Function at 0x41a660
Capabilities:
Check for time delay via gettickcount
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x481189
push eax
mov eax, 0x204cc
mov dword fs:[0], esp
call fcn.0045c650
mov eax, dword [ebp + 0x1c]
push ebx
push esi
mov esi, dword [ebp + 0x18]
push edi
push eax
mov edi, ecx
push esi
call fcn.0041a180
mov ecx, dword [edi + 0x1c]
test esi, esi
mov edx, dword [ecx]
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x34], edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x38], eax
mov edx, dword [ecx + 8]
mov dword [esp + 0x3c], edx
mov ebx, dword [ecx + 0xc]
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0x408f4000
je 0x41a6ce
mov dword [esi], 0
mov eax, dword [ebp + 0x1c]
xor ecx, ecx
cmp eax, ecx
je 0x41a6da
mov dword [esi + 4], ecx
mov eax, dword [edi + 8]
add eax, 0xfffffffc
cmp eax, 0x53
ja case.default.0x41a6e9
jmp dword [eax*4 + 0x423b8c]
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], ecx
sub ebx, eax
mov eax, ebx
mov dword [esp + 0x14], ebx
cdq
and edx, 0xf
add eax, edx
sar eax, 4
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x41a779
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
cmp ebx, dword [esp + 0x14]
jge 0x41a75a
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
mov edx, dword [edi + 0x10]
sub eax, ecx
mov ecx, dword [esi + 4]
add ecx, ebx
test edx, edx
je 0x41a73d
mov edx, dword [edx + 4]
push 0xcc0020
push ebx
push 0
push edx
push 1
push eax
mov eax, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
push eax
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov eax, dword [esp + 0x1c]
add ebx, 0x10
dec eax
mov dword [esp + 0x1c], eax
jne 0x41a71e
mov eax, dword [esp + 0xc]
inc eax
cmp eax, 0x10
mov dword [esp + 0xc], eax
jl 0x41a70e
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
sub eax, edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], eax
cdq
and edx, 0xf
add eax, edx
sar eax, 4
inc eax
mov dword [esp + 0x28], eax
test eax, eax
jle 0x41a84b
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], eax
jmp 0x41a7d4
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x18]
jge 0x41a81c
mov edx, dword [edi + 0x10]
add ecx, dword [esi]
mov eax, ebx
sub eax, dword [esp + 0x38]
test edx, edx
jne 0x41a7ef
mov dword [esp + 0x10], edx
jmp 0x41a7f6
mov edx, dword [edx + 4]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x1c]
push 0xcc0020
push 0
push edx
mov edx, dword [esp + 0x1c]
push edx
push eax
mov eax, dword [esi + 4]
push 1
push eax
mov eax, dword [ebp + 8]
push ecx
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
add ecx, 0x10
dec eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], eax
jne 0x41a7d0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
inc ecx
cmp ecx, 0x10
mov dword [esp + 0x24], ecx
jl 0x41a7be
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
mov edx, dword [edi + 0x10]
sub eax, ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 4]
add eax, ecx
mov ecx, dword [esi]
add ecx, dword [esp + 0x30]
test edx, edx
jne 0x41a8ae
mov dword [esp + 0x10], edx
jmp 0x41a8b5
mov edx, dword [edx + 4]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x30]
push 0xcc0020
push edx
push edx
mov edx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x2c]
push 1
push edx
push eax
mov eax, dword [ebp + 8]
push ecx
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x48]
test eax, eax
jge 0x41a93a
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
mov ecx, ebx
sub ecx, edx
sub ecx, eax
mov eax, ebx
sub eax, edx
mov edx, dword [esp + 0x30]
sub eax, edx
mov edx, dword [esi + 4]
add eax, edx
mov edx, dword [esi]
add edx, dword [esp + 0x30]
mov dword [esp + 0x28], edx
mov edx, dword [edi + 0x10]
test edx, edx
je 0x41a914
mov edx, dword [edx + 4]
push 0xcc0020
push ecx
mov ecx, dword [esp + 0x38]
push ecx
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [esp + 0x2c]
push 1
push edx
mov edx, dword [ecx + 4]
push eax
mov eax, dword [esp + 0x44]
push eax
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x38]
mov eax, ebx
sub eax, ecx
mov ecx, dword [esp + 0x48]
mov edx, dword [edi + 0x10]
add eax, ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 4]
add eax, ecx
mov ecx, dword [esi]
add ecx, dword [esp + 0x30]
test edx, edx
jne 0x41a968
mov dword [esp + 0x10], edx
jmp 0x41a96f
mov edx, dword [edx + 4]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x30]
push 0xcc0020
push edx
push edx
mov edx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
push edx
push 1
push eax
mov eax, dword [ebp + 8]
push ecx
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x48]
test eax, eax
jge 0x41a9ff
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0xc]
sub eax, ecx
mov ecx, dword [esi + 4]
inc edx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x30]
add ecx, edx
mov edx, eax
add edx, dword [esi]
mov dword [esp + 0x64], edx
mov edx, dword [edi + 0x10]
test edx, edx
jne 0x41a9ce
mov dword [esp + 0x10], edx
jmp 0x41a9d5
mov edx, dword [edx + 4]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x30]
push 0xcc0020
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x74]
push edx
push 1
push ecx
mov ecx, dword [ebp + 8]
push eax
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0xc]
mov eax, 1
cmp ecx, eax
jl case.default.0x41a6e9
cmp dword [esp + 0x1c], eax
jl case.default.0x41a6e9
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x48]
inc ecx
dec eax
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
mov eax, 2
sub edx, eax
sub ecx, eax
mov dword [esp + 0x48], edx
mov dword [esp + 0x2c], ecx
jmp 0x41a884
mov edx, dword [esp + 0x38]
mov eax, ebx
sub eax, edx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
cdq
sub eax, edx
mov edx, dword [esp + 0x34]
sar eax, 1
mov dword [esp + 0x30], eax
mov eax, ecx
sub eax, edx
cdq
sub eax, edx
mov edx, ecx
sar eax, 1
sub edx, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x1c], edx
lea edx, [eax + eax]
sub ecx, edx
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x34]
mov edx, dword [edi + 0x10]
sub eax, ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 4]
add eax, ecx
mov ecx, dword [esi]
add ecx, dword [esp + 0x44]
test edx, edx
jne 0x41aac0
mov dword [esp + 0x10], edx
jmp 0x41aac7
mov edx, dword [edx + 4]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x30]
push 0xcc0020
push edx
mov edx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x34]
push 1
push edx
push eax
mov eax, dword [ebp + 8]
push ecx
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x30]
test eax, eax
jle 0x41ab48
mov ecx, dword [esp + 0x14]
mov edx, eax
mov eax, ebx
sub ecx, edx
sub eax, dword [esp + 0x38]
sub eax, edx
mov edx, dword [esi + 4]
add eax, edx
mov edx, dword [esi]
add edx, dword [esp + 0x44]
mov dword [esp + 0x28], edx
mov edx, dword [edi + 0x10]
test edx, edx
je 0x41ab22
mov edx, dword [edx + 4]
push 0xcc0020
push ecx
mov ecx, dword [esp + 0x4c]
push ecx
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [esp + 0x34]
push 1
push edx
mov edx, dword [ecx + 4]
push eax
mov eax, dword [esp + 0x44]
push eax
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x30]
mov edx, dword [edi + 0x10]
lea ecx, [eax + eax]
mov eax, ebx
sub eax, ecx
mov ecx, dword [esp + 0x38]
sub eax, ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 4]
add eax, ecx
mov ecx, dword [esi]
add ecx, dword [esp + 0x44]
test edx, edx
jne 0x41ab79
mov dword [esp + 0x10], edx
jmp 0x41ab80
mov edx, dword [edx + 4]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x30]
push 0xcc0020
push edx
mov edx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x34]
push edx
push 1
push eax
mov eax, dword [ebp + 8]
push ecx
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x44]
test eax, eax
jle 0x41ac2b
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
lea eax, [edx + 1]
mov dword [esp + 0x24], eax
lea edx, [eax + ecx]
mov eax, dword [esp + 0x14]
cmp edx, eax
jle 0x41abd2
sub eax, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
sub eax, ecx
mov ecx, dword [esi + 4]
add ecx, edx
mov edx, eax
add edx, dword [esi]
mov dword [esp + 0x28], edx
mov edx, dword [edi + 0x10]
test edx, edx
jne 0x41abfa
mov dword [esp + 0x10], edx
jmp 0x41ac01
mov edx, dword [edx + 4]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x30]
push 0xcc0020
push edx
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x38]
push edx
push 1
push ecx
mov ecx, dword [ebp + 8]
push eax
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x41ac3f
mov eax, dword [esp + 0x44]
test eax, eax
je case.default.0x41a6e9
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov eax, dword [esp + 0x44]
test eax, eax
jle 0x41ac73
mov ecx, dword [esp + 0xc]
mov edx, eax
mov eax, dword [esp + 0x1c]
dec edx
add ecx, 2
inc eax
mov dword [esp + 0x44], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x30]
test eax, eax
jle 0x41aa96
dec eax
mov dword [esp + 0x30], eax
jmp 0x41aa96
mov edx, dword [esp + 0x38]
mov eax, ebx
sub eax, edx
push 0x10
push eax
mov dword [esp + 0x1c], eax
call fcn.0045c84d
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x5c], edx
mov edx, dword [esp + 0x3c]
sub eax, edx
push 0x10
push eax
mov dword [esp + 0x28], eax
call fcn.0045c84d
mov ecx, dword [esp + 0x60]
add esp, 0x10
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x54]
test ecx, ecx
je 0x41acd7
mov ecx, dword [esp + 0x50]
inc ecx
mov dword [esp + 0x1c], ecx
test edx, edx
mov dword [esp + 0x2c], eax
je 0x41ace4
inc eax
mov dword [esp + 0x2c], eax
mov edx, dword [esp + 0x2c]
push 2
push edx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x41ad08
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
inc ecx
inc eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
imul eax, dword [esp + 0x1c]
xor edx, edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], edx
mov dword [esp + 0xc], edx
cmp eax, edx
mov dword [esp + 0x1c], edx
jle 0x41ae3e
mov eax, dword [esp + 0x1c]
push 2
push eax
call fcn.0045c84d
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x2c]
add esp, 8
cmp edx, eax
jne 0x41ae25
mov ecx, dword [esp + 0x2c]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
shl eax, 1
cmp eax, ecx
lea eax, [ecx + 1]
je 0x41ad60
mov eax, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call fcn.0045c84d
lea ecx, [eax + 1]
add esp, 8
shl ecx, 4
cmp ecx, dword [esp + 0x14]
mov dword [esp + 0x54], edx
jle 0x41ad97
mov edx, eax
mov ecx, ebx
shl edx, 4
sub ecx, edx
mov edx, dword [esp + 0x38]
sub ecx, edx
mov edx, dword [esp + 0x54]
mov dword [esp + 0x48], ecx
jmp 0x41ad9f
mov dword [esp + 0x48], 0x10
shl edx, 4
mov ecx, edx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x28], ecx
add ecx, edx
cmp ecx, dword [esp + 0x18]
mov dword [esp + 0x44], ecx
jge 0x41ae14
mov ecx, dword [esp + 0x14]
shl eax, 4
cmp eax, ecx
mov dword [esp + 0x64], eax
jge 0x41ae14
mov ecx, dword [esi + 4]
add ecx, eax
mov eax, dword [esi]
add eax, edx
mov edx, dword [esp + 0x28]
add eax, edx
mov edx, dword [edi + 0x10]
test edx, edx
jne 0x41ade3
mov dword [esp + 0x10], edx
jmp 0x41adea
mov edx, dword [edx + 4]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x64]
push 0xcc0020
push edx
mov edx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x58]
push edx
push 1
push ecx
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jl 0x41ad2b
xor edx, edx
mov eax, ecx
mov ecx, dword [esp + 0xc]
inc ecx
cmp ecx, 0x10
mov dword [esp + 0xc], ecx
jl 0x41ad1f
mov ecx, dword [esp + 0x24]
inc ecx
cmp ecx, 2
mov dword [esp + 0x24], ecx
jl 0x41ad1b
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [esp + 0x38]
push 0x10
sub ebx, edx
push ebx
mov dword [esp + 0x1c], ebx
call fcn.0045c84d
mov ebx, eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x5c], edx
mov edx, dword [esp + 0x3c]
sub eax, edx
push 0x10
push eax
mov dword [esp + 0x28], eax
call fcn.0045c84d
mov ecx, dword [esp + 0x64]
add esp, 0x10
test ecx, ecx
mov dword [esp + 0x48], ebx
je 0x41aebb
inc ebx
mov dword [esp + 0x48], ebx
test edx, edx
mov dword [esp + 0xc], eax
je 0x41aec8
inc eax
mov dword [esp + 0xc], eax
push 2
push ebx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x41aee2
mov eax, dword [esp + 0xc]
inc ebx
mov dword [esp + 0x48], ebx
inc eax
jmp 0x41aee6
mov eax, dword [esp + 0xc]
imul eax, ebx
xor ecx, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x30]
mov dword [esp + 0x1c], ecx
cmp eax, ecx
jle 0x41b00e
mov ecx, dword [esp + 0x1c]
push 2
push ecx
call fcn.0045c84d
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x14]
add esp, 8
cmp edx, eax
jne 0x41aff7
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
shl eax, 1
cmp eax, ebx
lea eax, [ebx + 1]
je 0x41af38
mov eax, ebx
mov edx, dword [esp + 0x1c]
push eax
push edx
call fcn.0045c84d
mov ebx, dword [esp + 0x20]
lea ecx, [eax + 1]
shl ecx, 4
add esp, 8
cmp ecx, ebx
jle 0x41af6d
mov ecx, eax
shl ecx, 4
mov ebx, ecx
mov ecx, dword [esp + 0x3c]
sub ecx, ebx
mov ebx, dword [esp + 0x34]
sub ecx, ebx
mov dword [esp + 0x2c], ecx
jmp 0x41af75
mov dword [esp + 0x2c], 0x10
mov ebx, dword [esp + 0x14]
shl edx, 4
mov ecx, edx
mov edx, dword [esp + 0x24]
add edx, ecx
cmp edx, ebx
mov dword [esp + 0x28], edx
jge 0x41afe2
shl eax, 4
mov edx, eax
mov eax, dword [esp + 0x18]
cmp edx, eax
jge 0x41afe2
mov eax, dword [esi + 4]
mov ebx, dword [edi + 0x10]
add eax, ecx
mov ecx, dword [esp + 0x24]
add eax, ecx
mov ecx, dword [esi]
add ecx, edx
test ebx, ebx
jne 0x41afb5
mov dword [esp + 0x10], ebx
jmp 0x41afbc
mov ebx, dword [ebx + 4]
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x28]
push 0xcc0020
push ebx
push edx
mov edx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x3c]
push 1
push edx
push eax
mov eax, dword [ebp + 8]
push ecx
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [esp + 0x48]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jl 0x41af07
xor ecx, ecx
mov eax, dword [esp + 0x24]
inc eax
cmp eax, 0x10
mov dword [esp + 0x24], eax
jl 0x41aef7
mov eax, dword [esp + 0xc]
inc eax
cmp eax, 2
mov dword [esp + 0xc], eax
jl 0x41aef3
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [esp + 0x38]
mov eax, ebx
sub eax, edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], eax
jmp 0x41b067
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x2c], eax
jge 0x41b0b9
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x2c]
sub eax, ecx
mov ecx, dword [esi + 4]
add ecx, edx
mov edx, dword [edi + 0x10]
test edx, edx
jne 0x41b08d
mov dword [esp + 0x10], edx
jmp 0x41b094
mov edx, dword [edx + 4]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x2c]
push 0xcc0020
push edx
mov edx, dword [esp + 0x18]
push 0
push edx
push 1
push eax
mov eax, dword [esi]
push ecx
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x1c]
test eax, eax
jle 0x41b115
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
sub ecx, eax
mov eax, dword [esi + 4]
sub eax, edx
mov edx, dword [esp + 0x2c]
sub eax, edx
mov edx, dword [edi + 0x10]
add eax, ebx
test edx, edx
jne 0x41b0e9
mov dword [esp + 0x10], edx
jmp 0x41b0f0
mov edx, dword [edx + 4]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0xc]
push 0xcc0020
push edx
mov edx, dword [esp + 0x18]
push 0
push edx
push 1
push ecx
push eax
mov eax, dword [esi]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
inc ecx
dec eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x14]
add eax, 2
cmp eax, ecx
mov dword [esp + 0x1c], eax
jle 0x41b063
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x38]
mov dword [esp + 0x1c], ecx
sub ebx, eax
mov dword [esp + 0x48], ecx
mov eax, ebx
mov dword [esp + 0x14], ebx
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov dword [esp + 0x24], ebx
mov dword [esp + 0xc], ebx
jmp 0x41b18f
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
jg 0x41b1dd
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x34]
sub edx, eax
mov eax, dword [esi + 4]
sub eax, ecx
mov ecx, dword [edi + 0x10]
add eax, ebx
test ecx, ecx
jne 0x41b1b1
mov dword [esp + 0x10], ecx
jmp 0x41b1b8
mov ecx, dword [ecx + 4]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0xc]
push 0xcc0020
push ecx
mov ecx, dword [esp + 0x18]
push 0
push ecx
push 1
push edx
mov edx, dword [ebp + 8]
push eax
mov eax, dword [esi]
push eax
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jge 0x41b21b
mov ecx, dword [esp + 0x3c]
mov edx, eax
mov eax, dword [edi + 0x10]
push 0xcc0020
push edx
mov edx, dword [esi + 4]
push 0
push eax
mov eax, dword [esp + 0x44]
push 1
sub ecx, eax
mov eax, dword [esp + 0x30]
add edx, eax
mov eax, dword [esi]
add edx, ebx
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
inc edx
dec ecx
inc eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x14]
add eax, 2
mov dword [esp + 0x1c], edx
cmp eax, ecx
mov dword [esp + 0x48], eax
jle 0x41b18b
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
sub eax, edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
cdq
sub eax, edx
mov dword [esp + 0xc], ecx
sar eax, 1
mov dword [esp + 0x2c], eax
jmp 0x41b2a2
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
cmp ecx, eax
jg 0x41b2d4
mov edx, dword [edi + 0x10]
push 0xcc0020
mov eax, ecx
push 0
push eax
push edx
mov edx, dword [esp + 0x48]
mov ecx, ebx
sub ecx, edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [esi]
push 1
add ecx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov eax, dword [esp + 0x24]
test eax, eax
jle 0x41b30c
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x34]
mov edx, dword [edi + 0x10]
sub eax, ecx
push 0xcc0020
push 0
push eax
push edx
mov edx, dword [esp + 0x48]
mov ecx, ebx
sub ecx, edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [ebp + 8]
push 1
push edx
add eax, dword [esi]
push eax
call fcn.00423db0
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
inc ecx
dec eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x18]
add eax, 2
cmp eax, ecx
mov dword [esp + 0x24], eax
jle 0x41b29e
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
sub eax, edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x48], ecx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], eax
jmp 0x41b38a
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x48]
test ecx, ecx
jle 0x41b3c0
mov eax, dword [esp + 0xc]
mov edx, dword [edi + 0x10]
push 0xcc0020
push 0
push eax
push edx
mov edx, dword [esp + 0x48]
mov ecx, ebx
sub ecx, edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [ebp + 8]
push 1
push edx
add eax, dword [esi]
push eax
call fcn.00423db0
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x1c], eax
jge 0x41b3fa
mov eax, dword [esp + 0x24]
mov ecx, dword [edi + 0x10]
push 0xcc0020
push 0
push eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 0x48]
mov edx, ebx
sub edx, ecx
mov ecx, dword [esi]
push edx
mov edx, dword [esp + 0x40]
push 1
push eax
add ecx, dword [esp + 0x38]
add ecx, edx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
inc edx
dec ecx
inc eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x18]
add eax, 2
mov dword [esp + 0x1c], edx
cmp eax, ecx
mov dword [esp + 0x48], eax
jle 0x41b386
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x18]
push 0xcc0020
push 0
push 0
push ecx
sub ebx, dword [esp + 0x48]
push ebx
push edx
jmp 0x420ae3
push 0xa
lea ecx, [esp + 0x394]
call fcn.00423e20
push 0
lea ecx, [esp + 0x44c]
mov dword [esp + 0x204e4], 0
call fcn.00426a80
mov ecx, dword [esp + 0x38]
mov byte [esp + 0x204e0], 1
sub ebx, ecx
mov dword [esp + 0xc], 0
test ebx, ebx
jle 0x41b589
push 4
call fcn.004704db
mov edx, dword [esp + 0x10]
add esp, 4
lea ecx, [esp + 0x390]
mov dword [eax], edx
push eax
call fcn.00423f10
mov eax, dword [esp + 0xc]
inc eax
cmp eax, ebx
mov dword [esp + 0xc], eax
jl 0x41b49e
test ebx, ebx
jle 0x41b589
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
sub eax, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x39c]
lea ecx, [esp + 0x448]
dec eax
push eax
push 0
call fcn.00426b90
lea ecx, [esp + 0x448]
call fcn.00426bd0
mov ecx, dword [esp + 0x39c]
dec ecx
cmp eax, ecx
jle 0x41b513
xor eax, eax
push eax
lea ecx, [esp + 0x394]
call fcn.00423e50
mov ebx, eax
mov edx, dword [edi + 0x10]
mov ecx, dword [esp + 0x18]
push 0xcc0020
mov eax, dword [ebx + 8]
mov dword [esp + 0x2c], eax
mov eax, dword [eax]
push eax
push 0
push edx
mov edx, dword [esi + 4]
push 1
add eax, edx
mov edx, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
push eax
push edx
call fcn.00423db0
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
push ebx
lea ecx, [esp + 0x394]
call fcn.00423f90
mov edx, dword [esp + 0x28]
push edx
call fcn.00470504
mov eax, dword [esp + 0x14]
add esp, 4
dec eax
mov dword [esp + 0x10], eax
jne 0x41b4e2
lea ecx, [esp + 0x448]
mov byte [esp + 0x204e0], 0
call fcn.00426b10
lea ecx, [esp + 0x390]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00423e80
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0xa
lea ecx, [esp + 0x3bc]
call fcn.00423e20
push 0
lea ecx, [esp + 0x47c]
mov dword [esp + 0x204e4], 2
call fcn.00426a80
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
sub eax, edx
mov byte [esp + 0x204e0], 3
test eax, eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], eax
jle 0x41b642
push 4
call fcn.004704db
mov ecx, dword [esp + 0x10]
add esp, 4
mov dword [eax], ecx
lea ecx, [esp + 0x3b8]
push eax
call fcn.00423f10
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
inc eax
cmp eax, ecx
mov dword [esp + 0xc], eax
jl 0x41b614
mov eax, dword [esp + 0x18]
test eax, eax
jle 0x41b707
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
sub ebx, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x3c4]
lea ecx, [esp + 0x478]
dec eax
push eax
push 0
call fcn.00426b90
lea ecx, [esp + 0x478]
call fcn.00426bd0
mov ecx, dword [esp + 0x3c4]
dec ecx
cmp eax, ecx
jle 0x41b691
xor eax, eax
push eax
lea ecx, [esp + 0x3bc]
call fcn.00423e50
mov edx, dword [edi + 0x10]
mov ebx, eax
mov ecx, dword [esp + 0x14]
push 0xcc0020
mov eax, dword [ebx + 8]
push 0
mov dword [esp + 0x30], eax
mov eax, dword [eax]
push eax
push edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [esi]
push 1
add ecx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
push ebx
lea ecx, [esp + 0x3bc]
call fcn.00423f90
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00470504
mov eax, dword [esp + 0x14]
add esp, 4
dec eax
mov dword [esp + 0x10], eax
jne 0x41b660
lea ecx, [esp + 0x478]
mov byte [esp + 0x204e0], 2
call fcn.00426b10
lea ecx, [esp + 0x3b8]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00423e80
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0xa
lea ecx, [esp + 0x304]
call fcn.00423ee0
push 0
lea ecx, [esp + 0x4bc]
mov dword [esp + 0x204e4], 4
call fcn.00426a80
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
sub eax, edx
mov byte [esp + 0x204e0], 5
test eax, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], eax
jle 0x41b809
mov eax, dword [esp + 0x38]
mov ecx, ebx
sub ecx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
test ecx, ecx
mov dword [esp + 0xc], 0
jle 0x41b7fa
and eax, 0xffff
mov dword [esp + 0x28], eax
push 4
call fcn.004704db
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
and edx, 0xffff
add esp, 4
shl edx, 0x10
or edx, ecx
push eax
lea ecx, [esp + 0x304]
mov dword [eax], edx
call fcn.00423f10
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
add eax, 4
cmp eax, ecx
mov dword [esp + 0xc], eax
jl 0x41b7b7
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
add eax, 4
cmp eax, edx
mov dword [esp + 0x1c], eax
jl 0x41b7a2
sub ebx, dword [esp + 0x38]
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x30c]
lea ecx, [esp + 0x4b8]
dec eax
mov ebx, 4
push eax
push 0
call fcn.00426b90
lea ecx, [esp + 0x4b8]
call fcn.00426bd0
mov ecx, dword [esp + 0x30c]
dec ecx
cmp eax, ecx
jle 0x41b847
xor eax, eax
push eax
lea ecx, [esp + 0x304]
call fcn.00423e50
mov dword [esp + 0x64], eax
mov eax, dword [eax + 8]
xor ecx, ecx
mov dword [esp + 0xc], eax
mov cx, word [eax]
mov eax, dword [eax]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x18]
lea edx, [ecx + 4]
shr eax, 0x10
cmp edx, ebx
jle 0x41b88c
mov edx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x34]
sub edx, ecx
sub edx, ebx
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x14]
lea ebx, [eax + 4]
cmp ebx, edx
jle 0x41b89b
sub edx, eax
jmp 0x41b89f
mov edx, dword [esp + 0x28]
mov ebx, dword [edi + 0x10]
push 0xcc0020
push eax
push ecx
push ebx
push edx
mov edx, dword [esp + 0x24]
push edx
mov edx, dword [esi + 4]
add eax, edx
push eax
mov eax, dword [esi]
add eax, ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
mov ecx, dword [esp + 0x64]
push ecx
lea ecx, [esp + 0x304]
call fcn.00423f90
mov edx, dword [esp + 0xc]
push edx
call fcn.00470504
mov eax, dword [esp + 0x310]
add esp, 4
cmp eax, 1
jl 0x41b92a
mov eax, dword [ebp + 0xc]
push 0
mov ecx, dword [eax + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41b811
mov eax, dword [esp + 0x304]
test eax, eax
je 0x41b92a
mov esi, dword [eax + 8]
push eax
lea ecx, [esp + 0x304]
call fcn.00423f90
push esi
call fcn.00470504
add esp, 4
jmp 0x41b904
lea ecx, [esp + 0x4b8]
mov byte [esp + 0x204e0], 4
call fcn.00426b10
lea ecx, [esp + 0x300]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00424000
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x38]
mov dword [esp + 0x28], ecx
sub ebx, eax
mov dword [esp + 0x14], ebx
js case.default.0x41a6e9
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
sub eax, ecx
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0xc]
mov eax, dword [edi + 0x10]
mov ecx, dword [esp + 0x18]
push 0xcc0020
push edx
mov edx, dword [esi + 4]
push 0
push eax
mov eax, dword [esi]
push ebx
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
inc ebx
dec ecx
cmp ebx, eax
mov dword [esp + 0xc], ecx
jle 0x41b996
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x38]
mov eax, ebx
sub eax, ecx
mov dword [esp + 0x14], eax
js case.default.0x41a6e9
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
sub eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0x10]
mov ecx, dword [esp + 0x18]
push 0xcc0020
push 0
push 0
push eax
mov eax, dword [esp + 0x1c]
mov edx, ebx
push eax
push ecx
mov ecx, dword [esp + 0x50]
sub edx, ecx
mov ecx, dword [esi + 4]
sub edx, eax
mov eax, dword [esi]
add edx, ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
inc eax
cmp eax, ecx
mov dword [esp + 0xc], eax
jle 0x41ba19
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [esp + 0x34]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x3c]
mov eax, ecx
sub eax, edx
mov dword [esp + 0x18], eax
js case.default.0x41a6e9
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], ecx
sub ebx, eax
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x28]
mov eax, dword [edi + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 4]
push 0xcc0020
push 0
push 0
push eax
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0x48]
push ebx
push edx
mov edx, dword [esp + 0x28]
sub eax, ecx
mov ecx, dword [ebp + 8]
add eax, edx
push eax
call fcn.00423db0
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
inc ebx
dec ecx
cmp ebx, eax
mov dword [esp + 0xc], ecx
jle 0x41bab0
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [esp + 0x34]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x3c]
mov eax, ecx
sub eax, edx
mov dword [esp + 0x18], eax
js case.default.0x41a6e9
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], ecx
sub ebx, eax
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x34]
mov ecx, dword [edi + 0x10]
push 0xcc0020
sub eax, edx
mov edx, dword [esp + 0x18]
push 0
push eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esi]
push edx
push ebx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
inc ebx
dec ecx
cmp ebx, eax
mov dword [esp + 0xc], ecx
jle 0x41bb44
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
sub ebx, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], ebx
sub eax, edx
fild dword [esp + 0x14]
cmp eax, ebx
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], eax
fst dword [esp + 0x1c]
jle 0x41bbef
fild dword [esp + 0x18]
mov dword [esp + 0xc], 0x3f800000
fst dword [esp + 0x44]
fdiv st(1)
fstp dword [esp + 0x10]
fstp st(0)
jmp 0x41bc07
fild dword [esp + 0x18]
mov dword [esp + 0x10], 0x3f800000
fstp dword [esp + 0x44]
fdiv dword [esp + 0x44]
fstp dword [esp + 0xc]
fld dword [esp + 0x48]
call fcn.0045b910
fld dword [esp + 0x1c]
mov ebx, eax
call fcn.0045b910
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
sub ecx, ebx
push 0xcc0020
sub ecx, edx
mov edx, dword [edi + 0x10]
push 0
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esi + 4]
sub ecx, eax
push ecx
mov ecx, dword [ebp + 8]
add eax, edx
mov edx, dword [esi]
push ebx
push eax
push edx
call fcn.00423db0
fld dword [esp + 0x48]
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 0x41
je 0x41bc67
fld dword [esp + 0x10]
fadd dword [esp + 0x48]
fstp dword [esp + 0x48]
fld dword [esp + 0x1c]
fcomp dword [0x486278]
fnstsw ax
test ah, 1
jne 0x41bc91
fld dword [esp + 0x1c]
fsub dword [esp + 0xc]
fst dword [esp + 0x1c]
fcomp dword [0x486278]
fnstsw ax
test ah, 1
je 0x41bca0
fld dword [esp + 0x48]
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 1
je 0x41bcb6
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
jmp 0x41bc07
mov edx, dword [edi + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
sub ebx, eax
mov eax, dword [esp + 0x3c]
sub eax, edx
mov dword [esp + 0x48], 0
cmp eax, ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
jle 0x41bd45
fild dword [esp + 0x18]
mov dword [esp + 0xc], 0x3f800000
fstp dword [esp + 0x44]
fild dword [esp + 0x14]
fstp dword [esp + 0x30]
fld dword [esp + 0x44]
fdiv dword [esp + 0x30]
fstp dword [esp + 0x10]
jmp 0x41bd69
fild dword [esp + 0x14]
mov dword [esp + 0x10], 0x3f800000
fstp dword [esp + 0x30]
fild dword [esp + 0x18]
fstp dword [esp + 0x44]
fld dword [esp + 0x30]
fdiv dword [esp + 0x44]
fstp dword [esp + 0xc]
fld dword [esp + 0x1c]
call fcn.0045b910
fld dword [esp + 0x48]
mov ebx, eax
call fcn.0045b910
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x3c]
sub ecx, ebx
push 0xcc0020
push ecx
mov ecx, dword [esp + 0x3c]
sub edx, eax
sub edx, ecx
mov ecx, dword [edi + 0x10]
push edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [ebp + 8]
push ebx
push eax
mov eax, dword [esi]
push edx
push eax
call fcn.00423db0
fld dword [esp + 0x48]
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 0x41
je 0x41bdc6
fld dword [esp + 0x10]
fadd dword [esp + 0x48]
fstp dword [esp + 0x48]
fld dword [esp + 0x1c]
fcomp dword [esp + 0x30]
fnstsw ax
test ah, 0x41
je 0x41bdec
fld dword [esp + 0xc]
fadd dword [esp + 0x1c]
fst dword [esp + 0x1c]
fcomp dword [esp + 0x30]
fnstsw ax
test ah, 0x41
jne 0x41bdfb
fld dword [esp + 0x48]
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 0x41
je 0x41be11
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
jmp 0x41bd69
mov eax, dword [edi + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push 0xcc0020
push 0
push 0
push eax
push ecx
push edx
jmp 0x420ae3
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
sub eax, ecx
mov dword [esp + 0x18], eax
sub ebx, edx
fild dword [esp + 0x18]
mov dword [esp + 0x14], ebx
cmp eax, ebx
fst dword [esp + 0x48]
fild dword [esp + 0x14]
fst dword [esp + 0x1c]
jle 0x41be6d
fxch st(1)
fdiv st(1)
mov dword [esp + 0xc], 0x3f800000
fstp dword [esp + 0x10]
fstp st(0)
jmp 0x41be7d
fdiv st(1)
mov dword [esp + 0x10], 0x3f800000
fstp dword [esp + 0xc]
fstp st(0)
fld dword [esp + 0x1c]
call fcn.0045b910
fld dword [esp + 0x48]
mov ebx, eax
call fcn.0045b910
mov edx, dword [edi + 0x10]
mov ecx, dword [esp + 0x14]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x4c]
sub ecx, ebx
push ecx
mov ecx, dword [esp + 0x48]
sub edx, eax
sub edx, ecx
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [esi + 4]
add ebx, edx
mov edx, dword [esi]
add eax, edx
push ebx
push eax
call fcn.00423db0
fld dword [esp + 0x48]
fcomp dword [0x486278]
fnstsw ax
test ah, 1
jne 0x41bee2
fld dword [esp + 0x48]
fsub dword [esp + 0x10]
fstp dword [esp + 0x48]
fld dword [esp + 0x1c]
fcomp dword [0x486278]
fnstsw ax
test ah, 1
jne 0x41bf0c
fld dword [esp + 0x1c]
fsub dword [esp + 0xc]
fst dword [esp + 0x1c]
fcomp dword [0x486278]
fnstsw ax
test ah, 1
je 0x41bf21
fld dword [esp + 0x48]
fcomp dword [0x486278]
fnstsw ax
test ah, 1
jne case.default.0x41a6e9
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
jmp 0x41be7d
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
sub eax, ecx
mov dword [esp + 0x18], eax
sub ebx, edx
fild dword [esp + 0x18]
cmp eax, ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], ebx
fst dword [esp + 0x48]
jle 0x41bf7d
fild dword [esp + 0x14]
mov dword [esp + 0xc], 0x3f800000
fstp dword [esp + 0x30]
fdiv dword [esp + 0x30]
fstp dword [esp + 0x10]
jmp 0x41bf95
fild dword [esp + 0x14]
mov dword [esp + 0x10], 0x3f800000
fst dword [esp + 0x30]
fdiv st(1)
fstp dword [esp + 0xc]
fstp st(0)
fld dword [esp + 0x1c]
call fcn.0045b910
fld dword [esp + 0x48]
mov ebx, eax
call fcn.0045b910
mov edx, dword [esp + 0x14]
mov ecx, dword [edi + 0x10]
sub edx, ebx
push 0xcc0020
push edx
mov edx, dword [esp + 0x44]
push 0
push ecx
mov ecx, dword [esi + 4]
push ebx
mov ebx, dword [esp + 0x48]
sub edx, eax
sub edx, ebx
push edx
mov edx, dword [esi]
add eax, edx
push ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
fld dword [esp + 0x48]
fcomp dword [0x486278]
fnstsw ax
test ah, 1
jne 0x41bff7
fld dword [esp + 0x48]
fsub dword [esp + 0x10]
fstp dword [esp + 0x48]
fld dword [esp + 0x1c]
fcomp dword [esp + 0x30]
fnstsw ax
test ah, 0x41
je 0x41c01d
fld dword [esp + 0xc]
fadd dword [esp + 0x1c]
fst dword [esp + 0x1c]
fcomp dword [esp + 0x30]
fnstsw ax
test ah, 0x41
jne 0x41c02e
fld dword [esp + 0x48]
fcomp dword [0x486278]
fnstsw ax
test ah, 1
jne 0x41c044
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
jmp 0x41bf95
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push 0xcc0020
push 0
push 0
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
push eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [esp + 0x38]
mov dword [esp + 0x28], ecx
sub ebx, edx
cmp ebx, ecx
mov dword [esp + 0x14], ebx
jle case.default.0x41a6e9
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
mov ebx, dword [esp + 0x28]
sub eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0x10]
mov ecx, dword [esp + 0x18]
push 0xcc0020
push ebx
push 0
push eax
mov eax, dword [esi]
push 1
push ecx
mov ecx, dword [esi + 4]
mov edx, ebx
add edx, ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov eax, dword [esp + 0x14]
inc ebx
cmp ebx, eax
jl 0x41c0a9
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [esp + 0x38]
mov eax, ebx
sub eax, edx
mov dword [esp + 0xc], 1
cmp eax, 1
mov dword [esp + 0x14], eax
jl case.default.0x41a6e9
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
sub ecx, edx
dec eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x18]
push 0xcc0020
push eax
push 0
push ecx
mov ecx, dword [esp + 0x1c]
push 1
push edx
mov edx, dword [esp + 0x50]
mov eax, ebx
sub eax, edx
mov edx, dword [esi + 4]
sub eax, ecx
mov ecx, dword [esi]
add eax, edx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x1c], edx
jle 0x41c130
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
sub eax, edx
mov dword [esp + 0x28], ecx
cmp eax, ecx
mov dword [esp + 0x18], eax
jle case.default.0x41a6e9
sub ebx, dword [esp + 0x38]
mov dword [esp + 0x14], ebx
mov ebx, ecx
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 4]
push 0xcc0020
push 0
push ebx
push ecx
push edx
push 1
push eax
mov eax, dword [esi]
mov ecx, ebx
add ecx, eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
mov eax, dword [esp + 0x18]
inc ebx
cmp ebx, eax
jl 0x41c1cc
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
mov eax, ecx
sub eax, edx
cmp eax, 1
jl case.default.0x41a6e9
mov edx, dword [esp + 0x38]
mov dword [esp + 0x10], eax
sub ebx, edx
mov dword [esp + 0x14], ebx
lea ebx, [ecx - 1]
mov edx, dword [esp + 0x34]
mov ecx, dword [edi + 0x10]
mov eax, ebx
push 0xcc0020
sub eax, edx
mov edx, dword [esp + 0x18]
push 0
push eax
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
push 1
add edx, eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov eax, dword [esp + 0x10]
dec ebx
dec eax
mov dword [esp + 0x10], eax
jne 0x41c249
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [esp + 0x38]
mov eax, ebx
sub eax, edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x10], eax
lea edx, [eax + 2]
cmp edx, ecx
jle 0x41c36f
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
sub ecx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0xc]
mov eax, dword [edi + 0x10]
mov ecx, dword [esp + 0x1c]
push 0xcc0020
push edx
mov edx, dword [esp + 0x20]
push 0
push eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esi]
push edx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov edx, dword [esp + 0x10]
mov eax, dword [edi + 0x10]
mov ecx, dword [esp + 0x18]
push 0xcc0020
push edx
push 0
push eax
mov eax, dword [esp + 0x2c]
push eax
push ecx
mov ecx, dword [esp + 0x50]
mov edx, ebx
sub edx, ecx
mov ecx, dword [esi + 4]
sub edx, eax
mov eax, dword [esi]
add edx, ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc]
inc eax
dec ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x10]
add ecx, 2
mov dword [esp + 0x1c], eax
cmp eax, ecx
jl 0x41c2df
mov edx, dword [edi + 0x10]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x34]
push 0xcc0020
mov ecx, dword [esi + 4]
push 0
push 0
push edx
mov edx, dword [esi]
push eax
mov eax, dword [esp + 0x50]
sub eax, ebx
push eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esp + 0x180]
call fcn.00476da2
lea ecx, [esp + 0x138]
mov dword [esp + 0x204e0], 6
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 7
test eax, eax
jne 0x41c3e8
xor eax, eax
jmp 0x41c3ee
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x184]
call fcn.00476e59
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
sub ebx, edx
sub eax, ecx
mov ecx, dword [ebp + 8]
push ebx
push eax
push ecx
lea ecx, [esp + 0x144]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
call fcn.00423d10
lea edx, [esp + 0x138]
lea ecx, [esp + 0x180]
push edx
call fcn.00423d40
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov eax, dword [esi + 4]
push 0xcc0020
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
push ebx
push eax
push 0
push 0
lea ecx, [esp + 0x1a0]
call fcn.00423db0
mov eax, ebx
mov dword [esp + 0x30], 0
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
inc ebx
js 0x41c5c0
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
push 0xcc0020
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x188]
push 0
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov ecx, dword [esp + 0x1c]
mov edx, dword [edi + 0x10]
mov eax, dword [esp + 0x18]
push 0xcc0020
push ecx
push 0
push edx
mov edx, dword [esp + 0x40]
push 1
mov ecx, ebx
push eax
mov eax, dword [esi + 4]
sub ecx, edx
mov edx, dword [esi]
add ecx, eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
add eax, ebx
cmp eax, ecx
jg 0x41c567
mov ecx, dword [esp + 0x30]
mov eax, ebx
sub eax, ecx
lea edx, [eax + ecx]
mov ecx, dword [esp + 0x14]
add edx, ebx
cmp edx, ecx
jbe 0x41c510
mov edx, dword [esp + 0x30]
mov eax, ecx
sub eax, edx
sub eax, ebx
mov edx, dword [esp + 0x18]
push 0xcc0020
push ebx
lea ecx, [esp + 0x188]
push 0
push ecx
mov ecx, dword [esi]
push eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esi + 4]
add eax, ebx
add eax, edx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov eax, dword [esp + 0x30]
mov ecx, dword [edi + 0x10]
push 0xcc0020
lea edx, [eax + ebx - 1]
add eax, ebx
push edx
mov edx, dword [esp + 0x20]
push 0
push ecx
mov ecx, dword [esi + 4]
push 1
push edx
lea edx, [eax + ecx - 1]
mov eax, dword [esi]
push edx
push eax
jmp 0x41c58d
mov edx, dword [esp + 0x18]
push 0xcc0020
push eax
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x188]
push 0
push ecx
mov ecx, dword [esi]
push 1
push edx
mov edx, dword [esi + 4]
add eax, ebx
add eax, edx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x1c]
inc eax
dec edx
cmp eax, ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], edx
jle 0x41c486
mov ecx, dword [esp + 0x28]
push ecx
lea ecx, [esp + 0x184]
call fcn.00423d40
lea ecx, [esp + 0x138]
call fcn.0047774e
lea ecx, [esp + 0x138]
mov byte [esp + 0x204e0], 6
call fcn.00401b30
lea ecx, [esp + 0x180]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [esp + 0x38]
mov eax, ebx
sub eax, edx
mov dword [esp + 0x1c], ecx
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x3c]
mov ecx, edx
sar eax, 3
sub ecx, dword [esp + 0x34]
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], ecx
js case.default.0x41a6e9
mov dword [esp + 0x24], edx
jmp 0x41c656
mov eax, dword [esp + 0x28]
test eax, eax
mov byte [esp + 0x5b], 1
jl 0x41c72b
mov ecx, dword [esp + 0x38]
mov edx, ebx
sub edx, ecx
xor ecx, ecx
inc eax
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
jmp 0x41c680
mov edx, dword [esp + 0x14]
lea eax, [ecx + 8]
cmp eax, edx
mov dword [esp + 0x64], eax
jle 0x41c69b
mov edx, dword [esp + 0x38]
mov eax, ebx
sub eax, edx
mov edx, dword [esp + 0xc]
add eax, edx
jmp 0x41c6a0
mov eax, 8
mov dl, byte [esp + 0x5b]
test dl, dl
je 0x41c6d9
mov edx, dword [esp + 0x24]
push 0xcc0020
sub edx, dword [esp + 0x38]
push ecx
push edx
mov edx, dword [edi + 0x10]
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esp + 0x30]
push eax
mov eax, dword [esi]
add edx, ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov byte [esp + 0x5b], 0
jmp 0x41c70d
mov edx, dword [edi + 0x10]
push 0xcc0020
push ecx
push 0
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esp + 0x30]
push eax
mov eax, dword [esi]
add edx, ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x40]
sub eax, ecx
mov ecx, dword [ebp + 8]
add eax, edx
mov byte [esp + 0x77], 1
push eax
call fcn.00423db0
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, 8
dec eax
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x10], eax
jne 0x41c67c
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], edx
jle 0x41c652
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
mov eax, ecx
mov dword [esp + 0x1c], 0
sub eax, edx
cdq
and edx, 7
add eax, edx
mov edx, ebx
sar eax, 3
sub edx, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
js case.default.0x41a6e9
mov dword [esp + 0x24], edx
jmp 0x41c7b0
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x10]
test eax, eax
mov byte [esp + 0x5b], 1
jl 0x41c87f
mov edx, dword [esp + 0x34]
mov eax, ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x10]
sub eax, edx
xor edx, edx
inc ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x48], ecx
jmp 0x41c7de
mov eax, dword [esp + 0x18]
lea ecx, [edx + 8]
cmp ecx, eax
mov dword [esp + 0x28], ecx
jle 0x41c7f5
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x34]
sub eax, ecx
jmp 0x41c7fa
mov eax, 8
mov cl, byte [esp + 0x5b]
test cl, cl
je 0x41c82f
mov ecx, dword [esp + 0x24]
push 0xcc0020
push ecx
mov ecx, dword [edi + 0x10]
push edx
push ecx
mov ecx, dword [esp + 0x2c]
push ecx
mov ecx, dword [esi]
push eax
mov eax, dword [esi + 4]
add ecx, edx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov byte [esp + 0x5b], 0
jmp 0x41c861
mov ecx, dword [edi + 0x10]
push 0xcc0020
push 0
push edx
push ecx
mov ecx, dword [esp + 0x2c]
push ecx
push eax
mov eax, dword [esi + 4]
mov byte [esp + 0x73], 1
sub eax, ecx
mov ecx, dword [esp + 0x50]
sub eax, ecx
mov ecx, dword [esi]
add eax, ebx
add ecx, edx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x28]
sub ecx, 8
dec eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x48], eax
jne 0x41c7da
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], edx
jle 0x41c7a8
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
sub eax, edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x2c], eax
lea edx, [eax + 2]
cmp edx, ecx
jle 0x41c99b
mov edx, dword [esp + 0x38]
mov ecx, ebx
sub ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x3c]
sub eax, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov eax, dword [edi + 0x10]
push 0xcc0020
add ecx, edx
mov edx, dword [esp + 0x20]
push 0
push ecx
mov ecx, dword [esp + 0x20]
push eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esi]
push edx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov edx, dword [esp + 0x2c]
mov eax, dword [edi + 0x10]
mov ecx, dword [esp + 0x14]
push 0xcc0020
push 0
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esi]
push edx
mov edx, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x40]
sub ecx, edx
add ecx, eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
inc eax
dec ecx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x2c]
add ecx, 2
mov dword [esp + 0x1c], eax
cmp eax, ecx
jl 0x41c905
mov ecx, dword [esp + 0x38]
mov edx, dword [edi + 0x10]
mov eax, dword [esp + 0x18]
push 0xcc0020
push 0
push 0
sub ebx, ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
push ebx
push eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esp + 0x200]
call fcn.00476da2
lea ecx, [esp + 0x148]
mov dword [esp + 0x204e0], 8
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 9
test eax, eax
jne 0x41ca10
xor eax, eax
jmp 0x41ca16
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x204]
call fcn.00476e59
mov edx, dword [esp + 0x34]
mov ecx, dword [ebp + 8]
mov eax, ebx
mov ebx, dword [esp + 0x38]
sub eax, ebx
mov ebx, dword [esp + 0x3c]
sub ebx, edx
push eax
push ebx
push ecx
lea ecx, [esp + 0x154]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebx
call fcn.00423d10
lea edx, [esp + 0x148]
lea ecx, [esp + 0x200]
push edx
call fcn.00423d40
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov eax, dword [esi + 4]
push 0xcc0020
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
push ebx
push 0
push 0
lea ecx, [esp + 0x220]
call fcn.00423db0
mov eax, ebx
mov dword [esp + 0x2c], 0
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
inc ebx
js 0x41cbbd
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
push 0xcc0020
push 0
lea edx, [esp + 0x208]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov eax, dword [esp + 0x1c]
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x14]
push 0xcc0020
push 0
push eax
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
push 1
add edx, eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
add eax, ebx
cmp eax, ecx
jg 0x41cb92
mov ecx, dword [esp + 0x2c]
mov eax, ebx
sub eax, ecx
lea edx, [eax + ecx]
add edx, ebx
cmp edx, dword [esp + 0x18]
jbe 0x41cb34
mov eax, dword [esp + 0x3c]
sub eax, ecx
mov ecx, dword [esp + 0x34]
sub eax, ebx
sub eax, ecx
mov edx, dword [esp + 0x14]
push 0xcc0020
push 0
lea ecx, [esp + 0x208]
push ebx
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esi]
push eax
mov eax, dword [esi + 4]
push eax
lea eax, [ecx + ebx]
mov ecx, dword [ebp + 8]
add eax, edx
push eax
call fcn.00423db0
mov eax, dword [esp + 0x2c]
mov ecx, dword [edi + 0x10]
push 0xcc0020
push 0
lea edx, [eax + ebx - 1]
add eax, ebx
push edx
mov edx, dword [esp + 0x20]
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
push 1
push ecx
mov ecx, dword [ebp + 8]
lea eax, [eax + edx - 1]
push eax
call fcn.00423db0
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
inc eax
dec edx
cmp eax, ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], edx
jle 0x41cab0
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x200]
push eax
call fcn.00423d40
lea ecx, [esp + 0x148]
call fcn.0047774e
lea ecx, [esp + 0x148]
mov byte [esp + 0x204e0], 8
call fcn.00401b30
lea ecx, [esp + 0x200]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esp + 0x2b0]
call fcn.00476da2
lea ecx, [esp + 0x158]
mov dword [esp + 0x204e0], 0xa
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0xb
test eax, eax
jne 0x41cc52
xor eax, eax
jmp 0x41cc58
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x2b4]
call fcn.00476e59
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
sub ebx, edx
mov edx, dword [ebp + 8]
sub eax, ecx
push ebx
push eax
push edx
lea ecx, [esp + 0x164]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
call fcn.00423d10
lea eax, [esp + 0x158]
lea ecx, [esp + 0x2b0]
push eax
call fcn.00423d40
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 8]
push 0xcc0020
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
push ebx
push ecx
push 0
push 0
lea ecx, [esp + 0x2d0]
call fcn.00423db0
mov eax, dword [esp + 0x14]
xor ebx, ebx
test eax, eax
jl 0x41cd5a
mov edx, eax
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x18]
push 0xcc0020
push eax
mov eax, dword [esi + 4]
push 0
push ecx
mov ecx, dword [esi]
push ebx
push edx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0xcc0020
push 0
lea edx, [esp + 0x2b8]
push 0
push edx
push eax
mov eax, dword [esi]
push ecx
mov ecx, dword [esi + 4]
mov edx, ebx
add edx, ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
inc ebx
dec ecx
cmp ebx, eax
mov dword [esp + 0x1c], ecx
jle 0x41cce4
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x2b0]
push eax
call fcn.00423d40
lea ecx, [esp + 0x158]
call fcn.0047774e
lea ecx, [esp + 0x158]
mov byte [esp + 0x204e0], 0xa
call fcn.00401b30
lea ecx, [esp + 0x2b0]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esp + 0x250]
call fcn.00476da2
lea ecx, [esp + 0x168]
mov dword [esp + 0x204e0], 0xc
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0xd
test eax, eax
jne 0x41cdef
xor eax, eax
jmp 0x41cdf5
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x254]
call fcn.00476e59
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov eax, ebx
sub eax, ecx
mov ecx, dword [esp + 0x3c]
sub ecx, edx
mov edx, dword [ebp + 8]
push eax
mov dword [esp + 0x1c], ecx
push ecx
push edx
lea ecx, [esp + 0x174]
mov dword [esp + 0x20], eax
call fcn.00423d10
lea eax, [esp + 0x168]
lea ecx, [esp + 0x250]
push eax
call fcn.00423d40
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 8]
push 0xcc0020
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x24]
push eax
push ecx
push edx
push 0
push 0
lea ecx, [esp + 0x270]
call fcn.00423db0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], 0
test eax, eax
jl 0x41cf1d
mov dword [esp + 0xc], eax
mov ecx, dword [edi + 0x10]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0xcc0020
push 0
push 0
push ecx
push eax
mov ecx, ebx
push edx
mov edx, dword [esp + 0x50]
sub ecx, eax
mov eax, dword [esi + 4]
sub ecx, edx
mov edx, dword [esi]
add ecx, eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0xc]
push 0xcc0020
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x258]
push 0
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
push eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], edx
jle 0x41ce8f
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x250]
push edx
call fcn.00423d40
lea ecx, [esp + 0x168]
call fcn.0047774e
lea ecx, [esp + 0x168]
mov byte [esp + 0x204e0], 0xc
call fcn.00401b30
lea ecx, [esp + 0x250]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esp + 0x220]
call fcn.00476da2
lea ecx, [esp + 0x178]
mov dword [esp + 0x204e0], 0xe
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0xf
test eax, eax
jne 0x41cfb2
xor eax, eax
jmp 0x41cfb8
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x224]
call fcn.00476e59
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
sub ebx, edx
sub eax, ecx
mov ecx, dword [ebp + 8]
push ebx
push eax
push ecx
lea ecx, [esp + 0x184]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
call fcn.00423d10
lea edx, [esp + 0x178]
lea ecx, [esp + 0x220]
push edx
call fcn.00423d40
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
mov dword [esp + 0x64], eax
mov eax, dword [esi + 4]
push 0xcc0020
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
push ebx
push eax
push 0
push 0
lea ecx, [esp + 0x240]
call fcn.00423db0
mov eax, dword [esp + 0x18]
xor ebx, ebx
test eax, eax
jl 0x41d0c8
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x34]
mov edx, dword [edi + 0x10]
push 0xcc0020
sub eax, ecx
mov ecx, dword [esp + 0x18]
push 0
push 0
push edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [esi]
push ebx
add ecx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x48], eax
call fcn.00423db0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
push 0xcc0020
push 0
lea edx, [esp + 0x228]
push ebx
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
inc ebx
dec ecx
cmp ebx, eax
mov dword [esp + 0xc], ecx
jle 0x41d04a
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x220]
push eax
call fcn.00423d40
lea ecx, [esp + 0x178]
call fcn.0047774e
lea ecx, [esp + 0x178]
mov byte [esp + 0x204e0], 0xe
call fcn.00401b30
lea ecx, [esp + 0x220]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esp + 0x270]
call fcn.00476da2
lea ecx, [esp + 0x120]
mov dword [esp + 0x204e0], 0x10
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x11
test eax, eax
jne 0x41d15d
xor eax, eax
jmp 0x41d163
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x274]
call fcn.00476e59
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
sub ebx, edx
mov edx, dword [ebp + 8]
sub eax, ecx
push ebx
push eax
push edx
lea ecx, [esp + 0x12c]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
call fcn.00423d10
lea eax, [esp + 0x120]
lea ecx, [esp + 0x270]
push eax
call fcn.00423d40
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 8]
push 0xcc0020
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
push ebx
push ecx
push 0
push 0
lea ecx, [esp + 0x290]
call fcn.00423db0
mov eax, dword [esp + 0x18]
xor ebx, ebx
test eax, eax
jl 0x41d273
mov edx, dword [esp + 0x3c]
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x34]
mov edx, dword [esi + 4]
sub eax, ecx
mov ecx, dword [esp + 0x14]
push 0xcc0020
push 0
mov dword [esp + 0x30], eax
push eax
mov eax, dword [edi + 0x10]
push eax
mov eax, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
push ebx
push edx
push eax
call fcn.00423db0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
push 0xcc0020
push 0
lea ecx, [esp + 0x278]
push 0
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
push eax
add edx, ebx
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
inc ebx
dec ecx
cmp ebx, eax
mov dword [esp + 0xc], ecx
jle 0x41d1f5
mov edx, dword [esp + 0x64]
lea ecx, [esp + 0x270]
push edx
call fcn.00423d40
lea ecx, [esp + 0x120]
call fcn.0047774e
lea ecx, [esp + 0x120]
mov byte [esp + 0x204e0], 0x10
call fcn.00401b30
lea ecx, [esp + 0x270]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esp + 0x1b0]
call fcn.00476da2
lea ecx, [esp + 0xd0]
mov dword [esp + 0x204e0], 0x12
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x13
test eax, eax
jne 0x41d308
xor eax, eax
jmp 0x41d30e
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x1b4]
call fcn.00476e59
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov eax, ebx
sub eax, ecx
mov ecx, dword [esp + 0x3c]
sub ecx, edx
push eax
mov dword [esp + 0x1c], ecx
push ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x1c], eax
push ecx
lea ecx, [esp + 0xdc]
call fcn.00423d10
lea edx, [esp + 0xd0]
lea ecx, [esp + 0x1b0]
push edx
call fcn.00423d40
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov eax, dword [esi + 4]
push 0xcc0020
push eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
push 0
push 0
lea ecx, [esp + 0x1d0]
call fcn.00423db0
fild dword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp eax, edx
mov dword [esp + 0x48], 0
fst dword [esp + 0x1c]
jle 0x41d3c6
fild dword [esp + 0x18]
mov dword [esp + 0x64], 0x3f800000
fst dword [esp + 0x44]
fdiv st(1)
fstp dword [esp + 0x30]
fstp st(0)
jmp 0x41d3de
fild dword [esp + 0x18]
mov dword [esp + 0x30], 0x3f800000
fstp dword [esp + 0x44]
fdiv dword [esp + 0x44]
fstp dword [esp + 0x64]
fld dword [esp + 0x1c]
call fcn.0045b910
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], eax
fld dword [esp + 0x48]
sub ecx, eax
mov dword [esp + 0x10], ecx
call fcn.0045b910
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
sub ecx, eax
push 0xcc0020
sub ecx, edx
mov edx, dword [esp + 0x28]
push edx
mov edx, dword [edi + 0x10]
push 0
push edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x1c], eax
push edx
push eax
mov eax, dword [esi + 4]
mov dword [esp + 0x44], ecx
push eax
mov eax, dword [esi]
add ecx, eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push 0xcc0020
push 0
lea edx, [esp + 0x1b8]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
push 0xcc0020
push 0
lea edx, [esp + 0x1b8]
push ecx
push edx
mov edx, dword [esp + 0x1c]
push eax
push edx
mov edx, ebx
sub edx, eax
mov eax, dword [esp + 0x50]
sub edx, eax
mov eax, dword [esi + 4]
add edx, eax
mov eax, dword [esi]
add ecx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x2c]
push 0xcc0020
push 0
push eax
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x1bc]
push ecx
push eax
mov ecx, ebx
push edx
mov edx, dword [esp + 0x50]
sub ecx, eax
mov eax, dword [esi + 4]
sub ecx, edx
mov edx, dword [esi]
add ecx, eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
fld dword [esp + 0x48]
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 0x41
je 0x41d4f5
fld dword [esp + 0x30]
fadd dword [esp + 0x48]
fstp dword [esp + 0x48]
fld dword [esp + 0x1c]
fcomp dword [0x486278]
fnstsw ax
test ah, 1
jne 0x41d51f
fld dword [esp + 0x1c]
fsub dword [esp + 0x64]
fst dword [esp + 0x1c]
fcomp dword [0x486278]
fnstsw ax
test ah, 1
je 0x41d52e
fld dword [esp + 0x48]
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 1
je 0x41d544
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
jmp 0x41d3de
mov edx, dword [edi + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov ecx, dword [esp + 0x28]
push ecx
lea ecx, [esp + 0x1b4]
call fcn.00423d40
lea ecx, [esp + 0xd0]
call fcn.0047774e
lea ecx, [esp + 0xd0]
mov byte [esp + 0x204e0], 0x12
call fcn.00401b30
lea ecx, [esp + 0x1b0]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esp + 0x1a0]
call fcn.00476da2
lea ecx, [esp + 0x150]
mov dword [esp + 0x204e0], 0x14
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x15
test eax, eax
jne 0x41d5ff
xor eax, eax
jmp 0x41d605
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x1a4]
call fcn.00476e59
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
sub ebx, eax
mov eax, dword [esp + 0x3c]
sub eax, edx
push ebx
mov dword [esp + 0x1c], eax
push eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x158]
push eax
mov dword [esp + 0x20], ebx
call fcn.00423d10
lea ecx, [esp + 0x150]
push ecx
lea ecx, [esp + 0x1a4]
call fcn.00423d40
mov edx, dword [esi + 4]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov eax, dword [esi]
push 0xcc0020
push edx
mov edx, dword [esp + 0x20]
push eax
push ecx
push ebx
push edx
push 0
push 0
lea ecx, [esp + 0x1c0]
call fcn.00423db0
fild dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], 0
cmp eax, ebx
fst dword [esp + 0x48]
jle 0x41d6b3
fild dword [esp + 0x18]
mov dword [esp + 0x64], 0x3f800000
fst dword [esp + 0x44]
fdiv st(1)
fstp dword [esp + 0x30]
fstp st(0)
jmp 0x41d6cb
fild dword [esp + 0x18]
mov dword [esp + 0x30], 0x3f800000
fstp dword [esp + 0x44]
fdiv dword [esp + 0x44]
fstp dword [esp + 0x64]
fld dword [esp + 0x48]
call fcn.0045b910
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], eax
fld dword [esp + 0x2c]
sub ecx, eax
mov dword [esp + 0x1c], ecx
call fcn.0045b910
mov ebx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
mov ecx, dword [edi + 0x10]
sub ebx, eax
push 0xcc0020
sub ebx, edx
mov edx, dword [esp + 0x20]
push 0
push 0
push ecx
push edx
mov edx, dword [esi + 4]
mov dword [esp + 0x20], eax
push eax
mov eax, dword [esp + 0x3c]
mov ecx, ebx
add eax, edx
push eax
mov eax, dword [esi]
add ecx, eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
push 0xcc0020
push edx
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x1a8]
push eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esi]
push edx
push ebx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0xc]
push 0xcc0020
push eax
lea ecx, [esp + 0x1a8]
push edx
mov edx, dword [esp + 0x28]
push ecx
mov ecx, dword [esi + 4]
push edx
add eax, ecx
mov ecx, dword [ebp + 8]
push ebx
push eax
mov eax, dword [esi]
push eax
call fcn.00423db0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
push 0xcc0020
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1a8]
push ebx
push edx
mov edx, dword [esi + 4]
push eax
push ecx
mov ecx, dword [esi]
add ebx, ecx
mov ecx, dword [ebp + 8]
push edx
push ebx
call fcn.00423db0
fld dword [esp + 0x2c]
fcomp dword [esp + 0x44]
fld dword [esp + 0x30]
fadd dword [esp + 0x2c]
fnstsw ax
fstp dword [esp + 0x2c]
fld dword [esp + 0x48]
fcomp dword [0x486278]
test ah, 0x41
fnstsw ax
test ah, 1
jne 0x41d817
fld dword [esp + 0x48]
fsub dword [esp + 0x64]
fst dword [esp + 0x48]
fcomp dword [0x486278]
fnstsw ax
test ah, 1
je 0x41d801
fld dword [esp + 0x2c]
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 1
je 0x41d821
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
jmp 0x41d6cb
mov dword [esp + 0x48], 0
jmp 0x41d801
mov edx, dword [edi + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov ecx, dword [esp + 0x28]
push ecx
lea ecx, [esp + 0x1a4]
call fcn.00423d40
lea ecx, [esp + 0x150]
call fcn.0047774e
lea ecx, [esp + 0x150]
mov byte [esp + 0x204e0], 0x14
call fcn.00401b30
lea ecx, [esp + 0x1a0]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
sub ebx, eax
mov eax, dword [esp + 0x3c]
sub eax, edx
mov dword [esp + 0x48], 0
cmp eax, ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
jle 0x41d8f8
fild dword [esp + 0x18]
mov dword [esp + 0x2c], 0x3f800000
fstp dword [esp + 0x44]
fild dword [esp + 0x14]
fstp dword [esp + 0x30]
fld dword [esp + 0x44]
fdiv dword [esp + 0x30]
fstp dword [esp + 0x10]
jmp 0x41d91c
fild dword [esp + 0x14]
mov dword [esp + 0x10], 0x3f800000
fstp dword [esp + 0x30]
fild dword [esp + 0x18]
fstp dword [esp + 0x44]
fld dword [esp + 0x30]
fdiv dword [esp + 0x44]
fstp dword [esp + 0x2c]
lea ecx, [esp + 0x1c0]
call fcn.00476da2
lea ecx, [esp + 0xe0]
mov dword [esp + 0x204e0], 0x16
call fcn.00423d00
mov ebx, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x17
test ebx, ebx
jne 0x41d952
xor eax, eax
jmp 0x41d955
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x1c4]
call fcn.00476e59
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push edx
push eax
push ebx
lea ecx, [esp + 0xec]
call fcn.00423d10
lea ecx, [esp + 0xe0]
push ecx
lea ecx, [esp + 0x1c4]
call fcn.00423d40
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x28], eax
mov eax, dword [esi]
push 0xcc0020
push edx
mov edx, dword [esp + 0x20]
push eax
push ebx
push ecx
push edx
push 0
push 0
lea ecx, [esp + 0x1e0]
call fcn.00423db0
fld dword [esp + 0x1c]
call fcn.0045b910
fld dword [esp + 0x48]
mov ebx, eax
mov eax, dword [esp + 0x14]
sub eax, ebx
mov dword [esp + 0xc], eax
call fcn.0045b910
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
sub ecx, eax
push 0xcc0020
sub ecx, edx
mov edx, dword [esp + 0x10]
push edx
mov edx, dword [esi + 4]
mov dword [esp + 0x6c], ecx
push ecx
mov ecx, dword [edi + 0x10]
mov dword [esp + 0x30], eax
push ecx
mov ecx, dword [ebp + 8]
push ebx
push eax
mov eax, dword [esi]
push edx
push eax
call fcn.00423db0
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x64]
push 0xcc0020
push 0
lea ecx, [esp + 0x1c8]
push 0
push ecx
push edx
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esi + 4]
mov ecx, ebx
add ecx, eax
push ecx
mov ecx, dword [esi]
add edx, ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov ecx, dword [esp + 0x64]
mov edx, dword [esi + 4]
push 0xcc0020
push 0
lea eax, [esp + 0x1c8]
push 0
push eax
mov eax, dword [esp + 0x34]
push ebx
push ecx
mov ecx, dword [ebp + 8]
push edx
add eax, dword [esi]
push eax
call fcn.00423db0
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
push 0xcc0020
push 0
lea ecx, [esp + 0x1c8]
push 0
push ecx
mov ecx, dword [esi]
push edx
mov edx, dword [esi + 4]
add ebx, edx
push eax
push ebx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
fld dword [esp + 0x48]
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 0x41
je 0x41dab6
fld dword [esp + 0x10]
fadd dword [esp + 0x48]
fstp dword [esp + 0x48]
fld dword [esp + 0x1c]
fcomp dword [esp + 0x30]
fnstsw ax
test ah, 0x41
je 0x41dadc
fld dword [esp + 0x2c]
fadd dword [esp + 0x1c]
fst dword [esp + 0x1c]
fcomp dword [esp + 0x30]
fnstsw ax
test ah, 0x41
jne 0x41daeb
fld dword [esp + 0x48]
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 0x41
je 0x41db01
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
jmp 0x41d9bf
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push 0xcc0020
push 0
push 0
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
push eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x1c0]
push eax
call fcn.00423d40
lea ecx, [esp + 0xe0]
call fcn.0047774e
lea ecx, [esp + 0xe0]
mov byte [esp + 0x204e0], 0x16
call fcn.00401b30
lea ecx, [esp + 0x1c0]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov eax, ebx
mov dword [esp + 0x2c], 0
sub eax, ecx
mov ecx, dword [esp + 0x3c]
sub ecx, edx
mov dword [esp + 0x48], 0
cmp ecx, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
jle 0x41dbda
fild dword [esp + 0x18]
mov dword [esp + 0x28], 0x3f800000
fstp dword [esp + 0x44]
fild dword [esp + 0x14]
fstp dword [esp + 0x30]
fld dword [esp + 0x44]
fdiv dword [esp + 0x30]
fstp dword [esp + 0x10]
jmp 0x41dbfe
fild dword [esp + 0x14]
mov dword [esp + 0x10], 0x3f800000
fstp dword [esp + 0x30]
fild dword [esp + 0x18]
fstp dword [esp + 0x44]
fld dword [esp + 0x30]
fdiv dword [esp + 0x44]
fstp dword [esp + 0x28]
lea ecx, [esp + 0x190]
call fcn.00476da2
lea ecx, [esp + 0x130]
mov dword [esp + 0x204e0], 0x18
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x19
test eax, eax
jne 0x41dc34
xor eax, eax
jmp 0x41dc3a
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x194]
call fcn.00476e59
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
lea ecx, [esp + 0x13c]
call fcn.00423d10
lea edx, [esp + 0x130]
lea ecx, [esp + 0x190]
push edx
call fcn.00423d40
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
mov dword [esp + 0x70], eax
mov eax, dword [esi + 4]
push 0xcc0020
push eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
push 0
push 0
lea ecx, [esp + 0x1b0]
call fcn.00423db0
fld dword [esp + 0x2c]
call fcn.0045b910
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
fld dword [esp + 0x48]
sub ecx, eax
mov dword [esp + 0x1c], eax
sub ecx, edx
mov dword [esp + 0x24], ecx
call fcn.0045b910
mov edx, dword [esp + 0x24]
mov ecx, dword [edi + 0x10]
push 0xcc0020
push 0
push edx
mov edx, dword [esp + 0x28]
push ecx
push eax
mov ecx, ebx
push edx
mov edx, dword [esp + 0x50]
sub ecx, eax
mov dword [esp + 0x24], eax
mov eax, dword [esi + 4]
sub ecx, edx
mov edx, dword [esi]
add ecx, eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x24]
push 0xcc0020
sub eax, ecx
push ecx
lea ecx, [esp + 0x198]
push 0
push ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x74], eax
push eax
mov eax, dword [esi + 4]
push edx
push eax
mov eax, dword [esi]
add ecx, eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x64]
push 0xcc0020
push edx
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x198]
push 0
push eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esi]
push edx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov edx, dword [esp + 0x64]
mov ecx, dword [esp + 0x24]
push 0xcc0020
push edx
lea eax, [esp + 0x198]
push 0
push eax
mov eax, dword [esp + 0x1c]
mov edx, ebx
push eax
sub edx, eax
mov eax, dword [esp + 0x4c]
push ecx
sub edx, eax
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x34]
add edx, ecx
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [esi]
add eax, edx
push eax
call fcn.00423db0
fld dword [esp + 0x2c]
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 0x41
je 0x41ddc5
fld dword [esp + 0x10]
fadd dword [esp + 0x2c]
fstp dword [esp + 0x2c]
fld dword [esp + 0x48]
fcomp dword [esp + 0x30]
fnstsw ax
test ah, 0x41
je 0x41dde0
fld dword [esp + 0x28]
fadd dword [esp + 0x48]
fstp dword [esp + 0x48]
fld dword [esp + 0x48]
fcomp dword [esp + 0x30]
fnstsw ax
test ah, 1
jne 0x41ddfe
fld dword [esp + 0x2c]
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 1
je 0x41de14
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
jmp 0x41dcaa
mov edx, dword [edi + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov ecx, dword [esp + 0x70]
push ecx
lea ecx, [esp + 0x194]
call fcn.00423d40
lea ecx, [esp + 0x130]
call fcn.0047774e
lea ecx, [esp + 0x130]
mov byte [esp + 0x204e0], 0x18
call fcn.00401b30
lea ecx, [esp + 0x190]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov ecx, ebx
mov dword [esp + 0x1c], 0
sub ecx, eax
mov eax, dword [esp + 0x3c]
sub eax, edx
mov dword [esp + 0x24], 0
cmp eax, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
jle 0x41dedd
fild dword [esp + 0x18]
mov dword [esp + 0xc], 0x3f800000
fidiv dword [esp + 0x14]
fstp dword [esp + 0x10]
jmp 0x41def1
fild dword [esp + 0x14]
mov dword [esp + 0x10], 0x3f800000
fidiv dword [esp + 0x18]
fstp dword [esp + 0xc]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x2c], eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x44], eax
fld dword [esp + 0x24]
call fcn.0045b910
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x30], eax
fld dword [esp + 0x1c]
sub ecx, eax
mov dword [esp + 0x28], ecx
call fcn.0045b910
mov edx, dword [esp + 0x2c]
mov ecx, eax
neg ecx
mov dword [esp + 0x64], ecx
add ecx, edx
mov edx, dword [esp + 0x28]
push 0xcc0020
push edx
mov edx, dword [esp + 0x38]
mov dword [esp + 0x78], ecx
push ecx
mov ecx, dword [edi + 0x10]
mov dword [esp + 0x54], eax
push ecx
mov ecx, dword [esi]
push edx
push eax
mov eax, dword [esi + 4]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov ecx, dword [edi + 0x10]
push 0xcc0020
push edx
mov edx, dword [esp + 0x38]
push eax
push ecx
mov ecx, dword [esp + 0x58]
push edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [esi]
add eax, eax
push edx
mov edx, dword [esp + 0x80]
add eax, ecx
mov ecx, dword [ebp + 8]
add eax, edx
push eax
call fcn.00423db0
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x70]
mov edx, dword [edi + 0x10]
push 0xcc0020
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, ebx
push eax
sub edx, eax
mov eax, dword [esp + 0x4c]
push ecx
mov ecx, dword [esi + 4]
sub edx, eax
mov eax, dword [esi]
add edx, ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x2c]
mov eax, dword [edi + 0x10]
push 0xcc0020
push ecx
push edx
push eax
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x58]
mov edx, ebx
push eax
sub edx, eax
mov eax, dword [esp + 0x4c]
push ecx
mov ecx, dword [esi + 4]
sub edx, eax
mov eax, dword [esp + 0x54]
add edx, ecx
mov ecx, dword [esi]
push edx
mov edx, dword [esp + 0x50]
sub eax, edx
mov edx, dword [esp + 0x80]
add eax, ecx
mov ecx, dword [ebp + 8]
add eax, edx
push eax
call fcn.00423db0
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x30]
cmp eax, ecx
jne 0x41e039
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x2c]
cmp edx, eax
je 0x41c044
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x48]
cmp ecx, eax
jge 0x41e04f
fld dword [esp + 0x10]
fadd dword [esp + 0x1c]
jmp 0x41e053
fild dword [esp + 0x2c]
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x30]
fstp dword [esp + 0x1c]
cmp eax, ecx
jge 0x41e06d
fld dword [esp + 0xc]
fadd dword [esp + 0x24]
jmp 0x41e071
fild dword [esp + 0x44]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
fstp dword [esp + 0x24]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
jmp 0x41df05
lea ecx, [esp + 0xb0]
call fcn.00476da2
lea ecx, [esp + 0xf0]
mov dword [esp + 0x204e0], 0x1a
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x1b
test eax, eax
jne 0x41e0c1
xor eax, eax
jmp 0x41e0c7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0xb4]
call fcn.00476e59
mov edx, dword [esp + 0x34]
mov ecx, dword [ebp + 8]
mov eax, ebx
mov ebx, dword [esp + 0x38]
sub eax, ebx
mov ebx, dword [esp + 0x3c]
sub ebx, edx
push eax
push ebx
push ecx
lea ecx, [esp + 0xfc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebx
call fcn.00423d10
lea edx, [esp + 0xf0]
lea ecx, [esp + 0xb0]
push edx
call fcn.00423d40
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
mov dword [esp + 0x50], eax
mov eax, dword [esi + 4]
push 0xcc0020
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
push ebx
push 0
push 0
lea ecx, [esp + 0xd0]
call fcn.00423db0
mov eax, ebx
mov ecx, dword [esp + 0x14]
cdq
sub eax, edx
mov dword [esp + 0x24], 0
sar eax, 1
mov dword [esp + 0x30], eax
mov eax, ecx
cdq
sub eax, edx
mov dword [esp + 0x1c], 0
sar eax, 1
cmp ebx, ecx
mov dword [esp + 0x44], eax
jle 0x41e189
fild dword [esp + 0x18]
mov dword [esp + 0x64], 0x3f800000
fidiv dword [esp + 0x14]
fstp dword [esp + 0x28]
jmp 0x41e19d
fild dword [esp + 0x14]
mov dword [esp + 0x28], 0x3f800000
fidiv dword [esp + 0x18]
fstp dword [esp + 0x64]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x44]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
sub eax, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
sub eax, edx
sub eax, ecx
mov dword [esp + 0xc], eax
fld dword [esp + 0x1c]
call fcn.0045b910
fld dword [esp + 0x24]
mov ebx, eax
mov eax, dword [esp + 0x44]
sub eax, ebx
mov dword [esp + 0x18], eax
call fcn.0045b910
mov edx, dword [esp + 0x30]
push 0xcc0020
push ebx
mov ecx, edx
push edx
lea edx, [esp + 0xbc]
push edx
mov edx, dword [esp + 0x28]
sub ecx, eax
push edx
mov edx, dword [esi]
mov dword [esp + 0x5c], ecx
push ecx
mov ecx, dword [esi + 4]
mov dword [esp + 0x44], eax
push ecx
mov ecx, dword [esp + 0x4c]
add eax, edx
add eax, ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov ecx, dword [edi + 0x10]
push 0xcc0020
push edx
mov edx, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esi + 4]
sub edx, ebx
push ebx
add edx, ecx
mov ecx, dword [esi]
push eax
add ecx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov eax, dword [esp + 0x30]
mov edx, dword [edi + 0x10]
mov ecx, dword [esp + 0x18]
push 0xcc0020
push 0
push eax
push edx
mov edx, dword [esp + 0x3c]
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
add edx, eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
push 0xcc0020
push ebx
lea ecx, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x54]
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
push eax
push ecx
push edx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov eax, dword [esp + 0x48]
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x44]
push 0xcc0020
push 0
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
sub edx, eax
add edx, ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0x18]
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x48]
push 0xcc0020
push eax
mov eax, dword [esp + 0x4c]
push 0
push ecx
mov ecx, dword [esi]
push ebx
push edx
mov edx, dword [esi + 4]
sub eax, ebx
add eax, edx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
push 0xcc0020
push edx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0xb8]
push eax
mov eax, dword [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x54]
push edx
push eax
mov eax, dword [esi]
lea edx, [ebx + ecx]
mov ecx, dword [esi + 4]
add edx, ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov ecx, dword [esp + 0x10]
mov edx, dword [edi + 0x10]
mov eax, dword [esp + 0x30]
push 0xcc0020
push ecx
mov ecx, dword [esp + 0x4c]
push 0
push edx
mov edx, dword [esi]
push ebx
push eax
mov eax, dword [esi + 4]
add ecx, eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x14]
mov eax, ebx
sub eax, ecx
add eax, edx
mov edx, dword [edi + 0x10]
push 0xcc0020
mov dword [esp + 0x74], eax
push eax
mov eax, dword [esp + 0x50]
add ecx, ebx
push eax
mov eax, dword [esp + 0x24]
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esp + 0x40]
add ecx, edx
mov edx, dword [esi]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
sub edx, eax
add edx, ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push eax
lea edx, [esp + 0xb8]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esi + 4]
add eax, ebx
add eax, edx
mov edx, dword [esi]
push eax
mov eax, dword [esp + 0x4c]
add ecx, edx
add ecx, eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov ecx, dword [edi + 0x10]
push 0xcc0020
push edx
mov edx, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esi + 4]
add edx, ecx
mov ecx, dword [esi]
push ebx
push eax
add ecx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0xc]
mov ecx, dword [edi + 0x10]
push 0xcc0020
push edx
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x54]
push edx
push eax
mov eax, dword [esi]
lea edx, [ebx + ecx]
add edx, dword [esi + 4]
push edx
mov edx, dword [esp + 0x4c]
mov ecx, dword [ebp + 8]
add eax, edx
push eax
call fcn.00423db0
cmp ebx, dword [esp + 0x44]
jne 0x41e465
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
cmp ecx, eax
je 0x41e4d3
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
cmp eax, edx
jge 0x41e47d
fld dword [esp + 0x28]
fadd dword [esp + 0x24]
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
call fcn.0045b910
cmp eax, dword [esp + 0x30]
jle 0x41e494
fild dword [esp + 0x30]
fstp dword [esp + 0x24]
cmp ebx, dword [esp + 0x44]
jge 0x41e4a6
fld dword [esp + 0x64]
fadd dword [esp + 0x1c]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
call fcn.0045b910
cmp eax, dword [esp + 0x44]
jle 0x41e4bd
fild dword [esp + 0x44]
fstp dword [esp + 0x1c]
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
jmp 0x41e1bf
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0xb0]
push edx
call fcn.00423d40
lea ecx, [esp + 0xf0]
call fcn.0047774e
lea ecx, [esp + 0xf0]
mov byte [esp + 0x204e0], 0x1a
call fcn.00401b30
lea ecx, [esp + 0xb0]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
sub eax, edx
mov edx, dword [esp + 0x38]
mov dword [esp + 0x18], eax
mov eax, ebx
fild dword [esp + 0x18]
sub eax, edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], eax
fidiv dword [esp + 0x14]
fstp dword [esp + 0x50]
js 0x41e9a4
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], 0
test eax, eax
jl 0x41e636
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
dec eax
mov dword [esp + 0x48], eax
fild dword [esp + 0x24]
fmul dword [esp + 0x50]
call fcn.0045b910
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x1c], ecx
jg 0x41e60f
mov edx, dword [esp + 0x48]
mov eax, dword [edi + 0x10]
mov ecx, dword [esp + 0x10]
push 0xcc0020
push edx
push 0
push eax
mov eax, dword [esp + 0x2c]
push 1
push ecx
mov ecx, dword [esp + 0x50]
mov edx, ebx
sub edx, ecx
sub edx, eax
mov eax, dword [esi + 4]
lea ecx, [edx + eax - 1]
mov edx, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x34]
sub eax, ecx
mov ecx, dword [esp + 0x1c]
sub eax, edx
mov edx, dword [edi + 0x10]
push 0xcc0020
push ecx
push eax
push edx
mov edx, dword [esp + 0x20]
push 1
push edx
mov edx, dword [esi + 4]
add ecx, edx
mov edx, dword [esi]
add eax, edx
push ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x48]
inc eax
dec ecx
dec edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0xc]
cmp eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x48], edx
jle 0x41e583
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
inc eax
cmp eax, ecx
mov dword [esp + 0xc], eax
jle 0x41e562
jmp 0x41e9a4
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
sub eax, edx
mov dword [esp + 0x18], eax
sub ebx, ecx
fild dword [esp + 0x18]
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x2e0]
fidiv dword [esp + 0x14]
fstp dword [esp + 0x28]
call fcn.00476da2
lea ecx, [esp + 0x170]
mov dword [esp + 0x204e0], 0x1c
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x1d
test eax, eax
jne 0x41e6bb
xor eax, eax
jmp 0x41e6c1
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x2e4]
call fcn.00476e59
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov eax, dword [ebp + 8]
push edx
push ebx
push eax
lea ecx, [esp + 0x17c]
call fcn.00423d10
lea ecx, [esp + 0x170]
push ecx
lea ecx, [esp + 0x2e4]
call fcn.00423d40
mov edx, dword [esi + 4]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x70], eax
mov eax, dword [esi]
push 0xcc0020
push edx
mov edx, dword [esp + 0x1c]
push eax
push ecx
push edx
push ebx
push 0
push 0
lea ecx, [esp + 0x300]
call fcn.00423db0
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x14]
xor ebx, ebx
test eax, eax
mov dword [esp + 0x10], ebx
jle 0x41e7b4
mov eax, dword [esp + 0x1c]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x50], eax
fild dword [esp + 0x10]
fmul dword [esp + 0x28]
call fcn.0045b910
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x1c]
sub eax, edx
lea edx, [eax + ecx]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jle 0x41e780
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
sub ecx, eax
sub ecx, edx
jmp 0x41e784
mov ecx, dword [esp + 0x1c]
mov edx, dword [edi + 0x10]
push 0xcc0020
push ebx
push eax
push edx
mov edx, dword [esi + 4]
push 1
push ecx
mov ecx, ebx
add ecx, edx
push ecx
mov ecx, dword [esi]
add eax, ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
mov eax, dword [esp + 0x14]
inc ebx
cmp ebx, eax
mov dword [esp + 0x10], ebx
jl 0x41e750
mov ebx, dword [esp + 0x1c]
mov eax, 0x88888889
imul ebx
add edx, ebx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [edx + edx*2]
lea ecx, [eax + eax*4]
cmp ecx, ebx
jne 0x41e7eb
mov eax, dword [ebp + 0x14]
lea edx, [esp + 0x5c]
push edx
mov ecx, dword [ebp + 0xc]
cdq
sub eax, edx
sar eax, 1
push eax
call fcn.00402670
fild dword [esp + 0x10]
mov eax, ebx
cdq
fmul dword [esp + 0x28]
sub eax, edx
sar eax, 1
mov dword [esp + 0x50], eax
fisub dword [esp + 0x50]
fcomp dword [0x486278]
fnstsw ax
test ah, 0x41
je 0x41e815
cmp ebx, dword [esp + 0x18]
jg 0x41e81f
inc ebx
mov dword [esp + 0x1c], ebx
jmp 0x41e735
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0x2e0]
push eax
call fcn.00423d40
lea ecx, [esp + 0x170]
call fcn.0047774e
lea ecx, [esp + 0x170]
mov byte [esp + 0x204e0], 0x1c
call fcn.00401b30
lea ecx, [esp + 0x2e0]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
sub eax, edx
mov edx, dword [esp + 0x38]
mov dword [esp + 0x18], eax
mov eax, ebx
fild dword [esp + 0x18]
sub eax, edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], eax
fidiv dword [esp + 0x14]
fstp dword [esp + 0x50]
js 0x41e9a4
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], 0
test eax, eax
jl 0x41e97e
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
dec ecx
mov dword [esp + 0x24], ecx
fild dword [esp + 0x10]
fmul dword [esp + 0x50]
call fcn.0045b910
mov edx, dword [esp + 0x14]
mov dword [esp + 0x28], eax
cmp dword [esp + 0x1c], edx
jge 0x41e957
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x34]
sub eax, ecx
sub eax, edx
mov edx, dword [esp + 0x24]
push 0xcc0020
push edx
mov edx, dword [edi + 0x10]
push eax
push edx
mov edx, dword [esp + 0x2c]
push 1
push ecx
mov ecx, ebx
sub ecx, edx
mov edx, dword [esp + 0x50]
sub ecx, edx
mov edx, dword [esi + 4]
lea ecx, [ecx + edx - 1]
mov edx, dword [esi]
add eax, edx
push ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
mov eax, dword [esp + 0x1c]
mov edx, dword [edi + 0x10]
mov ecx, dword [esp + 0x28]
push 0xcc0020
push eax
push 0
push edx
mov edx, dword [esi + 4]
push 1
add eax, edx
mov edx, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
push eax
push edx
call fcn.00423db0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x24]
inc eax
dec ecx
dec edx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0xc]
cmp eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], edx
jle 0x41e8cf
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
inc eax
cmp eax, ecx
mov dword [esp + 0xc], eax
jle 0x41e8ae
mov edx, dword [edi + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
sub eax, edx
mov dword [esp + 0x18], eax
mov eax, ebx
fild dword [esp + 0x18]
sub eax, ecx
lea ecx, [esp + 0x2f0]
mov dword [esp + 0x14], eax
fidiv dword [esp + 0x14]
fstp dword [esp + 0x28]
call fcn.00476da2
lea ecx, [esp + 0x100]
mov dword [esp + 0x204e0], 0x1e
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x1f
test eax, eax
jne 0x41ea3d
xor eax, eax
jmp 0x41ea43
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x2f4]
call fcn.00476e59
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
lea ecx, [esp + 0x10c]
call fcn.00423d10
lea edx, [esp + 0x100]
lea ecx, [esp + 0x2f0]
push edx
call fcn.00423d40
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
mov dword [esp + 0x70], eax
mov eax, dword [esi + 4]
push 0xcc0020
push eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
push 0
push 0
lea ecx, [esp + 0x310]
call fcn.00423db0
mov dword [esp + 0x48], 0
mov ecx, dword [esp + 0x14]
mov eax, 1
cmp ecx, eax
mov dword [esp + 0x1c], eax
jl 0x41eb69
mov eax, dword [esp + 0x48]
cdq
sub eax, edx
mov edx, ecx
sar eax, 1
dec edx
mov dword [esp + 0x50], eax
mov dword [esp + 0x10], edx
fild dword [esp + 0x1c]
fmul dword [esp + 0x28]
call fcn.0045b910
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x48]
sub eax, edx
lea edx, [eax + ecx]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jle 0x41eb14
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
sub ecx, eax
sub ecx, edx
jmp 0x41eb18
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x10]
push 0xcc0020
push edx
mov edx, dword [edi + 0x10]
push eax
push edx
mov edx, dword [esp + 0x2c]
push 1
push ecx
mov ecx, ebx
sub ecx, edx
mov edx, dword [esp + 0x50]
sub ecx, edx
mov edx, dword [esi + 4]
add ecx, edx
push ecx
mov ecx, dword [esi]
add eax, ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
jle 0x41eae4
mov ecx, dword [esp + 0x48]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [edx + edx*2]
lea edx, [eax + eax*4]
cmp edx, ecx
jne 0x41eba4
lea eax, [esp + 0x5c]
mov ecx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x14]
cdq
sub eax, edx
sar eax, 1
push eax
call fcn.00402670
mov ecx, dword [esp + 0x48]
fild dword [esp + 0x1c]
mov eax, ecx
cdq
fmul dword [esp + 0x28]
sub eax, edx
sar eax, 1
mov dword [esp + 0x50], eax
fisub dword [esp + 0x50]
fcomp dword [0x486278]
fnstsw ax
test ah, 0x41
je 0x41ebce
cmp ecx, dword [esp + 0x18]
jg 0x41ebd8
inc ecx
mov dword [esp + 0x48], ecx
jmp 0x41eabb
mov ecx, dword [esp + 0x70]
push ecx
lea ecx, [esp + 0x2f4]
call fcn.00423d40
lea ecx, [esp + 0x100]
call fcn.0047774e
lea ecx, [esp + 0x100]
mov byte [esp + 0x204e0], 0x1e
call fcn.00401b30
lea ecx, [esp + 0x2f0]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esp + 0x2c0]
call fcn.00476da2
lea ecx, [esp + 0x140]
mov dword [esp + 0x204e0], 0x20
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x21
test eax, eax
jne 0x41ec6d
xor eax, eax
jmp 0x41ec73
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x2c4]
call fcn.00476e59
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
sub ebx, eax
mov eax, dword [esp + 0x3c]
sub eax, edx
push ebx
mov dword [esp + 0x1c], eax
push eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x148]
push eax
mov dword [esp + 0x20], ebx
call fcn.00423d10
lea ecx, [esp + 0x140]
push ecx
lea ecx, [esp + 0x2c4]
call fcn.00423d40
mov edx, dword [esi + 4]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x50], eax
mov eax, dword [esi]
push 0xcc0020
push edx
mov edx, dword [esp + 0x20]
push eax
push ecx
push ebx
push edx
push 0
push 0
lea ecx, [esp + 0x2e0]
call fcn.00423db0
mov eax, dword [esp + 0x14]
mov ebx, 1
cmp eax, ebx
jl 0x41ed7b
dec eax
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
push 0xcc0020
push 0
lea ecx, [esp + 0x2c8]
push 0
push ecx
push edx
mov edx, dword [esi]
push eax
mov eax, dword [esi + 4]
mov ecx, ebx
add ecx, eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x18]
lea eax, [ebx - 1]
push 0xcc0020
push eax
mov eax, dword [esi + 4]
push 0
push ecx
push 1
push edx
mov edx, dword [esi]
lea ecx, [ebx + eax - 1]
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
inc ebx
dec ecx
cmp ebx, eax
mov dword [esp + 0x10], ecx
jle 0x41ed01
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x2c0]
push edx
call fcn.00423d40
lea ecx, [esp + 0x140]
call fcn.0047774e
lea ecx, [esp + 0x140]
mov byte [esp + 0x204e0], 0x20
call fcn.00401b30
lea ecx, [esp + 0x2c0]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esp + 0x290]
call fcn.00476da2
lea ecx, [esp + 0x110]
mov dword [esp + 0x204e0], 0x22
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x23
test eax, eax
jne 0x41ee10
xor eax, eax
jmp 0x41ee16
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x294]
call fcn.00476e59
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov eax, ebx
sub eax, ecx
mov ecx, dword [esp + 0x3c]
sub ecx, edx
push eax
mov dword [esp + 0x1c], ecx
push ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x1c], eax
push ecx
lea ecx, [esp + 0x11c]
call fcn.00423d10
lea edx, [esp + 0x110]
lea ecx, [esp + 0x290]
push edx
call fcn.00423d40
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
mov dword [esp + 0x50], eax
mov eax, dword [esi + 4]
push 0xcc0020
push eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
push 0
push 0
lea ecx, [esp + 0x2b0]
call fcn.00423db0
mov ecx, dword [esp + 0x14]
mov eax, 1
cmp ecx, eax
mov dword [esp + 0xc], eax
jl 0x41ef46
mov edx, ecx
dec edx
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x1c]
push 0xcc0020
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x298]
push 0
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
push eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0x1c]
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x18]
push 0xcc0020
push eax
push 0
push ecx
mov ecx, dword [esp + 0x1c]
push 1
push edx
mov edx, dword [esp + 0x50]
mov eax, ebx
sub eax, edx
mov edx, dword [esi + 4]
sub eax, ecx
mov ecx, dword [esi]
add eax, edx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x1c], edx
jle 0x41eeb4
mov ecx, dword [esp + 0x50]
push ecx
lea ecx, [esp + 0x294]
call fcn.00423d40
lea ecx, [esp + 0x110]
call fcn.0047774e
lea ecx, [esp + 0x110]
mov byte [esp + 0x204e0], 0x22
call fcn.00401b30
lea ecx, [esp + 0x290]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esp + 0x2d0]
call fcn.00476da2
lea ecx, [esp + 0x160]
mov dword [esp + 0x204e0], 0x24
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x25
test eax, eax
jne 0x41efdb
xor eax, eax
jmp 0x41efe1
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x2d4]
call fcn.00476e59
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
sub ebx, eax
mov eax, dword [esp + 0x3c]
sub eax, edx
push ebx
mov dword [esp + 0x1c], eax
push eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x168]
push eax
call fcn.00423d10
lea ecx, [esp + 0x160]
push ecx
lea ecx, [esp + 0x2d4]
call fcn.00423d40
mov edx, dword [esi + 4]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x50], eax
mov eax, dword [esi]
push 0xcc0020
push edx
mov edx, dword [esp + 0x20]
push eax
push ecx
push ebx
push edx
push 0
push 0
lea ecx, [esp + 0x2f0]
call fcn.00423db0
mov ecx, dword [esp + 0x18]
mov eax, 1
cmp ecx, eax
mov dword [esp + 0x10], eax
jl 0x41f0e9
mov eax, ecx
dec eax
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push 0xcc0020
push 0
lea edx, [esp + 0x2d8]
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
push ebx
push eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0xc]
mov ecx, dword [edi + 0x10]
mov edx, dword [esi + 4]
push 0xcc0020
push 0
push eax
push ecx
mov ecx, dword [esi]
push ebx
push 1
add eax, ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
jle 0x41f071
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x2d0]
push edx
call fcn.00423d40
lea ecx, [esp + 0x160]
call fcn.0047774e
lea ecx, [esp + 0x160]
mov byte [esp + 0x204e0], 0x24
call fcn.00401b30
lea ecx, [esp + 0x2d0]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esp + 0x230]
call fcn.00476da2
lea ecx, [esp + 0xc0]
mov dword [esp + 0x204e0], 0x26
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x27
test eax, eax
jne 0x41f17e
xor eax, eax
jmp 0x41f184
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x234]
call fcn.00476e59
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
sub ebx, edx
sub eax, ecx
mov ecx, dword [ebp + 8]
push ebx
push eax
push ecx
lea ecx, [esp + 0xcc]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
call fcn.00423d10
lea edx, [esp + 0xc0]
lea ecx, [esp + 0x230]
push edx
call fcn.00423d40
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
mov dword [esp + 0x50], eax
mov eax, dword [esi + 4]
push 0xcc0020
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
push ebx
push eax
push 0
push 0
lea ecx, [esp + 0x250]
call fcn.00423db0
mov eax, dword [esp + 0x18]
mov ebx, 1
cmp eax, ebx
jl 0x41f298
mov ecx, dword [esp + 0x3c]
dec ecx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push 0xcc0020
push 0
lea edx, [esp + 0x238]
push 0
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esp + 0x48]
sub ecx, eax
mov eax, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
add eax, ebx
push edx
push eax
call fcn.00423db0
mov edx, dword [edi + 0x10]
mov eax, dword [esp + 0x14]
push 0xcc0020
lea ecx, [ebx - 1]
push 0
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
push eax
push 1
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edx + ebx - 1]
push eax
call fcn.00423db0
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
inc ebx
dec ecx
cmp ebx, eax
mov dword [esp + 0x10], ecx
jle 0x41f21a
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x230]
push eax
call fcn.00423d40
lea ecx, [esp + 0xc0]
call fcn.0047774e
lea ecx, [esp + 0xc0]
mov byte [esp + 0x204e0], 0x26
call fcn.00401b30
lea ecx, [esp + 0x230]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esp + 0x240]
call fcn.00476da2
lea ecx, [esp + 0xa8]
mov dword [esp + 0x204e0], 0x28
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x29
test eax, eax
jne 0x41f32d
xor eax, eax
jmp 0x41f333
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x244]
call fcn.00476e59
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov eax, ebx
sub eax, ecx
mov ecx, dword [esp + 0x3c]
sub ecx, edx
mov edx, dword [ebp + 8]
push eax
mov dword [esp + 0x1c], ecx
push ecx
push edx
lea ecx, [esp + 0xb4]
mov dword [esp + 0x20], eax
call fcn.00423d10
lea eax, [esp + 0xa8]
lea ecx, [esp + 0x240]
push eax
call fcn.00423d40
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 8]
push 0xcc0020
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x24]
push eax
push ecx
push edx
push 0
push 0
lea ecx, [esp + 0x260]
call fcn.00423db0
fild dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
mov dword [esp + 0x1c], 0
fst dword [esp + 0xc]
jle 0x41f3eb
fild dword [esp + 0x18]
mov dword [esp + 0x24], 0x3f800000
fst dword [esp + 0x44]
fdiv st(1)
fstp dword [esp + 0x10]
fstp st(0)
jmp 0x41f403
fild dword [esp + 0x18]
mov dword [esp + 0x10], 0x3f800000
fstp dword [esp + 0x44]
fdiv dword [esp + 0x44]
fstp dword [esp + 0x24]
fld dword [esp + 0x1c]
call fcn.0045b910
fld dword [esp + 0xc]
mov dword [esp + 0x64], eax
call fcn.0045b910
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x64]
push 0xcc0020
push 0
sub ecx, edx
push edx
sub ecx, dword [esp + 0x40]
lea edx, [esp + 0x24c]
push edx
mov edx, dword [esp + 0x48]
push eax
mov dword [esp + 0x84], ecx
push ecx
mov ecx, ebx
sub ecx, edx
mov edx, dword [esi]
mov dword [esp + 0x40], eax
sub ecx, eax
add ecx, dword [esi + 4]
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x28]
mov ecx, dword [edi + 0x10]
push 0xcc0020
push 0
sub eax, edx
mov edx, dword [esp + 0x20]
push 0
push ecx
mov ecx, dword [esi]
mov dword [esp + 0x60], eax
push eax
mov eax, dword [esi + 4]
push edx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x70]
mov ecx, dword [edi + 0x10]
push 0xcc0020
push edx
mov edx, dword [esp + 0x6c]
push eax
push ecx
mov ecx, dword [esp + 0x38]
push ecx
push edx
mov edx, ebx
sub edx, dword [esp + 0x50]
sub edx, ecx
mov ecx, dword [esi + 4]
add edx, ecx
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [esi]
add eax, edx
push eax
call fcn.00423db0
fld dword [esp + 0x1c]
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 0x41
je 0x41f4e0
fld dword [esp + 0x10]
fadd dword [esp + 0x1c]
fstp dword [esp + 0x1c]
fld dword [esp + 0xc]
fcomp dword [0x486278]
fnstsw ax
test ah, 1
jne 0x41f50a
fld dword [esp + 0xc]
fsub dword [esp + 0x24]
fst dword [esp + 0xc]
fcomp dword [0x486278]
fnstsw ax
test ah, 1
je 0x41f519
fld dword [esp + 0x1c]
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 1
je 0x41f52f
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
jmp 0x41f403
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x240]
push edx
call fcn.00423d40
lea ecx, [esp + 0xa8]
call fcn.0047774e
lea ecx, [esp + 0xa8]
mov byte [esp + 0x204e0], 0x28
call fcn.00401b30
lea ecx, [esp + 0x240]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esp + 0x260]
call fcn.00476da2
lea ecx, [esp + 0xc8]
mov dword [esp + 0x204e0], 0x2a
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x2b
test eax, eax
jne 0x41f5c4
xor eax, eax
jmp 0x41f5ca
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x264]
call fcn.00476e59
mov edx, dword [esp + 0x34]
mov ecx, dword [ebp + 8]
mov eax, ebx
mov ebx, dword [esp + 0x38]
sub eax, ebx
mov ebx, dword [esp + 0x3c]
sub ebx, edx
push eax
push ebx
push ecx
lea ecx, [esp + 0xd4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebx
call fcn.00423d10
lea edx, [esp + 0xc8]
lea ecx, [esp + 0x260]
push edx
call fcn.00423d40
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
mov dword [esp + 0x70], eax
mov eax, dword [esi + 4]
push 0xcc0020
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
push ebx
push 0
push 0
lea ecx, [esp + 0x280]
call fcn.00423db0
fild dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], 0
cmp ebx, eax
fst dword [esp + 0xc]
jle 0x41f67a
fild dword [esp + 0x18]
mov dword [esp + 0x24], 0x3f800000
fst dword [esp + 0x44]
fdiv st(1)
fstp dword [esp + 0x10]
fstp st(0)
jmp 0x41f692
fild dword [esp + 0x18]
mov dword [esp + 0x10], 0x3f800000
fstp dword [esp + 0x44]
fdiv dword [esp + 0x44]
fstp dword [esp + 0x24]
fld dword [esp + 0xc]
call fcn.0045b910
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x28], eax
fld dword [esp + 0x1c]
sub ecx, eax
mov dword [esp + 0x64], ecx
call fcn.0045b910
mov ebx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x64]
sub ebx, eax
push 0xcc0020
sub ebx, edx
push ecx
mov ecx, dword [esi + 4]
mov dword [esp + 0x58], eax
push eax
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x26c]
push edx
mov edx, dword [esi]
push eax
push ebx
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [edi + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x50]
push 0xcc0020
push 0
push ebx
push eax
mov eax, dword [esi + 4]
push ecx
push edx
mov edx, dword [esi]
mov ecx, ebx
add ecx, edx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov eax, dword [esp + 0x28]
mov edx, dword [edi + 0x10]
mov ecx, dword [esp + 0x64]
push 0xcc0020
push eax
push 0
push edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [ebp + 8]
add edx, eax
mov eax, dword [esi]
push ebx
push edx
push eax
call fcn.00423db0
fld dword [esp + 0x1c]
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 0x41
je 0x41f755
fld dword [esp + 0x10]
fadd dword [esp + 0x1c]
fstp dword [esp + 0x1c]
fld dword [esp + 0xc]
fcomp dword [0x486278]
fnstsw ax
test ah, 1
jne 0x41f77f
fld dword [esp + 0xc]
fsub dword [esp + 0x24]
fst dword [esp + 0xc]
fcomp dword [0x486278]
fnstsw ax
test ah, 1
je 0x41f78e
fld dword [esp + 0x1c]
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 1
je 0x41f7a4
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
jmp 0x41f692
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0x260]
push eax
call fcn.00423d40
lea ecx, [esp + 0xc8]
call fcn.0047774e
lea ecx, [esp + 0xc8]
mov byte [esp + 0x204e0], 0x2a
call fcn.00401b30
lea ecx, [esp + 0x260]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
sub ebx, eax
mov eax, dword [esp + 0x3c]
sub eax, edx
mov dword [esp + 0x1c], 0
cmp eax, ebx
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
jle 0x41f855
fild dword [esp + 0x18]
mov dword [esp + 0x10], 0x3f800000
fstp dword [esp + 0x44]
fild dword [esp + 0x14]
fstp dword [esp + 0x30]
fld dword [esp + 0x44]
fdiv dword [esp + 0x30]
fstp dword [esp + 0x64]
jmp 0x41f879
fild dword [esp + 0x14]
mov dword [esp + 0x64], 0x3f800000
fstp dword [esp + 0x30]
fild dword [esp + 0x18]
fstp dword [esp + 0x44]
fld dword [esp + 0x30]
fdiv dword [esp + 0x44]
fstp dword [esp + 0x10]
lea ecx, [esp + 0x280]
call fcn.00476da2
lea ecx, [esp + 0xd8]
mov dword [esp + 0x204e0], 0x2c
call fcn.00423d00
mov ebx, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x2d
test ebx, ebx
jne 0x41f8af
xor eax, eax
jmp 0x41f8b2
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x284]
call fcn.00476e59
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push ecx
push edx
push ebx
lea ecx, [esp + 0xe4]
call fcn.00423d10
lea eax, [esp + 0xd8]
lea ecx, [esp + 0x280]
push eax
call fcn.00423d40
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push 0xcc0020
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push ebx
push eax
push ecx
push 0
push 0
lea ecx, [esp + 0x2a0]
call fcn.00423db0
fld dword [esp + 0xc]
call fcn.0045b910
fld dword [esp + 0x1c]
mov ebx, eax
mov eax, dword [esp + 0x14]
sub eax, ebx
mov dword [esp + 0x28], eax
call fcn.0045b910
mov ecx, dword [esp + 0x28]
push 0xcc0020
push 0
lea edx, [esp + 0x288]
push 0
push edx
mov edx, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x48]
sub edx, eax
sub edx, ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
add ecx, ebx
add edx, eax
push ecx
mov ecx, dword [ebp + 8]
push edx
mov dword [esp + 0x70], eax
call fcn.00423db0
mov eax, dword [edi + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 4]
push 0xcc0020
push 0
push 0
push eax
mov eax, dword [esi]
push ebx
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x50]
push 0xcc0020
push ebx
push 0
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
add ecx, ebx
push eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
fld dword [esp + 0x1c]
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 0x41
je 0x41f9d8
fld dword [esp + 0x64]
fadd dword [esp + 0x1c]
fstp dword [esp + 0x1c]
fld dword [esp + 0xc]
fcomp dword [esp + 0x30]
fnstsw ax
test ah, 0x41
je 0x41f9fe
fld dword [esp + 0x10]
fadd dword [esp + 0xc]
fst dword [esp + 0xc]
fcomp dword [esp + 0x30]
fnstsw ax
test ah, 0x41
jne 0x41fa0d
fld dword [esp + 0x1c]
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 0x41
je 0x41fa23
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
jmp 0x41f91c
mov edx, dword [esp + 0x70]
lea ecx, [esp + 0x280]
push edx
call fcn.00423d40
lea ecx, [esp + 0xd8]
call fcn.0047774e
lea ecx, [esp + 0xd8]
mov byte [esp + 0x204e0], 0x2c
call fcn.00401b30
lea ecx, [esp + 0x280]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esp + 0x2a0]
call fcn.00476da2
lea ecx, [esp + 0xe8]
mov dword [esp + 0x204e0], 0x2e
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x2f
test eax, eax
jne 0x41fab8
xor eax, eax
jmp 0x41fabe
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x2a4]
call fcn.00476e59
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
sub ebx, edx
sub eax, ecx
mov ecx, dword [ebp + 8]
push ebx
push eax
push ecx
lea ecx, [esp + 0xf4]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
call fcn.00423d10
lea edx, [esp + 0xe8]
lea ecx, [esp + 0x2a0]
push edx
call fcn.00423d40
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
mov dword [esp + 0x70], eax
mov eax, dword [esi + 4]
push 0xcc0020
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
push ebx
push eax
push 0
push 0
lea ecx, [esp + 0x2c0]
call fcn.00423db0
fild dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], 0
cmp eax, ebx
fst dword [esp + 0xc]
jle 0x41fb6c
fild dword [esp + 0x18]
mov dword [esp + 0x10], 0x3f800000
fst dword [esp + 0x44]
fdiv st(1)
fstp dword [esp + 0x64]
fstp st(0)
jmp 0x41fb84
fild dword [esp + 0x18]
mov dword [esp + 0x64], 0x3f800000
fstp dword [esp + 0x44]
fdiv dword [esp + 0x44]
fstp dword [esp + 0x10]
fld dword [esp + 0xc]
call fcn.0045b910
fld dword [esp + 0x1c]
mov ebx, eax
mov eax, dword [esp + 0x14]
sub eax, ebx
mov dword [esp + 0x28], eax
call fcn.0045b910
mov ecx, dword [esp + 0x28]
push 0xcc0020
push ecx
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x2a8]
push 0
push edx
mov edx, dword [esp + 0x44]
sub ecx, eax
push ebx
sub ecx, edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [esi]
add ecx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x70], eax
call fcn.00423db0
mov edx, dword [edi + 0x10]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
push 0xcc0020
push ebx
push 0
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esi]
add edx, ebx
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x50]
mov eax, dword [esi + 4]
push 0xcc0020
push 0
push 0
push ecx
mov ecx, dword [esi]
push ebx
push edx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
fld dword [esp + 0x1c]
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 0x41
je 0x41fc3d
fld dword [esp + 0x64]
fadd dword [esp + 0x1c]
fstp dword [esp + 0x1c]
fld dword [esp + 0xc]
fcomp dword [0x486278]
fnstsw ax
test ah, 1
jne 0x41fc67
fld dword [esp + 0xc]
fsub dword [esp + 0x10]
fst dword [esp + 0xc]
fcomp dword [0x486278]
fnstsw ax
test ah, 1
je 0x41fc76
fld dword [esp + 0x1c]
fcomp dword [esp + 0x44]
fnstsw ax
test ah, 1
je 0x41fc8c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
jmp 0x41fb84
mov ecx, dword [esp + 0x70]
push ecx
lea ecx, [esp + 0x2a4]
call fcn.00423d40
lea ecx, [esp + 0xe8]
call fcn.0047774e
lea ecx, [esp + 0xe8]
mov byte [esp + 0x204e0], 0x2e
call fcn.00401b30
lea ecx, [esp + 0x2a0]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0xa
lea ecx, [esp + 0x3e4]
call fcn.00423e20
push 0
lea ecx, [esp + 0x49c]
mov dword [esp + 0x204e4], 0x30
call fcn.00426a80
mov edx, dword [esp + 0x38]
mov eax, ebx
sub eax, edx
push 8
push eax
mov byte [esp + 0x204e8], 0x31
mov dword [esp + 0x1c], eax
call fcn.0045c84d
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x5c], edx
mov edx, dword [esp + 0x3c]
sub eax, edx
push 8
push eax
mov dword [esp + 0x28], eax
call fcn.0045c84d
mov ecx, dword [esp + 0x60]
add esp, 0x10
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x54]
test ecx, ecx
je 0x41fd68
mov ecx, dword [esp + 0x50]
inc ecx
mov dword [esp + 0xc], ecx
test edx, edx
je 0x41fd6d
inc eax
imul eax, dword [esp + 0xc]
test eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], 0
jle 0x41feed
push 4
call fcn.004704db
mov edx, dword [esp + 0x14]
add esp, 4
lea ecx, [esp + 0x3e0]
mov dword [eax], edx
push eax
call fcn.00423f10
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x41fd86
mov eax, ecx
test eax, eax
jle 0x41feed
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3ec]
lea ecx, [esp + 0x498]
dec eax
push eax
push 0
call fcn.00426b90
lea ecx, [esp + 0x498]
call fcn.00426bd0
mov ecx, dword [esp + 0x3ec]
dec ecx
cmp eax, ecx
jle 0x41fdf3
xor eax, eax
push eax
lea ecx, [esp + 0x3e4]
call fcn.00423e50
mov edx, dword [esp + 0xc]
mov dword [esp + 0x50], eax
mov eax, dword [eax + 8]
push edx
mov dword [esp + 0x74], eax
mov eax, dword [eax]
push eax
call fcn.0045c84d
lea ecx, [eax*8 + 8]
add esp, 8
cmp ecx, dword [esp + 0x18]
mov dword [esp + 0x20], edx
jle 0x41fe49
mov ecx, dword [esp + 0x3c]
lea edx, [eax*8]
sub ecx, edx
mov edx, dword [esp + 0x34]
sub ecx, edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x64], ecx
jmp 0x41fe51
mov dword [esp + 0x64], 8
lea ecx, [edx*8 + 8]
cmp ecx, dword [esp + 0x14]
jle 0x41fe75
shl edx, 3
mov ecx, ebx
sub ecx, edx
mov edx, dword [esp + 0x38]
sub ecx, edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x28], ecx
jmp 0x41fe7d
mov dword [esp + 0x28], 8
lea ecx, [edx*8]
mov edx, dword [edi + 0x10]
shl eax, 3
push 0xcc0020
push ecx
push eax
push edx
mov edx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x78]
push edx
mov edx, dword [esi + 4]
add ecx, edx
push ecx
mov ecx, dword [esi]
add eax, ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x3e0]
push edx
call fcn.00423f90
mov eax, dword [esp + 0x70]
push eax
call fcn.00470504
mov eax, dword [esp + 0x14]
add esp, 4
dec eax
mov dword [esp + 0x10], eax
jne 0x41fdc2
lea ecx, [esp + 0x498]
mov byte [esp + 0x204e0], 0x30
call fcn.00426b10
lea ecx, [esp + 0x3e0]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00423e80
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [esp + 0x38]
mov eax, ebx
sub eax, edx
push 0x10
push eax
mov dword [esp + 0x1c], eax
call fcn.0045c84d
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x5c], edx
mov edx, dword [esp + 0x3c]
sub eax, edx
push 0x10
push eax
mov dword [esp + 0x28], eax
call fcn.0045c84d
mov ecx, dword [esp + 0x60]
add esp, 0x10
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x54]
test ecx, ecx
je 0x41ff7d
mov ecx, dword [esp + 0x50]
inc ecx
mov dword [esp + 0xc], ecx
test edx, edx
mov dword [esp + 0x2c], eax
je 0x41ff8a
inc eax
mov dword [esp + 0x2c], eax
mov edx, dword [esp + 0x2c]
push 2
push edx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x41ffb0
mov ecx, dword [esp + 0xc]
inc ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x2c]
inc ecx
mov dword [esp + 0x2c], ecx
jmp 0x41ffb4
mov ecx, dword [esp + 0x2c]
mov eax, ecx
imul eax, dword [esp + 0xc]
mov dword [esp + 0x64], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x48], 0
test eax, eax
mov dword [esp + 0x24], 0
jle 0x420105
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
shl eax, 1
mov dword [esp + 0x50], eax
jmp 0x41fff6
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x2c]
cmp eax, ecx
lea eax, [ecx + 1]
je 0x41ffff
mov eax, ecx
push eax
mov eax, dword [esp + 0x28]
push eax
call fcn.0045c84d
mov ecx, dword [esp + 0x1c]
add esp, 8
mov dword [esp + 0x70], eax
inc eax
shl eax, 4
cmp eax, ecx
jle 0x420034
mov ecx, dword [esp + 0x70]
mov eax, ebx
shl ecx, 4
sub eax, ecx
mov ecx, dword [esp + 0x38]
sub eax, ecx
mov dword [esp + 0x10], eax
jmp 0x42003c
mov dword [esp + 0x10], 0x10
mov eax, dword [esp + 0x48]
shl edx, 4
lea ecx, [edx + eax]
mov eax, dword [esp + 0x18]
cmp ecx, eax
jge 0x4200d9
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x14]
shl eax, 4
cmp eax, edx
mov dword [esp + 0x28], eax
jge 0x4200d9
mov eax, dword [esp + 0x70]
cdq
sub eax, edx
mov edx, dword [esp + 0x70]
sar eax, 1
shl eax, 1
cmp eax, edx
jne 0x420093
mov edx, dword [esp + 0xc]
xor eax, eax
test edx, edx
mov edx, dword [esp + 0x18]
setne al
mov dword [esp + 0x1c], eax
add eax, ecx
cmp eax, edx
jge 0x4200d9
jmp 0x4200ac
mov edx, dword [esp + 0xc]
xor eax, eax
test edx, edx
mov edx, dword [esp + 0x18]
sete al
mov dword [esp + 0x1c], eax
add eax, ecx
cmp eax, edx
jge 0x4200d9
mov edx, dword [esp + 0x28]
push 0xcc0020
push edx
push eax
mov eax, dword [edi + 0x10]
push eax
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [esi + 4]
add eax, edx
mov edx, dword [esp + 0x30]
push 1
push eax
add ecx, dword [esi]
add ecx, edx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x64]
inc eax
cmp eax, ecx
mov dword [esp + 0x24], eax
jl 0x41ffee
mov eax, ecx
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x48]
add edx, 2
cmp edx, 0x10
mov dword [esp + 0x48], edx
jl 0x41ffcf
mov edx, dword [esp + 0xc]
inc edx
cmp edx, 2
mov dword [esp + 0xc], edx
jl 0x41ffc7
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [esp + 0x38]
push 0x10
sub ebx, edx
push ebx
mov dword [esp + 0x1c], ebx
call fcn.0045c84d
mov ebx, eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x5c], edx
mov edx, dword [esp + 0x3c]
sub eax, edx
push 0x10
push eax
mov dword [esp + 0x28], eax
call fcn.0045c84d
mov ecx, dword [esp + 0x64]
add esp, 0x10
test ecx, ecx
je 0x42017c
inc ebx
test edx, edx
mov dword [esp + 0x2c], eax
je 0x420189
inc eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
push 2
push eax
mov ecx, edi
call fcn.00423df0
test al, al
je 0x4201a7
mov ecx, dword [esp + 0x2c]
inc ebx
inc ecx
mov dword [esp + 0x2c], ecx
jmp 0x4201ab
mov ecx, dword [esp + 0x2c]
mov eax, ecx
mov dword [esp + 0xc], 0
imul eax, ebx
mov dword [esp + 0x64], eax
mov dword [esp + 0x24], 0
xor ebx, ebx
test eax, eax
mov dword [esp + 0x28], ebx
jle 0x420313
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
shl eax, 1
mov dword [esp + 0x50], eax
jmp 0x4201e9
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x50]
cmp eax, ecx
lea eax, [ecx + 1]
je 0x4201f2
mov eax, ecx
push eax
push ebx
call fcn.0045c84d
mov ebx, dword [esp + 0x20]
lea ecx, [edx + 1]
shl ecx, 4
add esp, 8
cmp ecx, ebx
mov dword [esp + 0x48], eax
jle 0x420227
mov ecx, edx
shl ecx, 4
mov ebx, ecx
mov ecx, dword [esp + 0x3c]
sub ecx, ebx
mov ebx, dword [esp + 0x34]
sub ecx, ebx
mov dword [esp + 0x10], ecx
jmp 0x42022f
mov dword [esp + 0x10], 0x10
mov ebx, dword [esp + 0x18]
mov ecx, edx
shl ecx, 4
cmp ecx, ebx
jge 0x4202e9
mov ebx, dword [esp + 0x24]
shl eax, 4
add ebx, eax
mov eax, dword [esp + 0x14]
cmp ebx, eax
jge 0x4202e9
mov eax, dword [esp + 0x48]
add eax, edx
mov dword [esp + 0x70], eax
cdq
sub eax, edx
mov edx, dword [esp + 0x70]
sar eax, 1
shl eax, 1
cmp eax, edx
jne 0x4202a7
mov edx, dword [esp + 0xc]
xor eax, eax
test edx, edx
mov edx, dword [esp + 0x14]
setne al
mov dword [esp + 0x1c], eax
add eax, ebx
cmp eax, edx
jge 0x4202e9
mov edx, dword [edi + 0x10]
push 0xcc0020
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
mov edx, dword [esi + 4]
push 1
push eax
mov eax, dword [esp + 0x34]
add edx, ebx
add edx, eax
push edx
jmp 0x4202de
mov edx, dword [esp + 0xc]
xor eax, eax
test edx, edx
mov edx, dword [esp + 0x14]
sete al
mov dword [esp + 0x1c], eax
add eax, ebx
cmp eax, edx
jge 0x4202e9
mov edx, dword [esp + 0x10]
push 0xcc0020
push eax
mov eax, dword [edi + 0x10]
push ecx
push eax
mov eax, dword [esi + 4]
push 1
push edx
mov edx, dword [esp + 0x34]
add eax, ebx
add eax, edx
push eax
add ecx, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x64]
inc ebx
cmp ebx, eax
mov dword [esp + 0x28], ebx
jl 0x4201e1
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
add edx, 2
cmp edx, 0x10
mov dword [esp + 0x24], edx
jl 0x4201c4
mov edx, dword [esp + 0xc]
inc edx
cmp edx, 2
mov dword [esp + 0xc], edx
jl 0x4201bc
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [esp + 0x38]
mov eax, ebx
sub eax, edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], eax
cdq
and edx, 7
add eax, edx
sar eax, 3
inc eax
mov dword [esp + 0x48], eax
cmp eax, ecx
jl 0x420430
mov ecx, dword [esp + 0x24]
lea edx, [eax*8]
mov dword [esp + 0x1c], ecx
mov ecx, ebx
mov dword [esp + 0xc], edx
sub ecx, edx
lea edx, [eax + 1]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x28], edx
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jl 0x4203fe
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
sub ecx, edx
mov edx, dword [esp + 0x1c]
cmp edx, ecx
jg 0x4203fe
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov ecx, 8
add edx, ecx
cmp edx, eax
jle 0x4203d3
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x38]
sub ecx, edx
test ecx, ecx
jle 0x4203fa
mov eax, dword [esp + 0xc]
mov edx, dword [edi + 0x10]
push 0xcc0020
push eax
push 0
push edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [esp + 0x30]
add edx, eax
mov eax, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x1c]
mov ecx, 8
sub edx, ecx
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x10]
add edx, ecx
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0xc]
sub edx, ecx
mov ecx, dword [esp + 0x28]
dec ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x28], ecx
jne 0x420398
mov edx, dword [esp + 0x3c]
lea ecx, [eax*8]
mov eax, dword [esp + 0x34]
sub ecx, eax
mov eax, dword [esp + 0x24]
add ecx, edx
cmp eax, ecx
jg case.default.0x41a6e9
mov ecx, eax
mov eax, dword [ebp + 0x14]
inc ecx
lea edx, [esp + 0x5c]
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
call fcn.00402670
mov eax, dword [esp + 0x48]
xor ecx, ecx
jmp 0x42036e
mov edx, dword [esp + 0x38]
mov eax, ebx
sub eax, edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
inc eax
mov dword [esp + 0x64], eax
cmp eax, ecx
jle 0x420516
mov edx, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esp + 0xc], edx
mov dword [esp + 0x28], eax
test edx, edx
jle 0x420501
mov ecx, dword [esp + 0x3c]
sub ecx, dword [esp + 0x34]
cmp edx, ecx
jg 0x420501
mov ecx, dword [esp + 0x14]
lea edx, [ebx + 8]
cmp edx, ecx
mov eax, 8
jle 0x4204d6
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0xc]
sub eax, edx
add eax, ecx
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0xc]
push 0xcc0020
push ebx
push 0
push ecx
mov ecx, dword [esi]
push eax
mov eax, dword [esi + 4]
push edx
add eax, ebx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
add ebx, 8
sub edx, 8
dec ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x28], ecx
jne 0x4204a6
mov ebx, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
lea edx, [eax*8]
mov eax, dword [esp + 0x1c]
sub edx, ebx
add edx, ecx
cmp eax, edx
jg case.default.0x41a6e9
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, eax
lea eax, [esp + 0x5c]
inc ebx
push eax
dec edx
push ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], edx
call fcn.00402670
mov eax, dword [esp + 0x64]
xor ecx, ecx
jmp 0x420494
mov edx, dword [esp + 0x38]
mov eax, ebx
sub eax, edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x3c]
sar eax, 3
inc eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x48]
cmp eax, ecx
jl 0x42066b
mov ecx, dword [esp + 0x2c]
lea edx, [eax*8]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], ecx
mov ecx, ebx
mov dword [esp + 0xc], edx
sub ecx, edx
mov edx, dword [esp + 0x48]
inc edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x64], ecx
mov dword [esp + 0x30], edx
test eax, eax
jl 0x420630
mov edx, dword [esp + 0x3c]
sub edx, dword [esp + 0x34]
cmp eax, edx
jg 0x420630
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
add eax, 8
mov dword [esp + 0x28], 8
cmp eax, edx
jle 0x4205f6
mov edx, dword [esp + 0x38]
mov eax, ecx
sub eax, edx
test eax, eax
mov dword [esp + 0x28], eax
jle 0x420630
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0xc]
sub eax, edx
mov edx, dword [edi + 0x10]
push 0xcc0020
push ecx
push eax
push edx
mov edx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x38]
push edx
mov edx, dword [esi + 4]
add edx, ecx
mov ecx, dword [esi]
add ecx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
add eax, 8
sub edx, 8
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x30]
sub eax, 8
add ecx, 8
dec edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x64], ecx
mov dword [esp + 0x30], edx
jne 0x4205bf
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x3c]
lea edx, [eax*8]
mov eax, dword [esp + 0x34]
sub edx, eax
mov eax, dword [esp + 0x1c]
add edx, ecx
cmp eax, edx
jg case.default.0x41a6e9
mov edx, dword [esp + 0x2c]
mov ecx, dword [ebp + 0x14]
inc eax
dec edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x34], edx
call fcn.00402670
xor ecx, ecx
jmp 0x420587
mov edx, dword [esp + 0x38]
mov eax, ebx
sub eax, edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
inc eax
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x3c]
sub eax, ebx
mov dword [esp + 0x50], eax
cmp dword [esp + 0x48], ecx
jle 0x42078a
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
xor ebx, ebx
add eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0xc], edx
mov dword [esp + 0x28], eax
test edx, edx
jle 0x420766
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x34]
sub ecx, eax
cmp edx, ecx
jg 0x420766
mov eax, dword [esp + 0x14]
lea edx, [ebx + 8]
cmp edx, eax
mov ecx, 8
jle 0x420734
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0xc]
sub ecx, edx
add ecx, eax
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x34]
sub eax, edx
mov edx, dword [edi + 0x10]
push 0xcc0020
push ebx
push eax
push edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [esp + 0x20]
add edx, ebx
push ecx
mov ecx, dword [esi]
add ecx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
add ebx, 8
add eax, 8
sub edx, 8
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
dec eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x28], eax
jne 0x420702
mov edx, dword [esp + 0x48]
mov ebx, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
lea eax, [edx*8]
mov edx, dword [esp + 0x3c]
sub eax, ebx
add eax, edx
cmp ecx, eax
jg case.default.0x41a6e9
mov ebx, dword [esp + 0x24]
mov edx, dword [ebp + 0x14]
mov eax, ecx
lea ecx, [esp + 0x5c]
inc eax
dec ebx
push ecx
mov ecx, dword [ebp + 0xc]
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], ebx
call fcn.00402670
mov eax, dword [esp + 0x50]
xor ecx, ecx
jmp 0x4206dc
lea eax, [esp + 0x4d8]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x10], eax
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x28], eax
cdq
and edx, 0xff
add eax, edx
mov edx, dword [esp + 0x10]
sar eax, 8
mov byte [ecx + edx], al
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x64]
inc ecx
add eax, edx
cmp ecx, 0xff
mov dword [esp + 0x28], eax
jle 0x4207f0
mov ecx, dword [esp + 0x10]
inc edx
add ecx, 0x100
cmp edx, 0x100
mov dword [esp + 0x64], edx
mov dword [esp + 0x10], ecx
jl 0x4207e8
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
mov ecx, dword [ebp + 0x14]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
xor ecx, ecx
shr eax, 0x1f
add edx, eax
mov eax, 0xb
sub eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0x24]
cmp eax, ecx
jne 0x420870
mov dword [esp + 0x10], ecx
jmp 0x420877
mov edx, dword [eax + 4]
mov dword [esp + 0x10], edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x348], 0x28
cmp eax, ecx
mov word [esp + 0x356], cx
jne 0x420895
xor eax, eax
jmp 0x420898
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x348]
push 0
push ecx
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
je case.default.0x41a6e9
mov eax, dword [esp + 0x34c]
mov word [esp + 0x356], 0x18
mov dword [esp + 0x358], 0
lea eax, [eax + eax*2]
lea eax, [eax*8 + 0x1f]
sar eax, 3
and al, 0xfc
imul eax, dword [esp + 0x350]
mov dword [esp + 0x50], eax
mov dword [esp + 0x35c], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x420904
mov eax, dword [eax + 4]
push 0
lea ecx, [esp + 0xa0]
push 0
push ecx
lea edx, [esp + 0x354]
push 0
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateDIBSection]
test eax, eax
mov dword [esp + 0x64], eax
je case.default.0x41a6e9
mov eax, dword [ebp + 8]
test eax, eax
je 0x420937
mov eax, dword [eax + 4]
push 0
lea ecx, [esp + 0x9c]
push 0
push ecx
lea edx, [esp + 0x354]
push 0
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateDIBSection]
test eax, eax
mov dword [esp + 0x44], eax
jne 0x42097e
mov eax, dword [esp + 0x64]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 8]
test eax, eax
je 0x420988
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x98]
lea ecx, [esp + 0x348]
push 0
push ecx
mov ecx, dword [esp + 0x358]
push edx
mov edx, dword [esp + 0x1c]
push ecx
push 0
push edx
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x420aae
mov dword [esp + 0x48], 0
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x9c]
shl eax, 8
mov dword [esp + 0x28], edx
lea ecx, [esp + eax + 0x4d8]
mov eax, dword [esp + 0x98]
mov dword [esp + 0x70], ecx
mov ecx, dword [esp + 0x50]
add ecx, eax
cmp eax, ecx
mov dword [esp + 0x1c], ecx
jae 0x420a23
mov ecx, dword [esp + 0x70]
xor edx, edx
mov dl, byte [eax]
mov dl, byte [edx + ecx]
mov ecx, dword [esp + 0x28]
mov byte [ecx], dl
inc ecx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x1c]
inc eax
cmp eax, ecx
jb 0x420a04
mov eax, dword [ebp + 8]
test eax, eax
je 0x420a2d
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x9c]
lea ecx, [esp + 0x348]
push 1
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x38]
push ecx
push 0
push 0
push 0
push ecx
mov ecx, dword [esp + 0x36c]
push ecx
mov ecx, dword [esp + 0x54]
push edx
push ecx
push eax
call dword [sym.imp.GDI32.dll_SetDIBitsToDevice]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x10]
imul ecx, dword [esp + 0xc]
add edx, ecx
cmp eax, edx
ja 0x420a93
mov edx, dword [esp + 0x10]
sub edx, eax
add edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x48]
inc eax
jmp 0x420a9f
mov ecx, dword [esp + 0x10]
xor edx, edx
sub eax, ecx
div dword [esp + 0xc]
cmp eax, 0x100
mov dword [esp + 0x48], eax
jl 0x4209d2
mov eax, dword [esp + 0x64]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x44]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [edi + 0x10]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x34]
push 0xcc0020
push 0
push 0
sub ebx, ecx
push edx
sub eax, edi
push ebx
push eax
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
xor edx, edx
mov dword [esp + 0x10], edx
xor ecx, ecx
shl edx, 8
xor eax, eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x50], edx
mov dword [esp + 0x64], eax
cdq
and edx, 0xff
add eax, edx
mov edx, dword [esp + 0x50]
sub ecx, edx
mov edx, dword [esp + 0x10]
sar eax, 8
mov byte [esp + ecx + 0x203d8], al
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x64]
inc ecx
add eax, edx
cmp ecx, 0xff
mov dword [esp + 0x28], ecx
mov dword [esp + 0x64], eax
jle 0x420b22
inc edx
cmp edx, 0x100
mov dword [esp + 0x10], edx
jl 0x420b0f
mov eax, dword [esi + 4]
mov edx, dword [esi]
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x24], eax
mov eax, 0x51eb851f
mov dword [esp + 0x48], edx
imul ecx
sar edx, 5
mov ecx, edx
mov edi, dword [edi + 0x24]
shr ecx, 0x1f
add edx, ecx
mov eax, 0xc
sub eax, edx
mov dword [esp + 0xc], eax
xor eax, eax
cmp edi, eax
jne 0x420ba2
mov dword [esp + 0x10], eax
jmp 0x420ba9
mov edx, dword [edi + 4]
mov dword [esp + 0x10], edx
mov edi, dword [ebp + 8]
mov dword [esp + 0x31c], 0x28
cmp edi, eax
mov word [esp + 0x32a], ax
je 0x420bc6
mov eax, dword [edi + 4]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x31c]
push 0
push ecx
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
je case.default.0x41a6e9
mov eax, dword [esp + 0x320]
mov word [esp + 0x32a], 0x18
lea eax, [eax + eax*2]
lea eax, [eax*8 + 0x1f]
sar eax, 3
and al, 0xfc
imul eax, dword [esp + 0x324]
mov dword [esp + 0x50], eax
mov dword [esp + 0x330], eax
xor eax, eax
cmp edi, eax
mov dword [esp + 0x32c], eax
je 0x420c2d
mov eax, dword [edi + 4]
push 0
lea ecx, [esp + 0xa4]
push 0
push ecx
lea edx, [esp + 0x328]
push 0
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov edi, eax
test edi, edi
mov dword [esp + 0x2c], edi
je case.default.0x41a6e9
mov eax, dword [ebp + 8]
test eax, eax
je 0x420c62
mov eax, dword [eax + 4]
push 0
lea ecx, [esp + 0xa8]
push 0
push ecx
lea edx, [esp + 0x328]
push 0
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateDIBSection]
test eax, eax
mov dword [esp + 0x30], eax
jne 0x420ca5
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 8]
test eax, eax
je 0x420caf
mov eax, dword [eax + 4]
mov edx, dword [esp + 0xa4]
lea ecx, [esp + 0x31c]
push 0
push ecx
mov ecx, dword [esp + 0x32c]
push edx
mov edx, dword [esp + 0x1c]
push ecx
push 0
push edx
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x420dca
xor edi, edi
mov eax, edi
mov edx, dword [esp + 0xa0]
shl eax, 8
mov dword [esp + 0x28], edx
lea ecx, [esp + eax + 0x104d8]
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x70], ecx
mov ecx, dword [esp + 0x50]
add ecx, eax
cmp eax, ecx
mov dword [esp + 0x64], ecx
jae 0x420d42
mov ecx, dword [esp + 0x70]
xor edx, edx
mov dl, byte [eax]
mov dl, byte [edx + ecx]
mov ecx, dword [esp + 0x28]
mov byte [ecx], dl
inc ecx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x64]
inc eax
cmp eax, ecx
jb 0x420d23
mov eax, dword [ebp + 8]
test eax, eax
je 0x420d4c
mov eax, dword [eax + 4]
mov edx, dword [esp + 0xa0]
lea ecx, [esp + 0x31c]
push 1
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x30]
push ecx
push 0
push 0
push 0
push ecx
mov ecx, dword [esp + 0x340]
push ecx
mov ecx, dword [esp + 0x6c]
push edx
push ecx
push eax
call dword [sym.imp.GDI32.dll_SetDIBitsToDevice]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, edi
mov edx, dword [esp + 0x10]
imul ecx, dword [esp + 0xc]
add edx, ecx
cmp eax, edx
ja 0x420dac
mov edx, dword [esp + 0x10]
sub edx, eax
add edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
jmp 0x420dba
mov ecx, dword [esp + 0x10]
xor edx, edx
sub eax, ecx
div dword [esp + 0xc]
mov edi, eax
cmp edi, 0x100
jl 0x420cf3
mov edi, dword [esp + 0x2c]
push edi
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
call edi
mov eax, dword [esp + 0x30]
push eax
call edi
mov edi, dword [esp + 0x38]
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x3c]
mov esi, dword [esi]
sub ebx, edi
add ebx, ecx
push ebx
mov ebx, dword [esp + 0x38]
sub eax, ebx
add eax, esi
push eax
push ecx
push esi
lea ecx, [esp + 0x478]
call fcn.00423ce0
push 0
lea ecx, [esp + 0x444]
call fcn.004777b4
lea ecx, [esp + 0x468]
push eax
push ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x204e8], 0x32
call fcn.00423d70
lea ecx, [esp + 0x440]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00409240
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
sub ecx, edx
sub ebx, eax
mov eax, ecx
imul eax, ebx
push ebx
mov dword [esp + 0x1c], ecx
lea edx, [eax + eax*2]
mov eax, dword [esi + 4]
mov dword [esp + 0x54], edx
mov edx, dword [ebp + 8]
push ecx
mov ecx, dword [esi]
push eax
mov eax, dword [edx + 4]
push ecx
push eax
mov dword [esp + 0x28], ebx
call fcn.0042c8f9
mov ecx, dword [esp + 0x2c]
mov edx, dword [edi + 0x10]
push ebx
mov dword [esp + 0x24], eax
mov eax, dword [edx + 4]
push ecx
push 0
push 0
push eax
call fcn.0042c8f9
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov edi, eax
mov eax, dword [esp + 0x40]
push 0
push ebx
push eax
push ecx
mov ecx, dword [ebp + 8]
push edx
push ebx
push eax
mov eax, dword [esp + 0x50]
mov edx, dword [ecx + 4]
push eax
push edx
mov dword [esp + 0xbc], edi
call fcn.0042c7f4
mov eax, 0x55555556
add esp, 0x4c
imul dword [esp + 0x50]
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
mov byte [esp + 0x6f], 1
test eax, eax
jle 0x420fd3
mov edx, dword [esp + 0xc]
mov ecx, edi
sub ecx, edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x28]
lea eax, [edx + 2]
mov dword [esp + 0x2c], ecx
mov edi, dword [esp + 0x1c]
xor ebx, ebx
mov bl, byte [eax]
xor ecx, ecx
mov dword [esp + 0x48], ebx
xor ebx, ebx
mov bl, byte [edi]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x64], ebx
mov cl, byte [eax - 2]
xor ebx, ebx
xor edx, edx
mov bl, byte [edi + eax - 1]
mov dl, byte [eax - 1]
mov dword [esp + 0x24], ebx
xor ebx, ebx
mov bl, byte [edi + eax]
mov edi, dword [esp + 0x64]
cmp ecx, edi
mov dword [esp + 0x10], ebx
jle 0x420f5c
dec ecx
cmp ecx, edi
jge 0x420f5f
inc ecx
mov edi, dword [esp + 0x24]
cmp edx, edi
jle 0x420f6a
dec edx
cmp edx, edi
jge 0x420f6d
inc edx
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x48]
cmp ebx, edi
jle 0x420f80
mov edi, ebx
dec edi
mov dword [esp + 0x48], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x48]
cmp ebx, edi
jge 0x420f8d
inc ebx
mov edi, dword [esp + 0x64]
mov byte [eax - 2], cl
mov byte [eax - 1], dl
cmp ecx, edi
mov byte [eax], bl
je 0x420fae
cmp edx, dword [esp + 0x24]
je 0x420fae
cmp ebx, dword [esp + 0x10]
je 0x420fae
mov byte [esp + 0x6f], 0
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
add edi, 3
add eax, 3
dec ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x2c], ecx
jne 0x420f1c
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x70]
mov eax, dword [esp + 0x18]
mov edx, dword [esi + 4]
mov ecx, dword [esi]
push 0
push ebx
push eax
push edx
mov edx, dword [esp + 0x1c]
push ecx
push ebx
push eax
mov eax, dword [ebp + 8]
push edx
mov ecx, dword [eax + 4]
push ecx
call fcn.0042c7f4
mov edx, dword [ebp + 0xc]
add esp, 0x24
mov eax, dword [edx + 0x70]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x421028
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov al, byte [esp + 0x6f]
test al, al
je 0x420ef0
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push eax
call esi
push edi
call esi
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [esp + 0x38]
mov eax, ebx
sub eax, edx
mov dword [esp + 0x1c], ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x50], eax
js case.default.0x41a6e9
xor ebx, ebx
mov ecx, dword [esp + 0x1c]
push 2
push ecx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x4210ff
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], eax
js 0x421188
mov eax, dword [esp + 0xc]
mov edx, dword [edi + 0x10]
push 0xcc0020
push ebx
push eax
push edx
mov edx, dword [esi + 4]
mov ecx, ebx
push 8
add ecx, edx
push 1
push ecx
mov ecx, dword [esi]
add eax, ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
mov edx, dword [esp + 0xc]
push 0xa
push edx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x4210e9
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
inc eax
cmp eax, ecx
mov dword [esp + 0xc], eax
jle 0x42109e
jmp 0x421188
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
mov eax, ecx
mov dword [esp + 0x10], 0
sub eax, edx
mov dword [esp + 0x18], eax
js 0x421188
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x34]
mov edx, dword [edi + 0x10]
sub eax, ecx
push 0xcc0020
push ebx
push eax
push edx
mov edx, dword [esi + 4]
mov ecx, ebx
push 8
add ecx, edx
push 1
push ecx
mov ecx, dword [esi]
add eax, ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
mov edx, dword [esp + 0x10]
push 0xa
push edx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x42116e
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
jle 0x42111d
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x50]
inc eax
add ebx, 8
cmp eax, ecx
mov dword [esp + 0x1c], eax
jle 0x421070
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
sub eax, edx
mov dword [esp + 0x24], ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x50], eax
js case.default.0x41a6e9
mov dword [esp + 0x1c], ecx
mov edx, dword [esp + 0x24]
push 2
push edx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x42126b
mov ecx, dword [esp + 0x38]
mov eax, ebx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
js 0x4212f8
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
mov edx, dword [edi + 0x10]
push 0xcc0020
push ecx
push eax
push edx
mov edx, dword [esi + 4]
add ecx, edx
mov edx, dword [esi]
push 1
push 8
add eax, edx
push ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
mov eax, dword [esp + 0xc]
push 0xa
push eax
mov ecx, edi
call fcn.00423df0
test al, al
je 0x421255
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
inc eax
cmp eax, ecx
mov dword [esp + 0xc], eax
jle 0x421208
jmp 0x4212f8
mov ecx, dword [esp + 0x38]
mov eax, ebx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
js 0x4212f8
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x10]
push 0xcc0020
push eax
mov eax, dword [esp + 0x24]
mov edx, ebx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
push 1
sub edx, ecx
mov ecx, dword [esp + 0x4c]
sub edx, ecx
mov ecx, dword [esi + 4]
add edx, ecx
mov ecx, dword [ebp + 8]
push 8
push edx
add eax, dword [esi]
push eax
call fcn.00423db0
mov eax, dword [esp + 0xc]
push 0xa
push eax
mov ecx, edi
call fcn.00423df0
test al, al
je 0x4212de
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
jle 0x421285
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x50]
inc eax
add edx, 8
cmp eax, ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], edx
jle 0x4211dc
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [esp + 0x38]
mov eax, ebx
sub eax, edx
mov dword [esp + 0x2c], ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
inc eax
cmp eax, ecx
mov dword [esp + 0x50], eax
jl case.default.0x41a6e9
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x2c]
push 2
push eax
mov ecx, edi
call fcn.00423df0
test al, al
je 0x42140a
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], eax
js 0x4214b3
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x38]
sub eax, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov edx, dword [edi + 0x10]
push 0xcc0020
push ecx
push eax
push edx
mov edx, dword [esp + 0x48]
mov ecx, ebx
push 8
sub ecx, edx
mov edx, dword [esp + 0x30]
sub ecx, edx
mov edx, dword [esi + 4]
add ecx, edx
push 1
push ecx
mov ecx, dword [esi]
add eax, ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
mov edx, dword [esp + 0xc]
push 0xa
push edx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x4213f4
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
inc eax
cmp eax, ecx
mov dword [esp + 0xc], eax
jle 0x421399
jmp 0x4214b3
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
mov eax, ecx
mov dword [esp + 0xc], 0
sub eax, edx
mov dword [esp + 0x18], eax
js 0x4214b3
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x38]
sub eax, edx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x10]
sub eax, ecx
mov ecx, dword [edi + 0x10]
push 0xcc0020
push edx
push eax
push ecx
mov ecx, dword [esp + 0x48]
mov edx, ebx
push 8
sub edx, ecx
mov ecx, dword [esp + 0x30]
sub edx, ecx
mov ecx, dword [esi + 4]
add edx, ecx
mov ecx, dword [ebp + 8]
push 1
push edx
add eax, dword [esi]
push eax
call fcn.00423db0
mov eax, dword [esp + 0xc]
push 0xa
push eax
mov ecx, edi
call fcn.00423df0
test al, al
je 0x421499
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x18]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x48], edx
jle 0x42143a
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov ecx, 8
inc eax
add edx, ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x24]
sub edx, ecx
mov ecx, dword [esp + 0x50]
cmp eax, ecx
mov dword [esp + 0x24], edx
jle 0x421359
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
sub eax, edx
mov dword [esp + 0x48], ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
inc eax
cmp eax, ecx
mov dword [esp + 0x50], eax
jl case.default.0x41a6e9
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x48]
push 2
push ecx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x4215c5
mov ecx, dword [esp + 0x38]
mov eax, ebx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
js 0x421666
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x34]
sub eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [edi + 0x10]
push 0xcc0020
push eax
push ecx
push edx
mov edx, dword [esi + 4]
push 1
add eax, edx
push 8
push eax
mov eax, dword [esi]
add eax, ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
mov ecx, dword [esp + 0xc]
push 0xa
push ecx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x4215af
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
inc eax
cmp eax, ecx
mov dword [esp + 0xc], eax
jle 0x421562
jmp 0x421666
mov ecx, dword [esp + 0x38]
mov eax, ebx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
js 0x421666
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x34]
sub ecx, edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov edx, dword [edi + 0x10]
push 0xcc0020
push ecx
push eax
push edx
mov edx, dword [esp + 0x1c]
mov ecx, ebx
push 1
sub ecx, edx
mov edx, dword [esp + 0x4c]
sub ecx, edx
mov edx, dword [esi + 4]
add ecx, edx
mov edx, dword [esi]
push 8
add edx, eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0xc]
push 0xa
push eax
mov ecx, edi
call fcn.00423df0
test al, al
je 0x42164c
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x24], edx
jle 0x4215f1
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x50]
inc eax
sub edx, 8
cmp eax, ecx
mov dword [esp + 0x48], eax
mov dword [esp + 0x1c], edx
jle 0x421524
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esp + 0x1e0]
call fcn.00476da2
lea ecx, [esp + 0xf8]
mov dword [esp + 0x204e0], 0x33
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x34
test eax, eax
jne 0x4216d3
xor eax, eax
jmp 0x4216d9
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x1e4]
call fcn.00476e59
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
sub ebx, edx
sub eax, ecx
mov ecx, dword [ebp + 8]
push ebx
push eax
push ecx
lea ecx, [esp + 0x104]
mov dword [esp + 0x24], eax
call fcn.00423d10
lea edx, [esp + 0xf8]
lea ecx, [esp + 0x1e0]
push edx
call fcn.00423d40
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov eax, dword [esi + 4]
push 0xcc0020
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
push ebx
push eax
push 0
push 0
lea ecx, [esp + 0x200]
call fcn.00423db0
mov eax, ebx
mov dword [esp + 0xc], 0
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x70], eax
js 0x421923
xor ebx, ebx
mov ecx, dword [esp + 0xc]
push 2
push ecx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x42184b
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], 0
test eax, eax
jl 0x42190b
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
sub eax, ecx
mov ecx, dword [esp + 0x1c]
push 0xcc0020
push ebx
mov dword [esp + 0x58], eax
push eax
mov eax, dword [edi + 0x10]
mov edx, ebx
push eax
mov eax, dword [esi]
push 8
push ecx
mov ecx, dword [esi + 4]
add edx, ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov edx, dword [esp + 0x50]
push 0xcc0020
push ebx
lea ecx, [esp + 0x1e8]
push 0
push ecx
mov ecx, dword [esi]
push 8
push edx
mov edx, dword [esi + 4]
mov eax, ebx
add eax, edx
push eax
mov eax, dword [esp + 0x38]
add ecx, eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov edx, dword [esp + 0x1c]
push 0xa
push edx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x421828
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
jle 0x4217a2
jmp 0x42190b
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], 0
test eax, eax
jl 0x42190b
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x34]
mov ecx, dword [edi + 0x10]
push 0xcc0020
push ebx
sub eax, edx
mov edx, dword [esp + 0x24]
push 0
push ecx
push 8
push edx
mov edx, dword [esi + 4]
mov ecx, ebx
mov dword [esp + 0x68], eax
add ecx, edx
mov edx, dword [esi]
add eax, edx
push ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x50]
push 0xcc0020
push ebx
lea eax, [esp + 0x1e8]
push edx
push eax
mov eax, dword [esi]
push 8
push ecx
mov ecx, dword [esi + 4]
mov edx, ebx
add edx, ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov ecx, dword [esp + 0x1c]
push 0xa
push ecx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x4218ed
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
jle 0x421867
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x70]
inc eax
add ebx, 8
cmp eax, ecx
mov dword [esp + 0xc], eax
jle 0x421770
mov ecx, dword [esp + 0x28]
push ecx
lea ecx, [esp + 0x1e4]
call fcn.00423d40
lea ecx, [esp + 0xf8]
call fcn.0047774e
lea ecx, [esp + 0xf8]
mov byte [esp + 0x204e0], 0x33
call fcn.00401b30
lea ecx, [esp + 0x1e0]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esp + 0x1f0]
call fcn.00476da2
lea ecx, [esp + 0x108]
mov dword [esp + 0x204e0], 0x35
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x36
test eax, eax
jne 0x4219b8
xor eax, eax
jmp 0x4219be
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x1f4]
call fcn.00476e59
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov eax, ebx
sub eax, ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
sub ecx, edx
push eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x1c], ecx
push ecx
push eax
lea ecx, [esp + 0x114]
call fcn.00423d10
lea ecx, [esp + 0x108]
push ecx
lea ecx, [esp + 0x1f4]
call fcn.00423d40
mov edx, dword [esi + 4]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x70], eax
mov eax, dword [esi]
push 0xcc0020
push edx
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push ecx
push edx
push eax
push 0
push 0
lea ecx, [esp + 0x210]
call fcn.00423db0
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], 0
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x50], eax
js 0x421c12
mov dword [esp + 0x48], 0
mov ecx, dword [esp + 0x24]
push 2
push ecx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x421b38
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], 0
test eax, eax
jl 0x421bf2
mov edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x1c]
push 0xcc0020
push eax
mov eax, dword [esp + 0x50]
push eax
push ecx
mov ecx, dword [esi + 4]
push edx
push 8
push ecx
mov ecx, dword [esi]
add eax, ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
lea edx, [esp + 0x1f8]
push eax
push edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [esp + 0x30]
add edx, ecx
mov ecx, dword [ebp + 8]
push 8
push edx
add eax, dword [esi]
push eax
call fcn.00423db0
mov eax, dword [esp + 0x1c]
push 0xa
push eax
mov ecx, edi
call fcn.00423df0
test al, al
je 0x421b15
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], edx
jle 0x421a97
jmp 0x421bf2
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], 0
test eax, eax
jl 0x421bf2
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov ecx, dword [edi + 0x10]
push 0xcc0020
push 0
mov edx, ebx
push eax
sub edx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x2c]
push ecx
sub edx, ecx
mov ecx, dword [esi + 4]
push 8
add edx, ecx
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [esi]
add eax, edx
push eax
call fcn.00423db0
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
push 0xcc0020
push eax
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x1f8]
push eax
push ecx
mov ecx, dword [esi + 4]
push edx
push 8
push ecx
mov ecx, dword [esi]
add eax, ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
mov edx, dword [esp + 0x1c]
push 0xa
push edx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x421bd4
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
jle 0x421b50
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x50]
inc eax
add edx, 8
cmp eax, ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x48], edx
jle 0x421a67
mov edx, dword [esp + 0x70]
lea ecx, [esp + 0x1f0]
push edx
call fcn.00423d40
lea ecx, [esp + 0x108]
call fcn.0047774e
lea ecx, [esp + 0x108]
mov byte [esp + 0x204e0], 0x35
call fcn.00401b30
lea ecx, [esp + 0x1f0]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esp + 0x210]
call fcn.00476da2
lea ecx, [esp + 0x118]
mov dword [esp + 0x204e0], 0x37
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x38
test eax, eax
jne 0x421ca7
xor eax, eax
jmp 0x421cad
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x214]
call fcn.00476e59
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov eax, ebx
sub eax, ecx
mov ecx, dword [esp + 0x3c]
sub ecx, edx
push eax
mov dword [esp + 0x1c], ecx
push ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x1c], eax
push ecx
lea ecx, [esp + 0x124]
call fcn.00423d10
lea edx, [esp + 0x118]
lea ecx, [esp + 0x210]
push edx
call fcn.00423d40
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov eax, dword [esi + 4]
push 0xcc0020
push eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
push 0
push 0
lea ecx, [esp + 0x230]
call fcn.00423db0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], 0
cdq
and edx, 7
add eax, edx
sar eax, 3
inc eax
test eax, eax
mov dword [esp + 0x70], eax
jl 0x421f82
mov dword [esp + 0x48], 0
mov dword [esp + 0xc], ebx
mov edx, dword [esp + 0x2c]
push 2
push edx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x421e66
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], 0
test eax, eax
jl 0x421f54
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x38]
sub eax, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x24]
sub eax, edx
mov edx, dword [edi + 0x10]
push 0xcc0020
push ecx
mov dword [esp + 0x58], eax
push eax
mov eax, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x48]
push 8
push eax
mov eax, dword [esp + 0x60]
mov ecx, ebx
sub ecx, eax
mov eax, dword [esi + 4]
sub ecx, edx
mov edx, dword [esi]
add ecx, eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x50]
push 0xcc0020
push eax
lea ecx, [esp + 0x218]
push 0
push ecx
mov ecx, dword [esp + 0x48]
push 8
push edx
mov edx, dword [esp + 0x60]
mov eax, ebx
sub eax, edx
mov edx, dword [esi + 4]
sub eax, ecx
mov ecx, dword [esi]
add eax, edx
push eax
mov eax, dword [esp + 0x38]
add ecx, eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov edx, dword [esp + 0x1c]
push 0xa
push edx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x421e43
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
jle 0x421d9d
jmp 0x421f54
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], 0
test eax, eax
jl 0x421f54
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
sub eax, ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x24]
sub eax, edx
mov edx, dword [edi + 0x10]
push 0xcc0020
push ecx
mov ecx, dword [esp + 0x24]
push 0
push edx
push 8
push ecx
mov ecx, dword [esp + 0x60]
mov edx, ebx
sub edx, ecx
mov ecx, dword [esp + 0x50]
sub edx, ecx
mov ecx, dword [esi + 4]
add edx, ecx
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [esi]
mov dword [esp + 0x6c], eax
add eax, edx
push eax
call fcn.00423db0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
push 0xcc0020
push eax
mov eax, dword [esp + 0x58]
lea edx, [esp + 0x218]
push ecx
push edx
mov edx, dword [esp + 0x48]
push 8
push eax
mov eax, dword [esp + 0x60]
mov ecx, ebx
sub ecx, eax
mov eax, dword [esi + 4]
sub ecx, edx
mov edx, dword [esi]
add ecx, eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0x1c]
push 0xa
push eax
mov ecx, edi
call fcn.00423df0
test al, al
je 0x421f36
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
jle 0x421e90
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x2c]
mov ecx, 8
inc eax
add edx, ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x48], edx
mov edx, dword [esp + 0xc]
sub edx, ecx
mov ecx, dword [esp + 0x70]
cmp eax, ecx
mov dword [esp + 0xc], edx
jle 0x421d5d
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x210]
push eax
call fcn.00423d40
lea ecx, [esp + 0x118]
call fcn.0047774e
lea ecx, [esp + 0x118]
mov byte [esp + 0x204e0], 0x37
call fcn.00401b30
lea ecx, [esp + 0x210]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [esp + 0x1d0]
call fcn.00476da2
lea ecx, [esp + 0x128]
mov dword [esp + 0x204e0], 0x39
call fcn.00423d00
mov eax, dword [ebp + 8]
mov byte [esp + 0x204e0], 0x3a
test eax, eax
jne 0x422017
xor eax, eax
jmp 0x42201d
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x1d4]
call fcn.00476e59
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov eax, ebx
sub eax, ecx
mov ecx, dword [esp + 0x3c]
sub ecx, edx
mov edx, dword [ebp + 8]
push eax
mov dword [esp + 0x1c], ecx
push ecx
push edx
lea ecx, [esp + 0x134]
mov dword [esp + 0x20], eax
call fcn.00423d10
lea eax, [esp + 0x128]
lea ecx, [esp + 0x1d0]
push eax
call fcn.00423d40
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 8]
push 0xcc0020
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x24]
push eax
push ecx
push edx
push 0
push 0
lea ecx, [esp + 0x1f0]
call fcn.00423db0
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], 0
cdq
and edx, 7
add eax, edx
sar eax, 3
inc eax
test eax, eax
mov dword [esp + 0x50], eax
jl 0x422294
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0x2c]
push 2
push ecx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x4221ac
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], 0
test eax, eax
jl 0x422274
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x14]
sub eax, ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x1c]
push 0xcc0020
push eax
mov eax, dword [esp + 0x2c]
push eax
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
push 8
add edx, eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0xc]
push 0xcc0020
push 0
lea ecx, [esp + 0x1d8]
push eax
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esi + 4]
add ecx, edx
mov edx, dword [esi]
push 8
add edx, eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0x1c]
push 9
push eax
mov ecx, edi
call fcn.00423df0
test al, al
je 0x422189
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], edx
jle 0x422109
jmp 0x422274
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], 0
test ecx, ecx
jl 0x422274
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x34]
sub eax, edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [edi + 0x10]
push 0xcc0020
push 0
mov edx, ebx
push ecx
sub edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x2c]
push eax
sub edx, eax
mov eax, dword [esi + 4]
push 8
add edx, eax
mov eax, dword [esi]
add eax, ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
push 0xcc0020
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1d8]
push eax
push edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [esi]
push 8
add ecx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov edx, dword [esp + 0x1c]
push 9
push edx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x422256
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
jle 0x4221d2
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x50]
inc eax
sub edx, 8
cmp eax, ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x48], edx
jle 0x4220c9
mov edx, dword [esp + 0x70]
lea ecx, [esp + 0x1d0]
push edx
call fcn.00423d40
lea ecx, [esp + 0x128]
call fcn.0047774e
lea ecx, [esp + 0x128]
mov byte [esp + 0x204e0], 0x39
call fcn.00401b30
lea ecx, [esp + 0x1d0]
mov dword [esp + 0x204e0], 0xffffffff
call fcn.00476ec1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
sub ebx, ecx
lea ecx, [esp + 0x78]
push ebx
mov ebx, dword [esp + 0x38]
sub eax, ebx
mov byte [esp + 0x5f], 0
push eax
push 0
push 0
mov byte [esp + 0x7f], 1
call fcn.00423ce0
mov edx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x84]
mov ebx, dword [esp + 0x78]
mov dword [esp + 0x28], 2
cmp byte [esp + 0x5b], 0
je 0x4223dd
mov edx, ecx
mov dword [esp + 0x50], 0
sub edx, ebx
js 0x4223d2
mov ebx, dword [esp + 0x50]
jmp 0x422360
mov eax, dword [esp + 0x84]
lea edx, [eax - 8]
push 0xcc0020
push edx
mov edx, ecx
sub edx, ebx
push edx
mov edx, dword [edi + 0x10]
push edx
mov edx, dword [esi + 4]
push 8
push 1
lea eax, [eax + edx - 8]
mov edx, dword [esi]
sub edx, ebx
push eax
add edx, ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
push 2
push ebx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x4223ac
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x78]
mov edx, ecx
inc ebx
sub edx, eax
cmp ebx, edx
jle 0x422359
mov edx, dword [esp + 0x7c]
mov eax, dword [esp + 0x84]
mov byte [esp + 0x5b], 0
jmp 0x422440
mov edx, dword [esp + 0x7c]
mov byte [esp + 0x5b], 0
jmp 0x422440
cmp dword [esp + 0x78], ecx
jge 0x42243b
mov eax, dword [edi + 0x10]
mov ecx, dword [esi]
push 0xcc0020
push edx
push ebx
push eax
mov eax, dword [esi + 4]
push 8
add edx, eax
push 1
add ecx, ebx
push edx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
push 2
push ebx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x422424
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x7c]
inc ebx
cmp ebx, ecx
jl 0x4223e3
mov eax, dword [esp + 0x84]
mov byte [esp + 0x5b], 1
mov bl, byte [esp + 0x6f]
test bl, bl
je 0x4224bd
cmp edx, eax
mov ebx, edx
jg 0x4224b6
jmp 0x422457
mov ecx, dword [esp + 0x80]
mov eax, dword [edi + 0x10]
push 0xcc0020
lea edx, [ecx - 8]
push ebx
push edx
push eax
mov eax, dword [esi + 4]
mov edx, ebx
add edx, eax
mov eax, dword [esi]
push 1
push 8
lea ecx, [eax + ecx - 8]
push edx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
push 2
push ebx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x42249f
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
mov eax, dword [esp + 0x84]
inc ebx
cmp ebx, eax
jle 0x422450
mov edx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov byte [esp + 0x6f], 0
jmp 0x42253a
mov ebx, eax
mov dword [esp + 0x50], 0
sub ebx, edx
js 0x422535
mov ebx, dword [esp + 0x50]
mov ecx, dword [esp + 0x78]
mov edx, eax
sub edx, ebx
push 0xcc0020
push edx
mov edx, dword [edi + 0x10]
push ecx
push edx
mov edx, dword [esi + 4]
sub eax, ebx
push 1
add eax, edx
push 8
push eax
mov eax, dword [esi]
add eax, ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
push 2
push ebx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x42251a
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov eax, dword [esp + 0x84]
mov edx, dword [esp + 0x7c]
mov ecx, eax
inc ebx
sub ecx, edx
cmp ebx, ecx
jle 0x4224cf
mov ecx, dword [esp + 0x80]
mov byte [esp + 0x6f], 1
mov ebx, dword [esp + 0x28]
dec ebx
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0x78]
jne 0x42233a
add edx, 8
sub ecx, 8
mov dword [esp + 0x7c], edx
add ebx, 8
mov edx, ecx
sub eax, 8
sub edx, ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], eax
js case.default.0x41a6e9
mov edx, dword [esp + 0x7c]
mov ebx, eax
sub ebx, edx
jns 0x42232e
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
sub ebx, ecx
lea ecx, [esp + 0x88]
push ebx
mov ebx, dword [esp + 0x38]
sub eax, ebx
mov byte [esp + 0x5f], 0
push eax
push 0
push 0
mov byte [esp + 0x7f], 1
call fcn.00423ce0
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov dword [esp + 0x28], 2
mov bl, byte [esp + 0x6f]
test bl, bl
je 0x422662
cmp ecx, eax
mov ebx, ecx
jg 0x42265b
jmp 0x4225fe
mov edx, dword [esp + 0x88]
mov eax, dword [edi + 0x10]
push 0xcc0020
push ebx
push edx
push eax
mov eax, dword [esi + 4]
mov ecx, ebx
push 1
add ecx, eax
mov eax, dword [esi]
push 8
add eax, edx
push ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
push 2
push ebx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x422641
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov eax, dword [esp + 0x94]
inc ebx
cmp ebx, eax
jle 0x4225f7
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov byte [esp + 0x6f], 0
jmp 0x4226de
mov edx, eax
xor ebx, ebx
sub edx, ecx
js 0x4226d2
mov ecx, dword [esp + 0x90]
mov edx, eax
sub edx, ebx
push 0xcc0020
add ecx, 0xfffffff8
push edx
mov edx, dword [edi + 0x10]
push ecx
push edx
mov edx, dword [esi + 4]
sub eax, ebx
push 1
add eax, edx
push 8
push eax
mov eax, dword [esi]
add eax, ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
push 2
push ebx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x4226bb
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x8c]
mov edx, eax
inc ebx
sub edx, ecx
cmp ebx, edx
jle 0x42266a
mov edx, dword [esp + 0x88]
mov byte [esp + 0x6f], 1
mov bl, byte [esp + 0x5b]
test bl, bl
je 0x42277e
mov ebx, dword [esp + 0x90]
mov dword [esp + 0x50], 0
sub ebx, edx
js 0x422777
mov ebx, dword [esp + 0x50]
jmp 0x42270a
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x90]
mov edx, dword [edi + 0x10]
sub eax, ebx
push 0xcc0020
push ecx
push eax
push edx
mov edx, dword [esi + 4]
add ecx, edx
mov edx, dword [esi]
push 8
push 1
add eax, edx
push ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
push 2
push ebx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x422754
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov eax, dword [esp + 0x90]
mov edx, dword [esp + 0x88]
inc ebx
sub eax, edx
cmp ebx, eax
jle 0x422703
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x8c]
mov byte [esp + 0x5b], 0
jmp 0x4227fd
mov ebx, dword [esp + 0x90]
mov dword [esp + 0x50], edx
cmp edx, ebx
jge 0x4227f8
mov ebx, edx
mov edx, dword [edi + 0x10]
lea ecx, [eax - 8]
push 0xcc0020
push ecx
mov ecx, dword [esi + 4]
push ebx
push edx
push 8
lea edx, [eax + ecx - 8]
mov ecx, dword [ebp + 8]
push 1
push edx
mov edx, dword [esi]
mov eax, ebx
add eax, edx
push eax
call fcn.00423db0
push 2
push ebx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x4227d7
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
call fcn.00402670
mov eax, dword [esp + 0x90]
inc ebx
cmp ebx, eax
mov eax, dword [esp + 0x94]
jl 0x42278f
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov byte [esp + 0x5b], 1
mov ebx, dword [esp + 0x28]
dec ebx
mov dword [esp + 0x28], ebx
jne 0x4225e7
mov ebx, dword [esp + 0x90]
add edx, 8
sub ebx, 8
add ecx, 8
mov dword [esp + 0x90], ebx
sub eax, 8
sub ebx, edx
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x94], eax
js case.default.0x41a6e9
mov ebx, eax
sub ebx, ecx
jns 0x4225df
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], ecx
sub eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
js 0x42298d
mov ecx, dword [esp + 0x38]
mov eax, ebx
sub eax, ecx
mov dword [esp + 0x14], eax
jmp 0x42288c
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [esp + 0x1c], 0
jl 0x422967
mov edx, dword [esp + 0x38]
mov ecx, ebx
fild dword [esp + 0xc]
sub ecx, edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x50], ecx
fidiv dword [esp + 0x50]
fstp dword [esp + 0x50]
fild dword [esp + 0x1c]
fmul dword [esp + 0x50]
call fcn.0045b910
mov edx, dword [esp + 0x18]
mov dword [esp + 0x10], eax
cmp dword [esp + 0xc], edx
jne 0x4228de
mov eax, edx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x10]
push 0xcc0020
push eax
push 0
push ecx
mov ecx, dword [esi + 4]
push 1
add eax, ecx
mov ecx, dword [ebp + 8]
push edx
push eax
mov eax, dword [esi]
push eax
call fcn.00423db0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x34]
sub eax, ecx
sub eax, edx
mov edx, dword [esp + 0x24]
push 0xcc0020
push edx
mov edx, dword [edi + 0x10]
push eax
push edx
mov edx, dword [esp + 0x48]
push 1
push ecx
mov ecx, ebx
sub ecx, edx
mov edx, dword [esp + 0x34]
sub ecx, edx
mov edx, dword [esi + 4]
add ecx, edx
push ecx
mov ecx, dword [esi]
add eax, ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], edx
jle 0x4228b8
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00402670
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
inc eax
cmp eax, ecx
mov dword [esp + 0xc], eax
jle 0x422888
mov ecx, dword [esp + 0x38]
push 2
sub ebx, ecx
mov ecx, edi
push ebx
call fcn.00423df0
test al, al
jne case.default.0x41a6e9
mov ecx, dword [esp + 0x18]
push 2
push ecx
mov ecx, edi
call fcn.00423df0
test al, al
jne case.default.0x41a6e9
mov eax, ebx
push 0xcc0020
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x1c]
cdq
sar ecx, 1
sub eax, edx
sar eax, 1
lea edx, [ecx - 5]
push edx
lea edx, [eax - 1]
push edx
mov edx, dword [edi + 0x10]
push edx
mov edx, dword [esi + 4]
push 0xb
push 3
lea ecx, [edx + ecx - 5]
mov edx, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edx + eax - 1]
push eax
call fcn.00423db0
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
sub eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
js 0x422b3b
mov ecx, dword [esp + 0x38]
mov eax, ebx
sub eax, ecx
mov dword [esp + 0x14], eax
jmp 0x422a38
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [esp + 0x1c], 0
jl 0x422b15
mov edx, dword [esp + 0x38]
mov ecx, ebx
fild dword [esp + 0x24]
sub ecx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x50], ecx
fidiv dword [esp + 0x50]
fstp dword [esp + 0x50]
fild dword [esp + 0x1c]
fmul dword [esp + 0x50]
call fcn.0045b910
mov edx, dword [esp + 0x18]
mov dword [esp + 0xc], eax
cmp dword [esp + 0x24], edx
jne 0x422a8a
mov eax, edx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0xc]
push 0xcc0020
push eax
push 0
push ecx
mov ecx, dword [esp + 0x2c]
push 1
push edx
mov edx, dword [esp + 0x50]
mov eax, ebx
sub eax, edx
mov edx, dword [esi + 4]
sub eax, ecx
mov ecx, dword [esi]
add eax, edx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x34]
sub eax, ecx
mov ecx, dword [esp + 0x1c]
sub eax, edx
mov edx, dword [edi + 0x10]
push 0xcc0020
push ecx
push eax
push edx
mov edx, dword [esp + 0x1c]
push 1
push edx
add ecx, dword [esi + 4]
push ecx
mov ecx, dword [esi]
add eax, ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
jle 0x422a64
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
inc eax
cmp eax, ecx
mov dword [esp + 0x24], eax
jle 0x422a34
mov ecx, dword [esp + 0x38]
push 2
sub ebx, ecx
mov ecx, edi
push ebx
call fcn.00423df0
test al, al
jne case.default.0x41a6e9
mov edx, dword [esp + 0x18]
push 2
push edx
mov ecx, edi
call fcn.00423df0
test al, al
jne case.default.0x41a6e9
mov eax, ebx
push 0xcc0020
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x1c]
cdq
sar ecx, 1
sub eax, edx
sar eax, 1
lea edx, [ecx - 5]
push edx
lea edx, [eax - 1]
push edx
mov edx, dword [edi + 0x10]
push edx
mov edx, dword [esi + 4]
push 0xb
push 3
lea ecx, [edx + ecx - 5]
mov edx, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
lea eax, [edx + eax - 1]
push eax
call fcn.00423db0
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esp + 0x38]
push 0x28
sub ebx, ecx
push ebx
call fcn.0045c84d
mov ecx, dword [esp + 0x3c]
mov ebx, eax
mov eax, dword [esp + 0x44]
push 0x28
sub eax, ecx
mov dword [esp + 0x60], edx
push eax
call fcn.0045c84d
mov ecx, dword [esp + 0x64]
add esp, 0x10
test ecx, ecx
je 0x422bf0
inc ebx
test edx, edx
mov dword [esp + 0x2c], eax
je 0x422bfd
inc eax
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x2c]
push 2
push ecx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x422c19
mov eax, dword [esp + 0x2c]
inc ebx
inc eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
imul eax, ebx
mov dword [esp + 0x64], eax
xor ebx, ebx
mov eax, dword [esp + 0x64]
xor ecx, ecx
test eax, eax
mov dword [esp + 0x28], ecx
jle 0x422cb9
mov eax, dword [esp + 0x2c]
cdq
sub eax, edx
sar eax, 1
shl eax, 1
mov dword [esp + 0x50], eax
jmp 0x422c4d
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x2c]
cmp eax, edx
lea eax, [edx + 1]
je 0x422c5a
mov eax, edx
push eax
push ecx
call fcn.0045c84d
lea edx, [edx + edx*4]
lea eax, [eax + eax*4]
shl edx, 3
sub edx, ebx
lea eax, [eax*8 + 0x14]
add esp, 8
lea ecx, [edx + 0x14]
mov edx, dword [esi]
mov dword [esp + 0x70], ecx
add edx, ecx
mov ecx, eax
sub eax, ebx
push 0xcc0020
push eax
mov eax, dword [esp + 0x78]
sub ecx, ebx
add ecx, dword [esi + 4]
push eax
mov eax, dword [edi + 0x10]
push eax
lea eax, [ebx + ebx]
push eax
push eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x64]
inc ecx
cmp ecx, eax
mov dword [esp + 0x28], ecx
jl 0x422c49
fld qword [esp + 0x5c]
mov ecx, dword [ebp + 0x14]
lea edx, [esp + 0x42c]
fmul qword [0x486270]
lea eax, [ecx + ecx]
mov ecx, dword [ebp + 0xc]
push edx
push eax
mov dword [esp + 0x14], eax
fstp qword [esp + 0x434]
call fcn.00402670
fld qword [esp + 0x5c]
fmul qword [0x486270]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x414]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
fstp qword [esp + 0x41c]
call fcn.00402670
fld qword [esp + 0x5c]
fmul qword [0x486270]
mov eax, dword [esp + 0xc]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x37c]
push edx
push eax
fstp qword [esp + 0x384]
call fcn.00402670
fld qword [esp + 0x5c]
fmul qword [0x486270]
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x374]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
fstp qword [esp + 0x37c]
call fcn.00402670
fld qword [esp + 0x5c]
fmul qword [0x486270]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x424]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
fstp qword [esp + 0x42c]
call fcn.00402670
inc ebx
cmp ebx, 0x14
jle 0x422c26
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esp + 0x38]
push 0x28
sub ebx, ecx
push ebx
call fcn.0045c84d
mov ecx, dword [esp + 0x3c]
mov ebx, eax
mov eax, dword [esp + 0x44]
push 0x28
sub eax, ecx
mov dword [esp + 0x60], edx
push eax
call fcn.0045c84d
mov ecx, dword [esp + 0x64]
add esp, 0x10
test ecx, ecx
je 0x422dd0
inc ebx
test edx, edx
mov dword [esp + 0x30], eax
je 0x422ddd
inc eax
mov dword [esp + 0x30], eax
mov edx, dword [esp + 0x30]
push 2
push edx
mov ecx, edi
call fcn.00423df0
test al, al
je 0x422df9
mov eax, dword [esp + 0x30]
inc ebx
inc eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x2c], 0x14
imul eax, ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], 0
test eax, eax
jle 0x422f55
mov ecx, dword [esp + 0x30]
mov eax, ecx
cdq
sub eax, edx
mov edx, dword [esp + 0x2c]
sar eax, 1
add edx, edx
shl eax, 1
inc edx
mov dword [esp + 0x50], eax
mov dword [esp + 0x70], edx
jmp 0x422e46
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x30]
cmp eax, ecx
lea eax, [ecx + 1]
je 0x422e4f
mov eax, ecx
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0045c84d
lea ecx, [edx + edx*4]
mov edx, dword [esp + 0x34]
shl ecx, 3
sub ecx, edx
lea eax, [eax + eax*4]
add esp, 8
lea edx, [ecx + 0x14]
mov ecx, dword [esi]
mov dword [esp + 0xc], edx
add ecx, edx
mov edx, dword [esp + 0x2c]
lea eax, [eax*8 + 0x14]
mov ebx, eax
sub eax, edx
push 0xcc0020
mov dword [esp + 0x6c], eax
push eax
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [edi + 0x10]
sub ebx, edx
push eax
add ebx, dword [esi + 4]
lea eax, [edx + edx]
push 1
push eax
push ebx
mov dword [esp + 0x38], ecx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x68]
push 0xcc0020
lea eax, [ecx + ecx]
mov ecx, dword [esp + 0x10]
add edx, eax
push edx
mov edx, dword [edi + 0x10]
push ecx
push edx
mov ecx, dword [ebp + 8]
push 1
push eax
add eax, ebx
push eax
mov eax, dword [esp + 0x38]
push eax
call fcn.00423db0
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0xc]
mov eax, dword [edi + 0x10]
push 0xcc0020
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x28]
push eax
lea eax, [ecx + ecx]
mov ecx, dword [ebp + 8]
push eax
push 1
push ebx
push edx
call fcn.00423db0
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0xc]
push 0xcc0020
push eax
lea eax, [ecx + ecx]
lea ecx, [eax + edx]
mov edx, dword [edi + 0x10]
push ecx
mov ecx, dword [esp + 0x7c]
push edx
push ecx
mov edx, dword [esp + 0x30]
mov ecx, dword [ebp + 8]
push 1
add eax, edx
push ebx
push eax
call fcn.00423db0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x422e3e
fld qword [esp + 0x5c]
mov eax, dword [ebp + 0x14]
lea ecx, [esp + 0x384]
fmul qword [0x486270]
lea ebx, [eax + eax]
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
fstp qword [esp + 0x38c]
call fcn.00402670
fld qword [esp + 0x5c]
fmul qword [0x486270]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x434]
push edx
push ebx
fstp qword [esp + 0x43c]
call fcn.00402670
fld qword [esp + 0x5c]
fmul qword [0x486270]
mov ecx, dword [ebp + 0xc]
lea eax, [esp + 0x3ac]
push eax
push ebx
fstp qword [esp + 0x3b4]
call fcn.00402670
fld qword [esp + 0x5c]
fmul qword [0x486270]
lea ecx, [esp + 0x404]
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
fstp qword [esp + 0x40c]
call fcn.00402670
fld qword [esp + 0x5c]
fmul qword [0x486270]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x3d4]
push edx
push ebx
fstp qword [esp + 0x3dc]
call fcn.00402670
mov eax, dword [esp + 0x2c]
dec eax
mov dword [esp + 0x2c], eax
jns 0x422e0c
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esp + 0x38]
push 0x28
sub ebx, ecx
push ebx
call fcn.0045c84d
mov ecx, dword [esp + 0x3c]
mov ebx, eax
mov eax, dword [esp + 0x44]
push 0x28
sub eax, ecx
mov dword [esp + 0x60], edx
push eax
call fcn.0045c84d
mov ecx, dword [esp + 0x64]
add esp, 0x10
test ecx, ecx
je 0x42305d
inc ebx
test edx, edx
mov dword [esp + 0x2c], eax
je 0x42306a
inc eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
push 2
push eax
mov ecx, edi
call fcn.00423df0
test al, al
je 0x423086
mov eax, dword [esp + 0x2c]
inc ebx
inc eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], 0
imul eax, ebx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x48]
xor ebx, ebx
test eax, eax
mov dword [esp + 0x24], ebx
jle 0x42316b
mov eax, dword [esp + 0x2c]
cdq
sub eax, edx
sar eax, 1
shl eax, 1
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x50]
cmp ecx, eax
jne 0x4230c7
inc eax
push eax
push ebx
call fcn.0045c84d
xor ecx, ecx
add esp, 8
cmp dword [esp + 0x1c], ecx
mov dword [esp + 0x10], ecx
jle 0x42315a
lea edx, [edx + edx*4]
lea ebx, [eax + eax*4]
mov eax, dword [esp + 0x1c]
shl edx, 3
mov dword [esp + 0x28], edx
mov dword [esp + 0xc], eax
shl ebx, 3
mov edx, 0x28
cmp eax, edx
mov dword [esp + 0x64], edx
jg 0x423106
mov dword [esp + 0x64], eax
cmp ecx, edx
jg 0x42310c
mov edx, ecx
mov eax, dword [esi]
mov ecx, dword [esp + 0x28]
add eax, ecx
lea ecx, [edx + ebx]
add edx, ebx
add ecx, dword [esi + 4]
push 0xcc0020
push edx
mov edx, dword [esp + 0x30]
push edx
mov edx, dword [edi + 0x10]
push edx
mov edx, dword [esp + 0x74]
push 1
push edx
push ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x1c]
inc ecx
dec eax
cmp ecx, edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
jl 0x4230f5
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x48]
inc ebx
cmp ebx, eax
mov dword [esp + 0x24], ebx
jl 0x4230ba
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
lea eax, [esp + 0x5c]
push eax
push ebx
call fcn.00402670
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
call fcn.00402670
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x5c]
push edx
push ebx
call fcn.00402670
mov eax, dword [esp + 0x1c]
inc eax
cmp eax, 0x50
mov dword [esp + 0x1c], eax
jle 0x423099
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
sub eax, ecx
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul qword [0x486268]
call fcn.0045b910
mov edx, dword [esp + 0x18]
mov dword [esp + 0x50], eax
xor ecx, ecx
add eax, edx
cmp eax, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x64], eax
jle case.default.0x41a6e9
mov eax, ecx
cmp ecx, eax
mov dword [esp + 0x1c], ecx
jge 0x4232d9
sub eax, dword [esp + 0x50]
mov dword [esp + 0x70], eax
jmp 0x42321e
mov eax, dword [esp + 0x70]
test eax, eax
jge 0x423224
xor eax, eax
cmp ecx, eax
jle 0x423264
cmp ecx, dword [esp + 0x18]
jge 0x423298
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0xc]
sub eax, ecx
push 0xcc0020
add eax, edx
push 0
push eax
mov eax, dword [edi + 0x10]
push eax
mov eax, dword [esp + 0x48]
mov edx, ebx
sub edx, eax
mov eax, dword [esi + 4]
push edx
mov edx, dword [esi]
push 1
add ecx, edx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
jmp 0x423298
mov eax, dword [esp + 0x1c]
mov ecx, dword [edi + 0x10]
push 0xcc0020
push 0
push eax
push ecx
mov ecx, dword [esp + 0x48]
mov edx, ebx
sub edx, ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
push 1
add eax, edx
push ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00423db0
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x28]
push 0x4b
inc eax
mov ecx, edi
push eax
mov dword [esp + 0x30], eax
call fcn.00423df0
test al, al
je 0x4232c0
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
inc ecx
cmp ecx, eax
mov dword [esp + 0x1c], ecx
jl 0x42321a
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x64]
inc eax
cmp eax, edx
mov dword [esp + 0xc], eax
jl 0x423204
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
sub eax, ecx
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul qword [0x486268]
call fcn.0045b910
mov edx, dword [esp + 0x18]
mov dword [esp + 0x50], eax
xor ecx, ecx
add eax, edx
cmp eax, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x64], eax
jl case.default.0x41a6e9
mov eax, ecx
cmp ecx, eax
mov dword [esp + 0xc], ecx
jge 0x42344c
mov edx, dword [esp + 0x50]
sub eax, edx
mov edx, dword [esp + 0x3c]
sub edx, dword [esp + 0x24]
mov dword [esp + 0x70], eax
mov dword [esp + 0x1c], edx
jmp 0x42336c
mov eax, dword [esp + 0x70]
test eax, eax
jge 0x423372
xor eax, eax
cmp ecx, eax
jle 0x4233c8
cmp ecx, dword [esp + 0x18]
jge 0x423402
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x3c]
sub ecx, eax
mov eax, dword [esp + 0x48]
sub ecx, eax
mov eax, dword [esp + 0x34]
sub ecx, eax
push 0xcc0020
add ecx, edx
mov edx, dword [edi + 0x10]
push 0
push ecx
push edx
mov edx, dword [esp + 0x48]
mov ecx, ebx
sub ecx, edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [esi]
push 1
push edx
mov edx, dword [esp + 0x38]
sub ecx, eax
add ecx, edx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
jmp 0x423402
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x34]
mov edx, dword [edi + 0x10]
sub eax, ecx
push 0xcc0020
push 0
push eax
push edx
mov edx, dword [esp + 0x48]
mov ecx, ebx
sub ecx, edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [esi]
push 1
add ecx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov edx, dword [esp + 0xc]
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x28]
push 0x4b
inc eax
mov ecx, edi
push eax
mov dword [esp + 0x30], eax
call fcn.00423df0
test al, al
je 0x42342a
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
inc ecx
dec eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x48]
cmp ecx, eax
mov dword [esp + 0xc], ecx
jl 0x423368
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x64]
inc eax
cmp eax, edx
mov dword [esp + 0x48], eax
jle 0x423344
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
sub ebx, dword [esp + 0x38]
mov dword [esp + 0x14], ebx
fild dword [esp + 0x14]
fmul qword [0x486268]
call fcn.0045b910
mov dword [esp + 0x50], eax
xor ecx, ecx
add eax, ebx
mov dword [esp + 0x28], ecx
cmp eax, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x64], eax
jle case.default.0x41a6e9
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
cmp ebx, eax
jge 0x423540
sub eax, dword [esp + 0x50]
mov dword [esp + 0x70], eax
jmp 0x4234c5
mov eax, dword [esp + 0x70]
test eax, eax
jge 0x4234cb
xor eax, eax
cmp ebx, eax
jle 0x423509
cmp ebx, dword [esp + 0x14]
jge 0x423537
mov edx, dword [esp + 0x1c]
sub eax, ebx
mov ecx, dword [esi + 4]
add eax, edx
mov edx, dword [edi + 0x10]
push 0xcc0020
push eax
mov eax, dword [esp + 0x44]
push 0
push edx
mov edx, dword [esp + 0x44]
push 1
sub eax, edx
mov edx, dword [esi]
add ecx, ebx
push eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
jmp 0x423537
mov eax, dword [edi + 0x10]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esi + 4]
push 0xcc0020
push ebx
push 0
push eax
mov eax, dword [esp + 0x44]
sub ecx, eax
mov eax, dword [esi]
push 1
add edx, ebx
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.00423db0
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x1c]
inc ebx
cmp ebx, eax
jl 0x4234c1
mov ebx, dword [ebp + 0x14]
mov ecx, 0x44c
sub ecx, ebx
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
lea eax, [esp + 0x40c]
shr ecx, 0x1f
push eax
push ebx
lea edx, [edx + ecx + 2]
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x78], edx
fild dword [esp + 0x78]
fmul qword [esp + 0x64]
fstp qword [esp + 0x414]
call fcn.00402670
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x64]
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jl 0x4234a7
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esp + 0x38]
mov eax, ebx
sub eax, ecx
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fmul qword [0x486268]
call fcn.0045b910
mov edx, dword [esp + 0x14]
mov dword [esp + 0x50], eax
xor ecx, ecx
add eax, edx
cmp eax, ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x64], eax
jl case.default.0x41a6e9
mov eax, edx
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
cmp ecx, eax
mov dword [esp + 0x48], ecx
jge 0x4236d2
mov edx, dword [esp + 0x50]
sub eax, edx
mov edx, dword [esp + 0x38]
mov dword [esp + 0x70], eax
mov eax, ebx
sub eax, ecx
sub eax, edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x70]
test eax, eax
jge 0x423624
xor eax, eax
cmp ecx, eax
jle 0x423672
cmp ecx, dword [esp + 0x14]
jge 0x4236b8
mov ecx, dword [esp + 0x1c]
mov edx, dword [edi + 0x10]
sub ecx, eax
mov eax, dword [esp + 0x48]
add ecx, eax
push 0xcc0020
push ecx
mov ecx, dword [esp + 0x44]
push 0
push edx
mov edx, dword [esp + 0x44]
push 1
sub ecx, edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [esp + 0x50]
sub edx, ecx
mov ecx, dword [ebp + 8]
sub edx, eax
mov eax, dword [esi]
add edx, ebx
push edx
push eax
call fcn.00423db0
jmp 0x4236b4
mov ecx, dword [esp + 0x10]
mov edx, dword [edi + 0x10]
mov eax, dword [esp + 0x3c]
push 0xcc0020
push ecx
mov ecx, dword [esi + 4]
push 0
push edx
mov edx, dword [esp + 0x44]
push 1
sub eax, edx
mov edx, dword [esp + 0x5c]
push eax
mov eax, dword [esp + 0x50]
sub ecx, eax
sub ecx, edx
mov edx, dword [esi]
add ecx, ebx
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0x48]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
inc ecx
dec edx
cmp ecx, eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x10], edx
jl 0x42361a
mov ecx, dword [ebp + 0x14]
mov edx, 0x44c
sub edx, ecx
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov eax, edx
shr eax, 0x1f
lea edx, [edx + eax + 2]
lea eax, [esp + 0x3fc]
mov dword [esp + 0x70], edx
push eax
fild dword [esp + 0x74]
push ecx
mov ecx, dword [ebp + 0xc]
fmul qword [esp + 0x64]
fstp qword [esp + 0x404]
call fcn.00402670
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x64]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x1c], edx
jle 0x4235ee
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
sub eax, ecx
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul qword [0x486268]
call fcn.0045b910
mov ecx, eax
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x50], ecx
cdq
sub eax, edx
mov dword [esp + 0x48], 0
sar eax, 1
inc eax
mov dword [esp + 0x28], eax
add eax, ecx
test eax, eax
mov dword [esp + 0x10], eax
jle case.default.0x41a6e9
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov dword [esp + 0x2c], eax
jge 0x423935
mov edx, dword [esp + 0x50]
sub ecx, edx
mov edx, dword [esp + 0x3c]
sub edx, dword [esp + 0x24]
mov dword [esp + 0x70], ecx
mov dword [esp + 0xc], edx
jmp 0x4237c9
mov ecx, dword [esp + 0x70]
test ecx, ecx
mov dword [esp + 0x1c], ecx
jge 0x4237d7
xor ecx, ecx
mov dword [esp + 0x1c], ecx
cmp eax, ecx
jle 0x42381b
cmp eax, dword [esp + 0x28]
jge 0x423857
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x48]
sub ecx, eax
push 0xcc0020
add ecx, edx
mov edx, dword [edi + 0x10]
push 0
push ecx
push edx
mov edx, dword [esp + 0x48]
mov ecx, ebx
sub ecx, edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [esi]
push 1
add ecx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
jmp 0x42384f
mov eax, dword [esp + 0x2c]
mov edx, dword [edi + 0x10]
push 0xcc0020
push 0
push eax
push edx
mov edx, dword [esp + 0x48]
mov ecx, ebx
sub ecx, edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [esi]
push 1
add ecx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x24], edx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
cmp eax, ecx
jle 0x4238b1
cmp eax, dword [esp + 0x28]
jge 0x4238eb
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x48]
sub ecx, edx
mov edx, dword [esp + 0x2c]
sub ecx, eax
mov eax, dword [esp + 0x34]
push 0xcc0020
sub ecx, eax
push 0
add ecx, edx
mov edx, dword [edi + 0x10]
push ecx
push edx
mov edx, dword [esp + 0x48]
mov ecx, ebx
sub ecx, edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [esi]
push 1
push edx
mov edx, dword [esp + 0x28]
sub ecx, eax
add ecx, edx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
jmp 0x4238eb
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x34]
mov edx, dword [edi + 0x10]
sub eax, ecx
push 0xcc0020
push 0
push eax
push edx
mov edx, dword [esp + 0x48]
mov ecx, ebx
sub ecx, edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [esi]
push 1
add ecx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423db0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x64]
push 0x32
inc eax
mov ecx, edi
push eax
mov dword [esp + 0x6c], eax
call fcn.00423df0
test al, al
je 0x423913
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x5c]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00402670
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
inc eax
dec ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x48]
cmp eax, ecx
mov dword [esp + 0x2c], eax
jl 0x4237c5
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
inc ecx
cmp ecx, edx
mov dword [esp + 0x48], ecx
jl 0x4237a1
mov ecx, dword [esp + 0x204d8]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esp + 0x38]
mov eax, ebx
sub eax, ecx
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fmul qword [0x486268]
call fcn.0045b910
mov ecx, eax
mov eax, dword [esp + 0x14]
cdq
sub eax, edx
mov dword [esp + 0x50], ecx
sar eax, 1
inc eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x28], eax
add eax, ecx
test eax, eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x64], eax
jle case.default.0x41a6e9
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x48]
cmp eax, ecx
mov dword [esp + 0x30], eax
jge 0x423b1e
sub ecx, dword [esp + 0x50]
mov dword [esp + 0x70], ecx
mov ecx, dword [esp + 0x14]
sub ecx, eax
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x70]
test ecx, ecx
mov dword [esp + 0x1c], ecx
jge 0x4239e2
xor ecx, ecx
mov dword [esp + 0x1c], ecx
cmp eax, ecx
jle 0x423a28
cmp eax, dword [esp + 0x28]
jge 0x423a66
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x48]
sub edx, eax
add edx, ecx
mov ecx, dword [edi + 0x10]
push 0xcc0020
push edx
mov edx, dword [esp + 0x44]
push 0
push ecx
mov ecx, dword [esp + 0x44]
sub edx, ecx
mov ecx, dword [esi + 4]
push 1
push edx
mov edx, dword [esi]
add ecx, eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
jmp 0x423a5e
mov eax, dword [esp + 0x30]
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x3c]
push 0xcc0020
push eax
push 0
push ecx
mov ecx, dword [esp + 0x44]
sub edx, ecx
mov ecx, dword [esi + 4]
push 1
push edx
mov edx, dword [esi]
add ecx, eax
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
cmp eax, ecx
jle 0x423abe
cmp eax, dword [esp + 0x28]
jge 0x423b04
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x48]
sub ecx, edx
mov edx, dword [edi + 0x10]
sub ecx, eax
mov eax, dword [esp + 0x30]
push 0xcc0020
add ecx, eax
push ecx
mov ecx, dword [esp + 0x44]
push 0
push edx
mov edx, dword [esp + 0x44]
push 1
sub ecx, edx
mov edx, dword [esi + 4]
push ecx
mov ecx, dword [esp + 0x50]
sub edx, ecx
mov ecx, dword [ebp + 8]
sub edx, eax
mov eax, dword [esi]
add edx, ebx
push edx
push eax
call fcn.00423db0
jmp 0x423b00
mov ecx, dword [esp + 0xc]
mov edx, dword [edi + 0x10]
mov eax, dword [esp + 0x3c]
push 0xcc0020
push ecx
mov ecx, dword [esi + 4]
push 0
push edx
mov edx, dword [esp + 0x44]
push 1
sub eax, edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x50]
sub ecx, eax
sub ecx, edx
mov edx, dword [esi]
add ecx, ebx
push ecx
mov ecx, dword [ebp + 8]
push edx
call fcn.00423db0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x48]
inc eax
dec edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0xc], edx
jl 0x4239d0
mov ecx, dword [ebp + 0x14]
mov edx, 0x44c
sub edx, ecx
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov eax, edx
shr eax, 0x1f
lea edx, [edx + eax + 2]
lea eax, [esp + 0x41c]
mov dword [esp + 0x70], edx
push eax
fild dword [esp + 0x74]
push ecx
mov ecx, dword [ebp + 0xc]
fmul qword [esp + 0x64]
fstp qword [esp + 0x424]
call fcn.00402670
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x64]
inc eax
cmp eax, ecx
mov dword [esp + 0x48], eax
jl 0x4239aa
mov ecx, dword [esp + 0x204d8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x18