Function at 0x29ad7850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x29b2707b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb4
push ebx
mov ebx, dword [esp + 0xd0]
push ebp
mov ebp, dword [esp + 0xe0]
push edi
push 0x18
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0xb8], eax
xor edi, edi
cmp eax, edi
mov dword [esp + 0xc8], edi
je 0x29ad78ae
mov ecx, dword [esp + 0xd4]
push ecx
push eax
mov ecx, ebx
xor edx, edx
call fcn.29ad2c10
mov edi, eax
mov edx, edi
mov dword [esp + 0xc], edi
mov dword [esp + 0xc8], 0xffffffff
call fcn.29ad2ee0
mov ecx, dword [esp + 0xdc]
xor edx, edx
test ecx, ecx
sete dl
test ebx, ebx
mov dword [esp + 0x34], 0
lea edx, [edx*8 + 8]
mov dword [esp + 0xb4], edx
jle 0x29ad89f5
mov ebx, dword [esp + 0x34]
mov eax, ebp
neg eax
mov dword [esp + 0xac], eax
or eax, 0xffffffff
sub eax, ebp
mov dword [esp + 0x90], eax
jmp 0x29ad7910
mov eax, dword [esp + 0xdc]
mov edi, dword [esp + 0xc]
xor ecx, ecx
cmp eax, ecx
lea eax, [ebx - 1]
je 0x29ad8054
cmp eax, ecx
jl 0x29ad7952
cmp eax, dword [edi + 0xc]
jge 0x29ad7952
cmp dword [edi + 8], ecx
jle 0x29ad7952
mov edx, dword [edi + 0x10]
imul edx, eax
add edx, dword [edi + 0x14]
mov ebp, 7
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], ecx
jmp 0x29ad795b
mov dword [esp + 0x48], ecx
mov ebp, 7
push edi
lea edx, [esp + 0x4c]
call fcn.29ad2f80
xor edx, edx
cmp ebx, edx
mov dword [esp + 0x80], eax
jl 0x29ad7998
cmp ebx, dword [edi + 0xc]
jge 0x29ad7998
mov eax, dword [edi + 8]
or ecx, 0xffffffff
cmp eax, ecx
jle 0x29ad7998
mov eax, dword [edi + 0x10]
imul eax, ebx
add eax, dword [edi + 0x14]
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], ecx
jmp 0x29ad799c
mov dword [esp + 0x38], edx
sub ebx, dword [esp + 0xe8]
lea edi, [ebx - 1]
cmp edi, edx
mov dword [esp + 0x54], ebx
jl 0x29ad79f8
cmp edi, dword [esi + 0xc]
jge 0x29ad79f8
mov ecx, dword [esp + 0xac]
cmp ecx, dword [esi + 8]
jge 0x29ad79f8
mov eax, dword [esi + 0x10]
imul eax, edi
cmp ecx, edx
mov dword [esp + 0x30], ecx
jge 0x29ad79da
add eax, dword [esi + 0x14]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], eax
jmp 0x29ad79fc
mov edx, ecx
sar edx, 3
add eax, edx
add eax, dword [esi + 0x14]
mov dword [esp + 0x28], eax
mov edx, ecx
and edx, ebp
mov eax, ebp
sub eax, edx
mov dword [esp + 0x2c], eax
xor edx, edx
jmp 0x29ad79fc
mov dword [esp + 0x28], edx
cmp ebx, edx
jl 0x29ad7a4e
cmp ebx, dword [esi + 0xc]
jge 0x29ad7a4e
mov eax, dword [esp + 0x90]
cmp eax, dword [esi + 8]
jge 0x29ad7a4e
cmp eax, edx
mov dword [esp + 0x18], eax
jge 0x29ad7a2e
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
imul ecx, ebx
add ecx, edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebp
jmp 0x29ad7a52
mov edx, dword [esi + 0x10]
imul edx, ebx
mov ecx, eax
sar ecx, 3
add edx, ecx
add edx, dword [esi + 0x14]
mov dword [esp + 0x10], edx
mov edx, eax
and edx, ebp
sub ebp, edx
mov dword [esp + 0x14], ebp
jmp 0x29ad7a52
mov dword [esp + 0x10], edx
push esi
lea edx, [esp + 0x14]
call fcn.29ad2f80
push esi
lea edx, [esp + 0x14]
mov ebp, eax
call fcn.29ad2f80
lea ecx, [ebp + ebp]
or eax, ecx
inc ebx
mov dword [esp + 0x88], eax
js 0x29ad7ad2
cmp ebx, dword [esi + 0xc]
jge 0x29ad7ad2
mov eax, dword [esp + 0xac]
cmp eax, dword [esi + 8]
jge 0x29ad7ad2
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x24], eax
jge 0x29ad7aac
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
imul edx, ebx
add edx, ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], 7
jmp 0x29ad7ad8
mov ecx, dword [esi + 0x10]
imul ecx, ebx
mov edx, eax
sar edx, 3
add ecx, edx
add ecx, dword [esi + 0x14]
mov dword [esp + 0x1c], ecx
mov ecx, eax
and ecx, 7
mov edx, 7
sub edx, ecx
mov dword [esp + 0x20], edx
jmp 0x29ad7ad8
xor ebp, ebp
mov dword [esp + 0x1c], ebp
push esi
lea edx, [esp + 0x20]
call fcn.29ad2f80
mov dword [esp + 0x84], eax
cmp dword [esp + 0xe0], ebp
mov dword [esp + 0x8c], ebp
mov dword [esp + 0x58], ebp
mov dword [esp + 0x44], ebp
je 0x29ad7bda
mov ecx, dword [esp + 0x90]
push edi
lea eax, [esp + 0x60]
mov edx, esi
call fcn.29ad2f20
push esi
lea edx, [esp + 0x60]
call fcn.29ad2f80
push esi
lea edx, [esp + 0x60]
mov ebp, eax
call fcn.29ad2f80
mov edi, eax
lea eax, [ebp + ebp]
push esi
lea edx, [esp + 0x60]
or edi, eax
call fcn.29ad2f80
mov edx, dword [esp + 0x54]
lea ecx, [edi + edi]
or eax, ecx
mov ecx, dword [esp + 0x90]
mov dword [esp + 0x44], eax
push edx
lea eax, [esp + 0x78]
mov edx, esi
call fcn.29ad2f20
push esi
lea edx, [esp + 0x78]
call fcn.29ad2f80
push esi
lea edx, [esp + 0x78]
mov ebp, eax
call fcn.29ad2f80
mov edi, eax
lea eax, [ebp + ebp]
push esi
lea edx, [esp + 0x78]
or edi, eax
call fcn.29ad2f80
lea ecx, [edi + edi]
or eax, ecx
mov ecx, dword [esp + 0x90]
mov dword [esp + 0x58], eax
push ebx
lea eax, [esp + 0x6c]
mov edx, esi
call fcn.29ad2f20
push esi
lea edx, [esp + 0x6c]
call fcn.29ad2f80
push esi
lea edx, [esp + 0x6c]
mov ebp, eax
call fcn.29ad2f80
mov edi, eax
lea edx, [ebp + ebp]
or edi, edx
push esi
lea edx, [esp + 0x6c]
call fcn.29ad2f80
lea ecx, [edi + edi]
or eax, ecx
mov dword [esp + 0x8c], eax
xor ebp, ebp
mov eax, dword [esp + 0xd4]
xor ebx, ebx
cmp eax, ebp
jle 0x29ad89d7
mov ebp, dword [esp + 0xc]
mov edx, dword [esp + 0x48]
test edx, edx
mov edi, dword [esp + 0x50]
jne 0x29ad7bff
xor eax, eax
jmp 0x29ad7c49
test edi, edi
jge 0x29ad7c0c
inc edi
mov dword [esp + 0x50], edi
xor eax, eax
jmp 0x29ad7c49
movzx eax, byte [edx]
mov cl, byte [esp + 0x4c]
shr eax, cl
mov ecx, dword [ebp + 8]
and eax, 1
inc edi
cmp edi, ecx
mov dword [esp + 0x50], edi
jne 0x29ad7c2e
mov dword [esp + 0x48], 0
jmp 0x29ad7c49
mov ecx, dword [esp + 0x4c]
test ecx, ecx
jne 0x29ad7c45
inc edx
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], 7
jmp 0x29ad7c49
dec dword [esp + 0x4c]
mov edx, dword [esp + 0x80]
lea ecx, [edx + edx]
mov edx, dword [esp + 0x10]
or ecx, eax
and ecx, 7
test edx, edx
mov dword [esp + 0x80], ecx
jne 0x29ad7c6b
xor eax, eax
jmp 0x29ad7cb9
mov edi, dword [esp + 0x18]
test edi, edi
jge 0x29ad7c7c
inc edi
mov dword [esp + 0x18], edi
xor eax, eax
jmp 0x29ad7cb9
movzx eax, byte [edx]
mov cl, byte [esp + 0x14]
shr eax, cl
mov ecx, dword [esi + 8]
and eax, 1
inc edi
cmp edi, ecx
mov dword [esp + 0x18], edi
jne 0x29ad7c9e
mov dword [esp + 0x10], 0
jmp 0x29ad7cb9
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x29ad7cb5
inc edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 7
jmp 0x29ad7cb9
dec dword [esp + 0x14]
mov edx, dword [esp + 0x88]
lea ecx, [edx + edx]
mov edx, dword [esp + 0x1c]
or ecx, eax
and ecx, 7
test edx, edx
mov dword [esp + 0x88], ecx
jne 0x29ad7cdb
xor eax, eax
jmp 0x29ad7d29
mov edi, dword [esp + 0x24]
test edi, edi
jge 0x29ad7cec
inc edi
mov dword [esp + 0x24], edi
xor eax, eax
jmp 0x29ad7d29
movzx eax, byte [edx]
mov cl, byte [esp + 0x20]
shr eax, cl
mov ecx, dword [esi + 8]
and eax, 1
inc edi
cmp edi, ecx
mov dword [esp + 0x24], edi
jne 0x29ad7d0e
mov dword [esp + 0x1c], 0
jmp 0x29ad7d29
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x29ad7d25
inc edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], 7
jmp 0x29ad7d29
dec dword [esp + 0x20]
mov edx, dword [esp + 0x84]
lea ecx, [edx + edx]
or ecx, eax
mov eax, dword [esp + 0xe0]
and ecx, 3
test eax, eax
mov dword [esp + 0x84], ecx
je 0x29ad7f1b
mov eax, dword [esp + 0x5c]
xor edi, edi
cmp eax, edi
jne 0x29ad7d5c
xor eax, eax
jmp 0x29ad7daa
mov eax, dword [esp + 0x64]
cmp eax, edi
jge 0x29ad7d6d
inc eax
mov dword [esp + 0x64], eax
xor eax, eax
jmp 0x29ad7daa
mov edx, dword [esp + 0x5c]
movzx eax, byte [edx]
mov edx, dword [esp + 0x60]
mov cl, dl
shr eax, cl
mov ecx, dword [esp + 0x64]
and eax, 1
inc ecx
cmp ecx, dword [esi + 8]
mov dword [esp + 0x64], ecx
jne 0x29ad7d93
mov dword [esp + 0x5c], edi
jmp 0x29ad7daa
cmp edx, edi
jne 0x29ad7da5
inc dword [esp + 0x5c]
mov dword [esp + 0x60], 7
jmp 0x29ad7daa
dec edx
mov dword [esp + 0x60], edx
mov ecx, dword [esp + 0x44]
lea edx, [ecx + ecx]
or edx, eax
mov eax, dword [esp + 0x74]
and edx, 7
cmp eax, edi
mov dword [esp + 0x44], edx
jne 0x29ad7dc6
xor eax, eax
jmp 0x29ad7e14
mov eax, dword [esp + 0x7c]
cmp eax, edi
jge 0x29ad7dd7
inc eax
mov dword [esp + 0x7c], eax
xor eax, eax
jmp 0x29ad7e14
mov eax, dword [esp + 0x74]
movzx eax, byte [eax]
mov edx, dword [esp + 0x78]
mov cl, dl
shr eax, cl
mov ecx, dword [esp + 0x7c]
and eax, 1
inc ecx
cmp ecx, dword [esi + 8]
mov dword [esp + 0x7c], ecx
jne 0x29ad7dfd
mov dword [esp + 0x74], edi
jmp 0x29ad7e14
cmp edx, edi
jne 0x29ad7e0f
inc dword [esp + 0x74]
mov dword [esp + 0x78], 7
jmp 0x29ad7e14
dec edx
mov dword [esp + 0x78], edx
mov ecx, dword [esp + 0x58]
lea edx, [ecx + ecx]
or edx, eax
mov eax, dword [esp + 0x68]
and edx, 7
cmp eax, edi
mov dword [esp + 0x58], edx
jne 0x29ad7e30
xor eax, eax
jmp 0x29ad7e7e
mov eax, dword [esp + 0x70]
cmp eax, edi
jge 0x29ad7e41
inc eax
mov dword [esp + 0x70], eax
xor eax, eax
jmp 0x29ad7e7e
mov eax, dword [esp + 0x68]
movzx eax, byte [eax]
mov edx, dword [esp + 0x6c]
mov cl, dl
shr eax, cl
mov ecx, dword [esp + 0x70]
and eax, 1
inc ecx
cmp ecx, dword [esi + 8]
mov dword [esp + 0x70], ecx
jne 0x29ad7e67
mov dword [esp + 0x68], edi
jmp 0x29ad7e7e
cmp edx, edi
jne 0x29ad7e79
inc dword [esp + 0x68]
mov dword [esp + 0x6c], 7
jmp 0x29ad7e7e
dec edx
mov dword [esp + 0x6c], edx
mov ecx, dword [esp + 0x8c]
lea edi, [ecx + ecx]
mov ecx, dword [esp + 0xd0]
mov edx, dword [ecx + 0x40]
mov ecx, dword [ecx + 0x38]
or edi, eax
mov eax, dword [esp + 0xb4]
and edi, 7
push edx
mov dword [esp + 0x90], edi
call fcn.29ad2090
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x29ad7eeb
mov eax, dword [esp + 0x58]
test eax, eax
jne 0x29ad7f1b
test edi, edi
jne 0x29ad7f1b
mov eax, dword [ebp + 0x10]
imul eax, dword [esp + 0x34]
mov edx, dword [ebp + 0x14]
mov ecx, ebx
sar ecx, 3
add eax, ecx
add eax, edx
mov ecx, ebx
and ecx, 7
mov edx, 0x7f7f
sar edx, cl
mov cl, byte [eax]
and cl, dl
jmp 0x29ad803d
mov ecx, dword [esp + 0x44]
mov eax, 7
cmp ecx, eax
jne 0x29ad7f1b
cmp dword [esp + 0x58], eax
jne 0x29ad7f1b
cmp edi, eax
jne 0x29ad7f1b
mov eax, dword [ebp + 0x10]
imul eax, dword [esp + 0x34]
mov edx, dword [ebp + 0x14]
mov ecx, ebx
sar ecx, 3
add eax, ecx
add eax, edx
jmp 0x29ad802a
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x29ad7f27
xor edi, edi
jmp 0x29ad7f7b
mov eax, dword [esp + 0x40]
test eax, eax
jge 0x29ad7f38
inc eax
mov dword [esp + 0x40], eax
xor edi, edi
jmp 0x29ad7f7b
mov eax, dword [esp + 0x38]
movzx edi, byte [eax]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov cl, dl
shr edi, cl
mov ecx, dword [ebp + 8]
and edi, 1
inc eax
cmp eax, ecx
mov dword [esp + 0x40], eax
jne 0x29ad7f64
mov dword [esp + 0x38], 0
jmp 0x29ad7f7b
test edx, edx
jne 0x29ad7f76
inc dword [esp + 0x38]
mov dword [esp + 0x3c], 7
jmp 0x29ad7f7b
dec edx
mov dword [esp + 0x3c], edx
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x29ad7f87
xor edx, edx
jmp 0x29ad7fd8
mov eax, dword [esp + 0x30]
test eax, eax
jge 0x29ad7f98
inc eax
mov dword [esp + 0x30], eax
xor edx, edx
jmp 0x29ad7fd8
mov ecx, dword [esp + 0x28]
movzx edx, byte [ecx]
mov cl, byte [esp + 0x2c]
shr edx, cl
mov ecx, dword [esi + 8]
and edx, 1
inc eax
cmp eax, ecx
mov dword [esp + 0x30], eax
jne 0x29ad7fbe
mov dword [esp + 0x28], 0
jmp 0x29ad7fd8
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x29ad7fd4
inc dword [esp + 0x28]
mov dword [esp + 0x2c], 7
jmp 0x29ad7fd8
dec dword [esp + 0x2c]
mov ecx, dword [esp + 0xd0]
mov eax, dword [ecx + 0x40]
mov ecx, dword [ecx + 0x38]
push eax
mov eax, dword [esp + 0x84]
add eax, eax
or eax, edi
shl eax, 1
or eax, edx
mov edx, dword [esp + 0x8c]
shl eax, 3
or eax, edx
mov edx, dword [esp + 0x88]
shl eax, 2
or eax, edx
call fcn.29ad2090
test eax, eax
je 0x29ad803f
mov ecx, dword [ebp + 0x10]
imul ecx, dword [esp + 0x34]
mov eax, dword [ebp + 0x14]
mov edx, ebx
sar edx, 3
add ecx, edx
add eax, ecx
mov ecx, 7
mov edx, ebx
and edx, ecx
sub ecx, edx
mov dl, 1
shl dl, cl
mov cl, byte [eax]
or cl, dl
mov byte [eax], cl
mov eax, dword [esp + 0xd4]
inc ebx
cmp ebx, eax
jl 0x29ad7bef
jmp 0x29ad89d7
cmp eax, ecx
jl 0x29ad807e
cmp eax, dword [edi + 0xc]
jge 0x29ad807e
cmp dword [edi + 8], ecx
jle 0x29ad807e
mov edx, dword [edi + 0x10]
imul edx, eax
add edx, dword [edi + 0x14]
mov ebp, 7
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], ecx
jmp 0x29ad8087
mov dword [esp + 0x48], ecx
mov ebp, 7
push edi
lea edx, [esp + 0x4c]
call fcn.29ad2f80
xor edx, edx
cmp ebx, edx
mov dword [esp + 0x80], eax
jl 0x29ad80c4
cmp ebx, dword [edi + 0xc]
jge 0x29ad80c4
mov eax, dword [edi + 8]
or ecx, 0xffffffff
cmp eax, ecx
jle 0x29ad80c4
mov eax, dword [edi + 0x10]
imul eax, ebx
add eax, dword [edi + 0x14]
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], ecx
jmp 0x29ad80c8
mov dword [esp + 0x38], edx
mov ecx, dword [esp + 0xe8]
mov edi, ebx
sub edi, ecx
lea ecx, [edi - 1]
cmp ecx, edx
mov dword [esp + 0x54], edi
mov dword [esp + 0xbc], ecx
jl 0x29ad810b
cmp ecx, dword [esi + 0xc]
jge 0x29ad810b
mov eax, dword [esp + 0xac]
cmp eax, dword [esi + 8]
jge 0x29ad810b
cmp eax, edx
mov edx, dword [esi + 0x10]
mov dword [esp + 0x30], eax
jge 0x29ad8156
imul edx, ecx
add edx, dword [esi + 0x14]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], edx
push esi
lea edx, [esp + 0x2c]
call fcn.29ad2f80
test edi, edi
mov dword [esp + 0xb0], eax
jl 0x29ad819b
cmp edi, dword [esi + 0xc]
jge 0x29ad819b
mov ebp, dword [esp + 0x90]
cmp ebp, dword [esi + 8]
jge 0x29ad81a2
test ebp, ebp
mov dword [esp + 0x18], ebp
jge 0x29ad8173
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
imul eax, edi
add eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 7
jmp 0x29ad81aa
imul edx, ecx
mov ecx, eax
sar ecx, 3
add edx, ecx
add edx, dword [esi + 0x14]
mov dword [esp + 0x28], edx
mov edx, eax
and edx, ebp
sub ebp, edx
mov dword [esp + 0x2c], ebp
jmp 0x29ad810f
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
imul ecx, edi
mov edx, ebp
sar edx, 3
add ecx, edx
add ecx, eax
mov dword [esp + 0x10], ecx
mov eax, ebp
and eax, 7
mov ecx, 7
sub ecx, eax
mov dword [esp + 0x14], ecx
jmp 0x29ad81aa
mov ebp, dword [esp + 0x90]
mov dword [esp + 0x10], 0
push esi
lea edx, [esp + 0x14]
call fcn.29ad2f80
push esi
lea edx, [esp + 0x14]
mov ebx, eax
call fcn.29ad2f80
lea edx, [ebx + ebx]
or eax, edx
inc edi
mov dword [esp + 0x88], eax
mov dword [esp + 0xb8], edi
js 0x29ad8229
cmp edi, dword [esi + 0xc]
jge 0x29ad8229
cmp ebp, dword [esi + 8]
jge 0x29ad8229
test ebp, ebp
mov dword [esp + 0x24], ebp
jge 0x29ad8201
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
imul eax, edi
add eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 7
jmp 0x29ad8231
mov ecx, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
imul ecx, edi
mov edx, ebp
sar edx, 3
add ecx, edx
add ecx, ebx
mov dword [esp + 0x1c], ecx
mov eax, ebp
and eax, 7
mov ecx, 7
sub ecx, eax
mov dword [esp + 0x20], ecx
jmp 0x29ad8231
mov dword [esp + 0x1c], 0
push esi
lea edx, [esp + 0x20]
call fcn.29ad2f80
push esi
lea edx, [esp + 0x20]
mov edi, eax
call fcn.29ad2f80
mov ebp, dword [esp + 0xec]
lea edx, [edi + edi]
mov edi, dword [esp + 0xf0]
mov ecx, dword [edi]
or eax, edx
mov dword [esp + 0x84], eax
add ecx, dword [esp + 0x34]
mov eax, dword [ebp]
js 0x29ad82cc
mov ebx, dword [esp + 0xc]
cmp ecx, dword [ebx + 0xc]
jge 0x29ad82cc
cmp eax, dword [ebx + 8]
jge 0x29ad82cc
mov edx, dword [ebx + 0x10]
imul edx, ecx
test eax, eax
mov dword [esp + 0xa8], eax
jge 0x29ad82a4
add edx, dword [ebx + 0x14]
mov dword [esp + 0xa0], edx
mov dword [esp + 0xa4], 7
xor ebx, ebx
jmp 0x29ad82d5
mov ecx, eax
sar ecx, 3
add edx, ecx
add edx, dword [ebx + 0x14]
mov dword [esp + 0xa0], edx
mov edx, eax
and edx, 7
mov ecx, 7
sub ecx, edx
mov dword [esp + 0xa4], ecx
xor ebx, ebx
jmp 0x29ad82d5
xor ebx, ebx
mov dword [esp + 0xa0], ebx
mov ecx, dword [edi + 4]
mov edx, dword [esp + 0xe8]
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0xe4]
sub ecx, edx
add ecx, eax
mov eax, dword [ebp + 4]
sub eax, edi
cmp ecx, ebx
jl 0x29ad834f
cmp ecx, dword [esi + 0xc]
jge 0x29ad834f
cmp eax, dword [esi + 8]
jge 0x29ad834f
mov edx, dword [esi + 0x10]
imul edx, ecx
cmp eax, ebx
mov dword [esp + 0x9c], eax
jge 0x29ad8329
add edx, dword [esi + 0x14]
mov dword [esp + 0x94], edx
mov dword [esp + 0x98], 7
jmp 0x29ad8356
mov ecx, eax
sar ecx, 3
add edx, ecx
add edx, dword [esi + 0x14]
mov dword [esp + 0x94], edx
mov edx, eax
and edx, 7
mov ecx, 7
sub ecx, edx
mov dword [esp + 0x98], ecx
jmp 0x29ad8356
mov dword [esp + 0x94], ebx
cmp dword [esp + 0xe0], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x44], ebx
je 0x29ad844d
mov eax, dword [esp + 0xbc]
mov ebx, dword [esp + 0x90]
push eax
lea eax, [esp + 0x60]
mov ecx, ebx
mov edx, esi
call fcn.29ad2f20
push esi
lea edx, [esp + 0x60]
call fcn.29ad2f80
push esi
lea edx, [esp + 0x60]
mov ebp, eax
call fcn.29ad2f80
mov edi, eax
lea ecx, [ebp + ebp]
push esi
lea edx, [esp + 0x60]
or edi, ecx
call fcn.29ad2f80
lea edx, [edi + edi]
or eax, edx
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x54]
push eax
lea eax, [esp + 0x78]
mov ecx, ebx
mov edx, esi
call fcn.29ad2f20
push esi
lea edx, [esp + 0x78]
call fcn.29ad2f80
push esi
lea edx, [esp + 0x78]
mov ebp, eax
call fcn.29ad2f80
mov edi, eax
lea ecx, [ebp + ebp]
push esi
lea edx, [esp + 0x78]
or edi, ecx
call fcn.29ad2f80
lea edx, [edi + edi]
or eax, edx
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0xb8]
push eax
lea eax, [esp + 0x6c]
mov ecx, ebx
mov edx, esi
call fcn.29ad2f20
push esi
lea edx, [esp + 0x6c]
call fcn.29ad2f80
push esi
lea edx, [esp + 0x6c]
mov ebp, eax
call fcn.29ad2f80
mov edi, eax
lea ecx, [ebp + ebp]
push esi
lea edx, [esp + 0x6c]
or edi, ecx
call fcn.29ad2f80
lea edx, [edi + edi]
or eax, edx
mov dword [esp + 0x8c], eax
xor ebx, ebx
cmp dword [esp + 0xd4], ebx
mov dword [esp + 0x54], ebx
jle 0x29ad89d7
mov edi, dword [esp + 0x48]
xor ebp, ebp
cmp edi, ebp
jne 0x29ad846c
xor eax, eax
jmp 0x29ad84b7
mov edx, dword [esp + 0x50]
cmp edx, ebp
jge 0x29ad847d
inc edx
mov dword [esp + 0x50], edx
xor eax, eax
jmp 0x29ad84b7
movzx eax, byte [edi]
mov ebx, dword [esp + 0x4c]
mov cl, bl
shr eax, cl
mov ecx, dword [esp + 0xc]
and eax, 1
inc edx
cmp edx, dword [ecx + 8]
mov dword [esp + 0x50], edx
jne 0x29ad849f
mov dword [esp + 0x48], ebp
jmp 0x29ad84b7
cmp ebx, ebp
jne 0x29ad84b2
inc edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], 7
jmp 0x29ad84b7
dec ebx
mov dword [esp + 0x4c], ebx
mov edx, dword [esp + 0x80]
mov edi, dword [esp + 0x28]
lea ecx, [edx + edx]
or ecx, eax
and ecx, 3
cmp edi, ebp
mov dword [esp + 0x80], ecx
jne 0x29ad84d9
xor eax, eax
jmp 0x29ad8522
mov edx, dword [esp + 0x30]
cmp edx, ebp
jge 0x29ad84ea
inc edx
mov dword [esp + 0x30], edx
xor eax, eax
jmp 0x29ad8522
movzx eax, byte [edi]
mov ebx, dword [esp + 0x2c]
mov cl, bl
shr eax, cl
mov ecx, dword [esi + 8]
and eax, 1
inc edx
cmp edx, ecx
mov dword [esp + 0x30], edx
jne 0x29ad850a
mov dword [esp + 0x28], ebp
jmp 0x29ad8522
cmp ebx, ebp
jne 0x29ad851d
inc edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], 7
jmp 0x29ad8522
dec ebx
mov dword [esp + 0x2c], ebx
mov edx, dword [esp + 0xb0]
mov edi, dword [esp + 0x10]
lea ecx, [edx + edx]
or ecx, eax
and ecx, 3
cmp edi, ebp
mov dword [esp + 0xb0], ecx
jne 0x29ad8544
xor eax, eax
jmp 0x29ad858d
mov edx, dword [esp + 0x18]
cmp edx, ebp
jge 0x29ad8555
inc edx
mov dword [esp + 0x18], edx
xor eax, eax
jmp 0x29ad858d
movzx eax, byte [edi]
mov ebx, dword [esp + 0x14]
mov cl, bl
shr eax, cl
mov ecx, dword [esi + 8]
and eax, 1
inc edx
cmp edx, ecx
mov dword [esp + 0x18], edx
jne 0x29ad8575
mov dword [esp + 0x10], ebp
jmp 0x29ad858d
cmp ebx, ebp
jne 0x29ad8588
inc edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], 7
jmp 0x29ad858d
dec ebx
mov dword [esp + 0x14], ebx
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x1c]
lea ecx, [edx + edx]
or ecx, eax
and ecx, 7
cmp edi, ebp
mov dword [esp + 0x88], ecx
jne 0x29ad85af
xor eax, eax
jmp 0x29ad85f8
mov edx, dword [esp + 0x24]
cmp edx, ebp
jge 0x29ad85c0
inc edx
mov dword [esp + 0x24], edx
xor eax, eax
jmp 0x29ad85f8
movzx eax, byte [edi]
mov ebx, dword [esp + 0x20]
mov cl, bl
shr eax, cl
mov ecx, dword [esi + 8]
and eax, 1
inc edx
cmp edx, ecx
mov dword [esp + 0x24], edx
jne 0x29ad85e0
mov dword [esp + 0x1c], ebp
jmp 0x29ad85f8
cmp ebx, ebp
jne 0x29ad85f3
inc edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], 7
jmp 0x29ad85f8
dec ebx
mov dword [esp + 0x20], ebx
mov edx, dword [esp + 0x84]
lea ecx, [edx + edx]
or ecx, eax
mov eax, dword [esp + 0xe0]
and ecx, 7
cmp eax, ebp
mov dword [esp + 0x84], ecx
je 0x29ad87e0
mov ebp, dword [esp + 0x5c]
xor ebx, ebx
cmp ebp, ebx
jne 0x29ad862b
xor eax, eax
jmp 0x29ad8675
mov edi, dword [esp + 0x64]
cmp edi, ebx
jge 0x29ad863c
inc edi
mov dword [esp + 0x64], edi
xor eax, eax
jmp 0x29ad8675
movzx eax, byte [ebp]
mov edx, dword [esp + 0x60]
mov cl, dl
shr eax, cl
mov ecx, dword [esi + 8]
and eax, 1
inc edi
cmp edi, ecx
mov dword [esp + 0x64], edi
jne 0x29ad865d
mov dword [esp + 0x5c], ebx
jmp 0x29ad8675
cmp edx, ebx
jne 0x29ad8670
inc ebp
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x60], 7
jmp 0x29ad8675
dec edx
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x44]
mov ebp, dword [esp + 0x74]
lea ecx, [edx + edx]
or ecx, eax
and ecx, 7
cmp ebp, ebx
mov dword [esp + 0x44], ecx
jne 0x29ad8691
xor eax, eax
jmp 0x29ad86db
mov edi, dword [esp + 0x7c]
cmp edi, ebx
jge 0x29ad86a2
inc edi
mov dword [esp + 0x7c], edi
xor eax, eax
jmp 0x29ad86db
movzx eax, byte [ebp]
mov edx, dword [esp + 0x78]
mov cl, dl
shr eax, cl
mov ecx, dword [esi + 8]
and eax, 1
inc edi
cmp edi, ecx
mov dword [esp + 0x7c], edi
jne 0x29ad86c3
mov dword [esp + 0x74], ebx
jmp 0x29ad86db
cmp edx, ebx
jne 0x29ad86d6
inc ebp
mov dword [esp + 0x74], ebp
mov dword [esp + 0x78], 7
jmp 0x29ad86db
dec edx
mov dword [esp + 0x78], edx
mov edx, dword [esp + 0x58]
mov ebp, dword [esp + 0x68]
lea ebx, [edx + edx]
or ebx, eax
and ebx, 7
test ebp, ebp
mov dword [esp + 0x58], ebx
jne 0x29ad86f7
xor eax, eax
jmp 0x29ad8745
mov edi, dword [esp + 0x70]
test edi, edi
jge 0x29ad8708
inc edi
mov dword [esp + 0x70], edi
xor eax, eax
jmp 0x29ad8745
movzx eax, byte [ebp]
mov edx, dword [esp + 0x6c]
mov cl, dl
shr eax, cl
mov ecx, dword [esi + 8]
and eax, 1
inc edi
cmp edi, ecx
mov dword [esp + 0x70], edi
jne 0x29ad872d
mov dword [esp + 0x68], 0
jmp 0x29ad8745
test edx, edx
jne 0x29ad8740
inc ebp
mov dword [esp + 0x68], ebp
mov dword [esp + 0x6c], 7
jmp 0x29ad8745
dec edx
mov dword [esp + 0x6c], edx
mov ecx, dword [esp + 0x8c]
lea edi, [ecx + ecx]
mov ecx, dword [esp + 0xd0]
mov edx, dword [ecx + 0x40]
mov ecx, dword [ecx + 0x38]
or edi, eax
mov eax, dword [esp + 0xb4]
and edi, 7
push edx
mov dword [esp + 0x90], edi
call fcn.29ad2090
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x29ad87b4
test ebx, ebx
jne 0x29ad87e0
test edi, edi
jne 0x29ad87e0
mov eax, dword [esp + 0xc]
mov edx, dword [eax + 0x10]
imul edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x54]
mov eax, dword [eax + 0x14]
mov edi, ecx
sar edi, 3
add edx, edi
add eax, edx
and ecx, 7
mov edx, 0x7f7f
sar edx, cl
mov cl, byte [eax]
and cl, dl
jmp 0x29ad89bd
cmp eax, 7
jne 0x29ad87e0
cmp ebx, eax
jne 0x29ad87e0
cmp edi, eax
jne 0x29ad87e0
mov eax, dword [esp + 0xc]
mov edx, dword [eax + 0x10]
imul edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x54]
mov eax, dword [eax + 0x14]
mov edi, ecx
sar edi, 3
add edx, edi
jmp 0x29ad89a8
mov eax, dword [esp + 0x38]
test eax, eax
mov ebp, dword [esp + 0xc]
jne 0x29ad87f0
xor ebx, ebx
jmp 0x29ad8844
mov eax, dword [esp + 0x40]
test eax, eax
jge 0x29ad8801
inc eax
mov dword [esp + 0x40], eax
xor ebx, ebx
jmp 0x29ad8844
mov eax, dword [esp + 0x38]
movzx ebx, byte [eax]
mov eax, dword [esp + 0x3c]
mov edx, dword [ebp + 8]
mov cl, al
shr ebx, cl
mov ecx, dword [esp + 0x40]
and ebx, 1
inc ecx
cmp ecx, edx
mov dword [esp + 0x40], ecx
jne 0x29ad882d
mov dword [esp + 0x38], 0
jmp 0x29ad8844
test eax, eax
jne 0x29ad883f
inc dword [esp + 0x38]
mov dword [esp + 0x3c], 7
jmp 0x29ad8844
dec eax
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xa0]
test eax, eax
jne 0x29ad8853
xor edi, edi
jmp 0x29ad88c5
mov eax, dword [esp + 0xa8]
test eax, eax
jge 0x29ad886a
inc eax
mov dword [esp + 0xa8], eax
xor edi, edi
jmp 0x29ad88c5
mov ecx, dword [esp + 0xa0]
movzx edi, byte [ecx]
mov eax, dword [esp + 0xa4]
mov edx, dword [ebp + 8]
mov cl, al
shr edi, cl
mov ecx, dword [esp + 0xa8]
and edi, 1
inc ecx
cmp ecx, edx
mov dword [esp + 0xa8], ecx
jne 0x29ad88a5
mov dword [esp + 0xa0], 0
jmp 0x29ad88c5
test eax, eax
jne 0x29ad88bd
inc dword [esp + 0xa0]
mov dword [esp + 0xa4], 7
jmp 0x29ad88c5
dec eax
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x94]
test eax, eax
jne 0x29ad88d4
xor edx, edx
jmp 0x29ad8944
mov eax, dword [esp + 0x9c]
test eax, eax
jge 0x29ad88eb
inc eax
mov dword [esp + 0x9c], eax
xor edx, edx
jmp 0x29ad8944
mov edx, dword [esp + 0x94]
movzx edx, byte [edx]
mov eax, dword [esp + 0x98]
mov cl, al
shr edx, cl
mov ecx, dword [esp + 0x9c]
and edx, 1
inc ecx
cmp ecx, dword [esi + 8]
mov dword [esp + 0x9c], ecx
jne 0x29ad8924
mov dword [esp + 0x94], 0
jmp 0x29ad8944
test eax, eax
jne 0x29ad893c
inc dword [esp + 0x94]
mov dword [esp + 0x98], 7
jmp 0x29ad8944
dec eax
mov dword [esp + 0x98], eax
mov ecx, dword [esp + 0xd0]
mov eax, dword [ecx + 0x40]
push eax
mov eax, dword [esp + 0x84]
add eax, eax
or eax, ebx
mov ebx, dword [esp + 0xb4]
mov ecx, dword [ecx + 0x38]
shl eax, 2
or eax, ebx
mov ebx, dword [esp + 0x8c]
shl eax, 3
or eax, ebx
mov ebx, dword [esp + 0x88]
shl eax, 3
or eax, ebx
shl eax, 1
or eax, edi
shl eax, 1
or eax, edx
call fcn.29ad2090
test eax, eax
je 0x29ad89bf
mov edx, dword [ebp + 0x10]
imul edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x54]
mov eax, ecx
sar eax, 3
add edx, eax
mov eax, dword [ebp + 0x14]
add eax, edx
mov edx, ecx
mov ecx, 7
and edx, ecx
sub ecx, edx
mov dl, 1
shl dl, cl
mov cl, byte [eax]
or cl, dl
mov byte [eax], cl
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0xd4]
inc eax
cmp eax, ecx
mov dword [esp + 0x54], eax
jl 0x29ad845e
mov ebx, dword [esp + 0x34]
mov eax, dword [esp + 0xd8]
inc ebx
cmp ebx, eax
mov dword [esp + 0x34], ebx
jl 0x29ad7910
mov eax, dword [esp + 0xc]
jmp 0x29ad89f7
mov eax, edi
mov ecx, dword [esp + 0xc0]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xc0
ret 0x24