jmp 0x474f07
mov dword [esp], edx
call fcn.00458a30
mov dword [esp + 0x38], eax
jmp 0x4751a6
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.00458a40
jmp 0x475262
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.00458a40
jmp 0x4751fc
cmp dl, 2
jne 0x474eae
lea eax, [edi - 0x1b]
cmp eax, 0x48
ja case.0x475478.28
jmp dword [eax*4 + 0x6469bc]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00474970
cmp ebp, edi
ja 0x47549c
mov ecx, dword [esp + 0x40a0]
mov eax, dword [esp + 0x30]
xor edx, edx
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x50]
call fcn.00474cf0
xor edx, edx
mov dword [esp + 0x2c], 0
jmp 0x474ef0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00474970
cmp ebp, edi
ja 0x475516
mov ecx, dword [esp + 0x40a0]
mov eax, dword [esp + 0x30]
xor edx, edx
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x50]
call fcn.004740c0
xor edx, edx
mov dword [esp + 0x2c], 0
jmp 0x474ef0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00474970
cmp ebp, edi
ja 0x475590
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x50]
movzx eax, byte [eax + 0x9b]
test al, al
jne 0x476267
movzx eax, byte [0x63a048]
mov byte [esp + 0x2c], al
movzx eax, byte [0x6ab65f]
mov byte [esp + 0x40], al
movzx eax, byte [0x6ab65e]
mov byte [esp + 0x50], al
movzx eax, byte [0x6ab65d]
mov esi, eax
movzx eax, byte [0x6ab65c]
mov byte [esp + 0x44], al
cmp byte [esp + 0x2c], 0xff
jne 0x47564a
cmp byte [esp + 0x40], 0xff
jne 0x47564a
cmp byte [esp + 0x50], 0xff
mov eax, esi
sete dl
cmp al, 0xff
sete al
test dl, al
je 0x475640
cmp byte [esp + 0x44], 0xff
je 0x475790
mov byte [esp + 0x40], 0xff
mov byte [esp + 0x2c], 0xff
lea eax, [esp + 0x6a]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x90]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
sub esp, 8
test eax, eax
je 0x47648c
movzx eax, word [esp + 0x72]
test ah, 0x40
je 0x475696
mov edx, eax
mov ecx, eax
shr ax, 4
and edx, 0xf
xor cl, cl
and eax, 0xf
shl edx, 4
or edx, ecx
or eax, edx
mov word [esp + 0x72], ax
movzx edx, byte [esp + 0x2c]
cmp dl, 0xff
je 0x4756ce
and eax, 0xfffffff8
and edx, 1
je 0x4756ab
or eax, 4
test byte [esp + 0x2c], 2
mov word [esp + 0x72], ax
je 0x4756bf
or eax, 2
mov word [esp + 0x72], ax
test byte [esp + 0x2c], 4
je 0x4756ce
or eax, 1
mov word [esp + 0x72], ax
movzx edx, byte [esp + 0x50]
cmp dl, 0xff
je 0x4756e8
test dl, dl
je 0x4763da
or eax, 8
mov word [esp + 0x72], ax
movzx edx, byte [esp + 0x40]
cmp dl, 0xff
je 0x475720
and eax, 0xffffff8f
and edx, 1
je 0x4756fd
or eax, 0x40
test byte [esp + 0x40], 2
mov word [esp + 0x72], ax
je 0x475711
or eax, 0x20
mov word [esp + 0x72], ax
test byte [esp + 0x40], 4
je 0x475720
or eax, 0x10
mov word [esp + 0x72], ax
mov edx, esi
cmp dl, 0xff
je 0x475736
test dl, dl
je 0x4763e7
or al, 0x80
mov word [esp + 0x72], ax
cmp byte [esp + 0x44], 0xff
je 0x4763c1
cmp byte [esp + 0x44], 0
je 0x4763b4
or ah, 0x40
mov edx, eax
mov ecx, eax
shr ax, 4
and edx, 0xf
xor cl, cl
and eax, 0xf
shl edx, 4
or edx, ecx
or eax, edx
mov word [esp + 0x72], ax
movzx eax, ax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x90]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
sub esp, 8
test eax, eax
je 0x47648c
xor edx, edx
mov dword [esp + 0x2c], 0
jmp 0x474ef0
xor edx, edx
cmp cl, 1
jne 0x474ef0
mov eax, dword [esp + 0x30]
cmp word [eax + 0x9c], 0x19
jne 0x474ef0
add eax, 0x90
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x2c]
mov edx, 0x2000
mov ecx, dword [esp + 0x40a0]
sub esi, eax
cmp esi, 0x2000
mov dword [esp], ecx
cmova esi, edx
mov edx, dword [esp + 0x38]
mov ecx, esi
lea edx, [edx + eax*2]
mov eax, dword [esp + 0x44]
call fcn.00474970
add dword [esp + 0x40], esi
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x2c], eax
ja 0x4757cd
mov ecx, dword [esp + 0x40a0]
mov eax, dword [esp + 0x44]
xor edx, edx
call fcn.006345f0
xor edx, edx
mov dword [esp + 0x2c], 0
jmp 0x474ef0
xor edx, edx
cmp cl, 1
jne 0x474ef0
mov eax, dword [esp + 0x30]
cmp word [eax + 0x9c], 0x19
jne 0x474ef0
add eax, 0x90
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x2c]
mov edx, 0x2000
mov ecx, dword [esp + 0x40a0]
sub esi, eax
cmp esi, 0x2000
mov dword [esp], ecx
cmova esi, edx
mov edx, dword [esp + 0x38]
mov ecx, esi
lea edx, [edx + eax*2]
mov eax, dword [esp + 0x44]
call fcn.00474970
add dword [esp + 0x40], esi
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x2c], eax
ja 0x47585e
mov ecx, dword [esp + 0x40a0]
mov eax, dword [esp + 0x44]
mov edx, 1
call fcn.006345f0
xor edx, edx
mov dword [esp + 0x2c], 0
jmp 0x474ef0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00474970
cmp ebp, edi
ja 0x4758e1
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov edx, 1
mov ebp, dword [esp + 0x50]
cmp byte [eax + 0x9b], 0
je 0x475936
movzx edx, word [eax + 0x9c]
mov eax, dword [esp + 0x40a0]
mov eax, dword [eax]
test eax, eax
mov dword [esp + 0x2c], eax
jne 0x475790
mov eax, dword [esp + 0x40a0]
mov dword [esp + 4], 1
mov ecx, 1
mov dword [esp], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
call fcn.00474c30
xor edx, edx
jmp 0x474ef0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00474970
cmp ebp, edi
ja 0x475997
mov eax, dword [esp + 0x30]
xor edx, edx
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x50]
cmp byte [eax + 0x9b], 0
je 0x4759f4
movzx eax, word [eax + 0x9c]
mov ecx, eax
sub eax, 1
test cx, cx
cmovne edx, eax
mov eax, dword [esp + 0x40a0]
mov eax, dword [eax]
test eax, eax
mov dword [esp + 0x2c], eax
jne 0x475790
mov eax, dword [esp + 0x40a0]
mov dword [esp + 4], 1
xor ecx, ecx
mov dword [esp], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
call fcn.00474c30
xor edx, edx
jmp 0x474ef0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00474970
cmp ebp, edi
ja 0x475a52
mov edx, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov eax, 0xffffffff
mov ebp, dword [esp + 0x50]
cmp byte [edx + 0x9b], 0
je 0x475aa9
movzx eax, word [edx + 0x9c]
neg eax
mov esi, dword [esp + 0x40a0]
mov edx, dword [esi]
test edx, edx
mov dword [esp + 0x2c], edx
jne 0x475790
mov dword [esp], eax
mov eax, dword [esp + 0x30]
xor edx, edx
mov dword [esp + 8], esi
mov dword [esp + 4], 1
xor ecx, ecx
call fcn.00474c30
xor edx, edx
jmp 0x474ef0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00474970
cmp ebp, edi
ja 0x475afe
mov edx, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov eax, 1
mov ebp, dword [esp + 0x50]
cmp byte [edx + 0x9b], 0
je 0x475aa9
movzx eax, word [edx + 0x9c]
jmp 0x475aa9
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00474970
cmp ebp, edi
ja 0x475b79
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov edx, 0xffffffff
mov ebp, dword [esp + 0x50]
cmp byte [eax + 0x9b], 0
je 0x475936
movzx edx, word [eax + 0x9c]
neg edx
jmp 0x475936
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00474970
cmp ebp, edi
ja 0x475bf6
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x50]
cmp byte [eax + 0x9b], 0
je 0x476387
movzx edx, word [eax + 0x9c]
cmp edx, 2
jg 0x475790
mov eax, dword [esp + 0x40a0]
mov ecx, 1
mov dword [esp], eax
mov eax, dword [esp + 0x30]
call fcn.00474a50
xor edx, edx
mov dword [esp + 0x2c], 0
jmp 0x474ef0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00474970
cmp ebp, edi
ja 0x475c97
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x50]
movzx ecx, byte [eax + 0x9b]
test cl, cl
je 0x47638e
movzx eax, word [eax + 0x9c]
xor edx, edx
mov esi, eax
sub eax, 1
test si, si
cmove eax, edx
cmp cl, 1
jbe 0x4765f3
mov esi, dword [esp + 0x30]
movzx ecx, word [esi + 0x9e]
mov esi, ecx
sub ecx, 1
test si, si
cmovne edx, ecx
mov esi, dword [esp + 0x40a0]
mov esi, dword [esi]
test esi, esi
mov dword [esp + 0x2c], esi
jne 0x475790
mov esi, dword [esp + 0x40a0]
mov dword [esp], eax
xor ecx, ecx
mov eax, dword [esp + 0x30]
mov dword [esp + 4], 0
mov dword [esp + 8], esi
call fcn.00474c30
xor edx, edx
jmp 0x474ef0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00474970
cmp ebp, edi
ja 0x475d73
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x50]
cmp byte [eax + 0x9b], 0
je 0x476260
movzx edx, word [eax + 0x9c]
cmp edx, 2
jg 0x475790
mov eax, dword [esp + 0x40a0]
xor ecx, ecx
mov dword [esp], eax
mov eax, dword [esp + 0x30]
call fcn.00474a50
xor edx, edx
mov dword [esp + 0x2c], 0
jmp 0x474ef0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00474970
cmp ebp, edi
ja 0x475e11
mov edx, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov eax, 0xffffffff
mov ebp, dword [esp + 0x50]
cmp byte [edx + 0x9b], 0
je 0x475e68
movzx eax, word [edx + 0x9c]
neg eax
mov esi, dword [esp + 0x40a0]
mov edx, dword [esi]
test edx, edx
mov dword [esp + 0x2c], edx
jne 0x475790
mov dword [esp], eax
mov eax, dword [esp + 0x30]
xor edx, edx
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov ecx, 1
call fcn.00474c30
xor edx, edx
jmp 0x474ef0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00474970
cmp ebp, edi
ja 0x475ec0
mov edx, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov eax, 1
mov ebp, dword [esp + 0x50]
cmp byte [edx + 0x9b], 0
je 0x475e68
movzx eax, word [edx + 0x9c]
jmp 0x475e68
mov eax, dword [esp + 0x30]
mov dword [esp + 0x44], edi
xor esi, esi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x2c], ebp
mov ebp, dword [esp + 0x38]
add eax, 0x90
mov dword [esp + 0x40], eax
lea esi, [esi]
mov ebx, edi
mov eax, 0x2000
lea edx, [ebp + esi*2]
sub ebx, esi
cmp ebx, 0x2000
cmova ebx, eax
mov eax, dword [esp + 0x40a0]
mov ecx, ebx
add esi, ebx
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00474970
cmp edi, esi
ja 0x475f40
mov esi, dword [esp + 0x40a0]
xor ebx, ebx
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x2c]
movzx eax, word [0x63a04a]
mov esi, dword [esi]
test esi, esi
jne 0x4760b7
mov dword [esp + 4], eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x90]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
sub esp, 8
test eax, eax
je 0x47639e
mov esi, dword [esp + 0x30]
mov dword [esp + 4], 0
mov eax, dword [esi + 0x90]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
sub esp, 8
test eax, eax
je 0x4760a8
lea eax, [esp + 0x6a]
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], ebp
mov edi, esi
mov dword [esp + 0x50], eax
mov esi, eax
jmp 0x476082
lea eax, [esp + 0x64]
movsx edx, word [esp + 0x6c]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 0x20
mov dword [esp + 0x10], eax
movsx eax, word [esp + 0x6a]
imul eax, edx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x90]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
sub esp, 0x14
test eax, eax
je 0x476071
lea eax, [esp + 0x64]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [edi + 0x90]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
sub esp, 0x14
test eax, eax
jne 0x4761ec
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x57
jne 0x4761d0
mov dword [esp + 4], esi
mov eax, dword [edi + 0x90]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
sub esp, 8
test eax, eax
jne 0x476000
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x40a0]
mov dword [edx], eax
xor ebx, ebx
jmp 0x475790
xor ebx, ebx
mov edx, 8
jmp 0x474ef0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x44], edi
xor esi, esi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x2c], ebp
mov ebp, dword [esp + 0x38]
add eax, 0x90
mov dword [esp + 0x40], eax
lea esi, [esi]
mov ebx, edi
mov eax, 0x2000
lea edx, [ebp + esi*2]
sub ebx, esi
cmp ebx, 0x2000
cmova ebx, eax
mov eax, dword [esp + 0x40a0]
mov ecx, ebx
add esi, ebx
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00474970
cmp edi, esi
ja 0x4760f0
mov ecx, dword [esp + 0x40a0]
mov eax, dword [esp + 0x30]
mov edx, 1
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
call fcn.00474cf0
xor edx, edx
mov dword [esp + 0x2c], 0
jmp 0x474ef0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x44], edi
xor esi, esi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x2c], ebp
mov ebp, dword [esp + 0x38]
add eax, 0x90
mov dword [esp + 0x40], eax
nop
mov ebx, edi
mov eax, 0x2000
lea edx, [ebp + esi*2]
sub ebx, esi
cmp ebx, 0x2000
cmova ebx, eax
mov eax, dword [esp + 0x40a0]
mov ecx, ebx
add esi, ebx
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00474970
cmp edi, esi
ja 0x476170
mov ecx, dword [esp + 0x40a0]
mov eax, dword [esp + 0x30]
mov edx, 1
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
call fcn.004740c0
jmp 0x475790
xor ebx, ebx
jmp 0x474ef0
mov esi, ebp
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
call esi
mov edx, dword [esp + 0x40a0]
xor ebx, ebx
mov dword [edx], eax
jmp 0x475790
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x40]
xor ebx, ebx
mov ebp, dword [esp + 0x44]
mov dword [0x63a060], 0
call fcn.00473fd0
jmp 0x475790
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x40a0]
mov ebp, ebx
mov dword [esp + 0x50], 0
mov dword [edx], eax
mov eax, dword [esp + 0x30]
add eax, 0x90
mov dword [esp + 0x24], eax
jmp 0x47520b
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], 0
xor edi, edi
add eax, 0x90
mov dword [esp + 0x24], eax
lea eax, [esp + 0x80]
mov dword [esp + 0x38], eax
jmp 0x47520b
xor edx, edx
jmp 0x475dd0
movzx edx, byte [0x6ab65f]
mov esi, dword [esp + 0x30]
mov ecx, 0xffffffff
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], ebp
mov edi, ecx
mov byte [esp + 0x44], 0xff
mov byte [esp + 0x40], 0xff
mov byte [esp + 0x2c], 0xff
mov byte [esp + 0x55], dl
movzx edx, byte [0x6ab65d]
mov byte [esp + 0x56], dl
movzx edx, byte [0x63a048]
mov byte [esp + 0x50], dl
movzx edx, byte [0x6ab65e]
mov byte [esp + 0x54], dl
movzx edx, byte [0x6ab65c]
mov byte [esp + 0x57], dl
lea edx, [esi + 0x9c]
lea esi, [edx + eax*2]
mov eax, 0xffffffff
mov ebp, eax
jmp 0x476336
cmp ax, 1
je 0x476365
cmp ax, 2
je 0x476381
cmp ax, 5
je 0x476397
cmp ax, 7
je 0x4763d0
lea ecx, [eax - 0x15]
cmp cx, 1
jbe 0x476421
cmp ax, 0x19
je 0x47641a
cmp ax, 0x1b
je 0x476410
lea ecx, [eax - 0x1e]
cmp cx, 7
ja 0x4763f3
sub eax, 0x1e
mov byte [esp + 0x2c], al
add edx, 2
cmp esi, edx
je 0x47636c
movzx eax, word [edx]
test ax, ax
jne 0x4762d2
movzx eax, byte [esp + 0x57]
movzx edi, byte [esp + 0x56]
movzx ebp, byte [esp + 0x54]
mov byte [esp + 0x44], al
movzx eax, byte [esp + 0x55]
mov byte [esp + 0x40], al
movzx eax, byte [esp + 0x50]
mov byte [esp + 0x2c], al
jmp 0x47632f
mov ebp, 1
jmp 0x47632f
mov eax, ebp
mov esi, edi
mov ebp, dword [esp + 0x5c]
mov edi, dword [esp + 0x58]
mov byte [esp + 0x50], al
jmp 0x475614
xor edi, edi
xor ebp, ebp
jmp 0x47632f
xor edx, edx
jmp 0x475c53
xor eax, eax
xor edx, edx
jmp 0x475d19
mov edi, 1
jmp 0x47632f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x40a0]
xor ebx, ebx
mov dword [esi], eax
jmp 0x475790
and ah, 0xbf
mov word [esp + 0x72], ax
jmp 0x47576b
test ah, 0x40
jne 0x47574f
jmp 0x47576b
mov byte [esp + 0x44], 1
jmp 0x47632f
and eax, 0xfffffff7
mov word [esp + 0x72], ax
jmp 0x4756e8
and al, 0x7f
mov word [esp + 0x72], ax
jmp 0x475736
cmp ax, 0x27
je 0x476448
lea ecx, [eax - 0x28]
cmp cx, 7
ja 0x476428
sub eax, 0x28
mov byte [esp + 0x40], al
jmp 0x47632f
mov byte [esp + 0x44], 0
jmp 0x47632f
xor edi, edi
jmp 0x47632f
xor ebp, ebp
jmp 0x47632f
cmp ax, 0x31
je 0x476479
lea ecx, [eax - 0x5a]
cmp cx, 7
ja 0x47645b
sub eax, 0x5a
mov ebp, 1
mov byte [esp + 0x2c], al
jmp 0x47632f
movzx eax, byte [esp + 0x50]
movzx ebp, byte [esp + 0x54]
mov byte [esp + 0x2c], al
jmp 0x47632f
lea ecx, [eax - 0x64]
cmp cx, 7
ja 0x47632f
sub eax, 0x64
mov edi, 1
mov byte [esp + 0x40], al
jmp 0x47632f
movzx eax, byte [esp + 0x55]
movzx edi, byte [esp + 0x56]
mov byte [esp + 0x40], al
jmp 0x47632f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x40a0]
mov dword [edx], eax
jmp 0x475790
call sub.msvcrt.dll_abort
cmp edi, 0xffff
ja 0x474ff0
cmp edi, 0xa
sete al
cmp edi, 0xd
sete dl
je 0x4764c7
test al, al
je 0x4752c5
cmp byte [esp + 0x3c], 0xd
je 0x47651b
test al, al
je 0x47651b
mov esi, dword [esp + 0x2c]
mov eax, 0x2000
sub eax, esi
cmp eax, 1
jbe 0x476572
lea eax, [esi + 1]
mov edx, esi
add esi, 2
mov dword [esp + 0x2c], esi
mov ecx, 0xd
mov ebx, 0xa
mov word [esp + edx*2 + 0x80], cx
mov word [esp + eax*2 + 0x80], bx
mov eax, edi
xor ebx, ebx
xor edx, edx
mov byte [esp + 0x3c], al
jmp 0x474ef0
cmp byte [esp + 0x3c], 0xa
jne 0x476526
test dl, dl
jne 0x47650c
mov esi, dword [esp + 0x2c]
cmp esi, 0x2000
mov eax, esi
je 0x476545
add esi, 1
mov dword [esp + 0x2c], esi
mov word [esp + eax*2 + 0x80], di
jmp 0x47650c
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x40a0]
mov ecx, 0x2000
mov edx, dword [esp + 0x38]
add eax, 0x90
mov dword [esp], esi
call fcn.00474970
mov dword [esp + 0x2c], 1
xor eax, eax
jmp 0x47653b
mov eax, dword [esp + 0x30]
mov dword [esp + 0x40], edi
xor esi, esi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x2c], ebp
mov ebp, dword [esp + 0x38]
add eax, 0x90
mov dword [esp + 0x3c], eax
mov ebx, edi
mov eax, 0x2000
lea edx, [ebp + esi*2]
sub ebx, esi
cmp ebx, 0x2000
cmova ebx, eax
mov eax, dword [esp + 0x40a0]
mov ecx, ebx
add esi, ebx
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
call fcn.00474970
cmp edi, esi
ja 0x476591
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x40]
mov eax, 1
mov dword [esp + 0x2c], 2
xor edx, edx
jmp 0x4764f2
lea eax, [edi - 0x40]
cmp eax, 0x1f
ja 0x4764a5
xor ebx, ebx
xor edx, edx
jmp 0x474ef0
xor edx, edx
jmp 0x475d19