Function at 0x428d00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4fbaac
mov eax, dword fs:[0]
push eax
mov eax, 0x1d618
call fcn.004e6a80
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x1d614], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x519bc0]
xor eax, esp
push eax
lea eax, [esp + 0x1d62c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1d63c]
xor eax, eax
mov ebp, ecx
mov ecx, dword [ebp + 0x38]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x5c], eax
cmp word [ecx + 0x1010], ax
je 0x428dad
push 0x502a38
push edi
call fcn.00453770
test al, al
jne 0x428dad
push 0x502a30
push edi
call fcn.00453770
test al, al
jne 0x428dad
push 0x502a28
push edi
call fcn.00453770
mov esi, dword [esp + 0x1d640]
test al, al
jne 0x428da6
push esi
push 0x502a1c
push edi
call fcn.00469570
push esi
push edi
call fcn.00453fb0
mov edx, dword [ebp + 0x38]
cmp byte [edx + 0x61a0], 0
je 0x428dbf
push edi
call fcn.00445b00
xor eax, eax
mov word [esp + 0x1c5a8], ax
mov eax, dword [ebp + 0x38]
xor ecx, ecx
mov word [esp + 0x1c628], cx
mov edx, dword [eax + 0x6168]
or edx, dword [eax + 0x616c]
je 0x428ded
mov byte [ebp + 0x225c], 1
jmp 0x428df4
and dword [eax + 0x614c], 0xffffffe7
mov eax, dword [ebp + 0x38]
mov byte [esp + 0x16], cl
push eax
lea ecx, [esp + 0x38]
call fcn.0042aae0
xor esi, esi
mov dword [esp + 0x1d634], esi
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x16]
push ecx
push edx
lea eax, [esp + 0x3c]
push eax
mov ecx, ebp
call fcn.00426bc0
mov ecx, dword [ebp + 0x38]
push ecx
lea ecx, [esp + 0xf374]
call fcn.0042db80
mov byte [esp + 0x1d634], 1
mov edx, dword [ebp + 0x38]
push edx
lea ecx, [esp + 0x213c]
call fcn.0042db80
mov byte [esp + 0x1d634], 2
xor ebx, ebx
xor edi, edi
cmp dword [esp + 0x44], ebx
jbe 0x428efd
push esi
lea ecx, [esp + 0x38]
call fcn.0042a850
cmp dword [eax + 0x2c], 2
je 0x428e82
push esi
lea ecx, [esp + 0x38]
call fcn.0042a850
cmp dword [eax + 0x2c], 3
jne 0x428ef2
push esi
lea ecx, [esp + 0x38]
call fcn.0042a850
mov ecx, dword [eax + 0xc]
cmp ecx, edi
jb 0x428eac
ja 0x428e9c
mov edx, dword [eax + 8]
cmp edx, ebx
jbe 0x428eac
push esi
lea ecx, [esp + 0x38]
call fcn.0042a850
mov ebx, dword [eax + 8]
mov edi, dword [eax + 0xc]
push esi
lea ecx, [esp + 0x38]
call fcn.0042a850
mov ecx, dword [eax + 8]
add dword [esp + 0xe358], ecx
mov edx, dword [eax + 0xc]
push esi
adc dword [esp + 0xe360], edx
lea ecx, [esp + 0x38]
call fcn.0042a850
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x213c]
call fcn.0042afd0
add dword [esp + 0xe360], eax
adc dword [esp + 0xe364], 0
inc esi
cmp esi, dword [esp + 0x44]
jb 0x428e62
lea ecx, [esp + 0x15]
push ecx
lea edx, [esp + 0x38]
push edx
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x2140]
push eax
lea ecx, [esp + 0xf37c]
push ecx
push edx
mov ecx, ebp
mov byte [esp + 0x29], 0
call fcn.00427950
test al, al
je 0x42a380
mov eax, dword [esp + 0xe320]
mov ecx, dword [ebp + 0x38]
push eax
call fcn.0043a3d0
xor esi, esi
cmp dword [esp + 0x44], esi
jbe 0x428f94
jmp 0x428f50
mov ecx, dword [ebp + 0x38]
cmp byte [ecx + 0x6157], 0
je 0x428f6c
push esi
lea ecx, [esp + 0x38]
call fcn.0042a850
cmp dword [eax + 0x2c], 2
je 0x428f7c
push esi
lea ecx, [esp + 0x38]
call fcn.0042a850
cmp dword [eax + 0x2c], 1
jne 0x428f8d
push esi
lea ecx, [esp + 0x38]
call fcn.0042a850
mov dword [eax + 0x2c], 0
inc esi
cmp esi, dword [esp + 0x44]
jb 0x428f50
cmp dword [esp + 0xf374], 0xffffffff
mov ecx, dword [ebp + 0x38]
setne al
cmp word [ecx + 0x73b8], 0
mov byte [esp + 0x19], al
jne 0x429038
test al, al
je 0x428fc2
cmp byte [esp + 0x1b55c], 0
jne 0x429038
cmp byte [esp + 0x16], 0
jne 0x429038
mov eax, dword [ecx + 0x614c]
test eax, eax
je 0x428fe3
mov edx, dword [esp + 0xe358]
mov esi, dword [esp + 0xe35c]
jmp 0x428fe7
mov edx, ebx
mov esi, edi
neg eax
sbb eax, eax
and eax, 0xe0000
add eax, 0x20000
cmp dword [ecx + 0xc], eax
jbe 0x429038
push 0
push 2
push esi
push edx
call fcn.004e79f0
mov ecx, dword [ebp + 0x38]
mov edi, dword [ecx + 0xc]
xor esi, esi
cmp esi, edx
jb 0x429038
ja 0x429017
cmp edi, eax
jbe 0x429038
shr dword [ecx + 0xc], 1
mov ecx, dword [ebp + 0x38]
mov esi, dword [ecx + 0x614c]
neg esi
sbb esi, esi
and esi, 0xe0000
add esi, 0x20000
cmp dword [ecx + 0xc], esi
ja 0x429005
cmp dword [esp + 0xe320], 2
mov ecx, 0x400000
jne 0x429052
mov eax, dword [ebp + 0x38]
cmp dword [eax + 0xc], ecx
jbe 0x429052
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0x38]
xor ebx, ebx
cmp dword [eax + 0x6138], ebx
jne 0x42906c
mov ecx, 0x20000
cmp dword [eax + 0xc], ecx
jbe 0x42906c
mov dword [eax + 0xc], ecx
mov esi, 3
cmp dword [esp + 0xe320], esi
jne 0x42908d
mov eax, dword [ebp + 0x38]
cmp byte [eax + 0x61a4], 0
je 0x42908d
mov byte [eax + 0x61a4], 0
cmp byte [esp + 0xe324], 0
je 0x4290a7
mov edx, dword [ebp + 0x38]
cmp byte [edx + 0x6185], 0
jne 0x4290a7
mov al, 1
jmp 0x4290a9
xor al, al
push ebx
push eax
lea ecx, [esp + 0x3c]
call fcn.0042af10
mov eax, dword [ebp + 0x38]
cmp dword [eax + 0x61a8], ebx
je 0x4290f6
cmp dword [esp + 0xe320], esi
jne 0x4290f6
lea ecx, [esp + 0x60]
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], 0x79
call fcn.0046b420
lea ecx, [esp + 0x34]
push ecx
mov ecx, ebp
call fcn.00426660
mov ecx, dword [ebp + 0x3c]
cmp ecx, ebx
je 0x429105
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
cmp byte [esp + 0x19], 0
je 0x42913f
cmp dword [esp + 0x1b558], esi
je 0x42914b
push 0x1b498
call fcn.004e7da8
add esp, 4
mov dword [esp + 0x30], eax
mov byte [esp + 0x1d634], 4
cmp eax, ebx
je 0x429175
lea ecx, [ebp + 0x58]
push ecx
mov ecx, eax
call fcn.00451af0
jmp 0x429177
mov ecx, dword [ebp + 0x38]
cmp byte [ecx + 0x619f], 0
je 0x429115
push 0x6228
call fcn.004e7da8
add esp, 4
mov dword [esp + 0x30], eax
mov byte [esp + 0x1d634], 3
cmp eax, ebx
je 0x429175
lea edx, [ebp + 0x58]
push edx
mov ecx, eax
call fcn.0044b2f0
jmp 0x429177
xor eax, eax
mov byte [esp + 0x1d634], 2
mov edx, dword [ebp + 0x38]
mov dword [ebp + 0x3c], eax
mov dword [edx + 0xa3d0], eax
mov esi, dword [ebp + 0x40]
cmp esi, ebx
je 0x4291a2
mov ecx, esi
call fcn.00472c70
push esi
call fcn.004e6cc6
add esp, 4
push 0xe6e8
call fcn.004e7da8
add esp, 4
mov dword [esp + 0x30], eax
mov byte [esp + 0x1d634], 5
cmp eax, ebx
je 0x4291cc
lea ecx, [ebp + 0x58]
push ecx
mov ecx, eax
call fcn.004759e0
jmp 0x4291ce
xor eax, eax
mov byte [esp + 0x1d634], 2
mov ecx, dword [ebp + 0x3c]
mov dword [ebp + 0x40], eax
mov eax, dword [ebp + 0x38]
mov edx, dword [ecx]
mov eax, dword [eax + 0x83b8]
mov edx, dword [edx + 0x20]
push eax
call edx
mov eax, dword [ebp + 0x38]
mov eax, dword [eax + 0x83b8]
mov ecx, dword [ebp + 0x40]
cmp eax, 8
jb 0x429203
mov eax, 8
mov dword [ecx + 0x1c], eax
mov ecx, dword [ebp + 0x38]
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp + 0x3c]
mov edx, dword [ecx]
mov esi, eax
push eax
mov eax, dword [edx + 4]
call eax
test al, al
jne 0x429246
mov edi, 0x100000
mov eax, dword [ebp + 0x38]
cmp dword [eax + 0xc], edi
jbe 0x429305
shr dword [eax + 0xc], 1
mov ecx, dword [ebp + 0x3c]
mov eax, dword [ebp + 0x38]
mov edx, dword [ecx]
mov eax, dword [eax + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
test al, al
je 0x429222
mov ecx, dword [ebp + 0x38]
mov eax, dword [ecx + 0xc]
cmp esi, eax
je 0x42928a
shr eax, 0x14
shr esi, 0x14
lea ecx, [esp + 0x60]
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa8], 0x28
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], eax
mov dword [esp + 0xa4], 2
call fcn.0046b420
mov ecx, dword [ebp + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
lea esi, [ebp + 8]
push esi
call eax
cmp byte [esp + 0x1b55c], 0
lea eax, [ebp + 0x58]
mov dword [esi + 0x24], ebp
mov ecx, dword [ebp + 0x38]
mov dword [esi + 0x2c], eax
lea edx, [esp + 0xf370]
lea eax, [esp + 0x2138]
mov dword [esi + 0x28], ecx
mov dword [esi + 0x20], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], eax
mov byte [esp + 0x16], 0
mov byte [esp + 0x17], 0
je 0x42935c
mov ecx, dword [ebp + 0x38]
cmp byte [ecx + 0x5128], 0
jne 0x4292ef
cmp byte [esp + 0x15], 0
je 0x42933c
mov edx, dword [ebp + 0x48]
add dword [esp + 0xe358], edx
mov eax, dword [ebp + 0x4c]
adc dword [esp + 0xe35c], eax
jmp 0x429341
push 1
push 0x516c38
lea ecx, [esp + 0x58]
call fcn.004e98c9
mov byte [esp + 0x1d634], 6
mov dword [esp + 0x50], vtable.std::bad_alloc.0
mov byte [esp + 0x1d634], 2
push 0x50eca4
lea eax, [esp + 0x54]
push eax
call fcn.004e7fef
mov byte [esp + 0x16], 1
push ebx
lea ecx, [esp + 0xf374]
call fcn.0042ff50
push edx
push eax
lea ecx, [esp + 0xf37c]
call fcn.0042b430
xor edi, edi
mov dword [esp + 0xb4], edi
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
mov byte [esp + 0x1d634], 7
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x44], ebx
jbe 0x42a155
jmp 0x4293a0
mov ecx, dword [esp + 0x24]
push ecx
lea ecx, [esp + 0x38]
call fcn.0042a850
mov esi, eax
mov ecx, 0x14
lea edi, [esp + 0x60]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x8c]
cmp eax, ebx
je 0x42a13b
lea ebx, [ebx]
cmp eax, 6
je 0x429cca
cmp eax, 5
je 0x429dcf
cmp eax, 4
je 0x429ddd
push ebx
lea ecx, [esp + 0x98bc]
call fcn.00447e40
lea ecx, [esp + 0x1114]
mov dword [esp + 0x10dc], ebx
mov dword [esp + 0x10e0], ebx
mov dword [esp + 0x10e4], ebx
mov dword [esp + 0x10e8], ebx
mov dword [esp + 0x10ec], ebx
mov dword [esp + 0x10f0], ebx
call fcn.00443ed0
mov byte [esp + 0x1d634], 8
cmp byte [esp + 0xad], 0
je 0x429479
cmp dword [esp + 0xe320], 3
jne 0x429479
mov edx, dword [ebp + 0x38]
cmp byte [edx + 0x6191], 0
mov bl, 1
je 0x42947b
mov ecx, dword [esp + 0x60]
lea eax, [esp + 0x98b8]
push eax
push ecx
call fcn.00441450
xor edi, edi
cmp dword [esp + 0xa9a8], edi
jne 0x42947d
xor bl, bl
jmp 0x42947d
xor bl, bl
xor edi, edi
mov al, byte [esp + 0xac]
test al, al
jne 0x42949e
test bl, bl
je 0x429497
mov edx, dword [ebp + 0x38]
cmp byte [edx + 0x6191], al
jne 0x42949e
mov byte [esp + 0x1a], 0
jmp 0x4294b7
mov byte [esp + 0x1a], 1
test al, al
je 0x4294b7
mov eax, dword [ebp + 0x38]
cmp dword [eax + 0x615c], 1
je 0x42a125
mov eax, dword [ebp + 0x38]
mov esi, dword [esp + 0x60]
cmp word [eax + 0x73b8], di
jne 0x42950b
movzx ecx, byte [eax + 0x6191]
push ecx
lea edx, [esp + 0xd0]
push edx
push esi
call fcn.004470d0
cmp byte [esp + 0xac], 0
mov bl, al
mov byte [esp + 0x15], bl
je 0x42951c
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x10ec], eax
mov dword [esp + 0x10f0], ecx
jmp 0x42951c
xor bl, bl
mov byte [esp + 0x15], bl
mov dword [esp + 0x1120], 1
mov cl, byte [esp + 0x1a]
test cl, cl
jne 0x4296d1
mov eax, dword [ebp + 0x38]
cmp word [eax + 0x73b8], di
jne 0x4296d1
test bl, bl
je 0x429558
movzx edx, byte [eax + 0x619d]
neg edx
sbb edx, edx
and edx, 4
push edx
push esi
lea ecx, [esp + 0x111c]
call fcn.00443f60
cmp dword [esp + 0x1118], 0xffffffff
jne 0x4295fa
mov eax, dword [esp + 0x2c]
push esi
push eax
mov ecx, 0x531158
call fcn.0043f7f0
mov ecx, dword [esp + 0x68]
sub dword [esp + 0xe358], ecx
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x6c]
sbb dword [esp + 0xe35c], edx
push eax
lea ecx, [esp + 0x38]
call fcn.0042a850
inc dword [esp + 0x20]
cmp dword [esp + 0x9c], edi
mov dword [eax + 0x2c], edi
jl 0x42a125
jg 0x4295bd
cmp dword [esp + 0x98], edi
jbe 0x42a125
cmp dword [esp + 0xa4], edi
jne 0x42a125
mov dword [esp + 0x8c], 4
mov dword [ebp + 0x44], edi
mov byte [esp + 0x1d634], 7
lea ecx, [esp + 0x1114]
call fcn.00444640
mov eax, dword [esp + 0x8c]
xor ebx, ebx
jmp 0x4293d0
test bl, bl
je 0x42964b
test dword [esp + 0x10d4], 0x400
mov ecx, dword [esp + 0x10dc]
mov edx, dword [esp + 0x10e0]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
je 0x42964b
mov eax, dword [esp + 0x10cc]
or eax, dword [esp + 0x10d0]
jne 0x42964b
lea ecx, [esp + 0x1114]
call fcn.004448a0
mov dword [esp + 0x10cc], eax
mov dword [esp + 0x10d0], edx
cmp byte [esp + 0xad], 0
jne 0x4296ed
mov ecx, dword [ebp + 0x38]
cmp byte [ecx + 0x6192], 0
je 0x4296ed
cmp dword [esp + 0xe320], 3
jne 0x4296ed
mov edx, dword [esp + 0x24]
lea eax, [esp + 0xc4]
push eax
lea ecx, [esp + 0xb8]
mov dword [esp + 0xc8], edx
push ecx
lea edx, [esp + 0x111c]
push edx
mov ecx, ebp
call fcn.00426420
test al, al
je 0x4296ed
mov ecx, dword [esp + 0xc4]
push 0x800
lea eax, [esp + 0xa9b0]
push eax
push ecx
lea ecx, [esp + 0x40]
mov dword [esp + 0xa9b4], 4
call fcn.0042a850
mov edx, dword [ebp + 0x38]
push eax
push edx
jmp 0x42974d
cmp byte [esp + 0xad], 0
jne 0x4296e9
mov dword [esp + 0x10cc], edi
mov dword [esp + 0x10d0], edi
test cl, cl
jne 0x429757
mov esi, dword [esp + 0xa8]
cmp esi, 0xffffffff
je 0x429757
cmp dword [esp + 0x1118], 0xffffffff
je 0x42970f
lea ecx, [esp + 0x1114]
call fcn.00444230
push esi
lea ecx, [esp + 0x38]
call fcn.0042a850
mov eax, dword [eax + 0x2c]
cmp eax, 2
je 0x429726
cmp eax, 3
jne 0x429757
push 0x800
lea eax, [esp + 0xa9b0]
push eax
push esi
lea ecx, [esp + 0x40]
mov dword [esp + 0xa9b4], 5
call fcn.0042a850
mov ecx, dword [ebp + 0x38]
push eax
push ecx
call fcn.00424ea0
mov byte [esp + 0x1a], 1
mov edx, dword [esp + 0x60]
push edx
push 1
mov ecx, 0x531168
call fcn.00448110
mov edx, dword [ebp + 0x38]
push 0x800
lea eax, [esp + 0x98dc]
push eax
lea ecx, [esp + 0x68]
push ecx
push edx
call fcn.00424ea0
cmp byte [esp + 0x17], 0
je 0x4297ec
lea ecx, [esp + 0xf370]
call fcn.0042b470
push 0
lea ecx, [esp + 0xf374]
mov esi, eax
mov edi, edx
call fcn.0042ff50
push edx
push eax
lea ecx, [esp + 0xf37c]
call fcn.0042b430
mov eax, dword [ebp + 0x40]
push 0
push eax
push edi
push esi
lea ecx, [esp + 0xf380]
push ecx
mov ecx, ebp
call fcn.004273b0
mov eax, dword [ebp + 0x38]
mov eax, dword [eax + 0x6138]
mov ecx, dword [ebp + 0x3c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
dec eax
push eax
mov eax, dword [ebp + 0x40]
push eax
call edx
mov byte [ebp + 0x54], 1
xor edi, edi
cmp byte [esp + 0xe324], 0
mov byte [esp + 0x17], 0
mov byte [esp + 0x16], 0
je 0x42991f
mov eax, dword [ebp + 0x38]
mov ecx, dword [eax + 0x614c]
mov byte [esp + 0x18], 0
test cl, 2
je 0x429835
mov esi, dword [eax + 0x6150]
cmp esi, edi
jle 0x429835
mov eax, dword [esp + 0x28]
cmp eax, edi
jle 0x429835
cdq
idiv esi
test edx, edx
jne 0x429835
mov byte [esp + 0x18], 1
test cl, 4
je 0x429880
lea eax, [esp + 0x98d8]
push eax
call fcn.00453750
mov esi, eax
cmp esi, edi
je 0x429876
lea ecx, [esp + 0x1c5a8]
push ecx
push esi
call fcn.004694a0
test eax, eax
je 0x429864
mov byte [esp + 0x18], 1
push 0x40
push esi
lea edx, [esp + 0x1c5b0]
push edx
call fcn.004694f0
jmp 0x429880
xor eax, eax
mov word [esp + 0x1c5a8], ax
mov ecx, dword [ebp + 0x38]
mov ebx, dword [ecx + 0x614c]
test bl, 8
jne 0x4298e6
lea ecx, [esp + 0x2156]
lea eax, [esp + 0x1c628]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4298c6
cmp dx, di
je 0x4298c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4298c6
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4298a0
xor eax, eax
jmp 0x4298cb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x4298e6
test bl, 0x10
jne 0x4298ed
cmp dword [esp + 0x54], edi
jg 0x4298ed
jl 0x4298e6
cmp dword [esp + 0x50], 0x400000
ja 0x4298ed
cmp byte [esp + 0x18], 0
je 0x42990b
cmp dword [esp + 0x28], edi
jle 0x42990b
mov ecx, dword [ebp + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov byte [ebp + 0x54], 0
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], edi
jmp 0x42991b
mov ecx, dword [esp + 0x68]
add dword [esp + 0x50], ecx
mov edx, dword [esp + 0x6c]
adc dword [esp + 0x54], edx
mov bl, byte [esp + 0x15]
push 0x800
lea eax, [esp + 0x215a]
push eax
lea ecx, [esp + 0x1c630]
push ecx
call fcn.004694f0
mov ecx, dword [esp + 0x60]
mov esi, 3
cmp dword [esp + 0x8c], esi
push edi
sete dl
push edi
movzx eax, dl
push eax
push ecx
push 1
call fcn.0046b040
mov eax, dword [ebp + 0x38]
cmp word [eax + 0x73b8], di
jne 0x429976
mov edx, dword [esp + 0x10dc]
or edx, dword [esp + 0x10e0]
jne 0x429999
mov ecx, 0x7fffffff
mov dword [esp + 0x10cc], ecx
mov dword [esp + 0x10d0], ecx
mov byte [esp + 0xa9a1], 1
mov byte [esp + 0xa942], 1
mov ecx, dword [esp + 0x10cc]
mov edx, dword [esp + 0x10d0]
mov dword [esp + 0x98bc], 2
mov dword [esp + 0xa908], ecx
mov dword [esp + 0xa90c], edx
mov dword [esp + 0xa900], edi
mov dword [esp + 0xa904], edi
cmp dword [esp + 0xe320], esi
jne 0x4299df
mov esi, dword [eax + 0x613c]
jmp 0x4299e4
mov esi, 2
push esi
lea ecx, [esp + 0xa91c]
call fcn.00447990
mov eax, dword [ebp + 0x38]
cmp byte [eax + 0x5128], 0
je 0x429a96
cmp byte [esp + 0xac], 0
jne 0x429a96
cmp dword [esp + 0xe320], 3
jne 0x429a4e
push 0x10
lea ecx, [esp + 0xa95d]
push ecx
call fcn.0043ccf0
xor edx, edx
cmp byte [esp + 0xe32c], dl
mov dword [esp + 0xa994], 0xf
sete dl
mov byte [esp + 0xa969], 1
mov byte [esp + 0xa972], dl
mov eax, dword [esp + 0xe336]
mov ecx, dword [esp + 0xe33a]
mov edx, dword [esp + 0xe33e]
mov dword [esp + 0xa949], eax
mov eax, dword [esp + 0xe342]
mov byte [esp + 0xa943], 1
mov byte [esp + 0xa948], 1
mov dword [esp + 0xa94d], ecx
mov dword [esp + 0xa951], edx
mov dword [esp + 0xa955], eax
mov ecx, dword [esp + 0xe320]
mov edx, dword [ebp + 0x38]
sub ecx, 3
neg ecx
sbb ecx, ecx
and ecx, 0xffffffeb
add ecx, 0x32
cmp byte [ebp + 0x54], 0
mov byte [esp + 0x98d1], cl
mov eax, dword [edx + 0xc]
mov dword [esp + 0xa99c], eax
mov byte [esp + 0xa999], 0
je 0x429ad4
mov byte [esp + 0xa998], 1
test bl, bl
je 0x429b2e
mov ecx, dword [esp + 0x10dc]
mov edx, dword [esp + 0x10e0]
mov eax, dword [esp + 0x10ec]
mov dword [esp + 0xa8e8], ecx
mov ecx, dword [esp + 0x10f0]
mov dword [esp + 0xa8ec], edx
mov edx, dword [esp + 0x10e4]
mov dword [esp + 0xa8f8], eax
mov eax, dword [esp + 0x10e8]
mov dword [esp + 0xa8fc], ecx
mov dword [esp + 0xa8f0], edx
mov dword [esp + 0xa8f4], eax
jmp 0x429b56
lea ecx, [esp + 0xa8e8]
call fcn.0046aa00
mov dword [esp + 0xa8f8], edi
mov dword [esp + 0xa8fc], edi
mov dword [esp + 0xa8f0], edi
mov dword [esp + 0xa8f4], edi
mov ecx, dword [esp + 0xe320]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x98d4], eax
cmp ecx, 2
je 0x429b76
cmp dword [esp + 0xa9a8], edi
jne 0x429b82
and eax, 0xfffffbff
mov dword [esp + 0x98d4], eax
cmp dword [esp + 0xa90c], edi
movzx edx, byte [esp + 0xac]
mov eax, dword [ebp + 0x38]
mov byte [esp + 0xa999], dl
movzx edx, byte [eax + 0x6138]
mov byte [esp + 0x98d2], dl
jg 0x429bbf
jl 0x429bba
cmp dword [esp + 0xa908], 0x80000000
ja 0x429bbf
cmp ecx, 3
jne 0x429bc7
mov byte [esp + 0xa9a1], 1
mov eax, dword [eax + 0x83b8]
push eax
push esi
lea ecx, [ebp + 0x2e14]
call fcn.00447ac0
lea ecx, [esp + 0x2138]
push ecx
lea edx, [esp + 0x1118]
lea esi, [ebp + 0x58]
push edx
mov ecx, esi
mov dword [esp + 0xa9ac], edi
call fcn.00459280
cmp byte [esp + 0x1a], 0
mov eax, dword [esp + 0x10cc]
mov dword [esp + 0xa910], eax
mov edx, dword [esp + 0x10d0]
mov byte [ebp + 0xa8], 1
mov dword [ebp + 0x2268], edi
mov dword [ebp + 0x226c], edi
mov dword [esp + 0xa914], edx
jne 0x429fef
mov ecx, dword [ebp + 0x38]
cmp word [ecx + 0x73b8], di
jne 0x429fef
lea edx, [esp + 0x1f]
push edx
lea eax, [esp + 0x22]
push eax
lea ecx, [esp + 0x38]
push ecx
mov ecx, esi
call fcn.004591a0
cmp byte [esp + 0x1e], 0
je 0x429f0d
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x2c]
push edx
push eax
mov ecx, 0x531158
call fcn.0043f7f0
mov ecx, dword [esp + 0x68]
sub dword [esp + 0xe358], ecx
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x6c]
sbb dword [esp + 0xe35c], edx
push eax
lea ecx, [esp + 0x38]
call fcn.0042a850
inc dword [esp + 0x20]
cmp dword [esp + 0x9c], edi
mov dword [eax + 0x2c], edi
jl 0x42a125
jg 0x4295ca
cmp dword [esp + 0x98], edi
jbe 0x42a125
jmp 0x4295ca
mov ecx, dword [ebp + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov ecx, dword [esp + 0x9c]
mov edx, dword [esp + 0x98]
push ebx
push ecx
push edx
lea ecx, [esp + 0xf37c]
call fcn.0042b430
lea ecx, [esp + 0xf370]
call fcn.004329e0
mov eax, dword [esp + 0x15904]
cmp eax, 2
je 0x429d76
cmp eax, 3
je 0x429d7f
mov al, byte [esp + 0x1b564]
cmp al, byte [esp + 0xe32c]
jne 0x42a13b
mov ecx, dword [esp + 0x1b54c]
mov edx, dword [esp + 0x1b548]
push ebx
push ecx
push edx
lea ecx, [esp + 0xf37c]
call fcn.0042b430
mov eax, dword [esp + 0x1b550]
sub eax, dword [esp + 0x1b548]
mov ecx, dword [esp + 0x1b554]
sbb ecx, dword [esp + 0x1b54c]
lea edx, [esp + 0x2138]
push ecx
push eax
push edx
lea ecx, [esp + 0xf37c]
call fcn.00444b60
jmp 0x42a13b
lea ecx, [esp + 0x16af0]
jmp 0x429d86
lea ecx, [esp + 0x18e30]
push ebx
push ebx
push ecx
push eax
lea ecx, [esp + 0x2148]
call fcn.0042def0
lea ecx, [esp + 0xf370]
call fcn.0042b470
mov ecx, dword [esp + 0x1b550]
sub ecx, eax
mov eax, dword [esp + 0x1b554]
sbb eax, edx
push eax
push ecx
lea ecx, [esp + 0x2140]
push ecx
lea ecx, [esp + 0xf37c]
call fcn.00444b60
jmp 0x42a13b
inc dword [esp + 0x5c]
call fcn.00469c30
jmp 0x42a13b
cmp byte [esp + 0x1b55c], 0
je 0x429e44
cmp byte [esp + 0x16], 0
jne 0x429e44
mov edx, dword [ebp + 0x40]
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0x98]
push ebx
push edx
push eax
push ecx
lea edx, [esp + 0xf380]
push edx
mov ecx, ebp
call fcn.004273b0
mov eax, dword [esp + 0xa4]
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
push eax
push ebx
push ecx
push edx
lea eax, [esp + 0x2148]
push eax
lea ecx, [esp + 0xf384]
push ecx
mov ecx, ebp
call fcn.004282a0
call fcn.00469c30
jmp 0x42a13b
mov ecx, dword [ebp + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov ecx, dword [esp + 0x9c]
mov edx, dword [esp + 0x98]
push ebx
push ecx
push edx
lea ecx, [esp + 0xf37c]
call fcn.0042b430
lea ecx, [esp + 0xf370]
call fcn.004329e0
lea eax, [esp + 0x16af0]
push eax
lea ecx, [esp + 0x98bc]
call fcn.00447f20
mov eax, dword [esp + 0xa4]
cmp eax, ebx
je 0x429ea6
push eax
lea ecx, [esp + 0x98bc]
push ecx
mov ecx, ebp
call fcn.004250c0
lea ecx, [esp + 0xf370]
call fcn.0042fe50
test al, al
jne 0x429ec1
mov dl, byte [esp + 0x1b55c]
mov byte [esp + 0x17], dl
cmp byte [esp + 0x17], 0
je 0x429ede
mov eax, dword [ebp + 0x38]
mov eax, dword [eax + 0xc]
cmp eax, dword [esp + 0xa99c]
jbe 0x429ede
mov dword [esp + 0xa99c], eax
push ebx
push ebx
push ebx
push 2
lea ecx, [esp + 0x2148]
call fcn.0042def0
lea ecx, [esp + 0xf370]
push ecx
lea ecx, [esp + 0x213c]
call fcn.0042b2a0
call fcn.00469c30
jmp 0x42a13b
cmp byte [esp + 0x1f], 0
je 0x429f6b
mov ecx, dword [esp + 0x10d0]
mov edx, dword [esp + 0x30]
xor eax, eax
cmp ecx, eax
mov eax, dword [esp + 0x10cc]
ja 0x429f50
jb 0x429f32
cmp eax, edx
jae 0x429f50
mov byte [esp + 0xb0], 1
mov edx, dword [esp + 0xb0]
push edx
push 1
push ecx
push eax
call fcn.00425160
jmp 0x429fe1
mov byte [esp + 0xb0], 0
mov edx, dword [esp + 0xb0]
push edx
push 1
push ecx
push eax
call fcn.00425160
jmp 0x429fe1
mov eax, dword [esp + 0x30]
xor ecx, ecx
mov esi, ecx
push esi
mov dword [esp + 0x10d0], eax
mov edi, eax
add eax, 0x200
mov dword [esp + 0x10d4], ecx
push 2
adc ecx, ecx
push ecx
push eax
call fcn.004e79f0
mov ebx, eax
cmp edx, esi
ja 0x429fa7
jb 0x429fa0
cmp ebx, edi
jae 0x429fa7
xor ebx, ebx
mov edx, 0x40000000
mov esi, 1
xor edi, edi
mov edi, edi
mov eax, esi
add eax, 0xffffffff
mov ecx, edi
adc ecx, 0xffffffff
cmp edx, ecx
jb 0x429fd3
ja 0x429fc4
cmp ebx, eax
jb 0x429fd3
shld edi, esi, 7
shl esi, 7
mov eax, esi
or eax, edi
jne 0x429fb0
jmp 0x429fdd
add esi, 0xffffffff
adc edi, 0xffffffff
mov ebx, esi
mov edx, edi
mov eax, ebx
xor edi, edi
mov dword [esp + 0xa910], eax
mov dword [esp + 0xa914], edx
mov ecx, dword [esp + 0xe320]
inc dword [esp + 0x28]
cmp ecx, 3
jne 0x42a00b
mov dword [ebp + 0x2298], eax
mov dword [ebp + 0x229c], edx
test byte [esp + 0xa0], 1
jne 0x42a024
mov edx, dword [ebp + 0x38]
cmp dword [edx + 0x6138], edi
je 0x42a024
xor bl, bl
jmp 0x42a026
mov bl, 1
cmp byte [esp + 0x1a], 0
jne 0x42a031
test bl, bl
je 0x42a056
mov eax, dword [ebp + 0x38]
mov byte [esp + 0x98d2], 0
cmp byte [eax + 0x5128], 0
jne 0x42a052
cmp ecx, 3
je 0x42a052
mov byte [esp + 0x98d1], 0x14
test bl, bl
jne 0x42a082
mov ecx, dword [ebp + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
xor ecx, ecx
add eax, dword [esp + 0xa908]
adc ecx, dword [esp + 0xa90c]
mov dword [esp + 0xc8], ecx
js 0x42a08c
jg 0x42a082
cmp eax, 0x8000
jbe 0x42a08c
mov ecx, dword [ebp + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov ecx, dword [esp + 0x1a]
mov edx, dword [esp + 0x60]
mov eax, dword [ebp + 0x3c]
push ecx
push 1
push edx
push eax
lea ecx, [esp + 0x1124]
push ecx
lea esi, [ebp + 8]
mov ecx, esi
call fcn.00428080
cmp byte [esp + 0x1a], 0
jne 0x42a109
test bl, bl
je 0x42a0da
push edi
mov ecx, esi
call fcn.00428140
lea eax, [ebp + 0x58]
push eax
call fcn.00426370
push edi
mov ecx, esi
call fcn.00426f90
mov dword [esi + 8], edi
mov dword [esi + 4], edi
jmp 0x42a109
mov eax, dword [ebp + 0x38]
mov ecx, dword [ebp + 0x3c]
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
lea esi, [eax + 0x62e4]
mov eax, dword [eax + 0x6138]
push esi
dec eax
push eax
movzx eax, byte [ebp + 0x54]
push eax
call edx
cmp byte [esp + 0xe324], 0
je 0x42a113
mov byte [ebp + 0x54], 1
cmp byte [esp + 0xe324], 0
jne 0x42a11d
mov ecx, dword [ebp + 0x3c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
call fcn.00469c30
mov dword [ebp + 0x28], edi
mov byte [esp + 0x1d634], 7
lea ecx, [esp + 0x1114]
call fcn.00444640
xor ebx, ebx
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
cmp eax, dword [esp + 0x44]
jb 0x4293a0
mov edi, dword [esp + 0xb4]
mov ecx, dword [ebp + 0x3c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
mov eax, dword [ebp + 0x38]
mov dword [eax + 0xa3d0], ebx
mov ecx, dword [ebp + 0x3c]
cmp ecx, ebx
je 0x42a177
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov esi, dword [ebp + 0x40]
mov dword [ebp + 0x3c], ebx
cmp esi, ebx
je 0x42a191
mov ecx, esi
call fcn.00472c70
push esi
call fcn.004e6cc6
add esp, 4
mov dword [ebp + 0x40], ebx
cmp edi, ebx
je 0x42a1aa
push edi
call fcn.004e68b2
add esp, 4
xor edi, edi
mov dword [esp + 0xb4], edi
cmp dword [esp + 0x28], ebx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
jle 0x42a1c6
lea ecx, [ebp + 0x58]
call fcn.004590c0
cmp dword [esp + 0x20], ebx
jle 0x42a1d8
push 6
mov ecx, 0x531158
call fcn.0043f200
cmp dword [esp + 0x28], ebx
jne 0x42a20a
cmp dword [esp + 0x5c], ebx
jne 0x42a20a
cmp dword [0x531158], 6
je 0x42a1f9
push 0xa
mov ecx, 0x531158
call fcn.0043f200
lea ecx, [esp + 0x2138]
call fcn.00444290
jmp 0x42a36b
cmp byte [esp + 0x19], 0
je 0x42a227
lea ecx, [esp + 0xf370]
push ecx
lea ecx, [esp + 0x213c]
call fcn.0042eb10
jmp 0x42a235
push ebx
push ebx
lea ecx, [esp + 0x2140]
call fcn.0042ef60
lea edx, [esp + 0x2156]
push edx
push ebx
mov ecx, 0x531168
call fcn.00448110
lea eax, [esp + 0x2156]
lea ecx, [esp + 0x60]
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], 0x89
mov dword [esp + 0x60], eax
mov dword [esp + 0xa0], 1
call fcn.0046b420
mov eax, dword [ebp + 0x38]
movzx ecx, word [eax + 0x63a4]
add eax, 0x63a4
cmp cx, bx
je 0x42a2b7
xor edx, edx
cmp cx, 0x40
sete dl
dec edx
and eax, edx
push eax
lea eax, [esp + 0x215a]
push eax
call fcn.00469ea0
test al, al
jne 0x42a2b7
push 2
mov ecx, 0x531158
call fcn.0043f3c0
mov ecx, dword [ebp + 0x38]
cmp byte [ecx + 0x6154], 0
je 0x42a2d4
mov edx, dword [esp + 0x2c]
push edx
lea eax, [esp + 0x38]
push eax
mov ecx, ebp
call fcn.00425700
lea esi, [esp + 0xe36a]
cmp word [esp + 0xe36a], bx
jne 0x42a2ec
lea esi, [esp + 0x2156]
mov ecx, dword [ebp + 0x38]
push 0x800
push esi
add ecx, 0xb412
push ecx
call fcn.004694f0
mov edx, dword [ebp + 0x38]
cmp byte [edx + 0x62e1], 0
je 0x42a319
push esi
mov ecx, ebp
call fcn.00427d80
test al, al
je 0x42a36b
mov eax, dword [ebp + 0x38]
cmp word [eax + 0xa3f2], 0x4d
je 0x42a32f
cmp byte [eax + 0x619e], 0
je 0x42a348
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x215a]
push ecx
lea edx, [esp + 0x3c]
push edx
mov ecx, ebp
call fcn.00425a10
cmp byte [esp + 0xe325], 0
je 0x42a36b
mov ebp, dword [ebp + 0x38]
cmp dword [ebp + 0x6144], ebx
je 0x42a36b
lea eax, [esp + 0xe36a]
push eax
push ebp
call fcn.0045d270
mov byte [esp + 0x1d634], 2
cmp edi, ebx
je 0x42a380
push edi
call fcn.004e68b2
add esp, 4
mov byte [esp + 0x1d634], 1
lea ecx, [esp + 0x2138]
call fcn.0042b740
mov byte [esp + 0x1d634], 0
lea ecx, [esp + 0xf370]
call fcn.0042b740
mov dword [esp + 0x1d634], 0xffffffff
lea ecx, [esp + 0x34]
call fcn.0042a750
mov ecx, dword [esp + 0x1d62c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1d614]
xor ecx, esp
call fcn.004e6a64
add esp, 0x1d624
ret 0xc