Function at 0x4f5eec
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd48
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x45], 0
mov byte [ebp - 0x5d], 0
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov byte [eax + 0x519], 0
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
cmp byte [eax + 0xfd], 0
je 0x4f604c
xor eax, eax
push ebp
push 0x4f6045
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x4f5f57
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
je 0x4f5f57
mov eax, dword [ebp - 8]
call fcn.004211f0
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
jmp 0x4f5f65
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x54], 0xffffffff
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
cmp dword [eax + 0x17c], 0
je 0x4f5f85
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov eax, dword [eax + 0x17c]
mov dl, 1
call fcn.006467f4
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
xor edx, edx
call fcn.006200ac
mov eax, dword [ebp + 0x24]
push eax
mov eax, dword [ebp + 0x20]
push eax
push 1
mov al, byte [ebp + 0x18]
push eax
push 1
mov al, byte [ebp + 0x10]
push eax
mov al, byte [ebp + 0xc]
push eax
mov al, byte [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004f5eec
mov byte [ebp - 0xd], al
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov dl, 1
call fcn.006200ac
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
cmp dword [eax + 0x17c], 0
je 0x4f600d
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov eax, dword [eax + 0x17c]
call fcn.006468c4
test al, al
jne 0x4f600d
mov byte [ebp - 0xd], 1
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax + 0x17c]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x28]
call fcn.004045a0
jmp 0x4f6ead
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f604c
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00421210
cmp dword [ebp - 0x54], 0
jne 0x4f6034
cmp dword [ebp - 0x58], 0
jb 0x4f6044
jmp 0x4f6036
jl 0x4f6044
push dword [ebp - 0x54]
push dword [ebp - 0x58]
mov eax, dword [ebp - 8]
call fcn.00421210
ret
mov eax, dword [ebp - 4]
call fcn.004211f0
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
xor edx, edx
mov dword [eax + 0xec], edx
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
xor edx, edx
mov dword [eax + 0xf0], edx
mov eax, dword [ebp - 4]
call fcn.004f7730
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x4f609c
cmp dword [ebp - 0x30], 0xffffffff
jne 0x4f609c
mov eax, dword [ebp + 0x20]
mov eax, dword [eax + 0x28]
mov byte [eax], 1
jmp 0x4f6ead
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.00421210
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
cmp byte [eax + 0x515], 0
je 0x4f60d3
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
cmp byte [eax + 0x514], 0
jne 0x4f60d3
mov edx, dword [ebp + 0x24]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.004f7c24
mov eax, dword [0x8a92c4]
cmp byte [eax], 0
je 0x4f60eb
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
cmp dword [eax + 0x5ec], 0
jne 0x4f60ef
xor eax, eax
jmp 0x4f60f1
mov al, 1
mov byte [ebp - 0x39], al
mov eax, dword [0x8a9520]
cmp byte [eax], 0
je 0x4f610c
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
cmp dword [eax + 0x5ec], 0
jne 0x4f6110
xor eax, eax
jmp 0x4f6112
mov al, 1
mov byte [ebp - 0x3a], al
cmp byte [ebp - 0x3a], 0
je 0x4f612e
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
call fcn.00620108
call fcn.0065530c
test al, al
jne 0x4f6132
xor eax, eax
jmp 0x4f6134
mov al, 1
mov edx, dword [ebp + 0x24]
mov edx, dword [edx]
mov byte [edx + 0x519], al
xor ecx, ecx
push ebp
push 0x4f6ea3
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor eax, eax
mov dword [ebp - 0x18], eax
mov esi, 0x893428
lea edi, [ebp - 0x2ac]
mov ecx, 0x1e
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0x20]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x2ac]
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x234]
mov ecx, 0x1d0
mov edx, 0x3e
call fcn.004f7f30
mov eax, dword [ebp + 0x20]
mov eax, dword [eax + 0x28]
cmp byte [eax], 0
je 0x4f61aa
mov byte [ebp - 0xd], 1
call fcn.004045a0
jmp 0x4f6ead
cmp dword [ebp - 8], 0
je 0x4f61d9
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
je 0x4f61d9
mov ecx, dword [ebp + 0x20]
mov ecx, dword [ecx + 0x28]
lea eax, [ebp - 0x234]
mov edx, dword [ebp - 8]
call fcn.004f5d3c
lea eax, [ebp - 0x234]
xor edx, edx
call fcn.004f81f8
mov ecx, dword [ebp + 0x20]
mov ecx, dword [ecx + 0x28]
lea eax, [ebp - 0x234]
mov edx, dword [ebp - 4]
call fcn.004f5d3c
mov eax, dword [ebp + 0x20]
mov eax, dword [eax + 0x28]
cmp byte [eax], 0
je 0x4f6206
mov byte [ebp - 0xd], 1
call fcn.004045a0
jmp 0x4f6ead
xor eax, eax
push ebp
push 0x4f626f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
cmp byte [eax + 0x514], 0
jne 0x4f6257
lea eax, [ebp - 0x234]
mov ecx, 0xffff
mov edx, 0xfe
call fcn.00503f7c
mov ebx, 0xe0
lea eax, [ebp - 0x234]
mov ecx, 0xffff
mov edx, ebx
call fcn.00503f7c
inc ebx
cmp ebx, 0xf0
jne 0x4f623c
lea eax, [ebp - 0x234]
or edx, 0xffffffff
call fcn.004f81f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f62cb
mov eax, dword [ebp + 0x20]
mov eax, dword [eax + 0x28]
cmp byte [eax], 0
je 0x4f62e4
mov byte [ebp - 0xd], 1
call fcn.004045a0
jmp 0x4f6ead
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov dword [eax + 8], 8
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
xor edx, edx
mov dword [eax + 0xd0], edx
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
xor edx, edx
mov dword [eax + 0xd4], edx
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x20c]
cmp eax, 5
ja case.0x4f6325.0
jmp dword [eax*4 + 0x4f632c]
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov byte [eax + 0xc4], 0
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov dword [eax + 0x10], 3
jmp case.0x4f6325.0
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov byte [eax + 0xc4], 1
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov dword [eax + 0x10], 1
jmp case.0x4f6325.0
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov byte [eax + 0xc4], 2
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov dword [eax + 0x10], 3
mov dword [ebp - 0x208], 2
cmp byte [ebp + 0x1c], 0
jne case.0x4f6325.0
cmp byte [ebp + 0x18], 0
jne case.0x4f6325.0
mov al, byte [ebp + 0x14]
or al, byte [ebp + 8]
je case.0x4f6325.0
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 0x24]
mov edx, dword [edx]
mov dword [edx + 0xd0], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp + 0x24]
mov edx, dword [edx]
mov dword [edx + 0xd4], eax
jmp case.0x4f6325.0
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov byte [eax + 0xc4], 3
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov dword [eax + 0x10], 4
jmp case.0x4f6325.0
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov byte [eax + 0xc4], 4
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov dword [eax + 0x10], 4
mov dword [ebp - 0x208], 4
cmp byte [ebp + 0x18], 0
je 0x4f642d
mov dword [ebp - 0x208], 3
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov al, byte [eax + 0xcc]
sub al, 1
jb 0x4f6444
je 0x4f644e
dec al
je 0x4f645a
jmp 0x4f6464
xor eax, eax
mov dword [ebp - 0x1ec], eax
jmp 0x4f6464
mov dword [ebp - 0x1ec], 1
jmp 0x4f6464
mov dword [ebp - 0x1ec], 2
mov al, byte [ebp - 0x116]
sub al, 2
jb 0x4f6472
je 0x4f6496
jmp 0x4f64ee
movzx edx, word [ebp - 0x114]
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
call fcn.0062000c
movzx edx, word [ebp - 0x112]
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
call fcn.0062003c
jmp 0x4f64ee
movzx eax, word [ebp - 0x114]
mov dword [ebp - 0x2b0], eax
fild dword [ebp - 0x2b0]
fld xword [0x4f6ebc]
fdivp st(1)
call fcn.00402f88
mov edx, eax
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
call fcn.0062000c
movzx eax, word [ebp - 0x112]
mov dword [ebp - 0x2b0], eax
fild dword [ebp - 0x2b0]
fld xword [0x4f6ebc]
fdivp st(1)
call fcn.00402f88
mov edx, eax
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
call fcn.0062003c
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
cmp dword [eax + 0x524], 0
je 0x4f6526
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov eax, dword [eax + 0x524]
call fcn.00402a90
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
xor edx, edx
mov dword [eax + 0x524], edx
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
xor edx, edx
mov dword [eax + 0x528], edx
cmp dword [ebp - 0x158], 1
sbb eax, eax
inc eax
mov edx, dword [ebp + 0x24]
mov edx, dword [edx]
mov byte [edx + 0xe0], al
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov edx, dword [ebp - 0x218]
mov dword [eax + 0xf4], edx
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov edx, dword [ebp - 0x214]
mov dword [eax + 0xf8], edx
mov dword [ebp - 0x204], 1
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
movzx eax, byte [eax + 0xe1]
cmp eax, 4
ja case.default.0x4f657c
jmp dword [eax*4 + 0x4f6583]
mov dword [ebp - 0x200], 1
jmp case.default.0x4f657c
mov dword [ebp - 0x200], 2
jmp case.default.0x4f657c
mov dword [ebp - 0x200], 4
jmp case.default.0x4f657c
mov dword [ebp - 0x200], 8
jmp case.default.0x4f657c
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
cmp dword [eax + 0x14], 0
jle 0x4f6641
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
cmp dword [eax + 0x18], 0
jle 0x4f6641
xor eax, eax
mov dword [ebp - 0x20], eax
mov ebx, 3
mov ecx, ebx
mov eax, 1
shl eax, cl
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x218]
cdq
idiv dword [ebp - 0x24]
mov edx, dword [ebp + 0x24]
mov edx, dword [edx]
cmp eax, dword [edx + 0x14]
jl 0x4f6629
mov eax, dword [ebp - 0x214]
cdq
idiv dword [ebp - 0x24]
mov edx, dword [ebp + 0x24]
mov edx, dword [edx]
cmp eax, dword [edx + 0x18]
jl 0x4f6629
mov dword [ebp - 0x20], ebx
jmp 0x4f662f
dec ebx
cmp ebx, 0xffffffff
jne 0x4f65f0
mov ecx, dword [ebp - 0x20]
mov eax, 1
shl eax, cl
mov dword [ebp - 0x200], eax
jmp case.default.0x4f657c
mov dword [ebp - 0x200], 1
cmp byte [ebp + 8], 0
jne 0x4f6662
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov edx, dword [ebp - 0x200]
mov dword [eax + 0xe8], edx
xor eax, eax
push ebp
push 0x4f6685
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x234]
call fcn.004f9694
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f66a7
mov byte [ebp - 0xd], 1
mov eax, dword [ebp + 0x20]
mov eax, dword [eax + 0x28]
cmp byte [eax], 0
je 0x4f66c0
call fcn.004045a0
jmp 0x4f6ead
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c4]
mov dword [eax + 0x14], edx
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c0]
mov dword [eax + 0x18], edx
cmp byte [ebp + 0x1c], 0
je 0x4f66ec
call fcn.004045a0
jmp 0x4f6ead
mov eax, dword [ebp - 0x1c4]
shl eax, 2
call fcn.00402a70
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
cmp byte [eax + 0x520], 0
je 0x4f67b5
mov eax, dword [ebp - 0x208]
cmp eax, 5
ja case.0x4f671e.0
jmp dword [eax*4 + 0x4f6725]
push 3
mov ecx, dword [ebp - 0x1c0]
mov edx, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp case.0x4f671e.0
push 5
mov ecx, dword [ebp - 0x1c0]
mov edx, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp case.0x4f671e.0
push 5
mov ecx, dword [ebp - 0x1c0]
mov edx, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp case.0x4f671e.0
push 7
mov ecx, dword [ebp - 0x1c0]
mov edx, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp case.0x4f671e.0
push 5
mov ecx, dword [ebp - 0x1c0]
mov edx, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp case.0x4f671e.0
push 5
mov ecx, dword [ebp - 0x1c0]
mov edx, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x24]
cmp dword [ebp - 0x208], 4
jne 0x4f688e
cmp byte [ebp - 0x45], 0
jne 0x4f688e
mov eax, dword [0x8a9618]
cmp byte [eax], 0
je 0x4f688e
cmp dword [ebp - 0x4c], 0
jne 0x4f688e
cmp dword [ebp - 0x50], 0
jne 0x4f688e
cmp dword [ebp - 8], 0
jne 0x4f688e
mov eax, dword [ebp + 0x20]
mov eax, dword [eax + 0x28]
cmp byte [eax], 0
jne 0x4f688e
cmp byte [ebp + 0x1c], 0
jne 0x4f688e
cmp byte [ebp + 0x18], 0
jne 0x4f688e
cmp byte [ebp + 0x14], 0
je 0x4f688e
cmp dword [ebp - 0x1c4], 1
jbe 0x4f688e
cmp dword [ebp - 0x1c0], 1
jbe 0x4f688e
cmp dword [ebp - 0x200], 1
je 0x4f6854
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
cmp byte [eax + 0x518], 0
je 0x4f686d
push 0
push 0
mov ecx, dword [ebp + 0x24]
mov ecx, dword [ecx]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004f5dc0
mov byte [ebp - 0x45], al
jmp 0x4f688e
mov eax, dword [ebp - 0x1c4]
push eax
mov eax, dword [ebp - 0x1c0]
push eax
mov ecx, dword [ebp + 0x24]
mov ecx, dword [ecx]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004f5dc0
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
jne 0x4f6bad
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x2b8], eax
xor eax, eax
mov dword [ebp - 0x2b4], eax
fild qword [ebp - 0x2b8]
fdivr dword [0x4f6ec8]
mov eax, dword [ebp + 0x20]
fstp qword [eax + 0x18]
wait
mov eax, dword [ebp + 0x20]
xor edx, edx
mov dword [eax + 0xc], edx
xor ecx, ecx
push ebp
push 0x4f6b70
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor ebx, ebx
mov esi, 1
jmp 0x4f6b48
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x208]
dec eax
je 0x4f6910
dec eax
je 0x4f6a70
dec eax
je 0x4f6987
dec eax
je 0x4f69ca
jmp 0x4f6b0a
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x10]
cmp al, 3
jne 0x4f6936
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
mov ecx, 1
call fcn.004f9830
mov esi, eax
jmp 0x4f6b0a
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x234]
mov ecx, 1
call fcn.004f9830
mov esi, eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c4]
dec edx
test edx, edx
jl 0x4f6b0a
inc edx
mov dword [ebp - 0x64], edx
mov edx, dword [ebp - 0x1c]
mov cl, byte [eax]
mov byte [edx + 2], cl
mov cl, byte [eax]
mov byte [edx + 1], cl
mov cl, byte [eax]
mov byte [edx], cl
inc eax
add dword [ebp - 0x1c], 3
dec dword [ebp - 0x64]
jne 0x4f6967
jmp 0x4f6b0a
cmp byte [ebp + 0x18], 0
je 0x4f6b0a
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
mov ecx, 1
call fcn.004f9830
mov esi, eax
cmp dword [ebp - 0x20c], 2
jne 0x4f6b0a
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, eax
mov eax, dword [ebp - 0x14]
call fcn.005f72c8
jmp 0x4f6b0a
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x10]
cmp al, 5
jne 0x4f6a47
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x234]
mov ecx, 1
call fcn.004f9830
mov esi, eax
mov eax, dword [ebp + 0x20]
mov eax, dword [eax + 0x28]
cmp byte [eax], 0
jne 0x4f6b66
cmp byte [ebp + 0x10], 0
je 0x4f6a21
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c4]
shl edx, 2
dec edx
test edx, edx
jl 0x4f6a21
inc edx
mov dword [ebp - 0x64], edx
mov dl, 0xff
sub dl, byte [eax]
mov byte [eax], dl
inc eax
dec dword [ebp - 0x64]
jne 0x4f6a15
push 1
mov eax, dword [ebp - 0x1c4]
push eax
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
push eax
mov edi, dword [0x8a99d0]
mov edi, dword [edi]
mov ecx, dword [ebp - 0x14]
mov dl, 2
mov eax, dword [ebp - 0x18]
call edi
jmp 0x4f6b0a
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
mov ecx, 1
call fcn.004f9830
mov esi, eax
mov eax, dword [ebp + 0x20]
mov eax, dword [eax + 0x28]
cmp byte [eax], 0
jne 0x4f6b66
jmp 0x4f6b0a
cmp byte [ebp - 0x39], 0
je 0x4f6ada
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x234]
mov ecx, 1
call fcn.004f9830
mov esi, eax
cmp dword [ebp - 0x20c], 2
jne 0x4f6ab7
push 1
mov eax, dword [ebp - 0x1c4]
push eax
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
push eax
mov edi, dword [0x8a99d0]
mov edi, dword [edi]
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x18]
call edi
jmp 0x4f6b0a
push 1
mov eax, dword [ebp - 0x1c4]
push eax
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
push eax
mov edi, dword [0x8a99d0]
mov edi, dword [edi]
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [ebp - 0x18]
call edi
jmp 0x4f6b0a
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x234]
mov ecx, 1
call fcn.004f9830
mov esi, eax
cmp dword [ebp - 0x20c], 2
jne 0x4f6b0a
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, eax
mov eax, dword [ebp - 0x14]
call fcn.005f72c8
add ebx, esi
mov eax, dword [ebp + 0x20]
add dword [eax + 0xc], esi
mov eax, dword [ebp + 0x20]
cmp word [eax + 2], 0
je 0x4f6b3d
mov eax, dword [ebp + 0x20]
fild dword [eax + 0xc]
mov eax, dword [ebp + 0x20]
fmul qword [eax + 0x18]
call fcn.00402f88
mov ecx, eax
mov edi, dword [ebp + 0x20]
mov edx, dword [ebp + 0x20]
mov edx, dword [edx + 8]
mov eax, dword [edi + 4]
call dword [edi]
mov eax, dword [ebp + 0x20]
mov eax, dword [eax + 0x28]
cmp byte [eax], 0
jne 0x4f6b66
mov eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0x1c0]
jae 0x4f6b66
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 8]
cmp ebx, eax
jl 0x4f68e1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f6b92
cmp ebx, dword [ebp - 0x1c0]
jge 0x4f6bad
mov eax, dword [ebp + 0x20]
mov eax, dword [eax + 0x28]
mov byte [eax], 1
call fcn.004045a0
jmp 0x4f6ead
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f6ead
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov eax, dword [eax + 0xe4]
call fcn.0063f7b8
mov esi, dword [ebp - 0x104]
xor ebx, ebx
test esi, esi
je 0x4f6c0a
mov al, byte [esi + 4]
cmp al, 0xe0
setne dl
or dl, bl
je 0x4f6bfc
mov dx, word [esi + 0xc]
push edx
mov ecx, dword [esi + 0x10]
mov edx, eax
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov eax, dword [eax + 0xe4]
call fcn.0063f6fc
cmp byte [esi + 4], 0xe0
jne 0x4f6c04
mov bl, 1
mov esi, dword [esi]
test esi, esi
jne 0x4f6bd6
mov al, byte [ebp + 0xc]
and al, byte [ebp - 0x39]
je 0x4f6c5b
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
call fcn.00620108
cmp byte [eax + 0x18], 0
je 0x4f6c5b
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
call fcn.00620108
call fcn.006553e0
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov eax, dword [eax + 0xe4]
mov dl, 0xe2
call fcn.0063f6c8
cmp eax, 0xffffffff
je 0x4f6c5b
mov edx, dword [ebp + 0x24]
mov edx, dword [edx]
mov edx, dword [edx + 0xe4]
xchg edx, eax
call fcn.0063f7f4
jmp 0x4f6c31
mov al, byte [ebp + 0xc]
and al, byte [ebp - 0x3a]
je 0x4f6c99
cmp byte [ebp + 0x1c], 0
jne 0x4f6c99
cmp byte [ebp + 0x14], 0
je 0x4f6c99
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov eax, dword [eax + 0xe4]
mov dl, 0xe2
call fcn.0063f6c8
cmp eax, 0xffffffff
je 0x4f6c99
mov edx, dword [ebp + 0x24]
mov edx, dword [edx]
mov edx, dword [edx + 0xe4]
xchg edx, eax
call fcn.0063f7f4
jmp 0x4f6c6f
mov eax, dword [ebp + 0x20]
mov eax, dword [eax + 0x28]
cmp byte [eax], 0
jne 0x4f6ce5
cmp byte [ebp + 0x1c], 0
jne 0x4f6ce5
xor eax, eax
mov dword [ebp - 0x238], eax
xor eax, eax
push ebp
push 0x4f6cdb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 0x45], 0
jne 0x4f6cd1
lea eax, [ebp - 0x234]
call fcn.004f8378
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f6ce5
lea eax, [ebp - 0x234]
call fcn.004f8000
cmp dword [ebp - 0x18], 0
je 0x4f6cfe
mov eax, dword [ebp - 0x18]
call fcn.00402a90
mov eax, dword [ebp - 0x234]
cmp dword [eax + 0x70], 0
je 0x4f6d32
mov eax, dword [ebp - 0x234]
mov eax, dword [eax + 0x70]
mov edx, dword [ebp + 0x24]
mov edx, dword [edx]
mov dword [edx + 0xec], eax
mov eax, dword [ebp - 0x234]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp + 0x24]
mov edx, dword [edx]
mov dword [edx + 0xf0], eax
lea eax, [ebp - 0x234]
call fcn.004f5da4
cmp byte [ebp + 0x14], 0
je 0x4f6ea2
cmp byte [ebp - 0x5d], 0
jne 0x4f6ea2
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov esi, dword [eax + 0xe4]
mov dl, 0xed
mov eax, esi
call fcn.0063f6c8
mov ebx, eax
test ebx, ebx
jl 0x4f6d94
mov edx, ebx
mov eax, esi
call fcn.0063f6b0
movzx eax, ax
push eax
mov edx, ebx
mov eax, esi
call fcn.0063f684
mov edx, eax
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov eax, dword [eax + 0x16c]
pop ecx
call fcn.0063ff9c
mov dl, 0xe1
mov eax, esi
call fcn.0063f6c8
mov ebx, eax
test ebx, ebx
jl 0x4f6ea2
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x44], eax
mov edx, ebx
mov eax, esi
call fcn.0063f6b0
movzx eax, ax
push eax
mov edx, ebx
mov eax, esi
call fcn.0063f684
mov ecx, dword [ebp + 0x24]
mov ecx, dword [ecx]
pop edx
call fcn.00644bf8
test al, al
je 0x4f6ea2
cmp dword [ebp - 0x40], 1
jne 0x4f6e5c
cmp dword [ebp - 0x44], 1
jne 0x4f6e5c
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
cmp dword [eax + 0x2c0], 3
jne 0x4f6e10
mov dword [ebp - 0x38], 0x851eb852
mov dword [ebp - 0x34], 0x400451eb
jmp 0x4f6e1c
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], 0x3ff00000
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
fld qword [eax + 0x2b0]
fmul qword [ebp - 0x38]
call fcn.00402f88
mov edx, eax
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
call fcn.0062000c
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
fld qword [eax + 0x2b8]
fmul qword [ebp - 0x38]
call fcn.00402f88
mov edx, eax
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
call fcn.0062003c
jmp 0x4f6e76
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov edx, dword [ebp - 0x40]
call fcn.0062000c
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov edx, dword [ebp - 0x44]
call fcn.0062003c
mov eax, dword [ebp + 0x20]
mov eax, dword [eax + 0x28]
cmp byte [eax], 0
jne 0x4f6ea2
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
cmp byte [eax + 0xfc], 0
je 0x4f6ea2
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax + 0x2a8]
mov eax, dword [ebp - 0xc]
call fcn.00655dd0
ret
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20