Function at 0x40d070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xac
mov ecx, dword [esp + 0xc8]
mov edi, dword [esp + 0xd0]
mov esi, dword [esp + 0xc0]
cmp ecx, edi
jne 0x40f520
lea ebx, [ecx - 1]
mov dword [esp + 0x84], 3
sar ebx, 3
mov dword [esp + 0x88], 1
add ebx, 1
mov dword [esp + 0x8c], 0
lea edx, [ebx*8]
mov eax, ebx
mov dword [esp + 0x64], ebx
sub eax, edx
mov dword [esp + 0x58], 7
lea edx, [eax + ecx]
add eax, edi
mov dword [esp + 0x90], 2
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], eax
mov dword [esp + 0x94], 0
mov dword [esp + 0x5c], 7
mov dword [esp + 0x68], 0
mov dword [esp + 0x9c], 7
mov dword [esp + 0x98], 7
mov edx, dword [esp + 0x64]
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 3
imul ebp, edx, 0x34
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0xc4]
imul eax, edx, 0x2c
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x5c]
lea edi, [esi + ebp + 8]
add eax, esi
mov dword [esp + 8], ecx
mov dword [esp], edi
mov dword [esp + 4], eax
mov dword [esp + 0x48], edi
mov dword [esp + 0x3c], eax
call fcn.004107a0
mov edx, dword [esp + 0x64]
mov dword [esp + 0x1c], esi
mov edi, eax
mov dword [esp + 0x18], 3
lea ecx, [edx + edx*2]
mov edx, dword [esp + 0xd4]
mov dword [esp + 0x10], ebx
mov eax, ecx
mov dword [esp + 0x60], ecx
shl eax, 4
lea ecx, [esi + eax + 4]
lea eax, [edx + eax + 0x10]
mov edx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0xcc]
mov dword [esp], eax
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0x4c], ecx
mov dword [esp + 8], edx
mov dword [esp + 0x40], eax
call fcn.004107a0
mov ecx, dword [esp + 0xd4]
mov edx, dword [esp + 0x64]
xor edi, eax
lea ebp, [ecx + ebp + 0x14]
mov eax, ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x44], ebp
lea ebp, [ebx + 1]
lea eax, [eax + ecx*4 + 4]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0xd4]
lea ecx, [eax + ecx*8 + 8]
lea eax, [edx + edx*8]
mov dword [esp + 0x70], ecx
mov ecx, dword [esp + 0xd4]
lea ecx, [ecx + eax*4 + 0xc]
mov eax, edx
mov dword [esp + 0x6c], ecx
mov ecx, dword [esp + 0x3c]
shl eax, 5
sub ecx, eax
mov eax, edx
shl eax, 4
mov dword [esp + 0x80], ecx
add eax, ecx
mov dword [esp + 0x78], eax
lea eax, [ebx + ebx]
lea edx, [eax + 1]
add eax, 2
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x60], edx
mov dword [esp + 0x14], eax
cmp ebx, 0x48
jle 0x40e0d8
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], ebp
mov dword [esp], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
cmp ebx, 0xb3
jle 0x40d9c0
cmp ebx, 0xfa
jle 0x40ee60
cmp ebx, 0x169
jg 0x40e7a0
call fcn.0040bad0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0xd4]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.0040bad0
mov eax, dword [esp + 0x8c]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 4], edi
mov edi, dword [esp + 0xd4]
mov dword [esp + 0x14], eax
mov dword [esp], edi
mov dword [esp + 8], esi
call fcn.0040f880
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x1c], esi
mov ecx, dword [esp + 0xc4]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], ecx
mov dword [esp], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
call fcn.004107a0
mov edx, dword [esp + 0xcc]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 2
mov edi, eax
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], ebx
call fcn.004107a0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.0040bad0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x74]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.0040bad0
mov ecx, dword [esp + 0x94]
mov eax, dword [esp + 0x74]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x90]
mov dword [esp + 4], edi
mov dword [esp + 0x14], ecx
mov dword [esp], eax
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.004100c0
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov edi, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0xcc]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.004100c0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.0040bad0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x70]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.0040bad0
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x18], 2
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 3
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
call fcn.00410440
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 3
mov edi, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0xcc]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 0x10], ebx
call fcn.00410440
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.0040bad0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x6c]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.0040bad0
mov eax, dword [esp + 0x7c]
mov dword [esp + 0xc], edi
mov dword [esp + 0x18], 6
mov dword [esp + 4], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], 3
mov dword [esp], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
call fcn.004107a0
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x1c], esi
mov edi, eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
call fcn.004107a0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.0040bad0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x80]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.0040bad0
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x80]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x88]
mov dword [esp + 4], edi
mov dword [esp + 0x14], ecx
mov dword [esp], eax
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0040fda0
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov edi, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0xcc]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.0040fda0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 4], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
call fcn.0040bad0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0xc], edx
mov dword [esp], ecx
call fcn.0040bad0
mov ecx, dword [esp + 0x78]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x18], 0
mov dword [esp], ecx
mov dword [esp + 4], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
call fcn.0040f880
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0xc4]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x5c]
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov edi, dword [esp + 0x48]
mov dword [esp], edi
call fcn.00410440
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x1c], esi
mov edi, eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x18], 2
mov dword [esp + 4], ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.00410440
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.0040bad0
mov edx, dword [esp + 0x44]
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ebp
mov ecx, dword [esp + 0x48]
mov ebp, dword [esp + 0x3c]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp], ebp
mov dword [esp + 0xc], edx
call fcn.0040bad0
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x18], 4
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ebp
call fcn.0040f880
cmp ebx, 0xfb
je 0x40f4e8
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xcc]
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc4]
mov dword [esp + 4], eax
call fcn.0040bad0
mov eax, dword [esp + 0x68]
test eax, eax
je 0x40e07f
lea esi, [esi]
nop
mov eax, dword [esp + 0x98]
mov edi, dword [esp + 0xc4]
mov ebp, dword [esp + 0x54]
imul eax, ebx
lea ecx, [edi + eax*4]
mov eax, dword [esp + 0x9c]
mov edi, dword [esp + 0xcc]
imul eax, ebx
lea edx, [edi + eax*4]
mov eax, dword [esp + 0x64]
mov edi, dword [esp + 0x50]
shl eax, 5
add eax, dword [esp + 0x78]
cmp edi, ebp
jle 0x40f640
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00404360
jmp 0x40e07f
call fcn.00409020
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0xd4]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.00409020
mov eax, dword [esp + 0x8c]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 4], edi
mov edi, dword [esp + 0xd4]
mov dword [esp + 0x14], eax
mov dword [esp], edi
mov dword [esp + 8], esi
call fcn.0040f880
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x1c], esi
mov ecx, dword [esp + 0xc4]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], ecx
mov dword [esp], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
call fcn.004107a0
mov edx, dword [esp + 0xcc]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 2
mov edi, eax
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], ebx
call fcn.004107a0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.00409020
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x74]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.00409020
mov ecx, dword [esp + 0x94]
mov eax, dword [esp + 0x74]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x90]
mov dword [esp + 4], edi
mov dword [esp + 0x14], ecx
mov dword [esp], eax
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.004100c0
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov edi, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0xcc]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.004100c0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.00409020
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x70]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.00409020
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x18], 2
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 3
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
call fcn.00410440
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 3
mov edi, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0xcc]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 0x10], ebx
call fcn.00410440
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.00409020
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x6c]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.00409020
mov eax, dword [esp + 0x7c]
mov dword [esp + 0xc], edi
mov dword [esp + 0x18], 6
mov dword [esp + 4], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], 3
mov dword [esp], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
call fcn.004107a0
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x1c], esi
mov edi, eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
call fcn.004107a0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.00409020
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x80]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.00409020
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x80]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x88]
mov dword [esp + 4], edi
mov dword [esp + 0x14], ecx
mov dword [esp], eax
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0040fda0
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov edi, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0xcc]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.0040fda0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 4], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
call fcn.00409020
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0xc], edx
mov dword [esp], ecx
call fcn.00409020
mov ecx, dword [esp + 0x78]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x18], 0
mov dword [esp], ecx
mov dword [esp + 4], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
call fcn.0040f880
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0xc4]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x5c]
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov edi, dword [esp + 0x48]
mov dword [esp], edi
call fcn.00410440
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x1c], esi
mov edi, eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x18], 2
mov dword [esp + 4], ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.00410440
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.00409020
mov edx, dword [esp + 0x44]
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ebp
mov ecx, dword [esp + 0x48]
mov ebp, dword [esp + 0x3c]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp], ebp
mov dword [esp + 0xc], edx
call fcn.00409020
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x18], 4
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ebp
call fcn.0040f880
cmp ebx, 0x49
je 0x40e76b
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xcc]
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc4]
mov dword [esp + 4], eax
call fcn.00409020
mov eax, dword [esp + 0x68]
test eax, eax
jne 0x40d960
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x14], ebx
add ecx, dword [esp + 0x54]
mov dword [esp], esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 4], eax
call fcn.00412a70
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], ebp
mov dword [esp], esi
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call fcn.00407650
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0xd4]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp], eax
call fcn.00407650
mov eax, dword [esp + 0x8c]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 4], edi
mov edi, dword [esp + 0xd4]
mov dword [esp + 0x14], eax
mov dword [esp], edi
mov dword [esp + 8], esi
call fcn.0040f880
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x1c], esi
mov edx, dword [esp + 0xc4]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], edx
mov dword [esp], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
call fcn.004107a0
mov ecx, dword [esp + 0xcc]
mov edx, dword [esp + 0x54]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 2
mov edi, eax
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], edx
mov dword [esp], ecx
mov dword [esp + 0x10], ebx
call fcn.004107a0
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.00407650
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x74]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp], eax
call fcn.00407650
mov edx, dword [esp + 0x94]
mov eax, dword [esp + 0x74]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x90]
mov dword [esp + 4], edi
mov dword [esp + 0x14], edx
mov dword [esp], eax
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.004100c0
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov edi, eax
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0xcc]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x4c]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.004100c0
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.00407650
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x70]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp], eax
call fcn.00407650
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x18], 2
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 3
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
call fcn.00410440
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 3
mov edi, eax
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0xcc]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x4c]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 0x10], ebx
call fcn.00410440
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.00407650
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x6c]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp], eax
call fcn.00407650
mov eax, dword [esp + 0x7c]
mov dword [esp + 0xc], edi
mov dword [esp + 0x18], 6
mov dword [esp + 4], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], 3
mov dword [esp], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
call fcn.004107a0
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x1c], esi
mov edi, eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], edx
mov dword [esp], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
call fcn.004107a0
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.00407650
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x80]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp], eax
call fcn.00407650
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x80]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x88]
mov dword [esp + 4], edi
mov dword [esp + 0x14], edx
mov dword [esp], eax
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0040fda0
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov edi, eax
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0xcc]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x4c]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.0040fda0
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 4], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebp
call fcn.00407650
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ebp
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x78]
mov dword [esp + 0xc], ecx
mov dword [esp], edx
call fcn.00407650
mov edx, dword [esp + 0x78]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x18], 0
mov dword [esp], edx
mov dword [esp + 4], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
call fcn.0040f880
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0xc4]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x5c]
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov edi, dword [esp + 0x48]
mov dword [esp], edi
call fcn.00410440
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x1c], esi
mov edi, eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x18], 2
mov dword [esp + 4], edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.00410440
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.00407650
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ebp
mov edx, dword [esp + 0x48]
mov ebp, dword [esp + 0x3c]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], edx
mov dword [esp], ebp
mov dword [esp + 0xc], ecx
call fcn.00407650
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x18], 4
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ebp
call fcn.0040f880
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xcc]
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc4]
mov dword [esp + 4], eax
call fcn.00407650
jmp 0x40e073
call fcn.0040d070
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0xd4]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.0040d070
mov eax, dword [esp + 0x8c]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 4], edi
mov edi, dword [esp + 0xd4]
mov dword [esp + 0x14], eax
mov dword [esp], edi
mov dword [esp + 8], esi
call fcn.0040f880
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x1c], esi
mov ecx, dword [esp + 0xc4]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], ecx
mov dword [esp], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
call fcn.004107a0
mov edx, dword [esp + 0xcc]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 2
mov edi, eax
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], ebx
call fcn.004107a0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.0040d070
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x74]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.0040d070
mov ecx, dword [esp + 0x94]
mov eax, dword [esp + 0x74]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x90]
mov dword [esp + 4], edi
mov dword [esp + 0x14], ecx
mov dword [esp], eax
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.004100c0
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov edi, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0xcc]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.004100c0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.0040d070
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x70]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.0040d070
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x18], 2
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 3
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
call fcn.00410440
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 3
mov edi, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0xcc]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 0x10], ebx
call fcn.00410440
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.0040d070
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x6c]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.0040d070
mov eax, dword [esp + 0x7c]
mov dword [esp + 0xc], edi
mov dword [esp + 0x18], 6
mov dword [esp + 4], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], 3
mov dword [esp], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
call fcn.004107a0
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x1c], esi
mov edi, eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
call fcn.004107a0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.0040d070
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x80]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.0040d070
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x80]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x88]
mov dword [esp + 4], edi
mov dword [esp + 0x14], ecx
mov dword [esp], eax
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0040fda0
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov edi, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0xcc]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.0040fda0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 4], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
call fcn.0040d070
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0xc], edx
mov dword [esp], ecx
call fcn.0040d070
mov ecx, dword [esp + 0x78]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x18], 0
mov dword [esp], ecx
mov dword [esp + 4], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
call fcn.0040f880
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0xc4]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x5c]
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov edi, dword [esp + 0x48]
mov dword [esp], edi
call fcn.00410440
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x1c], esi
mov edi, eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x18], 2
mov dword [esp + 4], ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.00410440
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.0040d070
mov edx, dword [esp + 0x44]
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ebp
mov ecx, dword [esp + 0x48]
mov ebp, dword [esp + 0x3c]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp], ebp
mov dword [esp + 0xc], edx
call fcn.0040d070
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x18], 4
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ebp
call fcn.0040f880
cmp ebx, 0x16a
je 0x40d91d
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xcc]
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc4]
mov dword [esp + 4], eax
call fcn.0040d070
jmp 0x40e073
call fcn.0040b350
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0xd4]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.0040b350
mov eax, dword [esp + 0x8c]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 4], edi
mov edi, dword [esp + 0xd4]
mov dword [esp + 0x14], eax
mov dword [esp], edi
mov dword [esp + 8], esi
call fcn.0040f880
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x1c], esi
mov ecx, dword [esp + 0xc4]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], ecx
mov dword [esp], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
call fcn.004107a0
mov edx, dword [esp + 0xcc]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 2
mov edi, eax
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], ebx
call fcn.004107a0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.0040b350
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x74]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.0040b350
mov ecx, dword [esp + 0x94]
mov eax, dword [esp + 0x74]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x90]
mov dword [esp + 4], edi
mov dword [esp + 0x14], ecx
mov dword [esp], eax
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.004100c0
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov edi, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0xcc]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.004100c0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.0040b350
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x70]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.0040b350
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x18], 2
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 3
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
call fcn.00410440
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 3
mov edi, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0xcc]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 0x10], ebx
call fcn.00410440
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.0040b350
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x6c]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.0040b350
mov eax, dword [esp + 0x7c]
mov dword [esp + 0xc], edi
mov dword [esp + 0x18], 6
mov dword [esp + 4], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], 3
mov dword [esp], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
call fcn.004107a0
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x1c], esi
mov edi, eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
call fcn.004107a0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.0040b350
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x80]
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.0040b350
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x80]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x88]
mov dword [esp + 4], edi
mov dword [esp + 0x14], ecx
mov dword [esp], eax
mov dword [esp + 8], esi
call fcn.0040f880
mov eax, dword [esp + 0xc4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0040fda0
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov edi, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0xcc]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.0040fda0
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 4], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
call fcn.0040b350
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ebp
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0xc], edx
mov dword [esp], ecx
call fcn.0040b350
mov ecx, dword [esp + 0x78]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x18], 0
mov dword [esp], ecx
mov dword [esp + 4], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
call fcn.0040f880
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0xc4]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x5c]
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov edi, dword [esp + 0x48]
mov dword [esp], edi
call fcn.00410440
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x1c], esi
mov edi, eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x18], 2
mov dword [esp + 4], ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.00410440
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov dword [esp], esi
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
call fcn.0040b350
mov edx, dword [esp + 0x44]
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ebp
mov ecx, dword [esp + 0x48]
mov ebp, dword [esp + 0x3c]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov dword [esp], ebp
mov dword [esp + 0xc], edx
call fcn.0040b350
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x18], 4
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ebp
call fcn.0040f880
cmp ebx, 0xb4
je 0x40e045
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xcc]
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc4]
mov dword [esp + 4], eax
call fcn.0040b350
jmp 0x40e073
lea ebp, [ecx*4]
lea eax, [ebp + ecx]
mov dword [esp + 0x3c], eax
lea edx, [eax + eax]
mov eax, edi
sar eax, 1
lea ebx, [eax + eax*4]
lea ebx, [eax + ebx*4]
cmp edx, ebx
jl 0x40d097
lea ebx, [ecx + ecx*2]
mov dword [esp + 0x44], ebx
lea ebx, [ecx + ebx*4]
mov dword [esp + 0x40], ebx
mov ebx, edi
shl ebx, 4
cmp dword [esp + 0x40], ebx
jl 0x40f668
lea ebx, [eax + eax*2]
lea ebx, [ebx + ebx*8]
cmp edx, ebx
jge 0x40f730
mov dword [esp + 0x68], 0
lea edx, [ecx*8]
mov ebp, 9
mov dword [esp + 0x9c], 6
sub edx, ecx
mov dword [esp + 0x98], 8
mov dword [esp + 0x3c], 7
mov eax, edi
imul eax, ebp
cmp eax, edx
jg 0x40f710
lea eax, [ecx - 1]
xor edx, edx
div ebp
add eax, 1
mov dword [esp + 0x64], eax
mov ebx, eax
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x98]
imul eax, edx
sub ecx, eax
mov eax, edx
mov edx, dword [esp + 0x9c]
mov dword [esp + 0x50], ecx
imul eax, edx
sub edi, eax
mov dword [esp + 0x54], edi
mov edi, dword [esp + 0x68]
test edi, edi
jne 0x40f6a0
mov eax, dword [esp + 0x98]
mov dword [esp + 0x58], edx
mov dword [esp + 0x8c], 0
mov dword [esp + 0x5c], eax
mov dword [esp + 0x94], 0
mov dword [esp + 0x84], 3
mov dword [esp + 0x88], 1
mov dword [esp + 0x90], 2
jmp 0x40d121
mov edi, dword [esp + 0x50]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x54]
mov dword [esp], eax
mov dword [esp + 8], edi
call fcn.00404360
jmp 0x40e07f
mov dword [esp + 0x68], 1
lea edx, [ecx*8]
mov ebp, 9
mov dword [esp + 0x9c], 7
mov dword [esp + 0x98], 8
mov dword [esp + 0x3c], 8
jmp 0x40f5a3
mov ecx, dword [esp + 0x50]
test ecx, ecx
jle 0x40f7f6
mov eax, dword [esp + 0x98]
mov edx, dword [esp + 0x54]
mov dword [esp + 0x5c], eax
test edx, edx
jle 0x40f85b
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x84], 6
mov dword [esp + 0x88], 2
mov dword [esp + 0x58], eax
mov dword [esp + 0x8c], 3
mov dword [esp + 0x90], 4
mov dword [esp + 0x94], 2
jmp 0x40d121
lea eax, [edi - 1]
xor edx, edx
div dword [esp + 0x3c]
add eax, 1
mov dword [esp + 0x64], eax
mov ebx, eax
jmp 0x40f5c0
mov ebx, eax
shl ebx, 5
add eax, ebx
cmp edx, eax
jge 0x40f774
lea edx, [ecx*8]
mov ebp, 0xa
mov dword [esp + 0x68], 1
mov dword [esp + 0x9c], 6
sub edx, ecx
mov dword [esp + 0x98], 9
mov dword [esp + 0x3c], 7
jmp 0x40f5a3
mov ebx, dword [esp + 0x44]
lea eax, [edi*8]
sub eax, edi
add ebx, ebx
mov edx, ebx
cmp ebp, eax
jl 0x40f7c6
lea eax, [edi + edi*2]
mov ebp, 0xb
mov dword [esp + 0x98], 0xa
lea eax, [edi + eax*4]
cmp eax, ebx
cmovle edx, dword [esp + 0x3c]
setg al
movzx eax, al
lea ebx, [eax + 4]
mov dword [esp + 0x68], eax
add eax, 5
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x3c], eax
jmp 0x40f5a3
mov dword [esp + 0x68], 0
mov ebp, 0xa
mov dword [esp + 0x9c], 5
mov dword [esp + 0x98], 9
mov dword [esp + 0x3c], 6
jmp 0x40f5a3
mov edx, dword [esp + 0x64]
add dword [esp + 0x50], edx
lea eax, [ebp - 2]
mov dword [esp + 0x98], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x84], 3
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 2
mov dword [esp + 0x94], 0
mov dword [esp + 0x68], 0
jmp 0x40d121
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x64]
add dword [esp + 0x54], edx
sub eax, 2
mov dword [esp + 0x9c], eax
jmp 0x40f813