Function at 0x47dd70
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x70
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], ecx
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x14
mov edi, dword [esp + 0x90]
idiv ecx
mov ax, word [edi + 0x12]
mov ebx, dword [esp + 0x88]
mov ebp, dword [esp + 0x98]
test ax, ax
mov esi, edx
jne 0x47ddb4
cmp word [edi + 0x14], 0
je 0x47e061
mov cl, byte [edi]
cmp cl, 0x4f
je 0x47e061
cmp cl, 0x50
je 0x47e061
mov edx, dword [esp + 0x84]
mov dx, word [edx + 0x20]
and edx, 0x400
test dx, dx
jne 0x47e061
cmp word [edi + 0x14], dx
jne 0x47dedb
cmp esi, 8
jg 0x47de01
mov dword [esp + 0x88], 1
jmp 0x47e071
cmp esi, 0xb
jl 0x47de16
mov dword [esp + 0x88], 2
jmp 0x47e071
test ax, ax
je 0x47de06
mov edi, dword [edi + 0x50]
test edi, edi
je 0x47de06
mov al, byte [edi + 0x30]
cmp al, 1
je 0x47ddf1
cmp al, 0xb
je 0x47ddf1
cmp al, 0x44
jne 0x47dea2
mov eax, dword [esp + 0x8c]
mov ecx, dword [eax + 0x120]
cmp ecx, 0x1312d00
jbe 0x47de69
mov edx, dword [esp + 0x8c]
mov eax, 0x51eb851f
mul dword [edx + 0x2bc]
mov esi, edx
mov eax, ecx
shr esi, 5
xor edx, edx
div esi
cmp al, 0x64
jae 0x47de92
jmp 0x47de85
lea ecx, [ecx + ecx*4]
xor edx, edx
lea eax, [ecx + ecx*4]
mov ecx, dword [esp + 0x8c]
shl eax, 2
div dword [ecx + 0x2bc]
cmp al, 0x64
jae 0x47de92
and eax, 0xff
cmp al, 0x41
jle 0x47e7d7
mov dword [esp + 0x88], 1
jmp 0x47e071
cmp al, 0x27
jne 0x47e7d7
mov edx, dword [esp + 0x9c]
mov dword [esp + 0x88], 1
xor eax, eax
lea ecx, [edx + 0x3e48]
cmp byte [ecx], 0
jne 0x47e7d7
inc eax
add ecx, 0x10
cmp eax, 0xe
jl 0x47dec4
jmp 0x47e071
test ax, ax
jne 0x47df0e
cmp esi, 8
jge 0x47def5
mov dword [esp + 0x88], 1
jmp 0x47e071
cmp esi, 0xb
jle 0x47eb22
mov dword [esp + 0x88], 2
jmp 0x47e071
mov eax, dword [esp + 0x84]
mov ax, word [eax + 0x12]
cmp ax, 0x3d
jne 0x47df74
cmp esi, 2
jg 0x47df34
mov dword [esp + 0x88], 1
jmp 0x47e071
cmp esi, 5
jg 0x47df49
mov dword [esp + 0x88], 2
jmp 0x47e071
cmp esi, 8
jg 0x47eb22
mov ecx, dword [edi + 0x50]
mov al, byte [ecx + 0x30]
cmp al, 1
je 0x47df64
cmp al, 0xb
jne 0x47e7d7
mov dword [esp + 0x88], 1
jmp 0x47e071
cmp ax, 0x54
je 0x47ecb6
cmp ax, 0x5d
jne 0x47dfb2
cmp esi, 2
jg 0x47df99
mov dword [esp + 0x88], 1
jmp 0x47e071
cmp esi, 5
jg 0x47eb22
mov dword [esp + 0x88], 2
jmp 0x47e071
cmp cl, 0x62
jne 0x47dfef
cmp esi, 2
jg 0x47dfcc
mov dword [esp + 0x88], 1
jmp 0x47e071
cmp esi, 4
jg 0x47dfe1
mov dword [esp + 0x88], 2
jmp 0x47e071
cmp esi, 0xf
jge 0x47eb22
jmp 0x47e7d7
cmp esi, 7
jge 0x47e001
mov dword [esp + 0x88], 1
jmp 0x47e071
cmp esi, 0xc
jle 0x47e013
mov dword [esp + 0x88], 2
jmp 0x47e071
cmp esi, 9
jg 0x47e023
mov edx, dword [edi + 0x50]
mov al, byte [edx + 0x30]
jmp 0x47df58
cmp cl, 0x4a
jne 0x47eb22
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x8c]
mov ecx, dword [ecx + 0x294]
cmp eax, ecx
jbe 0x47eb22
sub eax, ecx
cmp eax, 0x4e20
jae 0x47eb22
mov dword [esp + 0x88], 1
jmp 0x47e071
xor edx, edx
cmp esi, 9
setg dl
inc edx
mov dword [esp + 0x88], edx
mov ax, word [ebx + 2]
movsx ecx, word [ebp + 2]
movsx eax, ax
sub eax, ecx
mov cx, word [ebx]
cdq
mov esi, eax
xor esi, edx
sub esi, edx
movsx edx, word [ebp]
movsx eax, cx
sub eax, edx
cdq
mov edi, eax
xor edi, edx
sub edi, edx
cmp edi, esi
mov dword [esp + 0x98], edi
jg 0x47e0aa
mov dword [esp + 0x98], esi
mov al, byte [ebx + 4]
mov dl, byte [ebp + 4]
cmp al, dl
je 0x47e0e6
test al, al
jne 0x47e0c8
cmp word [ebp], cx
jle 0x47e0c8
mov ax, word [ebx + 2]
cmp word [ebp + 2], ax
jg 0x47e0df
mov al, byte [ebp + 4]
test al, al
jne 0x47e0e6
cmp cx, word [ebp]
jle 0x47e0e6
mov ax, word [ebx + 2]
cmp ax, word [ebp + 2]
jle 0x47e0e6
mov eax, 1
jmp 0x47e0e8
xor eax, eax
mov edx, dword [esp + 0x98]
add eax, edx
mov edx, dword [esp + 0x90]
movsx edx, byte [edx + 3]
cmp eax, edx
jle 0x47e187
cmp edi, esi
jle 0x47e10a
mov esi, edi
mov al, byte [ebx + 4]
mov dl, byte [ebp + 4]
cmp al, dl
je 0x47e143
test al, al
jne 0x47e128
cmp word [ebp], cx
jle 0x47e128
mov ax, word [ebx + 2]
cmp word [ebp + 2], ax
jg 0x47e13c
test dl, dl
jne 0x47e143
cmp cx, word [ebp]
jle 0x47e143
mov ax, word [ebx + 2]
cmp ax, word [ebp + 2]
jle 0x47e143
mov eax, 1
jmp 0x47e145
xor eax, eax
mov ecx, dword [esp + 0x90]
add eax, esi
movsx edx, byte [ecx + 4]
cmp eax, edx
jle 0x47e187
mov eax, dword [esp + 0x84]
mov cx, word [eax + 0x20]
and ecx, 0x400
test cx, cx
jne 0x47ede4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 5
div ecx
test edx, edx
jne 0x47ede4
mov eax, dword [esp + 0x88]
cmp eax, 1
jne 0x47e462
mov ax, word [ebx + 2]
mov cx, word [ebx]
movsx edx, word [ebp + 2]
movsx eax, ax
sub eax, edx
cdq
mov esi, eax
xor esi, edx
sub esi, edx
movsx edx, word [ebp]
movsx eax, cx
sub eax, edx
cdq
mov edi, eax
xor edi, edx
sub edi, edx
cmp edi, esi
mov dword [esp + 0x88], edi
jg 0x47e1d0
mov dword [esp + 0x88], esi
mov al, byte [ebx + 4]
mov dl, byte [ebp + 4]
cmp al, dl
je 0x47e20c
test al, al
jne 0x47e1ee
cmp word [ebp], cx
jle 0x47e1ee
mov ax, word [ebx + 2]
cmp word [ebp + 2], ax
jg 0x47e205
mov al, byte [ebp + 4]
test al, al
jne 0x47e20c
cmp cx, word [ebp]
jle 0x47e20c
mov ax, word [ebx + 2]
cmp ax, word [ebp + 2]
jle 0x47e20c
mov eax, 1
jmp 0x47e20e
xor eax, eax
mov edx, dword [esp + 0x88]
add eax, edx
mov edx, dword [esp + 0x90]
movsx edx, byte [edx + 3]
cmp eax, edx
jg 0x47e2e1
mov eax, dword [esp + 0x90]
cmp byte [eax], 0x3e
jne 0x47e268
mov esi, dword [esp + 0x8c]
mov edx, dword [esp + 0x94]
mov eax, dword [esp + 0x84]
mov edi, dword [esp + 0x10]
mov ecx, dword [esi + 0x2c4]
push ecx
push 4
push 0
push ebp
push edx
push esi
push ebx
push eax
mov ecx, edi
call fcn.0047f920
jmp 0x47e2a0
mov ecx, dword [esp + 0x9c]
mov edx, dword [esp + 0x94]
mov eax, dword [esp + 0x8c]
push 0
push ecx
mov ecx, dword [esp + 0x8c]
push ebp
push edx
push eax
push ebx
push ecx
mov ecx, dword [esp + 0x2c]
call fcn.0047eea0
mov esi, dword [esp + 0x8c]
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x90]
mov eax, dword [ebx + 8]
cdq
idiv dword [edi + 0x9c]
mov ecx, eax
mov dword [esi + 0x104], ecx
mov eax, dword [ebx + 8]
cdq
idiv dword [edi + 0x9c]
test edx, edx
jle 0x47eb05
inc ecx
pop edi
mov dword [esi + 0x104], ecx
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x70
ret 0x1c
cmp edi, esi
jle 0x47e2e7
mov esi, edi
mov al, byte [ebx + 4]
mov dl, byte [ebp + 4]
cmp al, dl
je 0x47e320
test al, al
jne 0x47e305
cmp word [ebp], cx
jle 0x47e305
mov ax, word [ebx + 2]
cmp word [ebp + 2], ax
jg 0x47e319
test dl, dl
jne 0x47e320
cmp cx, word [ebp]
jle 0x47e320
mov ax, word [ebx + 2]
cmp ax, word [ebp + 2]
jle 0x47e320
mov eax, 1
jmp 0x47e322
xor eax, eax
lea edx, [eax + esi]
mov eax, dword [esp + 0x90]
movsx ecx, byte [eax + 4]
cmp edx, ecx
mov cl, byte [eax]
jg 0x47e356
cmp cl, 0x3e
jne 0x47e536
mov esi, dword [esp + 0x8c]
mov edx, dword [esi + 0x2c4]
push edx
push 4
push 0
jmp 0x47e516
cmp cl, 0x4a
je 0x47ede4
mov ecx, dword [eax + 0x54]
test ecx, ecx
je 0x47ede4
mov ecx, dword [eax + 0x50]
test ecx, ecx
jne 0x47e389
call dword [sym.imp.MSVCRT.dll_rand]
and eax, 0x80000003
jns 0x47e383
dec eax
or eax, 0xfffffffc
inc eax
je 0x47ede4
mov ax, word [ebx + 2]
mov si, word [ebx]
movsx ecx, word [ebp + 2]
movsx eax, ax
sub eax, ecx
mov di, word [ebp]
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
movsx edx, di
movsx eax, si
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jle 0x47e3b7
mov ecx, eax
mov dl, byte [ebx + 4]
mov al, byte [ebp + 4]
cmp dl, al
je 0x47e3ee
test dl, dl
jne 0x47e3d4
cmp di, si
jle 0x47e3d4
mov dx, word [ebx + 2]
cmp word [ebp + 2], dx
jg 0x47e3e7
test al, al
jne 0x47e3ee
cmp si, di
jle 0x47e3ee
mov dx, word [ebx + 2]
cmp dx, word [ebp + 2]
jle 0x47e3ee
mov edi, 1
jmp 0x47e3f0
xor edi, edi
mov esi, dword [esp + 0x90]
add edi, ecx
mov edx, dword [esi + 0x54]
movsx eax, word [edx + 0x28]
cmp edi, eax
jg 0x47ede4
mov cx, word [esi + 0x14]
mov eax, dword [esp + 0x94]
push edx
mov edx, dword [esp + 0xa0]
mov edi, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x8c]
push edx
push ebp
mov ebp, dword [esp + 0x9c]
push eax
push ebp
push ebx
push ecx
mov ecx, edi
call fcn.00480790
xor eax, eax
mov ax, word [esi + 0x18]
cdq
idiv dword [edi + 0x9c]
mov ecx, eax
xor eax, eax
mov dword [ebp + 0x104], ecx
mov ax, word [esi + 0x18]
cdq
idiv dword [edi + 0x9c]
jmp 0x47eafa
cmp eax, 2
jne 0x47e7ce
mov ax, word [ebx + 2]
mov cx, word [ebx]
movsx edx, word [ebp + 2]
movsx eax, ax
sub eax, edx
cdq
mov esi, eax
xor esi, edx
sub esi, edx
movsx edx, word [ebp]
movsx eax, cx
sub eax, edx
cdq
mov edi, eax
xor edi, edx
sub edi, edx
cmp edi, esi
mov dword [esp + 0x88], edi
jg 0x47e4a4
mov dword [esp + 0x88], esi
mov al, byte [ebx + 4]
mov dl, byte [ebp + 4]
cmp al, dl
je 0x47e4e0
test al, al
jne 0x47e4c2
cmp word [ebp], cx
jle 0x47e4c2
mov ax, word [ebp + 2]
cmp ax, word [ebx + 2]
jg 0x47e4d9
mov al, byte [ebp + 4]
test al, al
jne 0x47e4e0
cmp cx, word [ebp]
jle 0x47e4e0
mov ax, word [ebp + 2]
cmp word [ebx + 2], ax
jle 0x47e4e0
mov eax, 1
jmp 0x47e4e2
xor eax, eax
mov ecx, dword [esp + 0x88]
lea edx, [eax + ecx]
mov eax, dword [esp + 0x90]
movsx ecx, byte [eax + 4]
cmp edx, ecx
jg 0x47e58f
cmp byte [eax], 0x3e
jne 0x47e536
mov esi, dword [esp + 0x8c]
mov edx, dword [esi + 0x2c4]
push edx
push 4
push 1
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x90]
mov edi, dword [esp + 0x1c]
push ebp
push eax
push esi
push ebx
push ecx
mov ecx, edi
call fcn.0047f920
jmp 0x47e56e
mov edx, dword [esp + 0x9c]
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x8c]
push 1
push edx
mov edx, dword [esp + 0x8c]
push ebp
push eax
push ecx
mov ecx, dword [esp + 0x24]
push ebx
push edx
call fcn.0047eea0
mov esi, dword [esp + 0x8c]
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x90]
mov eax, dword [ebx + 0xc]
cdq
idiv dword [edi + 0x9c]
mov ecx, eax
mov dword [esi + 0x104], ecx
mov eax, dword [ebx + 0xc]
jmp 0x47e2bc
cmp edi, esi
jle 0x47e595
mov esi, edi
mov cl, byte [ebx + 4]
mov dl, byte [ebp + 4]
cmp cl, dl
je 0x47e5d4
test cl, cl
jne 0x47e5b6
mov cx, word [ebx]
cmp word [ebp], cx
jle 0x47e5b6
mov cx, word [ebx + 2]
cmp word [ebp + 2], cx
jg 0x47e5cd
test dl, dl
jne 0x47e5d4
mov cx, word [ebx]
cmp cx, word [ebp]
jle 0x47e5d4
mov cx, word [ebx + 2]
cmp cx, word [ebp + 2]
jle 0x47e5d4
mov ecx, 1
jmp 0x47e5d6
xor ecx, ecx
movsx edx, byte [eax + 3]
add ecx, esi
cmp ecx, edx
mov cl, byte [eax]
jg 0x47e645
cmp cl, 0x3e
jne 0x47e61c
mov esi, dword [esp + 0x8c]
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x84]
mov edi, dword [esp + 0x10]
mov eax, dword [esi + 0x2c4]
push eax
push 4
push 1
push ebp
push ecx
push esi
push ebx
push edx
mov ecx, edi
call fcn.0047f920
jmp 0x47e2a0
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x8c]
push 0
push eax
mov eax, dword [esp + 0x8c]
push ebp
push ecx
push edx
push ebx
push eax
jmp 0x47e28c
cmp cl, 0x4a
je 0x47ede4
mov ecx, dword [eax + 0x54]
test ecx, ecx
je 0x47ede4
mov ecx, dword [eax + 0x50]
test ecx, ecx
jne 0x47e67f
call dword [sym.imp.MSVCRT.dll_rand]
and eax, 0x80000003
jns 0x47e672
dec eax
or eax, 0xfffffffc
inc eax
je 0x47ede4
mov eax, dword [esp + 0x90]
mov eax, dword [eax + 0x54]
mov dword [esp + 0x98], 0
mov dword [esp + 0x14], eax
movsx eax, word [eax + 0x28]
cmp eax, 0x2710
mov dword [esp + 0x88], eax
jl 0x47e6ba
sub eax, 0x2710
mov dword [esp + 0x98], 1
mov dword [esp + 0x88], eax
mov ax, word [ebx + 2]
mov si, word [ebx]
movsx ecx, word [ebp + 2]
movsx eax, ax
sub eax, ecx
mov di, word [ebp]
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
movsx edx, di
movsx eax, si
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jle 0x47e6e8
mov ecx, eax
mov dl, byte [ebx + 4]
mov al, byte [ebp + 4]
cmp dl, al
je 0x47e71f
test dl, dl
jne 0x47e705
cmp di, si
jle 0x47e705
mov dx, word [ebx + 2]
cmp word [ebp + 2], dx
jg 0x47e718
test al, al
jne 0x47e71f
cmp si, di
jle 0x47e71f
mov dx, word [ebx + 2]
cmp dx, word [ebp + 2]
jle 0x47e71f
mov edx, 1
jmp 0x47e721
xor edx, edx
mov eax, dword [esp + 0x88]
add edx, ecx
cmp edx, eax
jg 0x47ede4
cmp dword [esp + 0x98], 1
jne 0x47e770
mov edi, dword [esp + 0x90]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x84]
mov esi, dword [esp + 0x10]
mov cx, word [edi + 0x14]
push 0
push 0
push eax
push ecx
push ebp
mov ebp, dword [esp + 0xa0]
mov ecx, esi
push ebp
push ebx
push edx
call fcn.004813c0
jmp 0x47e7ae
mov edi, dword [esp + 0x90]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x9c]
mov esi, dword [esp + 0x10]
mov cx, word [edi + 0x14]
push eax
mov eax, dword [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x8c]
push edx
push ebp
mov ebp, dword [esp + 0x9c]
push eax
push ebp
push ebx
push ecx
mov ecx, esi
call fcn.00480790
xor eax, eax
mov ax, word [edi + 0x18]
cdq
idiv dword [esi + 0x9c]
mov ecx, eax
xor eax, eax
mov dword [ebp + 0x104], ecx
mov ax, word [edi + 0x18]
jmp 0x47eaf3
cmp eax, 3
jne 0x47eb14
mov edx, dword [esp + 0x90]
mov dword [esp + 0x18], 0
mov eax, dword [edx + 0x50]
mov dword [esp + 0x88], eax
movsx eax, word [eax + 0x28]
cmp eax, 0x2710
mov dword [esp + 0x14], eax
jl 0x47e810
sub eax, 0x2710
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], eax
mov ax, word [ebx + 2]
movsx ecx, word [ebp + 2]
movsx eax, ax
sub eax, ecx
mov cx, word [ebx]
cdq
mov esi, eax
xor esi, edx
sub esi, edx
movsx edx, word [ebp]
movsx eax, cx
sub eax, edx
cdq
mov edi, eax
xor edi, edx
sub edi, edx
cmp edi, esi
mov dword [esp + 0x98], edi
jg 0x47e849
mov dword [esp + 0x98], esi
mov al, byte [ebx + 4]
mov dl, byte [ebp + 4]
cmp al, dl
je 0x47e885
test al, al
jne 0x47e867
cmp word [ebp], cx
jle 0x47e867
mov ax, word [ebp + 2]
cmp ax, word [ebx + 2]
jg 0x47e87e
mov al, byte [ebp + 4]
test al, al
jne 0x47e885
cmp cx, word [ebp]
jle 0x47e885
mov ax, word [ebp + 2]
cmp word [ebx + 2], ax
jle 0x47e885
mov eax, 1
jmp 0x47e887
xor eax, eax
mov ecx, dword [esp + 0x98]
add eax, ecx
mov ecx, dword [esp + 0x14]
cmp eax, ecx
mov eax, dword [esp + 0x94]
jle 0x47e8a3
test ecx, ecx
jne 0x47e8ec
mov edx, dword [esp + 0x88]
mov cl, byte [edx + 0x30]
cmp cl, 0x2a
jne 0x47e8c1
mov dx, word [eax + 0x1c]
and edx, 0x800
test dx, dx
jne 0x47e8ec
cmp cl, 0x26
jne 0x47ea50
mov cx, word [eax + 0x1a]
and ecx, 0x4000
test cx, cx
jne 0x47e8ec
mov dx, word [eax + 0x1e]
and edx, 0x800
test dx, dx
je 0x47ea50
mov eax, dword [esp + 0x90]
cmp byte [eax], 0x4a
je 0x47ede4
mov cx, word [eax + 0x14]
test cx, cx
mov dword [esp + 0x14], ecx
je 0x47ede4
mov eax, dword [eax + 0x54]
mov dword [esp + 0x98], 0
movsx ecx, word [eax + 0x28]
cmp ecx, 0x2710
mov dword [esp + 0x88], ecx
jl 0x47e946
sub ecx, 0x2710
mov dword [esp + 0x98], 1
mov dword [esp + 0x88], ecx
cmp edi, esi
jle 0x47e94c
mov esi, edi
mov cl, byte [ebx + 4]
mov dl, byte [ebp + 4]
cmp cl, dl
je 0x47e98b
test cl, cl
jne 0x47e96d
mov cx, word [ebx]
cmp word [ebp], cx
jle 0x47e96d
mov cx, word [ebx + 2]
cmp word [ebp + 2], cx
jg 0x47e984
test dl, dl
jne 0x47e98b
mov cx, word [ebx]
cmp cx, word [ebp]
jle 0x47e98b
mov cx, word [ebx + 2]
cmp cx, word [ebp + 2]
jle 0x47e98b
mov ecx, 1
jmp 0x47e98d
xor ecx, ecx
mov edx, dword [esp + 0x88]
add ecx, esi
cmp ecx, edx
jg 0x47ede4
cmp dword [esp + 0x98], 1
jne 0x47e9d1
mov edi, dword [esp + 0x8c]
mov ecx, dword [esp + 0x84]
push 0
mov esi, dword [esp + 0x14]
push 0
push eax
mov eax, dword [esp + 0x20]
push eax
push ebp
push edi
push ebx
push ecx
mov ecx, esi
call fcn.004813c0
jmp 0x47ea0d
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x94]
push eax
mov eax, dword [esp + 0xa0]
push edx
mov edx, dword [esp + 0x94]
push eax
mov eax, dword [esp + 0x90]
push ebp
push ecx
mov ecx, dword [esp + 0x24]
push edx
push ebx
push eax
call fcn.00480790
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x8c]
mov ebx, dword [esp + 0x90]
xor eax, eax
mov ax, word [ebx + 0x18]
cdq
idiv dword [esi + 0x9c]
mov ecx, eax
xor eax, eax
mov dword [edi + 0x104], ecx
mov ax, word [ebx + 0x18]
cdq
idiv dword [esi + 0x9c]
test edx, edx
jle 0x47ea41
inc ecx
mov dword [edi + 0x104], ecx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x70
ret 0x1c
cmp dword [esp + 0x18], 1
jne 0x47ea8e
mov edi, dword [esp + 0x90]
mov ecx, dword [esp + 0x88]
mov eax, dword [esp + 0x84]
mov esi, dword [esp + 0x10]
mov dx, word [edi + 0x12]
push 0
push 0
push ecx
push edx
push ebp
mov ebp, dword [esp + 0xa0]
mov ecx, esi
push ebp
push ebx
push eax
call fcn.004813c0
jmp 0x47ead8
mov ecx, dword [esp + 0x88]
mov edx, dword [esp + 0x90]
push ecx
mov cx, word [edx + 0x12]
mov edx, dword [esp + 0xa0]
push ecx
mov ecx, dword [esp + 0x8c]
push edx
push ebp
push eax
mov eax, dword [esp + 0xa0]
push eax
push ebx
push ecx
mov ecx, dword [esp + 0x30]
call fcn.00480790
mov esi, dword [esp + 0x10]
mov ebp, dword [esp + 0x8c]
mov edi, dword [esp + 0x90]
xor eax, eax
mov ax, word [edi + 0x16]
cdq
idiv dword [esi + 0x9c]
mov ecx, eax
xor eax, eax
mov dword [ebp + 0x104], ecx
mov ax, word [edi + 0x16]
cdq
idiv dword [esi + 0x9c]
test edx, edx
jle 0x47eb05
inc ecx
mov dword [ebp + 0x104], ecx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x70
ret 0x1c
cmp dword [esp + 0x88], 4
jne 0x47eca1
mov edx, dword [esp + 0x90]
mov dword [esp + 0x98], 0
mov eax, dword [edx + 0x54]
movsx eax, word [eax + 0x28]
cmp eax, 0x2710
mov dword [esp + 0x88], eax
jl 0x47eb60
sub eax, 0x2710
mov dword [esp + 0x98], 1
mov dword [esp + 0x88], eax
mov ax, word [ebx + 2]
mov si, word [ebx]
movsx ecx, word [ebp + 2]
movsx eax, ax
sub eax, ecx
mov di, word [ebp]
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
movsx edx, di
movsx eax, si
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jle 0x47eb8e
mov ecx, eax
mov dl, byte [ebx + 4]
mov al, byte [ebp + 4]
cmp dl, al
je 0x47ebc5
test dl, dl
jne 0x47ebab
cmp di, si
jle 0x47ebab
mov dx, word [ebx + 2]
cmp word [ebp + 2], dx
jg 0x47ebbe
test al, al
jne 0x47ebc5
cmp si, di
jle 0x47ebc5
mov dx, word [ebx + 2]
cmp dx, word [ebp + 2]
jle 0x47ebc5
mov edx, 1
jmp 0x47ebc7
xor edx, edx
mov eax, dword [esp + 0x88]
add edx, ecx
cmp edx, eax
jg 0x47ede4
cmp dword [esp + 0x98], 1
jne 0x47ec15
mov edi, dword [esp + 0x90]
push 0
push 0
mov ecx, dword [esp + 0x8c]
mov eax, dword [edi + 0x54]
mov esi, dword [esp + 0x18]
push eax
mov ax, word [edi + 0x14]
push eax
push ebp
mov ebp, dword [esp + 0xa0]
push ebp
push ebx
push ecx
mov ecx, esi
call fcn.004813c0
jmp 0x47ec59
mov ecx, dword [esp + 0x90]
mov esi, dword [esp + 0x10]
mov eax, dword [ecx + 0x54]
mov dx, word [ecx + 0x14]
mov ecx, dword [esp + 0x94]
push eax
mov eax, dword [esp + 0xa0]
push edx
mov edx, dword [esp + 0x8c]
push eax
push ebp
mov ebp, dword [esp + 0x9c]
push ecx
push ebp
push ebx
push edx
mov ecx, esi
call fcn.00480790
mov edi, dword [esp + 0x90]
xor eax, eax
mov ax, word [edi + 0x18]
cdq
idiv dword [esi + 0x9c]
mov ecx, eax
xor eax, eax
mov dword [ebp + 0x104], ecx
mov ax, word [edi + 0x18]
cdq
idiv dword [esi + 0x9c]
test edx, edx
jle 0x47ec86
inc ecx
mov dword [ebp + 0x104], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
mov dword [ebp + 0x294], eax
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x70
ret 0x1c
cmp dword [esp + 0x88], 5
jne 0x47ede4
mov edi, dword [esp + 0x90]
mov eax, dword [edi + 0x54]
movsx ecx, word [eax + 0x28]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x88], ecx
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x47ede4
lea ecx, [eax + 0x40]
lea eax, [esp + 0x94]
push 1
push eax
mov edx, dword [ecx]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0xa8]
push eax
mov dword [esp + 0xb0], ecx
call dword [edx + 0x34]
test eax, eax
je 0x47ede4
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x94]
cmp ecx, eax
je 0x47edb4
mov di, word [ebx + 2]
mov si, word [ebx]
movsx edx, word [esp + 0x1a]
movsx eax, di
sub eax, edx
mov bp, word [esp + 0x18]
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
movsx eax, si
movsx edx, bp
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jle 0x47ed4c
mov ecx, eax
mov dl, byte [ebx + 4]
mov al, byte [esp + 0x1c]
cmp dl, al
je 0x47ed7e
test dl, dl
jne 0x47ed67
cmp bp, si
jle 0x47ed67
cmp word [esp + 0x1a], di
jg 0x47ed77
test al, al
jne 0x47ed7e
cmp si, bp
jle 0x47ed7e
cmp di, word [esp + 0x1a]
jle 0x47ed7e
mov edx, 1
jmp 0x47ed80
xor edx, edx
mov eax, dword [esp + 0x88]
add edx, ecx
cmp edx, eax
jg 0x47edb4
mov eax, dword [esp + 0x94]
mov ecx, dword [eax + 0x120]
mov edx, dword [eax + 0x2bc]
cmp ecx, edx
jne 0x47edf0
mov ecx, dword [esp + 0x10]
mov edx, eax
push edx
call fcn.0047ac40
test eax, eax
jne 0x47edf0
mov ecx, dword [esp + 0x9c]
lea edx, [esp + 0x94]
push 1
push edx
mov eax, dword [ecx]
lea edx, [esp + 0x20]
push edx
lea edx, [esp + 0x2c]
push edx
lea edx, [esp + 0xa8]
push edx
call dword [eax + 0x38]
test eax, eax
jne 0x47ed06
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x70
ret 0x1c
mov eax, dword [esp + 0x94]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x18]
push edx
call fcn.0047bca0
mov eax, dword [esp + 0x94]
lea edx, [esp + 0x18]
push edx
push ebx
mov ecx, dword [eax + 0x2bc]
mov dword [eax + 0x120], ecx
call dword [sym.imp.Staff2.dll_char___cdecl_STAFFGetDirection_struct_PIS___struct_PIS__]
add esp, 8
cmp al, 5
jne 0x47ee33
mov al, 2
mov ebp, dword [esp + 0x84]
mov ecx, dword [esp + 0x9c]
mov byte [ebp + 0x18], al
mov eax, dword [esp + 0x8c]
push eax
push ebx
push ebp
call fcn.0040a390
mov ecx, 0xb
lea esi, [esp + 0x20]
lea edi, [esp + 0x50]
mov edx, dword [esp + 0x90]
rep movsd dword es:[edi], dword [esi]
mov ax, word [edx + 0x14]
lea ecx, [esp + 0x50]
push 0x2f
push ecx
mov ecx, dword [esp + 0x18]
push eax
push ebx
push ebp
mov ecx, dword [ecx + 0x3c]
movsw word es:[edi], word [esi]
mov byte [esp + 0x92], 0x64
call fcn.0045f9b0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x70
ret 0x1c