406f2e:	ff 15 f8 f0 40 00    	call   *0x40f0f8
406f34:	8b d0                	mov    %eax,%edx
406f36:	89 45 f8             	mov    %eax,-0x8(%ebp)
406f39:	2b d3                	sub    %ebx,%edx
406f3b:	89 07                	mov    %eax,(%edi)
406f3d:	d1 fa                	sar    $1,%edx
406f3f:	8d 4a 01             	lea    0x1(%edx),%ecx
406f42:	8d 0c 4e             	lea    (%esi,%ecx,2),%ecx
406f45:	3b 4d fc             	cmp    -0x4(%ebp),%ecx
406f48:	73 39                	jae    0x406f83
406f4a:	85 d2                	test   %edx,%edx
406f4c:	7e 16                	jle    0x406f64
406f4e:	2b de                	sub    %esi,%ebx
406f50:	66 8b 04 33          	mov    (%ebx,%esi,1),%ax
406f54:	66 89 06             	mov    %ax,(%esi)
406f57:	83 c6 02             	add    $0x2,%esi
406f5a:	83 ea 01             	sub    $0x1,%edx
406f5d:	75 f1                	jne    0x406f50
406f5f:	8b 07                	mov    (%edi),%eax
406f61:	89 45 f8             	mov    %eax,-0x8(%ebp)
406f64:	0f b7 00             	movzwl (%eax),%eax
406f67:	33 d2                	xor    %edx,%edx
406f69:	8b 5d f8             	mov    -0x8(%ebp),%ebx
406f6c:	8b c8                	mov    %eax,%ecx
406f6e:	66 3b d0             	cmp    %ax,%dx
406f71:	74 02                	je     0x406f75
406f73:	eb a1                	jmp    0x406f16
406f75:	3b 75 fc             	cmp    -0x4(%ebp),%esi
406f78:	73 09                	jae    0x406f83
406f7a:	33 c0                	xor    %eax,%eax
406f7c:	66 89 06             	mov    %ax,(%esi)
406f7f:	33 c0                	xor    %eax,%eax
406f81:	eb 05                	jmp    0x406f88
406f83:	b8 09 00 02 80       	mov    $0x80020009,%eax
406f88:	5f                   	pop    %edi
406f89:	5e                   	pop    %esi
406f8a:	5b                   	pop    %ebx
406f8b:	c9                   	leave
406f8c:	c2 04 00             	ret    $0x4
406f8f:	8b ff                	mov    %edi,%edi
406f91:	55                   	push   %ebp
406f92:	8b ec                	mov    %esp,%ebp
406f94:	6a ff                	push   $0xffffffff
406f96:	68 2e a6 40 00       	push   $0x40a62e
406f9b:	64 a1 00 00 00 00    	mov    %fs:0x0,%eax
406fa1:	50                   	push   %eax
406fa2:	b8 58 22 00 00       	mov    $0x2258,%eax
406fa7:	e8 04 34 00 00       	call   0x40a3b0
406fac:	a1 e4 c1 40 00       	mov    0x40c1e4,%eax
406fb1:	33 c5                	xor    %ebp,%eax
406fb3:	89 45 f0             	mov    %eax,-0x10(%ebp)
406fb6:	53                   	push   %ebx
406fb7:	56                   	push   %esi
406fb8:	57                   	push   %edi
406fb9:	50                   	push   %eax
406fba:	8d 45 f4             	lea    -0xc(%ebp),%eax
406fbd:	64 a3 00 00 00 00    	mov    %eax,%fs:0x0
406fc3:	8b c1                	mov    %ecx,%eax
406fc5:	89 85 e0 dd ff ff    	mov    %eax,-0x2220(%ebp)
406fcb:	8b 4d 0c             	mov    0xc(%ebp),%ecx
406fce:	8b 7d 08             	mov    0x8(%ebp),%edi
406fd1:	89 8d dc dd ff ff    	mov    %ecx,-0x2224(%ebp)
406fd7:	33 c9                	xor    %ecx,%ecx
406fd9:	8b d9                	mov    %ecx,%ebx
406fdb:	89 8d c4 dd ff ff    	mov    %ecx,-0x223c(%ebp)
406fe1:	89 9d c8 dd ff ff    	mov    %ebx,-0x2238(%ebp)
406fe7:	89 8d cc dd ff ff    	mov    %ecx,-0x2234(%ebp)
406fed:	89 8d d0 dd ff ff    	mov    %ecx,-0x2230(%ebp)
406ff3:	89 4d fc             	mov    %ecx,-0x4(%ebp)
406ff6:	8b c8                	mov    %eax,%ecx
406ff8:	57                   	push   %edi
406ff9:	e8 37 fe ff ff       	call   0x406e35
406ffe:	8b f0                	mov    %eax,%esi
407000:	85 f6                	test   %esi,%esi
407002:	0f 88 0c 06 00 00    	js     0x407614
407008:	e9 c2 05 00 00       	jmp    0x4075cf
40700d:	68 c0 23 40 00       	push   $0x4023c0
407012:	57                   	push   %edi
407013:	c7 85 d8 dd ff ff 01 	movl   $0x1,-0x2228(%ebp)
40701a:	00 00 00
40701d:	ff 15 8c f0 40 00    	call   *0x40f08c
407023:	f7 d8                	neg    %eax
407025:	68 94 23 40 00       	push   $0x402394
40702a:	1b f6                	sbb    %esi,%esi
40702c:	46                   	inc    %esi
40702d:	57                   	push   %edi
40702e:	89 b5 e4 dd ff ff    	mov    %esi,-0x221c(%ebp)
407034:	ff 15 8c f0 40 00    	call   *0x40f08c
40703a:	85 c0                	test   %eax,%eax
40703c:	74 08                	je     0x407046
40703e:	85 f6                	test   %esi,%esi
407040:	0f 84 a0 00 00 00    	je     0x4070e6
407046:	8b 8d e0 dd ff ff    	mov    -0x2220(%ebp),%ecx
40704c:	57                   	push   %edi
40704d:	e8 e3 fd ff ff       	call   0x406e35
407052:	8b f0                	mov    %eax,%esi
407054:	85 f6                	test   %esi,%esi
407056:	0f 88 ad 05 00 00    	js     0x407609
40705c:	83 7d 10 00          	cmpl   $0x0,0x10(%ebp)
407060:	0f 84 80 00 00 00    	je     0x4070e6
407066:	33 c0                	xor    %eax,%eax
407068:	8b cf                	mov    %edi,%ecx
40706a:	6a 5c                	push   $0x5c
40706c:	5a                   	pop    %edx
40706d:	89 85 b8 dd ff ff    	mov    %eax,-0x2248(%ebp)
407073:	89 85 bc dd ff ff    	mov    %eax,-0x2244(%ebp)
407079:	89 85 c0 dd ff ff    	mov    %eax,-0x2240(%ebp)
40707f:	e8 67 f5 ff ff       	call   0x4065eb
407084:	85 c0                	test   %eax,%eax
407086:	0f 85 78 05 00 00    	jne    0x407604
40708c:	57                   	push   %edi
40708d:	e8 71 fb ff ff       	call   0x406c03
407092:	85 c0                	test   %eax,%eax
407094:	74 20                	je     0x4070b6
407096:	8b 85 dc dd ff ff    	mov    -0x2224(%ebp),%eax
40709c:	8d 8d b8 dd ff ff    	lea    -0x2248(%ebp),%ecx
4070a2:	57                   	push   %edi
4070a3:	89 85 b8 dd ff ff    	mov    %eax,-0x2248(%ebp)
4070a9:	e8 86 fb ff ff       	call   0x406c34
4070ae:	33 c0                	xor    %eax,%eax
4070b0:	89 85 b8 dd ff ff    	mov    %eax,-0x2248(%ebp)
4070b6:	83 bd e4 dd ff ff 00 	cmpl   $0x0,-0x221c(%ebp)
4070bd:	74 27                	je     0x4070e6
4070bf:	8b 8d e0 dd ff ff    	mov    -0x2220(%ebp),%ecx
4070c5:	57                   	push   %edi
4070c6:	e8 6a fd ff ff       	call   0x406e35
4070cb:	8b f0                	mov    %eax,%esi
4070cd:	85 f6                	test   %esi,%esi
4070cf:	0f 88 34 05 00 00    	js     0x407609
4070d5:	8b 8d e0 dd ff ff    	mov    -0x2220(%ebp),%ecx
4070db:	57                   	push   %edi
4070dc:	e8 bb fa ff ff       	call   0x406b9c
4070e1:	e9 81 02 00 00       	jmp    0x407367
4070e6:	68 ac 23 40 00       	push   $0x4023ac
4070eb:	57                   	push   %edi
4070ec:	ff 15 8c f0 40 00    	call   *0x40f08c
4070f2:	85 c0                	test   %eax,%eax
4070f4:	75 1c                	jne    0x407112
4070f6:	8b 8d e0 dd ff ff    	mov    -0x2220(%ebp),%ecx
4070fc:	57                   	push   %edi
4070fd:	89 85 d8 dd ff ff    	mov    %eax,-0x2228(%ebp)
407103:	e8 2d fd ff ff       	call   0x406e35
407108:	8b f0                	mov    %eax,%esi
40710a:	85 f6                	test   %esi,%esi
40710c:	0f 88 f7 04 00 00    	js     0x407609
407112:	68 8c 23 40 00       	push   $0x40238c
407117:	57                   	push   %edi
407118:	ff 15 8c f0 40 00    	call   *0x40f08c
40711e:	85 c0                	test   %eax,%eax
407120:	0f 85 1c 01 00 00    	jne    0x407242
407126:	8b 8d e0 dd ff ff    	mov    -0x2220(%ebp),%ecx
40712c:	8d 85 e8 dd ff ff    	lea    -0x2218(%ebp),%eax
407132:	50                   	push   %eax
407133:	e8 fd fc ff ff       	call   0x406e35
407138:	8b f0                	mov    %eax,%esi
40713a:	85 f6                	test   %esi,%esi
40713c:	0f 88 c7 04 00 00    	js     0x407609
407142:	8b 8d e0 dd ff ff    	mov    -0x2220(%ebp),%ecx
407148:	57                   	push   %edi
407149:	e8 e7 fc ff ff       	call   0x406e35
40714e:	8b f0                	mov    %eax,%esi
407150:	85 f6                	test   %esi,%esi
407152:	0f 88 b1 04 00 00    	js     0x407609
407158:	6a 3d                	push   $0x3d
40715a:	58                   	pop    %eax
40715b:	66 39 07             	cmp    %ax,(%edi)
40715e:	0f 85 a0 04 00 00    	jne    0x407604
407164:	83 7d 10 00          	cmpl   $0x0,0x10(%ebp)
407168:	74 52                	je     0x4071bc
40716a:	33 c0                	xor    %eax,%eax
40716c:	89 85 b0 dd ff ff    	mov    %eax,-0x2250(%ebp)
407172:	89 85 b4 dd ff ff    	mov    %eax,-0x224c(%ebp)
407178:	8b 85 dc dd ff ff    	mov    -0x2224(%ebp),%eax
40717e:	8b 8d e0 dd ff ff    	mov    -0x2220(%ebp),%ecx
407184:	c6 45 fc 01          	movb   $0x1,-0x4(%ebp)
407188:	89 85 ac dd ff ff    	mov    %eax,-0x2254(%ebp)
40718e:	8d 85 e8 dd ff ff    	lea    -0x2218(%ebp),%eax
407194:	57                   	push   %edi
407195:	50                   	push   %eax
407196:	8d 85 ac dd ff ff    	lea    -0x2254(%ebp),%eax
40719c:	50                   	push   %eax
40719d:	e8 06 f5 ff ff       	call   0x4066a8
4071a2:	8b f0                	mov    %eax,%esi
4071a4:	33 c0                	xor    %eax,%eax
4071a6:	89 85 ac dd ff ff    	mov    %eax,-0x2254(%ebp)
4071ac:	85 f6                	test   %esi,%esi
4071ae:	0f 88 55 04 00 00    	js     0x407609
4071b4:	88 45 fc             	mov    %al,-0x4(%ebp)
4071b7:	e9 b5 01 00 00       	jmp    0x407371
4071bc:	83 7d 14 00          	cmpl   $0x0,0x14(%ebp)
4071c0:	75 65                	jne    0x407227
4071c2:	83 bd d8 dd ff ff 00 	cmpl   $0x0,-0x2228(%ebp)
4071c9:	74 5c                	je     0x407227
4071cb:	8d 85 e4 dd ff ff    	lea    -0x221c(%ebp),%eax
4071d1:	33 c9                	xor    %ecx,%ecx
4071d3:	50                   	push   %eax
4071d4:	68 06 00 02 00       	push   $0x20006
4071d9:	51                   	push   %ecx
4071da:	51                   	push   %ecx
4071db:	ff b5 dc dd ff ff    	push   -0x2224(%ebp)
4071e1:	89 8d e4 dd ff ff    	mov    %ecx,-0x221c(%ebp)
4071e7:	ff 15 0c f0 40 00    	call   *0x40f00c
4071ed:	85 c0                	test   %eax,%eax
4071ef:	0f 85 04 04 00 00    	jne    0x4075f9
4071f5:	8b b5 e4 dd ff ff    	mov    -0x221c(%ebp),%esi
4071fb:	8d 85 e8 dd ff ff    	lea    -0x2218(%ebp),%eax
407201:	50                   	push   %eax
407202:	56                   	push   %esi
407203:	89 b5 d8 dd ff ff    	mov    %esi,-0x2228(%ebp)
407209:	ff 15 18 f0 40 00    	call   *0x40f018
40720f:	85 c0                	test   %eax,%eax
407211:	74 09                	je     0x40721c
407213:	83 f8 02             	cmp    $0x2,%eax
407216:	0f 85 c1 03 00 00    	jne    0x4075dd
40721c:	85 f6                	test   %esi,%esi
40721e:	74 07                	je     0x407227
407220:	56                   	push   %esi
407221:	ff 15 00 f0 40 00    	call   *0x40f000
407227:	8b 8d e0 dd ff ff    	mov    -0x2220(%ebp),%ecx
40722d:	57                   	push   %edi
40722e:	e8 69 f9 ff ff       	call   0x406b9c
407233:	8b f0                	mov    %eax,%esi
407235:	85 f6                	test   %esi,%esi
407237:	0f 88 cc 03 00 00    	js     0x407609
40723d:	e9 8d 03 00 00       	jmp    0x4075cf
407242:	6a 5c                	push   $0x5c
407244:	5a                   	pop    %edx
407245:	8b cf                	mov    %edi,%ecx
407247:	e8 9f f3 ff ff       	call   0x4065eb
40724c:	85 c0                	test   %eax,%eax
40724e:	0f 85 b0 03 00 00    	jne    0x407604
407254:	39 45 10             	cmp    %eax,0x10(%ebp)
407257:	0f 84 6f 01 00 00    	je     0x4073cc
40725d:	8b b5 dc dd ff ff    	mov    -0x2224(%ebp),%esi
407263:	8d 85 e4 dd ff ff    	lea    -0x221c(%ebp),%eax
407269:	50                   	push   %eax
40726a:	68 1f 00 02 00       	push   $0x2001f
40726f:	33 c9                	xor    %ecx,%ecx
407271:	51                   	push   %ecx
407272:	57                   	push   %edi
407273:	56                   	push   %esi
407274:	89 8d e4 dd ff ff    	mov    %ecx,-0x221c(%ebp)
40727a:	ff 15 0c f0 40 00    	call   *0x40f00c
407280:	85 c0                	test   %eax,%eax
407282:	75 1f                	jne    0x4072a3
407284:	85 db                	test   %ebx,%ebx
407286:	74 07                	je     0x40728f
407288:	53                   	push   %ebx
407289:	ff 15 00 f0 40 00    	call   *0x40f000
40728f:	8b 9d e4 dd ff ff    	mov    -0x221c(%ebp),%ebx
407295:	89 9d c8 dd ff ff    	mov    %ebx,-0x2238(%ebp)
40729b:	85 c0                	test   %eax,%eax
40729d:	0f 84 8a 00 00 00    	je     0x40732d
4072a3:	8d 85 e4 dd ff ff    	lea    -0x221c(%ebp),%eax
4072a9:	33 c9                	xor    %ecx,%ecx
4072ab:	50                   	push   %eax
4072ac:	68 19 00 02 00       	push   $0x20019
4072b1:	51                   	push   %ecx
4072b2:	57                   	push   %edi
4072b3:	56                   	push   %esi
4072b4:	89 8d e4 dd ff ff    	mov    %ecx,-0x221c(%ebp)
4072ba:	ff 15 0c f0 40 00    	call   *0x40f00c
4072c0:	85 c0                	test   %eax,%eax
4072c2:	75 1b                	jne    0x4072df
4072c4:	85 db                	test   %ebx,%ebx
4072c6:	74 07                	je     0x4072cf
4072c8:	53                   	push   %ebx
4072c9:	ff 15 00 f0 40 00    	call   *0x40f000
4072cf:	8b 9d e4 dd ff ff    	mov    -0x221c(%ebp),%ebx
4072d5:	89 9d c8 dd ff ff    	mov    %ebx,-0x2238(%ebp)
4072db:	85 c0                	test   %eax,%eax
4072dd:	74 4e                	je     0x40732d
4072df:	8d 85 9c dd ff ff    	lea    -0x2264(%ebp),%eax
4072e5:	33 c9                	xor    %ecx,%ecx
4072e7:	50                   	push   %eax
4072e8:	8d 85 e4 dd ff ff    	lea    -0x221c(%ebp),%eax
4072ee:	89 8d e4 dd ff ff    	mov    %ecx,-0x221c(%ebp)
4072f4:	50                   	push   %eax
4072f5:	51                   	push   %ecx
4072f6:	68 1f 00 02 00       	push   $0x2001f
4072fb:	51                   	push   %ecx
4072fc:	51                   	push   %ecx
4072fd:	51                   	push   %ecx
4072fe:	57                   	push   %edi
4072ff:	56                   	push   %esi
407300:	ff 15 14 f0 40 00    	call   *0x40f014
407306:	85 c0                	test   %eax,%eax
407308:	0f 85 eb 02 00 00    	jne    0x4075f9
40730e:	85 db                	test   %ebx,%ebx
407310:	74 07                	je     0x407319
407312:	53                   	push   %ebx
407313:	ff 15 00 f0 40 00    	call   *0x40f000
407319:	8b 9d e4 dd ff ff    	mov    -0x221c(%ebp),%ebx
40731f:	89 9d c8 dd ff ff    	mov    %ebx,-0x2238(%ebp)
407325:	85 c0                	test   %eax,%eax
407327:	0f 85 cc 02 00 00    	jne    0x4075f9
40732d:	8b 8d e0 dd ff ff    	mov    -0x2220(%ebp),%ecx
407333:	57                   	push   %edi
407334:	e8 fc fa ff ff       	call   0x406e35
407339:	8b f0                	mov    %eax,%esi
40733b:	85 f6                	test   %esi,%esi
40733d:	0f 88 c6 02 00 00    	js     0x407609
407343:	6a 3d                	push   $0x3d
407345:	58                   	pop    %eax
407346:	66 39 07             	cmp    %ax,(%edi)
407349:	75 26                	jne    0x407371
40734b:	8b 8d e0 dd ff ff    	mov    -0x2220(%ebp),%ecx
407351:	33 c0                	xor    %eax,%eax
407353:	57                   	push   %edi
407354:	50                   	push   %eax
407355:	8d 85 c8 dd ff ff    	lea    -0x2238(%ebp),%eax
40735b:	50                   	push   %eax
40735c:	e8 47 f3 ff ff       	call   0x4066a8
407361:	8b 9d c8 dd ff ff    	mov    -0x2238(%ebp),%ebx
407367:	8b f0                	mov    %eax,%esi
407369:	85 f6                	test   %esi,%esi
40736b:	0f 88 98 02 00 00    	js     0x407609
407371:	6a 7b                	push   $0x7b
407373:	58                   	pop    %eax
407374:	66 39 07             	cmp    %ax,(%edi)
407377:	0f 85 52 02 00 00    	jne    0x4075cf
40737d:	8b cf                	mov    %edi,%ecx
40737f:	8d 51 02             	lea    0x2(%ecx),%edx
407382:	66 8b 01             	mov    (%ecx),%ax
407385:	83 c1 02             	add    $0x2,%ecx
407388:	66 3b 85 c4 dd ff ff 	cmp    -0x223c(%ebp),%ax
40738f:	75 f1                	jne    0x407382
407391:	2b ca                	sub    %edx,%ecx
407393:	d1 f9                	sar    $1,%ecx
407395:	83 f9 01             	cmp    $0x1,%ecx
407398:	0f 85 31 02 00 00    	jne    0x4075cf
40739e:	8b 8d e0 dd ff ff    	mov    -0x2220(%ebp),%ecx
4073a4:	33 c0                	xor    %eax,%eax
4073a6:	50                   	push   %eax
4073a7:	ff 75 10             	push   0x10(%ebp)
4073aa:	53                   	push   %ebx
4073ab:	57                   	push   %edi
4073ac:	e8 de fb ff ff       	call   0x406f8f
4073b1:	8b f0                	mov    %eax,%esi
4073b3:	85 f6                	test   %esi,%esi
4073b5:	0f 88 4e 02 00 00    	js     0x407609
4073bb:	8b 8d e0 dd ff ff    	mov    -0x2220(%ebp),%ecx
4073c1:	57                   	push   %edi
4073c2:	e8 6e fa ff ff       	call   0x406e35
4073c7:	e9 67 fe ff ff       	jmp    0x407233
4073cc:	8b 75 14             	mov    0x14(%ebp),%esi
4073cf:	85 f6                	test   %esi,%esi
4073d1:	75 51                	jne    0x407424
4073d3:	8d 85 e4 dd ff ff    	lea    -0x221c(%ebp),%eax
4073d9:	33 c9                	xor    %ecx,%ecx