408b99:	ff 75 08             	push   0x8(%ebp)
408b9c:	ff d6                	call   *%esi
408b9e:	8b c8                	mov    %eax,%ecx
408ba0:	3b cb                	cmp    %ebx,%ecx
408ba2:	89 4d f8             	mov    %ecx,-0x8(%ebp)
408ba5:	0f 84 c1 00 00 00    	je     0x408c6c
408bab:	66 f7 45 0c 00 04    	testw  $0x400,0xc(%ebp)
408bb1:	74 29                	je     0x408bdc
408bb3:	39 5d 1c             	cmp    %ebx,0x1c(%ebp)
408bb6:	0f 84 b0 00 00 00    	je     0x408c6c
408bbc:	3b 4d 1c             	cmp    0x1c(%ebp),%ecx
408bbf:	0f 8f a7 00 00 00    	jg     0x408c6c
408bc5:	ff 75 1c             	push   0x1c(%ebp)
408bc8:	ff 75 18             	push   0x18(%ebp)
408bcb:	57                   	push   %edi
408bcc:	ff 75 f4             	push   -0xc(%ebp)
408bcf:	ff 75 0c             	push   0xc(%ebp)
408bd2:	ff 75 08             	push   0x8(%ebp)
408bd5:	ff d6                	call   *%esi
408bd7:	e9 90 00 00 00       	jmp    0x408c6c
408bdc:	3b cb                	cmp    %ebx,%ecx
408bde:	7e 45                	jle    0x408c25
408be0:	6a e0                	push   $0xffffffe0
408be2:	33 d2                	xor    %edx,%edx
408be4:	58                   	pop    %eax
408be5:	f7 f1                	div    %ecx
408be7:	83 f8 02             	cmp    $0x2,%eax
408bea:	72 39                	jb     0x408c25
408bec:	8d 44 09 08          	lea    0x8(%ecx,%ecx,1),%eax
408bf0:	3d 00 04 00 00       	cmp    $0x400,%eax
408bf5:	77 16                	ja     0x408c0d
408bf7:	e8 54 7a 00 00       	call   0x410650
408bfc:	8b f4                	mov    %esp,%esi
408bfe:	3b f3                	cmp    %ebx,%esi
408c00:	74 6a                	je     0x408c6c
408c02:	c7 06 cc cc 00 00    	movl   $0xcccc,(%esi)
408c08:	83 c6 08             	add    $0x8,%esi
408c0b:	eb 1a                	jmp    0x408c27
408c0d:	50                   	push   %eax
408c0e:	e8 3c 21 00 00       	call   0x40ad4f
408c13:	3b c3                	cmp    %ebx,%eax
408c15:	59                   	pop    %ecx
408c16:	74 09                	je     0x408c21
408c18:	c7 00 dd dd 00 00    	movl   $0xdddd,(%eax)
408c1e:	83 c0 08             	add    $0x8,%eax
408c21:	8b f0                	mov    %eax,%esi
408c23:	eb 02                	jmp    0x408c27
408c25:	33 f6                	xor    %esi,%esi
408c27:	3b f3                	cmp    %ebx,%esi
408c29:	74 41                	je     0x408c6c
408c2b:	ff 75 f8             	push   -0x8(%ebp)
408c2e:	56                   	push   %esi
408c2f:	57                   	push   %edi
408c30:	ff 75 f4             	push   -0xc(%ebp)
408c33:	ff 75 0c             	push   0xc(%ebp)
408c36:	ff 75 08             	push   0x8(%ebp)
408c39:	ff 15 dc 70 41 00    	call   *0x4170dc
408c3f:	85 c0                	test   %eax,%eax
408c41:	74 22                	je     0x408c65
408c43:	39 5d 1c             	cmp    %ebx,0x1c(%ebp)
408c46:	53                   	push   %ebx
408c47:	53                   	push   %ebx
408c48:	75 04                	jne    0x408c4e
408c4a:	53                   	push   %ebx
408c4b:	53                   	push   %ebx
408c4c:	eb 06                	jmp    0x408c54
408c4e:	ff 75 1c             	push   0x1c(%ebp)
408c51:	ff 75 18             	push   0x18(%ebp)
408c54:	ff 75 f8             	push   -0x8(%ebp)
408c57:	56                   	push   %esi
408c58:	53                   	push   %ebx
408c59:	ff 75 20             	push   0x20(%ebp)
408c5c:	ff 15 90 70 41 00    	call   *0x417090
408c62:	89 45 f8             	mov    %eax,-0x8(%ebp)
408c65:	56                   	push   %esi
408c66:	e8 3e fd ff ff       	call   0x4089a9
408c6b:	59                   	pop    %ecx
408c6c:	ff 75 f4             	push   -0xc(%ebp)
408c6f:	e8 35 fd ff ff       	call   0x4089a9
408c74:	8b 45 f8             	mov    -0x8(%ebp),%eax
408c77:	59                   	pop    %ecx
408c78:	e9 59 01 00 00       	jmp    0x408dd6
408c7d:	39 5d 08             	cmp    %ebx,0x8(%ebp)
408c80:	89 5d f4             	mov    %ebx,-0xc(%ebp)
408c83:	89 5d f0             	mov    %ebx,-0x10(%ebp)
408c86:	75 08                	jne    0x408c90
408c88:	8b 06                	mov    (%esi),%eax
408c8a:	8b 40 14             	mov    0x14(%eax),%eax
408c8d:	89 45 08             	mov    %eax,0x8(%ebp)
408c90:	39 5d 20             	cmp    %ebx,0x20(%ebp)
408c93:	75 08                	jne    0x408c9d
408c95:	8b 06                	mov    (%esi),%eax
408c97:	8b 40 04             	mov    0x4(%eax),%eax
408c9a:	89 45 20             	mov    %eax,0x20(%ebp)
408c9d:	ff 75 08             	push   0x8(%ebp)
408ca0:	e8 a9 77 00 00       	call   0x41044e
408ca5:	83 f8 ff             	cmp    $0xffffffff,%eax
408ca8:	59                   	pop    %ecx
408ca9:	89 45 ec             	mov    %eax,-0x14(%ebp)
408cac:	75 07                	jne    0x408cb5
408cae:	33 c0                	xor    %eax,%eax
408cb0:	e9 21 01 00 00       	jmp    0x408dd6
408cb5:	3b 45 20             	cmp    0x20(%ebp),%eax
408cb8:	0f 84 db 00 00 00    	je     0x408d99
408cbe:	53                   	push   %ebx
408cbf:	53                   	push   %ebx
408cc0:	8d 4d 14             	lea    0x14(%ebp),%ecx
408cc3:	51                   	push   %ecx
408cc4:	ff 75 10             	push   0x10(%ebp)
408cc7:	50                   	push   %eax
408cc8:	ff 75 20             	push   0x20(%ebp)
408ccb:	e8 c5 77 00 00       	call   0x410495
408cd0:	83 c4 18             	add    $0x18,%esp
408cd3:	3b c3                	cmp    %ebx,%eax
408cd5:	89 45 f4             	mov    %eax,-0xc(%ebp)
408cd8:	74 d4                	je     0x408cae
408cda:	8b 35 d8 70 41 00    	mov    0x4170d8,%esi
408ce0:	53                   	push   %ebx
408ce1:	53                   	push   %ebx
408ce2:	ff 75 14             	push   0x14(%ebp)
408ce5:	50                   	push   %eax
408ce6:	ff 75 0c             	push   0xc(%ebp)
408ce9:	ff 75 08             	push   0x8(%ebp)
408cec:	ff d6                	call   *%esi
408cee:	3b c3                	cmp    %ebx,%eax
408cf0:	89 45 f8             	mov    %eax,-0x8(%ebp)
408cf3:	75 07                	jne    0x408cfc
408cf5:	33 f6                	xor    %esi,%esi
408cf7:	e9 b7 00 00 00       	jmp    0x408db3
408cfc:	7e 3d                	jle    0x408d3b
408cfe:	83 f8 e0             	cmp    $0xffffffe0,%eax
408d01:	77 38                	ja     0x408d3b
408d03:	83 c0 08             	add    $0x8,%eax
408d06:	3d 00 04 00 00       	cmp    $0x400,%eax
408d0b:	77 16                	ja     0x408d23
408d0d:	e8 3e 79 00 00       	call   0x410650
408d12:	8b fc                	mov    %esp,%edi
408d14:	3b fb                	cmp    %ebx,%edi
408d16:	74 dd                	je     0x408cf5
408d18:	c7 07 cc cc 00 00    	movl   $0xcccc,(%edi)
408d1e:	83 c7 08             	add    $0x8,%edi
408d21:	eb 1a                	jmp    0x408d3d
408d23:	50                   	push   %eax
408d24:	e8 26 20 00 00       	call   0x40ad4f
408d29:	3b c3                	cmp    %ebx,%eax
408d2b:	59                   	pop    %ecx
408d2c:	74 09                	je     0x408d37
408d2e:	c7 00 dd dd 00 00    	movl   $0xdddd,(%eax)
408d34:	83 c0 08             	add    $0x8,%eax
408d37:	8b f8                	mov    %eax,%edi
408d39:	eb 02                	jmp    0x408d3d
408d3b:	33 ff                	xor    %edi,%edi
408d3d:	3b fb                	cmp    %ebx,%edi
408d3f:	74 b4                	je     0x408cf5
408d41:	ff 75 f8             	push   -0x8(%ebp)
408d44:	53                   	push   %ebx
408d45:	57                   	push   %edi
408d46:	e8 05 ce ff ff       	call   0x405b50
408d4b:	83 c4 0c             	add    $0xc,%esp
408d4e:	ff 75 f8             	push   -0x8(%ebp)
408d51:	57                   	push   %edi
408d52:	ff 75 14             	push   0x14(%ebp)
408d55:	ff 75 f4             	push   -0xc(%ebp)
408d58:	ff 75 0c             	push   0xc(%ebp)
408d5b:	ff 75 08             	push   0x8(%ebp)
408d5e:	ff d6                	call   *%esi
408d60:	3b c3                	cmp    %ebx,%eax
408d62:	89 45 f8             	mov    %eax,-0x8(%ebp)
408d65:	75 04                	jne    0x408d6b
408d67:	33 f6                	xor    %esi,%esi
408d69:	eb 25                	jmp    0x408d90
408d6b:	ff 75 1c             	push   0x1c(%ebp)
408d6e:	8d 45 f8             	lea    -0x8(%ebp),%eax
408d71:	ff 75 18             	push   0x18(%ebp)
408d74:	50                   	push   %eax
408d75:	57                   	push   %edi
408d76:	ff 75 20             	push   0x20(%ebp)
408d79:	ff 75 ec             	push   -0x14(%ebp)
408d7c:	e8 14 77 00 00       	call   0x410495
408d81:	8b f0                	mov    %eax,%esi
408d83:	89 75 f0             	mov    %esi,-0x10(%ebp)
408d86:	83 c4 18             	add    $0x18,%esp
408d89:	f7 de                	neg    %esi
408d8b:	1b f6                	sbb    %esi,%esi
408d8d:	23 75 f8             	and    -0x8(%ebp),%esi
408d90:	57                   	push   %edi
408d91:	e8 13 fc ff ff       	call   0x4089a9
408d96:	59                   	pop    %ecx
408d97:	eb 1a                	jmp    0x408db3
408d99:	ff 75 1c             	push   0x1c(%ebp)
408d9c:	ff 75 18             	push   0x18(%ebp)
408d9f:	ff 75 14             	push   0x14(%ebp)
408da2:	ff 75 10             	push   0x10(%ebp)
408da5:	ff 75 0c             	push   0xc(%ebp)
408da8:	ff 75 08             	push   0x8(%ebp)
408dab:	ff 15 d8 70 41 00    	call   *0x4170d8
408db1:	8b f0                	mov    %eax,%esi
408db3:	39 5d f4             	cmp    %ebx,-0xc(%ebp)
408db6:	74 09                	je     0x408dc1
408db8:	ff 75 f4             	push   -0xc(%ebp)
408dbb:	e8 93 d6 ff ff       	call   0x406453
408dc0:	59                   	pop    %ecx
408dc1:	8b 45 f0             	mov    -0x10(%ebp),%eax
408dc4:	3b c3                	cmp    %ebx,%eax
408dc6:	74 0c                	je     0x408dd4
408dc8:	39 45 18             	cmp    %eax,0x18(%ebp)
408dcb:	74 07                	je     0x408dd4
408dcd:	50                   	push   %eax
408dce:	e8 80 d6 ff ff       	call   0x406453
408dd3:	59                   	pop    %ecx
408dd4:	8b c6                	mov    %esi,%eax
408dd6:	8d 65 e0             	lea    -0x20(%ebp),%esp
408dd9:	5f                   	pop    %edi
408dda:	5e                   	pop    %esi
408ddb:	5b                   	pop    %ebx
408ddc:	8b 4d fc             	mov    -0x4(%ebp),%ecx
408ddf:	33 cd                	xor    %ebp,%ecx
408de1:	e8 4f d1 ff ff       	call   0x405f35
408de6:	c9                   	leave
408de7:	c3                   	ret
408de8:	55                   	push   %ebp
408de9:	8b ec                	mov    %esp,%ebp
408deb:	83 ec 10             	sub    $0x10,%esp
408dee:	ff 75 08             	push   0x8(%ebp)
408df1:	8d 4d f0             	lea    -0x10(%ebp),%ecx
408df4:	e8 cb fb ff ff       	call   0x4089c4
408df9:	ff 75 28             	push   0x28(%ebp)
408dfc:	8d 4d f0             	lea    -0x10(%ebp),%ecx
408dff:	ff 75 24             	push   0x24(%ebp)
408e02:	ff 75 20             	push   0x20(%ebp)
408e05:	ff 75 1c             	push   0x1c(%ebp)
408e08:	ff 75 18             	push   0x18(%ebp)
408e0b:	ff 75 14             	push   0x14(%ebp)
408e0e:	ff 75 10             	push   0x10(%ebp)
408e11:	ff 75 0c             	push   0xc(%ebp)
408e14:	e8 2d fc ff ff       	call   0x408a46
408e19:	83 c4 20             	add    $0x20,%esp
408e1c:	80 7d fc 00          	cmpb   $0x0,-0x4(%ebp)
408e20:	74 07                	je     0x408e29
408e22:	8b 4d f8             	mov    -0x8(%ebp),%ecx
408e25:	83 61 70 fd          	andl   $0xfffffffd,0x70(%ecx)
408e29:	c9                   	leave
408e2a:	c3                   	ret
408e2b:	e8 1c 37 00 00       	call   0x40c54c
408e30:	8b c8                	mov    %eax,%ecx
408e32:	8b 41 6c             	mov    0x6c(%ecx),%eax
408e35:	3b 05 20 d2 41 00    	cmp    0x41d220,%eax
408e3b:	74 10                	je     0x408e4d
408e3d:	8b 15 38 d1 41 00    	mov    0x41d138,%edx
408e43:	85 51 70             	test   %edx,0x70(%ecx)
408e46:	75 05                	jne    0x408e4d
408e48:	e8 a5 08 00 00       	call   0x4096f2
408e4d:	8b 80 c8 00 00 00    	mov    0xc8(%eax),%eax
408e53:	c3                   	ret
408e54:	55                   	push   %ebp
408e55:	8b ec                	mov    %esp,%ebp
408e57:	83 ec 10             	sub    $0x10,%esp
408e5a:	ff 75 0c             	push   0xc(%ebp)
408e5d:	8d 4d f0             	lea    -0x10(%ebp),%ecx
408e60:	e8 5f fb ff ff       	call   0x4089c4
408e65:	8b 45 f0             	mov    -0x10(%ebp),%eax
408e68:	83 b8 ac 00 00 00 01 	cmpl   $0x1,0xac(%eax)
408e6f:	7e 13                	jle    0x408e84
408e71:	8d 45 f0             	lea    -0x10(%ebp),%eax
408e74:	50                   	push   %eax
408e75:	6a 04                	push   $0x4
408e77:	ff 75 08             	push   0x8(%ebp)
408e7a:	e8 fd 77 00 00       	call   0x41067c
408e7f:	83 c4 0c             	add    $0xc,%esp
408e82:	eb 10                	jmp    0x408e94
408e84:	8b 80 c8 00 00 00    	mov    0xc8(%eax),%eax
408e8a:	8b 4d 08             	mov    0x8(%ebp),%ecx
408e8d:	0f b6 04 48          	movzbl (%eax,%ecx,2),%eax
408e91:	83 e0 04             	and    $0x4,%eax
408e94:	80 7d fc 00          	cmpb   $0x0,-0x4(%ebp)
408e98:	74 07                	je     0x408ea1
408e9a:	8b 4d f8             	mov    -0x8(%ebp),%ecx
408e9d:	83 61 70 fd          	andl   $0xfffffffd,0x70(%ecx)
408ea1:	c9                   	leave
408ea2:	c3                   	ret
408ea3:	83 3d 04 da 41 00 00 	cmpl   $0x0,0x41da04
408eaa:	75 12                	jne    0x408ebe
408eac:	8b 44 24 04          	mov    0x4(%esp),%eax
408eb0:	8b 0d 10 d2 41 00    	mov    0x41d210,%ecx
408eb6:	0f b6 04 41          	movzbl (%ecx,%eax,2),%eax
408eba:	83 e0 04             	and    $0x4,%eax
408ebd:	c3                   	ret
408ebe:	6a 00                	push   $0x0
408ec0:	ff 74 24 08          	push   0x8(%esp)
408ec4:	e8 8b ff ff ff       	call   0x408e54
408ec9:	59                   	pop    %ecx
408eca:	59                   	pop    %ecx
408ecb:	c3                   	ret
408ecc:	55                   	push   %ebp
408ecd:	8b ec                	mov    %esp,%ebp
408ecf:	83 ec 48             	sub    $0x48,%esp
408ed2:	a1 20 c5 41 00       	mov    0x41c520,%eax
408ed7:	33 c5                	xor    %ebp,%eax
408ed9:	89 45 fc             	mov    %eax,-0x4(%ebp)
408edc:	53                   	push   %ebx
408edd:	33 db                	xor    %ebx,%ebx
408edf:	56                   	push   %esi
408ee0:	8b 75 08             	mov    0x8(%ebp),%esi
408ee3:	39 5e 14             	cmp    %ebx,0x14(%esi)
408ee6:	57                   	push   %edi
408ee7:	89 5d d4             	mov    %ebx,-0x2c(%ebp)
408eea:	89 5d dc             	mov    %ebx,-0x24(%ebp)
408eed:	89 5d e4             	mov    %ebx,-0x1c(%ebp)
408ef0:	89 5d d8             	mov    %ebx,-0x28(%ebp)
408ef3:	89 5d e0             	mov    %ebx,-0x20(%ebp)
408ef6:	89 75 b8             	mov    %esi,-0x48(%ebp)
408ef9:	89 5d bc             	mov    %ebx,-0x44(%ebp)
408efc:	0f 84 0b 03 00 00    	je     0x40920d
408f02:	8d 46 04             	lea    0x4(%esi),%eax
408f05:	39 18                	cmp    %ebx,(%eax)
408f07:	75 20                	jne    0x408f29
408f09:	50                   	push   %eax
408f0a:	0f b7 46 30          	movzwl 0x30(%esi),%eax
408f0e:	68 04 10 00 00       	push   $0x1004
408f13:	50                   	push   %eax
408f14:	8d 45 b8             	lea    -0x48(%ebp),%eax
408f17:	53                   	push   %ebx
408f18:	50                   	push   %eax
408f19:	e8 0c 7a 00 00       	call   0x41092a
408f1e:	83 c4 14             	add    $0x14,%esp
408f21:	85 c0                	test   %eax,%eax
408f23:	0f 85 bc 02 00 00    	jne    0x4091e5
408f29:	6a 04                	push   $0x4
408f2b:	e8 bc 03 00 00       	call   0x4092ec
408f30:	6a 02                	push   $0x2
408f32:	bf 80 01 00 00       	mov    $0x180,%edi
408f37:	57                   	push   %edi
408f38:	89 45 d4             	mov    %eax,-0x2c(%ebp)
408f3b:	e8 ec 03 00 00       	call   0x40932c
408f40:	6a 01                	push   $0x1
408f42:	57                   	push   %edi
408f43:	89 45 dc             	mov    %eax,-0x24(%ebp)
408f46:	e8 e1 03 00 00       	call   0x40932c
408f4b:	6a 01                	push   $0x1
408f4d:	57                   	push   %edi
408f4e:	89 45 e4             	mov    %eax,-0x1c(%ebp)
408f51:	e8 d6 03 00 00       	call   0x40932c
408f56:	6a 01                	push   $0x1
408f58:	68 01 01 00 00       	push   $0x101
408f5d:	89 45 d8             	mov    %eax,-0x28(%ebp)
408f60:	e8 c7 03 00 00       	call   0x40932c
408f65:	83 c4 24             	add    $0x24,%esp
408f68:	39 5d d4             	cmp    %ebx,-0x2c(%ebp)
408f6b:	89 45 e0             	mov    %eax,-0x20(%ebp)
408f6e:	0f 84 71 02 00 00    	je     0x4091e5