Function at 0x4f9e38
Capabilities:
Check os version
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4faf38
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.004f9dd4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov byte [eax + 0x55], 0
xor edx, edx
push ebp
push 0x4faefb
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x9c]
mov edx, dword [ebp - 4]
mov esi, dword [edx + 0x10]
mov dword [esi + 0x18], eax
mov dword [esi + 0x10], edi
mov eax, dword [ebp - 4]
mov edi, dword [eax + 8]
mov edx, dword [edi + 0x30]
mov eax, esi
call fcn.004a8b7c
mov edx, eax
mov eax, edi
call fcn.0050f9e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x50]
call fcn.00402ad0
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x98]
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
cmp byte [eax + 0x34], 2
ja 0x4f9eff
mov esi, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x38]
call fcn.004afc18
dec esi
jne 0x4f9eee
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
cmp word [eax + 0x7a], 0
je 0x4f9f1e
mov esi, eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x7c]
call dword [esi + 0x78]
xor eax, eax
push ebp
push 0x4fae4e
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4fae2a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0051009c
test al, al
je 0x4f9f52
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00404770
jmp 0x4faf02
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x1e]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
cmp eax, dword [edx + 0x50]
jle 0x4f9f78
mov eax, dword [ebp - 4]
movzx edx, word [eax + 0x1e]
mov eax, dword [ebp - 4]
add eax, 4
call fcn.00402b20
jmp 0x4f9fe3
mov eax, dword [ebp - 4]
test byte [eax + 0x1d], 0x80
je 0x4f9f99
mov ecx, 0x4faf50
mov dl, 1
mov eax, dword [0x408604]
call fcn.0040d94c
call fcn.004046c4
jmp 0x4f9fe3
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x1c]
and ax, 0xff
cmp ax, 9
je 0x4f9fe3
mov eax, dword [ebp - 4]
cmp word [eax + 0x1c], 0xfc
je 0x4f9fe3
mov eax, dword [ebp - 4]
cmp word [eax + 0x1c], 0xeb
je 0x4f9fe3
mov eax, dword [ebp - 4]
cmp word [eax + 0x1c], 0xec
je 0x4f9fe3
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x1e]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.004a8688
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
cmp word [eax + 0x7a], 0
je 0x4fa033
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.004a8b70
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
fild dword [eax + 0x20]
fdivp st(1)
fmul dword [0x4faf64]
call fcn.00402fcc
mov esi, eax
cmp esi, dword [ebp - 8]
jle 0x4fa033
mov dword [ebp - 8], esi
mov eax, dword [ebp - 4]
mov esi, dword [eax + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x7c]
call dword [esi + 0x78]
test bl, bl
je 0x4fa04d
mov eax, dword [ebp - 4]
cmp word [eax + 0x1c], 0x1ab
jne 0x4fae2a
xor ebx, ebx
jmp 0x4fae2a
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 1
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x1c]
cmp eax, 0x8d
jg 0x4fa2b2
je 0x4fa66b
cmp eax, 0x8c
ja case.0x4fa495.519
jmp dword [eax*4 + 0x4fa07e]
cmp eax, 0x1b0
jg 0x4fa423
je 0x4faaba
cmp eax, 0xe5
jg 0x4fa370
je 0x4faaad
cmp eax, 0xbe
jg 0x4fa327
je 0x4fa9ea
cmp eax, 0x9d
jg 0x4fa30e
je 0x4fa8e8
sub eax, 0x92
je 0x4fa6ac
sub eax, 9
je 0x4fa8db
dec eax
je 0x4fa603
jmp case.0x4fa495.519
sub eax, 0xa1
je 0x4fa88d
sub eax, 0x1c
je 0x4faa04
jmp case.0x4fa495.519
add eax, 0xffffff2a
cmp eax, 0xc
ja case.0x4fa495.519
jmp dword [eax*4 + 0x4fa33c]
cmp eax, 0x160
jg 0x4fa3e6
je 0x4fa72e
add eax, 0xffffff15
cmp eax, 0x14
ja case.0x4fa495.519
jmp dword [eax*4 + 0x4fa392]
cmp eax, 0x1aa
jg 0x4fa40c
je 0x4faaed
sub eax, 0x161
je 0x4fa5f6
sub eax, 0x48
je 0x4faae1
jmp case.0x4fa495.519
sub eax, 0x1ae
je 0x4fa6ed
dec eax
je 0x4fa637
jmp case.0x4fa495.519
cmp eax, 0x218
jg 0x4fa4c0
je case.0x4fa077.24
cmp eax, 0x201
jg 0x4fa487
je 0x4fa9b6
cmp eax, 0x1bc
jg 0x4fa46e
je 0x4fa644
sub eax, 0x1b2
je 0x4faad4
sub eax, 5
je 0x4fa692
dec eax
je 0x4faac7
jmp case.0x4fa495.519
sub eax, 0x1c1
je 0x4fa755
sub eax, 0x3f
je 0x4fa930
jmp case.0x4fa495.519
add eax, 0xfffffdfd
cmp eax, 8
ja case.0x4fa495.519
jmp dword [eax*4 + 0x4fa49c]
cmp eax, 0x406
jg 0x4fa515
je case.0x4fa495.518
cmp eax, 0x23e
jg 0x4fa4fc
je 0x4faa6c
sub eax, 0x223
je case.0x4fa077.35
sub eax, 2
je 0x4fa818
sub eax, 0xc
je case.0x4fa077.49
jmp case.0x4fa495.519
sub eax, 0x243
je case.0x4fa335.224
sub eax, 0x3b
je case.0x4fa077.126
jmp case.0x4fa495.519
cmp eax, 0x862
jg 0x4fa53b
je 0x4faa93
sub eax, 0x41e
je 0x4fa6c6
sub eax, 0x25
je case.0x4fa335.224
jmp case.0x4fa495.519
sub eax, 0x866
je 0x4fa76f
dec eax
je 0x4faaa0
jmp case.0x4fa495.519
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov esi, dword [eax]
call dword [esi + 0x18]
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 0
mov eax, dword [ebp - 4]
call fcn.004f9df0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4fae44
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x18]
jle 0x4fae44
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc944
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcb9c
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcb98
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fd4ec
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcb54
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc220
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc374
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc38c
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fd4cc
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcdb0
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcd14
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcd94
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcdac
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fd294
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc058
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc8f0
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc008
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcd34
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcde8
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc078
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc0a0
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc51c
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc7d4
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fd728
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc3a4
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc3d4
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc404
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc434
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc4e0
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc4e4
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fd270
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc0dc
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc278
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc29c
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcc90
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcd10
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fd240
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fd268
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc200
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc1e0
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcdc8
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcba0
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc2f4
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fce00
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcd74
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcd54
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc890
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc8b0
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc2b4
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fd554
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fd588
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fd64c
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc63c
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc708
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc8d0
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fd274
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcd30
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fd220
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fd160
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fd1a0
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fd1e0
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fd120
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc2d4
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcb68
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc028
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc240
jmp 0x4fae07
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
cmp byte [eax + 0x34], 5
je 0x4fa917
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 0
je 0x4fa923
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 0
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc314
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc314
jmp 0x4fae07
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
cmp byte [eax + 0x34], 4
ja 0x4fae07
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x40]
call fcn.0050a864
mov eax, dword [eax + 0x18]
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
jmp 0x4fae07
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 0
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fb910
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fb9e4
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fb950
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fb024
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004faff4
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fb084
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fb414
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fb858
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fbc8c
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fbcdc
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fbd18
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fb8dc
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fba18
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fbad0
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fbbf8
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fbf78
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcc5c
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcd08
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fd2b4
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fd2f8
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fce20
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcf10
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcf30
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcbc0
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fcc34
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fc910
jmp 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004fd0f8
jmp 0x4fae07
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 0
jmp 0x4fae07
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 0
mov bl, 1
jmp 0x4fae07
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x1c]
and ax, 0xff
cmp ax, 9
jne 0x4fae07
mov eax, dword [ebp - 4]
call fcn.004f9df0
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x1e]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.004a88a4
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
movzx eax, word [eax + 2]
cmp eax, 0x20
jg 0x4fab66
je 0x4fad98
sub eax, 5
je 0x4fab7f
dec eax
je 0x4fac2c
sub eax, 0xa
je 0x4fac2c
jmp 0x4fae07
sub eax, 0x40
je 0x4fac2c
sub eax, 0xc0
je 0x4fadf1
jmp 0x4fae07
mov eax, dword [ebp - 4]
cmp word [eax + 0x1e], 0x100
jbe 0x4faba0
mov ecx, 0x4faf70
mov dl, 1
mov eax, dword [0x408604]
call fcn.0040d94c
call fcn.004046c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
cmp byte [eax + 0x34], 6
jb 0x4fabbd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
and eax, 0x10
cmp eax, 0x10
je 0x4fabc1
xor eax, eax
jmp 0x4fabc3
mov al, 1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
mov byte [edx + 0x54], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x98]
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov esi, dword [eax]
call dword [esi + 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
cmp word [eax + 6], 0x7ce
jne 0x4fac1b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
cmp dword [eax + 8], 0
jne 0x4fac1b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
cmp dword [eax + 0xc], 6
je 0x4fac1f
xor eax, eax
jmp 0x4fac21
mov al, 1
mov edx, dword [ebp - 4]
mov byte [edx + 0x30], al
jmp 0x4fae07
mov eax, dword [ebp - 4]
inc dword [eax + 0x18]
mov eax, dword [ebp - 4]
inc dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov ax, word [eax + 2]
sub ax, 6
je 0x4fac66
sub ax, 0xa
je 0x4fac78
sub ax, 0x30
jne 0x4fac88
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x40]
mov dl, 2
call fcn.0050a948
jmp 0x4fac88
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x40]
mov dl, 1
call fcn.0050a948
jmp 0x4fac88
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x40]
xor edx, edx
call fcn.0050a948
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x40]
call fcn.0050a864
mov byte [eax + 0x1c], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
cmp byte [eax + 0x34], 4
ja 0x4faccf
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x40]
call fcn.0050a864
mov edx, 0x4faf88
call fcn.0050dc88
jmp 0x4fad87
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004a3b7c
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x40]
call fcn.0050a864
pop edx
call fcn.0050dc88
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x18]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x40]
call fcn.0050a864
pop edx
mov byte [eax + 0x64], dl
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x40]
call fcn.0050a864
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x18]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x40]
call fcn.0050a864
mov eax, dword [eax + 0x18]
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov esi, dword [eax]
call dword [esi + 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
jmp 0x4fae07
mov eax, dword [ebp - 4]
inc dword [eax + 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
push eax
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.004a3b7c
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0xa4]
call fcn.004ecfa4
jmp 0x4fae07
mov ecx, 0x4fafa0
mov dl, 1
mov eax, dword [0x408604]
call fcn.0040d94c
call fcn.004046c4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x38], 0
je 0x4fae27
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.004c4eb4
inc dword [ebp - 0xc]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.004a88e0
cmp eax, 4
je 0x4f9f31
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4faeba
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
cmp word [eax + 0x7a], 0
je 0x4faed7
mov ebx, eax
mov ecx, 0x64
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x7c]
call dword [ebx + 0x78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4faf02
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.004a7fa4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00402b00
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4faf3f
lea eax, [ebp - 0x3c]
call fcn.00404d50
lea eax, [ebp - 0x20]
call fcn.00404d50
lea eax, [ebp - 0x1c]
call fcn.004054a8
lea eax, [ebp - 0x18]
call fcn.00404d50
lea eax, [ebp - 0x14]
call fcn.004054a8
ret