Function at 0xcf1f80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
xor eax, eax
push edi
mov ecx, 0xa
push esi
push ebx
sub esp, 0x20c
mov ebp, dword [esp + 0x224]
lea edi, [esp + 0x104]
mov dword [esp + 0x54], edi
mov ebx, dword [esp + 0x22c]
rep stosd dword es:[edi], eax
mov dword [esp + 0x1f0], 0x7fffffff
lea esi, [ebp + 0x744]
mov dword [esp + 0x84], esi
lea esi, [ebp + 0x179c]
mov dword [esp + 0x88], esi
lea esi, [ebp + 0xca0]
mov dword [esp + 0x90], esi
mov esi, dword [esp + 0x220]
mov dword [esp + 0x12c], 0
mov dword [esp + 0x130], 1
mov dword [esp + 0x134], 2
mov esi, dword [esi + 0x2b2fc]
mov dword [esp + 0x138], 3
mov dword [esp + 0x13c], 4
mov dword [esp + 0x140], 5
mov dword [esp + 0xa4], esi
mov dword [esp + 0x144], 6
mov dword [esp + 0x148], 7
mov dword [esp + 0x1f8], 0
mov dword [esp + 0x1d0], 0
mov dword [esp + 0x1d4], 0
mov dword [esp + 0x1d8], 0
mov dword [esp + 0x1dc], 0
mov dword [esp + 0x170], 0
mov dword [esp + 0x174], 0
mov dword [esp + 0x178], 0
mov dword [esp + 0x17c], 0
mov dword [esp + 0x180], 0
mov esi, dword [esp + 0x220]
mov dword [esp + 0x184], 0
mov dword [esp + 0x188], 0
mov dword [esp + 0x18c], 0
mov eax, dword [esi + 0x2b2dc]
mov dword [esp + 0x14c], 0
mov dword [esp + 0x150], 0
mov dword [esp + 0x154], 0
test al, 1
mov dword [esp + 0x158], 0
mov dword [esp + 0x15c], 0
jne 0xcf2ee0
mov dword [esp + 0x1d4], 1
test al, 2
jne 0xcf2e30
mov dword [esp + 0x1d8], 1
test al, 4
je 0xcf215c
mov esi, dword [esp + 0x220]
mov edi, dword [esi + 0x1f6cc]
test edi, edi
jne 0xcf2fd1
mov dword [esp + 0x1dc], 1
mov ebx, dword [esp + 0x220]
mov esi, dword [esp + 0x238]
mov eax, dword [esp + 0x220]
mov edx, dword [ebp + 0x1d28]
add dword [ebx + 0x1f828], 1
mov dword [esi], 0x7fffffff
mov edi, dword [ebx + 0x1f6d0]
add eax, 0x2c7dc
mov dword [ebp + 0x8174], 0
add ebx, 0x1f82c
xor esi, esi
mov dword [edx + 8], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0x5c], edi
mov edi, 0x7fffffff
mov dword [esp + 0x8c], 0x7fffffff
mov dword [esp + 0x70], 0
mov dword [esp + 0x94], 0x7fffffff
mov dword [esp + 0xa8], eax
lea esi, [esi]
cmp dword [ebx + 0xa0], edi
jge 0xcf2275
mov eax, dword [esi*4 + 0x1281920]
mov dword [esp + 0xbc], edx
mov ecx, dword [esp + eax*4 + 0x1d0]
mov dword [edx + 8], eax
test ecx, ecx
jne 0xcf2275
mov edx, dword [ebx - 0xa4]
test edx, edx
mov dword [esp + 0x58], edx
je 0xcf2368
mov edx, dword [ebx - 0xf4]
cmp edx, 1
jbe 0xcf2368
mov ecx, dword [esp + 0x220]
imul edx, dword [esp + 0x58]
cmp dword [ecx + 0x1f828], edx
ja 0xcf2368
mov edx, dword [ebx]
add edx, 4
cmp edx, 0x200
mov dword [ebx], edx
jg 0xcf2726
mov eax, dword [ebx + 0x50]
sar eax, 7
imul eax, edx
mov dword [ebx + 0xa0], eax
mov edx, dword [ebp + 0x1d28]
add esi, 1
add ebx, 4
cmp esi, 0x14
jne 0xcf21f0
mov ebx, dword [esp + 0x70]
mov esi, dword [esp + 0x220]
mov eax, dword [esi + ebx*4 + 0x1f87c]
lea ecx, [eax - 1]
cmp ecx, 0x1ffffffd
ja 0xcf22e3
add ebx, 0x7e08
mov esi, dword [esi + ebx*4 + 0xc]
mov ecx, esi
sar ecx, 3
lea edi, [ecx + 0x1f]
mov dword [esp + 0x74], edi
mov edi, esi
sub edi, ecx
mov ecx, 0x20
cmp esi, dword [esp + 0x74]
mov esi, dword [esp + 0x220]
cmovg ecx, edi
mov edi, dword [esp + 0x70]
sar eax, 7
imul eax, ecx
mov dword [esi + ebx*4 + 0xc], ecx
mov dword [esi + edi*4 + 0x1f8cc], eax
mov ebx, dword [esp + 0x234]
mov eax, 0x3ff
mov ecx, dword [ebx]
sar ecx, 7
cmp ecx, 0x3ff
cmovle eax, ecx
mov ecx, dword [esp + 0x5c]
add dword [esi + eax*4 + 0x2b36c], 1
test ecx, ecx
je 0xcf2695
cmp dword [esp + 0x14c], 7
je 0xcf2687
mov ebx, dword [esp + 0x220]
mov dword [edx + 0xc], 0
mov eax, dword [ebp + 0x1d28]
mov dword [edx], 7
mov dword [edx + 8], 3
mov edx, dword [ebx + 0x1ce24]
mov dword [eax + 4], 0
test edx, edx
setne byte [eax + 0x11]
mov eax, dword [ebp + 0x1d28]
mov byte [eax + 0x10], 0
add esp, 0x20c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esp + 0x58]
mov dword [esp + 0x1ec], 0
add edx, 1
test eax, eax
mov dword [ebx - 0xa4], edx
mov edx, dword [esi*4 + 0x1281980]
mov dword [esp + 0x58], edx
mov edx, dword [ebp + 0x1d28]
mov ecx, dword [esp + 0x58]
mov dword [edx], ecx
mov ecx, dword [esp + 0xbc]
mov dword [ecx + 4], 0
mov ecx, dword [ebp + eax*4 + 0x1d78]
mov dword [esp + 0x60], ecx
jne 0xcf2600
mov eax, dword [esp + 0x5c]
test eax, eax
je 0xcf2510
mov eax, dword [esp + 0x220]
mov eax, dword [eax + 0x1f65c]
test eax, eax
jne 0xcf2510
cmp dword [esp + 0x58], 7
jne 0xcf2275
mov ecx, dword [esp + 0xbc]
cmp dword [ecx + 8], 3
jne 0xcf2275
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x58]
movzx eax, word [esp + edx*4 + 0x104]
sar ax, 3
cwde
cmp eax, dword [ebp + 0x8168]
jl 0xcf277b
cmp eax, dword [ebp + 0x816c]
jg 0xcf25d3
mov edx, dword [esp + 0x58]
movzx eax, word [esp + edx*4 + 0x106]
sar ax, 3
cwde
cmp eax, dword [ebp + 0x8160]
jl 0xcf277b
cmp eax, dword [ebp + 0x8164]
jg 0xcf25d3
lea edx, [esp + 0x160]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp], edx
call fcn.00d162f0
mov ecx, dword [esp + 0x3c]
add eax, ecx
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x80], eax
mov eax, dword [ebp + 0x1d28]
mov edx, dword [esp + ecx*4 + 0x104]
cmp ecx, 8
mov dword [eax + 0xc], edx
jne 0xcf31b6
mov eax, dword [esp + 0xa4]
test eax, eax
je 0xcf31b6
mov eax, dword [esp + 0x220]
mov edx, dword [esp + 0x1ec]
cmp dword [eax + 0x1ce30], 1
je 0xcf31b6
mov eax, dword [esp + 0x80]
imul eax, dword [ebp + 0x20c8]
imul edx, dword [ebp + 0x20c4]
mov ecx, dword [esp + 0x220]
sub eax, 0xffffff80
sar eax, 8
add edx, eax
mov eax, dword [ecx + 0x2c3a0]
test eax, eax
je 0xcf316f
mov eax, dword [ebp + 0x8180]
cmp byte [eax], 0
jne 0xcf316f
mov dword [ebp + 0x8174], 1
jmp 0xcf2940
cmp dword [esp + 0x58], 8
jbe 0xcf25f0
mov eax, dword [esp + 0x60]
mov edx, 0x7fffffff
mov dword [esp + 0x80], eax
mov eax, dword [ebp + 0x8174]
test eax, eax
je 0xcf2736
mov ecx, dword [esp + 0x80]
mov edi, dword [esp + 0x230]
mov eax, dword [esp + 0x1ec]
mov dword [esp + 0x70], esi
mov dword [edi], ecx
mov edi, dword [esp + 0x234]
mov dword [edi], eax
mov eax, dword [ebp + 0x1d28]
mov edi, dword [esp + 0x1f0]
mov ecx, dword [eax]
mov dword [esp + 0x8c], edi
mov dword [esp + 0x14c], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x150], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x154], ecx
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x158], ecx
mov ecx, dword [ebx]
mov eax, dword [eax + 0x10]
cmp ecx, 0x22
lea edi, [ecx - 2]
mov ecx, dword [ebx + 0x50]
mov dword [esp + 0x15c], eax
mov eax, 0x20
cmovge eax, edi
mov edi, edx
mov dword [ebx], eax
sar ecx, 7
imul eax, ecx
mov dword [ebx + 0xa0], eax
mov eax, dword [ebp + 0x8174]
test eax, eax
jne 0xcf3153
mov eax, dword [esp + 0x220]
mov edx, dword [ebp + 0x1d28]
mov eax, dword [eax + 0x1f6d0]
mov dword [esp + 0x5c], eax
jmp 0xcf2275
mov edx, dword [esp + 0x58]
jmp dword [edx*4 + 0x127dba0]
mov ecx, dword [esp + eax*4 + 0x1a0]
mov dword [ebp + 0x1cc8], ecx
mov ecx, dword [esp + eax*4 + 0x1b0]
mov dword [ebp + 0x1ccc], ecx
mov ecx, dword [esp + eax*4 + 0x1c0]
mov dword [ebp + 0x1cd0], ecx
mov ecx, dword [esp + eax*4 + 0x170]
mov dword [esp + 0x118], ecx
mov ecx, dword [esp + eax*4 + 0x180]
mov dword [esp + 0x11c], ecx
mov ecx, dword [esp + eax*4 + 0x190]
shl eax, 4
lea eax, [esp + eax + 0xc4]
mov dword [esp + 0x1e0], ecx
mov ecx, dword [eax]
mov dword [esp + 0x160], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x164], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x168], ecx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x16c], eax
jmp 0xcf23b8
cmp dword [esp + 0x154], 3
jne 0xcf231f
mov eax, dword [esp + 0x14c]
mov dword [edx], eax
mov eax, dword [esp + 0x150]
cmp dword [esp + 0x14c], 4
mov dword [edx + 4], eax
mov eax, dword [esp + 0x154]
mov dword [edx + 8], eax
mov eax, dword [esp + 0x158]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x15c]
mov dword [edx + 0x10], eax
jbe 0xcf2fb3
mov eax, dword [ebp + 0x1d28]
cmp dword [eax], 8
mov edx, dword [eax + 8]
jne 0xcf235d
lea ecx, [esp + edx*4 + 0x190]
movsx edx, word [eax + 0xc]
movsx ebx, word [ecx]
mov esi, dword [esp + 0x220]
sub edx, ebx
sar edx, 1
add dword [esi + edx*4 + 0x24b1c], 1
movsx eax, word [eax + 0xe]
movsx edx, word [ecx + 2]
sub eax, edx
sar eax, 1
add dword [esi + eax*4 + 0x26b18], 1
add esp, 0x20c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebx], 0x200
mov edx, 0x200
jmp 0xcf2260
mov edx, dword [ebx]
add edx, 4
cmp edx, 0x200
mov dword [ebx], edx
jle 0xcf2750
mov dword [ebx], 0x200
mov edx, 0x200
mov eax, dword [ebx + 0x50]
sar eax, 7
imul eax, edx
mov dword [ebx + 0xa0], eax
jmp 0xcf25c5
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x58]
mov eax, dword [esp + edx*4 + 0x104]
test eax, eax
jne 0xcf23fd
mov ecx, dword [esp + 0x220]
mov edx, dword [ebp + 0x1d28]
mov ecx, dword [ecx + 0x1f6d0]
mov dword [esp + 0x5c], ecx
jmp 0xcf2275
mov ecx, dword [esp + 0x8c]
lea edx, [esp + 0x1ec]
mov eax, dword [esp + 0x220]
mov dword [esp], edx
mov edx, ebp
mov dword [esp + 0x1ec], ecx
lea ecx, [esp + 0x1e8]
add eax, 0x2c7d8
call fcn.00cf1a00
cmp dword [esp + 0x1ec], 0x7fffffff
je case.default.0xcf25f4
mov eax, dword [esp + 0x60]
add eax, dword [esp + 0x1e8]
mov dword [esp + 0xc], 0x10
mov edx, dword [esp + 0x220]
mov dword [esp + 0x80], eax
lea eax, [esp + 0x1f0]
mov dword [esp + 0x10], eax
lea eax, [ebp + 0xfc0]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x770]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x768]
mov eax, dword [eax]
mov dword [esp], eax
call dword [edx + 0x2c800]
mov dword [esp + 0x58], eax
mov edx, dword [esp + 0x58]
mov dword [esp + 0x1ec], eax
mov eax, dword [esp + 0x80]
imul eax, dword [ebp + 0x20c8]
imul edx, dword [ebp + 0x20c4]
sub eax, 0xffffff80
sar eax, 8
add edx, eax
cmp edx, dword [esp + 0x94]
jge 0xcf2940
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x238]
mov dword [esp + 0x94], edx
mov dword [ecx], eax
jmp 0xcf2940
mov edx, dword [esp + 0x90]
mov ecx, dword [esp + 0x220]
mov dword [esp], edx
call dword [ecx + 0x1e8b0]
lea eax, [esp + 0x1f0]
mov edx, dword [esp + 0x220]
mov dword [esp + 0x10], eax
lea eax, [ebp + 0xfc0]
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x770]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x768]
mov eax, dword [eax]
mov dword [esp], eax
call dword [edx + 0x2c800]
mov edx, dword [ebp + 0x1d28]
mov ecx, dword [edx]
mov dword [esp + 0x58], eax
mov edx, dword [esp + 0x58]
mov dword [esp + 0x1ec], eax
mov eax, dword [ebp + 0x1d30]
imul edx, dword [ebp + 0x20c4]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2]
mov ecx, dword [esp + 0x60]
add ecx, dword [ebp + eax*4 + 0x70e8]
mov eax, dword [ebp + 0x20c8]
mov dword [esp + 0x80], ecx
imul eax, ecx
sub eax, 0xffffff80
sar eax, 8
add edx, eax
cmp edx, dword [esp + 0x94]
jge 0xcf2940
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x238]
mov dword [esp + 0x94], edx
mov dword [eax], ecx
cmp edx, edi
jl 0xcf2539
jmp 0xcf252b
movzx eax, word [esp + 0x1e2]
mov edx, dword [ebp + 0x20bc]
mov ecx, eax
sar cx, 3
test al, 7
setne al
mov word [esp + 0x40], cx
movzx eax, al
movsx ecx, cx
lea eax, [ecx + eax - 0xff]
mov dword [esp + 0x74], eax
movzx eax, word [esp + 0x1e0]
mov dword [esp + 0x98], edx
mov edx, eax
sar dx, 3
test al, 7
setne al
add ecx, 0xff
mov dword [esp + 0x80], ecx
mov ecx, dword [ebp + 0x8160]
movzx eax, al
mov word [esp + 0x78], dx
movsx edx, dx
lea eax, [edx + eax - 0xff]
add edx, 0xff
mov dword [esp + 0x9c], edx
mov edx, dword [ebp + 0x8164]
mov dword [esp + 0xac], ecx
mov ecx, dword [ebp + 0x8168]
mov dword [esp + 0x7c], eax
mov eax, 1
mov dword [esp + 0xb0], edx
mov edx, dword [ebp + 0x816c]
mov dword [esp + 0xb4], ecx
mov ecx, dword [esp + 0x220]
mov dword [esp + 0xb8], edx
mov edx, dword [ecx + 0x2b25c]
cmp edx, 5
jle 0xcf2a1f
xor eax, eax
cmp edx, 8
setge al
add eax, 2
mov edx, dword [esp + 0x220]
mov ecx, dword [edx + 0x2b358]
mov edx, dword [edx + 0x2b368]
add ecx, eax
test edx, edx
mov dword [esp + 0x5c], ecx
je 0xcf2f86
mov ecx, dword [esp + 0xa0]
lea edx, [esp + 0x12c]
test ecx, ecx
je 0xcf3068
mov dword [esp + 0x1c], edx
lea edx, [esp + 0x1f8]
mov ecx, dword [esp + 0xbc]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x220]
add edx, 0x1dba4
mov dword [esp + 0x14], edx
mov edx, dword [ecx + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x220]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x10], edx
lea edx, [esp + 0x1f4]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x90]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.00d163c0
mov eax, dword [esp + 0x3c]
add eax, dword [esp + 0x1f8]
cmp dword [esp + 0x5c], eax
mov dword [esp + 0x1f8], eax
cmovge eax, dword [esp + 0x5c]
mov dword [esp + 0x5c], eax
movzx eax, word [esp + 0x1f6]
sar ax, 3
mov word [esp + 0x1fe], ax
movzx eax, word [esp + 0x1f4]
sar ax, 3
mov word [esp + 0x1fc], ax
mov ecx, dword [esp + 0x74]
cmp ecx, dword [ebp + 0x8160]
jle 0xcf2b0a
mov dword [ebp + 0x8160], ecx
mov eax, dword [esp + 0x80]
cmp eax, dword [ebp + 0x8164]
jge 0xcf2b1f
mov dword [ebp + 0x8164], eax
mov edx, dword [esp + 0x7c]
cmp edx, dword [ebp + 0x8168]
jle 0xcf2b31
mov dword [ebp + 0x8168], edx
mov ecx, dword [esp + 0x9c]
cmp ecx, dword [ebp + 0x816c]
jge 0xcf2b46
mov dword [ebp + 0x816c], ecx
mov eax, dword [esp + 0x220]
xor ecx, ecx
cmp dword [eax + 0x2b25c], 7
jg 0xcf2b64
mov ecx, dword [esp + 0x5c]
not ecx
add ecx, dword [eax + 0x2b354]
mov edx, dword [esp + 0x220]
cmp dword [edx + 0x2b2e4], 2
je 0xcf30c2
mov eax, edx
lea edx, [ebp + 0x60d8]
add eax, 0x2c4c8
mov dword [esp + 0x80], edx
lea edx, [ebp + 0x17cc]
mov dword [esp + 0x78], edx
lea edx, [esp + 0x1e0]
mov dword [esp + 0x40], edx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x80]
mov dword [esp + 0x7c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1e4]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1fc]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x98]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x3c], ecx
mov dword [esp], ebp
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], eax
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x78]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x88]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x220]
call dword [edx + 0x2c424]
mov edx, dword [esp + 0x1e4]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x1e4], 0
cmp ecx, edx
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x17cc]
mov dword [esp + 0x124], eax
jle 0xcf2d27
mov dword [esp + 0x9c], edi
xor eax, eax
mov edi, edx
mov dword [esp + 0xbc], esi
mov esi, ebx
mov ebx, ecx
jmp 0xcf2c79
sub eax, 1
mov dword [esp + 0x1e4], eax
cmp edi, ebx
je 0xcf2d17
mov eax, dword [esp + 0x1e4]
add edi, 1
test eax, eax
jne 0xcf2c60
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x1e4]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x5c]
mov dword [esp], ebp
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x98]
add eax, edi
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1fc]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x88]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x84]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x220]
mov dword [esp + 4], ecx
call dword [edx + 0x2c424]
cmp dword [esp + 0x74], eax
jle 0xcf2e17
mov edx, dword [ebp + 0x17cc]
cmp edi, ebx
mov dword [esp + 0x74], eax
mov dword [esp + 0x124], edx
jne 0xcf2c72
mov ebx, esi
mov edi, dword [esp + 0x9c]
mov esi, dword [esp + 0xbc]
mov ecx, dword [esp + 0xac]
mov edx, dword [esp + 0xb0]
cmp dword [esp + 0x74], 0x7fffffff
mov dword [ebp + 0x8160], ecx
mov ecx, dword [esp + 0xb4]
mov dword [ebp + 0x8164], edx
mov edx, dword [esp + 0xb8]
mov dword [ebp + 0x8168], ecx
mov ecx, dword [esp + 0x220]
mov dword [ebp + 0x816c], edx
lea edx, [ecx + 0x168d8]
je 0xcf2ddc
mov ecx, dword [esp + 0x7c]
lea eax, [esp + 0x1f0]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1ec]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x40]
mov eax, dword [ebp + 0x20b8]
mov dword [esp + 0x38], edx
mov dword [esp], ebp
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x84]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x220]
call dword [ecx + 0x2c418]
mov edx, dword [esp + 0x38]
mov eax, dword [ebp + 0x17cc]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 0x124], eax
lea eax, [esp + 0x124]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00ce73d0
mov ecx, dword [esp + 0x60]
add ecx, eax
jmp 0xcf2768
mov eax, dword [esp + 0x124]
mov dword [ebp + 0x17cc], eax
jmp 0xcf2c6a
mov esi, dword [esp + 0x220]
mov edi, dword [esp + 0x90]
imul eax, dword [esi + 0x1cd84], 0x3c
mov dword [esp + 0x18], 2
lea esi, [esi + eax + 0x1cc7c]
mov eax, dword [esp + 0x220]
add eax, 0x1dba4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xe4]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x198]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x188]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x178]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x1d28]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00d10d50
mov eax, dword [esp + 0x228]
add eax, dword [esi + 0x18]
mov dword [esp + 0x1a8], eax
mov eax, dword [esi + 0x1c]
add eax, ebx
mov dword [esp + 0x1b8], eax
mov eax, dword [esi + 0x20]
mov esi, dword [esp + 0x220]
add eax, ebx
mov dword [esp + 0x1c8], eax
mov eax, dword [esi + 0x2b2dc]
jmp 0xcf2143
imul eax, dword [esi + 0x1cd80], 0x3c
mov edi, dword [esp + 0x90]
mov dword [esp + 0x18], 1
lea esi, [esi + eax + 0x1cc7c]
mov eax, dword [esp + 0x220]
add eax, 0x1dba4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xd4]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x194]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x184]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x174]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x1d28]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00d10d50
mov eax, dword [esp + 0x228]
add eax, dword [esi + 0x18]
mov dword [esp + 0x1a4], eax
mov eax, dword [esi + 0x1c]
add eax, ebx
mov dword [esp + 0x1b4], eax
mov eax, dword [esi + 0x20]
mov esi, dword [esp + 0x220]
add eax, ebx
mov dword [esp + 0x1c4], eax
mov eax, dword [esi + 0x2b2dc]
jmp 0xcf2130
mov eax, dword [esp + 0x1e0]
movzx edx, word [esp + 0x78]
mov dword [esp + 0x1f4], eax
movzx eax, word [esp + 0x40]
mov word [esp + 0x1fc], dx
mov word [esp + 0x1fe], ax
jmp 0xcf2af8
mov eax, ebp
call fcn.00cf0f50
mov eax, dword [ebp + 0x1d28]
cmp dword [eax], 8
mov edx, dword [eax + 8]
jne 0xcf235d
jmp 0xcf26e6
imul eax, dword [esi + 0x1cd88], 0x3c
mov edi, dword [esp + 0x90]
mov dword [esp + 0x18], 3
lea esi, [esi + eax + 0x1cc7c]
mov eax, dword [esp + 0x220]
add eax, 0x1dba4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xf4]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x19c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x18c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x17c]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x1d28]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00d10d50
mov eax, dword [esp + 0x228]
add eax, dword [esi + 0x18]
mov dword [esp + 0x1ac], eax
mov eax, dword [esi + 0x1c]
add eax, ebx
add ebx, dword [esi + 0x20]
mov dword [esp + 0x1bc], eax
mov dword [esp + 0x1cc], ebx
jmp 0xcf2167
mov ecx, dword [esp + 0x228]
mov dword [esp + 0x10], edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x90]
mov dword [esp + 8], ebp
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x220]
mov dword [esp], ecx
call fcn.00d169b0
mov ecx, dword [ebp + 0x1d28]
mov dword [esp + 0xa0], 1
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xbc], ecx
jmp 0xcf2a56
lea ecx, [esp + 0x1e0]
add edx, 0x2c4c8
mov dword [esp + 0x40], ecx
lea eax, [ebp + 0x60d8]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x24], eax
lea eax, [ebp + 0x70e0]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1fc]
mov dword [esp + 0x7c], edx
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x98]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x88]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x84]
mov dword [esp], ebp
mov dword [esp + 0x18], edx
lea edx, [ebp + 0x17cc]
mov dword [esp + 0x78], edx
mov dword [esp + 0x10], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call fcn.00ceb0c0
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x17cc]
mov dword [esp + 0x124], eax
jmp 0xcf2d27
mov ebx, dword [esp + 0x220]
mov edx, dword [ebp + 0x1d28]
mov ebx, dword [ebx + 0x1f6d0]
mov dword [esp + 0x5c], ebx
jmp 0xcf2284
mov eax, dword [esp + 0x1f0]
cmp dword [ebp + 0x8178], eax
jbe 0xcf2940
mov ecx, dword [esp + 0xa8]
mov dword [esp + 0x38], edx
mov dword [esp], ebp
mov dword [esp + 4], ecx
call fcn.00d16160
mov edx, dword [esp + 0x38]
add eax, eax
cmp eax, dword [ebp + 0x8178]
setl al
movzx eax, al
mov dword [ebp + 0x8174], eax
jmp 0xcf2940
mov edx, dword [esp + 0x220]
mov ecx, dword [esp + 0x58]
mov edx, dword [edx + 0x2c4cc]
lea eax, [esp + ecx*4 + 0x104]
mov ecx, dword [ebp + 0x770]
mov dword [esp + 0x98], edx
movzx edx, word [eax]
movzx eax, word [eax + 2]
mov dword [esp + 0x74], ecx
mov word [esp + 0x60], dx
mov word [esp + 0x40], ax
mov eax, dword [ebp + 0x768]
mov edx, dword [eax]
mov eax, dword [ebp + 0x17b0]
add edx, dword [ebp + 0x76c]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x17b8]
add ecx, dword [ebp + 0x17b4]
mov dword [esp + 0x5c], eax
movzx eax, word [esp + 0x40]
and eax, 7
mov dword [esp + 0x78], eax
movzx eax, word [esp + 0x60]
and eax, 7
mov dword [esp + 0x7c], eax
movzx eax, word [esp + 0x60]
sar ax, 3
cwde
imul eax, dword [esp + 0x5c]
mov dword [esp + 0x60], eax
movzx eax, word [esp + 0x40]
sar ax, 3
cwde
add eax, dword [esp + 0x60]
add eax, ecx
mov ecx, dword [esp + 0x7c]
or ecx, dword [esp + 0x78]
lea ecx, [esp + 0x1f0]
jne 0xcf3292
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x5c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x74]
mov dword [esp], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
call dword [esp + 0x98]
mov edx, eax
mov dword [esp + 0x1ec], edx
jmp 0xcf24ba
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x7c]
mov dword [esp], eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x220]
mov dword [esp + 4], edx
call dword [ecx + 0x2c4d0]
mov edx, eax
jmp 0xcf3286