410e0d:	89 4d f4             	mov    %ecx,-0xc(%ebp)
410e10:	83 7d f4 00          	cmpl   $0x0,-0xc(%ebp)
410e14:	76 5f                	jbe    0x410e75
410e16:	8b 55 f8             	mov    -0x8(%ebp),%edx
410e19:	8b 42 04             	mov    0x4(%edx),%eax
410e1c:	89 45 fc             	mov    %eax,-0x4(%ebp)
410e1f:	8b 4d f4             	mov    -0xc(%ebp),%ecx
410e22:	2b 4d fc             	sub    -0x4(%ebp),%ecx
410e25:	89 4d f4             	mov    %ecx,-0xc(%ebp)
410e28:	8b 55 fc             	mov    -0x4(%ebp),%edx
410e2b:	83 ea 08             	sub    $0x8,%edx
410e2e:	89 55 fc             	mov    %edx,-0x4(%ebp)
410e31:	8b 45 fc             	mov    -0x4(%ebp),%eax
410e34:	d1 e8                	shr    $1,%eax
410e36:	89 45 fc             	mov    %eax,-0x4(%ebp)
410e39:	8b 4d f8             	mov    -0x8(%ebp),%ecx
410e3c:	83 c1 08             	add    $0x8,%ecx
410e3f:	89 4d f0             	mov    %ecx,-0x10(%ebp)
410e42:	8b 55 f8             	mov    -0x8(%ebp),%edx
410e45:	8b 45 08             	mov    0x8(%ebp),%eax
410e48:	03 02                	add    (%edx),%eax
410e4a:	89 45 ec             	mov    %eax,-0x14(%ebp)
410e4d:	8b 4d 0c             	mov    0xc(%ebp),%ecx
410e50:	51                   	push   %ecx
410e51:	8b 55 f0             	mov    -0x10(%ebp),%edx
410e54:	52                   	push   %edx
410e55:	8b 45 fc             	mov    -0x4(%ebp),%eax
410e58:	50                   	push   %eax
410e59:	8b 4d ec             	mov    -0x14(%ebp),%ecx
410e5c:	51                   	push   %ecx
410e5d:	e8 5e fc ff ff       	call   0x410ac0
410e62:	83 c4 10             	add    $0x10,%esp
410e65:	89 45 f8             	mov    %eax,-0x8(%ebp)
410e68:	83 7d f8 00          	cmpl   $0x0,-0x8(%ebp)
410e6c:	75 05                	jne    0x410e73
410e6e:	83 c8 ff             	or     $0xffffffff,%eax
410e71:	eb 04                	jmp    0x410e77
410e73:	eb 9b                	jmp    0x410e10
410e75:	33 c0                	xor    %eax,%eax
410e77:	8b e5                	mov    %ebp,%esp
410e79:	5d                   	pop    %ebp
410e7a:	c3                   	ret
410e7b:	cc                   	int3
410e7c:	cc                   	int3
410e7d:	cc                   	int3
410e7e:	cc                   	int3
410e7f:	cc                   	int3
410e80:	55                   	push   %ebp
410e81:	8b ec                	mov    %esp,%ebp
410e83:	83 ec 30             	sub    $0x30,%esp
410e86:	c7 45 e8 00 00 00 00 	movl   $0x0,-0x18(%ebp)
410e8d:	83 7d 08 00          	cmpl   $0x0,0x8(%ebp)
410e91:	74 0c                	je     0x410e9f
410e93:	83 7d 0c 00          	cmpl   $0x0,0xc(%ebp)
410e97:	74 06                	je     0x410e9f
410e99:	83 7d 10 00          	cmpl   $0x0,0x10(%ebp)
410e9d:	75 08                	jne    0x410ea7
410e9f:	8b 45 e8             	mov    -0x18(%ebp),%eax
410ea2:	e9 84 01 00 00       	jmp    0x41102b
410ea7:	e8 a4 fb ff ff       	call   0x410a50
410eac:	89 45 f8             	mov    %eax,-0x8(%ebp)
410eaf:	8b 45 f8             	mov    -0x8(%ebp),%eax
410eb2:	50                   	push   %eax
410eb3:	e8 d8 fb ff ff       	call   0x410a90
410eb8:	83 c4 04             	add    $0x4,%esp
410ebb:	89 45 fc             	mov    %eax,-0x4(%ebp)
410ebe:	83 7d fc 00          	cmpl   $0x0,-0x4(%ebp)
410ec2:	0f 84 60 01 00 00    	je     0x411028
410ec8:	c7 45 f0 00 00 00 00 	movl   $0x0,-0x10(%ebp)
410ecf:	8b 4d fc             	mov    -0x4(%ebp),%ecx
410ed2:	8b 51 50             	mov    0x50(%ecx),%edx
410ed5:	33 c0                	xor    %eax,%eax
410ed7:	89 55 d0             	mov    %edx,-0x30(%ebp)
410eda:	89 45 d4             	mov    %eax,-0x2c(%ebp)
410edd:	6a 00                	push   $0x0
410edf:	68 00 00 00 08       	push   $0x8000000
410ee4:	6a 40                	push   $0x40
410ee6:	8d 4d d0             	lea    -0x30(%ebp),%ecx
410ee9:	51                   	push   %ecx
410eea:	6a 00                	push   $0x0
410eec:	68 1f 00 0f 00       	push   $0xf001f
410ef1:	8d 55 f0             	lea    -0x10(%ebp),%edx
410ef4:	52                   	push   %edx
410ef5:	e8 c6 16 ff ff       	call   0x4025c0
410efa:	8b 80 98 00 00 00    	mov    0x98(%eax),%eax
410f00:	ff d0                	call   *%eax
410f02:	89 45 dc             	mov    %eax,-0x24(%ebp)
410f05:	83 7d dc 00          	cmpl   $0x0,-0x24(%ebp)
410f09:	0f 8c 19 01 00 00    	jl     0x411028
410f0f:	c7 45 f4 00 00 00 00 	movl   $0x0,-0xc(%ebp)
410f16:	c7 45 e4 00 00 00 00 	movl   $0x0,-0x1c(%ebp)
410f1d:	6a 04                	push   $0x4
410f1f:	6a 00                	push   $0x0
410f21:	6a 01                	push   $0x1
410f23:	8d 4d e4             	lea    -0x1c(%ebp),%ecx
410f26:	51                   	push   %ecx
410f27:	6a 00                	push   $0x0
410f29:	8b 55 fc             	mov    -0x4(%ebp),%edx
410f2c:	8b 42 50             	mov    0x50(%edx),%eax
410f2f:	50                   	push   %eax
410f30:	6a 00                	push   $0x0
410f32:	8d 4d f4             	lea    -0xc(%ebp),%ecx
410f35:	51                   	push   %ecx
410f36:	6a ff                	push   $0xffffffff
410f38:	8b 55 f0             	mov    -0x10(%ebp),%edx
410f3b:	52                   	push   %edx
410f3c:	e8 7f 16 ff ff       	call   0x4025c0
410f41:	8b 80 9c 00 00 00    	mov    0x9c(%eax),%eax
410f47:	ff d0                	call   *%eax
410f49:	85 c0                	test   %eax,%eax
410f4b:	0f 8c d7 00 00 00    	jl     0x411028
410f51:	8b 4d fc             	mov    -0x4(%ebp),%ecx
410f54:	8b 51 50             	mov    0x50(%ecx),%edx
410f57:	52                   	push   %edx
410f58:	8b 45 f8             	mov    -0x8(%ebp),%eax
410f5b:	50                   	push   %eax
410f5c:	8b 4d f4             	mov    -0xc(%ebp),%ecx
410f5f:	51                   	push   %ecx
410f60:	e8 3b 5a ff ff       	call   0x4069a0
410f65:	83 c4 0c             	add    $0xc,%esp
410f68:	c7 45 ec 00 00 00 00 	movl   $0x0,-0x14(%ebp)
410f6f:	6a 40                	push   $0x40
410f71:	6a 00                	push   $0x0
410f73:	6a 01                	push   $0x1
410f75:	8d 55 e4             	lea    -0x1c(%ebp),%edx
410f78:	52                   	push   %edx
410f79:	6a 00                	push   $0x0
410f7b:	8b 45 fc             	mov    -0x4(%ebp),%eax
410f7e:	8b 48 50             	mov    0x50(%eax),%ecx
410f81:	51                   	push   %ecx
410f82:	6a 00                	push   $0x0
410f84:	8d 55 ec             	lea    -0x14(%ebp),%edx
410f87:	52                   	push   %edx
410f88:	8b 45 08             	mov    0x8(%ebp),%eax
410f8b:	50                   	push   %eax
410f8c:	8b 4d f0             	mov    -0x10(%ebp),%ecx
410f8f:	51                   	push   %ecx
410f90:	e8 2b 16 ff ff       	call   0x4025c0
410f95:	8b 90 9c 00 00 00    	mov    0x9c(%eax),%edx
410f9b:	ff d2                	call   *%edx
410f9d:	85 c0                	test   %eax,%eax
410f9f:	7c 63                	jl     0x411004
410fa1:	b8 08 00 00 00       	mov    $0x8,%eax
410fa6:	6b c8 05             	imul   $0x5,%eax,%ecx
410fa9:	8b 55 fc             	mov    -0x4(%ebp),%edx
410fac:	8b 44 0a 78          	mov    0x78(%edx,%ecx,1),%eax
410fb0:	89 45 e0             	mov    %eax,-0x20(%ebp)
410fb3:	b9 08 00 00 00       	mov    $0x8,%ecx
410fb8:	6b d1 05             	imul   $0x5,%ecx,%edx
410fbb:	8b 45 fc             	mov    -0x4(%ebp),%eax
410fbe:	8b 4c 10 7c          	mov    0x7c(%eax,%edx,1),%ecx
410fc2:	89 4d d8             	mov    %ecx,-0x28(%ebp)
410fc5:	83 7d e0 00          	cmpl   $0x0,-0x20(%ebp)
410fc9:	74 24                	je     0x410fef
410fcb:	83 7d d8 00          	cmpl   $0x0,-0x28(%ebp)
410fcf:	74 1e                	je     0x410fef
410fd1:	8b 55 f8             	mov    -0x8(%ebp),%edx
410fd4:	03 55 e0             	add    -0x20(%ebp),%edx
410fd7:	52                   	push   %edx
410fd8:	8b 45 fc             	mov    -0x4(%ebp),%eax
410fdb:	50                   	push   %eax
410fdc:	8b 4d ec             	mov    -0x14(%ebp),%ecx
410fdf:	2b 4d f8             	sub    -0x8(%ebp),%ecx
410fe2:	51                   	push   %ecx
410fe3:	8b 55 f4             	mov    -0xc(%ebp),%edx
410fe6:	52                   	push   %edx
410fe7:	e8 c4 fd ff ff       	call   0x410db0
410fec:	83 c4 10             	add    $0x10,%esp
410fef:	8b 45 0c             	mov    0xc(%ebp),%eax
410ff2:	2b 45 f8             	sub    -0x8(%ebp),%eax
410ff5:	03 45 ec             	add    -0x14(%ebp),%eax
410ff8:	8b 4d 10             	mov    0x10(%ebp),%ecx
410ffb:	89 01                	mov    %eax,(%ecx)
410ffd:	c7 45 e8 01 00 00 00 	movl   $0x1,-0x18(%ebp)
411004:	8b 55 f4             	mov    -0xc(%ebp),%edx
411007:	52                   	push   %edx
411008:	6a ff                	push   $0xffffffff
41100a:	e8 b1 15 ff ff       	call   0x4025c0
41100f:	8b 80 a0 00 00 00    	mov    0xa0(%eax),%eax
411015:	ff d0                	call   *%eax
411017:	8b 4d f0             	mov    -0x10(%ebp),%ecx
41101a:	51                   	push   %ecx
41101b:	e8 a0 15 ff ff       	call   0x4025c0
411020:	8b 90 b8 00 00 00    	mov    0xb8(%eax),%edx
411026:	ff d2                	call   *%edx
411028:	8b 45 e8             	mov    -0x18(%ebp),%eax
41102b:	8b e5                	mov    %ebp,%esp
41102d:	5d                   	pop    %ebp
41102e:	c3                   	ret
41102f:	cc                   	int3
411030:	55                   	push   %ebp
411031:	8b ec                	mov    %esp,%ebp
411033:	81 ec 9c 03 00 00    	sub    $0x39c,%esp
411039:	56                   	push   %esi
41103a:	c7 45 f8 00 00 00 00 	movl   $0x0,-0x8(%ebp)
411041:	83 7d 08 00          	cmpl   $0x0,0x8(%ebp)
411045:	74 06                	je     0x41104d
411047:	83 7d 0c 00          	cmpl   $0x0,0xc(%ebp)
41104b:	75 08                	jne    0x411055
41104d:	8b 45 f8             	mov    -0x8(%ebp),%eax
411050:	e9 2e 02 00 00       	jmp    0x411283
411055:	c7 45 fc 00 00 00 00 	movl   $0x0,-0x4(%ebp)
41105c:	c7 45 f4 00 00 00 00 	movl   $0x0,-0xc(%ebp)
411063:	8d 45 f4             	lea    -0xc(%ebp),%eax
411066:	50                   	push   %eax
411067:	8b 4d 08             	mov    0x8(%ebp),%ecx
41106a:	51                   	push   %ecx
41106b:	e8 e0 65 ff ff       	call   0x407650
411070:	83 c4 08             	add    $0x8,%esp
411073:	85 c0                	test   %eax,%eax
411075:	74 4d                	je     0x4110c4
411077:	8b 55 08             	mov    0x8(%ebp),%edx
41107a:	52                   	push   %edx
41107b:	e8 e0 59 ff ff       	call   0x406a60
411080:	83 c4 04             	add    $0x4,%esp
411083:	8b f0                	mov    %eax,%esi
411085:	8b 45 f4             	mov    -0xc(%ebp),%eax
411088:	50                   	push   %eax
411089:	e8 d2 59 ff ff       	call   0x406a60
41108e:	83 c4 04             	add    $0x4,%esp
411091:	2b f0                	sub    %eax,%esi
411093:	83 ee 01             	sub    $0x1,%esi
411096:	89 75 f0             	mov    %esi,-0x10(%ebp)
411099:	8b 4d f0             	mov    -0x10(%ebp),%ecx
41109c:	51                   	push   %ecx
41109d:	e8 5e 59 ff ff       	call   0x406a00
4110a2:	83 c4 04             	add    $0x4,%esp
4110a5:	89 45 ec             	mov    %eax,-0x14(%ebp)
4110a8:	83 7d ec 00          	cmpl   $0x0,-0x14(%ebp)
4110ac:	74 16                	je     0x4110c4
4110ae:	8b 55 f0             	mov    -0x10(%ebp),%edx
4110b1:	d1 e2                	shl    $1,%edx
4110b3:	52                   	push   %edx
4110b4:	8b 45 08             	mov    0x8(%ebp),%eax
4110b7:	50                   	push   %eax
4110b8:	8b 4d ec             	mov    -0x14(%ebp),%ecx
4110bb:	51                   	push   %ecx
4110bc:	e8 df 58 ff ff       	call   0x4069a0
4110c1:	83 c4 0c             	add    $0xc,%esp
4110c4:	6a 44                	push   $0x44
4110c6:	6a 00                	push   $0x0
4110c8:	8d 95 30 ff ff ff    	lea    -0xd0(%ebp),%edx
4110ce:	52                   	push   %edx
4110cf:	e8 ac 58 ff ff       	call   0x406980
4110d4:	83 c4 0c             	add    $0xc,%esp
4110d7:	6a 10                	push   $0x10
4110d9:	6a 00                	push   $0x0
4110db:	8d 45 d8             	lea    -0x28(%ebp),%eax
4110de:	50                   	push   %eax
4110df:	e8 9c 58 ff ff       	call   0x406980
4110e4:	83 c4 0c             	add    $0xc,%esp
4110e7:	8d 4d d8             	lea    -0x28(%ebp),%ecx
4110ea:	51                   	push   %ecx
4110eb:	8d 95 30 ff ff ff    	lea    -0xd0(%ebp),%edx
4110f1:	52                   	push   %edx
4110f2:	8b 45 fc             	mov    -0x4(%ebp),%eax
4110f5:	50                   	push   %eax
4110f6:	6a 00                	push   $0x0
4110f8:	68 22 00 00 04       	push   $0x4000022
4110fd:	6a 00                	push   $0x0
4110ff:	6a 00                	push   $0x0
411101:	6a 00                	push   $0x0
411103:	6a 00                	push   $0x0
411105:	8b 4d 08             	mov    0x8(%ebp),%ecx
411108:	51                   	push   %ecx
411109:	e8 b2 14 ff ff       	call   0x4025c0
41110e:	8b 90 10 01 00 00    	mov    0x110(%eax),%edx
411114:	ff d2                	call   *%edx
411116:	85 c0                	test   %eax,%eax
411118:	0f 84 50 01 00 00    	je     0x41126e
41111e:	b8 01 00 00 00       	mov    $0x1,%eax
411123:	85 c0                	test   %eax,%eax
411125:	0f 84 1d 01 00 00    	je     0x411248
41112b:	6a 60                	push   $0x60
41112d:	6a 00                	push   $0x0
41112f:	8d 8d 74 ff ff ff    	lea    -0x8c(%ebp),%ecx
411135:	51                   	push   %ecx
411136:	e8 45 58 ff ff       	call   0x406980
41113b:	83 c4 0c             	add    $0xc,%esp
41113e:	c7 45 d4 00 00 00 00 	movl   $0x0,-0x2c(%ebp)
411145:	6a ff                	push   $0xffffffff
411147:	8d 95 74 ff ff ff    	lea    -0x8c(%ebp),%edx
41114d:	52                   	push   %edx
41114e:	e8 6d 14 ff ff       	call   0x4025c0
411153:	8b 80 70 01 00 00    	mov    0x170(%eax),%eax
411159:	ff d0                	call   *%eax
41115b:	85 c0                	test   %eax,%eax
41115d:	0f 84 de 00 00 00    	je     0x411241
411163:	83 bd 74 ff ff ff 03 	cmpl   $0x3,-0x8c(%ebp)
41116a:	0f 85 af 00 00 00    	jne    0x41121f
411170:	c7 45 e8 00 00 00 00 	movl   $0x0,-0x18(%ebp)
411177:	8d 4d e8             	lea    -0x18(%ebp),%ecx
41117a:	51                   	push   %ecx
41117b:	8b 55 0c             	mov    0xc(%ebp),%edx
41117e:	52                   	push   %edx
41117f:	8b 45 d8             	mov    -0x28(%ebp),%eax
411182:	50                   	push   %eax
411183:	e8 f8 fc ff ff       	call   0x410e80
411188:	83 c4 0c             	add    $0xc,%esp
41118b:	85 c0                	test   %eax,%eax
41118d:	74 6e                	je     0x4111fd
41118f:	c7 85 64 fc ff ff 3f 	movl   $0x1003f,-0x39c(%ebp)
411196:	00 01 00
411199:	8d 8d 64 fc ff ff    	lea    -0x39c(%ebp),%ecx
41119f:	51                   	push   %ecx
4111a0:	8b 55 dc             	mov    -0x24(%ebp),%edx
4111a3:	52                   	push   %edx
4111a4:	e8 17 14 ff ff       	call   0x4025c0
4111a9:	8b 80 a4 00 00 00    	mov    0xa4(%eax),%eax
4111af:	ff d0                	call   *%eax
4111b1:	85 c0                	test   %eax,%eax
4111b3:	7c 48                	jl     0x4111fd
4111b5:	8b 4d e8             	mov    -0x18(%ebp),%ecx
4111b8:	89 8d 1c fd ff ff    	mov    %ecx,-0x2e4(%ebp)
4111be:	8d 95 64 fc ff ff    	lea    -0x39c(%ebp),%edx
4111c4:	52                   	push   %edx
4111c5:	8b 45 dc             	mov    -0x24(%ebp),%eax
4111c8:	50                   	push   %eax
4111c9:	e8 f2 13 ff ff       	call   0x4025c0
4111ce:	8b 88 a8 00 00 00    	mov    0xa8(%eax),%ecx
4111d4:	ff d1                	call   *%ecx
4111d6:	85 c0                	test   %eax,%eax
4111d8:	7c 23                	jl     0x4111fd
4111da:	c7 45 f8 01 00 00 00 	movl   $0x1,-0x8(%ebp)
4111e1:	83 7d 10 00          	cmpl   $0x0,0x10(%ebp)
4111e5:	74 08                	je     0x4111ef
4111e7:	8b 55 10             	mov    0x10(%ebp),%edx
4111ea:	8b 45 d8             	mov    -0x28(%ebp),%eax
4111ed:	89 02                	mov    %eax,(%edx)
4111ef:	83 7d 14 00          	cmpl   $0x0,0x14(%ebp)
4111f3:	74 08                	je     0x4111fd
4111f5:	8b 4d 14             	mov    0x14(%ebp),%ecx
4111f8:	8b 55 e0             	mov    -0x20(%ebp),%edx
4111fb:	89 11                	mov    %edx,(%ecx)
4111fd:	68 01 00 01 80       	push   $0x80010001
411202:	8b 85 7c ff ff ff    	mov    -0x84(%ebp),%eax
411208:	50                   	push   %eax
411209:	8b 8d 78 ff ff ff    	mov    -0x88(%ebp),%ecx
41120f:	51                   	push   %ecx
411210:	e8 ab 13 ff ff       	call   0x4025c0
411215:	8b 90 74 01 00 00    	mov    0x174(%eax),%edx
41121b:	ff d2                	call   *%edx
41121d:	eb 29                	jmp    0x411248
41121f:	68 02 00 01 00       	push   $0x10002
411224:	8b 85 7c ff ff ff    	mov    -0x84(%ebp),%eax
41122a:	50                   	push   %eax
41122b:	8b 8d 78 ff ff ff    	mov    -0x88(%ebp),%ecx
411231:	51                   	push   %ecx
411232:	e8 89 13 ff ff       	call   0x4025c0
411237:	8b 90 74 01 00 00    	mov    0x174(%eax),%edx