Function at 0x471d40
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x4088
call fcn.00497490
sub esp, eax
mov edi, ecx
mov eax, dword [esp + eax]
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ecx
mov esi, eax
mov dword [esp + 0x30], eax
movzx eax, byte [eax + 0x98]
movzx ebp, byte [esi + 0x9a]
mov byte [esp + 0x40], al
mov eax, dword [esi + 0x94]
mov dword [esp + 0x44], eax
movzx eax, byte [esi + 0x99]
mov byte [esp + 0x3c], al
mov eax, dword [esp + 0x40a0]
mov dword [eax], 0
mov dword [esp], 0x576840
call fcn.0046fc60
test edi, edi
je 0x4731c9
lea eax, [esp + 0x80]
mov dword [esp + 0x34], 0
xor edi, edi
mov ebx, ebp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x34]
mov edx, dword [eax + esi*8]
mov eax, dword [eax + esi*8 + 4]
mov dword [esp + 0x28], eax
mov eax, dword [0x53e040]
mov dword [esp + 0x24], edx
test eax, eax
jne 0x471deb
test edx, edx
jne 0x4720d5
mov eax, dword [esp + 0x24]
xor ebp, ebp
test eax, eax
je 0x471e97
mov edx, ebx
movzx ebx, byte [esp + 0x40]
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x44]
nop
lea esi, [esi]
mov eax, dword [esp + 0x28]
test bl, bl
movzx eax, byte [eax + ebp]
jne 0x471ed0
test al, al
jne 0x471f40
test dl, dl
je 0x472250
cmp dl, 2
mov edi, 0xfffd
je 0x473441
test dl, 4
je 0x471f00
mov ebx, edx
and ebx, 0x10
jne 0x4720c5
lea eax, [edi - 0x30]
cmp eax, 9
ja 0x472070
mov eax, dword [esp + 0x30]
test dl, 0x20
movzx eax, byte [eax + 0x9b]
jne 0x472270
cmp al, 3
jbe 0x4722f8
or edx, 0x10
lea esi, [esi]
add ebp, 1
cmp dword [esp + 0x24], ebp
ja 0x471e10
mov dword [esp + 0x44], edi
mov edi, dword [esp + 0x2c]
mov byte [esp + 0x40], bl
mov ebx, edx
add dword [esp + 0x34], 1
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x4c], eax
jne 0x471dc3
mov eax, dword [esp + 0x30]
mov ebp, ebx
mov dword [esp + 0x50], 0
add eax, 0x90
mov dword [esp + 0x24], eax
jmp 0x47219b
mov ecx, eax
and ecx, 0xffffffc0
cmp cl, 0x80
je 0x471fc0
sub ebp, 1
test dl, dl
je 0x471f80
cmp dl, 2
je 0x471f80
test dl, 4
mov edi, 0xfffd
jne 0x471e47
test dl, 8
je 0x473430
mov ebx, edx
and ebx, 0x40
je 0x472010
test dl, dl
js 0x472260
cmp edi, 0x22
je 0x4722e0
mov eax, edx
xor ebx, ebx
or edx, 0xffffff80
cmp edi, 0x5c
cmovne edx, eax
jmp 0x471e80
mov ecx, eax
mov ebx, 0x1f
movzx edi, al
not ecx
movzx ecx, cl
bsr ecx, ecx
xor ecx, 0x1f
sub ebx, ecx
cmp ebx, 7
je 0x471fd3
cmp ebx, 5
ja 0x471ee1
sub ecx, 0x17
mov esi, 0xff
sar esi, cl
and esi, eax
mov eax, 6
sub eax, ebx
mov edi, esi
mov ebx, eax
jmp 0x471e80
mov ebx, 0xfffffffd
mov edi, 0xfffd
cmp dword [esp + 0x2c], 0x2000
je 0x472040
mov esi, dword [esp + 0x2c]
mov eax, esi
add esi, 1
mov dword [esp + 0x2c], esi
mov word [esp + eax*2 + 0x80], bx
xor edx, edx
xor ebx, ebx
mov byte [esp + 0x3c], 0
jmp 0x471e80
shl edi, 6
and eax, 0x3f
or eax, edi
sub bl, 1
mov edi, eax
jne 0x471e80
test dl, dl
jne 0x4723f3
cmp edi, 0x1b
je 0x472003
cmp edi, 0x9b
jne 0x473435
mov eax, dword [esp + 0x30]
xor ebx, ebx
mov edx, 4
mov byte [eax + 0x9b], 0
jmp 0x471e80
xor ebx, ebx
mov edx, 2
jmp 0x471e80
cmp edi, 7
je case.0x4720ae.73
cmp edi, 0x5c
je 0x4720b5
cmp edi, 0x1b
je 0x4722f0
cmp edi, 0x22
je 0x47231b
and edx, 0xfffffffd
jmp 0x471e80
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x40a0]
mov ecx, 0x2000
mov edx, dword [esp + 0x38]
add eax, 0x90
mov dword [esp], esi
call fcn.00471900
mov dword [esp + 0x2c], 1
xor eax, eax
jmp 0x471fa5
cmp edi, 0x3b
je 0x4722a0
cmp edi, 0x3f
je 0x47232e
lea eax, [edi - 0x40]
cmp eax, 0x3e
ja 0x471e7a
mov eax, dword [esp + 0x30]
movzx ecx, byte [eax + 0x9b]
test cl, cl
jne 0x4720a6
cmp edi, 0x5b
je 0x471e7a
lea eax, [edi - 0x41]
cmp eax, 0x34
ja case.0x4720ae.73
jmp dword [eax*4 + 0x547aa8]
test dl, 2
je 0x472034
xor edx, edx
jmp 0x471e80
lea eax, [edi - 0x40]
xor ebx, ebx
cmp eax, 0x3f
cmovb edx, ebx
jmp 0x471e80
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
call esi
sub esp, 0x18
test eax, eax
mov edi, eax
je 0x47319e
lea edx, [eax + eax + 2]
xor eax, eax
cmp edx, 0x2000
mov dword [esp + 0x2c], edx
seta al
mov dword [esp + 0x50], eax
ja 0x4723c0
mov eax, dword [esp + 0x38]
mov dword [esp + 0x14], edi
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
call esi
sub esp, 0x18
mov esi, dword [esp + 0x30]
add esi, 0x90
test eax, eax
mov dword [esp + 0x24], esi
jne 0x47234d
cmp dword [esp + 0x2c], 0x2000
mov ebp, ebx
ja 0x4723e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x40a0]
mov dword [esi], eax
mov eax, ebp
mov ebp, dword [esp + 0x38]
xor esi, esi
mov byte [esp + 0x28], al
mov esi, esi
lea edi, [edi]
mov ebx, edi
mov eax, 0x2000
lea edx, [ebp + esi*2]
sub ebx, esi
cmp ebx, 0x2000
cmova ebx, eax
mov eax, dword [esp + 0x40a0]
mov ecx, ebx
add esi, ebx
mov dword [esp], eax
mov eax, dword [esp + 0x24]
call fcn.00471900
cmp edi, esi
ja 0x4721b0
mov edx, dword [esp + 0x50]
movzx ebp, byte [esp + 0x28]
test edx, edx
jne 0x4723d1
movzx eax, byte [esp + 0x40]
mov edi, dword [esp + 0x30]
mov byte [edi + 0x98], al
mov eax, dword [esp + 0x44]
mov dword [edi + 0x94], eax
movzx eax, byte [esp + 0x3c]
mov byte [edi + 0x99], al
mov eax, ebp
mov byte [edi + 0x9a], al
mov dword [esp], 0x576840
call fcn.0046fc20
mov eax, dword [esp + 0x40a0]
mov eax, dword [eax]
test eax, eax
setne al
add esp, 0x408c
movzx eax, al
pop ebx
neg eax
pop esi
pop edi
pop ebp
ret
mov edi, 0xfffd
mov ebx, edi
jmp 0x471f8a
and edx, 0x7f
xor ebx, ebx
jmp 0x471e80
mov esi, dword [esp + 0x30]
lea ecx, [esi + eax*2]
movzx eax, word [ecx + 0x9a]
lea eax, [eax + eax*4]
add eax, eax
cmp eax, 0xffff
jg 0x471e7a
lea eax, [eax + edi - 0x30]
mov word [ecx + 0x9a], ax
jmp 0x471e80
test dl, 0x20
jne 0x472326
mov eax, dword [esp + 0x30]
movzx eax, byte [eax + 0x9b]
cmp al, 3
ja 0x471e7a
mov esi, dword [esp + 0x30]
add eax, 1
xor ecx, ecx
mov byte [esi + 0x9b], al
movzx eax, al
mov word [esi + eax*2 + 0x9a], cx
jmp 0x471e80
and edx, 0xffffffbf
xor ebx, ebx
jmp 0x471e80
or edx, 2
jmp 0x471e80
mov esi, dword [esp + 0x30]
add eax, 1
lea ecx, [edi - 0x30]
or edx, 0x20
mov byte [esi + 0x9b], al
movzx eax, al
mov word [esi + eax*2 + 0x9a], cx
jmp 0x471e80
and edx, 0x7d
or edx, 0x40
jmp 0x471e80
and edx, 0xffffffdf
jmp 0x471e80
test dl, 0x20
jne 0x471e7a
mov eax, dword [esp + 0x30]
cmp byte [eax + 0x9b], 0
jne 0x471e7a
jmp 0x471e80
xor esi, esi
mov ebp, 0x2000
mov byte [esp + 0x28], bl
nop
lea esi, [esi]
mov eax, dword [esp + 0x38]
mov ebx, edi
sub ebx, esi
cmp ebx, 0x2000
lea edx, [eax + esi*2]
mov eax, dword [esp + 0x40a0]
cmova ebx, ebp
mov ecx, ebx
add esi, ebx
mov dword [esp], eax
mov eax, dword [esp + 0x24]
call fcn.00471900
cmp edi, esi
ja 0x472360
xor edi, edi
cmp dword [esp + 0x2c], 0x2000
movzx ebx, byte [esp + 0x28]
jbe 0x471e97
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.004559d0
lea eax, [esp + 0x80]
mov dword [esp + 0x38], eax
jmp 0x471e97
mov dword [esp], edx
call fcn.004559c0
mov dword [esp + 0x38], eax
jmp 0x472136
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.004559d0
jmp 0x4721f2
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.004559d0
jmp 0x47218c
cmp dl, 2
jne 0x471e3e
lea eax, [edi - 0x1b]
cmp eax, 0x48
ja case.0x472408.28
jmp dword [eax*4 + 0x547b7c]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00471900
cmp ebp, edi
ja 0x47242c
mov ecx, dword [esp + 0x40a0]
mov eax, dword [esp + 0x30]
xor edx, edx
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x50]
call fcn.00471c80
xor edx, edx
mov dword [esp + 0x2c], 0
jmp 0x471e80
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00471900
cmp ebp, edi
ja 0x4724a6
mov ecx, dword [esp + 0x40a0]
mov eax, dword [esp + 0x30]
xor edx, edx
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x50]
call fcn.00471050
xor edx, edx
mov dword [esp + 0x2c], 0
jmp 0x471e80
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00471900
cmp ebp, edi
ja 0x472520
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x50]
movzx eax, byte [eax + 0x9b]
test al, al
jne 0x4731f7
movzx eax, byte [0x53e044]
mov byte [esp + 0x2c], al
movzx eax, byte [0x57683f]
mov byte [esp + 0x40], al
movzx eax, byte [0x57683e]
mov byte [esp + 0x50], al
movzx eax, byte [0x57683d]
mov esi, eax
movzx eax, byte [0x57683c]
mov byte [esp + 0x44], al
cmp byte [esp + 0x2c], 0xff
jne 0x4725da
cmp byte [esp + 0x40], 0xff
jne 0x4725da
cmp byte [esp + 0x50], 0xff
mov eax, esi
sete dl
cmp al, 0xff
sete al
test dl, al
je 0x4725d0
cmp byte [esp + 0x44], 0xff
je 0x472720
mov byte [esp + 0x40], 0xff
mov byte [esp + 0x2c], 0xff
lea eax, [esp + 0x6a]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x90]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
sub esp, 8
test eax, eax
je 0x47341c
movzx eax, word [esp + 0x72]
test ah, 0x40
je 0x472626
mov edx, eax
mov ecx, eax
shr ax, 4
and edx, 0xf
xor cl, cl
and eax, 0xf
shl edx, 4
or edx, ecx
or eax, edx
mov word [esp + 0x72], ax
movzx edx, byte [esp + 0x2c]
cmp dl, 0xff
je 0x47265e
and eax, 0xfffffff8
and edx, 1
je 0x47263b
or eax, 4
test byte [esp + 0x2c], 2
mov word [esp + 0x72], ax
je 0x47264f
or eax, 2
mov word [esp + 0x72], ax
test byte [esp + 0x2c], 4
je 0x47265e
or eax, 1
mov word [esp + 0x72], ax
movzx edx, byte [esp + 0x50]
cmp dl, 0xff
je 0x472678
test dl, dl
je 0x47336a
or eax, 8
mov word [esp + 0x72], ax
movzx edx, byte [esp + 0x40]
cmp dl, 0xff
je 0x4726b0
and eax, 0xffffff8f
and edx, 1
je 0x47268d
or eax, 0x40
test byte [esp + 0x40], 2
mov word [esp + 0x72], ax
je 0x4726a1
or eax, 0x20
mov word [esp + 0x72], ax
test byte [esp + 0x40], 4
je 0x4726b0
or eax, 0x10
mov word [esp + 0x72], ax
mov edx, esi
cmp dl, 0xff
je 0x4726c6
test dl, dl
je 0x473377
or al, 0x80
mov word [esp + 0x72], ax
cmp byte [esp + 0x44], 0xff
je 0x473351
cmp byte [esp + 0x44], 0
je 0x473344
or ah, 0x40
mov edx, eax
mov ecx, eax
shr ax, 4
and edx, 0xf
xor cl, cl
and eax, 0xf
shl edx, 4
or edx, ecx
or eax, edx
mov word [esp + 0x72], ax
movzx eax, ax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x90]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
sub esp, 8
test eax, eax
je 0x47341c
xor edx, edx
mov dword [esp + 0x2c], 0
jmp 0x471e80
xor edx, edx
cmp cl, 1
jne 0x471e80
mov eax, dword [esp + 0x30]
cmp word [eax + 0x9c], 0x19
jne 0x471e80
add eax, 0x90
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x2c]
mov edx, 0x2000
mov ecx, dword [esp + 0x40a0]
sub esi, eax
cmp esi, 0x2000
mov dword [esp], ecx
cmova esi, edx
mov edx, dword [esp + 0x38]
mov ecx, esi
lea edx, [edx + eax*2]
mov eax, dword [esp + 0x44]
call fcn.00471900
add dword [esp + 0x40], esi
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x2c], eax
ja 0x47275d
mov ecx, dword [esp + 0x40a0]
mov eax, dword [esp + 0x44]
xor edx, edx
call fcn.0053d800
xor edx, edx
mov dword [esp + 0x2c], 0
jmp 0x471e80
xor edx, edx
cmp cl, 1
jne 0x471e80
mov eax, dword [esp + 0x30]
cmp word [eax + 0x9c], 0x19
jne 0x471e80
add eax, 0x90
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x2c]
mov edx, 0x2000
mov ecx, dword [esp + 0x40a0]
sub esi, eax
cmp esi, 0x2000
mov dword [esp], ecx
cmova esi, edx
mov edx, dword [esp + 0x38]
mov ecx, esi
lea edx, [edx + eax*2]
mov eax, dword [esp + 0x44]
call fcn.00471900
add dword [esp + 0x40], esi
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x2c], eax
ja 0x4727ee
mov ecx, dword [esp + 0x40a0]
mov eax, dword [esp + 0x44]
mov edx, 1
call fcn.0053d800
xor edx, edx
mov dword [esp + 0x2c], 0
jmp 0x471e80
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00471900
cmp ebp, edi
ja 0x472871
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov edx, 1
mov ebp, dword [esp + 0x50]
cmp byte [eax + 0x9b], 0
je 0x4728c6
movzx edx, word [eax + 0x9c]
mov eax, dword [esp + 0x40a0]
mov eax, dword [eax]
test eax, eax
mov dword [esp + 0x2c], eax
jne 0x472720
mov eax, dword [esp + 0x40a0]
mov dword [esp + 4], 1
mov ecx, 1
mov dword [esp], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
call fcn.00471bc0
xor edx, edx
jmp 0x471e80
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00471900
cmp ebp, edi
ja 0x472927
mov eax, dword [esp + 0x30]
xor edx, edx
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x50]
cmp byte [eax + 0x9b], 0
je 0x472984
movzx eax, word [eax + 0x9c]
mov ecx, eax
sub eax, 1
test cx, cx
cmovne edx, eax
mov eax, dword [esp + 0x40a0]
mov eax, dword [eax]
test eax, eax
mov dword [esp + 0x2c], eax
jne 0x472720
mov eax, dword [esp + 0x40a0]
mov dword [esp + 4], 1
xor ecx, ecx
mov dword [esp], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
call fcn.00471bc0
xor edx, edx
jmp 0x471e80
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00471900
cmp ebp, edi
ja 0x4729e2
mov edx, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov eax, 0xffffffff
mov ebp, dword [esp + 0x50]
cmp byte [edx + 0x9b], 0
je 0x472a39
movzx eax, word [edx + 0x9c]
neg eax
mov esi, dword [esp + 0x40a0]
mov edx, dword [esi]
test edx, edx
mov dword [esp + 0x2c], edx
jne 0x472720
mov dword [esp], eax
mov eax, dword [esp + 0x30]
xor edx, edx
mov dword [esp + 8], esi
mov dword [esp + 4], 1
xor ecx, ecx
call fcn.00471bc0
xor edx, edx
jmp 0x471e80
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00471900
cmp ebp, edi
ja 0x472a8e
mov edx, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov eax, 1
mov ebp, dword [esp + 0x50]
cmp byte [edx + 0x9b], 0
je 0x472a39
movzx eax, word [edx + 0x9c]
jmp 0x472a39
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00471900
cmp ebp, edi
ja 0x472b09
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov edx, 0xffffffff
mov ebp, dword [esp + 0x50]
cmp byte [eax + 0x9b], 0
je 0x4728c6
movzx edx, word [eax + 0x9c]
neg edx
jmp 0x4728c6
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00471900
cmp ebp, edi
ja 0x472b86
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x50]
cmp byte [eax + 0x9b], 0
je 0x473317
movzx edx, word [eax + 0x9c]
cmp edx, 2
jg 0x472720
mov eax, dword [esp + 0x40a0]
mov ecx, 1
mov dword [esp], eax
mov eax, dword [esp + 0x30]
call fcn.004719e0
xor edx, edx
mov dword [esp + 0x2c], 0
jmp 0x471e80
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00471900
cmp ebp, edi
ja 0x472c27
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x50]
movzx ecx, byte [eax + 0x9b]
test cl, cl
je 0x47331e
movzx eax, word [eax + 0x9c]
xor edx, edx
mov esi, eax
sub eax, 1
test si, si
cmove eax, edx
cmp cl, 1
jbe 0x473583
mov esi, dword [esp + 0x30]
movzx ecx, word [esi + 0x9e]
mov esi, ecx
sub ecx, 1
test si, si
cmovne edx, ecx
mov esi, dword [esp + 0x40a0]
mov esi, dword [esi]
test esi, esi
mov dword [esp + 0x2c], esi
jne 0x472720
mov esi, dword [esp + 0x40a0]
mov dword [esp], eax
xor ecx, ecx
mov eax, dword [esp + 0x30]
mov dword [esp + 4], 0
mov dword [esp + 8], esi
call fcn.00471bc0
xor edx, edx
jmp 0x471e80
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00471900
cmp ebp, edi
ja 0x472d03
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x50]
cmp byte [eax + 0x9b], 0
je 0x4731f0
movzx edx, word [eax + 0x9c]
cmp edx, 2
jg 0x472720
mov eax, dword [esp + 0x40a0]
xor ecx, ecx
mov dword [esp], eax
mov eax, dword [esp + 0x30]
call fcn.004719e0
xor edx, edx
mov dword [esp + 0x2c], 0
jmp 0x471e80
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00471900
cmp ebp, edi
ja 0x472da1
mov edx, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov eax, 0xffffffff
mov ebp, dword [esp + 0x50]
cmp byte [edx + 0x9b], 0
je 0x472df8
movzx eax, word [edx + 0x9c]
neg eax
mov esi, dword [esp + 0x40a0]
mov edx, dword [esi]
test edx, edx
mov dword [esp + 0x2c], edx
jne 0x472720
mov dword [esp], eax
mov eax, dword [esp + 0x30]
xor edx, edx
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov ecx, 1
call fcn.00471bc0
xor edx, edx
jmp 0x471e80
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x44], edi
add eax, 0x90
mov dword [esp + 0x40], eax
xor eax, eax
mov edi, eax
mov esi, ebp
mov eax, 0x2000
sub esi, edi
cmp esi, 0x2000
cmova esi, eax
mov eax, dword [esp + 0x38]
mov ecx, esi
lea edx, [eax + edi*2]
mov eax, dword [esp + 0x40a0]
add edi, esi
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00471900
cmp ebp, edi
ja 0x472e50
mov edx, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
mov eax, 1
mov ebp, dword [esp + 0x50]
cmp byte [edx + 0x9b], 0
je 0x472df8
movzx eax, word [edx + 0x9c]
jmp 0x472df8
mov eax, dword [esp + 0x30]
mov dword [esp + 0x44], edi
xor esi, esi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x2c], ebp
mov ebp, dword [esp + 0x38]
add eax, 0x90
mov dword [esp + 0x40], eax
lea esi, [esi]
mov ebx, edi
mov eax, 0x2000
lea edx, [ebp + esi*2]
sub ebx, esi
cmp ebx, 0x2000
cmova ebx, eax
mov eax, dword [esp + 0x40a0]
mov ecx, ebx
add esi, ebx
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00471900
cmp edi, esi
ja 0x472ed0
mov esi, dword [esp + 0x40a0]
xor ebx, ebx
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x2c]
movzx eax, word [0x53e046]
mov esi, dword [esi]
test esi, esi
jne 0x473047
mov dword [esp + 4], eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x90]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
sub esp, 8
test eax, eax
je 0x47332e
mov esi, dword [esp + 0x30]
mov dword [esp + 4], 0
mov eax, dword [esi + 0x90]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
sub esp, 8
test eax, eax
je 0x473038
lea eax, [esp + 0x6a]
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], ebp
mov edi, esi
mov dword [esp + 0x50], eax
mov esi, eax
jmp 0x473012
lea eax, [esp + 0x64]
movsx edx, word [esp + 0x6c]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 0x20
mov dword [esp + 0x10], eax
movsx eax, word [esp + 0x6a]
imul eax, edx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x90]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
sub esp, 0x14
test eax, eax
je 0x473001
lea eax, [esp + 0x64]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [edi + 0x90]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
sub esp, 0x14
test eax, eax
jne 0x47317c
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x57
jne 0x473160
mov dword [esp + 4], esi
mov eax, dword [edi + 0x90]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
sub esp, 8
test eax, eax
jne 0x472f90
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x40a0]
mov dword [edx], eax
xor ebx, ebx
jmp 0x472720
xor ebx, ebx
mov edx, 8
jmp 0x471e80
mov eax, dword [esp + 0x30]
mov dword [esp + 0x44], edi
xor esi, esi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x2c], ebp
mov ebp, dword [esp + 0x38]
add eax, 0x90
mov dword [esp + 0x40], eax
lea esi, [esi]
mov ebx, edi
mov eax, 0x2000
lea edx, [ebp + esi*2]
sub ebx, esi
cmp ebx, 0x2000
cmova ebx, eax
mov eax, dword [esp + 0x40a0]
mov ecx, ebx
add esi, ebx
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00471900
cmp edi, esi
ja 0x473080
mov ecx, dword [esp + 0x40a0]
mov eax, dword [esp + 0x30]
mov edx, 1
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
call fcn.00471c80
xor edx, edx
mov dword [esp + 0x2c], 0
jmp 0x471e80
mov eax, dword [esp + 0x30]
mov dword [esp + 0x44], edi
xor esi, esi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x2c], ebp
mov ebp, dword [esp + 0x38]
add eax, 0x90
mov dword [esp + 0x40], eax
nop
mov ebx, edi
mov eax, 0x2000
lea edx, [ebp + esi*2]
sub ebx, esi
cmp ebx, 0x2000
cmova ebx, eax
mov eax, dword [esp + 0x40a0]
mov ecx, ebx
add esi, ebx
mov dword [esp], eax
mov eax, dword [esp + 0x40]
call fcn.00471900
cmp edi, esi
ja 0x473100
mov ecx, dword [esp + 0x40a0]
mov eax, dword [esp + 0x30]
mov edx, 1
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
call fcn.00471050
jmp 0x472720
xor ebx, ebx
jmp 0x471e80
mov esi, ebp
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
call esi
mov edx, dword [esp + 0x40a0]
xor ebx, ebx
mov dword [edx], eax
jmp 0x472720
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x40]
xor ebx, ebx
mov ebp, dword [esp + 0x44]
mov dword [0x53e05c], 0
call fcn.00470f60
jmp 0x472720
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x40a0]
mov ebp, ebx
mov dword [esp + 0x50], 0
mov dword [edx], eax
mov eax, dword [esp + 0x30]
add eax, 0x90
mov dword [esp + 0x24], eax
jmp 0x47219b
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], 0
xor edi, edi
add eax, 0x90
mov dword [esp + 0x24], eax
lea eax, [esp + 0x80]
mov dword [esp + 0x38], eax
jmp 0x47219b
xor edx, edx
jmp 0x472d60
movzx edx, byte [0x57683f]
mov esi, dword [esp + 0x30]
mov ecx, 0xffffffff
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], ebp
mov edi, ecx
mov byte [esp + 0x44], 0xff
mov byte [esp + 0x40], 0xff
mov byte [esp + 0x2c], 0xff
mov byte [esp + 0x55], dl
movzx edx, byte [0x57683d]
mov byte [esp + 0x56], dl
movzx edx, byte [0x53e044]
mov byte [esp + 0x50], dl
movzx edx, byte [0x57683e]
mov byte [esp + 0x54], dl
movzx edx, byte [0x57683c]
mov byte [esp + 0x57], dl
lea edx, [esi + 0x9c]
lea esi, [edx + eax*2]
mov eax, 0xffffffff
mov ebp, eax
jmp 0x4732c6
cmp ax, 1
je 0x4732f5
cmp ax, 2
je 0x473311
cmp ax, 5
je 0x473327
cmp ax, 7
je 0x473360
lea ecx, [eax - 0x15]
cmp cx, 1
jbe 0x4733b1
cmp ax, 0x19
je 0x4733aa
cmp ax, 0x1b
je 0x4733a0
lea ecx, [eax - 0x1e]
cmp cx, 7
ja 0x473383
sub eax, 0x1e
mov byte [esp + 0x2c], al
add edx, 2
cmp esi, edx
je 0x4732fc
movzx eax, word [edx]
test ax, ax
jne 0x473262
movzx eax, byte [esp + 0x57]
movzx edi, byte [esp + 0x56]
movzx ebp, byte [esp + 0x54]
mov byte [esp + 0x44], al
movzx eax, byte [esp + 0x55]
mov byte [esp + 0x40], al
movzx eax, byte [esp + 0x50]
mov byte [esp + 0x2c], al
jmp 0x4732bf
mov ebp, 1
jmp 0x4732bf
mov eax, ebp
mov esi, edi
mov ebp, dword [esp + 0x5c]
mov edi, dword [esp + 0x58]
mov byte [esp + 0x50], al
jmp 0x4725a4
xor edi, edi
xor ebp, ebp
jmp 0x4732bf
xor edx, edx
jmp 0x472be3
xor eax, eax
xor edx, edx
jmp 0x472ca9
mov edi, 1
jmp 0x4732bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x40a0]
xor ebx, ebx
mov dword [esi], eax
jmp 0x472720
and ah, 0xbf
mov word [esp + 0x72], ax
jmp 0x4726fb
test ah, 0x40
jne 0x4726df
jmp 0x4726fb
mov byte [esp + 0x44], 1
jmp 0x4732bf
and eax, 0xfffffff7
mov word [esp + 0x72], ax
jmp 0x472678
and al, 0x7f
mov word [esp + 0x72], ax
jmp 0x4726c6
cmp ax, 0x27
je 0x4733d8
lea ecx, [eax - 0x28]
cmp cx, 7
ja 0x4733b8
sub eax, 0x28
mov byte [esp + 0x40], al
jmp 0x4732bf
mov byte [esp + 0x44], 0
jmp 0x4732bf
xor edi, edi
jmp 0x4732bf
xor ebp, ebp
jmp 0x4732bf
cmp ax, 0x31
je 0x473409
lea ecx, [eax - 0x5a]
cmp cx, 7
ja 0x4733eb
sub eax, 0x5a
mov ebp, 1
mov byte [esp + 0x2c], al
jmp 0x4732bf
movzx eax, byte [esp + 0x50]
movzx ebp, byte [esp + 0x54]
mov byte [esp + 0x2c], al
jmp 0x4732bf
lea ecx, [eax - 0x64]
cmp cx, 7
ja 0x4732bf
sub eax, 0x64
mov edi, 1
mov byte [esp + 0x40], al
jmp 0x4732bf
movzx eax, byte [esp + 0x55]
movzx edi, byte [esp + 0x56]
mov byte [esp + 0x40], al
jmp 0x4732bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x40a0]
mov dword [edx], eax
jmp 0x472720
call sub.msvcrt.dll_abort
cmp edi, 0xffff
ja 0x471f80
cmp edi, 0xa
sete al
cmp edi, 0xd
sete dl
je 0x473457
test al, al
je 0x472255
cmp byte [esp + 0x3c], 0xd
je 0x4734ab
test al, al
je 0x4734ab
mov esi, dword [esp + 0x2c]
mov eax, 0x2000
sub eax, esi
cmp eax, 1
jbe 0x473502
lea eax, [esi + 1]
mov edx, esi
add esi, 2
mov dword [esp + 0x2c], esi
mov ecx, 0xd
mov ebx, 0xa
mov word [esp + edx*2 + 0x80], cx
mov word [esp + eax*2 + 0x80], bx
mov eax, edi
xor ebx, ebx
xor edx, edx
mov byte [esp + 0x3c], al
jmp 0x471e80
cmp byte [esp + 0x3c], 0xa
jne 0x4734b6
test dl, dl
jne 0x47349c
mov esi, dword [esp + 0x2c]
cmp esi, 0x2000
mov eax, esi
je 0x4734d5
add esi, 1
mov dword [esp + 0x2c], esi
mov word [esp + eax*2 + 0x80], di
jmp 0x47349c
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x40a0]
mov ecx, 0x2000
mov edx, dword [esp + 0x38]
add eax, 0x90
mov dword [esp], esi
call fcn.00471900
mov dword [esp + 0x2c], 1
xor eax, eax
jmp 0x4734cb
mov eax, dword [esp + 0x30]
mov dword [esp + 0x40], edi
xor esi, esi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x2c], ebp
mov ebp, dword [esp + 0x38]
add eax, 0x90
mov dword [esp + 0x3c], eax
mov ebx, edi
mov eax, 0x2000
lea edx, [ebp + esi*2]
sub ebx, esi
cmp ebx, 0x2000
cmova ebx, eax
mov eax, dword [esp + 0x40a0]
mov ecx, ebx
add esi, ebx
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
call fcn.00471900
cmp edi, esi
ja 0x473521
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x40]
mov eax, 1
mov dword [esp + 0x2c], 2
xor edx, edx
jmp 0x473482
lea eax, [edi - 0x40]
cmp eax, 0x1f
ja 0x473435
xor ebx, ebx
xor edx, edx
jmp 0x471e80
xor edx, edx
jmp 0x472ca9