Function at 0x46efa0
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d4612
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x620
push ebx
push esi
push edi
push 0x10000
mov dword [esp + 0x48], 0x19
call fcn.004b0b39
add esp, 4
test eax, eax
mov dword [esp + 0xc], eax
jne 0x46f015
mov eax, dword [ebp + 8]
push 0
push 1
mov dword [eax + 0x10], 4
mov eax, dword [eax + 0xc]
push 0x40c
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
mov ecx, dword [esp + 0x62c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x1650]
cmp eax, 3
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x18], ebx
je 0x46f047
cmp eax, 0x10
jge 0x46f047
lea ecx, [esi + 0x1628]
push ecx
push ebx
push edi
call fcn.0046e640
add esp, 0xc
push ebx
push edi
call fcn.0041b120
add esp, 8
cmp eax, 0x12
mov dword [esp + 0x38], eax
je 0x46f062
add eax, 0xffffffbf
cmp eax, 2
ja 0x46f073
cmp dword [esi + 0x4c8], 0
mov dword [esp + 0x58], 2
jne 0x46f07b
mov dword [esp + 0x58], 0
push esi
call fcn.0043c260
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], eax
mov byte [esp + 0x17], 0
mov byte [esp + 0x1f], 0
mov byte [esp + 0x57], 0
mov byte [esp + 0x27], 0
mov byte [esp + 0x1e], 1
mov dword [esp + 0x6c], 0
call fcn.004746b6
xor eax, eax
mov dword [esp + 0x634], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x48], eax
or eax, 0xffffffff
mov dword [0x64a36c], eax
mov dword [0x64a370], eax
mov byte [0x64a368], 0
cmp dword [esi + 0x1c], 0x80
mov dword [esp + 0x84], 1
jne 0x46f707
cmp dword [esi + 0x4d0], 0
mov byte [esp + 0x17], 1
je 0x46f707
push 0
push 0
push str.Supported_image_files__.nrg_.iso_.nrg_.iso
push 0x800006
push 0
push 0x4e377c
push 1
lea ecx, [esp + 0x37c]
call fcn.0049be3e
lea ecx, [esp + 0x360]
mov byte [esp + 0x634], 1
call fcn.0049bd12
cmp eax, 1
jne 0x46f790
lea edx, [esp + 0x40]
push edx
lea ecx, [esp + 0x364]
call fcn.0049bfea
mov eax, dword [eax]
push 0x100
push 0x8000
push eax
call fcn.004cb580
add esp, 0xc
lea ecx, [esp + 0x40]
mov dword [0x64a370], eax
call fcn.00402470
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x364]
mov byte [esp + 0x4c], 0
call fcn.0049c1ae
lea ecx, [esp + 0x20]
mov byte [esp + 0x634], 2
call fcn.0040e7f0
lea ecx, [esp + 0x20]
push 0x4e3778
push ecx
call fcn.00429480
add esp, 8
test al, al
je 0x46f1bd
mov byte [esp + 0x48], 1
jmp 0x46f228
cmp dword [0x64a370], 0xffffffff
je 0x46f236
lea edx, [esp + 0x40]
push edx
lea ecx, [esp + 0x364]
call fcn.0049bfea
push str..001
push eax
lea eax, [esp + 0x58]
push eax
mov byte [esp + 0x640], 3
call fcn.00409a00
add esp, 0xc
lea ecx, [esp + 0x40]
mov byte [esp + 0x634], 2
call fcn.00402470
mov ecx, dword [esp + 0x50]
push 0x100
push 0x8000
push ecx
call fcn.004cb580
add esp, 0xc
lea ecx, [esp + 0x50]
mov dword [0x64a36c], eax
call fcn.00402470
mov eax, dword [0x64a370]
cmp eax, 0xffffffff
jne 0x46f38b
lea ecx, [esp + 0x50]
call fcn.004746b6
push 0xee
lea ecx, [esp + 0x54]
mov byte [esp + 0x638], 4
call fcn.004746ea
call fcn.004b232d
mov eax, dword [eax]
sub eax, 2
lea ecx, [esp + 0x360]
je 0x46f2e7
sub eax, 0xb
je 0x46f2bc
sub eax, 0xb
je 0x46f297
lea edx, [esp + 0x6c]
push edx
call fcn.0049bfea
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x294]
push str.Error_opening__s
push ecx
call fcn.004b09b2
lea ecx, [esp + 0x78]
jmp 0x46f310
lea edx, [esp + 0x40]
push edx
call fcn.0049bfea
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x294]
push str.Error_opening__s_r_n_nToo_many_open_files
push ecx
call fcn.004b09b2
lea ecx, [esp + 0x4c]
jmp 0x46f310
lea edx, [esp + 0x8c]
push edx
call fcn.0049bfea
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x294]
push str.Error_opening__s_r_n_nAccess_denied
push ecx
call fcn.004b09b2
lea ecx, [esp + 0x98]
jmp 0x46f310
lea edx, [esp + 0x88]
push edx
call fcn.0049bfea
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x294]
push str.Error_opening__s_r_n_nNo_such_file_or_directory
push ecx
call fcn.004b09b2
lea ecx, [esp + 0x94]
add esp, 0xc
call fcn.00402470
mov eax, dword [esi + 0xc]
lea edx, [esp + 0x290]
push edx
push 1
push 0x40c
push eax
mov dword [esi + 0x10], 8
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004b253e
add esp, 4
lea ecx, [esp + 0x50]
call fcn.00402470
lea ecx, [esp + 0x20]
call fcn.00402470
lea ecx, [esp + 0x360]
mov byte [esp + 0x634], 0
call fcn.0049bdfd
lea ecx, [esp + 0x10]
call fcn.00402470
xor eax, eax
mov ecx, dword [esp + 0x62c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esp + 0x48], 0
mov dword [esp + 0x84], 2
je 0x46f472
push eax
call fcn.004b4ec2
add esp, 4
push 0
push 0x800
mov ebx, eax
push edx
push ebx
mov dword [esp + 0x84], edx
call fcn.004b4fe0
or eax, edx
je 0x46f440
mov edx, dword [0x64a370]
push edx
call fcn.004c0ec6
mov eax, dword [0x64a36c]
add esp, 4
cmp eax, 0xffffffff
je 0x46f3e7
push eax
call fcn.004c0ec6
add esp, 4
push 0x6afc
lea ecx, [esp + 0x14]
call fcn.004746ea
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x148]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x46f402
mov ecx, dword [esi + 0xc]
lea eax, [esp + 0x148]
push eax
push 1
push 0x40c
push ecx
mov dword [esi + 0x10], 8
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [esp + 0xc]
push edx
call fcn.004b253e
add esp, 4
jmp 0x46f34e
mov eax, dword [esp + 0x74]
push 0
push 0x800
push eax
push ebx
call fcn.004b0d50
mov ecx, dword [0x64a370]
push 0
push 0
mov ebx, eax
push 0
push ecx
mov dword [esp + 0x4c], ebx
call fcn.004b4b2b
add esp, 0x10
jmp 0x46f507
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x40]
push eax
call fcn.0046e2f0
add esp, 8
test eax, eax
jne 0x46f503
mov ecx, dword [0x64a370]
push ecx
call fcn.004c0ec6
mov eax, dword [0x64a36c]
add esp, 4
cmp eax, 0xffffffff
je 0x46f4aa
push eax
call fcn.004c0ec6
add esp, 4
push 0x6afc
lea ecx, [esp + 0x14]
call fcn.004746ea
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x148]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x46f4c5
mov eax, dword [esi + 0xc]
lea edx, [esp + 0x148]
push edx
push 1
push 0x40c
push eax
mov dword [esi + 0x10], 8
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004b253e
add esp, 4
jmp 0x46f34e
mov ebx, dword [esp + 0x3c]
cmp byte [esp + 0x48], 0
mov edx, dword [esp + 0x30]
mov dword [0x64a364], ebx
jne 0x46f599
mov eax, dword [esi + 0x1650]
xor cl, cl
cmp eax, 3
jne 0x46f538
cmp edx, 0x3000
je 0x46f536
cmp edx, 1
jne 0x46f538
mov cl, 1
cmp eax, 0x10
jl 0x46f547
cmp edx, 0x1e
je 0x46f599
cmp edx, 0x1c
je 0x46f599
test cl, cl
jne 0x46f599
mov edx, dword [0x64a370]
push edx
call fcn.004c0ec6
mov eax, dword [0x64a36c]
add esp, 4
cmp eax, 0xffffffff
je 0x46f56d
push eax
call fcn.004c0ec6
add esp, 4
push 0x6afd
lea ecx, [esp + 0x14]
call fcn.004746ea
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x148]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x46f588
jmp 0x46f40e
cmp dword [esi + 0x4bc], 0
mov eax, dword [esi + 0x1648]
mov dword [esp + 0x48], eax
je 0x46f5bf
cmp dword [esi + 0x1650], 0x10
jge 0x46f5bf
mov eax, dword [esi + 0x4ec]
mov dword [esp + 0x48], eax
cmp dword [esi + 0x4c0], 0
je 0x46f5db
cmp dword [esi + 0x1650], 0x10
jl 0x46f5db
mov eax, dword [esi + 0x4f0]
mov dword [esp + 0x48], eax
cmp ebx, eax
jbe 0x46f65e
mov eax, dword [0x64a370]
push eax
call fcn.004c0ec6
mov eax, dword [0x64a36c]
add esp, 4
cmp eax, 0xffffffff
je 0x46f604
push eax
call fcn.004c0ec6
add esp, 4
push 0x6afe
lea ecx, [esp + 0x14]
call fcn.004746ea
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x148]
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x46f620
mov edx, dword [esi + 0xc]
lea ecx, [esp + 0x148]
push ecx
push 1
push 0x40c
push edx
mov dword [esi + 0x10], 8
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0xc]
push eax
call fcn.004b253e
add esp, 4
jmp 0x46f34e
push 0x6aff
lea ecx, [esp + 0x14]
call fcn.004746ea
push 0x4e376c
lea ecx, [esp + 0x14]
call fcn.00405f10
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x364]
call fcn.0049c0f6
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x638], 5
call fcn.0040a8a0
lea ecx, [esp + 0x40]
mov byte [esp + 0x634], 2
call fcn.00402470
push 0x4e3768
lea ecx, [esp + 0x14]
call fcn.00405f10
shr ebx, 9
push ebx
lea edx, [esp + 0x14c]
push str.___d_MB_
push edx
call fcn.004b09b2
add esp, 0xc
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0x14]
call fcn.00405f10
lea ecx, [esp + 0x20]
call fcn.00402470
lea ecx, [esp + 0x360]
mov byte [esp + 0x634], 0
call fcn.0049bdfd
mov ebx, dword [esp + 0x18]
cmp dword [esi + 0x4c4], 0
jne 0x46f724
cmp byte [esp + 0x17], 0
jne 0x46f724
mov ecx, 0x10
cmp dword [esi + 0x1650], ecx
jl 0x46f72e
mov byte [esp + 0x1f], 1
mov ecx, 0x10
cmp dword [esi + 0x4bc], 0
je 0x46f73f
cmp dword [esi + 0x1650], ecx
jl 0x46f750
cmp dword [esi + 0x4c0], 0
je 0x46f755
cmp dword [esi + 0x1650], ecx
jl 0x46f755
mov byte [esp + 0x57], 1
cmp byte [esp + 0x17], 0
je 0x46f771
cmp byte [esp + 0x1f], 0
je 0x46f771
cmp dword [esi + 0x4cc], 0
je 0x46f771
mov byte [esp + 0x27], 1
mov eax, dword [esi + 0x1650]
cmp eax, ecx
jl 0x46f80a
cmp dword [esi + 0x5b0], 1
jne 0x46f7c6
mov eax, dword [esi + 0x15e0]
jmp 0x46f7f6
push ebx
push edi
call fcn.0046ded0
mov ecx, dword [esi + 0xc]
add esp, 8
push 0
push 1
push 0x40c
push ecx
mov dword [esi + 0x10], 2
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [esp + 0xc]
push edx
call fcn.004b253e
add esp, 4
jmp 0x46f357
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x46f7e5
mov edx, dword [esi + 0x1648]
push 0xffff
push edx
push ebx
push edi
call fcn.0041ba20
add esp, 0x10
jmp 0x46f84b
cmp eax, 2
jne 0x46f84b
mov eax, dword [esi + 0x50c]
imul eax, eax, 0x569
mov ecx, dword [esi + 0x1648]
push eax
push ecx
push ebx
push edi
call fcn.0041ba20
add esp, 0x10
jmp 0x46f84b
cmp eax, 3
jne 0x46f84b
cmp dword [esi + 0x5b0], 1
jne 0x46f821
mov edx, dword [esi + 0x15e0]
push edx
jmp 0x46f841
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x46f82f
push 0xffff
jmp 0x46f841
cmp eax, 2
jne 0x46f84b
mov eax, dword [esi + 0x50c]
imul eax, eax, 0xb1
push eax
push ebx
push edi
call fcn.00419560
add esp, 0xc
lea ecx, [esp + 0x2f8]
push ecx
push 0x40
push 5
push ebx
push edi
call fcn.0041baf0
movzx edx, byte [esp + 0x30d]
push 0
push ebx
push edi
mov dword [esp + 0x48], edx
call fcn.0041a4d0
add esp, 0x20
cmp dword [esi + 0x1650], 0x10
mov dword [esp + 0x4c], 0x1194
jl 0x46f8a1
mov dword [esp + 0x30], 0
mov dword [esp + 0x44], 0x20
mov dword [esp + 0x4c], 0x1180
jmp 0x46f8be
cmp dword [esi + 0x4b4], 0
je 0x46f8b6
mov bl, 1
mov dword [esp + 0x30], 0
jmp 0x46f8c0
mov dword [esp + 0x30], 0xffffff6a
mov bl, 2
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x44]
cdq
idiv ecx
test edx, edx
je 0x46f8e1
mov eax, dword [esp + 0x34]
lea eax, [eax + ecx - 1]
cdq
idiv ecx
imul eax, ecx
mov dword [esp + 0x34], eax
push 0x64
lea ecx, [esp + 0xe4]
push 0
push ecx
call fcn.004b0a70
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0xec]
push edx
push eax
push ecx
push edi
mov byte [esp + 0x100], 5
mov byte [esp + 0x101], 0x32
mov byte [esp + 0x102], bl
mov byte [esp + 0x10f], 0x96
call fcn.00419c20
add esp, 0x1c
cmp byte [esp + 0x17], 0
je 0x46f93c
cmp dword [esi + 0x4d8], 0
je 0x46f948
mov dl, bl
or dl, 0x10
mov byte [esp + 0xe6], dl
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x18]
lea eax, [esp + 0xe0]
push eax
push ecx
push edx
push edi
call fcn.00419c20
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x28]
lea eax, [esp + 0xf0]
push eax
push ecx
push edx
push edi
mov byte [esp + 0x106], bl
call fcn.00419c20
add esp, 0x20
cmp byte [esp + 0x17], 0
je 0x46f992
cmp dword [esi + 0x4d8], 0
je 0x46f99c
or bl, 0x10
mov byte [esp + 0xe6], bl
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x18]
push eax
push 0x20
push ebx
push edi
call fcn.00419b60
mov ecx, dword [esp + 0x1c]
push ecx
push ebx
push edi
call fcn.0041a480
add esp, 0x1c
cmp byte [esp + 0x1f], 0
je 0x46f9e6
mov eax, dword [esi + 0x1650]
cmp eax, 0x10
jl 0x46f9d4
cmp eax, 0x15
jne 0x46f9e6
mov byte [esp + 0xe7], 4
mov byte [esp + 0xe8], 8
jmp 0x46f9f6
mov byte [esp + 0xe7], 0
mov byte [esp + 0xe8], 0
mov edx, dword [esi + 0x4b8]
push edx
push ebx
push edi
call fcn.0041bb30
lea eax, [esp + 0x304]
push eax
push 0x40
push 5
push ebx
push edi
call fcn.0041baf0
add esp, 0x20
test byte [esp + 0x2fa], 0x40
je 0x46fa2c
or byte [esp + 0xe6], 0x40
mov ecx, dword [esp + 0x38]
cmp ecx, 0x12
mov ebx, dword [esi + 0x1648]
mov dword [esp + 0x20], 0
je 0x46fa63
cmp ecx, 0x41
je 0x46fa63
cmp ecx, 0x42
je 0x46fa63
cmp ecx, 0x43
je 0x46fa63
push ecx
call fcn.0043e0f0
mov ecx, dword [esp + 0x3c]
add esp, 4
test al, al
je 0x46fa73
mov eax, ebx
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
shl eax, 5
mov ebx, eax
cmp byte [esp + 0x27], 0
mov eax, dword [esp + 0x3c]
je 0x46fa9b
test eax, eax
jbe 0x46faa3
mov edx, dword [esp + 0x48]
add edx, 5
cmp eax, edx
jbe 0x46fa96
mov byte [esp + 0x27], 0
mov ebx, eax
jmp 0x46fac4
lea ebx, [eax + 5]
jmp 0x46fac4
test eax, eax
jbe 0x46faa3
mov ebx, eax
jmp 0x46fac4
cmp ecx, 0x12
je 0x46fac4
cmp ecx, 0x41
je 0x46fac4
cmp ecx, 0x42
je 0x46fac4
cmp ecx, 0x43
je 0x46fac4
mov eax, dword [esp + 0x38]
push eax
call fcn.0043e0f0
add esp, 4
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xe0]
push ecx
push edx
push eax
push edi
call fcn.00419c20
add esp, 0x10
cmp eax, 1
je 0x46fb5e
mov ecx, dword [esi + 0xc]
push 0
push 1
push 0x40c
push ecx
mov dword [esi + 0x10], 4
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [esp + 0x18]
push 1
push edx
push edi
call fcn.0041a4d0
mov eax, dword [esp + 0x18]
push eax
call fcn.004b253e
add esp, 0x10
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x634], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46f374
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x62c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x4d0], 0
jne 0x46fc0a
cmp dword [esi + 0x4b4], 1
je 0x46fb85
cmp dword [esi + 0x1650], 0x10
jge 0x46fb85
sub ebx, 0x96
jmp 0x46fbda
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0043e0e0
add esp, 4
test al, al
jne 0x46fbda
mov ebx, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
push ebx
push 0x1c
push 0
push 0
push edx
push edi
call fcn.00419740
movzx ebx, byte [ebx + 0x19]
mov ecx, dword [esp + 0x24]
movzx edx, byte [ecx + 0x1a]
movzx ecx, byte [ecx + 0x1b]
shl ebx, 8
add ebx, edx
shl ebx, 8
add ebx, ecx
mov ecx, dword [esi + 0x1648]
add esp, 0x18
cmp ebx, ecx
jge 0x46fbd8
cmp eax, 1
je 0x46fbda
mov ebx, ecx
cmp dword [esi + 0x4bc], 0
je 0x46fbf2
cmp dword [esi + 0x1650], 0x10
jge 0x46fbf2
mov ebx, dword [esi + 0x4ec]
cmp dword [esi + 0x4c0], 0
je 0x46fc0a
cmp dword [esi + 0x1650], 0x10
jl 0x46fc0a
mov ebx, dword [esi + 0x4f0]
cmp byte [esp + 0x17], 0
je 0x46fcac
push 0x96000
call fcn.004b0b39
add esp, 4
cmp byte [esp + 0x27], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], 0
je 0x46fc6c
mov eax, dword [esp + 0x38]
cmp eax, 0x12
mov dword [esp + 0x28], 1
je 0x46fc64
cmp eax, 0x41
je 0x46fc64
cmp eax, 0x42
je 0x46fc64
cmp eax, 0x43
je 0x46fc64
mov edx, eax
push edx
call fcn.0043e0f0
add esp, 4
test al, al
je 0x46fc6c
mov dword [esp + 0x28], 3
mov eax, dword [esp + 0x38]
push eax
call fcn.0043e1a0
add esp, 4
cmp ebx, 0x15f90
push eax
push ebx
jge 0x46fc95
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
add ecx, 0x1f4
push ecx
push edx
jmp 0x46fca4
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
add eax, 0x1388
push eax
push ecx
call fcn.00447880
add esp, 0x10
cmp dword [esi + 0x4b4], 0
jne 0x46fef0
cmp dword [esi + 0x1650], 0x10
jge 0x46fef0
cmp byte [esp + 0x1f], 0
mov byte [esp + 0x90], 1
mov byte [esp + 0x91], 0
mov byte [esp + 0x92], 0
mov byte [esp + 0x93], 1
mov byte [esp + 0x94], 0
mov byte [esp + 0x95], 0
mov byte [esp + 0x96], 0
mov byte [esp + 0x97], 0
mov byte [esp + 0x98], 1
mov byte [esp + 0x99], 1
mov byte [esp + 0x9a], 0
mov byte [esp + 0x9b], 0
mov byte [esp + 0x9c], 0
mov byte [esp + 0x9d], 0
mov byte [esp + 0x9e], 0
mov byte [esp + 0x9f], 0
mov byte [esp + 0xa0], 1
mov byte [esp + 0xa1], 1
mov byte [esp + 0xa2], 1
mov byte [esp + 0xa3], 0
mov byte [esp + 0xa4], 0
mov byte [esp + 0xa5], 0
mov byte [esp + 0xa6], 2
mov byte [esp + 0xa7], 0
mov byte [esp + 0xa8], 1
mov byte [esp + 0xa9], 0xaa
mov byte [esp + 0xaa], 1
mov byte [esp + 0xab], 1
mov byte [esp + 0xac], 0
je 0x46fdf0
xor eax, eax
jmp 0x46fdc0
mov byte [esp + eax*8 + 0x90], 0x41
add eax, 1
cmp eax, 4
jl 0x46fdc0
mov byte [esp + 0xa3], 0x10
mov byte [esp + 0x9b], 0x10
mov byte [esp + 0xab], 0x14
mov byte [esp + 0x93], 0x14
mov edi, dword [esp + 0x4c]
mov ecx, dword [esp + 0x34]
mov eax, ebx
sub eax, edi
cdq
idiv ecx
imul eax, ecx
cmp byte [esp + 0x17], 0
lea edi, [eax + edi + 0x96]
mov dword [esp + 0x28], edi
je 0x46fe20
lea edx, [ebx + 0x96]
mov dword [esp + 0x28], edx
mov edi, edx
mov eax, 0x7482296b
imul edi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0xad], al
mov eax, 0x1b4e81b5
imul edi
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, ecx
cdq
mov edi, 0x3c
idiv edi
mov edi, dword [esp + 0x2c]
mov al, cl
mov cl, 0x4b
imul cl
mov cl, byte [esp + 0x28]
sub cl, al
mov eax, dword [esp + 0x18]
mov byte [esp + 0xaf], cl
mov byte [esp + 0xae], dl
lea edx, [esp + 0x90]
push edx
push 0x20
push eax
push edi
call fcn.004196e0
add esp, 0x10
cmp eax, 1
je 0x46fef0
mov ecx, dword [esi + 0xc]
push 0
push 1
push 0x40c
push ecx
mov dword [esi + 0x10], 4
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [esp + 0x20]
push edx
call fcn.004b253e
mov eax, dword [esp + 0x1c]
push 1
push eax
push edi
call fcn.0041a4d0
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004b253e
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0x14
mov dword [esp + 0x634], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x46fb37
cmp dword [esp + 0x84], 2
jne 0x47018f
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x34]
add ecx, edx
cmp dword [esp + 0x3c], ecx
mov dword [esi + 0x10], 5
jae 0x46ff85
mov eax, dword [esp + 0x20]
push eax
call fcn.004b253e
mov ecx, dword [esp + 0x1c]
push 1
push ecx
push edi
call fcn.0041a4d0
mov edx, dword [esp + 0x1c]
push edx
call fcn.004b253e
add esp, 0x14
push 0x6b36
lea ecx, [esp + 0x14]
call fcn.004746ea
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x148]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
add eax, 1
test cl, cl
jne 0x46ff54
mov ecx, dword [esi + 0xc]
lea eax, [esp + 0x148]
push eax
push 1
push 0x40c
push ecx
mov dword [esi + 0x10], 8
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x46f36b
call fcn.00445a00
cmp eax, 1
mov dword [0x64a490], eax
jge 0x46ff9e
mov eax, 0x140
mov dword [0x64a490], eax
imul eax, dword [esp + 0x44]
shl eax, 0xb
push eax
call fcn.004b0b39
add esp, 4
test eax, eax
mov dword [0x64a48c], eax
jne 0x46fffa
mov edx, dword [esi + 0xc]
push eax
push 1
push 0x40c
push edx
mov dword [esi + 0x10], 4
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x20]
push eax
call fcn.004b253e
mov ecx, dword [esp + 0x1c]
push 1
push ecx
push edi
call fcn.0041a4d0
mov edx, dword [esp + 0x1c]
push edx
call fcn.004b253e
add esp, 0x14
jmp 0x46f36b
mov eax, dword [0x64a490]
imul eax, dword [esp + 0x44]
shl eax, 0xb
lea ecx, [eax + 0x1e8480]
push ecx
add eax, 0xf4240
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov edx, dword [0x64a490]
imul edx, dword [esp + 0x44]
mov eax, dword [0x64a48c]
shl edx, 0xb
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualLock]
test eax, eax
jne 0x4700c4
mov ecx, dword [esp + 0x18]
push ecx
push edi
call fcn.0046ded0
add esp, 8
push 0x6b38
lea ecx, [esp + 0x14]
call fcn.004746ea
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x148]
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [eax + edx], cl
add eax, 1
test cl, cl
jne 0x470070
mov eax, dword [esi + 0xc]
lea edx, [esp + 0x528]
push edx
push 1
push 0x40c
push eax
mov dword [esi + 0x10], 8
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x64a48c]
push ecx
call fcn.004b253e
mov edx, dword [esp + 0x24]
push edx
call fcn.004b253e
mov eax, dword [esp + 0x14]
push eax
call fcn.004b253e
add esp, 0xc
jmp 0x46f36b
mov eax, dword [esp + 0x44]
xor ecx, ecx
mov edx, eax
shl edx, 0xb
cmp dword [0x64a490], ecx
mov dword [0x64a488], ecx
mov dword [0x64a484], ecx
mov dword [0x64a480], ecx
mov dword [0x64a47c], edx
mov dword [0x64a374], eax
mov dword [esp + 0x50], ecx
jle 0x47011c
push esi
call fcn.0046dfd0
add esp, 4
test eax, eax
je 0x4703aa
mov eax, dword [esp + 0x50]
add eax, 1
cmp eax, dword [0x64a490]
mov dword [esp + 0x50], eax
jl 0x4700f8
xor eax, eax
push eax
push 1
mov dword [0x64a488], eax
mov dword [0x64a484], eax
mov eax, dword [esi + 0xc]
push 0x40c
push eax
mov dword [esi + 0x10], 9
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x148]
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
add eax, 1
test cl, cl
jne 0x470150
mov edx, dword [esi + 0xc]
lea ecx, [esp + 0x148]
push ecx
push 1
push 0x40c
push edx
mov dword [esi + 0x10], 5
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0
push 0
push esi
push 0x46e080
call fcn.0049b408
cmp dword [esi + 0x1650], 0x14
jne 0x47020d
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
push eax
push 0x20
push ecx
push edi
call fcn.00419b60
add esp, 0x10
cmp eax, 1
jne 0x47020d
mov edx, dword [esp + 0xc]
test byte [edx + 7], 3
jne 0x47020d
mov ecx, dword [esp + 0x18]
mov al, 0xff
mov byte [esp + 0x60], al
mov byte [esp + 0x61], al
mov byte [esp + 0x62], al
mov byte [esp + 0x63], al
lea eax, [esp + 0x5c]
push eax
push 0xc
push 0x11
push ecx
push edi
mov byte [esp + 0x70], 0
mov byte [esp + 0x71], 0
mov byte [esp + 0x72], 0
mov byte [esp + 0x73], 8
mov byte [esp + 0x78], 0x98
mov byte [esp + 0x79], 0
mov byte [esp + 0x7a], 0
mov byte [esp + 0x7b], 0
call fcn.0041a520
add esp, 0x14
mov eax, dword [esi + 0x1650]
cmp eax, 0x20
jl 0x470281
cmp eax, 0x22
jg 0x470281
mov edx, ebx
mov ecx, ebx
sar edx, 0x10
sar ecx, 8
cmp eax, 0x21
mov byte [esp + 0x70], 0
mov byte [esp + 0x71], 0x82
mov byte [esp + 0x72], 0
mov byte [esp + 0x73], 8
mov byte [esp + 0x74], 0
mov byte [esp + 0x78], 0
mov byte [esp + 0x79], 0
mov byte [esp + 0x7a], 8
mov byte [esp + 0x7b], 0
mov byte [esp + 0x75], dl
mov byte [esp + 0x76], cl
mov byte [esp + 0x77], bl
jne 0x47026a
mov byte [esp + 0x78], 1
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x70]
push edx
push 0xc
push 0x11
push eax
push edi
call fcn.0041a520
add esp, 0x14
mov eax, dword [esi + 0x1650]
cmp eax, 0x30
jl 0x4702f2
cmp eax, 0x32
jg 0x4702f2
cmp dword [esi + 0x1654], 2
mov byte [esp + 0x5c], 0
mov byte [esp + 0x5d], 0x82
mov byte [esp + 0x5e], 0
mov byte [esp + 0x5f], 8
mov byte [esp + 0x60], 0
mov byte [esp + 0x61], 0
mov byte [esp + 0x62], 0
mov byte [esp + 0x63], 0
mov byte [esp + 0x64], 0x54
mov byte [esp + 0x65], 0
mov byte [esp + 0x66], 0
mov byte [esp + 0x67], 0
jne 0x4702db
mov byte [esp + 0x64], 0x5c
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x5c]
push ecx
push 0xc
push 0x11
push edx
push edi
call fcn.0041a520
add esp, 0x14
cmp dword [esi + 0x1650], 0x10
jl 0x47035a
mov eax, dword [esp + 0x18]
push 0
push 0
push 0
push 0
push eax
push edi
call fcn.00419980
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x30]
push ecx
push 0x20
push edx
push edi
call fcn.00419b60
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x40]
push eax
push 0x24
push 1
push 1
push ecx
push edi
call fcn.00419740
add esp, 0x40
cmp dword [esi + 0x1650], 0x10
jl 0x47035a
mov eax, dword [esp + 0x38]
cmp eax, 0x12
je 0x47035e
mov edx, dword [esp + 0x18]
push ebx
push edx
push edi
call fcn.004197b0
add esp, 0xc
mov eax, dword [esp + 0x38]
cmp byte [esp + 0x27], 0
je 0x470429
cmp eax, 0x12
je 0x470426
cmp eax, 0x41
je 0x470426
cmp eax, 0x42
je 0x470426
cmp eax, 0x43
je 0x470426
mov eax, dword [esp + 0x38]
push eax
call fcn.0043e0f0
add esp, 4
test al, al
jne 0x470426
sub ebx, 5
jmp 0x470429
mov eax, dword [esp + 0x18]
push eax
push edi
call fcn.0046ded0
add esp, 8
push 0xe2
lea ecx, [esp + 0x14]
call fcn.004746ea
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x148]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
add eax, 1
test cl, cl
jne 0x4703d3
mov edx, dword [esi + 0xc]
lea ecx, [esp + 0x528]
push ecx
push 1
push 0x40c
push edx
mov dword [esi + 0x10], 8
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x64a48c]
push eax
call fcn.004b253e
mov ecx, dword [esp + 0x24]
push ecx
call fcn.004b253e
mov edx, dword [esp + 0x14]
push edx
call fcn.004b253e
add esp, 0xc
jmp 0x46f36b
sub ebx, 0x20
mov edi, dword [esp + 0x4c]
mov ecx, dword [esp + 0x34]
mov eax, ebx
sub eax, edi
cdq
idiv ecx
cmp byte [esp + 0x17], 0
mov dword [esp + 0x50], eax
je 0x47044e
imul eax, ecx
sub ebx, eax
sub ebx, edi
mov dword [esp + 0x6c], ebx
mov ebx, dword [esp + 0x44]
mov eax, ecx
cdq
idiv ebx
mov edi, dword [esp + 0x30]
test edi, edi
mov dword [esp + 0x8c], eax
je 0x470527
mov edx, dword [esp + 0xc]
mov ecx, ebx
imul ecx, ecx, 0x930
push ecx
push 0
push edx
call fcn.004b0a70
mov eax, edi
cdq
idiv ebx
add esp, 0xc
mov dword [esp + 0x28], 0
neg eax
test eax, eax
mov dword [esp + 0x40], eax
jle 0x470527
lea ecx, [ecx]
cmp byte [esp + 0x1f], 0
je 0x4704c4
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x30]
push ecx
push 0x800
push ebx
push edi
push edx
push eax
jmp 0x4704df
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push 0x930
push ebx
push edi
push eax
push ecx
call fcn.0046e5b0
add esp, 0x1c
cmp eax, 1
je 0x470510
call fcn.004184d0
and eax, 0xffffff00
cmp eax, 0x20400
jne 0x4705ae
sub dword [esp + 0x28], 1
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
sub edi, ebx
mov eax, dword [esp + 0x28]
add eax, 1
add edi, ebx
cmp eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
jl 0x4704a0
mov eax, dword [esp + 0x4c]
cdq
idiv ebx
mov dword [esp + 0x30], 0
test eax, eax
mov dword [esp + 0x40], eax
jle 0x470774
mov eax, ebx
shl eax, 0xb
mov dword [esp + 0x3c], eax
mov eax, edi
shl eax, 0xb
add eax, dword [esp + 0x20]
mov dword [esp + 0x34], eax
cmp byte [esp + 0x17], 0
je 0x4706cf
cmp byte [esp + 0x1e], 0
je 0x4706ca
test edi, edi
jl 0x470621
mov ecx, 0x12c
sub ecx, ebx
cmp edi, ecx
jge 0x470621
cmp dword [esi + 0x4d0], 0
jne 0x470621
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0xc]
push edx
push eax
push ecx
call fcn.004b31c0
add esp, 0xc
jmp 0x4706cf
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
push edx
push eax
call fcn.0046ded0
mov ecx, dword [esi + 0xc]
add esp, 8
push 0
push 1
push 0x40c
push ecx
mov dword [esi + 0x10], 4
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [0x64a48c]
push edx
call fcn.004b253e
mov eax, dword [esp + 0x24]
push eax
call fcn.004b253e
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004b253e
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 0xc
mov dword [esp + 0x634], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x46fb37
mov edx, dword [esp + 0x84]
mov eax, dword [esp + 0xc]
mov ecx, dword [esi + 0x1650]
push 0x64
push edx
push eax
push ecx
push ebx
push edi
call fcn.0046e0d0
add esp, 0x18
test eax, eax
jne 0x4706cf
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
call fcn.0046ded0
add esp, 8
push 0xe2
lea ecx, [esp + 0x14]
call fcn.004746ea
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x148]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x470676
lea edx, [esp + 0x528]
mov dword [esi + 0x10], 8
push edx
mov eax, dword [esi + 0xc]
push 1
push 0x40c
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x64a48c]
push ecx
call fcn.004b253e
mov edx, dword [esp + 0x24]
push edx
call fcn.004b253e
mov eax, dword [esp + 0x14]
push eax
call fcn.004b253e
add esp, 0xc
jmp 0x46fb18
mov byte [esp + 0x1e], 1
cmp byte [esp + 0x1f], 0
je 0x4706f3
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x30]
push eax
push 0x800
push ebx
push edi
push ecx
push edx
jmp 0x47070e
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x30]
push ecx
push 0x930
push ebx
push edi
push edx
push eax
call fcn.0046e5b0
add esp, 0x1c
cmp eax, 1
je 0x47074c
call fcn.004184d0
and eax, 0xffffff00
cmp eax, 0x20400
jne 0x4708ce
sub dword [esp + 0x30], 1
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x3c]
sub edi, ebx
sub dword [esp + 0x34], ecx
mov byte [esp + 0x1e], 0
cmp byte [esi], 0
jne 0x470916
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x3c]
add dword [esp + 0x34], edx
add eax, 1
add edi, ebx
cmp eax, dword [esp + 0x40]
mov dword [esp + 0x30], eax
jl 0x470558
mov dword [esp + 0xc0], 0
call fcn.00445850
cmp eax, 1
mov dword [esp + 0x88], eax
jge 0x47079b
mov dword [esp + 0x88], 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0xcc], eax
xor eax, eax
mov ecx, 0x64
mov dword [esi + 0xdc8], eax
mov dword [esi + 0xdcc], eax
mov dword [esi + 0x5bc], ecx
mov dword [esi + 0x5c0], eax
mov dword [esi + 0xdd8], ecx
mov dword [esi + 0xddc], eax
call fcn.0043bd10
mov eax, dword [esp + 0x8c]
imul eax, ebx
xor ecx, ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0xc4], ecx
shl ebx, 0xb
lea ecx, [esi + 0xde0]
lea edx, [esi + 0x1668]
mov dword [esi + 0x10], 1
mov dword [esp + 0xdc], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x68], edx
jmp 0x470820
mov eax, dword [esp + 0xc4]
cdq
idiv dword [esp + 0x50]
xor ebx, ebx
push eax
mov eax, dword [esi + 0xc]
push ebx
push 0x40c
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x68]
mov edx, dword [esp + 0xdc]
mov ecx, edi
sub ecx, dword [esp + 0x4c]
mov dword [eax], edx
mov dword [eax - 4], ecx
call fcn.0043bd20
fld qword [0x4d9b60]
mov dword [esp + 0x30], ebx
fstp qword [esp + 0x70]
fld qword [esp + 0xd0]
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xc8], ebx
mov ebx, edi
shl ebx, 0xb
add ebx, dword [esp + 0x20]
mov dword [esp + 0xbc], ebx
cmp byte [esp + 0x17], 0
je 0x4709eb
cmp byte [esp + 0x1e], 0
je 0x4709e6
mov eax, 0x12c
sub eax, dword [esp + 0x44]
cmp edi, eax
jge 0x470936
mov ecx, dword [esp + 0x3c]
fstp st(0)
mov edx, dword [esp + 0xc]
push ecx
push ebx
push edx
call fcn.004b31c0
add esp, 0xc
jmp 0x4709ed
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x2c]
push ecx
push edx
call fcn.0046ded0
mov eax, dword [esi + 0xc]
add esp, 8
push 0
push 1
push 0x40c
push eax
mov dword [esi + 0x10], 4
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004b253e
mov edx, dword [esp + 0x10]
push edx
call fcn.004b253e
add esp, 8
jmp 0x46fb18
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x2c]
push ecx
push edx
call fcn.0046ded0
add esp, 8
mov dword [esi + 0x10], 2
push 0
jmp 0x470691
call fcn.004b0540
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x1650]
push eax
mov eax, dword [esp + 0x88]
push eax
mov eax, dword [esp + 0x4c]
push ecx
push edx
push eax
push edi
call fcn.0046e0d0
add esp, 0x18
test eax, eax
jne 0x4709ed
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
push edx
push eax
call fcn.0046ded0
add esp, 8
push 0xe2
lea ecx, [esp + 0x14]
call fcn.004746ea
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x148]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x470993
lea ecx, [esp + 0x528]
mov dword [esi + 0x10], 8
push ecx
mov edx, dword [esi + 0xc]
push 1
push 0x40c
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x64a48c]
push eax
call fcn.004b253e
mov ecx, dword [esp + 0x24]
push ecx
call fcn.004b253e
mov edx, dword [esp + 0x14]
push edx
call fcn.004b253e
add esp, 0xc
jmp 0x46fb18
mov byte [esp + 0x1e], 1
fstp st(0)
cmp byte [esp + 0x1f], 0
je 0x470a15
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x34]
push 0x800
push eax
push edi
push ecx
push edx
jmp 0x470a34
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x34]
push 0x930
push edx
push edi
push eax
push ecx
call fcn.0046e5b0
add esp, 0x1c
cmp eax, 1
mov dword [esp + 0x28], eax
je 0x470a7b
call fcn.004184d0
and eax, 0xffffff00
cmp eax, 0x20400
jne 0x470d7e
sub dword [esp + 0x30], 1
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
sub edi, dword [esp + 0x44]
sub ebx, dword [esp + 0x3c]
mov byte [esp + 0x1e], 0
mov dword [esp + 0xbc], ebx
cmp byte [esi], 0
jne 0x470916
cmp dword [esp + 0xc0], 0
jne 0x470c6a
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x210]
push edx
push eax
push ecx
call fcn.00419d00
add esp, 0xc
cmp eax, 1
jne 0x470bbc
movzx eax, byte [esp + 0x215]
movzx edx, byte [esp + 0x216]
movzx ecx, byte [esp + 0x217]
shl eax, 8
add eax, edx
movzx edx, byte [esp + 0x21a]
shl eax, 8
add eax, ecx
movzx ecx, byte [esp + 0x219]
shl ecx, 8
add ecx, edx
movzx edx, byte [esp + 0x21b]
shl ecx, 8
mov dword [esp + 0xb0], eax
add ecx, edx
sub eax, ecx
mov dword [esp + 0x48], eax
fild dword [esp + 0x48]
fmul qword [0x4d9b60]
fidiv dword [esp + 0xb0]
fst qword [esp + 0xd0]
fld qword [esp + 0x70]
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x470b2f
fst qword [esp + 0x70]
fild dword [esi + 0x5bc]
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x470b4b
fld st(0)
call fcn.004b0540
mov dword [esi + 0x5bc], eax
fild dword [esi + 0x5c0]
fcomp st(1)
fnstsw ax
test ah, 5
jp 0x470b67
fld st(0)
call fcn.004b0540
mov dword [esi + 0x5c0], eax
mov eax, dword [esi + 0xdc8]
fild dword [esi + 0xdc8]
test eax, eax
jge 0x470b7d
fadd qword [0x4dda00]
fnstcw word [esp + 0x48]
movzx eax, word [esp + 0x48]
fadd st(1)
or eax, 0xc00
add dword [esi + 0xdcc], 1
mov dword [esp + 0xb0], eax
fldcw word [esp + 0xb0]
fistp qword [esp + 0xb0]
mov ecx, dword [esp + 0xb0]
mov dword [esi + 0xdc8], ecx
fldcw word [esp + 0x48]
jmp 0x470bc5
fldz
fst qword [esp + 0xd0]
cmp dword [esi + 0x5b0], 0
je 0x470c71
fstp st(0)
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0xcc]
cmp eax, 0x190
jbe 0x470c6a
call fcn.0046abc0
mov ebx, eax
cmp ebx, 0x64
jle 0x470bfd
mov ebx, 0x64
cmp ebx, dword [esi + 0xdd8]
jge 0x470c0b
mov dword [esi + 0xdd8], ebx
cmp ebx, dword [esi + 0xddc]
jle 0x470c19
mov dword [esi + 0xddc], ebx
add dword [esp + 0xb8], ebx
add dword [esp + 0xc8], 1
mov dword [esi + 0x165c], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
fld qword [esp + 0x70]
mov dword [esp + 0xcc], eax
call fcn.004b0540
mov edx, dword [esi + 0xc]
push 1
push 1
push 0x40c
push edx
mov dword [esi + 0x5b8], eax
mov dword [esi + 0xdd4], ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [esp + 0xbc]
fld qword [esp + 0xd0]
mov eax, dword [esp + 0xc0]
add eax, 1
cdq
idiv dword [esp + 0x88]
mov eax, dword [esp + 0x30]
add ebx, dword [esp + 0x3c]
add edi, dword [esp + 0x44]
add eax, 1
cmp eax, dword [esp + 0x8c]
mov dword [esp + 0xbc], ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0xc0], edx
jge 0x470cb8
cmp dword [esp + 0x28], 0xfffffffe
jne 0x47088d
cmp dword [esp + 0x28], 1
fstp st(0)
jne 0x470d25
mov ebx, dword [esp + 0x40]
fld qword [esp + 0x70]
fstp qword [ebx - 0x818]
fild dword [esp + 0xb8]
fidiv dword [esp + 0xc8]
fstp qword [ebx]
call fcn.0043bd30
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x34]
fstp qword [ecx + 4]
add dword [esp + 0xc4], 0x64
push 0
add eax, 1
push 1
mov dword [esi + 0x1660], eax
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 0xc]
push 0x40c
add ebx, 8
add ecx, 0x10
push eax
mov dword [esp + 0x50], ebx
mov dword [esp + 0x78], ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x34]
cmp ecx, dword [esp + 0x50]
jl 0x470820
mov eax, dword [esp + 0x6c]
test eax, eax
jle 0x470d64
mov ebx, dword [esp + 0x44]
cdq
idiv ebx
test edx, edx
mov dword [esp + 0xb0], edx
mov dword [esp + 0x68], eax
je 0x470d58
add eax, 1
mov dword [esp + 0x68], eax
test eax, eax
mov dword [esp + 0x4c], 0
jg 0x470dab
cmp byte [esp + 0x57], 0
jne 0x470eb9
mov ecx, dword [esp + 0x50]
mov dword [esi + 0x1660], ecx
jmp 0x470ec3
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x2c]
push ecx
push edx
call fcn.0046ded0
add esp, 8
mov dword [esi + 0x10], 4
push 0
jmp 0x470691
mov eax, dword [esp + 0x68]
mov edx, dword [esp + 0xb0]
add eax, 0xffffffff
cmp dword [esp + 0x4c], eax
jne 0x470dba
test edx, edx
je 0x470dba
mov ebx, edx
cmp byte [esp + 0x1e], 0
je 0x470e23
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0xc]
mov eax, dword [esi + 0x1650]
push 0x64
push ecx
push edx
push eax
push ebx
push edi
call fcn.0046e0d0
add esp, 0x18
test eax, eax
jne 0x470e28
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
call fcn.0046ded0
add esp, 8
push 0xe2
lea ecx, [esp + 0x14]
call fcn.004746ea
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x148]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x470e12
jmp 0x470682
mov byte [esp + 0x1e], 1
cmp byte [esp + 0x1f], 0
je 0x470e4c
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push 0x800
push ebx
push edi
push eax
push ecx
jmp 0x470e67
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x30]
push eax
push 0x930
push ebx
push edi
push ecx
push edx
call fcn.0046e5b0
add esp, 0x1c
cmp eax, 1
je 0x470e9d
call fcn.004184d0
and eax, 0xffffff00
cmp eax, 0x20400
jne 0x470d7e
sub dword [esp + 0x4c], 1
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
sub edi, ebx
mov byte [esp + 0x1e], 0
mov eax, dword [esp + 0x4c]
add eax, 1
add edi, ebx
cmp eax, dword [esp + 0x68]
mov dword [esp + 0x4c], eax
jl 0x470da0
jmp 0x470d64
mov edx, dword [esp + 0x34]
mov dword [esi + 0x1660], edx
cmp byte [esp + 0x27], 0
je 0x470fcf
or dword [esi + 0x161c], 0x80
lea ebx, [esi + 0x15ec]
push 0x213c
push ebx
call fcn.00418b70
push 0x10000
mov dword [esi + 0x3728], eax
mov eax, dword [esp + 0x18]
push 0
push eax
call fcn.004b0a70
mov eax, dword [esp + 0x4c]
add esp, 0x14
cmp eax, 0x12
mov dword [esp + 0x6c], 5
je 0x470f42
cmp eax, 0x41
je 0x470f42
cmp eax, 0x42
je 0x470f42
cmp eax, 0x43
je 0x470f42
push eax
call fcn.0043e0f0
add esp, 4
test al, al
jne 0x470f42
mov ecx, dword [esp + 0xc]
push 0x2140
push ebx
push ecx
call fcn.004b31c0
jmp 0x470f60
mov edx, dword [esp + 0xc]
push 0x2140
add edx, 0xd800
push ebx
push edx
call fcn.004b31c0
mov dword [esp + 0x78], 0x20
mov ebx, dword [esp + 0x38]
add esp, 0xc
jmp 0x470f70
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x6c]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push 0x800
push edx
push edi
push eax
push ebx
call fcn.0046e5b0
add esp, 0x1c
cmp eax, 1
je 0x470fd3
call fcn.004184d0
and eax, 0xffffff00
cmp eax, 0x20400
jne 0x470fb3
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x470f70
mov ecx, dword [esp + 0x18]
push ecx
push ebx
call fcn.0046ded0
add esp, 8
mov dword [esi + 0x10], 4
push 0
jmp 0x4709ae
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x18]
push 0
push 0
push 0
push 0
push edi
push ebx
call fcn.00419980
mov eax, dword [esi + 0x1650]
add esp, 0x18
cmp eax, 0x30
jl 0x471014
cmp eax, 0x32
jg 0x471014
push 1
push 1
push edi
push ebx
call fcn.00419d50
push 0
push 6
push edi
push ebx
call fcn.00419d50
add esp, 0x20
jmp 0x471052
cmp dword [esi + 0x4b4], 1
je 0x471022
cmp eax, 0x10
jl 0x471052
push 1
push 1
push edi
push ebx
call fcn.00419d50
add esp, 0x10
cmp dword [esp + 0x38], 0x1b
je 0x471044
cmp dword [esp + 0x38], 0x2b
je 0x471044
push 1
push 2
jmp 0x471048
push 0
push 5
push edi
push ebx
call fcn.00419d50
add esp, 0x10
push edi
push ebx
mov dword [esi + 0x10], 3
call fcn.0046ded0
add esp, 8
cmp byte [esp + 0x17], 0
push 0
je 0x47107c
mov ecx, dword [esi + 0xc]
push 0x80
push 0x40c
push ecx
jmp 0x471087
mov edx, dword [esi + 0xc]
push 1
push 0x40c
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x64a48c]
push eax
call fcn.004b253e
mov ecx, dword [esp + 0x24]
push ecx
call fcn.004b253e
mov edx, dword [esp + 0x14]
push edx
call fcn.004b253e
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 0xc
mov dword [esp + 0x634], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4710da
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x62c]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret