Function at 0x476070
Capabilities:
Check for time delay via gettickcount
Enumerate pe sections

Disassembly:
push 0xffffffffffffffff
push 0x553412
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x57f7c4]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x57f7c4]
xor eax, esp
push eax
lea eax, [esp + 0x11c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x12c]
mov ebx, ecx
movzx eax, word [ebx]
add eax, 0xfffffdfc
cmp eax, 0x23
ja case.0x4760cc.519
movzx eax, byte [eax + 0x477a1c]
jmp dword [eax*4 + 0x4779c4]
cmp dword [ebp + 0x1444], 1
je 0x477999
cmp byte [ebp + 0x1360], 0x64
je 0x477999
cmp dword [ebp + 0x5880], 0
jne 0x477999
mov cl, byte [ebx + 2]
cmp cl, byte [ebx + 4]
jne 0x47610e
mov dl, byte [ebx + 3]
cmp dl, byte [ebx + 5]
je 0x477999
mov edi, ebp
call fcn.00456610
lea ecx, [ebp + 0x1634]
call fcn.00487030
mov al, byte [ebx + 2]
cmp al, 0x64
jne 0x4761ae
mov dl, byte [ebx + 3]
cmp dl, 0xf0
jae 0x4761ae
mov cl, byte [ebx + 4]
cmp cl, al
jne 0x476169
mov al, byte [ebx + 5]
cmp al, 0xf0
jae 0x476169
cmp al, 0x78
jb 0x476152
cmp dword [ebp + 0x5968], 0
je 0x477999
movzx ecx, al
movzx eax, dl
push 0x64
push eax
push 0x64
mov esi, ebp
call fcn.00469950
jmp 0x477999
movzx eax, cl
cmp eax, dword [ebp + 0x130c]
jg 0x477999
mov bl, byte [ebx + 5]
cmp bl, 0x18
jae 0x477999
movzx ecx, bl
lea esi, [eax + eax*2]
lea esi, [ecx + esi*8]
cmp dword [ebp + esi*4 + 0x1c0], 0
jne 0x477999
push ecx
push eax
movzx ecx, dl
push 0x64
mov edx, ebp
call fcn.00468e80
jmp 0x477999
mov edi, dword [ebp + 0x130c]
movzx esi, al
cmp esi, edi
jg 0x4762c5
mov dl, byte [ebx + 3]
cmp dl, 0x18
jae 0x4762c5
mov cl, byte [ebx + 4]
cmp cl, 0x64
jne 0x47620f
mov al, byte [ebx + 5]
cmp al, 0xf0
jae 0x47620f
cmp al, 0x78
jb 0x4761eb
cmp dword [ebp + 0x5968], 0
je 0x477999
movzx ecx, al
cmp dword [ebp + ecx*4 + 0x400], 0
jne 0x477999
movzx edx, dl
push 0x64
push edx
push esi
mov edx, ebp
call fcn.00469400
jmp 0x477999
movzx ecx, cl
cmp ecx, edi
jg 0x476233
mov al, byte [ebx + 5]
cmp al, 0x18
jae 0x476233
movzx eax, al
push eax
push ecx
movzx ecx, dl
push ecx
push esi
mov ecx, ebp
call fcn.004685a0
jmp 0x477999
mov edi, ebp
lea esi, [esp + 0x20]
call fcn.00431eb0
mov dword [esp + 0x124], 0
mov edi, dword [ebp + 0x1810]
test edi, edi
je 0x476345
cmp byte [ebx + 4], 0xff
jne 0x476345
mov cl, byte [ebx + 5]
cmp cl, 0xf0
jae 0x476345
movzx eax, byte [ebx + 2]
movzx edx, byte [ebx + 3]
lea esi, [eax + eax*2]
lea esi, [edx + esi*8]
cmp dword [ebp + esi*4 + 0x1c0], 0
lea esi, [ebp + esi*4 + 0x1c0]
je 0x476345
mov esi, dword [esi]
mov ebx, dword [esi + 0x30]
cmp dword [ebx + 0xa0], 0x1b
je 0x476345
mov esi, ebx
cmp byte [esi + 0x31], 0
jne 0x476345
push 0xff
push edx
push eax
movzx ecx, cl
push edi
mov edx, ebp
call fcn.004350b0
jmp 0x476345
mov edi, ebp
lea esi, [esp + 0x20]
call fcn.00431eb0
mov dword [esp + 0x124], 1
mov esi, dword [ebp + 0x1810]
test esi, esi
je 0x476345
cmp byte [ebx + 2], 0xff
jne 0x476345
mov dl, byte [ebx + 3]
cmp dl, 0xf0
jae 0x476345
mov cl, byte [ebx + 4]
cmp cl, 0xff
jne 0x47631d
mov al, byte [ebx + 5]
cmp al, 0xf0
jae 0x47631d
movzx edx, dl
push 0xff
push edx
push 0xff
movzx ecx, al
push ebp
mov edx, esi
call fcn.00435840
jmp 0x476345
movzx eax, cl
cmp eax, dword [ebp + 0x130c]
jg 0x476345
mov bl, byte [ebx + 5]
cmp bl, 0x18
jae 0x476345
movzx ecx, bl
push ecx
push eax
push 0xff
movzx ebx, dl
push esi
mov ecx, ebp
call fcn.00435bc0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x477999
add eax, 0x5cc
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x477999
cmp dword [ebp + 0x1444], 1
je 0x477999
cmp dword [ebp + 0x5880], 0
jne 0x477999
mov edi, ebp
call fcn.00456610
lea ecx, [ebp + 0x1634]
call fcn.00487030
mov ecx, dword [ebx + 2]
mov edx, ebp
call fcn.0046a1e0
jmp 0x477999
cmp dword [ebp + 0x1444], 1
je 0x477999
cmp dword [ebp + 0x5880], 0
jne 0x477999
mov al, byte [ebx + 2]
test al, al
je 0x477999
cmp byte [ebx + 4], 0
je 0x477999
movzx edx, al
cmp edx, dword [ebp + 0x130c]
jg 0x477999
cmp byte [ebx + 3], 0x18
jae 0x477999
mov edi, ebp
call fcn.00456610
lea ecx, [ebp + 0x1634]
call fcn.00487030
movzx eax, byte [ebx + 4]
movzx ecx, byte [ebx + 3]
movzx edx, byte [ebx + 2]
push eax
push ecx
push edx
mov ecx, ebp
call fcn.00469c00
jmp 0x477999
cmp byte [ebp + 0x58ea], 0
jne 0x477999
cmp dword [ebp + 0x1444], 1
je 0x477999
movzx ecx, word [ebx + 4]
movzx eax, word [ebx + 8]
movzx edx, word [ebx + 2]
add eax, ecx
movzx ecx, word [ebx + 0xc]
add eax, ecx
movzx ecx, word [ebx + 0xa]
add eax, ecx
movzx ecx, dx
add eax, ecx
movzx ecx, word [ebx + 6]
add eax, ecx
test eax, eax
jle 0x477999
movzx ecx, word [ebp + 0x138]
movzx esi, cx
cmp esi, eax
jge 0x476494
xor ecx, ecx
xor edx, edx
xor eax, eax
push 0xe
mov word [ebx + 6], cx
mov word [ebx + 0xc], cx
push ebx
mov ecx, ebp
mov word [ebx + 2], dx
mov word [ebx + 4], ax
mov word [ebx + 8], dx
mov word [ebx + 0xa], ax
call fcn.004ed0e0
jmp 0x477999
add word [ebp + 0x16c], dx
movzx edx, word [ebx + 2]
add dword [ebp + 0x121c], edx
movzx edx, word [ebx + 4]
add word [ebp + 0x16e], dx
movzx edx, word [ebx + 4]
add dword [ebp + 0x1220], edx
movzx edx, word [ebx + 6]
add word [ebp + 0x174], dx
movzx edx, word [ebx + 6]
add dword [ebp + 0x122c], edx
movzx edx, word [ebx + 8]
add word [ebp + 0x170], dx
movzx edx, word [ebx + 8]
add dword [ebp + 0x1224], edx
movzx edx, word [ebx + 0xa]
add word [ebp + 0x172], dx
movzx edx, word [ebx + 0xa]
add dword [ebp + 0x1228], edx
movzx edx, word [ebx + 0xc]
add word [ebp + 0x176], dx
movzx edx, word [ebx + 0xc]
add dword [ebp + 0x1230], edx
sub ecx, eax
mov word [ebp + 0x138], cx
movzx eax, word [ebx + 6]
test ax, ax
je 0x476533
movzx eax, ax
lea eax, [eax + eax*4]
add dword [ebp + 0x178], eax
mov esi, ebp
call fcn.00490830
movzx eax, word [ebx + 4]
test ax, ax
je 0x47654f
movzx eax, ax
lea ecx, [eax + eax*4]
add dword [ebp + 0x180], ecx
mov esi, ebp
call fcn.00490960
movzx eax, word [ebx + 0xa]
test ax, ax
je 0x47656b
movzx eax, ax
lea edx, [eax + eax*4]
add dword [ebp + 0x17c], edx
mov esi, ebp
call fcn.00490a70
mov esi, ebp
call fcn.00460e40
mov eax, ebp
call fcn.0047ab60
push 0xe
push ebx
mov ecx, ebp
call fcn.004ed0e0
lea esi, [esp + 0x84]
mov edi, ebp
call fcn.00467f60
mov eax, 0x30a
mov word [esp + 0x84], ax
movzx eax, word [ebx + 2]
test ax, ax
je 0x4765d6
mov cx, word [ebp + 0x16c]
push 0x5c
mov edx, esi
mov word [esp + 0xe0], cx
mov ecx, dword [0x587974]
push edx
mov byte [esp + 0xe3], 1
mov word [esp + 0xe6], ax
call fcn.004ed210
movzx eax, word [ebx + 4]
test ax, ax
je 0x476613
mov cx, word [ebp + 0x16e]
push 0x5c
lea edx, [esp + 0x88]
mov word [esp + 0xe0], cx
mov ecx, dword [0x587974]
push edx
mov byte [esp + 0xe3], 2
mov word [esp + 0xe6], ax
call fcn.004ed210
movzx eax, word [ebx + 6]
test ax, ax
je 0x476650
mov cx, word [ebp + 0x174]
push 0x5c
lea edx, [esp + 0x88]
mov word [esp + 0xe0], cx
mov ecx, dword [0x587974]
push edx
mov byte [esp + 0xe3], 5
mov word [esp + 0xe6], ax
call fcn.004ed210
movzx eax, word [ebx + 8]
test ax, ax
je 0x47668d
mov cx, word [ebp + 0x170]
push 0x5c
lea edx, [esp + 0x88]
mov word [esp + 0xe0], cx
mov ecx, dword [0x587974]
push edx
mov byte [esp + 0xe3], 3
mov word [esp + 0xe6], ax
call fcn.004ed210
movzx eax, word [ebx + 0xa]
test ax, ax
je 0x4766ca
mov cx, word [ebp + 0x172]
push 0x5c
lea edx, [esp + 0x88]
mov word [esp + 0xe0], cx
mov ecx, dword [0x587974]
push edx
mov byte [esp + 0xe3], 4
mov word [esp + 0xe6], ax
call fcn.004ed210
movzx eax, word [ebx + 0xc]
test ax, ax
je 0x477999
mov cx, word [ebp + 0x176]
push 0x5c
lea edx, [esp + 0x88]
mov word [esp + 0xe0], cx
mov ecx, dword [0x587974]
push edx
mov byte [esp + 0xe3], 6
mov word [esp + 0xe6], ax
call fcn.004ed210
jmp 0x477999
cmp byte [ebp + 0x58eb], 0
jne 0x477999
cmp dword [ebp + 0x1444], 1
je 0x477999
movzx eax, byte [ebx + 4]
movzx ecx, word [ebx + 2]
push eax
push ecx
push ebp
call fcn.004933f0
jmp 0x477999
cmp dword [ebp + 0x1444], 1
je 0x477999
mov ecx, dword [ebp + 0xe0]
mov al, byte [ebx + 2]
mov esi, dword [ecx + 0x28]
movzx eax, al
mov ecx, esi
call fcn.00430260
mov edi, eax
mov dword [esp + 0x20], edi
test edi, edi
je 0x477999
lea eax, [edi + 4]
lea ecx, [ebp + 0xd0]
call fcn.0041b8c0
fcomp dword [0x574140]
fnstsw ax
test ah, 5
jp 0x477999
mov ecx, dword [edi + 0x20]
cmp ecx, 0xc8
jne 0x4767ee
cmp dword [ebp + 0x587c], 0
jne 0x477999
cmp dword [ebp + 0x68], 0xffffffff
je 0x477999
mov edi, ebp
call fcn.00456610
lea ecx, [ebp + 0x1634]
call fcn.00487030
mov eax, dword [ebp + 0x582c]
push 6
lea ecx, [esp + 0x28]
mov edx, 0x80c
push ecx
mov ecx, dword [0x587968]
mov word [esp + 0x2c], dx
mov dword [esp + 0x2e], eax
call fcn.004ed2d0
jmp 0x477999
cmp dword [esi + 0x1a4], 0
je 0x476811
mov edx, dword [edi]
cmp edx, 0x3e8
jle 0x476811
mov esi, dword [ebp + 0xe0]
call fcn.0041df50
mov ecx, dword [edi + 0x20]
jmp 0x476814
mov eax, dword [edi + 0x14]
mov edx, dword [0x587960]
cmp ecx, dword [edx + 8]
jge 0x477999
imul ecx, ecx, 0x208
add ecx, dword [edx + 0xc]
mov dword [esp + 0x18], ecx
je 0x477999
test eax, eax
je 0x476863
cmp eax, 1
jne 0x47684d
cmp byte [ebp + 0x12d], 0
je 0x476863
jmp 0x477999
cmp eax, 2
jne 0x477999
cmp byte [ebp + 0x12d], 1
jne 0x477999
mov edx, dword [edi + 0x18]
test edx, edx
jne 0x47686f
cmp dword [edi + 0x1c], edx
je 0x476887
movzx eax, word [ebp + 0x136]
cmp eax, edx
jl 0x477999
cmp eax, dword [edi + 0x1c]
jg 0x477999
mov eax, dword [ecx + 0x1a4]
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x476899
jmp dword [eax*4 + 0x477a40]
mov eax, dword [esp + 0x18]
call fcn.0042fa40
test eax, eax
jne 0x4768d6
mov al, byte [ebx + 2]
push 4
lea ecx, [esp + 0x20]
mov edx, 0x20a
push ecx
mov ecx, ebp
mov word [esp + 0x24], dx
mov byte [esp + 0x26], al
mov byte [esp + 0x27], 9
call fcn.004ed0e0
jmp 0x477999
mov edi, ebp
lea esi, [esp + 0x1c]
call fcn.0044e110
mov dword [esp + 0x124], 2
mov eax, dword [ebp + 0x17f4]
test eax, eax
jne 0x476937
mov byte [esp + 0x1b], 4
mov al, byte [ebx + 2]
push 4
lea ecx, [esp + 0x1c]
mov edx, 0x20a
push ecx
mov ecx, ebp
mov word [esp + 0x20], dx
mov byte [esp + 0x22], al
call fcn.004ed0e0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x477999
add eax, 0x118
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x477999
mov edx, dword [ebp + 0xe0]
mov eax, dword [eax + 8]
mov ecx, dword [esp + 0x20]
push edx
push eax
mov eax, dword [ecx + 0x20]
call fcn.0041a840
test eax, eax
jne 0x476959
mov byte [esp + 0x1b], 0xb
jmp 0x4768fb
cmp eax, 2
je 0x476952
mov edx, dword [ebp + 0x17f4]
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x18]
cmp eax, dword [ecx + 0x1d8]
jge 0x47697a
mov byte [esp + 0x1b], 0xa
jmp 0x4768fb
mov dword [esp + 0x124], 0xffffffff
mov eax, dword [esp + 0x1c]
test eax, eax
je case.default.0x476899
add eax, 0x118
jmp 0x476b19
cmp dword [ebp + 0x1810], 0
jne case.default.0x476899
mov al, byte [ebx + 2]
push 4
lea ecx, [esp + 0x20]
mov edx, 0x20a
push ecx
mov ecx, ebp
mov word [esp + 0x24], dx
mov byte [esp + 0x26], al
mov byte [esp + 0x27], 0
call fcn.004ed0e0
jmp 0x477999
mov edi, ebp
lea esi, [esp + 0x1c]
call fcn.00431eb0
mov dword [esp + 0x124], 3
mov eax, dword [ebp + 0x1810]
test eax, eax
jne 0x476a32
mov byte [esp + 0x1b], 0
mov al, byte [ebx + 2]
mov edx, 0x20a
push 4
lea ecx, [esp + 0x1c]
mov word [esp + 0x1c], dx
mov byte [esp + 0x1e], al
push ecx
mov ecx, ebp
call fcn.004ed0e0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x477999
add eax, 0x5cc
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x477999
cmp byte [eax + 0x48], 0x1e
jbe 0x476a3f
mov byte [esp + 0x1b], 3
jmp 0x4769f6
cmp byte [eax + 0x55], 0
jne 0x476a4c
mov byte [esp + 0x1b], 6
jmp 0x4769f6
mov al, byte [eax + 0x54]
test al, al
jne 0x476a5a
mov byte [esp + 0x1b], 7
jmp 0x4769f6
cmp al, 2
jne 0x476b01
mov byte [esp + 0x1b], 8
jmp 0x4769f6
mov edi, ebp
lea esi, [esp + 0x1c]
call fcn.00431eb0
mov dword [esp + 0x124], 4
cmp dword [ebp + 0x1810], 0
je 0x4769f1
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x2c]
push edx
push eax
call fcn.0042f770
test eax, eax
jne 0x476ac1
mov dl, byte [ebx + 2]
mov ecx, 0x20a
push 4
lea eax, [esp + 0x1c]
mov word [esp + 0x1c], cx
mov byte [esp + 0x1e], dl
mov byte [esp + 0x1f], 1
push eax
jmp 0x476a0e
mov ecx, dword [ebp + 0xe0]
mov edx, dword [ecx + 0x28]
cmp dword [edx + 0x1a4], 5
je 0x476b01
mov eax, dword [esp + 0x2c]
cmp eax, dword [ebp + 0x5584]
jne 0x476b01
mov dl, byte [ebx + 2]
mov ecx, 0x20a
push 4
lea eax, [esp + 0x1c]
mov word [esp + 0x1c], cx
mov byte [esp + 0x1e], dl
mov byte [esp + 0x1f], 2
push eax
jmp 0x476a0e
mov dword [esp + 0x124], 0xffffffff
mov eax, dword [esp + 0x1c]
test eax, eax
je case.default.0x476899
add eax, 0x5cc
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp + 0xe0]
mov edx, dword [ecx + 0x28]
cmp dword [edx + 0x1e0], 0
je 0x476b4b
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x1e0], 0
jne 0x476b4b
mov ecx, dword [ebp + 0x128]
push ecx
call fcn.0043fcc0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp + 0x587c], 0
mov ecx, dword [esp + 0x20]
fld dword [ecx + 0x24]
mov edx, dword [ecx + 0x20]
fstp dword [esp + 0x20]
fld dword [ecx + 0x28]
fstp dword [esp + 0x1c]
fld dword [ecx + 0x2c]
fstp dword [esp + 0x18]
jne 0x477999
fld dword [esp + 0x20]
mov dword [ebp + 0x58b4], 1
fstp dword [ebp + 0x58c0]
mov dword [ebp + 0x58b8], eax
fld dword [esp + 0x1c]
mov dword [ebp + 0x58bc], edx
fstp dword [ebp + 0x58c4]
fld dword [esp + 0x18]
fstp dword [ebp + 0x58c8]
jmp 0x477999
cmp byte [ebx + 6], 3
jae 0x476f33
mov edx, dword [ebx + 2]
mov ecx, dword [ebp + 0xe0]
push edx
call fcn.0041d4a0
mov ecx, eax
test ecx, ecx
je 0x476f33
cmp dword [ecx + 0x34], 2
jne 0x476f33
mov esi, dword [ecx + 0x50]
mov dword [esp + 0x18], esi
test esi, esi
je 0x476f33
lea eax, [ebp + 0xd0]
add ecx, 8
call fcn.0041b8c0
fcomp qword [0x5740d8]
fnstsw ax
test ah, 5
jp 0x476f33
mov eax, dword [esi + 0x10]
cmp eax, 2
je 0x476c25
movzx ecx, byte [ebp + 0x12d]
cmp eax, ecx
jne 0x476f33
movzx edx, byte [ebx + 6]
imul edx, edx, 0x114
lea eax, [edx + esi]
mov ecx, 0xc8
cmp word [eax + 0x124], cx
je 0x47679a
mov edx, dword [eax + 0x234]
mov eax, dword [ebp + 0xe0]
mov ecx, dword [eax + 0x28]
cmp dword [ecx + 0x1a4], 6
mov dword [esp + 0x1c], edx
jne 0x476d03
mov edi, ebp
lea esi, [esp + 0x20]
call fcn.00431eb0
mov dword [esp + 0x124], 5
mov eax, dword [ebp + 0x1810]
test eax, eax
je 0x476f0c
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x50]
push ecx
movzx ecx, word [edx + 2]
push ecx
call fcn.004369c0
test eax, eax
je 0x476ee2
mov edx, dword [esp + 0x1c]
fild dword [esp + 0x1c]
test edx, edx
jge 0x476cba
fadd qword [0x574070]
fmul qword [esp + 0x4c]
fnstcw word [esp + 0x2c]
movzx eax, word [esp + 0x2c]
or eax, 0xc00
mov dword [esp + 0x1c], eax
fldcw word [esp + 0x1c]
fistp qword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x1c], eax
fldcw word [esp + 0x2c]
mov dword [esp + 0x124], 0xffffffff
mov eax, dword [esp + 0x20]
test eax, eax
je 0x476d03
add eax, 0x5cc
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, byte [ebx + 6]
mov ecx, dword [esp + 0x18]
imul eax, eax, 0x114
add ecx, eax
cmp byte [ecx + 0x134], 0
je 0x476f33
mov edx, dword [esp + 0x1c]
cmp dword [ebp + 0x140], edx
jb 0x476f33
movzx eax, word [ecx + 0x124]
mov edx, dword [0x587960]
cmp eax, dword [edx + 8]
jge 0x476f33
imul eax, eax, 0x208
add eax, dword [edx + 0xc]
je 0x476f33
fld dword [ecx + 0x130]
sub esp, 8
fstp dword [esp + 4]
fld dword [ecx + 0x128]
fstp dword [esp]
push eax
call fcn.0041bad0
test al, al
je 0x476f33
call dword [sym.imp.KERNEL32.dll_GetTickCount]
movzx ecx, byte [ebx + 6]
mov edx, dword [esp + 0x18]
imul ecx, ecx, 0x114
fld dword [ecx + edx + 0x128]
fstp dword [esp + 0x20]
fld dword [ecx + edx + 0x12c]
fstp dword [esp + 0x2c]
fld dword [ecx + edx + 0x130]
fstp dword [esp + 0x24]
add ecx, edx
cmp dword [ebp + 0x587c], 0
movzx edx, word [ecx + 0x124]
jne 0x476df4
fld dword [esp + 0x20]
mov dword [ebp + 0x58b4], 1
fstp dword [ebp + 0x58c0]
mov dword [ebp + 0x58b8], eax
fld dword [esp + 0x2c]
mov dword [ebp + 0x58bc], edx
fstp dword [ebp + 0x58c4]
fld dword [esp + 0x24]
fstp dword [ebp + 0x58c8]
mov eax, dword [esp + 0x1c]
sub dword [ebp + 0x140], eax
mov eax, ebp
call fcn.0047aae0
lea esi, [esp + 0x84]
mov edi, ebp
call fcn.00467f60
movzx edx, byte [ebx + 6]
mov eax, dword [esp + 0x18]
imul edx, edx, 0x114
mov ecx, 0x804
mov word [esp + 0x84], cx
mov ecx, dword [edx + eax + 0x234]
mov edx, dword [ebp + 0x140]
mov dword [esp + 0xdb], ecx
movzx ecx, word [eax + 2]
mov dword [esp + 0xe3], ecx
mov cx, word [0x571b34]
mov dword [esp + 0xdf], edx
mov edx, dword [str._NPC_]
add eax, 0x14
mov word [esp + 0xeb], cx
mov dword [esp + 0xe7], edx
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x476e75
lea edi, [esp + 0xe7]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x476e88
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x8b
lea edx, [esp + 0x88]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x587974]
push edx
call fcn.004ed210
mov ecx, dword [ebp + 0x140]
push 7
lea edx, [esp + 0x50]
mov eax, 0x20c
mov dword [esp + 0x53], ecx
push edx
mov ecx, ebp
mov word [esp + 0x54], ax
mov byte [esp + 0x56], 1
call fcn.004ed0e0
jmp 0x477999
mov dl, byte [esp + 0x2c]
mov ecx, 0xd28
push 4
lea eax, [esp + 0x20]
mov word [esp + 0x20], cx
push eax
mov ecx, ebp
mov byte [esp + 0x26], 2
mov byte [esp + 0x27], dl
call fcn.004ed0e0
jmp 0x476345
mov ecx, 0xd28
push 4
lea edx, [esp + 0x20]
mov word [esp + 0x20], cx
push edx
mov ecx, ebp
mov byte [esp + 0x26], 1
mov byte [esp + 0x27], 0x1e
call fcn.004ed0e0
jmp 0x476345
mov ecx, dword [ebp + 0x140]
push 7
lea edx, [esp + 0x48]
mov eax, 0x20c
mov dword [esp + 0x4b], ecx
push edx
mov ecx, ebp
mov word [esp + 0x4c], ax
mov byte [esp + 0x4e], 0
call fcn.004ed0e0
jmp 0x477999
cmp byte [ebp + 0x1360], 0xd
jne 0x476f7b
push 3
push ebx
mov ecx, ebp
mov byte [ebx + 2], 0
call fcn.004ed0e0
jmp 0x477999
xor eax, eax
cmp dword [ebp + 0x1450], eax
push 3
sete al
mov cl, al
push ebx
mov dword [ebp + 0x1450], eax
mov byte [ebx + 2], cl
mov ecx, ebp
call fcn.004ed0e0
jmp 0x477999
mov eax, ebp
call fcn.0049ace0
jmp 0x477999
cmp byte [ebp + 0x58ea], 0
jne 0x477999
movzx edx, byte [ebp + 0x58e8]
cmp edx, dword [0x582784]
jge 0x476fdd
push 1
mov edi, ebp
mov byte [ebp + 0x58ea], 1
call fcn.0048f710
jmp 0x477999
push 3
lea ecx, [esp + 0x34]
mov eax, 0x214
push ecx
mov ecx, ebp
mov word [esp + 0x38], ax
mov byte [esp + 0x3a], 0
call fcn.004ed0e0
jmp 0x477999
cmp byte [ebp + 0x58eb], 0
jne 0x477999
movzx edx, byte [ebp + 0x58e9]
cmp edx, dword [0x582788]
jge 0x477030
push 1
mov eax, ebp
mov byte [ebp + 0x58eb], 1
call fcn.0048fbc0
jmp 0x477999
push 3
lea ecx, [esp + 0x28]
mov eax, 0x215
push ecx
mov ecx, ebp
mov word [esp + 0x2c], ax
mov byte [esp + 0x2e], 0
call fcn.004ed0e0
jmp 0x477999
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp + 0x147c], 3
mov esi, eax
je 0x477999
mov edi, 1
cmp dword [ebp + 0x1444], edi
je 0x477999
xor ebx, ebx
mov edx, 0x216
mov word [esp + 0x1c], dx
cmp dword [ebp + 0x1f4], ebx
je 0x4771ca
cmp byte [ebp + 0x144c], bl
jne 0x4771ca
cmp byte [ebp + 0x1360], bl
jne 0x4771ca
mov eax, ebp
call fcn.0049ace0
mov eax, dword [ebp + 0x147c]
cmp eax, ebx
jne 0x477189
cmp dword [ebp + 0x1480], esi
jb 0x4770e0
push 4
lea eax, [esp + 0x20]
push eax
mov ecx, ebp
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], bl
call fcn.004ed0e0
jmp 0x477999
mov eax, dword [ebp + 0x1490]
cmp eax, ebx
je 0x477132
mov ecx, dword [ebp + 0xe0]
push eax
call fcn.0041c6e0
cmp eax, ebx
je 0x47712c
cmp dword [eax + 0x147c], 2
jne 0x47712c
mov ecx, 0x21e
push 3
lea edx, [esp + 0x1c]
mov word [esp + 0x1c], cx
push edx
mov ecx, eax
mov dword [eax + 0x1490], ebx
mov dword [eax + 0x1494], ebx
mov byte [esp + 0x22], 2
call fcn.004ed0e0
mov dword [ebp + 0x1490], ebx
mov eax, dword [ebp + 0x1f4]
mov dword [ebp + 0x147c], edi
mov ecx, dword [eax + 0x30]
cmp byte [ecx + 0x30], 3
jne 0x47714f
add esi, 0xbb8
jmp 0x477155
add esi, 0x1388
mov eax, dword [ebp + 0xdc]
mov edx, 0x217
lea ecx, [esp + 0x24]
mov word [esp + 0x24], dx
push ecx
lea ecx, [ebp + 0xd0]
mov edx, 6
mov dword [ebp + 0x1480], esi
mov dword [esp + 0x2a], eax
call fcn.004d5250
jmp 0x477999
cmp eax, edi
jne 0x477195
mov dword [ebp + 0x1480], ebx
jmp 0x4771a1
cmp eax, 2
jne 0x4771a1
mov edi, ebp
call fcn.004564c0
push 4
lea edx, [esp + 0x20]
push edx
mov ecx, ebp
mov dword [ebp + 0x147c], ebx
mov byte [esp + 0x26], 1
mov byte [esp + 0x27], bl
call fcn.004ed0e0
mov ecx, ebp
call fcn.004913e0
jmp 0x477999
push 4
lea eax, [esp + 0x20]
push eax
mov ecx, ebp
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], 1
call fcn.004ed0e0
jmp 0x477999
cmp dword [ebp + 0x147c], 3
jne 0x477999
mov ecx, dword [ebp + 0x148c]
push ecx
mov ecx, dword [ebp + 0xe0]
call fcn.0041c6e0
xor ecx, ecx
cmp eax, ecx
je 0x477211
mov dword [eax + 0x148c], ecx
mov dword [ebp + 0x147c], ecx
mov dword [ebp + 0x148c], ecx
mov ecx, ebp
call fcn.004914b0
jmp 0x477999
cmp dword [ebp + 0x147c], 2
jne 0x4772de
cmp dword [ebp + 0x1484], 0xf
jne 0x4772de
cmp dword [ebp + 0x148c], 0
jne 0x4772de
mov edx, dword [ebx + 2]
mov ecx, dword [ebp + 0xe0]
push edx
call fcn.0041c6e0
mov esi, eax
test esi, esi
je 0x4772de
cmp dword [esi + 0x1490], 0
jne 0x4772de
cmp dword [esi + 0x147c], 0
jne 0x4772de
mov al, byte [esi + 0x12d]
cmp al, byte [ebp + 0x12d]
jne 0x4772de
cmp dword [esi + 0x1358], 0
jne 0x4772de
mov ecx, dword [esi + 0xdc]
mov edx, dword [ebp + 0xdc]
mov dword [ebp + 0x1490], ecx
mov dword [esi + 0x1490], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0xdc]
add eax, 0x7530
mov dword [ebp + 0x1494], eax
push 6
lea edx, [esp + 0x28]
mov eax, 0x21d
mov dword [esp + 0x2a], ecx
push edx
mov ecx, esi
mov word [esp + 0x2c], ax
call fcn.004ed0e0
jmp 0x477999
push 3
lea ecx, [esp + 0x1c]
mov eax, 0x21e
push ecx
mov ecx, ebp
mov word [esp + 0x20], ax
mov byte [esp + 0x22], 2
call fcn.004ed0e0
jmp 0x477999
xor edi, edi
cmp dword [ebp + 0x147c], edi
jne 0x477999
mov eax, dword [ebp + 0x1490]
cmp eax, edi
je 0x477999
mov ecx, dword [ebp + 0xe0]
push eax
call fcn.0041c6e0
mov esi, eax
cmp esi, edi
je 0x477381
mov edx, dword [esi + 0x1490]
cmp edx, dword [ebp + 0xdc]
jne 0x477381
push 3
push ebx
mov ecx, esi
call fcn.004ed0e0
cmp byte [ebx + 2], 0
jne 0x477375
mov ecx, dword [esi + 0xdc]
mov eax, dword [ebp + 0xdc]
mov dword [esi + 0x148c], eax
mov dword [ebp + 0x148c], ecx
mov ecx, ebp
mov dword [ebp + 0x147c], 3
call fcn.004914b0
mov dword [esi + 0x1490], edi
mov dword [esi + 0x1494], edi
mov dword [ebp + 0x1490], edi
jmp 0x477999
mov eax, dword [ebp + 0x1498]
xor edi, edi
cmp eax, edi
je 0x477999
push eax
call fcn.00414d80
mov esi, eax
cmp esi, edi
je 0x4774d8
mov eax, dword [esi + 0xe0]
cmp eax, edi
je 0x4773f0
mov edx, dword [eax + 0x28]
mov eax, dword [edx + 0x1a4]
cmp eax, 5
je 0x4774d8
cmp eax, 3
je 0x4774d8
cmp eax, 6
jne 0x4773f0
mov eax, dword [esi + 0x1810]
cmp eax, edi
je 0x4774d8
cmp eax, dword [ebp + 0x1810]
jne 0x4774d8
mov edi, 1
cmp dword [ebp + 0x1444], edi
jne 0x477401
mov byte [ebx + 2], 1
mov ecx, dword [ebp + 0xdc]
mov dl, byte [ebx + 2]
mov eax, 0x224
mov word [esp + 0x44], ax
push 7
lea eax, [esp + 0x48]
mov dword [esp + 0x4a], ecx
push eax
mov ecx, esi
mov byte [esp + 0x52], dl
call fcn.004ed0e0
cmp byte [ebx + 2], 0
jne 0x4774d6
movzx edx, word [esi + 0x160]
movzx ecx, word [ebp + 0x136]
movzx ebx, dx
mov eax, ebx
call fcn.00472880
test al, al
je 0x4774d6
cmp word [ebp + 0x160], dx
je 0x477472
movzx ecx, byte [ebp + 0x12d]
push ecx
push ebx
call fcn.00430340
add esp, 8
test al, al
je 0x4774d6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
fld dword [esi + 0xd0]
cmp dword [ebp + 0x587c], 0
fstp dword [esp + 0x24]
fld dword [esi + 0xd4]
movzx ecx, word [esi + 0x160]
fstp dword [esp + 0x20]
fld dword [esi + 0xd8]
fstp dword [esp + 0x1c]
jne 0x4774d6
fld dword [esp + 0x24]
mov dword [ebp + 0x58b4], edi
fstp dword [ebp + 0x58c0]
mov dword [ebp + 0x58b8], eax
fld dword [esp + 0x20]
mov dword [ebp + 0x58bc], ecx
fstp dword [ebp + 0x58c4]
fld dword [esp + 0x1c]
fstp dword [ebp + 0x58c8]
xor edi, edi
mov dword [ebp + 0x1498], edi
mov dword [ebp + 0x149c], edi
jmp 0x477999
mov al, byte [ebx + 2]
mov ecx, dword [ebp + 0xe0]
mov edx, 0x220
mov word [esp + 0x30], dx
mov byte [esp + 0x33], al
mov ecx, dword [ecx + 0x28]
cmp dword [ecx + 0x80], 1
jne 0x477524
push 0x12
lea edx, [esp + 0x34]
push edx
mov ecx, ebp
mov byte [esp + 0x3a], 1
call fcn.004ed0e0
jmp 0x477999
cmp byte [ecx + 0x1e6], 0xff
je 0x477545
push 0x12
lea eax, [esp + 0x34]
push eax
mov ecx, ebp
mov byte [esp + 0x3a], 2
call fcn.004ed0e0
jmp 0x477999
test al, al
je 0x477751
cmp al, 4
ja 0x477751
fld dword [ebx + 5]
sub esp, 8
fstp qword [esp]
call fcn.0051ca16
add esp, 8
test eax, eax
je 0x477739
fld dword [ebx + 5]
sub esp, 8
fstp qword [esp]
call fcn.0051ca32
add esp, 8
test eax, eax
jne 0x477739
fld dword [ebx + 9]
sub esp, 8
fstp qword [esp]
call fcn.0051ca16
add esp, 8
test eax, eax
je 0x47752d
fld dword [ebx + 9]
sub esp, 8
fstp qword [esp]
call fcn.0051ca32
add esp, 8
test eax, eax
jne 0x47752d
fld dword [ebx + 0xd]
sub esp, 8
fstp qword [esp]
call fcn.0051ca16
add esp, 8
test eax, eax
je 0x477751
fld dword [ebx + 0xd]
sub esp, 8
fstp qword [esp]
call fcn.0051ca32
add esp, 8
test eax, eax
jne 0x477751
movzx esi, word [ebp + 0x160]
cmp word [ebx + 3], si
jne 0x477721
fld dword [ebx + 5]
lea ecx, [ebp + 0xd0]
fstp dword [esp + 0x54]
lea eax, [esp + 0x54]
fld dword [ebx + 9]
fstp dword [esp + 0x58]
fld dword [ebx + 0xd]
fstp dword [esp + 0x5c]
call fcn.0041b8c0
fcomp qword [0x5740e8]
fnstsw ax
test ah, 0x41
je 0x477721
mov ecx, dword [ebp + 0xe0]
mov edx, dword [ecx + 0x28]
cmp dword [edx + 0x1a4], 0
push 0x12
je 0x477657
lea eax, [esp + 0x34]
push eax
mov ecx, ebp
mov byte [esp + 0x3a], 2
call fcn.004ed0e0
jmp 0x477999
movzx edx, byte [ebx + 2]
movzx ecx, si
mov dword [ebp + edx*4 + 0x5908], ecx
movzx eax, byte [ebx + 2]
fld dword [ebx + 5]
add eax, 0x76c
lea eax, [eax + eax*2]
fstp dword [ebp + eax*4]
movzx eax, byte [ebx + 2]
fld dword [ebx + 9]
lea ecx, [eax + eax*2]
fstp dword [ebp + ecx*4 + 0x5914]
movzx eax, byte [ebx + 2]
fld dword [ebx + 0xd]
lea edx, [eax + eax*2]
lea ecx, [esp + 0x34]
push ecx
fstp dword [ebp + edx*4 + 0x5918]
mov ax, word [ebp + 0x160]
fld dword [ebx + 5]
mov ecx, ebp
fstp dword [esp + 0x3e]
mov byte [esp + 0x3a], 0
fld dword [ebx + 9]
mov word [esp + 0x3c], ax
fstp dword [esp + 0x42]
fld dword [ebx + 0xd]
fstp dword [esp + 0x46]
call fcn.004ed0e0
fld dword [ebx + 5]
mov eax, dword [ebp + 0x582c]
mov cl, byte [ebx + 2]
fstp dword [esp + 0x75]
fld dword [ebx + 9]
mov edx, 0xd02
dec cl
fstp dword [esp + 0x79]
fld dword [ebx + 0xd]
mov dword [esp + 0x6e], eax
mov word [esp + 0x6c], dx
fstp dword [esp + 0x7d]
mov dx, word [ebp + 0x160]
push 0x15
lea eax, [esp + 0x70]
mov byte [esp + 0x76], cl
mov ecx, dword [0x58796c]
push eax
mov word [esp + 0x7b], dx
call fcn.004ed2d0
jmp 0x477999
push 0x12
lea ecx, [esp + 0x34]
push ecx
mov ecx, ebp
mov byte [esp + 0x3a], 1
call fcn.004ed0e0
jmp 0x477999
push 0x12
lea ecx, [esp + 0x34]
push ecx
mov ecx, ebp
mov byte [esp + 0x3a], 2
call fcn.004ed0e0
jmp 0x477999
push 0x12
lea edx, [esp + 0x34]
push edx
mov ecx, ebp
mov byte [esp + 0x3a], 2
call fcn.004ed0e0
jmp 0x477999
cmp byte [ebp + 0x12f], 0
je 0x477999
cmp word [ebp + 0x136], 0x10
jb 0x477999
mov edi, ebp
call fcn.0049d240
jmp 0x477999
cmp byte [ebp + 0x12f], 0
je 0x477999
cmp word [ebp + 0x136], 0x10
jb 0x477999
push ebp
call fcn.0049cfc0
jmp 0x477999
cmp byte [ebp + 0x12f], 0
je 0x477999
cmp word [ebp + 0x136], 0x10
jb 0x477999
push ebp
call fcn.0049d0f0
jmp 0x477999
cmp dword [ebp + 0x1444], 1
je 0x477999
mov al, byte [ebx + 2]
test al, al
je 0x477999
movzx eax, al
cmp eax, dword [ebp + 0x130c]
jg 0x477999
mov cl, byte [ebx + 3]
cmp cl, 0x18
jae 0x477999
movzx ecx, cl
lea eax, [eax + eax*2]
lea edx, [ecx + eax*8]
mov eax, dword [ebp + edx*4 + 0x1c0]
test eax, eax
je 0x477999
mov eax, dword [eax + 0x30]
cmp dword [eax + 0xa0], 0x1a
je 0x47783f
mov ecx, ebp
call fcn.00472b80
jmp 0x477999
mov al, byte [eax + 0x46]
cmp al, 0x2c
jne 0x477863
mov al, byte [ebx + 4]
mov byte [ebp + 0x131], al
mov cl, byte [ebx + 5]
mov byte [ebp + 0x132], cl
mov dl, byte [ebx + 6]
mov byte [ebp + 0x133], dl
jmp 0x4778bd
cmp al, 0x2d
jne 0x477833
xor ecx, ecx
lea edx, [ebp + 0x1c0]
nop
mov eax, dword [edx]
test eax, eax
je 0x47788e
mov eax, dword [eax + 0x30]
add eax, 0x46
mov al, byte [eax]
cmp al, 0x41
je 0x477974
cmp al, 0x40
je 0x477974
inc ecx
add edx, 4
cmp ecx, 0xd
jl 0x477870
movzx edx, byte [ebx + 4]
mov byte [ebp + 0x131], dl
mov al, byte [ebx + 5]
mov byte [ebp + 0x132], al
mov cl, byte [ebx + 6]
mov byte [ebp + 0x133], cl
movzx edx, byte [ebx + 7]
mov byte [ebp + 0x135], dl
mov ecx, dword [ebp + 0x582c]
movzx edx, byte [ebp + 0x131]
mov eax, 0x615
mov word [esp + 0x60], ax
movzx eax, byte [ebp + 0x132]
mov dword [esp + 0x62], ecx
movzx ecx, byte [ebp + 0x133]
mov byte [esp + 0x66], dl
movzx edx, byte [ebp + 0x135]
mov byte [esp + 0x67], al
push 0xa
lea eax, [esp + 0x64]
mov byte [esp + 0x6c], cl
mov ecx, dword [0x58796c]
push eax
mov byte [esp + 0x71], dl
call fcn.004ed2d0
movzx ecx, byte [ebx + 3]
movzx edx, byte [ebx + 2]
push 0
push ecx
push edx
mov ecx, ebp
call fcn.004728e0
movzx edx, byte [ebp + 0x131]
mov ecx, dword [ebp + 0xdc]
mov eax, 0x226
mov word [esp + 0x54], ax
movzx eax, byte [ebp + 0x132]
mov byte [esp + 0x5a], dl
movzx edx, byte [ebp + 0x135]
mov byte [esp + 0x5b], al
mov dword [esp + 0x56], ecx
movzx ecx, byte [ebp + 0x133]
push 0xa
lea eax, [esp + 0x58]
mov byte [esp + 0x61], dl
push eax
xor edx, edx
mov eax, ebp
mov byte [esp + 0x64], cl
call fcn.004d56d0
jmp 0x477999
push 2
lea ecx, [esp + 0x30]
mov eax, 0x228
push ecx
mov ecx, ebp
mov word [esp + 0x34], ax
call fcn.004ed0e0
jmp 0x477999
push 0
push 9
mov ecx, ebp
call fcn.004ec760
mov ecx, dword [esp + 0x11c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0051a8be
add esp, 0x114
ret 4