Function at 0x9cab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x40
push ebx
mov ebx, dword [esp + 0x5c]
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0xec], edi
mov dword [esp + 0x34], edi
je 0x9cafd
test byte [esp + 0x7c], 8
je 0x9cafd
mov eax, dword [ebp + 0xe8]
mov ecx, dword [0x5271fc]
cmp eax, dword [ecx + 0x16c]
jne 0x9cafd
sub eax, dword [ebp + 0xb8]
cdq
xor eax, edx
sub eax, edx
cmp eax, 8
jg 0x9cafd
mov edi, 1
mov edx, dword [0x4e73e0]
mov ecx, dword [edx + 0x2520]
mov eax, dword [ecx]
mov dword [esp + 0x24], edi
call dword [eax + 0x124]
push eax
call fcn.00109a20
mov esi, dword [0x4e73e0]
test byte [esi + 0x23b0], 0x60
mov dword [esp + 0x38], eax
je 0x9cb36
cmp ebx, dword [ebp + 0x13c]
jne 0x9cb67
test byte [esi + 0x23b0], 0x10
je 0x9cb67
cmp ebx, dword [ebp + 0x13c]
je 0x9cb67
movzx ecx, word [ebp + 0x154]
mov edx, dword [esp + 0x58]
push 0
push 1
xor ecx, 1
push ecx
push edx
push ebp
call fcn.0009def0
mov esi, dword [0x4e73e0]
test edi, edi
mov eax, dword [esp + 0x60]
mov ecx, dword [ebp + 0x11c]
mov dword [ebp + 0x134], eax
mov dword [ebp + 0x13c], ebx
mov dword [esp + 0x10], ecx
je 0x9cb8f
mov dword [esp + 0x54], 0x100000
jmp 0x9cb99
mov edx, dword [ebp + 0x120]
mov dword [esp + 0x54], edx
mov ecx, dword [ebp + 0xe0]
mov eax, dword [ebp + 0xdc]
mov ebx, dword [ebp + 0xe4]
mov edx, dword [ebp + 0xe8]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp + 0x87c]
xor edi, edi
test ch, 0xf
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], edx
je 0x9cd28
test ecx, 0xff000
je 0x9cd28
cmp dword [esp + 0x24], edi
jne 0x9cd28
mov eax, 2
cmp dword [ebp + 0x8c], eax
jb 0x9cd28
cmp dword [ebp + 0x90], eax
jb 0x9cd28
mov edx, ecx
shr edx, 0xc
and edx, 0xff
mov eax, 0x180
sub eax, edx
mov edx, dword [esi + 0x1404]
shr ecx, 8
and ecx, 0xf
and edx, 0x300000
cmp edx, 0x100000
mov edi, ecx
jne 0x9cc3a
mov edx, 0x5a
jmp 0x9cc5f
cmp edx, 0x200000
jne 0x9cc49
mov edx, 0xb4
jmp 0x9cc5f
xor ecx, ecx
cmp edx, 0x300000
setne cl
sub ecx, 1
and ecx, 0x10e
mov edx, ecx
xor ecx, ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x88], ecx
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x6c]
push ecx
lea ecx, [esp + 0x6c]
push ecx
lea ecx, [esp + 0x80]
push ecx
lea ecx, [esp + 0x80]
push ecx
lea ecx, [esp + 0xa0]
push ecx
lea ecx, [esp + 0x48]
push ecx
mov ecx, dword [esp + 0xa4]
push ecx
mov ecx, dword [esp + 0xb0]
push edx
mov edx, dword [esp + 0xb8]
push edi
push edx
mov edx, dword [ebp + 0x5c]
push ecx
mov ecx, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0xa0]
push ecx
push ebx
push edx
sub esp, 0x10
lea ecx, [ebp + 0xac]
mov edi, dword [ecx]
mov edx, esp
mov dword [edx], edi
mov edi, dword [ecx + 4]
mov dword [edx + 4], edi
mov edi, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [edx + 8], edi
mov dword [edx + 0xc], ecx
sub esp, 0x10
lea edx, [ebp + 0xcc]
mov edi, dword [edx]
mov ecx, esp
mov dword [ecx], edi
mov edi, dword [edx + 4]
mov dword [ecx + 4], edi
mov edi, dword [edx + 8]
mov edx, dword [edx + 0xc]
mov dword [ecx + 8], edi
push ebp
mov dword [ecx + 0xc], edx
call fcn.0009a440
mov edi, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
shl edi, 0x10
or edi, dword [esp + 0x2c]
jmp 0x9cd3a
mov ecx, dword [esp + 0x84]
test ecx, ecx
je 0x9cd3d
mov edi, dword [esp + 0x88]
shl edi, 4
mov eax, dword [ebp + 0x5c]
mov edx, dword [esp + 0x60]
cmp eax, 0x3231564e
mov eax, edx
jne 0x9cd57
and eax, 0x7f
shl eax, 4
add edi, eax
jmp 0x9cd5d
and eax, 0x7f
lea edi, [edi + eax*8]
test ecx, ecx
mov dword [esp + 0x8c], edi
jne 0x9cd75
and edi, 0xffff
mov dword [esp + 0x8c], edi
mov ebx, dword [esp + 0x6c]
mov eax, dword [esp + 0x70]
and dword [esp + 0x64], 0xffffff80
shl eax, 0x10
and ebx, 0xfffe
or ebx, eax
mov eax, edi
shr eax, 4
add ebx, eax
and edx, 0xffffff80
cmp dword [esp + 0x80], 0
mov dword [esp + 0x84], ebx
mov dword [esp + 0x60], edx
jne 0x9cde1
cmp dword [esp + 0x24], 0
jne 0x9cde1
test ecx, ecx
jne 0x9cde1
movzx eax, word [ebp + 0x45a]
cmp eax, 0x177a
jg 0x9cf03
je 0x9cf15
cmp eax, 0x47
je 0x9cf15
cmp eax, 0x7a
je 0x9cf15
mov ecx, dword [esp + 0x7c]
mov eax, ecx
and eax, 0xc
mov dword [esp + 0x88], eax
je 0x9ce6d
test cl, 3
je 0x9ce6d
cmp dword [esp + 0x24], 0
jne 0x9ce6d
mov eax, dword [ebp]
test eax, 0x800000
jne 0x9ce6d
or ah, 4
test cl, 8
mov dword [ebp], eax
je 0x9ce56
test cl, 1
je 0x9ce21
add edx, dword [esp + 0x68]
mov dword [esp + 0x60], edx
mov ecx, dword [esp + 0x70]
shr ecx, 1
mov eax, ecx
shl eax, 0x14
xor edx, edx
div dword [ebp + 0xe8]
shl dword [esp + 0x68], 1
mov dword [esp + 0x70], ecx
shl ecx, 0x10
and ebx, 0xffff
or ebx, ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x84], ebx
mov dword [esp + 0x54], eax
test cl, 4
je 0x9ce6d
test cl, 1
jne 0x9ce6d
add edi, 0x80000
mov dword [esp + 0x8c], edi
test byte [ebp + 2], 0x80
je 0x9ced9
mov ecx, dword [ebp + 0x160]
test cl, 3
je 0x9ced9
mov edx, dword [esi + 0x23b0]
and edx, 0x10
or edx, dword [esi + 0x23b8]
test dl, 0xf8
je 0x9ced9
mov eax, dword [0x5271fc]
mov eax, dword [eax + 0x16c]
cdq
sub eax, edx
sar eax, 1
cmp dword [esp + 0x14], eax
jbe 0x9ced9
cmp dword [esp + 0x70], eax
jbe 0x9ced9
test cl, 1
je 0x9ced1
test cl, 0xc
je 0x9cec9
cmp dword [esp + 0x88], 0
je 0x9ced1
test byte [esp + 0x7c], 3
je 0x9ced1
mov ecx, dword [esp + 0x68]
add dword [esp + 0x60], ecx
mov dword [esp + 0x34], 1
mov eax, dword [ebp + 0x138]
mov edx, dword [esp + 0x38]
mov ecx, dword [edx + 4]
and eax, 0xffff0000
or eax, dword [esp + 0x68]
or eax, 0x80000000
test ch, 1
je 0x9cf47
or eax, 0x1000000
jmp 0x9cfa9
cmp eax, 0x307a
je 0x9cf15
cmp eax, 0x317a
jne 0x9cde1
mov ecx, dword [esp + 0x7c]
test cl, 0xc
je 0x9cf27
test cl, 3
jne 0x9cde5
cmp dword [esp + 0x54], 0x100000
je 0x9cde5
or edi, 0xfffc0000
mov dword [esp + 0x8c], edi
jmp 0x9cde5
test cl, cl
js 0x9cfa4
mov ecx, dword [ebp + 0xc8]
cmp ecx, 0x2c0
jbe 0x9cf77
cmp ecx, 0x2e0
jae 0x9cf77
mov edx, dword [ebp + 0xc4]
cmp edx, 0x4f0
jbe 0x9cf77
cmp edx, 0x510
jb 0x9cf9d
cmp ecx, 0x428
jbe 0x9cfa4
cmp ecx, 0x448
jae 0x9cfa4
mov ecx, dword [ebp + 0xc4]
cmp ecx, 0x770
jbe 0x9cfa4
cmp ecx, 0x790
jae 0x9cfa4
or eax, 0x1000000
jmp 0x9cfa9
and eax, 0xfeffffff
mov ecx, eax
and ecx, 0xf0000
cmp ecx, 0x30000
mov dword [esp + 0x90], eax
jne 0x9cfda
cmp dword [ebp + 0x5c], 0x3231564e
je 0x9cfda
and eax, 0xfff1ffff
or eax, 0x10000
mov dword [esp + 0x90], eax
mov eax, dword [ebp + 0x228]
cmp eax, 3
mov ebx, 0x8000
je 0x9d03a
cmp eax, 2
je 0x9d030
test byte [esp + 0x74], 1
mov ecx, dword [esp + 0x58]
mov eax, dword [ebp + 0x468]
je 0x9d01e
add eax, 0x20
push eax
mov eax, dword [ecx + 0x24]
call fcn.00092050
mov edx, dword [ebp + 0x468]
mov esi, dword [0x4e73e0]
mov word [edx + 0x2e], bx
jmp 0x9d03a
add eax, 0x10
push eax
mov eax, dword [ecx + 0x1c]
call fcn.00092050
mov esi, dword [0x4e73e0]
mov edx, dword [ebp + 0x468]
mov word [edx + 0x1e], bx
mov eax, dword [ebp + 0x210]
or eax, dword [ebp + 0x214]
je 0x9d187
mov ecx, dword [esp + 0x58]
mov eax, dword [ecx + 0x8c]
mov ecx, dword [ebp + 0x4a8]
add ecx, 0x10
cmp dword [esi + 0x2418], 1
je 0x9d079
test eax, eax
je 0x9d07d
call fcn.000b38d0
mov esi, dword [0x4e73e0]
jmp 0x9d07d
mov word [ecx + 0xe], bx
mov ebx, dword [ebp + 0x49c]
add esi, 8
mov eax, 7
call fcn.000b6530
mov esi, dword [0x4e73e0]
mov edx, dword [esi + 0x94]
mov dword [edx], 0x8e300
mov ecx, dword [ebp + 0x218]
mov eax, dword [esi + 0x94]
mov dword [eax + 4], ecx
mov eax, dword [ebp + 0x218]
mov edx, dword [ebp + 0x21c]
mov cl, 0x20
call fcn.003f4680
mov edx, dword [esi + 0x94]
mov dword [edx + 8], eax
mov eax, dword [esi + 0x94]
mov dword [eax + 0xc], 0x4e320
mov ecx, dword [esi + 0x94]
lea eax, [esi + 8]
mov dword [ecx + 0x10], 1
add dword [eax + 0x8c], 0x14
mov ecx, dword [eax + 0x8c]
cmp ecx, dword [eax + 0xa4]
jb 0x9d10a
call fcn.000b5d70
mov esi, dword [0x4e73e0]
test byte [esi + 0xc0], 8
lea eax, [esi + 8]
jne 0x9d13f
mov edx, dword [eax + 0x90]
mov ecx, dword [eax + 0x8c]
cmp edx, ecx
je 0x9d13f
sub ecx, edx
cmp ecx, 0x400
sbb edx, edx
add edx, 1
push edx
call fcn.000b5bd0
mov esi, dword [0x4e73e0]
mov eax, dword [ebp + 0x210]
add dword [ebp + 0x218], eax
mov ecx, dword [ebp + 0x214]
mov eax, dword [esp + 0x58]
adc dword [ebp + 0x21c], ecx
mov edx, dword [esi + 0x85c]
mov edi, dword [eax + 0x8c]
add edx, edx
add edx, edx
push edx
mov edx, dword [ebp + 0x4a8]
add edx, 0x10
call fcn.00091f70
mov esi, dword [0x4e73e0]
mov edi, dword [esp + 0x8c]
mov eax, dword [ebp]
test eax, 0x1000000
je 0x9d364
test eax, 0x4000000
je 0x9d364
cmp dword [esp + 0x88], 0
je 0x9d1b5
test byte [esp + 0x7c], 3
jne 0x9d364
test byte [esp + 0x7c], 3
je 0x9d364
test byte [ebp + 0x178], 0x20
je 0x9d364
mov ecx, dword [0x5271fc]
mov eax, dword [ecx + 0xb50]
mov ebx, dword [esi + 0x5c8]
mov ecx, dword [esi + 0x680c]
mov edx, dword [esi + 0x6814]
shl eax, 0xd
add ecx, ebx
add ecx, eax
add edx, ebx
add edx, eax
mov eax, dword [ecx]
mov ecx, dword [esi + 0x6810]
mov edx, dword [edx]
and ecx, eax
mov eax, dword [esi + 0x6818]
and eax, edx
mov dword [esp + 0x88], eax
jne 0x9d21f
test byte [esp + 0x7c], 2
jne 0x9d22a
jmp 0x9d364
test byte [esp + 0x7c], 1
je 0x9d364
mov edx, dword [0x5271fc]
mov eax, dword [edx + 0xb50]
lea edx, [eax*8]
sub edx, eax
mov edi, dword [esi + edx*8 + 0xa00]
mov edx, edi
sub edx, ecx
mov ecx, dword [esi + eax*8 + 0xa54]
push 0
add edx, 0x14
push edx
mov edx, dword [esi + eax*8 + 0xa50]
push ecx
push edx
call fcn.003f4730
push 0
push edi
push edx
push eax
call fcn.003f47f0
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x4a8]
add eax, 0x10
push eax
mov eax, dword [ecx + 0x8c]
mov edi, edx
call fcn.00092050
mov esi, dword [0x4e73e0]
mov ebx, dword [ebp + 0x49c]
add esi, 8
mov eax, 7
call fcn.000b6530
mov eax, dword [0x4e73e0]
mov edx, dword [eax + 0x94]
mov dword [edx], 0x8e308
mov ecx, dword [eax + 0x94]
mov edx, dword [esp + 0x40]
mov dword [ecx + 4], edx
mov edx, dword [eax + 0x94]
mov dword [edx + 8], edi
mov ecx, edi
sar ecx, 0x1f
mov ecx, dword [eax + 0x94]
mov dword [ecx + 0xc], 0x4e320
mov edx, dword [eax + 0x94]
add eax, 8
mov ecx, 5
mov dword [edx + 0x10], 1
call fcn.0006a150
mov eax, dword [0x4e73e0]
add eax, 8
test byte [eax + 0xb8], 8
jne 0x9d32e
mov edx, dword [eax + 0x90]
mov ecx, dword [eax + 0x8c]
cmp edx, ecx
je 0x9d32e
sub ecx, edx
cmp ecx, 0x400
sbb ecx, ecx
add ecx, 1
push ecx
call fcn.000b5bd0
mov edx, dword [0x4e73e0]
mov eax, dword [edx + 0x85c]
mov edx, dword [ebp + 0x4a8]
mov ecx, dword [esp + 0x58]
mov edi, dword [ecx + 0x8c]
add eax, eax
add eax, eax
push eax
add edx, 0x10
call fcn.00091f70
mov esi, dword [0x4e73e0]
mov edi, dword [esp + 0x8c]
test byte [esi + 0x23bd], 0x10
je 0x9d3bb
mov ecx, dword [esp + 0x84]
lea edx, [ecx - 2]
test dl, 8
je 0x9d3bb
mov eax, edi
and eax, 0xffff
cmp eax, 0x97
jb 0x9d3bb
and ecx, 0xffff
mov eax, ecx
imul eax, dword [esp + 0x10]
xor edx, edx
lea ebx, [ecx + 3]
div ebx
mov edx, dword [esp + 0x84]
add ecx, 8
and edx, 0xffff0000
or ecx, edx
mov dword [esp + 0x84], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x60]
mov dword [esi + 0xa98], eax
mov dword [esi + 0xa9c], 0
cmp dword [ebp + 0x890], 0
jne 0x9d3f1
cmp dword [ebp + 0x94], 0
jne 0x9d3f1
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.000ee130
mov esi, dword [0x4e73e0]
mov eax, dword [ebp + 0x228]
cmp eax, 3
je 0x9dd01
cmp eax, 2
jne 0x9d9b2
mov edi, dword [ebp + 0x2a0]
mov edx, dword [ebp + 0x2a8]
mov ebx, dword [ebp + 0x468]
lea esi, [edi - 1]
lea eax, [esp + 0x24]
and esi, 3
push eax
mov dword [esp + 0x78], esi
mov dword [esp + 0x5c], edx
add ebx, 0x10
mov dword [esp + 0x80], 0
call sub.WIN32K.SYS_EngQueryPerformanceCounter
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x60]
mov dword [ebp + edi*8 + 0x248], ecx
mov edx, dword [esp + 0x28]
mov dword [ebp + edi*8 + 0x24c], edx
mov dword [ebp + edi*4 + 0x290], eax
test byte [ebp + 0x22c], 1
jne 0x9d4d2
mov eax, dword [esp + 0x58]
mov ecx, dword [ebp + eax*8 + 0x2b0]
mov edx, dword [ebp + eax*8 + 0x2b4]
mov eax, ecx
or eax, edx
je 0x9d4d2
mov ebx, dword [esp + 0x94]
test ebx, ebx
mov eax, dword [esp + 0x98]
jne 0x9d4b7
test eax, eax
jne 0x9d4b7
mov eax, dword [ebp + esi*8 + 0x270]
add eax, ecx
mov ecx, dword [ebp + esi*8 + 0x274]
adc ecx, edx
mov dword [ebp + edi*8 + 0x274], ecx
jmp 0x9d625
xor edx, edx
xor ecx, ecx
or edx, ebx
or eax, ecx
mov dword [ebp + edi*8 + 0x270], edx
mov dword [ebp + edi*8 + 0x274], eax
jmp 0x9d62c
mov edx, dword [ebx + 8]
mov esi, dword [ebp + 0x238]
mov ecx, dword [esp + 0x24]
sub esi, edx
mov edx, dword [esp + 0x28]
mov eax, edi
sub eax, esi
sub eax, 1
and eax, 3
sub ecx, dword [ebp + eax*8 + 0x248]
push 0
sbb edx, dword [ebp + eax*8 + 0x24c]
push 0xf4240
push edx
push ecx
call fcn.003f4730
mov ecx, dword [ebp + 0x26c]
push ecx
mov ecx, dword [ebp + 0x268]
push ecx
push edx
push eax
call fcn.003f4610
push 0
push 0x3e8
push edx
push eax
call fcn.003f4730
mov dword [esp + 0x30], edx
mov edx, dword [ebp + 0x74]
mov dword [esp + 0x2c], eax
mov eax, dword [0x4e73e0]
mov ecx, dword [eax + edx*8 + 0xa50]
mov edx, dword [eax + edx*8 + 0xa54]
movzx eax, word [ebx + 0xc]
push 0
mov dword [esp + 0x40], edx
cdq
push 0x80000
push edx
push eax
mov dword [esp + 0x48], ecx
call fcn.003f4730
mov ecx, dword [esp + 0x3c]
mov ebx, eax
mov eax, dword [0x4e73e0]
sub ebx, dword [eax + 0xdc8]
sbb edx, dword [eax + 0xdcc]
mov eax, dword [esp + 0x38]
shrd eax, ecx, 1
mov dword [esp + 0x44], edx
shr ecx, 1
mov edx, ebx
sub edx, eax
mov eax, dword [esp + 0x44]
sbb eax, ecx
add edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x74]
adc eax, dword [esp + 0x30]
mov dword [ebp + edi*8 + 0x270], edx
mov dword [ebp + edi*8 + 0x274], eax
mov eax, dword [ebp + ecx*8 + 0x270]
mov edx, dword [ebp + ecx*8 + 0x274]
mov ecx, dword [ebp + edi*8 + 0x270]
sub ecx, eax
mov dword [esp + 0x48], eax
mov eax, dword [ebp + edi*8 + 0x274]
sbb eax, edx
cmp eax, dword [esp + 0x3c]
ja 0x9d5f0
jb 0x9d5e2
cmp ecx, dword [esp + 0x38]
jae 0x9d5f0
mov eax, dword [esp + 0x48]
add eax, dword [esp + 0x38]
adc edx, dword [esp + 0x3c]
jmp 0x9d61e
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x3c]
lea eax, [esi + 1]
cdq
push ecx
push edx
push eax
mov dword [esp + 0x8c], 1
call fcn.003f4730
add eax, ebx
adc edx, dword [esp + 0x44]
add eax, dword [esp + 0x2c]
adc edx, dword [esp + 0x30]
mov dword [ebp + edi*8 + 0x274], edx
mov dword [ebp + edi*8 + 0x270], eax
cmp word [ebp + 0x45a], 0x417a
jne 0x9d681
mov eax, dword [0x4e73e0]
mov edx, dword [eax + 0xc80]
test edx, edx
je 0x9d681
mov esi, dword [eax + 0xc84]
test esi, esi
je 0x9d681
mov ecx, dword [esp + 0x84]
mov eax, ecx
and eax, 0xffff
shr ecx, 0x10
cmp eax, edx
jb 0x9d667
mov eax, edx
cmp ecx, esi
jb 0x9d66d
mov ecx, esi
and ecx, 0xfffffffe
shl ecx, 0x10
and eax, 0xfffe
or ecx, eax
mov dword [esp + 0x84], ecx
mov esi, dword [0x4e73e0]
mov ebx, dword [ebp + 0x45c]
add esi, 8
mov eax, 7
call fcn.000b6530
cmp word [ebp + 0x45a], 0x417a
mov esi, dword [0x4e73e0]
jne 0x9d863
mov edx, dword [esi + 0x94]
mov dword [edx], 0x8e458
mov eax, dword [esi + 0x94]
mov ecx, dword [ebp + 0x15c]
mov dword [eax + 4], ecx
mov edx, dword [esi + 0x94]
mov eax, dword [esp + 0x60]
mov dword [edx + 8], eax
mov ecx, dword [esi + 0x94]
mov eax, dword [esp + 0x84]
mov dword [ecx + 0xc], 0x8e464
mov edx, dword [esi + 0x94]
mov dword [edx + 0x10], eax
mov ecx, dword [esi + 0x94]
mov edx, dword [esp + 0x8c]
lea eax, [esi + 8]
mov dword [ecx + 0x14], edx
add dword [eax + 0x8c], 0x18
mov ecx, dword [eax + 0x8c]
cmp ecx, dword [eax + 0xa4]
jb 0x9d727
call fcn.000b5d70
mov esi, dword [0x4e73e0]
mov ebx, 1
cmp dword [ebp + 0x8c], ebx
je 0x9d760
mov eax, dword [esi + 0x94]
mov edx, dword [esp + 0x10]
mov dword [eax], 0x4e46c
mov ecx, dword [esi + 0x94]
mov dword [ecx + 4], edx
lea eax, [esi + 8]
mov ecx, 2
call fcn.0006a150
mov esi, dword [0x4e73e0]
mov eax, dword [esi + 0x94]
mov edx, dword [esp + 0x54]
mov dword [eax], 0x10e470
mov ecx, dword [esi + 0x94]
mov eax, dword [esp + 0x18]
mov dword [ecx + 4], edx
movzx ecx, word [esp + 0x1c]
mov edx, dword [esi + 0x94]
shl eax, 0x10
or eax, ecx
movzx ecx, word [esp + 0x20]
mov dword [edx + 8], eax
mov eax, dword [esp + 0x14]
mov edx, dword [esi + 0x94]
shl eax, 0x10
or eax, ecx
mov ecx, dword [esp + 0x90]
mov dword [edx + 0xc], eax
mov eax, dword [esi + 0x94]
mov dword [eax + 0x10], ecx
xor ecx, ecx
xor eax, eax
cmp dword [esp + 0x80], ecx
jne 0x9d7ca
cmp dword [esp + 0x34], ecx
je 0x9d7dc
test byte [ebp + 0x160], bl
mov eax, 0x10
je 0x9d7dc
mov eax, 0x11
cmp dword [esp + 0x7c], ecx
mov edx, dword [esi + 0x94]
mov dword [edx + 0x14], 0x4e610
mov edx, dword [esi + 0x94]
mov dword [edx + 0x18], eax
mov eax, dword [esi + 0x94]
mov dword [eax + 0x1c], 0x8e480
je 0x9d826
mov edx, dword [esi + 0x94]
mov dword [edx + 0x20], ecx
mov eax, dword [esi + 0x94]
mov dword [eax + 0x24], ecx
add dword [esi + 0x94], 0x28
lea eax, [esi + 8]
jmp 0x9d964
mov eax, dword [ebp + edi*8 + 0x270]
mov edx, dword [ebp + edi*8 + 0x274]
mov cl, 0x20
call fcn.003f45f0
mov ecx, dword [esi + 0x94]
mov dword [ecx + 0x20], eax
mov eax, dword [ebp + edi*8 + 0x270]
mov edx, dword [esi + 0x94]
mov dword [edx + 0x24], eax
add dword [esi + 0x94], 0x28
lea eax, [esi + 8]
jmp 0x9d964
mov ecx, dword [esi + 0x94]
mov dword [ecx], 0x30e458
mov edx, dword [esi + 0x94]
mov eax, dword [ebp + 0x15c]
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x94]
mov edx, dword [esp + 0x60]
mov dword [ecx + 8], edx
mov eax, dword [esi + 0x94]
mov ecx, dword [esp + 0x64]
mov dword [eax + 0xc], ecx
mov edx, dword [esi + 0x94]
mov eax, dword [esp + 0x84]
mov dword [edx + 0x10], eax
mov ecx, dword [esi + 0x94]
mov edx, dword [esp + 0x8c]
mov dword [ecx + 0x14], edx
mov eax, dword [esi + 0x94]
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x18], ecx
mov edx, dword [esi + 0x94]
mov eax, dword [esp + 0x54]
movzx ecx, word [esp + 0x1c]
mov dword [edx + 0x1c], eax
mov eax, dword [esp + 0x18]
mov edx, dword [esi + 0x94]
shl eax, 0x10
or eax, ecx
movzx ecx, word [esp + 0x20]
mov dword [edx + 0x20], eax
mov eax, dword [esp + 0x14]
mov edx, dword [esi + 0x94]
shl eax, 0x10
or eax, ecx
mov ecx, dword [esp + 0x90]
mov dword [edx + 0x24], eax
mov eax, dword [esi + 0x94]
mov dword [eax + 0x28], ecx
xor eax, eax
cmp dword [esp + 0x7c], eax
je 0x9d92c
mov edx, dword [esi + 0x94]
mov dword [edx + 0x2c], eax
mov ecx, dword [esi + 0x94]
mov dword [ecx + 0x30], eax
jmp 0x9d95a
mov eax, dword [ebp + edi*8 + 0x270]
mov edx, dword [ebp + edi*8 + 0x274]
mov cl, 0x20
call fcn.003f45f0
mov edx, dword [esi + 0x94]
mov dword [edx + 0x2c], eax
mov eax, dword [esi + 0x94]
mov ecx, dword [ebp + edi*8 + 0x270]
mov dword [eax + 0x30], ecx
add dword [esi + 0x94], 0x34
lea eax, [esi + 8]
mov ecx, dword [eax + 0x8c]
cmp ecx, dword [eax + 0xa4]
jb 0x9d97d
call fcn.000b5d70
mov esi, dword [0x4e73e0]
mov edx, dword [ebp + 0x2a0]
mov eax, dword [ebp + 0x2a8]
add edx, 1
and edx, 3
mov dword [ebp + 0x2a0], edx
add eax, 1
xor edx, edx
div dword [ebp + 0x2a4]
add dword [ebp + 0x238], 1
mov dword [ebp + 0x2a8], edx
jmp 0x9dd01
cmp word [ebp + 0x45a], 0x177a
jne 0x9dc1f
mov eax, dword [ebp + 0x15c]
mov ebx, dword [esp + 0x74]
mov ecx, dword [ebp + 0x45c]
push eax
mov eax, dword [esi + 0x2330]
shl ebx, 7
lea edx, [ebx + 0x458]
push edx
push ecx
mov ecx, dword [esi + 0x2338]
mov dword [esp + 0x88], edx
push eax
mov edx, 0xdd005020
call fcn.00035780
add esp, 0x10
test eax, eax
jne 0x9db43
mov ecx, dword [ebp + 0x45c]
mov eax, dword [0x4e73e0]
push ecx
mov ecx, dword [esp + 0x64]
lea edx, [ebx + 0x45c]
push 0xdd005020
call fcn.000a3050
mov eax, dword [ebp + 0x45c]
mov ecx, dword [esp + 0x64]
push eax
mov eax, dword [0x4e73e0]
lea edx, [ebx + 0x460]
push 0xdd005020
call fcn.000a3050
mov ecx, dword [ebp + 0x45c]
mov eax, dword [0x4e73e0]
push ecx
mov ecx, dword [esp + 0x88]
lea edx, [ebx + 0x464]
push 0xdd005020
call fcn.000a3050
mov eax, dword [ebp + 0x45c]
push eax
mov eax, dword [0x4e73e0]
lea edx, [ebx + 0x468]
push 0xdd005020
mov ecx, edi
call fcn.000a3050
mov ecx, dword [ebp + 0x45c]
mov eax, dword [0x4e73e0]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [ebx + 0x46c]
push 0xdd005020
call fcn.000a3050
mov eax, dword [ebp + 0x45c]
mov ecx, dword [esp + 0x54]
push eax
mov eax, dword [0x4e73e0]
lea edx, [ebx + 0x470]
push 0xdd005020
call fcn.000a3050
movzx edx, word [esp + 0x1c]
mov eax, dword [ebp + 0x45c]
mov ecx, dword [esp + 0x18]
shl ecx, 0x10
push eax
mov eax, dword [0x4e73e0]
or ecx, edx
lea edx, [ebx + 0x474]
push 0xdd005020
call fcn.000a3050
movzx edx, word [esp + 0x20]
mov eax, dword [ebp + 0x45c]
mov ecx, dword [esp + 0x14]
shl ecx, 0x10
push eax
mov eax, dword [0x4e73e0]
or ecx, edx
lea edx, [ebx + 0x478]
push 0xdd005020
call fcn.000a3050
mov ecx, dword [ebp + 0x45c]
mov eax, dword [0x4e73e0]
push ecx
mov ecx, dword [esp + 0x94]
lea edx, [ebx + 0x47c]
push 0xdd005020
call fcn.000a3050
jmp 0x9dcfb
mov esi, dword [0x4e73e0]
mov ebx, dword [ebp + 0x45c]
add esi, 8
mov eax, 7
call fcn.000b6530
mov eax, dword [0x4e73e0]
mov edx, dword [eax + 0x94]
mov ecx, dword [esp + 0x7c]
or ecx, 0x28e000
mov dword [edx], ecx
mov ecx, dword [eax + 0x94]
mov edx, dword [ebp + 0x15c]
mov dword [ecx + 4], edx
mov ecx, dword [eax + 0x94]
mov edx, dword [esp + 0x60]
mov dword [ecx + 8], edx
mov ecx, dword [eax + 0x94]
mov edx, dword [esp + 0x64]
mov dword [ecx + 0xc], edx
mov ecx, dword [eax + 0x94]
mov edx, dword [esp + 0x84]
mov dword [ecx + 0x10], edx
mov ecx, dword [eax + 0x94]
mov dword [ecx + 0x14], edi
mov edx, dword [eax + 0x94]
mov ecx, dword [esp + 0x10]
mov dword [edx + 0x18], ecx
mov edx, dword [eax + 0x94]
mov ecx, dword [esp + 0x54]
mov dword [edx + 0x1c], ecx
movzx edx, word [esp + 0x1c]
mov ecx, dword [esp + 0x18]
shl ecx, 0x10
or ecx, edx
mov edx, dword [eax + 0x94]
mov dword [edx + 0x20], ecx
movzx edx, word [esp + 0x20]
mov ecx, dword [esp + 0x14]
shl ecx, 0x10
or ecx, edx
mov edx, dword [eax + 0x94]
mov dword [edx + 0x24], ecx
mov ecx, dword [eax + 0x94]
mov edx, dword [esp + 0x90]
mov dword [ecx + 0x28], edx
add eax, 8
mov ecx, 0xb
call fcn.0006a150
jmp 0x9dcfb
mov ebx, dword [ebp + 0x45c]
add esi, 8
mov eax, 7
call fcn.000b6530
mov esi, dword [0x4e73e0]
mov ecx, dword [esi + 0x94]
mov eax, dword [esp + 0x74]
shl eax, 7
add eax, 0x45c
or eax, 0x24e000
mov dword [ecx], eax
mov edx, dword [esi + 0x94]
mov eax, dword [ebp + 0x15c]
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x94]
mov edx, dword [esp + 0x60]
mov dword [ecx + 8], edx
mov eax, dword [esi + 0x94]
mov ecx, dword [esp + 0x84]
mov dword [eax + 0xc], ecx
mov edx, dword [esi + 0x94]
mov ecx, dword [esp + 0x10]
mov dword [edx + 0x10], edi
mov eax, dword [esi + 0x94]
mov dword [eax + 0x14], ecx
mov edx, dword [esi + 0x94]
mov eax, dword [esp + 0x54]
movzx ecx, word [esp + 0x1c]
mov dword [edx + 0x18], eax
mov eax, dword [esp + 0x18]
mov edx, dword [esi + 0x94]
shl eax, 0x10
or eax, ecx
movzx ecx, word [esp + 0x20]
mov dword [edx + 0x1c], eax
mov eax, dword [esp + 0x14]
mov edx, dword [esi + 0x94]
shl eax, 0x10
or eax, ecx
mov ecx, dword [esp + 0x90]
mov dword [edx + 0x20], eax
mov eax, dword [esi + 0x94]
mov dword [eax + 0x24], ecx
add dword [esi + 0x94], 0x28
mov ecx, dword [esi + 0x94]
cmp ecx, dword [esi + 0xac]
lea eax, [esi + 8]
jb 0x9dd01
call fcn.000b5d70
mov esi, dword [0x4e73e0]
test byte [esi + 0xc0], 8
lea eax, [esi + 8]
jne 0x9dd30
mov edx, dword [eax + 0x90]
mov ecx, dword [eax + 0x8c]
cmp edx, ecx
je 0x9dd30
sub ecx, edx
cmp ecx, 0x400
sbb edx, edx
add edx, 1
push edx
call fcn.000b5bd0
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x60]
mov ebx, dword [esp + 0x78]
push eax
mov eax, dword [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x6c]
push edx
call fcn.0009c9b0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x40
ret 0x48