Function at 0x499450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0xb8]
cmp eax, dword [ecx + 8]
jbe 0x49a624
sub esp, 0x138
mov dword [esp + 0x150], 0
mov dword [esp + 0x154], 0
mov dword [esp + 0x158], 0
mov dword [esp + 0x34], 0
movzx eax, byte [esp + 0x14c]
cmp dword [esp + 0x148], eax
sete al
mov byte [esp + 0x2b], al
je 0x4994b6
jmp 0x4994b8
jmp 0x4994c9
cmp dword [esp + 0x148], 0x5c
sete al
mov byte [esp + 0x2b], al
jmp 0x4994c9
movzx eax, byte [esp + 0x2b]
test al, al
jne 0x4994d7
jmp 0x4995e8
mov eax, dword [esp + 0x140]
lea ecx, [eax + 1]
mov edx, dword [esp + 0x144]
mov ebx, dword [esp + 0x13c]
cmp edx, ecx
jae 0x4994f5
jmp 0x4994f7
jmp 0x49952e
mov dword [esp + 0x3c], eax
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
call fcn.00448330
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea ecx, [eax + 1]
mov eax, dword [esp + 0x3c]
jmp 0x49952e
add eax, ebx
mov byte [eax], 0x5c
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x140], ecx
mov dword [esp + 0x144], edx
mov eax, dword [esp + 0x148]
mov byte [esp + 0x27], al
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x144]
mov edx, dword [esp + 0x13c]
lea ebx, [eax + 1]
cmp ecx, ebx
jae 0x499571
jmp 0x499573
jmp 0x4995aa
mov dword [esp + 0x3c], eax
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
call fcn.00448330
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea ebx, [eax + 1]
mov eax, dword [esp + 0x3c]
jmp 0x4995aa
movzx ebp, byte [esp + 0x27]
add eax, edx
xchg ebp, ebx
mov byte [eax], bl
xchg ebp, ebx
mov dword [esp + 0x13c], edx
mov dword [esp + 0x140], ebx
mov dword [esp + 0x144], ecx
mov dword [esp + 0x150], edx
mov dword [esp + 0x154], ebx
mov dword [esp + 0x158], ecx
add esp, 0x138
ret
jmp 0x4995ea
movzx eax, byte [esp + 0x14d]
test al, al
jne 0x4995fb
jmp 0x4996e6
cmp dword [esp + 0x148], 0x80
setl al
mov byte [esp + 0x2b], al
jl 0x499611
jmp 0x49962f
mov eax, dword [esp + 0x148]
mov dword [esp], eax
call fcn.0049a800
movzx eax, byte [esp + 4]
mov byte [esp + 0x2a], al
mov byte [esp + 0x2b], al
jmp 0x499631
jmp 0x499631
movzx eax, byte [esp + 0x2b]
test al, al
jne 0x49963f
jmp 0x4996df
mov eax, dword [esp + 0x148]
mov byte [esp + 0x26], al
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x144]
mov edx, dword [esp + 0x13c]
lea ebx, [eax + 1]
cmp ecx, ebx
jae 0x499668
jmp 0x49966a
jmp 0x4996a1
mov dword [esp + 0x3c], eax
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
call fcn.00448330
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea ebx, [eax + 1]
mov eax, dword [esp + 0x3c]
jmp 0x4996a1
movzx ebp, byte [esp + 0x26]
add eax, edx
xchg ebp, ebx
mov byte [eax], bl
xchg ebp, ebx
mov dword [esp + 0x13c], edx
mov dword [esp + 0x140], ebx
mov dword [esp + 0x144], ecx
mov dword [esp + 0x150], edx
mov dword [esp + 0x154], ebx
mov dword [esp + 0x158], ecx
add esp, 0x138
ret
jmp 0x4996e1
jmp 0x499913
mov eax, dword [esp + 0x148]
mov dword [esp], eax
call fcn.0049a800
movzx eax, byte [esp + 4]
mov byte [esp + 0x2b], al
mov byte [esp + 0x2a], al
test al, al
jne 0x499708
jmp 0x49970a
jmp 0x499747
movzx eax, byte [esp + 0x14e]
mov byte [esp + 0x29], al
test al, al
jne 0x49971c
jmp 0x49973a
mov eax, dword [esp + 0x148]
mov dword [esp], eax
call fcn.0049ac40
movzx eax, byte [esp + 4]
mov byte [esp + 0x28], al
mov byte [esp + 0x29], al
jmp 0x49973c
jmp 0x49973c
movzx eax, byte [esp + 0x29]
mov byte [esp + 0x2a], al
jmp 0x499747
movzx eax, byte [esp + 0x2a]
test al, al
jne 0x499755
jmp 0x49990f
lea eax, [esp + 0x34]
test byte [eax], al
jmp 0x49975d
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], 4
mov dword [esp + 0x134], 4
mov ecx, dword [esp + 0x148]
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 4
mov dword [esp + 0xc], ecx
call fcn.0047f3f0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x34]
test byte [eax], al
mov ecx, dword [esp + 0x38]
cmp ecx, 4
jbe 0x4997b9
jmp 0x49a619
jmp 0x4997bb
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], ecx
mov dword [esp + 0x134], 4
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x13c]
mov edx, dword [esp + 0x144]
mov dword [esp + 0x120], ecx
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], edx
mov ecx, dword [esp + 0x130]
add eax, ecx
mov dword [esp + 0x78], eax
cmp dword [esp + 0x128], eax
jb 0x499816
jmp 0x49986c
mov ecx, dword [esp + 0x120]
mov edx, dword [esp + 0x124]
mov ebx, dword [esp + 0x128]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], ecx
mov dword [esp + 0x128], edx
jmp 0x49986e
jmp 0x49986e
mov eax, dword [esp + 0x78]
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0x130]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x120]
add eax, dword [esp + 0x140]
mov dword [esp + 0xa4], eax
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x12c]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.0045e1c0
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x124]
mov edx, dword [esp + 0x128]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
mov dword [esp + 0x144], edx
mov eax, dword [esp + 0x13c]
mov ecx, dword [esp + 0x140]
mov edx, dword [esp + 0x144]
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], ecx
mov dword [esp + 0x158], edx
add esp, 0x138
ret
jmp 0x499911
jmp 0x499913
mov eax, dword [esp + 0x148]
mov dword [esp + 0x70], eax
cmp eax, 9
jle 0x499928
jmp 0x499c16
cmp eax, 7
je 0x499932
jmp 0x499a1f
jmp 0x499934
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x13c]
mov edx, dword [esp + 0x144]
mov dword [esp + 0x114], ecx
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], edx
add eax, 2
mov dword [esp + 0x6c], eax
lea ecx, [esp + 0x114]
cmp dword [ecx + 8], eax
jb 0x499973
jmp 0x4999c9
mov ecx, dword [esp + 0x114]
mov edx, dword [esp + 0x118]
mov ebx, dword [esp + 0x11c]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], ecx
mov dword [esp + 0x11c], edx
jmp 0x4999cb
jmp 0x4999cb
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0x114]
add eax, dword [esp + 0x140]
mov dword [esp + 0xa0], eax
mov word [eax], 0x615c
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x118]
mov edx, dword [esp + 0x11c]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
mov dword [esp + 0x144], edx
jmp 0x49a51d
cmp eax, 8
je 0x499a29
jmp 0x499b16
jmp 0x499a2b
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x13c]
mov edx, dword [esp + 0x144]
mov dword [esp + 0x108], ecx
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], edx
add eax, 2
mov dword [esp + 0x68], eax
lea ecx, [esp + 0x108]
cmp dword [ecx + 8], eax
jb 0x499a6a
jmp 0x499ac0
mov ecx, dword [esp + 0x108]
mov edx, dword [esp + 0x10c]
mov ebx, dword [esp + 0x110]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x108], eax
mov dword [esp + 0x10c], ecx
mov dword [esp + 0x110], edx
jmp 0x499ac2
jmp 0x499ac2
mov eax, dword [esp + 0x68]
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x108]
add eax, dword [esp + 0x140]
mov dword [esp + 0x9c], eax
mov word [eax], 0x625c
mov eax, dword [esp + 0x108]
mov ecx, dword [esp + 0x10c]
mov edx, dword [esp + 0x110]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
mov dword [esp + 0x144], edx
jmp 0x49a51d
cmp eax, 9
je 0x499b20
jmp 0x499c0d
jmp 0x499b22
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x13c]
mov edx, dword [esp + 0x144]
mov dword [esp + 0xd8], ecx
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], edx
add eax, 2
mov dword [esp + 0x58], eax
lea ecx, [esp + 0xd8]
cmp dword [ecx + 8], eax
jb 0x499b61
jmp 0x499bb7
mov ecx, dword [esp + 0xd8]
mov edx, dword [esp + 0xdc]
mov ebx, dword [esp + 0xe0]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], ecx
mov dword [esp + 0xe0], edx
jmp 0x499bb9
jmp 0x499bb9
mov eax, dword [esp + 0x58]
mov dword [esp + 0xdc], eax
mov eax, dword [esp + 0xd8]
add eax, dword [esp + 0x140]
mov dword [esp + 0x8c], eax
mov word [eax], 0x745c
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xdc]
mov edx, dword [esp + 0xe0]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
mov dword [esp + 0x144], edx
jmp 0x49a51d
jmp 0x499c0f
jmp 0x499c11
jmp 0x49a009
cmp eax, 0xb
jle 0x499c20
jmp 0x499e15
cmp eax, 0xa
je 0x499c2a
jmp 0x499d17
jmp 0x499c2c
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x13c]
mov edx, dword [esp + 0x144]
mov dword [esp + 0xf0], ecx
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], edx
add eax, 2
mov dword [esp + 0x60], eax
lea ecx, [esp + 0xf0]
cmp dword [ecx + 8], eax
jb 0x499c6b
jmp 0x499cc1
mov ecx, dword [esp + 0xf0]
mov edx, dword [esp + 0xf4]
mov ebx, dword [esp + 0xf8]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], ecx
mov dword [esp + 0xf8], edx
jmp 0x499cc3
jmp 0x499cc3
mov eax, dword [esp + 0x60]
mov dword [esp + 0xf4], eax
mov eax, dword [esp + 0xf0]
add eax, dword [esp + 0x140]
mov dword [esp + 0x94], eax
mov word [eax], 0x6e5c
mov eax, dword [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov edx, dword [esp + 0xf8]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
mov dword [esp + 0x144], edx
jmp 0x49a51d
cmp eax, 0xb
je 0x499d21
jmp 0x499e0e
jmp 0x499d23
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x13c]
mov edx, dword [esp + 0x144]
mov dword [esp + 0xcc], ecx
mov dword [esp + 0xd0], eax
mov dword [esp + 0xd4], edx
add eax, 2
mov dword [esp + 0x54], eax
lea ecx, [esp + 0xcc]
cmp dword [ecx + 8], eax
jb 0x499d62
jmp 0x499db8
mov ecx, dword [esp + 0xcc]
mov edx, dword [esp + 0xd0]
mov ebx, dword [esp + 0xd4]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0xcc], eax
mov dword [esp + 0xd0], ecx
mov dword [esp + 0xd4], edx
jmp 0x499dba
jmp 0x499dba
mov eax, dword [esp + 0x54]
mov dword [esp + 0xd0], eax
mov eax, dword [esp + 0xcc]
add eax, dword [esp + 0x140]
mov dword [esp + 0x88], eax
mov word [eax], 0x765c
mov eax, dword [esp + 0xcc]
mov ecx, dword [esp + 0xd0]
mov edx, dword [esp + 0xd4]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
mov dword [esp + 0x144], edx
jmp 0x49a51d
jmp 0x499e10
jmp 0x49a007
cmp eax, 0xc
je 0x499e1f
jmp 0x499f0c
jmp 0x499e21
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x13c]
mov edx, dword [esp + 0x144]
mov dword [esp + 0xfc], ecx
mov dword [esp + 0x100], eax
mov dword [esp + 0x104], edx
add eax, 2
mov dword [esp + 0x64], eax
lea ecx, [esp + 0xfc]
cmp dword [ecx + 8], eax
jb 0x499e60
jmp 0x499eb6
mov ecx, dword [esp + 0xfc]
mov edx, dword [esp + 0x100]
mov ebx, dword [esp + 0x104]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0xfc], eax
mov dword [esp + 0x100], ecx
mov dword [esp + 0x104], edx
jmp 0x499eb8
jmp 0x499eb8
mov eax, dword [esp + 0x64]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0xfc]
add eax, dword [esp + 0x140]
mov dword [esp + 0x98], eax
mov word [eax], 0x665c
mov eax, dword [esp + 0xfc]
mov ecx, dword [esp + 0x100]
mov edx, dword [esp + 0x104]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
mov dword [esp + 0x144], edx
jmp 0x49a51d
cmp eax, 0xd
je 0x499f16
jmp 0x49a003
jmp 0x499f18
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x13c]
mov edx, dword [esp + 0x144]
mov dword [esp + 0xe4], ecx
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], edx
add eax, 2
mov dword [esp + 0x5c], eax
lea ecx, [esp + 0xe4]
cmp dword [ecx + 8], eax
jb 0x499f57
jmp 0x499fad
mov ecx, dword [esp + 0xe4]
mov edx, dword [esp + 0xe8]
mov ebx, dword [esp + 0xec]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0xe4], eax
mov dword [esp + 0xe8], ecx
mov dword [esp + 0xec], edx
jmp 0x499faf
jmp 0x499faf
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xe8], eax
mov eax, dword [esp + 0xe4]
add eax, dword [esp + 0x140]
mov dword [esp + 0x90], eax
mov word [eax], 0x725c
mov eax, dword [esp + 0xe4]
mov ecx, dword [esp + 0xe8]
mov edx, dword [esp + 0xec]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
mov dword [esp + 0x144], edx
jmp 0x49a51d
jmp 0x49a005
jmp 0x49a007
jmp 0x49a009
jmp 0x49a00b
cmp dword [esp + 0x148], 0x20
jl 0x49a01a
jmp 0x49a23f
jmp 0x49a01c
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x13c]
mov edx, dword [esp + 0x144]
mov dword [esp + 0xc0], ecx
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], edx
add eax, 2
mov dword [esp + 0x50], eax
lea ecx, [esp + 0xc0]
cmp dword [ecx + 8], eax
jb 0x49a05b
jmp 0x49a0b1
mov ecx, dword [esp + 0xc0]
mov edx, dword [esp + 0xc4]
mov ebx, dword [esp + 0xc8]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], ecx
mov dword [esp + 0xc8], edx
jmp 0x49a0b3
jmp 0x49a0b3
mov eax, dword [esp + 0x50]
mov dword [esp + 0xc4], eax
mov eax, dword [esp + 0xc0]
add eax, dword [esp + 0x140]
mov dword [esp + 0x84], eax
mov word [eax], 0x785c
mov eax, dword [esp + 0xc0]
mov ecx, dword [esp + 0xc4]
mov edx, dword [esp + 0xc8]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
mov dword [esp + 0x144], edx
mov eax, dword [esp + 0x148]
shr al, 4
mov byte [esp + 0x25], al
movzx eax, al
jmp 0x49a115
lea ecx, [0x4b2cff]
add eax, ecx
movzx eax, byte [eax]
mov byte [esp + 0x24], al
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x144]
mov edx, dword [esp + 0x13c]
lea ebx, [eax + 1]
cmp ecx, ebx
jae 0x49a142
jmp 0x49a144
jmp 0x49a17b
mov dword [esp + 0x3c], eax
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
call fcn.00448330
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea ebx, [eax + 1]
mov eax, dword [esp + 0x3c]
jmp 0x49a17b
movzx ebp, byte [esp + 0x24]
add eax, edx
xchg ebp, ebx
mov byte [eax], bl
xchg ebp, ebx
mov dword [esp + 0x13c], edx
mov dword [esp + 0x140], ebx
mov dword [esp + 0x144], ecx
mov eax, dword [esp + 0x148]
mov ecx, eax
and eax, 0xf
mov byte [esp + 0x23], al
and ecx, 0xf
jmp 0x49a1b2
lea eax, [0x4b2cff]
add eax, ecx
movzx eax, byte [eax]
mov byte [esp + 0x22], al
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x144]
mov edx, dword [esp + 0x13c]
lea ebx, [eax + 1]
cmp ecx, ebx
jae 0x49a1df
jmp 0x49a1e1
jmp 0x49a218
mov dword [esp + 0x3c], eax
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
call fcn.00448330
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea ebx, [eax + 1]
mov eax, dword [esp + 0x3c]
jmp 0x49a218
movzx ebp, byte [esp + 0x22]
add eax, edx
xchg ebp, ebx
mov byte [eax], bl
xchg ebp, ebx
mov dword [esp + 0x13c], edx
mov dword [esp + 0x140], ebx
mov dword [esp + 0x144], ecx
jmp 0x49a51b
cmp dword [esp + 0x148], 0x10ffff
jg 0x49a24e
jmp 0x49a25d
jmp 0x49a250
mov dword [esp + 0x148], 0xfffd
jmp 0x49a271
cmp dword [esp + 0x148], 0x10000
jl 0x49a26f
jmp 0x49a364
jmp 0x49a271
mov eax, dword [esp + 0x140]
mov edx, dword [esp + 0x13c]
mov ebx, dword [esp + 0x144]
mov dword [esp + 0xb4], edx
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], ebx
add eax, 2
mov dword [esp + 0x4c], eax
lea edx, [esp + 0xb4]
cmp dword [edx + 8], eax
jb 0x49a2b0
jmp 0x49a306
mov ecx, dword [esp + 0xb4]
mov edx, dword [esp + 0xb8]
mov ebx, dword [esp + 0xbc]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xbc], edx
jmp 0x49a308
jmp 0x49a308
mov eax, dword [esp + 0x4c]
mov dword [esp + 0xb8], eax
mov eax, dword [esp + 0xb4]
add eax, dword [esp + 0x140]
mov dword [esp + 0x80], eax
mov word [eax], 0x755c
mov eax, dword [esp + 0xb4]
mov edx, dword [esp + 0xb8]
mov ebx, dword [esp + 0xbc]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], edx
mov dword [esp + 0x144], ebx
mov dword [esp + 0x2c], 0xc
jmp 0x49a54e
jmp 0x49a366
mov eax, dword [esp + 0x140]
mov edx, dword [esp + 0x13c]
mov ebx, dword [esp + 0x144]
mov dword [esp + 0xa8], edx
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], ebx
add eax, 2
mov dword [esp + 0x44], eax
lea edx, [esp + 0xa8]
cmp dword [edx + 8], eax
jb 0x49a3a5
jmp 0x49a3fb
mov ecx, dword [esp + 0xa8]
mov edx, dword [esp + 0xac]
mov ebx, dword [esp + 0xb0]
lea ebp, [0x4a7ea0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
call fcn.00448330
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], ecx
mov dword [esp + 0xb0], edx
jmp 0x49a3fd
jmp 0x49a3fd
mov eax, dword [esp + 0x44]
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0xa8]
add eax, dword [esp + 0x140]
mov dword [esp + 0x7c], eax
mov word [eax], 0x555c
mov eax, dword [esp + 0xa8]
mov edx, dword [esp + 0xac]
mov ebx, dword [esp + 0xb0]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], edx
mov dword [esp + 0x144], ebx
mov dword [esp + 0x30], 0x1c
jmp 0x49a453
mov eax, dword [esp + 0x30]
test eax, eax
jge 0x49a460
jmp 0x49a519
mov eax, dword [esp + 0x148]
mov ecx, dword [esp + 0x30]
cmp ecx, 0x20
sbb edx, edx
not edx
or ecx, edx
sar eax, cl
and eax, 0xf
mov dword [esp + 0x40], eax
jmp 0x49a47f
lea edx, [0x4b2cff]
add eax, edx
movzx eax, byte [eax]
mov byte [esp + 0x20], al
mov eax, dword [esp + 0x140]
mov edx, dword [esp + 0x144]
mov ebx, dword [esp + 0x13c]
lea ebp, [eax + 1]
cmp edx, ebp
jae 0x49a4ac
jmp 0x49a4ae
jmp 0x49a4e5
mov dword [esp + 0x3c], eax
lea ecx, [0x4a7ea0]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebp
call fcn.00448330
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea ebp, [eax + 1]
mov eax, dword [esp + 0x3c]
jmp 0x49a4e5
movzx esi, byte [esp + 0x20]
add eax, ebx
xchg esi, ebx
mov byte [eax], bl
xchg esi, ebx
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x140], ebp
mov dword [esp + 0x144], edx
jmp 0x49a509
mov eax, dword [esp + 0x30]
add eax, 0xfffffffc
mov dword [esp + 0x30], eax
jmp 0x49a453
jmp 0x49a51b
jmp 0x49a51d
mov eax, dword [esp + 0x13c]
mov ecx, dword [esp + 0x140]
mov edx, dword [esp + 0x144]
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], ecx
mov dword [esp + 0x158], edx
add esp, 0x138
ret
mov eax, dword [esp + 0x2c]
test eax, eax
jge 0x49a55b
jmp 0x49a614
mov eax, dword [esp + 0x148]
mov ecx, dword [esp + 0x2c]
cmp ecx, 0x20
sbb edx, edx
not edx
or ecx, edx
sar eax, cl
and eax, 0xf
mov dword [esp + 0x48], eax
jmp 0x49a57a
lea edx, [0x4b2cff]
add eax, edx
movzx eax, byte [eax]
mov byte [esp + 0x21], al
mov eax, dword [esp + 0x140]
mov edx, dword [esp + 0x144]
mov ebx, dword [esp + 0x13c]
lea ebp, [eax + 1]
cmp edx, ebp
jae 0x49a5a7
jmp 0x49a5a9
jmp 0x49a5e0
mov dword [esp + 0x3c], eax
lea ecx, [0x4a7ea0]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebp
call fcn.00448330
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea ebp, [eax + 1]
mov eax, dword [esp + 0x3c]
jmp 0x49a5e0
movzx esi, byte [esp + 0x21]
add eax, ebx
xchg esi, ebx
mov byte [eax], bl
xchg esi, ebx
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x140], ebp
mov dword [esp + 0x144], edx
jmp 0x49a604
mov eax, dword [esp + 0x2c]
add eax, 0xfffffffc
mov dword [esp + 0x2c], eax
jmp 0x49a54e
jmp 0x49a51b
mov edx, 4
call fcn.0045d980
nop
call fcn.0045c4a0
jmp fcn.00499450