Function at 0x407600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xa8
mov eax, dword [esp + 0xac]
push ebx
xor ecx, ecx
push ebp
mov cx, word [eax + 2]
xor ebp, ebp
mov bp, word [eax]
mov edx, ecx
imul edx, ebp
shr ecx, 4
mov dword [esp + 0x58], edx
mov edx, ecx
mov ecx, dword [eax + 0x1c]
push esi
mov dword [esp + 0x30], ecx
mov ecx, dword [eax + 0x20]
mov dword [esp + 0x50], ecx
xor ecx, ecx
mov cl, byte [eax + 0xc]
push edi
mov dword [esp + 0x5c], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x94], ecx
mov ecx, dword [eax + 0x2c]
mov esi, ebp
mov edi, ebp
mov dword [esp + 0x70], ecx
xor ecx, ecx
shr esi, 1
shr edi, 4
test edx, edx
mov dword [esp + 0x24], esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x6c], edx
mov dword [esp + 0x68], 0
lea ebx, [eax + 0x30]
mov dword [esp + 0x28], ecx
jbe 0x408138
mov edx, dword [esp + 0x70]
add edx, 0xfffffffd
mov dword [esp + 0x58], edx
test edi, edi
mov dword [esp + 0x2c], 0
jbe 0x40810f
mov edx, dword [esp + 0x60]
shr edx, 2
mov dword [esp + 0x74], edx
lea edx, [ecx*8]
imul edx, esi
mov esi, dword [esp + 0x58]
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
shl ecx, 4
imul ecx, ebp
add edx, 0x10
mov dword [esp + 0x64], ecx
mov dword [esp + 0x14], edx
mov edx, esi
shl edi, 3
add edx, edi
mov dword [esp + 0x58], edx
jmp 0x4076e5
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0xbc]
mov eax, dword [eax + 0x10]
add esi, 8
lea edx, [ecx + eax]
mov dword [esp + 0x78], edx
lea edi, [edx + 8]
mov dword [esp + 0x7c], edi
lea edi, [edx + ebp*8]
mov dword [esp + 0x80], edi
add edi, 8
mov dword [esp + 0x84], edi
mov edi, dword [esp + 0x38]
add edi, eax
mov eax, dword [esp + 0x60]
add edi, eax
mov eax, dword [esp + 0x74]
add eax, edi
mov dword [esp + 0x88], edi
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0xbc]
mov eax, dword [eax + 0x14]
add ecx, eax
mov dword [esp + 0x3c], ecx
add ecx, 8
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x3c]
lea ecx, [ecx + ebp*8]
mov dword [esp + 0x44], ecx
add ecx, 8
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x38]
add eax, ecx
mov ecx, dword [esp + 0x60]
add eax, ecx
mov ecx, dword [esp + 0x74]
add ecx, eax
mov dword [esp + 0x4c], eax
mov al, byte [esp + 0x5c]
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x14]
mov byte [ecx + 0xc2], al
mov ecx, dword [ebx + 0xc]
lea eax, [ecx - 0x1f]
test eax, eax
jle 0x4077be
mov ecx, 0x20
sub ecx, eax
mov eax, dword [ebx + 4]
shr eax, cl
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0x1c], eax
or eax, 0xffffffff
shr eax, cl
and eax, dword [ebx]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0xc]
lea ecx, [eax - 0x1f]
mov eax, dword [esp + 0x18]
shl eax, cl
mov ecx, dword [esp + 0x1c]
or ecx, eax
mov dword [esp + 0x1c], ecx
jmp 0x4077df
or eax, 0xffffffff
shr eax, cl
mov ecx, dword [ebx]
and eax, ecx
mov ecx, 0x1f
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0xc]
sub ecx, eax
mov eax, dword [esp + 0x18]
shr eax, cl
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0xc]
inc eax
cmp eax, 0x20
mov dword [esp + 0x10], eax
mov dword [ebx + 0xc], eax
jb 0x407837
mov ecx, dword [ebx + 4]
mov eax, dword [ebx + 0x10]
mov dword [ebx], ecx
mov eax, dword [eax + 8]
mov edx, eax
mov ecx, eax
and edx, 0xff0000
shr ecx, 0x10
or edx, ecx
mov ecx, eax
shl ecx, 0x10
and eax, 0xff00
or ecx, eax
mov eax, dword [ebx + 0x10]
shr edx, 8
shl ecx, 8
or edx, ecx
add eax, 4
mov dword [ebx + 4], edx
mov edx, dword [esp + 0x10]
add edx, 0xffffffe0
mov dword [ebx + 0x10], eax
mov dword [ebx + 0xc], edx
mov edx, dword [esp + 0x78]
cmp dword [esp + 0x1c], 1
jne 0x4078fd
mov eax, dword [esp + 0x14]
push ebp
push ebp
mov dword [eax - 0x10], 0xffffffff
mov cx, word [0x422c84]
mov word [esi + 1], cx
mov ax, word [0x422c84]
mov word [esi - 1], ax
mov cx, word [0x422c84]
mov word [esi - 3], cx
mov ecx, dword [esp + 0x44]
mov ax, word [0x422c84]
push ecx
push edx
mov word [esi - 5], ax
call dword [0x434ae0]
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x8c]
push ebp
push ebp
push edx
push eax
call dword [0x434ae0]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0xa0]
push ebp
push ebp
push ecx
push edx
call dword [0x434ae0]
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0xb4]
push ebp
push ebp
push eax
push ecx
call dword [0x434ae0]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x8c]
add esp, 0x40
push eax
push eax
push edx
push edi
call dword [0x434ae0]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x9c]
push eax
push eax
mov eax, dword [esp + 0x68]
push eax
push ecx
call dword [0x434ae0]
add esp, 0x20
jmp 0x4080c5
push ebx
call fcn.004069b0
mov edi, dword [esp + 0x18]
mov ecx, eax
and eax, 3
add esp, 4
shr ecx, 2
mov dword [esp + 0x1c], eax
xor eax, eax
cmp ecx, 2
mov dword [edi - 0x10], ecx
sete al
test eax, eax
mov dword [esp + 0x18], eax
je 0x4079cd
mov edx, dword [ebx + 0xc]
lea eax, [edx - 0x1f]
test eax, eax
jle 0x40795b
mov ecx, 0x20
or edi, 0xffffffff
sub ecx, eax
mov eax, dword [ebx + 4]
shr eax, cl
mov ecx, edx
shr edi, cl
mov ecx, dword [ebx]
and edi, ecx
lea ecx, [edx - 0x1f]
shl edi, cl
or eax, edi
mov edi, dword [esp + 0x14]
jmp 0x40796f
or eax, 0xffffffff
mov ecx, edx
shr eax, cl
mov ecx, dword [ebx]
and eax, ecx
mov ecx, 0x1f
sub ecx, edx
shr eax, cl
inc edx
cmp edx, 0x20
mov dword [esp + 0x10], edx
mov dword [ebx + 0xc], edx
jb 0x4079c5
mov edx, dword [ebx + 4]
mov ecx, dword [ebx + 0x10]
mov dword [ebx], edx
mov ecx, dword [ecx + 8]
mov edx, ecx
mov edi, ecx
and edx, 0xff0000
shr edi, 0x10
or edx, edi
mov edi, ecx
shl edi, 0x10
and ecx, 0xff00
or edi, ecx
mov ecx, dword [ebx + 0x10]
add ecx, 4
shr edx, 8
shl edi, 8
mov dword [ebx + 0x10], ecx
mov ecx, dword [esp + 0x10]
or edx, edi
mov edi, dword [esp + 0x14]
add ecx, 0xffffffe0
mov dword [ebx + 4], edx
mov dword [ebx + 0xc], ecx
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x18]
push eax
push ebx
call fcn.00406a60
mov dl, byte [esp + 0x24]
add esp, 8
shl al, 2
or al, dl
mov byte [edi + 0xc3], al
mov eax, dword [edi - 0x10]
test eax, eax
jne 0x407af1
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x6c]
push edx
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x78]
push ecx
push edx
push eax
call fcn.004073c0
mov word [esp + 0xa4], ax
mov ecx, dword [esp + 0xa4]
push ebx
push ecx
mov word [edi], ax
call fcn.00406620
mov word [esi - 5], ax
mov word [esi - 3], ax
movsx ecx, byte [esi - 4]
mov word [esi - 1], ax
mov word [esi + 1], ax
movsx edi, al
mov eax, ecx
mov edx, edi
sar eax, 1
mov dword [esp + 0x3c], eax
imul eax, ebp
sar edx, 1
mov dword [esp + 0x34], edx
add eax, edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0x38], ecx
add eax, edx
mov edx, dword [esp + 0xd8]
and ecx, 1
add esp, 0x1c
mov edx, dword [edx + 0x18]
mov dword [esp + 0x10], edx
mov edx, edi
and edx, 1
lea ecx, [edx + ecx*2]
sub ecx, 0
je 0x407ab4
dec ecx
je 0x407aa3
push ebp
dec ecx
push 0x10
push eax
je 0x407a96
mov eax, dword [esp + 0x1c]
push eax
call dword [0x45af90]
jmp 0x407ac3
mov ecx, dword [esp + 0x1c]
push ecx
call dword [0x45af98]
jmp 0x407ac3
mov edx, dword [esp + 0x10]
push ebp
push 0x10
push eax
push edx
call dword [0x45af9c]
jmp 0x407ac3
push ebp
push 0x10
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [0x434ad4]
mov edx, dword [esp + 0x28]
and edi, 3
xor ecx, ecx
xor eax, eax
mov cl, byte [edi + 0x422c70]
mov edi, dword [esp + 0x2c]
and edi, 3
add ecx, edx
mov edx, dword [esp + 0x30]
add esp, 0x10
mov al, byte [edi + 0x422c70]
add eax, edx
jmp 0x407d44
cmp eax, 1
jne 0x407eca
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
push 0
push ecx
lea edi, [esi - 5]
push edx
push eax
push edi
call fcn.00409ed0
mov ecx, dword [esp + 0x28]
mov word [esp + 0xb8], ax
mov edx, dword [esp + 0xb8]
push ebx
push edx
mov word [ecx], ax
call fcn.00406620
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov word [edi], ax
mov eax, dword [esp + 0x44]
push 1
push eax
push ecx
push edx
push edi
call fcn.00409ed0
mov ecx, dword [esp + 0x44]
mov word [esp + 0xd0], ax
mov edx, dword [esp + 0xd0]
push ebx
push edx
mov word [ecx + 2], ax
call fcn.00406620
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov word [esi - 3], ax
mov eax, dword [esp + 0x60]
push 2
push eax
push ecx
push edx
push edi
call fcn.00409ed0
mov ecx, dword [esp + 0x60]
add esp, 0x4c
mov word [esp + 0x98], ax
mov edx, dword [esp + 0x98]
push ebx
push edx
mov word [ecx + 4], ax
call fcn.00406620
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov word [esi - 1], ax
mov eax, dword [esp + 0x30]
push 3
push eax
push ecx
push edx
push edi
call fcn.00409ed0
mov ecx, dword [esp + 0x30]
mov word [esp + 0xb8], ax
mov edx, dword [esp + 0xb8]
push ebx
push edx
mov word [ecx + 6], ax
call fcn.00406620
movsx ecx, byte [edi]
mov word [esi + 1], ax
mov dword [esp + 0x34], ecx
movsx eax, byte [esi - 4]
mov edx, eax
and ecx, 1
and edx, 1
push ebp
push 0x10
lea ecx, [ecx + edx*2]
push ecx
sar eax, 1
imul eax, ebp
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x6c]
sar ecx, 1
add edx, eax
add ecx, edx
mov edx, dword [esp + 0xec]
push ecx
mov eax, dword [edx + 0x18]
push eax
call fcn.0040a100
movsx eax, byte [esi - 2]
movsx ecx, byte [esi - 3]
mov edx, eax
mov dword [esp + 0x48], ecx
sar eax, 1
imul eax, ebp
and edx, 1
and ecx, 1
push ebp
push 0x10
lea ecx, [ecx + edx*2]
mov edx, dword [esp + 0x80]
push ecx
mov ecx, dword [esp + 0x54]
sar ecx, 1
add edx, eax
add ecx, edx
mov edx, dword [esp + 0x100]
push ecx
mov eax, dword [edx + 0x18]
add eax, 8
push eax
call fcn.0040a100
movsx eax, byte [esi]
movsx ecx, byte [esi - 1]
mov edx, eax
mov dword [esp + 0x5c], ecx
sar eax, 1
imul eax, ebp
add esp, 0x4c
and edx, 1
and ecx, 1
push ebp
push 0x10
lea ecx, [ecx + edx*2]
mov edx, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x1c]
sar ecx, 1
add edx, eax
add ecx, edx
mov edx, dword [esp + 0xc8]
push ecx
mov eax, dword [edx + 0x18]
add eax, 0x80
push eax
call fcn.0040a100
movsx eax, byte [esi + 2]
movsx ecx, byte [esi + 1]
mov edx, eax
mov dword [esp + 0x24], ecx
sar eax, 1
imul eax, ebp
and edx, 1
and ecx, 1
push ebp
push 0x10
lea ecx, [ecx + edx*2]
mov edx, dword [esp + 0x64]
push ecx
mov ecx, dword [esp + 0x30]
sar ecx, 1
add edx, eax
add ecx, edx
mov edx, dword [esp + 0xdc]
push ecx
mov eax, dword [edx + 0x18]
add eax, 0x88
push eax
call fcn.0040a100
movsx eax, byte [esi + 1]
movsx ecx, byte [esi - 1]
movsx edx, byte [esi - 3]
add eax, ecx
add esp, 0x28
movsx ecx, byte [edi]
movsx edi, byte [esi]
add eax, edx
movsx edx, byte [esi + 2]
add eax, ecx
add edi, edx
movsx ecx, byte [esi - 2]
movsx edx, byte [esi - 4]
add edi, ecx
mov ecx, eax
add edi, edx
and ecx, 0xf
xor edx, edx
mov dl, byte [ecx + 0x422c74]
mov ecx, edx
xor edx, edx
sar eax, 3
add ecx, eax
mov eax, edi
and eax, 0xf
sar edi, 3
mov dl, byte [eax + 0x422c74]
mov eax, edx
add eax, edi
mov edx, eax
mov edi, ecx
and edx, 1
and edi, 1
sar eax, 1
lea edi, [edi + edx*2]
mov edx, dword [esp + 0x24]
imul eax, edx
sar ecx, 1
add eax, ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x18], eax
push edx
mov edx, dword [esp + 0xc0]
push 8
add eax, ecx
push edi
push eax
mov eax, dword [edx + 0x18]
add eax, 0x100
push eax
call fcn.0040a100
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x2c]
push ecx
push 8
push edi
mov edi, dword [esp + 0xdc]
add eax, edx
push eax
mov ecx, dword [edi + 0x18]
add ecx, 0x140
push ecx
call fcn.0040a100
mov eax, dword [edi + 0x18]
add esp, 0x28
mov dword [esp + 0x3c], eax
mov dword [esp + 0x20], 5
lea edx, [eax + 8]
lea ecx, [eax + 0x80]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ecx
lea edx, [eax + 0x88]
lea ecx, [eax + 0x100]
add eax, 0x140
xor edi, edi
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x10], edi
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov edx, 1
shl edx, cl
mov cl, byte [eax + 0xc3]
test cl, dl
je 0x407e80
mov edx, dword [esp + 0xbc]
mov ecx, 0x20
xor eax, eax
mov edi, dword [edx + 4]
rep stosd dword es:[edi], eax
mov edi, edx
mov eax, dword [edi + 4]
push eax
push ebx
call fcn.00406b20
mov ecx, dword [esp + 0x64]
mov edx, dword [edi + 4]
mov edi, dword [esp + 0x9c]
push ecx
push edx
push edi
call dword [0x434af4]
push edi
call dword [0x434ae4]
mov eax, dword [esp + 0x28]
add esp, 0x18
cmp eax, 4
mov ecx, ebp
jl 0x407e59
mov ecx, dword [esp + 0x24]
cmp eax, 4
sbb edx, edx
and edx, 8
add edx, 8
push edx
mov edx, dword [esp + eax*4 + 0x7c]
push ecx
mov ecx, dword [esp + eax*4 + 0x44]
push edi
push ecx
push edx
call dword [0x45af88]
mov edi, dword [esp + 0x24]
add esp, 0x14
jmp 0x407eae
cmp edi, 4
mov eax, ebp
jl 0x407e8b
mov eax, dword [esp + 0x24]
cmp edi, 4
mov edx, dword [esp + edi*4 + 0x3c]
sbb ecx, ecx
and ecx, 8
add ecx, 8
push ecx
push eax
mov eax, dword [esp + edi*4 + 0x80]
push edx
push eax
call dword [0x434ae0]
add esp, 0x10
mov ecx, dword [esp + 0x20]
inc edi
dec ecx
cmp edi, 6
mov dword [esp + 0x10], edi
mov dword [esp + 0x20], ecx
jl 0x407df1
jmp 0x4080c5
mov cx, word [0x422c84]
mov dword [esp + 0x10], 0
mov word [esi + 1], cx
mov dx, word [0x422c84]
mov word [esi - 1], dx
mov ax, word [0x422c84]
mov word [esi - 3], ax
mov cx, word [0x422c84]
lea edx, [esp + 0x78]
mov word [esi - 5], cx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], 5
mov edx, dword [esp + 0xbc]
mov ecx, 0x20
xor eax, eax
mov edi, dword [edx + 4]
mov edx, dword [esp + 0x28]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xa8]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x5c]
push edx
mov edx, dword [esp + 0x40]
push eax
push ecx
push edx
call fcn.00409cb0
mov eax, dword [esp + 0x80]
add esp, 0x18
test eax, eax
jne 0x407f67
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [ecx + eax + 0xcc], 0
mov eax, dword [esp + 0x10]
push ebx
cmp eax, 4
jae 0x407f7f
call fcn.00407090
add esp, 4
mov dword [esp + 0x20], eax
jmp 0x407f8b
call fcn.004071b0
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
je 0x407f9b
push eax
push ebx
call fcn.004072f0
add esp, 8
jmp 0x407f9d
xor eax, eax
mov edi, dword [esp + 0xbc]
mov edx, dword [edi + 4]
mov word [edx], ax
mov eax, dword [esp + 0x20]
cmp eax, 8
jle 0x408004
mov ecx, dword [ebx + 0xc]
inc ecx
mov eax, ecx
mov dword [ebx + 0xc], ecx
cmp eax, 0x20
jb 0x408004
mov eax, dword [ebx + 4]
mov dword [ebx], eax
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 8]
mov ecx, eax
mov edx, eax
and ecx, 0xff0000
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
mov eax, dword [ebx + 0x10]
add eax, 4
shr ecx, 8
shl edx, 8
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0xc]
or ecx, edx
add eax, 0xffffffe0
mov dword [ebx + 4], ecx
mov dword [ebx + 0xc], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov edx, 1
shl edx, cl
mov cl, byte [eax + 0xc3]
test cl, dl
je 0x408043
mov ecx, dword [esp + 0x10]
add eax, 0xfffffff0
xor edx, edx
push 1
mov dl, byte [ecx + eax + 0xcc]
push 1
push edx
mov edx, dword [edi + 4]
push edx
push ebx
call fcn.00406da0
mov eax, dword [esp + 0x28]
add esp, 0x14
mov edx, dword [edi + 4]
lea ecx, [esp + 0xa8]
push ecx
mov ecx, dword [esp + 0x14]
push edx
add eax, 0xfffffff0
push ecx
push eax
call fcn.00406530
mov edx, dword [esp + 0x6c]
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
push edx
push eax
push ecx
call dword [0x434aec]
mov edx, dword [edi + 8]
push edx
call dword [0x434ae4]
mov eax, dword [esp + 0x30]
add esp, 0x20
cmp eax, 4
mov eax, ebp
jb 0x40808c
mov eax, dword [esp + 0x24]
push 8
push eax
mov eax, dword [edi + 8]
mov edi, dword [esp + 0x20]
push eax
mov ecx, dword [edi]
push ecx
call dword [0x434adc]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
add esp, 0x10
inc eax
dec ecx
add edi, 4
cmp eax, 6
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edi
jb 0x407f0d
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x38]
mov edx, dword [esp + 0x14]
add ecx, 0x10
inc eax
mov dword [esp + 0x64], ecx
mov ecx, dword [esp + 0x30]
add edi, 8
add edx, 0xd4
cmp eax, ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], edi
mov dword [esp + 0x14], edx
jb 0x4076da
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0xbc]
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x34]
inc ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x6c]
cmp ecx, edx
mov dword [esp + 0x28], ecx
jb 0x40768b
mov eax, dword [ebx + 0xc]
and eax, 7
je 0x408191
mov edx, dword [ebx + 0xc]
mov ecx, 8
sub ecx, eax
add edx, ecx
cmp edx, 0x20
mov dword [ebx + 0xc], edx
jb 0x408191
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 0x10]
mov dword [ebx], eax
mov eax, dword [ecx + 8]
add ecx, 4
mov esi, eax
mov edi, eax
and esi, 0xff0000
mov dword [ebx + 0x10], ecx
shr edi, 0x10
or esi, edi
mov edi, eax
shl edi, 0x10
and eax, 0xff00
or edi, eax
shr esi, 8
shl edi, 8
or esi, edi
add edx, 0xffffffe0
mov dword [ebx + 4], esi
mov dword [ebx + 0xc], edx
mov ecx, dword [ebx + 0x14]
mov ebp, dword [ebx + 0x10]
mov eax, ecx
mov esi, dword [ebx + 0x1c]
shl eax, 0x1d
mov edx, dword [ebx + 0xc]
sub eax, ecx
add eax, ebp
pop edi
shl eax, 3
sub eax, esi
pop esi
add eax, edx
pop ebp
shr eax, 3
pop ebx
add esp, 0xa8
ret