Function at 0x4fad80
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push ecx
push esi
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
call 0x4fad80
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffd2
jne 0x42f662
mov ecx, 0x6fb1bc
call fcn.0042eb90
mov ecx, eax
call fcn.0045c1e0
test eax, eax
jne 0x42f660
push 4
call fcn.005247b1
push 0
mov esi, eax
push 0x80000
push 0x8000
mov dword [esp + 0x14], esi
call fcn.00518fc0
add esp, 0x10
mov dword [esi], eax
mov ecx, 0x6fb1bc
call fcn.0042eb90
push esi
mov ecx, eax
call fcn.0045c260
pop esi
add esp, 4
jmp 0x4fad80
mov eax, esi
pop esi
pop ecx
ret
sub esp, 0x164
mov eax, dword [0x6f9540]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [esp + 0x180]
mov edx, dword [esp + 0x190]
mov eax, dword [esp + 0x18c]
mov ebp, dword [esp + 0x17c]
xor ebx, ebx
mov esi, dword [esp + 0x178]
mov dword [esp + 0x28], ecx
xor ecx, ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x58], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x60], 0
mov edi, dword [esp + 0x184]
mov dword [esp + 0x34], edi
test ebp, ebp
jne 0x4fae22
test ecx, ecx
mov eax, 0x591868
cmovne eax, ebp
mov ebp, eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
test dword [esp + 0x188], 0x1fff9fc0
jne 0x4fc149
test esi, esi
je 0x4fc142
test ebp, ebp
je 0x4fc142
test eax, eax
je 0x4fc142
lea esi, [edi*2]
add esi, ebp
mov dword [esp + 0x2c], esi
lea eax, [esi - 2]
mov dword [esp + 0x68], eax
cmp ecx, 0xffffffff
jne 0x4fae7f
push ebp
call fcn.0051e2e0
mov edx, dword [esp + 0x40]
mov ecx, eax
add esp, 4
mov dword [esp + 0x28], ecx
mov dword [esp + 0x60], 1
lea eax, [ecx*2]
add eax, ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0x5c], eax
cmp edi, ecx
jbe 0x4fae9e
mov eax, 0xffffffdf
jmp 0x4fc14e
mov ebp, dword [esp + 0x24]
cmp dword [ebp + 0x38], 0x50435245
je 0x4faeb5
mov eax, 0xffffffe1
jmp 0x4fc14e
mov ecx, dword [ebp + 0x48]
mov eax, ecx
and al, 7
cmp al, 2
je 0x4faeca
mov eax, 0xffffffe0
jmp 0x4fc14e
mov eax, dword [esp + 0x188]
shr ecx, 0xe
and ecx, 0xc
or eax, ecx
mov dword [esp + 0x188], eax
cmp dword [ebp + 0x10], ebx
je 0x4faef3
test eax, 0xbfffbfc0
jne 0x4faef3
mov edi, 1
jmp 0x4faef5
xor edi, edi
mov ecx, dword [ebp + 0x40]
mov eax, ecx
shr eax, 0x13
and eax, 1
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x188]
test al, 0x20
je 0x4faf1a
mov eax, 2
jmp 0x4faf20
shr eax, 4
and eax, 1
movzx eax, ax
mov word [esp + 0x108], ax
test ax, ax
je 0x4faf44
mov eax, ecx
or eax, dword [esp + 0x188]
test eax, 0x20000000
jne 0x4fc149
test edx, edx
je 0x4faf60
cmp dword [edx + 0x24], 0xffffffff
je 0x4faf60
test ecx, 0x800000
jne 0x4faf60
mov eax, 0xffffffc8
jmp 0x4fc14e
mov edx, dword [esp + 0x20]
test byte [edx + 0x2d], 1
je 0x4faf84
push dword [edx + 8]
mov eax, dword [edx + 4]
push dword [edx + 0x10]
call eax
mov edx, dword [esp + 0x28]
add esp, 8
mov ecx, dword [esp + 0x1c]
and byte [edx + 0x2d], 0xfe
mov dword [edx + 0x10], ebx
lea ebp, [edx + 0x28]
mov dword [ebp], ebx
mov dword [esp + 0x48], 0xfc00
mov dword [esp + 0x4c], 0xdc00
test edi, edi
je 0x4fb0e6
cmp dword [esp + 0x18], ebx
je 0x4fb06a
test dword [esp + 0x188], 0x40000000
jne 0x4fb06a
test ecx, 0x4000000
jne 0x4fb06a
mov ebx, 0xfc00
mov edi, 0xdc00
cmp esi, dword [esp + 0x10]
jae 0x4faffa
mov ax, word [esi]
and ax, bx
cmp ax, di
jne 0x4faffa
xor eax, eax
cmp eax, dword [esp + 0x34]
sbb eax, eax
and eax, 0xfffffff6
add eax, 0xffffffe6
jmp 0x4fc14e
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
movzx ecx, word [eax + 0x64]
test ecx, ecx
je 0x4fb03b
nop word [eax + eax]
cmp esi, edx
jbe 0x4fb037
sub esi, 2
cmp esi, edx
jbe 0x4fb032
nop dword [eax + eax]
mov ax, word [esi]
and ax, bx
cmp ax, di
jne 0x4fb032
sub esi, 2
cmp esi, edx
ja 0x4fb020
sub ecx, 1
jne 0x4fb010
mov dword [esp + 0x2c], esi
mov eax, dword [esp + 0x28]
mov edi, esi
sub edi, edx
sar edi, 1
push ebp
sub eax, edi
push eax
push esi
call fcn.005216e0
mov edx, dword [esp + 0x2c]
add esp, 0xc
mov dword [edx + 0x30], eax
test eax, eax
je 0x4fb065
add dword [edx + 0x28], edi
jmp 0x4fc14e
mov ebx, 1
push dword [esp + 0x3c]
push edx
push dword [esp + 0x190]
push dword [esp + 0x40]
push dword [esp + 0x38]
push dword [esp + 0x28]
push dword [esp + 0x3c]
call fcn.00518e00
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffd3
je 0x4fb0e6
test edi, edi
js 0x4fb0df
test dword [esp + 0x188], 0x4000
je 0x4fb0df
mov ecx, dword [esp + 0x60]
mov esi, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
lea esi, [esi + ecx]
push dword [ebx + 8]
mov eax, dword [ebx]
add esi, esi
push esi
call eax
add esp, 8
mov dword [ebx + 0x10], eax
test eax, eax
je 0x4fb56c
push esi
push dword [esp + 0x18]
push eax
call fcn.00526450
add esp, 0xc
or byte [ebx + 0x2d], 1
mov eax, edi
jmp 0x4fc14e
cmp dword [esp + 0x18], 0
mov edi, dword [esp + 0x14]
mov dword [esp + 0x11c], edi
je 0x4fb2b6
test ebx, ebx
jne 0x4fb2b6
test dword [esp + 0x188], 0x40000000
mov ebx, dword [esp + 0x1c]
je 0x4fb121
test ebx, 0x4000000
je 0x4fb2b6
mov edx, dword [esp + 0x10]
mov eax, ebx
xor ecx, ecx
and eax, 0x4000000
cmp esi, edx
jae 0x4fb17a
test eax, eax
je 0x4fb161
nop word [eax + eax]
mov ax, word [esi]
and ax, word [esp + 0x48]
cmp ax, word [esp + 0x4c]
jne 0x4fb17a
add esi, 2
mov ecx, 1
mov dword [esp + 0x2c], esi
cmp esi, edx
jb 0x4fb140
jmp 0x4fb17a
mov ax, word [esi]
mov edx, 0xfc00
and ax, dx
mov edx, 0xdc00
cmp ax, dx
je 0x4fafe7
mov edx, esi
mov dword [esp + 0x11c], edx
test ecx, ecx
jne 0x4fb1d2
mov eax, dword [esp + 0x24]
movzx ecx, word [eax + 0x64]
test ecx, ecx
je 0x4fb1d2
cmp edx, edi
jbe 0x4fb1d2
sub edx, 2
mov dword [esp + 0x11c], edx
cmp edx, edi
jbe 0x4fb1cd
nop word [eax + eax]
mov ax, word [edx]
and ax, word [esp + 0x48]
cmp ax, word [esp + 0x4c]
jne 0x4fb1cd
sub edx, 2
mov dword [esp + 0x11c], edx
cmp edx, edi
ja 0x4fb1b0
sub ecx, 1
jne 0x4fb193
mov eax, dword [esp + 0x28]
mov ecx, edx
sub ecx, edi
sar ecx, 1
push ebp
sub eax, ecx
push eax
push edx
call fcn.005216e0
mov edx, eax
add esp, 0xc
mov eax, dword [esp + 0x20]
mov dword [eax + 0x30], edx
test edx, edx
je 0x4fb2b6
lea edi, [eax + 0x28]
nop dword [eax]
mov ecx, dword [esp + 0x11c]
mov ebp, dword [esp + 0x14]
sub ecx, ebp
mov eax, dword [edi]
sar ecx, 1
add eax, ecx
mov dword [edi], eax
test ebx, 0x4000000
je 0x4fb2af
test edx, edx
jg 0x4fb2af
lea ebp, [ebp + eax*2]
mov dword [esp + 0x10], ebp
cmp ebp, esi
jae 0x4fb2a1
lea edx, [ebp + 2]
mov dword [esp + 0x11c], edx
cmp edx, esi
jae 0x4fb269
mov ecx, 0xfc00
mov ebp, 0xdc00
nop dword [eax]
mov ax, word [edx]
and ax, cx
cmp ax, bp
jne 0x4fb269
add edx, 2
mov dword [esp + 0x11c], edx
cmp edx, esi
jb 0x4fb250
mov eax, dword [esp + 0x28]
mov ecx, edx
sub ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x5c]
sar ecx, 1
push edi
sub eax, ecx
mov dword [esp + 0x14], ebp
push eax
push edx
call fcn.005216e0
mov edx, eax
add esp, 0xc
mov eax, dword [esp + 0x20]
mov dword [eax + 0x30], edx
test edx, edx
jne 0x4fb200
mov edi, dword [esp + 0x14]
jmp 0x4fb2ba
mov edi, dword [esp + 0x14]
mov dword [esp + 0x58], 2
jmp 0x4fb2ba
mov eax, edx
jmp 0x4fc14e
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x3c]
test ecx, ecx
jne 0x4fb2cf
mov eax, dword [esp + 0x24]
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
jmp 0x4fb2d6
movq xmm0, qword [ecx]
mov eax, dword [ecx + 8]
test ecx, ecx
mov dword [esp + 0xd4], eax
mov ebx, 0x69f508
movq qword [esp + 0xcc], xmm0
cmovne ebx, ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0x40]
mov eax, edx
or eax, dword [esp + 0x188]
mov ecx, dword [ecx + 0x48]
shr eax, 0x1f
mov dword [esp + 0x48], eax
mov eax, edx
shr eax, 8
and eax, 1
mov dword [esp + 0x70], eax
mov eax, ecx
shr eax, 9
and eax, 1
mov dword [esp + 0x4c], eax
mov eax, dword [ebx + 0x24]
cmp eax, 0xffffffff
jne 0x4fb330
mov eax, dword [esp + 0x5c]
jmp 0x4fb333
lea eax, [edi + eax*2]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x8c]
mov dword [esp + 0x164], eax
mov eax, ebp
mov ebp, dword [esp + 0x34]
sub eax, edi
sar eax, 1
mov dword [esp + 0xa8], eax
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x16c], eax
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x168], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x120], eax
mov eax, ecx
shr eax, 0xc
and eax, 1
mov dword [esp + 0x8c], 2
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0xa4], edi
mov dword [esp + 0xc8], 0
mov dword [esp + 0x118], edi
cmp word [eax + 0x64], 0
mov dword [esp + 0x100], ebp
ja 0x4fb3c6
test ecx, 0x2000
jne 0x4fb3c6
xor eax, eax
jmp 0x4fb3cb
mov eax, 1
mov dword [esp + 0xf0], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x148], edx
mov dword [esp + 0x150], 0
mov dword [esp + 0x134], 0
movzx edx, word [eax + 0x6e]
lea edi, [eax + 0x70]
movzx eax, word [eax + 0x6c]
mov word [esp + 0x10e], ax
imul eax, edx
mov dword [esp + 0x110], edi
mov dword [esp + 0x130], 0
mov word [esp + 0x10c], dx
mov dword [esp + 0x154], 0
lea eax, [edi + eax*2]
mov edi, dword [esp + 0x24]
mov dword [esp + 0x114], eax
mov ax, word [edi + 0x60]
mov word [esp + 0x10a], ax
movzx eax, word [edi + 0x62]
dec eax
cmp eax, 5
ja case.default.0x4fb456
jmp dword [eax*4 + 0x4fc168]
mov eax, 0xd
mov dword [esp + 0x158], 1
mov word [esp + 0x15c], ax
jmp 0x4fb4d8
mov eax, 0xa
mov dword [esp + 0x158], 1
mov word [esp + 0x15c], ax
jmp 0x4fb4d8
xor eax, eax
mov dword [esp + 0x158], 1
mov word [esp + 0x15c], ax
jmp 0x4fb4d8
mov dword [esp + 0x158], 2
mov dword [esp + 0x15c], 0xa000d
jmp 0x4fb4d8
mov dword [esp + 0x154], 1
jmp 0x4fb4d8
mov dword [esp + 0x154], 2
movzx eax, word [edi + 0x68]
mov edx, dword [ebx + 0x28]
mov ecx, dword [ebx + 0x2c]
lea eax, [eax*8 + 0x57]
and eax, 0xfffffffc
cmp edx, dword [edi + 0x4c]
mov dword [esp + 0x3c], eax
cmovae edx, dword [edi + 0x4c]
shl edx, 0xa
cmp ecx, dword [edi + 0x50]
mov dword [esp + 0xd8], edx
cmovae ecx, dword [edi + 0x50]
mov dword [esp + 0xdc], ecx
mov ecx, dword [ebx + 0x30]
cmp ecx, dword [edi + 0x54]
cmovae ecx, dword [edi + 0x54]
lea edi, [eax + eax*4]
add edi, edi
mov dword [esp + 0xe0], ecx
mov ecx, 0x5000
cmp edi, ecx
cmovb edi, ecx
cmp edi, edx
jbe 0x4fb543
cmp eax, edx
jbe 0x4fb541
mov eax, 0xffffffc1
jmp 0x4fc14e
mov edi, edx
mov ebx, dword [esp + 0x20]
cmp dword [ebx + 0x1c], edi
jae 0x4fb57d
push dword [ebx + 8]
mov eax, dword [ebx + 4]
push dword [ebx + 0x18]
call eax
push dword [ebx + 8]
mov eax, dword [ebx]
push edi
call eax
add esp, 0x10
mov dword [ebx + 0x18], eax
test eax, eax
jne 0x4fb576
mov dword [ebx + 0x1c], eax
mov eax, 0xffffffd0
jmp 0x4fc14e
mov eax, dword [esp + 0x3c]
mov dword [ebx + 0x1c], edi
add eax, 0xffffffac
push eax
mov eax, dword [ebx + 0x18]
add eax, 0x54
push 0xff
push eax
call fcn.00526b90
mov ecx, dword [esp + 0x30]
add esp, 0xc
mov dword [esp + 0x34], 0xff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x48]
mov dword [esp + 0xf4], eax
lea edi, [eax + 0x100]
add eax, 0x340
mov dword [esp + 0xf8], edi
mov dword [esp + 0xfc], eax
test dl, 0x10
je 0x4fb666
movzx ebx, word [ecx + 0x58]
movzx eax, bx
mov dword [esp + 0x54], 1
mov dword [esp + 0x40], ebx
mov dword [esp + 0x38], eax
test dl, 0x20
je 0x4fb67f
mov ecx, 0xff
cmp bx, cx
ja 0x4fb60f
movzx eax, bx
movzx eax, byte [eax + edi]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x38]
cmp ax, 0x7f
jbe 0x4fb67f
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test ecx, ecx
jne 0x4fb623
test ebx, 0x20000
je 0x4fb687
movzx ecx, ax
mov eax, ecx
shr eax, 7
movzx eax, word [eax*2 + 0x6a6508]
shl eax, 7
and ecx, 0x8000007f
jns 0x4fb643
dec ecx
or ecx, 0xffffff80
inc ecx
add eax, ecx
movzx eax, word [eax*2 + 0x6aa908]
lea eax, [eax + eax*2]
mov ax, word [eax*4 + 0x6a22fc]
add ax, word [esp + 0x38]
movzx ecx, ax
mov dword [esp + 0x40], ecx
jmp 0x4fb683
cmp dword [esp + 0x4c], 0
jne 0x4fb67f
mov ebx, dword [esp + 0x1c]
test dl, 0x40
je 0x4fb683
add ecx, 0x14
mov dword [esp + 0x50], ecx
jmp 0x4fb683
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x40]
movzx esi, ax
mov eax, dword [esp + 0x38]
movzx eax, ax
mov dword [esp + 0x78], esi
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x74], eax
test dl, dl
jns 0x4fb73b
mov eax, dword [esp + 0x24]
mov dword [esp + 0x64], 1
movzx eax, word [eax + 0x5c]
mov dword [esp + 0x30], eax
movzx eax, ax
mov dword [esp + 0x44], eax
test edx, 0x100
je 0x4fb73d
mov edx, dword [esp + 0x30]
cmp dx, word [esp + 0x34]
ja 0x4fb6ec
movzx eax, dx
movzx eax, byte [eax + edi]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x44]
cmp ax, 0x7f
jbe 0x4fb73d
test ecx, ecx
jne 0x4fb6f8
test ebx, 0x20000
je 0x4fb73d
movzx ecx, ax
mov eax, ecx
shr eax, 7
movzx eax, word [eax*2 + 0x6a6508]
shl eax, 7
and ecx, 0x8000007f
jns 0x4fb718
dec ecx
or ecx, 0xffffff80
inc ecx
add eax, ecx
movzx eax, word [eax*2 + 0x6aa908]
lea eax, [eax + eax*2]
mov ax, word [eax*4 + 0x6a22fc]
add ax, word [esp + 0x44]
movzx eax, ax
mov dword [esp + 0x30], eax
jmp 0x4fb73d
xor eax, eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
movzx eax, ax
mov dword [esp + 0x80], eax
lea eax, [ebp*2]
mov dword [esp + 0x7c], eax
add eax, ecx
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x20]
add eax, 0x28
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x120]
nop dword [eax]
xor ebp, ebp
xor edi, edi
mov dword [esp + 0x34], ebp
mov ebp, dword [esp + 0x154]
mov dword [esp + 0x1c], edi
mov dword [esp + 0xe8], edi
nop word [eax + eax]
mov ebx, dword [esp + 0x24]
test dword [ebx + 0x40], 0x10000
mov ebx, dword [esp + 0x20]
jne 0x4fbd61
cmp dword [esp + 0x70], 0
je 0x4fb92f
mov edi, esi
cmp esi, edx
jae 0x4fb929
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4fb8a7
jmp 0x4fb7e7
mov eax, dword [esp + 0x120]
test ebp, ebp
je 0x4fb821
cmp edi, eax
jae 0x4fb815
push ecx
lea ecx, [esp + 0x15c]
push ecx
push eax
push ebp
push edi
call fcn.0051fd50
mov ebp, dword [esp + 0x168]
add esp, 0x14
test eax, eax
je 0x4fb815
mov eax, 1
jmp 0x4fb817
xor eax, eax
test eax, eax
jne 0x4fb929
jmp 0x4fb860
mov edx, dword [esp + 0x158]
mov ecx, dword [esp + 0x120]
lea eax, [edx + edx]
sub ecx, eax
cmp edi, ecx
ja 0x4fb860
mov ax, word [edi]
cmp ax, word [esp + 0x15c]
jne 0x4fb860
cmp edx, 1
je 0x4fb929
mov ax, word [edi + 2]
cmp ax, word [esp + 0x15e]
je 0x4fb929
mov edx, dword [esp + 0x10]
add edi, 2
cmp edi, edx
jae 0x4fb929
mov ax, word [edi]
mov ecx, 0xfc00
and ax, cx
mov ecx, 0xdc00
cmp ax, cx
mov ecx, dword [esp + 0x18]
jne 0x4fb7e0
add edi, 2
cmp edi, edx
jae 0x4fb929
jmp 0x4fb7e0
mov eax, dword [esp + 0x120]
test ebp, ebp
je 0x4fb8dd
cmp edi, eax
jae 0x4fb8d5
push ecx
lea ecx, [esp + 0x15c]
push ecx
push eax
push ebp
push edi
call fcn.0051fd50
mov ebp, dword [esp + 0x168]
add esp, 0x14
test eax, eax
je 0x4fb8d5
mov eax, 1
jmp 0x4fb8d7
xor eax, eax
test eax, eax
jne 0x4fb925
jmp 0x4fb914
mov edx, dword [esp + 0x158]
mov ecx, dword [esp + 0x120]
lea eax, [edx + edx]
sub ecx, eax
cmp edi, ecx
ja 0x4fb914
mov ax, word [edi]
cmp ax, word [esp + 0x15c]
jne 0x4fb914
cmp edx, 1
je 0x4fb925
mov ax, word [edi + 2]
cmp ax, word [esp + 0x15e]
je 0x4fb925
mov ecx, dword [esp + 0x18]
add edi, 2
cmp edi, dword [esp + 0x10]
jb 0x4fb8a0
mov esi, dword [esp + 0x2c]
mov edx, edi
mov dword [esp + 0x10], edx
mov edi, dword [esp + 0x48]
test edi, edi
je 0x4fba28
mov ecx, dword [esp + 0x54]
mov ebp, dword [esp + 0x50]
test ecx, ecx
jne 0x4fb94f
test ebp, ebp
je 0x4fbc92
cmp esi, edx
sbb eax, eax
neg eax
cmp esi, edx
jae 0x4fb9a2
movzx eax, word [esi]
test ecx, ecx
je 0x4fb976
cmp ax, word [esp + 0x38]
je 0x4fbc92
cmp ax, word [esp + 0x40]
je 0x4fbc92
test ebp, ebp
je case.0x4fbe1f.997
mov ecx, 0xff
cmp ax, cx
cmova eax, ecx
movzx edx, ax
mov eax, 1
mov ecx, edx
shr edx, 3
and ecx, 7
shl eax, cl
test byte [edx + ebp], al
mov eax, 0
setne al
test eax, eax
jne 0x4fbc92
xor ebx, ebx
cmp dword [esp + 0x18], 0
mov edx, dword [esp + 0x10]
je 0x4fc020
mov ebp, dword [esp + 0x5c]
cmp edx, ebp
je 0x4fc020
test ebx, ebx
je 0x4fb9d4
cmp ebx, 0xfffffffe
jne 0x4fc020
mov ebx, dword [esp + 0x88]
mov edi, 0xdc00
lea esi, [edx + 2]
mov dword [esp + 0x2c], esi
cmp esi, ebp
jae 0x4fba0a
mov ecx, 0xfc00
mov ax, word [esi]
and ax, cx
cmp ax, di
jne 0x4fbfa7
add esi, 2
mov dword [esp + 0x2c], esi
cmp esi, ebp
jb 0x4fb9f0
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x134]
mov byte [edi + 0x2c], 0
mov dword [edi + 0x14], eax
jmp 0x4fc0f7
cmp dword [esp + 0x54], 0
je 0x4fba8f
cmp esi, edx
jae 0x4fba6c
mov eax, dword [esp + 0x74]
cmp ax, word [esp + 0x78]
je 0x4fba5c
mov ecx, dword [esp + 0x38]
mov ebp, dword [esp + 0x40]
movzx eax, word [esi]
cmp ax, cx
je 0x4fba6c
cmp ax, bp
je 0x4fba6c
add esi, 2
cmp esi, edx
jb 0x4fba46
jmp 0x4fba6c
mov eax, dword [esp + 0x38]
cmp word [esi], ax
je 0x4fba6c
add esi, 2
cmp esi, edx
jb 0x4fba60
cmp word [esp + 0x108], 0
mov eax, dword [esp + 0x120]
jne 0x4fbc99
cmp esi, eax
jae case.0x4fbe1f.997
jmp 0x4fbc99
cmp dword [esp + 0x4c], 0
je 0x4fbc48
mov eax, dword [esp + 0x7c]
mov ebx, dword [esp + 0x118]
add eax, ebx
cmp esi, eax
jbe 0x4fbc8e
cmp esi, edx
jae 0x4fbb03
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4fbbb2
nop
test ebp, ebp
je 0x4fbb41
cmp esi, ebx
jbe 0x4fbaf5
push eax
lea eax, [esp + 0x15c]
push eax
push ebx
push ebp
push esi
call fcn.0051fe10
mov ebp, dword [esp + 0x168]
add esp, 0x14
mov ebx, dword [esp + 0x118]
test eax, eax
je 0x4fbaf5
mov eax, 1
jmp 0x4fbaf7
xor eax, eax
test eax, eax
je 0x4fbb76
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x48]
cmp word [esi - 2], 0xd
jne 0x4fbc8e
cmp ebp, 1
je 0x4fbb1c
cmp ebp, 2
jne 0x4fbc8e
cmp esi, edx
jae 0x4fbc8e
cmp word [esi], 0xa
mov eax, dword [esp + 0x120]
mov ebx, dword [esp + 0x20]
jne 0x4fbc99
add esi, 2
jmp 0x4fbc99
mov edx, dword [esp + 0x158]
lea edi, [edx + edx]
lea eax, [ebx + edi]
cmp esi, eax
jb 0x4fbb76
mov ecx, esi
sub ecx, edi
mov ax, word [ecx]
cmp ax, word [esp + 0x15c]
jne 0x4fbb76
cmp edx, 1
je 0x4fbafb
mov ax, word [ecx + 2]
cmp ax, word [esp + 0x15e]
je 0x4fbafb
mov edx, dword [esp + 0x10]
add esi, 2
cmp esi, edx
jae 0x4fbaff
mov ax, word [esi]
mov ecx, 0xfc00
and ax, cx
mov ecx, 0xdc00
cmp ax, cx
mov eax, dword [esp + 0x18]
jne 0x4fbac0
add esi, 2
cmp esi, edx
jae 0x4fbaff
jmp 0x4fbac0
test ebp, ebp
je 0x4fbbf3
cmp esi, ebx
jbe 0x4fbbe7
push eax
lea eax, [esp + 0x15c]
push eax
push ebx
push ebp
push esi
call fcn.0051fe10
mov ebp, dword [esp + 0x168]
add esp, 0x14
mov ebx, dword [esp + 0x118]
test eax, eax
je 0x4fbbe7
mov eax, 1
jmp 0x4fbbe9
xor eax, eax
test eax, eax
jne 0x4fbafb
jmp 0x4fbc30
mov edx, dword [esp + 0x158]
lea edi, [edx + edx]
lea eax, [ebx + edi]
cmp esi, eax
jb 0x4fbc30
mov ecx, esi
sub ecx, edi
mov ax, word [ecx]
cmp ax, word [esp + 0x15c]
jne 0x4fbc30
cmp edx, 1
je 0x4fbafb
mov ax, word [ecx + 2]
cmp ax, word [esp + 0x15e]
je 0x4fbafb
mov edx, dword [esp + 0x10]
add esi, 2
mov eax, dword [esp + 0x18]
cmp esi, edx
jb 0x4fbbb2
jmp 0x4fbaff
mov ebp, dword [esp + 0x50]
test ebp, ebp
je 0x4fbc92
cmp esi, edx
jae 0x4fba6c
mov ebx, 0xff
nop dword [eax]
movzx edx, word [esi]
mov eax, 1
cmp edx, ebx
cmova edx, ebx
mov ecx, edx
shr edx, 3
and ecx, 7
shl eax, cl
test byte [edx + ebp], al
jne 0x4fbc85
add esi, 2
cmp esi, dword [esp + 0x10]
jb 0x4fbc60
mov ebx, dword [esp + 0x20]
jmp 0x4fba6c
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x120]
cmp word [esp + 0x108], 0
mov edx, eax
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x10], edx
jne 0x4fbe40
movzx eax, word [ebp + 0x66]
sub edx, esi
sar edx, 1
cmp edx, eax
jl case.0x4fbe1f.997
cmp dword [esp + 0x64], 0
mov eax, dword [esp + 0x54]
lea ecx, [esi + eax*2]
je 0x4fbe40
cmp ecx, dword [esp + 0x68]
jbe 0x4fbe40
cmp edx, 0x7d0
jb 0x4fbcfa
test edi, edi
jne 0x4fbe40
cmp edx, 0x1e8480
jae 0x4fbe40
mov edx, dword [esp + 0x120]
cmp ecx, edx
jae case.0x4fbe1f.997
mov ebp, dword [esp + 0x30]
movzx eax, bp
mov ebp, dword [esp + 0x44]
cmp word [esp + 0x80], ax
je 0x4fbe26
movzx eax, word [ecx]
mov edi, ecx
add ecx, 2
mov edx, eax
cmp ax, bp
je 0x4fbd46
cmp dx, word [esp + 0x30]
je 0x4fbd46
cmp ecx, dword [esp + 0x120]
jb 0x4fbd22
jmp case.0x4fbe1f.997
mov edx, dword [esp + 0x120]
cmp edi, edx
jae case.0x4fbe1f.997
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x68], edi
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x24]
cmp esi, dword [esp + 0x6c]
ja case.0x4fbe1f.997
or dword [esp + 0xc8], 1
mov eax, esi
sub eax, ecx
mov dword [esp + 0x128], esi
sar eax, 1
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0x58]
or eax, dword [esp + 0x188]
mov dword [esp + 0x144], eax
lea eax, [esp + 0xcc]
push eax
movzx eax, word [ebp + 0x68]
push ebx
push dword [esp + 0x44]
mov dword [esp + 0x138], esi
push eax
push dword [esp + 0x124]
mov dword [esp + 0xf8], 0
push esi
mov dword [esp + 0x11c], 0
mov dword [esp + 0x164], 0
call fcn.004ef910
add esp, 0x18
mov ebx, eax
cmp dword [esp + 0xe8], 0
je 0x4fbe06
test edi, edi
jne 0x4fbe06
mov eax, dword [esp + 0x128]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x34], esi
test ebx, ebx
jg case.default.0x4fbe1f
je case.0x4fbe1f.996
lea eax, [ebx + 0x3e5]
cmp eax, 4
ja case.default.0x4fbe1f
jmp dword [eax*4 + 0x4fc180]
mov ax, word [ecx]
mov edi, ecx
add ecx, 2
cmp ax, bp
je 0x4fbd4d
cmp ecx, edx
jb 0x4fbe26
jmp case.0x4fbe1f.997
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
jmp 0x4fbd65
mov eax, dword [esp + 0x14c]
mov edi, esi
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x150], eax
jmp 0x4fbea8
mov edi, dword [esp + 0x13c]
cmp edi, esi
jbe case.0x4fbe1f.996
mov ecx, dword [esp + 0x18]
jmp 0x4fbea8
mov ecx, dword [esp + 0x18]
lea edi, [esi + 2]
mov dword [esp + 0x150], 0
test ecx, ecx
je 0x4fbea8
cmp edi, dword [esp + 0x10]
jae 0x4fbea8
mov ax, word [edi]
mov edx, 0xfc00
and ax, dx
mov edx, 0xdc00
cmp ax, dx
jne 0x4fbea8
add edi, 2
mov ebp, dword [esp + 0x154]
xor ebx, ebx
cmp dword [esp + 0x70], ebx
je 0x4fbf2e
mov eax, dword [esp + 0x120]
test ebp, ebp
je 0x4fbef6
cmp esi, eax
jae 0x4fbeea
push ecx
lea ecx, [esp + 0x15c]
push ecx
push eax
push ebp
push esi
call fcn.0051fd50
mov ebp, dword [esp + 0x168]
add esp, 0x14
test eax, eax
je 0x4fbeea
lea eax, [ebx + 1]
jmp 0x4fbeec
xor eax, eax
test eax, eax
jne case.default.0x4fbe1f
jmp 0x4fbf2e
mov edx, dword [esp + 0x158]
lea ecx, [edx + edx]
sub eax, ecx
cmp esi, eax
ja 0x4fbf2e
mov ax, word [esi]
cmp ax, word [esp + 0x15c]
jne 0x4fbf2e
cmp edx, 1
je case.default.0x4fbe1f
mov ax, word [esi + 2]
cmp ax, word [esp + 0x15e]
je case.default.0x4fbe1f
mov esi, edi
mov dword [esp + 0x2c], esi
cmp dword [esp + 0x48], ebx
jne case.default.0x4fbe1f
mov edx, dword [esp + 0x10]
cmp edi, edx
ja case.default.0x4fbe1f
cmp edi, dword [esp + 0x84]
jbe 0x4fbf8c
cmp word [edi - 2], 0xd
jne 0x4fbf8c
cmp edi, edx
jae 0x4fbf8c
cmp word [edi], 0xa
jne 0x4fbf8c
mov eax, dword [esp + 0x24]
test dword [eax + 0x48], 0x800
jne 0x4fbf8c
cmp ebp, 1
je 0x4fbf85
cmp ebp, 2
je 0x4fbf85
cmp dword [esp + 0x158], 2
jne 0x4fbf8c
lea esi, [edi + 2]
mov dword [esp + 0x2c], esi
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x130], ebx
jmp 0x4fb7a0
mov eax, dword [esp + 0x28]
mov ecx, esi
sub ecx, dword [esp + 0x14]
sar ecx, 1
push ebx
sub eax, ecx
mov dword [esp + 0x120], esi
push eax
push esi
call fcn.005216e0
add esp, 0xc
test eax, eax
je 0x4fc000
mov edx, dword [esp + 0x10]
jns 0x4fb9e0
mov eax, dword [ebx]
lea edx, [esi + eax*2]
mov dword [esp + 0x10], edx
mov eax, edx
mov dword [esp + 0x120], eax
cmp edx, esi
jbe 0x4fb9e0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x58], 3
jmp 0x4fb780
mov ecx, dword [esp + 0x14]
mov edx, ebp
mov eax, ebp
mov dword [esp + 0x10], edx
mov dword [esp + 0x120], eax
mov dword [esp + 0x58], 1
jmp 0x4fb780
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x130]
mov dword [edi + 0x14], eax
mov byte [edi + 0x2c], 0
cmp ebx, 1
jne 0x4fc0e4
movzx eax, word [edi + 0x2e]
mov ecx, dword [esp + 0x104]
add eax, eax
cmp ecx, eax
jl 0x4fc057
xor eax, eax
jmp 0x4fc05f
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
inc eax
mov ebx, dword [esp + 0x14]
sub esi, ebx
mov ecx, dword [esp + 0x124]
mov dword [edi + 0x30], eax
mov eax, dword [esp + 0x128]
sub eax, ebx
sar esi, 1
sar eax, 1
cmp dword [esp + 0x12c], ecx
mov dword [edi + 0x28], esi
cmova ecx, dword [esp + 0x12c]
sub ecx, ebx
mov dword [edi + 0x20], eax
sar ecx, 1
test dword [esp + 0x188], 0x4000
mov dword [edi + 0x24], ecx
je 0x4fc0dc
mov ecx, dword [esp + 0x60]
mov esi, dword [esp + 0x28]
push dword [edi + 8]
mov eax, dword [edi]
lea esi, [esi + ecx]
add esi, esi
push esi
call eax
add esp, 8
mov dword [edi + 0x10], eax
test eax, eax
je 0x4fb56c
push esi
push ebx
push eax
call fcn.00526450
mov eax, dword [edi + 0x30]
add esp, 0xc
or byte [edi + 0x2d], 1
jmp 0x4fc14e
mov eax, dword [edi + 0x30]
mov dword [edi + 0x10], ebx
jmp 0x4fc14e
mov eax, dword [esp + 0x134]
mov dword [edi + 0x14], eax
test ebx, ebx
je 0x4fc0f7
cmp ebx, 0xfffffffe
jne 0x4fc134
mov ebp, dword [esp + 0x34]
test ebp, ebp
je 0x4fc131
mov eax, dword [esp + 0x14]
mov ebx, 0xfffffffe
mov ecx, dword [esp + 0x1c]
sub ebp, eax
sub edx, eax
sar ebp, 1
sar edx, 1
sub ecx, eax
sar ecx, 1
mov dword [edi + 0x10], eax
mov eax, ebx
mov dword [edi + 0x34], ebp
mov dword [edi + 0x38], edx
mov dword [edi + 0x28], ebp
mov dword [edi + 0x20], ecx
mov dword [edi + 0x24], edx
mov dword [edi + 0x30], ebx
jmp 0x4fc14e
or ebx, 0xffffffff
mov dword [edi + 0x30], ebx
mov eax, ebx
jmp 0x4fc14e
mov eax, 0xffffffd4
jmp 0x4fc14e
mov eax, 0xffffffcd
jmp 0x4fc14e
mov eax, 0xffffffde
mov ecx, dword [esp + 0x170]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00524b20
add esp, 0x164
ret