Function at 0x4fbc70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
mov eax, dword [esp + 0x78]
push ebx
push ebp
lea eax, [eax + eax*4]
shl eax, 4
push esi
push edi
mov edi, dword [esp + 0x84]
mov ebp, dword [edi]
mov edx, dword [ebp]
mov ebx, dword [ebp + 8]
lea esi, [eax + edi + 0x2e0]
movzx eax, byte [esi + 0x2c]
mov dword [esp + 0x2c], edx
lea edx, [eax + eax*4]
mov eax, dword [edi + 4]
lea ecx, [edi + 0x148]
mov dword [esp + 0x44], ecx
mov ecx, dword [esi + 0x40]
shl edx, 4
lea eax, [edx + eax + 8]
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 0x30]
mov dword [esp + 0x34], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x40], 0
test eax, eax
jle 0x4fbcf9
lea ecx, [edi + 0x48]
mov edi, edi
mov edx, dword [esp + 0x18]
cmp dword [ecx], edx
je 0x4fbe8d
inc dword [esp + 0x40]
add ecx, 4
cmp dword [esp + 0x40], eax
jl 0x4fbce0
xor eax, eax
xor edx, edx
mov ecx, dword [esp + 0x88]
not eax
and eax, dword [esp + 0x8c]
not edx
and edx, dword [esp + 0x90]
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], edx
mov eax, dword [edi + 0x18]
mov edx, dword [edi + 0x1c]
call fcn.00554e40
and eax, 1
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
test byte [eax + 0x24], 0x40
je 0x4fbd46
test byte [edi + 0x22], 0x20
mov dword [esp + 0x68], 1
je 0x4fbd4e
mov dword [esp + 0x68], 0
mov eax, dword [ebx + 0x18]
mov ecx, dword [eax + 0x70]
lea edx, [ecx + 1]
mov dword [eax + 0x70], edx
lea edx, [ecx - 1]
mov dword [esp + 0x50], eax
mov dword [esp + 0x64], ecx
test ecx, edx
jne 0x4fbd9e
mov eax, ecx
lea ecx, [eax*8 + 4]
mov eax, dword [esp + 0x50]
mov edi, dword [eax + 0x74]
mov esi, dword [eax]
push 0
push ecx
call fcn.004cbab0
mov edx, dword [esp + 0x58]
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x6c]
mov edi, dword [esp + 0x8c]
mov dword [edx + 0x74], eax
add esp, 8
mov eax, edx
mov eax, dword [eax + 0x74]
test eax, eax
je 0x4fbdac
mov dword [eax + ecx*4], 0xffffffff
or eax, 0xffffffff
sub eax, ecx
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], eax
mov ecx, dword [ebx + 0x18]
mov dword [esp + 0x3c], eax
mov eax, dword [ecx + 0x70]
lea edx, [eax + 1]
mov dword [ecx + 0x70], edx
lea edx, [eax - 1]
mov dword [esp + 0x50], ecx
mov dword [esp + 0x64], eax
test eax, edx
jne 0x4fbe09
lea ecx, [eax*8 + 4]
mov eax, dword [esp + 0x50]
mov edi, dword [eax + 0x74]
mov esi, dword [eax]
push 0
push ecx
call fcn.004cbab0
mov edx, dword [esp + 0x58]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x8c]
mov dword [edx + 0x74], eax
mov eax, dword [esp + 0x6c]
add esp, 8
mov ecx, edx
mov ecx, dword [ecx + 0x74]
test ecx, ecx
je 0x4fbe17
mov dword [ecx + eax*4], 0xffffffff
or ecx, 0xffffffff
sub ecx, eax
cmp byte [esi + 0x2c], 0
mov dword [esp + 0x50], ecx
mov dword [esi + 0x18], ecx
jbe 0x4fbe4b
mov eax, dword [esp + 0x34]
test byte [eax + 0x24], 8
je 0x4fbe4b
inc dword [ebp + 0x48]
mov eax, dword [ebp + 0x48]
push 0
push eax
push 0
push 0x17
push ebx
mov dword [esi], eax
call fcn.004cf760
add esp, 0x14
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx + 0x28]
mov dword [esp + 0x7c], eax
test al, 0x10
je 0x4fbea2
mov eax, ecx
mov edx, dword [eax + 0x18]
mov edi, dword [eax + 0x1c]
push edx
push 0
push edi
push 0x11
push ebx
call fcn.004cf760
mov eax, dword [esp + 0x50]
push 0
push eax
push edi
push 0x14
push ebx
call fcn.004cf760
add esp, 0x28
mov dword [esi + 0x34], eax
mov byte [esi + 0x2d], 0xe
jmp 0x4fc07f
mov ecx, dword [esp + 0x40]
mov eax, 1
xor edx, edx
call fcn.005543f0
jmp 0x4fbcfd
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx + 0x24]
test edx, 0x400
je 0x4fc0d6
movzx eax, word [ecx + 0x28]
mov edi, dword [ebp + 0x38]
inc dword [ebp + 0x68]
mov edx, dword [ebp + 0x3c]
mov dword [esp + 0x40], eax
add eax, 2
cmp eax, edi
mov dword [esp + 0x70], eax
mov dword [esp + 0x3c], edx
jg 0x4fbee1
add edx, eax
sub edi, eax
mov dword [ebp + 0x3c], edx
mov dword [ebp + 0x38], edi
jmp 0x4fbef0
mov edx, dword [ebp + 0x48]
lea edi, [edx + 1]
add eax, edx
mov dword [esp + 0x3c], edi
mov dword [ebp + 0x48], eax
mov eax, dword [esi + 0xc]
xor edi, edi
cmp dword [esp + 0x40], edi
mov dword [esp + 0x60], eax
jle 0x4fbf5e
mov edx, dword [esp + 0x3c]
add edx, 2
mov dword [esp + 0x64], edx
lea ebx, [ebx]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x4fbf4e
test byte [eax + 0x12], 1
push edx
je 0x4fbf3b
mov ecx, dword [esp + 0x20]
push ecx
push edi
push esi
push eax
push ebp
call fcn.004d3dc0
mov edx, dword [esi + 0x10]
add esp, 0x18
mov dword [esp + 0x60], edx
jmp 0x4fbf4a
mov eax, dword [eax]
mov ecx, dword [eax + 0x10]
push ecx
push ebp
call fcn.0051b9e0
add esp, 0xc
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x64]
inc edi
inc edx
cmp edi, dword [esp + 0x40]
mov dword [esp + 0x64], edx
jl 0x4fbf10
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x3c]
mov eax, dword [edx + 0x18]
push 0
push edi
push eax
push 0x17
push ebx
call fcn.004cf760
mov ecx, dword [esp + 0x54]
push 0
inc edi
push edi
push ecx
push 0x17
push ebx
call fcn.004cf760
mov edx, dword [esp + 0x48]
movzx edi, byte [edx + 0x1c]
mov eax, edx
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x88]
push edx
push eax
mov dword [esp + 0xa4], ecx
mov ecx, dword [esp + 0x48]
neg edi
push ecx
sbb edi, edi
push 0xc
and edi, 0xfffffff7
push ebx
add edi, 0xfffffffe
call fcn.004cf760
push edi
mov edi, dword [esp + 0xb4]
push ebx
call fcn.004cfc30
mov edx, dword [esp + 0x64]
add esp, 0x44
cmp dword [esp + 0x40], 0
mov byte [edx + 0x1c], 0
mov dword [esp + 0x24], 0
jle 0x4fc028
mov edi, dword [esp + 0x24]
lea ebx, [ebx]
cmp edi, 0x10
jge 0x4fc028
mov eax, dword [esp + 0x20]
mov dx, word [eax + 0x1e]
mov cx, di
shr dx, cl
test dl, 1
je 0x4fc01d
mov ecx, dword [eax + 0x30]
mov edx, dword [esp + 0x24]
mov eax, dword [ecx + edx*4]
mov edi, esi
call fcn.004c9340
mov edi, dword [esp + 0x24]
inc edi
cmp edi, dword [esp + 0x40]
mov dword [esp + 0x24], edi
jl 0x4fbff0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x84]
mov edi, dword [esp + 0x70]
mov dword [eax + 0x30], ecx
mov cl, byte [edx + 0x26]
neg cl
sbb cl, cl
and cl, 6
add cl, 0x9b
mov byte [eax + 0x2d], cl
mov edx, dword [ebx + 0x20]
mov dword [eax + 0x34], edx
mov eax, dword [esp + 0x3c]
push eax
mov eax, edi
mov esi, ebp
call fcn.004c6f00
add esp, 4
cmp edi, dword [ebp + 0x38]
jle 0x4fc074
mov ecx, dword [esp + 0x3c]
mov dword [ebp + 0x38], edi
mov dword [ebp + 0x3c], ecx
mov eax, ebp
call fcn.004c6f60
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x44]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 0x14]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
test edx, edx
jle 0x4fd049
lea esp, [esp]
movzx eax, word [ecx + 0x14]
xor edi, edi
mov dword [esp + 0x7c], eax
test al, 6
jne 0x4fd02d
mov eax, dword [ecx + 0x28]
mov edx, dword [ecx + 0x2c]
and eax, dword [esi + 0x48]
and edx, dword [esi + 0x4c]
or eax, edx
je 0x4fcf69
mov eax, dword [esp + 0x84]
mov byte [eax + 0x27], 1
jmp 0x4fd02d
mov eax, edx
and eax, 0x100
je 0x4fc173
test dl, 5
je 0x4fc173
mov edx, ecx
mov eax, dword [edx + 0x30]
mov eax, dword [eax]
inc dword [ebp + 0x48]
mov ecx, dword [ebp + 0x48]
push ecx
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x20]
push ecx
push 0
push esi
push eax
push ebp
call fcn.004d3dc0
mov edi, eax
add esp, 0x18
cmp edi, dword [esp + 0x40]
je 0x4fc123
mov esi, dword [esp + 0x40]
mov edx, ebp
call fcn.004c7170
mov edx, dword [esp + 0x14]
mov esi, dword [edx + 0x10]
push 0
push esi
push edi
push 0x27
push ebx
call fcn.004cf760
mov eax, dword [esp + 0x2c]
push edi
push esi
push eax
push 0x4a
push ebx
call fcn.004cf760
push edi
mov eax, 1
mov esi, ebp
call fcn.004c6f00
mov ecx, dword [esp + 0x44]
push edi
push 0xffffffffffffffff
push ecx
mov edx, ebp
call fcn.004c6df0
mov edx, dword [esp + 0x4c]
add esp, 0x38
mov byte [edx + 0x2d], 0xa1
mov esi, edx
jmp 0x4fc07f
test eax, eax
je 0x4fc337
test dl, 2
je 0x4fc337
xor eax, eax
xor edi, edi
mov dword [esp + 0x34], 0xa1
mov dword [esp + 0x64], eax
mov dword [esp + 0x40], eax
test dl, 0x20
je 0x4fc1a7
mov eax, dword [ecx + 0x30]
mov edi, dword [eax]
mov eax, 1
test dl, 0x10
je 0x4fc1b6
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + eax*4]
mov dword [esp + 0x40], edx
cmp dword [esp + 0x1c], 0
je 0x4fc1c7
mov eax, edi
mov edi, dword [esp + 0x40]
mov dword [esp + 0x40], eax
test edi, edi
je 0x4fc246
mov esi, dword [edi]
mov ecx, dword [esi + 0x10]
lea eax, [esp + 0x70]
push eax
push ecx
mov eax, ebp
mov byte [esp + 0x40], 0x43
mov byte [esp + 0x41], 0x41
mov byte [esp + 0x42], 0x40
mov byte [esp + 0x43], 0x42
call fcn.004db8c0
movzx ecx, byte [esi]
mov edx, dword [esp + 0x44]
push eax
push edx
movzx edx, byte [esp + ecx - 8]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x28]
push eax
push edx
push ebx
call fcn.004cf760
mov eax, dword [esp + 0x90]
push eax
mov eax, 1
mov esi, ebp
call fcn.004c6f00
mov esi, dword [esp + 0x90]
add esp, 0x20
mov edx, ebp
call fcn.004c7170
mov eax, edi
mov edi, dword [esp + 0x14]
call fcn.004c9340
mov esi, edi
jmp 0x4fc266
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 0x6e
push ecx
mov ecx, dword [esp + 0x1c]
push ebx
call fcn.004cf7d0
add esp, 8
mov eax, dword [esp + 0x40]
test eax, eax
je 0x4fc2c1
mov edi, dword [eax]
inc dword [ebp + 0x48]
mov eax, dword [ebp + 0x48]
mov edx, dword [edi + 0x10]
push eax
push edx
push ebp
mov dword [esp + 0x70], eax
call fcn.0051b9e0
mov al, byte [edi]
add esp, 0xc
cmp al, 0x52
je 0x4fc2a5
cmp al, 0x50
je 0x4fc2a5
xor eax, eax
cmp dword [esp + 0x1c], eax
setne al
lea eax, [eax + eax + 0x50]
mov dword [esp + 0x34], eax
jmp 0x4fc2b6
xor ecx, ecx
cmp dword [esp + 0x1c], ecx
sete cl
lea ecx, [ecx + ecx + 0x51]
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x40]
mov edi, esi
call fcn.004c9340
cmp dword [esp + 0x1c], 0
mov eax, dword [ebx + 0x20]
mov ecx, dword [esp + 0x18]
sete dl
add dl, 7
cmp dword [esp + 0x34], 0xa1
mov byte [esi + 0x2d], dl
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
je 0x4fc07f
inc dword [ebp + 0x48]
mov edi, dword [ebp + 0x48]
push 0
push edi
mov edx, ecx
push edx
push 0x69
push ebx
call fcn.004cf760
mov eax, dword [esp + 0x2c]
push edi
push 0xffffffffffffffff
push eax
mov edx, ebp
call fcn.004c6df0
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x84]
mov eax, dword [esp + 0x54]
push edi
push ecx
push edx
push eax
push ebx
call fcn.004cf760
add esp, 0x34
mov dl, 0x53
mov ecx, ebx
call fcn.004cf980
jmp 0x4fc07f
test edx, 0x200
je 0x4fc8a9
movzx eax, word [ecx + 0x18]
xor edx, edx
test byte [edi + 0x22], 1
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], edx
mov dword [esp + 0x30], edx
mov byte [esp + 0x48], dl
mov byte [esp + 0x12], dl
mov byte [esp + 0x13], dl
mov edx, dword [ecx + 0x1c]
mov dword [esp + 0x3c], edx
mov edx, dword [esi + 8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x40], edx
je 0x4fc396
cmp byte [edi + 0x24], 0
jle 0x4fc396
mov edx, dword [esp + 0x3c]
cmp word [edx + 0x32], ax
jbe 0x4fc396
mov byte [esp + 0x12], 1
mov dword [esp + 0x30], 1
test byte [ecx + 0x24], 0x20
movzx edi, ax
mov eax, edi
je 0x4fc3b4
mov edx, dword [ecx + 0x30]
mov edx, dword [edx + eax*4]
mov dword [esp + 0x34], edx
inc eax
mov dword [esp + 0x30], 1
test byte [ecx + 0x24], 0x10
mov edx, dword [esp + 0x3c]
je 0x4fc434
mov ecx, dword [ecx + 0x30]
mov eax, dword [ecx + eax*4]
mov ecx, 0x100
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], 1
test word [eax + 0x14], cx
je 0x4fc40d
inc dword [ebp + 0x48]
mov eax, dword [ebp + 0x48]
push 0
push eax
mov dword [esi + 0x24], eax
mov eax, dword [edx + 0x1c]
xor ecx, ecx
cmp byte [edi + eax], 1
sete cl
xor ecx, dword [esp + 0x24]
push ecx
push 0x17
push ebx
call fcn.004cf760
mov edx, dword [ebx + 0x20]
mov dword [esi + 0x28], edx
mov edx, dword [esp + 0x50]
add esp, 0x14
cmp dword [esp + 0x34], 0
jne 0x4fc434
mov eax, dword [edx + 4]
movsx eax, word [eax + edi*2]
test eax, eax
jl 0x4fc434
mov ecx, dword [edx + 0xc]
mov ecx, dword [ecx + 4]
lea eax, [eax + eax*2]
cmp byte [ecx + eax*8 + 0x14], 0
jne 0x4fc434
mov byte [esp + 0x12], 1
movzx eax, word [edx + 0x32]
cmp word [esp + 0x24], ax
jae 0x4fc450
mov edx, dword [edx + 0x1c]
xor ecx, ecx
cmp byte [edi + edx], cl
sete cl
cmp dword [esp + 0x1c], ecx
je 0x4fc45e
cmp dword [esp + 0x1c], 0
je 0x4fc47b
cmp ax, word [esp + 0x24]
jne 0x4fc47b
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x34], eax
mov al, byte [esp + 0x12]
mov dword [esp + 0x38], edx
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], al
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x28]
push eax
push ecx
push edx
push esi
push ebp
call fcn.004d9920
add esp, 0x14
cmp dword [esp + 0x28], 0
mov dword [esp + 0x30], eax
je 0x4fc4aa
mov eax, dword [esp + 0x28]
mov cl, byte [edi + eax]
mov byte [esp + 0x48], cl
mov edx, dword [esi + 0x10]
mov eax, dword [esp + 0x34]
mov dword [esp + 0x4c], edx
mov dl, 0x28
test eax, eax
je 0x4fc4c8
mov dword [esp + 0x58], 0
test byte [eax + 0x12], dl
je 0x4fc4d0
mov dword [esp + 0x58], 1
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x4fc4e5
mov dword [esp + 0x60], 0
test byte [ecx + 0x12], dl
je 0x4fc4ed
mov dword [esp + 0x60], 1
test eax, eax
jne 0x4fc4fc
mov dword [esp + 0x5c], eax
cmp word [esp + 0x24], ax
jbe 0x4fc504
mov dword [esp + 0x5c], 1
mov dword [esp + 0x24], edi
test eax, eax
je 0x4fc5ab
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov eax, dword [ecx + 0x10]
mov edx, dword [esp + 0x30]
lea ecx, [edi + edx]
push ecx
push eax
push ebp
mov dword [esp + 0x60], eax
call fcn.0051b9e0
mov edx, dword [esp + 0x40]
push esi
mov ecx, ebx
call fcn.004c93b0
mov eax, dword [esp + 0x64]
add esp, 0x10
call fcn.004c6bf0
test eax, eax
je 0x4fc562
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x30]
push 0
push eax
lea eax, [edi + ecx]
push eax
push 0x4c
push ebx
call fcn.004cf760
add esp, 0x14
cmp dword [esp + 0x28], 0
je 0x4fc5a5
mov edx, dword [esp + 0x28]
movzx eax, byte [edi + edx]
push eax
mov eax, dword [esp + 0x58]
call fcn.004d76a0
add esp, 4
cmp al, 0x41
jne 0x4fc589
mov ecx, dword [esp + 0x28]
mov byte [edi + ecx], al
mov edx, dword [esp + 0x28]
mov dl, byte [edi + edx]
mov ecx, dword [esp + 0x54]
call fcn.004c6ca0
test eax, eax
je 0x4fc5a5
mov eax, dword [esp + 0x28]
mov byte [edi + eax], 0x41
inc dword [esp + 0x24]
jmp 0x4fc5de
cmp byte [esp + 0x12], 0
je 0x4fc5de
mov ecx, dword [esp + 0x30]
push 0
lea edx, [edi + ecx]
push edx
push 0
push 0x1a
push ebx
call fcn.004cf760
mov eax, 1
add esp, 0x14
add dword [esp + 0x24], eax
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], eax
movzx eax, byte [esp + 0x12]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x30]
sub ecx, eax
mov eax, dword [esp + 0x28]
push ecx
push edx
push ebp
call fcn.004d3d50
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x64]
push eax
mov eax, dword [esp + 0x6c]
push ecx
lea ecx, [edx + eax*2]
mov edx, dword [esp + 0x30]
movzx eax, byte [edx + ecx*2 + 0x58ba9c]
mov ecx, dword [esp + 0x60]
push eax
mov eax, dword [esp + 0x48]
push ebx
call fcn.004d6580
add esp, 0x1c
cmp dword [esp + 0x38], 0
mov dword [esp + 0x24], edi
je 0x4fc6d4
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
add edi, ecx
mov dword [esp + 0x64], eax
push edi
mov eax, 1
mov esi, ebp
call fcn.004c6f00
mov esi, dword [esp + 0x68]
push edi
push esi
push ebp
call fcn.0051b9e0
mov edx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x4c]
mov ecx, ebx
call fcn.004c93b0
add esp, 0x14
mov eax, esi
call fcn.004c6bf0
test eax, eax
je 0x4fc698
mov eax, dword [esp + 0x4c]
push 0
push eax
push edi
push 0x4c
push ebx
call fcn.004cf760
add esp, 0x14
mov ecx, dword [esp + 0x48]
mov esi, dword [esp + 0x64]
push ecx
mov eax, esi
call fcn.004d76a0
add esp, 4
cmp al, 0x41
je 0x4fc6ce
mov dl, byte [esp + 0x48]
mov ecx, esi
call fcn.004c6ca0
test eax, eax
jne 0x4fc6ce
push 1
push edi
push ebp
lea eax, [esp + 0x54]
call fcn.004d3d50
add esp, 0xc
mov esi, dword [esp + 0x14]
jmp 0x4fc6f9
cmp byte [esp + 0x13], 0
je 0x4fc6fd
mov edx, dword [esp + 0x30]
push 0
add edi, edx
push edi
push 0
push 0x1a
push ebx
call fcn.004cf760
add esp, 0x14
mov dword [esp + 0x60], 0
inc dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
call fcn.004bf680
mov eax, dword [ebx + 0x20]
mov dword [esi + 0x34], eax
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4fc740
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x60]
push eax
mov eax, dword [esp + 0x20]
push ecx
movzx ecx, byte [edx + eax*2 + 0x58baa4]
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x58]
push ebx
call fcn.004d6580
add esp, 0x10
mov eax, dword [esp + 0x34]
mov edi, esi
call fcn.004c9340
mov eax, dword [esp + 0x38]
call fcn.004c9340
cmp dword [esp + 0x68], 0
jne 0x4fc865
mov edx, dword [esp + 0x3c]
mov eax, dword [edx + 0xc]
test byte [eax + 0x2a], 0x20
jne 0x4fc7d1
inc dword [ebp + 0x48]
mov edi, dword [ebp + 0x48]
mov eax, dword [esp + 0x40]
push 0
push edi
push eax
push 0x72
push ebx
call fcn.004cf760
mov ecx, dword [esp + 0x2c]
push edi
push 0xffffffffffffffff
push ecx
mov edx, ebp
call fcn.004c6df0
mov edx, dword [esp + 0xa4]
add esp, 0x20
cmp byte [edx + 0x26], 0
je 0x4fc7b9
mov eax, dword [esp + 0x18]
push edi
push 0
push eax
push 0x4a
push ebx
call fcn.004cf760
add esp, 0x14
jmp 0x4fc865
mov ecx, dword [esp + 0x18]
push 0
push edi
push ecx
push 0x44
push ebx
call fcn.004cf760
add esp, 0x14
jmp 0x4fc865
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x40]
je 0x4fc865
call fcn.004c7600
movzx esi, word [eax + 0x32]
mov ecx, ebp
mov dword [esp + 0x4c], eax
call fcn.004c71a0
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x68], eax
xor eax, eax
xor edi, edi
cmp ax, word [ecx + 0x32]
jae 0x4fc840
mov edx, dword [esp + 0x68]
mov ecx, dword [esp + 0x4c]
lea eax, [edi + edx]
mov edx, dword [ecx + 4]
mov si, word [edx + edi*2]
mov edx, dword [esp + 0x3c]
push eax
call fcn.004c7620
mov ecx, dword [esp + 0x44]
cwde
push eax
push ecx
push 0x30
push ebx
call fcn.004cf760
mov edx, dword [esp + 0x60]
movzx eax, word [edx + 0x32]
inc edi
add esp, 0x14
cmp edi, eax
jl 0x4fc805
mov ecx, dword [esp + 0x4c]
movzx edx, word [ecx + 0x32]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x50]
push edx
push eax
mov eax, dword [esp + 0x70]
push 0x46
push ebx
call fcn.004d6580
mov esi, dword [esp + 0x24]
add esp, 0x10
mov eax, dword [esp + 0x20]
test dword [eax + 0x24], 0x1000
je 0x4fc878
mov byte [esi + 0x2d], 0xa1
jmp 0x4fc886
cmp dword [esp + 0x1c], 0
sete cl
add cl, 7
mov byte [esi + 0x2d], cl
mov edx, dword [esp + 0x40]
mov dword [esi + 0x30], edx
mov cl, byte [eax + 0x26]
and cl, 1
mov byte [esi + 0x2e], cl
test byte [eax + 0x24], 0xf
jne 0x4fc07f
mov byte [esi + 0x2f], 1
jmp 0x4fc07f
test edx, 0x2000
je 0x4fcf23
mov eax, dword [ebp + 0x44]
inc dword [ebp + 0x48]
mov edx, dword [ebp + 0x48]
mov dword [esp + 0x6c], eax
inc eax
xor ecx, ecx
mov dword [ebp + 0x44], eax
mov eax, ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x54], ecx
call fcn.004cf7f0
mov edx, dword [esp + 0x20]
mov dword [esp + 0x70], eax
xor eax, eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [eax + 0x10]
mov eax, dword [edx + 0x30]
mov eax, dword [eax]
mov edx, dword [esp + 0x40]
mov dword [esp + 0x3c], ecx
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x20], eax
mov byte [esi + 0x2d], 0x10
mov dword [esi + 0x30], edx
mov al, byte [edi + 0x29]
mov dword [esp + 0x64], ecx
cmp al, 1
jbe 0x4fc9e5
mov esi, dword [esp + 0x2c]
movzx eax, al
sub eax, dword [esp + 0x88]
push 0
dec eax
mov dword [esp + 0x64], eax
lea eax, [eax + eax*4]
shl eax, 4
add eax, 0x58
push eax
call fcn.004cb940
add esp, 8
mov dword [esp + 0x24], eax
test eax, eax
jne 0x4fc967
mov eax, dword [esp + 0x8c]
mov edx, dword [esp + 0x90]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret
mov cl, byte [esp + 0x60]
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x34]
mov edx, dword [esp + 0x84]
inc cl
movzx ecx, cl
mov dword [eax + 4], ecx
mov dword [eax], ecx
lea edi, [eax + 8]
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
mov edx, dword [edx + 4]
add edx, 8
cmp dword [esp + 0x60], 1
jl 0x4fc9ec
mov ecx, dword [esp + 0x60]
add eax, 0x58
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x14]
add eax, 0x7c
mov dword [esp + 0x5c], eax
mov dword [esp + 0x68], ecx
mov eax, dword [esp + 0x5c]
movzx eax, byte [eax]
mov edi, dword [esp + 0x58]
lea esi, [eax + eax*4]
shl esi, 4
mov eax, 0x50
add dword [esp + 0x5c], eax
add dword [esp + 0x58], eax
add esi, edx
sub dword [esp + 0x68], 1
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
jne 0x4fc9b5
jmp 0x4fc9ec
mov ecx, dword [edi + 4]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x84]
test byte [edx + 0x22], 8
jne 0x4fca59
mov eax, dword [esp + 0x3c]
test byte [eax + 0x2a], 0x20
jne 0x4fca1f
inc dword [ebp + 0x48]
mov eax, dword [ebp + 0x48]
push 0
push eax
push 0
push 0x1a
push ebx
mov dword [esp + 0x44], eax
call fcn.004cf760
add esp, 0x14
jmp 0x4fca4f
call fcn.004c7600
mov esi, eax
mov eax, dword [ebp + 0x44]
lea ecx, [eax + 1]
mov dword [ebp + 0x44], ecx
movzx edx, word [esi + 0x32]
push 0
push edx
push eax
push 0x3a
push ebx
mov dword [esp + 0x44], eax
call fcn.004cf760
add esp, 0x14
mov ecx, esi
mov eax, ebp
call fcn.004f8750
inc dword [ebp + 0x48]
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x54], eax
mov ecx, dword [esp + 0x40]
push 0
push ecx
push 0
push 0x17
push ebx
call fcn.004cf760
mov esi, dword [esp + 0x58]
mov dword [esp + 0x90], eax
mov eax, dword [esi + 0xc]
add esp, 0x14
cmp eax, 1
jle 0x4fcb18
mov dword [esp + 0x68], 0
test eax, eax
jle 0x4fcb18
xor edi, edi
mov edx, dword [esi + 0x14]
mov ecx, dword [edi + edx]
lea eax, [edi + edx]
cmp eax, dword [esp + 0x20]
je 0x4fcae4
test byte [ecx + 4], 1
jne 0x4fcae4
mov eax, edx
add eax, edi
test byte [eax + 0x14], 2
jne 0x4fcae4
mov edx, 0x1fff
test word [eax + 0x12], dx
je 0x4fcae4
mov eax, dword [esp + 0x2c]
push 0
push 0
push ecx
push eax
call fcn.004db5a0
mov ecx, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x40]
call fcn.004d7930
add esp, 0x14
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x68]
inc eax
add edi, 0x30
cmp eax, dword [esi + 0xc]
mov dword [esp + 0x68], eax
jl 0x4fca96
cmp dword [esp + 0x38], 0
je 0x4fcb18
mov edx, dword [esp + 0x38]
push 0
push edx
push 0
mov eax, 0x148
mov ecx, ebp
call fcn.004e2b80
add esp, 0xc
mov dword [esp + 0x38], eax
mov edi, dword [esp + 0x64]
mov esi, dword [esp + 0x24]
xor eax, eax
cmp dword [edi + 0xc], eax
mov dword [esp + 0x5c], 0xf0
mov dword [esp + 0x48], eax
jle 0x4fce11
mov dword [esp + 0x58], eax
jmp 0x4fcb40
mov eax, dword [edi + 0x14]
add eax, dword [esp + 0x58]
mov ecx, dword [eax + 8]
cmp ecx, dword [esp + 0x18]
je 0x4fcb5f
mov edx, 0x400
test word [eax + 0x12], dx
je 0x4fcdfa
mov ecx, dword [esp + 0x38]
mov eax, dword [eax]
mov dword [esp + 0x60], 0
test ecx, ecx
je 0x4fcb7c
test byte [eax + 4], 1
jne 0x4fcb7c
mov dword [ecx + 0xc], eax
mov eax, ecx
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x5c]
push ecx
push edx
push 0
push 0
push eax
push esi
push ebp
call fcn.00509db0
add esp, 0x1c
mov dword [esp + 0x78], eax
test eax, eax
je 0x4fcdfa
mov ecx, dword [esp + 0x14]
movzx edx, byte [ecx + 0x2c]
mov ecx, dword [esp + 0x88]
push 0
push edx
push ecx
lea edx, [eax + 0x2e0]
push esi
mov ecx, ebp
call fcn.004e9990
mov edx, dword [esp + 0x94]
add esp, 0x10
test byte [edx + 0x22], 8
jne 0x4fcd39
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0xc]
mov esi, dword [esp + 0x48]
dec ecx
cmp esi, ecx
jne 0x4fcbe9
or esi, 0xffffffff
mov eax, dword [esp + 0x3c]
test byte [eax + 0x2a], 0x20
mov dword [esp + 0x4c], esi
jne 0x4fcc2c
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x18]
push 0
push edx
push ecx
push 0xffffffffffffffff
push eax
mov eax, ebp
call fcn.004f11e0
mov edx, dword [esp + 0x44]
push esi
push edx
push 0x84
push ebx
xor ecx, ecx
call fcn.004d6580
add esp, 0x24
mov dword [esp + 0x60], eax
jmp 0x4fcd39
call fcn.004c7600
movzx esi, word [eax + 0x32]
mov ecx, ebp
mov dword [esp + 0x68], eax
mov dword [esp + 0x34], esi
call fcn.004c71a0
xor edi, edi
mov dword [esp + 0x28], eax
test esi, esi
jle 0x4fcc91
mov esi, eax
mov eax, dword [esp + 0x68]
mov ecx, dword [eax + 4]
movsx eax, word [ecx + edi*2]
mov edx, dword [esp + 0x18]
push 0
push esi
push edx
push eax
mov eax, dword [esp + 0x4c]
push eax
mov eax, ebp
call fcn.004f11e0
add esp, 0x14
cmp eax, esi
je 0x4fcc89
mov ecx, dword [ebp + 8]
push 0
push esi
push eax
push 0x20
push ecx
call fcn.004cf760
add esp, 0x14
inc edi
inc esi
cmp edi, dword [esp + 0x34]
jl 0x4fcc50
cmp dword [esp + 0x4c], 0
je 0x4fccbe
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push edx
push eax
mov eax, dword [esp + 0x30]
push 0x49
push ebx
xor ecx, ecx
call fcn.004d6580
add esp, 0x10
cmp dword [esp + 0x4c], 0
mov dword [esp + 0x60], eax
jl 0x4fcd15
mov esi, dword [esp + 0x54]
mov edi, dword [esp + 0x34]
mov ecx, dword [esp + 0x28]
push esi
push edi
push ecx
push 0x32
push ebx
call fcn.004cf760
mov edx, dword [esp + 0x44]
push 0
push esi
push edx
push 0x70
push ebx
call fcn.004cf760
add esp, 0x28
cmp dword [esp + 0x4c], 0
je 0x4fcd19
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx]
dec eax
cmp byte [ecx + 0x41], 0
je 0x4fcd06
mov eax, 0x5a2838
mov byte [eax + 3], 0x10
jmp 0x4fcd19
lea edx, [eax + eax*4]
mov eax, dword [ebx + 4]
lea eax, [eax + edx*4]
mov byte [eax + 3], 0x10
jmp 0x4fcd19
mov edi, dword [esp + 0x34]
mov ecx, dword [esp + 0x28]
push ecx
mov eax, edi
mov esi, ebp
call fcn.004c6f00
add esp, 4
cmp edi, dword [ebp + 0x38]
jle 0x4fcd39
mov edx, dword [esp + 0x28]
mov dword [ebp + 0x38], edi
mov dword [ebp + 0x3c], edx
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x40]
push 0
push eax
push ecx
push 0xf
push ebx
call fcn.004cf760
mov eax, dword [esp + 0x74]
add esp, 0x14
test eax, eax
je 0x4fcd87
mov edx, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x18]
dec edx
mov dword [ecx + 0x5c], edx
mov ecx, dword [ebx + 0x20]
test eax, eax
jge 0x4fcd6c
lea eax, [ecx - 1]
mov edx, dword [ebx]
cmp byte [edx + 0x41], 0
je 0x4fcd7b
mov eax, 0x5a2838
jmp 0x4fcd84
mov edx, dword [ebx + 4]
lea eax, [eax + eax*4]
lea eax, [edx + eax*4]
mov dword [eax + 8], ecx
mov eax, dword [esp + 0x78]
cmp byte [eax + 0x27], 0
je 0x4fcd99
mov dword [esp + 0x74], 1
mov esi, dword [eax + 0x320]
test dword [esi + 0x24], 0x200
je 0x4fcde1
cmp dword [esp + 0x48], 0
je 0x4fcdb8
mov ecx, dword [esp + 0x1c]
cmp dword [esi + 0x1c], ecx
jne 0x4fcde1
mov edx, dword [esp + 0x3c]
test byte [edx + 0x2a], 0x20
je 0x4fcdd0
mov ecx, dword [esi + 0x1c]
mov edx, dword [ecx + 0x38]
and dl, 3
cmp dl, 2
je 0x4fcde1
mov ecx, dword [esi + 0x1c]
or dword [esp + 0x5c], 0x1000
mov dword [esp + 0x1c], ecx
jmp 0x4fcde9
mov dword [esp + 0x1c], 0
push eax
call fcn.004d4a90
mov edi, dword [esp + 0x68]
mov esi, dword [esp + 0x28]
add esp, 4
mov eax, dword [esp + 0x48]
add dword [esp + 0x58], 0x30
inc eax
cmp eax, dword [edi + 0xc]
mov dword [esp + 0x48], eax
jl 0x4fcb40
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [ecx + 0x38], eax
test eax, eax
je 0x4fce27
mov edx, dword [esp + 0x6c]
mov dword [ecx + 8], edx
cmp dword [esp + 0x38], 0
je 0x4fce47
mov eax, dword [esp + 0x38]
push eax
mov dword [eax + 0xc], 0
mov eax, dword [esp + 0x30]
push eax
call fcn.004d15b0
add esp, 8
mov eax, dword [esp + 0x7c]
mov ecx, dword [ebx + 0x20]
test eax, eax
jge 0x4fce55
lea eax, [ecx - 1]
mov edx, dword [ebx]
cmp byte [edx + 0x41], 0
je 0x4fce64
mov eax, 0x5a2838
jmp 0x4fce6d
mov edx, dword [ebx + 4]
lea eax, [eax + eax*4]
lea eax, [edx + eax*4]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0xc]
push 0
push ecx
push 0
push 0xe
push ebx
call fcn.004cf760
mov ecx, dword [ebx + 0x18]
mov eax, dword [ecx + 0x74]
add esp, 0x14
test eax, eax
je 0x4fcea3
mov edx, dword [esp + 0x70]
lea edx, [edx*4 + 4]
sub eax, edx
mov edx, dword [ebx + 0x20]
mov dword [eax], edx
mov eax, dword [ebx + 0x20]
dec eax
mov dword [ecx + 0x5c], eax
mov ecx, dword [esp + 0x84]
cmp byte [ecx + 0x29], 1
jbe 0x4fcf04
test esi, esi
je 0x4fcf04
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x4fcefb
cmp dword [ecx + 0x208], 0
je 0x4fced5
mov eax, esi
call fcn.004bf640
jmp 0x4fcf04
cmp esi, dword [ecx + 0x114]
jb 0x4fcefb
cmp esi, dword [ecx + 0x118]
jae 0x4fcefb
mov edx, dword [ecx + 0x110]
mov dword [esi], edx
dec dword [ecx + 0xfc]
mov dword [ecx + 0x110], esi
jmp 0x4fcf04
push esi
call fcn.004bf5d0
add esp, 4
cmp dword [esp + 0x74], 0
jne 0x4fc07b
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x14]
call fcn.004c9340
mov esi, edi
jmp 0x4fc07f
test byte [esp + 0x7c], 0x20
je 0x4fcf33
mov byte [esi + 0x2d], 0xa1
jmp 0x4fc07f
mov eax, dword [esp + 0x1c]
mov cl, byte [eax + 0x58baa8]
mov byte [esi + 0x2d], cl
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x30], ecx
movzx edx, byte [eax + 0x58baac]
mov eax, dword [esp + 0x3c]
push edx
push ebx
call fcn.004cf7d0
add esp, 8
inc eax
mov dword [esi + 0x34], eax
mov byte [esi + 0x2f], 1
jmp 0x4fc07f
mov eax, dword [ecx]
xor edx, edx
mov dword [esp + 0x78], eax
cmp dword [esi], edx
je 0x4fcf7f
test byte [eax + 4], 1
je 0x4fd02d
test dword [esp + 0x7c], 0x200
je 0x4fcfd8
mov ecx, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
cmp dword [eax + 0x54], ecx
mov esi, dword [esi + 0x24]
jg 0x4fcfac
push 0
push 0
push esi
push 0x2f
mov esi, ebx
call fcn.004cf720
add esp, 0x10
mov ecx, eax
jmp 0x4fcfd2
mov edi, dword [ebx + 4]
lea eax, [ecx + 1]
mov dword [ebx + 0x20], eax
lea eax, [ecx + ecx*4]
lea eax, [edi + eax*4]
mov byte [eax], 0x2f
mov byte [eax + 3], 0
mov dword [eax + 4], esi
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov byte [eax + 1], 0
mov esi, dword [esp + 0x14]
mov edi, ecx
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x78]
push 0x10
push ecx
push edx
push ebp
call fcn.00516c80
add esp, 0x10
test edi, edi
je 0x4fd022
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x18]
dec eax
mov dword [ecx + 0x5c], eax
mov ecx, dword [ebx + 0x20]
mov eax, edi
test edi, edi
jge 0x4fd007
lea eax, [ecx - 1]
mov edx, dword [ebx]
cmp byte [edx + 0x41], 0
je 0x4fd016
mov eax, 0x5a2838
jmp 0x4fd01f
mov edx, dword [ebx + 4]
lea eax, [eax + eax*4]
lea eax, [edx + eax*4]
mov dword [eax + 8], ecx
mov eax, dword [esp + 0x20]
or word [eax + 0x14], 4
mov ecx, eax
mov eax, dword [esp + 0x24]
dec eax
add ecx, 0x30
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
test eax, eax
jg 0x4fc0a0
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
test eax, eax
jle 0x4fd18e
nop
mov edx, dword [esp + 0x20]
test byte [edx + 0x14], 6
jne 0x4fd178
mov eax, edx
movzx eax, word [eax + 0x12]
test al, 0x82
je 0x4fd178
test eax, 0x800
je 0x4fd178
mov ecx, dword [esp + 0x18]
cmp dword [edx + 8], ecx
jne 0x4fd178
cmp dword [esi], 0
jne 0x4fd178
mov eax, edx
mov ecx, dword [eax]
mov edx, dword [esp + 0x90]
push 0x83
push edx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x84], ecx
mov ecx, dword [esp + 0x94]
push ecx
push edx
mov edx, dword [esp + 0x54]
push eax
xor ecx, ecx
call fcn.004f47c0
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4fd178
test byte [edi + 0x14], 4
jne 0x4fd178
mov esi, dword [esp + 0x2c]
push 0
push 0x30
call fcn.004cb940
add esp, 8
mov dword [esp + 0x4c], eax
test eax, eax
je 0x4fd174
mov esi, dword [edi]
mov edi, eax
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x7c]
mov edx, dword [ecx + 0xc]
mov ecx, dword [esp + 0x50]
push 0x10
push ecx
push eax
push ebp
mov dword [eax + 0xc], edx
call fcn.00516c80
mov eax, dword [esp + 0x5c]
add esp, 0x10
cmp dword [esp + 0x2c], 0
je 0x4fd16b
mov ecx, dword [esp + 0x2c]
cmp dword [ecx + 0x208], 0
je 0x4fd145
call fcn.004bf640
jmp 0x4fd174
cmp eax, dword [ecx + 0x114]
jb 0x4fd16b
cmp eax, dword [ecx + 0x118]
jae 0x4fd16b
mov edx, dword [ecx + 0x110]
mov dword [eax], edx
dec dword [ecx + 0xfc]
mov dword [ecx + 0x110], eax
jmp 0x4fd174
push eax
call fcn.004bf5d0
add esp, 4
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
add dword [esp + 0x20], 0x30
dec eax
mov dword [esp + 0x24], eax
test eax, eax
jg 0x4fd060
cmp dword [esi], 0
je 0x4fd240
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx + 0x20]
mov dword [eax + 0x1c], ecx
mov ecx, dword [eax]
mov eax, dword [ebx + 0x20]
mov edx, dword [ebx + 0x18]
cmp dword [edx + 0x54], eax
jg 0x4fd1c1
push 0
push ecx
push 1
push 0x17
mov esi, ebx
call fcn.004cf720
add esp, 0x10
jmp 0x4fd1ec
lea edx, [eax + 1]
mov dword [ebx + 0x20], edx
mov edx, dword [ebx + 4]
lea eax, [eax + eax*4]
lea eax, [edx + eax*4]
mov dword [eax + 8], ecx
xor ecx, ecx
mov byte [eax], 0x17
mov byte [eax + 3], 0
mov dword [eax + 4], 1
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov byte [eax + 1], cl
mov edx, ebp
call fcn.004c6fb0
mov ebx, dword [esp + 0x44]
mov esi, dword [ebx + 0x14]
xor edi, edi
cmp dword [ebx + 0xc], edi
jle 0x4fd240
mov edx, dword [esp + 0x14]
test byte [esi + 0x14], 6
jne 0x4fd237
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
and eax, dword [edx + 0x48]
and ecx, dword [edx + 0x4c]
or eax, ecx
jne 0x4fd237
mov eax, dword [esp + 0x50]
mov ecx, dword [esi]
push 0x10
push eax
push ecx
push ebp
call fcn.00516c80
mov edx, dword [esp + 0x24]
add esp, 0x10
or word [esi + 0x14], 4
inc edi
add esi, 0x30
cmp edi, dword [ebx + 0xc]
jl 0x4fd205
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x48]
mov edx, dword [ecx + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret