Function at 0x4c5ce4
Capabilities:
Create process on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x19
push 0
push 0
dec ecx
jne 0x4c5ced
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [0x4d0304]
xor eax, eax
push ebp
push 0x4c6e0e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp bl, 1
je 0x4c6dc9
cmp bl, 2
je 0x4c6dc9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x22c]
cmp eax, 0x5dc
jbe 0x4c5d41
call fcn.00403950
imul edi, eax, 0xa
jno 0x4c5d4b
call fcn.00403958
mov eax, dword [0x4d0058]
cmp dword [eax + edi*8], 0
jne 0x4c5d81
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x22c]
cmp eax, 0x5dc
jbe 0x4c5d71
call fcn.00403950
mov eax, dword [0x4d0058]
cmp dword [eax + edi*8 + 0x4c], 0
je 0x4c6dc9
mov eax, dword [0x510680]
mov edx, 0x4c6e28
call fcn.00404c04
jne 0x4c6dc9
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x2f0]
cmp word [ebx + 0x78], 0xffeb
jne 0x4c5f62
mov eax, dword [0x4d0210]
cmp dword [eax], 0
jle 0x4c5eb7
mov eax, dword [ebx + 0x22c]
cmp eax, 0x5dc
jbe 0x4c5dca
call fcn.00403950
imul eax, eax, 0xa
jno 0x4c5dd4
call fcn.00403958
mov edx, dword [0x4d0058]
mov eax, dword [edx + eax*8 + 0x14]
lea edx, [ebp - 0x20]
call fcn.004a12c8
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xc]
call fcn.004a0808
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x22c]
cmp eax, 0x5dc
jbe 0x4c5e0c
call fcn.00403950
imul eax, eax, 0xa
jno 0x4c5e16
call fcn.00403958
mov edx, dword [0x4d0058]
mov eax, dword [edx + eax*8 + 0x1c]
lea edx, [ebp - 0x24]
call fcn.004a12c8
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x10]
call fcn.004a0808
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x22c]
cmp eax, 0x5dc
jbe 0x4c5e4e
call fcn.00403950
imul eax, eax, 0xa
jno 0x4c5e58
call fcn.00403958
mov edx, dword [0x4d0058]
mov eax, dword [edx + eax*8 + 4]
lea edx, [ebp - 0x14]
call fcn.004a12c8
cmp dword [ebp - 0x14], 0
je 0x4c5eb7
mov eax, dword [ebp - 0x14]
call fcn.00404ac0
mov edx, dword [ebp - 0x14]
dec eax
test edx, edx
je 0x4c5e85
cmp eax, dword [edx - 4]
jb 0x4c5e8a
call fcn.00403950
inc eax
cmp byte [edx + eax - 1], 0x2a
jne 0x4c5eb7
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404ac0
mov ecx, eax
sub ecx, 1
jno 0x4c5eaa
call fcn.00403958
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.00404d18
push 0x4c6e34
push dword [ebp - 0xc]
push 0x4c6e64
push dword [ebp - 0x10]
push 0x4c6e74
push dword [ebp - 0x14]
push 0x4c6e84
call fcn.0040a924
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x56c]
mov eax, dword [eax + 0x228]
call fcn.00499e3c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x28]
mov eax, 0x4c6e94
call fcn.0040b54c
push dword [ebp - 0x28]
push 0x4c6ea8
call fcn.0040a924
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x2c]
mov eax, 0x4c6eb8
call fcn.0040b54c
push dword [ebp - 0x2c]
push 0x4c6ec8
lea eax, [ebp - 0x18]
mov edx, 0xb
call fcn.00404b80
push 1
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00404cb8
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.0044f244
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4c6dc9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x22c]
cmp eax, 0x5dc
jbe 0x4c5f7d
call fcn.00403950
imul ebx, eax, 0xa
jno 0x4c5f87
call fcn.00403958
mov eax, dword [0x4d0058]
cmp dword [eax + ebx*8], 0
je 0x4c6ab5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x22c]
cmp eax, 0x5dc
jbe 0x4c5fb1
call fcn.00403950
mov eax, dword [0x4d0058]
cmp dword [eax + ebx*8 + 0x4c], 0
jne 0x4c6ab5
xor eax, eax
push ebp
push 0x4c6aae
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4c6a91
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004a117c
mov byte [ebp - 5], 0
call fcn.004a809c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x22c]
cmp eax, 0x5dc
jbe 0x4c6006
call fcn.00403950
imul eax, eax, 0xa
jno 0x4c6010
call fcn.00403958
mov edx, dword [0x4d0058]
mov eax, dword [edx + eax*8]
call fcn.00408f70
mov ebx, eax
mov dword [0x4cff04], ebx
mov eax, ebx
call fcn.004a7984
mov edx, dword [0x4cff8c]
mov dword [edx], eax
mov eax, dword [0x4cff8c]
mov eax, dword [eax]
test eax, eax
jl 0x4c6144
inc eax
mov dword [ebp - 0x1c], eax
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x22c]
cmp eax, 0x5dc
jbe 0x4c6065
call fcn.00403950
imul eax, eax, 0xa
jno 0x4c606f
call fcn.00403958
mov edx, dword [0x4d0058]
mov eax, dword [edx + eax*8 + 0x14]
lea edx, [ebp - 0x30]
call fcn.004a12c8
mov eax, dword [ebp - 0x30]
cmp ebx, 0xff
jbe 0x4c6091
call fcn.00403950
imul edi, ebx, 0xb
jno 0x4c609b
call fcn.00403958
mov edx, dword [esi + edi*4]
call fcn.00404c04
jne 0x4c60ab
mov byte [ebp - 5], 1
jmp 0x4c6119
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x22c]
cmp eax, 0x5dc
jbe 0x4c60c6
call fcn.00403950
imul eax, eax, 0xa
jno 0x4c60d0
call fcn.00403958
mov edx, dword [0x4d0058]
mov eax, dword [edx + eax*8 + 0x1c]
lea edx, [ebp - 0x34]
call fcn.004a12c8
mov eax, dword [ebp - 0x34]
cmp ebx, 0xff
jbe 0x4c60f2
call fcn.00403950
mov edx, dword [esi + edi*4]
call fcn.00404c04
jne 0x4c6119
cmp ebx, 0xff
jbe 0x4c6109
call fcn.00403950
lea eax, [esi + edi*4 + 0x18]
mov edx, 0x4c6ee0
call fcn.0040485c
jmp 0x4c6144
cmp byte [ebp - 5], 0
je 0x4c613a
cmp ebx, 0xff
jbe 0x4c612c
call fcn.00403950
lea eax, [esi + edi*4 + 0x18]
mov edx, 0x4c6ee0
call fcn.0040485c
inc ebx
dec dword [ebp - 0x1c]
jne 0x4c604a
mov edi, 1
mov eax, dword [0x4cff8c]
mov eax, dword [eax]
test eax, eax
jl 0x4c62aa
inc eax
mov dword [ebp - 0x1c], eax
xor ebx, ebx
cmp edi, 1
jne 0x4c618a
cmp ebx, 0xff
jbe 0x4c6170
call fcn.00403950
imul eax, ebx, 0xb
jno 0x4c617a
call fcn.00403958
lea eax, [esi + eax*4 + 0x14]
mov edx, 0x4c6eec
call fcn.0040485c
jmp 0x4c61c6
push 0x4c6efc
lea edx, [ebp - 0x38]
mov eax, edi
call fcn.00408ed0
push dword [ebp - 0x38]
push 0x4c6f08
cmp ebx, 0xff
jbe 0x4c61ae
call fcn.00403950
imul eax, ebx, 0xb
jno 0x4c61b8
call fcn.00403958
lea eax, [esi + eax*4 + 0x14]
mov edx, 3
call fcn.00404b80
mov eax, ebx
add eax, 1
jno 0x4c61d2
call fcn.00403958
cmp eax, 0xff
jbe 0x4c61de
call fcn.00403950
imul eax, eax, 0xb
jno 0x4c61e8
call fcn.00403958
mov eax, dword [esi + eax*4 + 8]
mov edx, 0x4c6f14
call fcn.00404c04
jne 0x4c624d
cmp ebx, 0xff
jbe 0x4c6205
call fcn.00403950
imul eax, ebx, 0xb
jno 0x4c620f
call fcn.00403958
mov eax, dword [esi + eax*4 + 8]
mov edx, ebx
add edx, 1
jno 0x4c621f
call fcn.00403958
cmp edx, 0xff
jbe 0x4c622c
call fcn.00403950
imul edx, edx, 0xb
jno 0x4c6236
call fcn.00403958
mov edx, dword [esi + edx*4 + 4]
call fcn.00404c04
jbe 0x4c62a0
add edi, 1
jno 0x4c624b
call fcn.00403958
jmp 0x4c62a0
cmp ebx, 0xff
jbe 0x4c625a
call fcn.00403950
imul eax, ebx, 0xb
jno 0x4c6264
call fcn.00403958
mov eax, dword [esi + eax*4 + 8]
mov edx, ebx
add edx, 1
jno 0x4c6274
call fcn.00403958
cmp edx, 0xff
jbe 0x4c6281
call fcn.00403950
imul edx, edx, 0xb
jno 0x4c628b
call fcn.00403958
mov edx, dword [esi + edx*4 + 8]
call fcn.00404c04
jbe 0x4c62a0
add edi, 1
jno 0x4c62a0
call fcn.00403958
inc ebx
dec dword [ebp - 0x1c]
jne 0x4c615e
mov eax, dword [0x4d012c]
cmp dword [eax], 0
jne 0x4c62cc
mov ecx, dword [0x4d012c]
mov eax, dword [0x4d0268]
mov eax, dword [eax]
mov edx, dword [0x4ab7bc]
call fcn.00468fa0
mov eax, dword [0x4d012c]
mov eax, dword [eax]
call fcn.00465aa4
mov eax, dword [0x4cff8c]
cmp dword [eax], 0x12
jge 0x4c62fb
mov eax, dword [0x4d012c]
mov eax, dword [eax]
mov eax, dword [eax + 0x308]
mov edx, 0x12
call fcn.00473fc0
jmp 0x4c631f
mov edx, dword [0x4cff8c]
mov edx, dword [edx]
add edx, 1
jno 0x4c630d
call fcn.00403958
mov eax, dword [0x4d012c]
mov eax, dword [eax]
mov eax, dword [eax + 0x308]
call fcn.00473fc0
mov eax, dword [0x4d012c]
mov eax, dword [eax]
mov eax, dword [eax + 0x308]
xor edx, edx
call fcn.004740c4
push 0x4c6f20
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [0x4cff8c]
mov ecx, dword [ecx]
xor edx, edx
xor eax, eax
call fcn.004a80cc
push dword [ebp - 0x40]
push 0x4c6f30
lea edx, [ebp - 0x44]
mov eax, dword [0x4cff8c]
mov eax, dword [eax]
add eax, 1
jno 0x4c6369
call fcn.00403958
call fcn.00408ed0
push dword [ebp - 0x44]
push 0x4c6f3c
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.00404b80
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x4d012c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2fc]
call fcn.00448b74
push 0x4c6f20
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x22c]
cmp eax, 0x5dc
jbe 0x4c63bc
call fcn.00403950
imul eax, eax, 0xa
jno 0x4c63c6
call fcn.00403958
mov edx, dword [0x4d0058]
mov eax, dword [edx + eax*8 + 0x1c]
lea edx, [ebp - 0x4c]
call fcn.004a12c8
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x22c]
cmp eax, 0x5dc
jbe 0x4c63f7
call fcn.00403950
imul eax, eax, 0xa
jno 0x4c6401
call fcn.00403958
mov edx, dword [0x4d0058]
mov eax, dword [edx + eax*8 + 0x14]
lea edx, [ebp - 0x50]
call fcn.004a12c8
mov eax, dword [ebp - 0x50]
mov ecx, dword [0x4cff8c]
mov ecx, dword [ecx]
pop edx
call fcn.004a80cc
mov edx, dword [ebp - 0x48]
mov eax, dword [0x4d012c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f8]
call fcn.00448b74
lea eax, [esi + 0x1c]
mov edx, 0x4c6f48
call fcn.0040485c
lea eax, [esi + 0x10]
mov edx, 0x4c6f14
call fcn.0040485c
lea eax, [esi + 0x20]
mov edx, 0x4c6f14
call fcn.0040485c
lea eax, [esi + 0x28]
mov edx, 0x4c6f14
call fcn.0040485c
lea eax, [esi + 0x24]
mov edx, 0x4c6f14
call fcn.0040485c
lea eax, [esi + 0x48]
mov edx, 0x4c6f54
call fcn.0040485c
lea eax, [ebp - 0x54]
push eax
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x30]
call fcn.004a842c
mov ecx, 0x3c
cdq
idiv ecx
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x30]
call fcn.004a842c
mov ecx, 0x3c
cdq
idiv ecx
mov dword [ebp - 0x5c], edx
mov byte [ebp - 0x58], 0
lea edx, [ebp - 0x64]
mov ecx, 1
mov eax, 0x4c6f60
call fcn.00409cb0
mov edx, dword [ebp - 0x54]
lea eax, [esi + 0x3c]
call fcn.0040485c
lea eax, [esi + 0x54]
mov edx, dword [esi + 0x38]
call fcn.0040485c
lea eax, [ebp - 0x68]
push eax
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x30]
call fcn.004a842c
mov ecx, 0x3c
cdq
idiv ecx
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x30]
call fcn.004a842c
mov ecx, 0x3c
cdq
idiv ecx
mov dword [ebp - 0x5c], edx
mov byte [ebp - 0x58], 0
lea edx, [ebp - 0x64]
mov ecx, 1
mov eax, 0x4c6f60
call fcn.00409cb0
mov edx, dword [ebp - 0x68]
lea eax, [esi + 0x50]
call fcn.0040485c
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [esi + 0x54]
call fcn.00408f70
mov dword [ebp - 0x78], eax
fild dword [ebp - 0x78]
fstp xword [ebp - 0x84]
wait
mov eax, dword [esi + 0x50]
call fcn.004a857c
mov dword [ebp - 0x88], eax
fild dword [ebp - 0x88]
fld xword [ebp - 0x84]
fdivrp st(1)
fmul dword [0x4c6f6c]
fstp xword [ebp - 0x94]
wait
lea eax, [ebp - 0x94]
mov dword [ebp - 0x74], eax
mov byte [ebp - 0x70], 3
lea edx, [ebp - 0x74]
xor ecx, ecx
mov eax, 0x4c6f78
call fcn.00409cb0
mov edx, dword [ebp - 0x6c]
lea eax, [esi + 0x4c]
call fcn.0040485c
mov eax, dword [0x4cff8c]
mov eax, dword [eax]
sub eax, 2
jl 0x4c6918
inc eax
mov dword [ebp - 0x1c], eax
mov ebx, 2
lea eax, [ebp - 0x98]
push eax
mov eax, ebx
sub eax, 1
jno 0x4c65d1
call fcn.00403958
cmp eax, 0xff
jbe 0x4c65dd
call fcn.00403950
imul eax, eax, 0xb
jno 0x4c65e7
call fcn.00403958
mov eax, dword [esi + eax*4 + 0x10]
call fcn.004a857c
push eax
mov eax, ebx
sub eax, 1
jno 0x4c65fd
call fcn.00403958
cmp eax, 0xff
jbe 0x4c6609
call fcn.00403950
imul eax, eax, 0xb
jno 0x4c6613
call fcn.00403958
mov edx, dword [esi + eax*4 + 4]
cmp ebx, 0xff
jbe 0x4c6624
call fcn.00403950
imul edi, ebx, 0xb
jno 0x4c662e
call fcn.00403958
mov eax, dword [esi + edi*4 + 4]
call fcn.004a842c
mov edx, eax
pop eax
add eax, edx
jno 0x4c6643
call fcn.00403958
mov ecx, 0x3c
cdq
idiv ecx
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0
mov eax, ebx
sub eax, 1
jno 0x4c665e
call fcn.00403958
cmp eax, 0xff
jbe 0x4c666a
call fcn.00403950
imul eax, eax, 0xb
jno 0x4c6674
call fcn.00403958
mov eax, dword [esi + eax*4 + 0x10]
call fcn.004a857c
push eax
mov eax, ebx
sub eax, 1
jno 0x4c668a
call fcn.00403958
cmp eax, 0xff
jbe 0x4c6696
call fcn.00403950
imul eax, eax, 0xb
jno 0x4c66a0
call fcn.00403958
mov edx, dword [esi + eax*4 + 4]
cmp ebx, 0xff
jbe 0x4c66b1
call fcn.00403950
mov eax, dword [esi + edi*4 + 4]
call fcn.004a842c
mov edx, eax
pop eax
add eax, edx
jno 0x4c66c6
call fcn.00403958
mov ecx, 0x3c
cdq
idiv ecx
mov dword [ebp - 0x5c], edx
mov byte [ebp - 0x58], 0
lea edx, [ebp - 0x64]
mov ecx, 1
mov eax, 0x4c6f60
call fcn.00409cb0
mov edx, dword [ebp - 0x98]
cmp ebx, 0xff
jbe 0x4c66fa
call fcn.00403950
lea eax, [esi + edi*4 + 0x10]
call fcn.0040485c
lea edx, [ebp - 0x9c]
mov eax, ebx
add eax, 1
jno 0x4c6715
call fcn.00403958
call fcn.00408ed0
mov edx, dword [ebp - 0x9c]
cmp ebx, 0xff
jbe 0x4c672d
call fcn.00403950
lea eax, [esi + edi*4 + 0x1c]
call fcn.0040485c
cmp ebx, 0xff
jbe 0x4c6743
call fcn.00403950
mov eax, dword [esi + edi*4 + 0xc]
call fcn.00408f70
push eax
mov eax, ebx
sub eax, 1
jno 0x4c6759
call fcn.00403958
cmp eax, 0xff
jbe 0x4c6765
call fcn.00403950
imul eax, eax, 0xb
jno 0x4c676f
call fcn.00403958
mov eax, dword [esi + eax*4 + 0xc]
call fcn.00408f70
pop edx
xchg edx, eax
sub eax, edx
jno 0x4c6783
call fcn.00403958
lea edx, [ebp - 0xa0]
call fcn.00408ed0
mov edx, dword [ebp - 0xa0]
cmp ebx, 0xff
jbe 0x4c67a1
call fcn.00403950
lea eax, [esi + edi*4 + 0x28]
call fcn.0040485c
lea eax, [ebp - 0xa4]
push eax
mov eax, ebx
sub eax, 1
jno 0x4c67bd
call fcn.00403958
cmp eax, 0xff
jbe 0x4c67c9
call fcn.00403950
imul eax, eax, 0xb
jno 0x4c67d3
call fcn.00403958
mov edx, dword [esi + eax*4 + 8]
cmp ebx, 0xff
jbe 0x4c67e4
call fcn.00403950
mov eax, dword [esi + edi*4 + 4]
call fcn.004a842c
mov ecx, 0x3c
cdq
idiv ecx
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0
mov eax, ebx
sub eax, 1
jno 0x4c6808
call fcn.00403958
cmp eax, 0xff
jbe 0x4c6814
call fcn.00403950
imul eax, eax, 0xb
jno 0x4c681e
call fcn.00403958
mov edx, dword [esi + eax*4 + 8]
cmp ebx, 0xff
jbe 0x4c682f
call fcn.00403950
mov eax, dword [esi + edi*4 + 4]
call fcn.004a842c
mov ecx, 0x3c
cdq
idiv ecx
mov dword [ebp - 0x5c], edx
mov byte [ebp - 0x58], 0
lea edx, [ebp - 0x64]
mov ecx, 1
mov eax, 0x4c6f60
call fcn.00409cb0
mov edx, dword [ebp - 0xa4]
cmp ebx, 0xff
jbe 0x4c686c
call fcn.00403950
lea eax, [esi + edi*4 + 0x24]
call fcn.0040485c
lea eax, [ebp - 0xa8]
push eax
cmp ebx, 0xff
jbe 0x4c6889
call fcn.00403950
mov eax, dword [esi + edi*4 + 0x28]
call fcn.00408f70
mov dword [ebp - 0x78], eax
fild dword [ebp - 0x78]
fstp xword [ebp - 0x84]
wait
cmp ebx, 0xff
jbe 0x4c68ac
call fcn.00403950
mov eax, dword [esi + edi*4 + 0x24]
call fcn.004a857c
mov dword [ebp - 0x88], eax
fild dword [ebp - 0x88]
fld xword [ebp - 0x84]
fdivrp st(1)
fmul dword [0x4c6f6c]
fstp xword [ebp - 0x94]
wait
lea eax, [ebp - 0x94]
mov dword [ebp - 0x74], eax
mov byte [ebp - 0x70], 3
lea edx, [ebp - 0x74]
xor ecx, ecx
mov eax, 0x4c6f78
call fcn.00409cb0
mov edx, dword [ebp - 0xa8]
cmp ebx, 0xff
jbe 0x4c6905
call fcn.00403950
lea eax, [esi + edi*4 + 0x20]
call fcn.0040485c
inc ebx
dec dword [ebp - 0x1c]
jne 0x4c65be
push 0x4c6f88
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x22c]
cmp eax, 0x5dc
jbe 0x4c6938
call fcn.00403950
imul eax, eax, 0xa
jno 0x4c6942
call fcn.00403958
mov edx, dword [0x4d0058]
mov eax, dword [edx + eax*8 + 4]
lea edx, [ebp - 0xb0]
call fcn.004a12c8
push dword [ebp - 0xb0]
push 0x4c6f98
mov eax, dword [0x4cff8c]
mov eax, dword [eax]
cmp eax, 0xff
jbe 0x4c6975
call fcn.00403950
imul ebx, eax, 0xb
jno 0x4c697f
call fcn.00403958
push dword [esi + ebx*4 + 0xc]
push 0x4c6fa8
lea eax, [ebp - 0xb4]
push eax
mov eax, dword [0x4cff8c]
mov eax, dword [eax]
cmp eax, 0xff
jbe 0x4c69a2
call fcn.00403950
mov eax, dword [esi + ebx*4 + 0xc]
call fcn.00408f70
mov dword [ebp - 0x78], eax
fild dword [ebp - 0x78]
fstp xword [ebp - 0x84]
wait
mov eax, dword [0x4cff8c]
mov eax, dword [eax]
cmp eax, 0xff
jbe 0x4c69cb
call fcn.00403950
imul eax, eax, 0xb
jno 0x4c69d5
call fcn.00403958
mov eax, dword [esi + eax*4 + 0x10]
call fcn.004a857c
mov dword [ebp - 0x88], eax
fild dword [ebp - 0x88]
fld xword [ebp - 0x84]
fdivrp st(1)
fmul dword [0x4c6f6c]
fstp xword [ebp - 0x94]
wait
lea eax, [ebp - 0x94]
mov dword [ebp - 0x74], eax
mov byte [ebp - 0x70], 3
lea edx, [ebp - 0x74]
xor ecx, ecx
mov eax, 0x4c6fc0
call fcn.00409cb0
push dword [ebp - 0xb4]
lea eax, [ebp - 0xac]
mov edx, 6
call fcn.00404b80
mov edx, dword [ebp - 0xac]
mov eax, dword [0x4d012c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30c]
call fcn.00448b74
call fcn.004a1378
mov eax, dword [0x4d012c]
mov eax, dword [eax]
mov eax, dword [eax + 0x308]
call fcn.004490b8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x56c]
call fcn.004490b8
mov eax, dword [0x4d012c]
mov eax, dword [eax]
cmp byte [eax + 0x57], 0
jne 0x4c6a87
mov eax, dword [0x4d012c]
mov eax, dword [eax]
call fcn.00465aa4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c6a9b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6dc9
call fcn.004a10c4
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x22c]
cmp eax, 0x5dc
jbe 0x4c6ad0
call fcn.00403950
mov eax, dword [0x4d0058]
cmp dword [eax + ebx*8 + 0x4c], 0
je 0x4c6dc9
push 0x4c6fd4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x22c]
cmp eax, 0x5dc
jbe 0x4c6b00
call fcn.00403950
mov eax, dword [0x4d0058]
mov eax, dword [eax + ebx*8 + 0x4c]
lea edx, [ebp - 0xbc]
call fcn.004a12c8
push dword [ebp - 0xbc]
push 0x4c700c
call fcn.0040a924
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x56c]
mov eax, dword [eax + 0x228]
call fcn.00499e3c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xc0]
mov eax, 0x4c7024
call fcn.0040b54c
push dword [ebp - 0xc0]
lea eax, [ebp - 0xb8]
mov edx, 4
call fcn.00404b80
mov eax, dword [ebp - 0xb8]
call fcn.004b8638
mov edx, dword [0x4cff8c]
mov dword [edx], eax
mov eax, dword [0x4cff8c]
mov eax, dword [eax]
test eax, eax
jl 0x4c6c9a
inc eax
mov dword [ebp - 0x1c], eax
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x22c]
cmp eax, 0x5dc
jbe 0x4c6baf
call fcn.00403950
imul eax, eax, 0xa
jno 0x4c6bb9
call fcn.00403958
mov edx, dword [0x4d0058]
mov eax, dword [edx + eax*8 + 0x14]
lea edx, [ebp - 0xc4]
call fcn.004a12c8
mov eax, dword [ebp - 0xc4]
cmp ebx, 0xff
jbe 0x4c6be1
call fcn.00403950
imul edi, ebx, 0xb
jno 0x4c6beb
call fcn.00403958
mov edx, dword [esi + edi*4]
call fcn.00404c04
jne 0x4c6bfb
mov byte [ebp - 5], 1
jmp 0x4c6c6f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x22c]
cmp eax, 0x5dc
jbe 0x4c6c16
call fcn.00403950
imul eax, eax, 0xa
jno 0x4c6c20
call fcn.00403958
mov edx, dword [0x4d0058]
mov eax, dword [edx + eax*8 + 0x1c]
lea edx, [ebp - 0xc8]
call fcn.004a12c8
mov eax, dword [ebp - 0xc8]
cmp ebx, 0xff
jbe 0x4c6c48
call fcn.00403950
mov edx, dword [esi + edi*4]
call fcn.00404c04
jne 0x4c6c6f
cmp ebx, 0xff
jbe 0x4c6c5f
call fcn.00403950
lea eax, [esi + edi*4 + 0x18]
mov edx, 0x4c6ee0
call fcn.0040485c
jmp 0x4c6c9a
cmp byte [ebp - 5], 0
je 0x4c6c90
cmp ebx, 0xff
jbe 0x4c6c82
call fcn.00403950
lea eax, [esi + edi*4 + 0x18]
mov edx, 0x4c6ee0
call fcn.0040485c
inc ebx
dec dword [ebp - 0x1c]
jne 0x4c6b94
call fcn.004a1378
mov eax, dword [0x4d012c]
cmp dword [eax], 0
jne 0x4c6cc1
mov ecx, dword [0x4d012c]
mov eax, dword [0x4d0268]
mov eax, dword [eax]
mov edx, dword [0x4ab7bc]
call fcn.00468fa0
mov eax, dword [0x4d012c]
mov eax, dword [eax]
call fcn.00465aa4
mov eax, dword [0x4cff8c]
cmp dword [eax], 0x12
jge 0x4c6cf0
mov eax, dword [0x4d012c]
mov eax, dword [eax]
mov eax, dword [eax + 0x308]
mov edx, 0x12
call fcn.00473fc0
jmp 0x4c6d14
mov edx, dword [0x4cff8c]
mov edx, dword [edx]
add edx, 1
jno 0x4c6d02
call fcn.00403958
mov eax, dword [0x4d012c]
mov eax, dword [eax]
mov eax, dword [eax + 0x308]
call fcn.00473fc0
mov eax, dword [0x4d012c]
mov eax, dword [eax]
mov eax, dword [eax + 0x308]
xor edx, edx
call fcn.004740c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov eax, dword [eax + 0x22c]
cmp eax, 0x5dc
jbe 0x4c6d43
call fcn.00403950
imul eax, eax, 0xa
jno 0x4c6d4d
call fcn.00403958
mov edx, dword [0x4d0058]
mov eax, dword [edx + eax*8 + 4]
lea edx, [ebp - 0xd0]
call fcn.004a12c8
mov ecx, dword [ebp - 0xd0]
lea eax, [ebp - 0xcc]
mov edx, 0x4c6f88
call fcn.00404b0c
mov edx, dword [ebp - 0xcc]
mov eax, dword [0x4d012c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30c]
call fcn.00448b74
mov eax, dword [0x4d012c]
mov eax, dword [eax]
mov eax, dword [eax + 0x308]
call fcn.004490b8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x56c]
call fcn.004490b8
mov eax, dword [0x4d012c]
mov eax, dword [eax]
cmp byte [eax + 0x57], 0
jne 0x4c6dc9
mov eax, dword [0x4d012c]
mov eax, dword [eax]
call fcn.00465aa4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6e15
lea eax, [ebp - 0xd0]
mov edx, 0xf
call fcn.0040482c
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.0040482c
lea eax, [ebp - 0x54]
mov edx, 0xe
call fcn.0040482c
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.0040482c
ret