Function at 0x47b320
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4efd28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xor esi, esi
push 6
push 0x5122d4
lea ecx, [esp + 0x20]
mov dword [esp + 0x138], esi
mov dword [esp + 0x2c], esi
call fcn.004be240
mov dword [esp + 0x1c], 0x4f73d4
mov word [esp + 0x20], 0xffff
mov word [esp + 0x22], si
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], 0
rep stosd dword es:[edi], eax
mov ebx, 2
mov byte [esp + 0x130], bl
stosw word es:[edi], ax
push ecx
lea eax, [esp + 0x13c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004be1b0
mov ecx, dword [0x5200a8]
call fcn.004c9430
mov ecx, dword [esp + 0x13c]
call fcn.004be660
movsx ecx, ax
sub ecx, 3
test ecx, ecx
jle 0x47b43b
mov edi, 3
mov ecx, dword [esp + 0x13c]
push edi
call fcn.004be4c0
mov ecx, dword [esp + 0x24]
push edi
movsx edx, cx
inc ecx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x140]
mov byte [esp + edx + 0x2c], al
call fcn.004be4c0
push eax
push 5
lea ecx, [esp + 0x20]
call fcn.004be5e0
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004be1b0
mov ecx, dword [0x5200a8]
call fcn.004c9650
mov ecx, dword [esp + 0x13c]
inc edi
call fcn.004be660
movsx ecx, ax
lea edx, [edi - 3]
sub ecx, 3
movsx eax, dx
cmp eax, ecx
jl 0x47b3cc
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [0x5200a8]
call fcn.004c9790
test ax, ax
jl 0x47c2ea
movsx edx, word [esp + 0x20]
cmp byte [esp + edx + 0x28], 0xfc
jae 0x47b4bd
cmp word [esp + 0x140], 0x42e
je 0x47b4bd
call fcn.004ccc40
test al, al
je 0x47b4bd
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x50f634
call fcn.004be240
push ecx
mov byte [esp + 0x140], 3
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x50f62c
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x140], bl
call fcn.004caf10
jmp 0x47b392
movsx eax, word [esp + 0x20]
mov al, byte [esp + eax + 0x28]
mov ecx, eax
and ecx, 0xff
dec ecx
cmp ecx, 0xfe
ja case.0x47b4e3.172
xor edx, edx
mov dl, byte [ecx + 0x47c5f0]
jmp dword [edx*4 + 0x47c340]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0xc]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x10]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x14]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x24]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x28]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x2c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x30]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x34]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x38]
jmp 0x47c28e
push 0
push 3
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x50f634
call fcn.004be240
push ecx
mov byte [esp + 0x140], 4
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x5122cc
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x140], bl
call fcn.004caf10
cmp ax, bx
je case.0x47b4e3.172
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x3c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x40]
jmp 0x47c28e
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x50f634
call fcn.004be240
push ecx
mov byte [esp + 0x140], 5
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x5122c4
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x140], bl
call fcn.004caf10
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x44]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x48]
jmp 0x47c28e
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x50f634
call fcn.004be240
push ecx
mov byte [esp + 0x140], 6
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x5122bc
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x140], bl
call fcn.004caf10
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x4c]
jmp 0x47c28e
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x50f634
call fcn.004be240
push ecx
mov byte [esp + 0x140], 7
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x5122b4
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x140], bl
call fcn.004caf10
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x50]
jmp 0x47c28e
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x50f634
call fcn.004be240
push ecx
mov byte [esp + 0x140], 8
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x5122ac
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x140], bl
call fcn.004caf10
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x54]
jmp 0x47c28e
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x50f634
call fcn.004be240
push ecx
mov byte [esp + 0x140], 9
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x5122a4
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x140], bl
call fcn.004caf10
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x58]
jmp 0x47c28e
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x50f634
call fcn.004be240
push ecx
mov byte [esp + 0x140], 0xa
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x51229c
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x140], bl
call fcn.004caf10
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x5c]
jmp 0x47c28e
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x50f634
call fcn.004be240
push ecx
mov byte [esp + 0x140], 0xb
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x512294
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x140], bl
call fcn.004caf10
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x60]
jmp 0x47c28e
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x50f634
call fcn.004be240
push ecx
mov byte [esp + 0x140], 0xc
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x51228c
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x140], bl
call fcn.004caf10
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x64]
jmp 0x47c28e
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x50f634
call fcn.004be240
push ecx
mov byte [esp + 0x140], 0xd
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x512284
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x140], bl
call fcn.004caf10
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x68]
jmp 0x47c28e
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x50f634
call fcn.004be240
push ecx
mov byte [esp + 0x140], 0xe
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x51227c
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x140], bl
call fcn.004caf10
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x6c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x70]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x74]
jmp 0x47c28e
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x50f634
call fcn.004be240
push ecx
mov byte [esp + 0x140], 0xf
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x512274
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x140], bl
call fcn.004caf10
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x78]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x7c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x80]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x84]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x88]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x8c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x90]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x94]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x98]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
movzx ax, al
mov edx, dword [ecx]
sub eax, 0x1f
push eax
call dword [edx + 0x9c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0xa0]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xa4]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0xa8]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xac]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0xb0]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xb4]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0xb8]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xbc]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0xc0]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xc4]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0xc8]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xcc]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0xd0]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xd4]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0xd8]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xdc]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + pe_nt_image_headers32]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xe4]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0xe8]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xec]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0xf0]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xf4]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0xf8]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xfc]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x100]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x104]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x108]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x10c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x110]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x114]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x118]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x11c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x120]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x124]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x128]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x12c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x130]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x134]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x138]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x140]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x13c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x144]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x14c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x148]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push 0
mov edx, dword [ecx]
call dword [edx + 0x158]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push 1
mov eax, dword [ecx]
call dword [eax + 0x15c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push ebx
mov edx, dword [ecx]
call dword [edx + 0x15c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push 0
mov eax, dword [ecx]
call dword [eax + 0x150]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push 0
mov edx, dword [ecx]
call dword [edx + 0x154]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push 1
mov eax, dword [ecx]
call dword [eax + 0x150]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push 1
mov edx, dword [ecx]
call dword [edx + 0x154]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push 1
mov eax, dword [ecx]
call dword [eax + 0x158]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push 1
mov edx, dword [ecx]
call dword [edx + 0x15c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x15c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x160]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push 3
mov eax, dword [ecx]
call dword [eax + 0x15c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push 4
mov edx, dword [ecx]
call dword [edx + 0x15c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x164]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x168]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x16c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x170]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x174]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x178]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x17c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x180]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x184]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x188]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x18c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x190]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x194]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x198]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x19c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x1a0]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x1a4]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x1a8]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x1ac]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x1b0]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x1b4]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x1b8]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x1bc]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push 0
mov edx, dword [ecx]
call dword [edx + 0x1c0]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push 1
mov eax, dword [ecx]
call dword [eax + 0x1c0]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push 0
mov edx, dword [ecx]
call dword [edx + 0x1c4]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push 1
mov eax, dword [ecx]
call dword [eax + 0x1c4]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x1c8]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x1cc]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push 0
mov edx, dword [ecx]
call dword [edx + 0x1d8]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push 1
mov eax, dword [ecx]
call dword [eax + 0x1d8]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x1d0]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x1d4]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x1dc]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
movzx ax, al
mov edx, dword [ecx]
sub eax, 0x7f
push eax
call dword [edx + 0x1e0]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x1e4]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x1e8]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x1ec]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x1f0]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x1f8]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x1fc]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x200]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x204]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x208]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push 1
mov eax, dword [ecx]
call dword [eax + 0x28c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push 3
mov edx, dword [ecx]
call dword [edx + 0x28c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x20c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x210]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x214]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
push 1
mov edx, dword [ecx]
call dword [edx + 0x218]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x21c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x220]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x224]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x228]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x22c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x230]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x234]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x238]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x23c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x240]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x244]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x248]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x24c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x250]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x254]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x258]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x25c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x1f4]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x260]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x264]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x268]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x26c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x270]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x274]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x278]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x27c]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x280]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 0x284]
jmp 0x47c28e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x288]
mov esi, eax
test si, si
jge 0x47b392
push 0
push 0
mov ecx, 0x520070
call fcn.004c1db0
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x50f76c
call fcn.004be240
push ecx
mov byte [esp + 0x140], 0x10
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x50f970
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x140], bl
call fcn.004caf10
mov ecx, ebp
call fcn.0047aa20
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], 0x4f73d4
mov byte [esp + 0x130], 0
call fcn.004be2e0
lea ecx, [esp + 0x138]
mov dword [esp + 0x130], 0xffffffff
call fcn.004be2e0
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebp
mov ax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x124
ret 0xc