Function at 0x407d80
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58c
push ebp
mov ebp, ecx
mov edx, dword [ebp + 4]
push edi
xor edi, edi
cmp edx, edi
mov dword [esp + 0x1c], ebp
jne 0x407da4
pop edi
xor eax, eax
pop ebp
add esp, 0x58c
ret 0x10
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [0x49e87c]
push esi
mov esi, dword [0x49e880]
mov dword [ebp + 0x2c], 1
movzx ecx, byte [0x490cfd]
dec ecx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x74], esi
mov dword [esp + 0x28], eax
je 0x407deb
dec ecx
jne case.0x407dfa.13
cmp eax, 0x46
jl 0x407de3
cmp eax, 0x47
jle 0x40e2a0
xor eax, eax
mov dword [esp + 0x28], eax
jmp 0x407e1c
lea ecx, [eax - 0xb]
cmp ecx, 0x46
ja case.0x407dfa.13
movzx ecx, byte [ecx + 0x40e2c0]
jmp dword [ecx*4 + 0x40e2b4]
mov eax, 0xa
mov dword [esp + 0x28], eax
jmp 0x407e1c
mov eax, 0x14
mov dword [esp + 0x28], eax
jmp 0x407e1c
cmp eax, 0x57
ja case.0x407e23.0
movzx eax, byte [eax + 0x40e3ac]
jmp dword [eax*4 + 0x40e308]
mov ecx, dword [esp + 0x5a4]
mov eax, dword [esi]
lea edi, [ebp + 0xc]
push edi
push edx
mov edx, dword [esp + 0x5a8]
push ecx
push edx
mov ecx, esi
call dword [eax + 0x60]
mov eax, dword [esp + 0x5ac]
test eax, eax
mov ecx, ebx
je 0x40e293
mov edx, dword [ebx]
push eax
call dword [edx + 0x28]
jmp 0x40e299
mov ecx, ebp
mov dword [ebp + 0x28], 0x64
call fcn.00407ce0
mov dword [esp + 0x1c], edi
xor edi, edi
mov eax, dword [esp + 0x1c]
mov ecx, dword [ebp + 4]
mov edx, dword [esi]
add eax, edi
push eax
lea eax, [ebp + 0xc]
push eax
mov eax, dword [esp + 0x5ac]
push ecx
mov ecx, dword [esp + 0x5ac]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x78]
inc edi
cmp edi, 4
jl 0x407e76
mov edx, dword [ebx]
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x1c]
add eax, 4
cmp eax, 0x10
mov dword [esp + 0x1c], eax
jl 0x407e74
jmp 0x40e299
mov ecx, ebp
mov dword [ebp + 0x28], 0x64
call fcn.00407ce0
mov dword [esp + 0x1c], edi
jmp 0x407ee0
xor edi, edi
mov eax, dword [esp + 0x1c]
mov ecx, dword [ebp + 4]
mov edx, dword [esi]
add eax, edi
push eax
lea eax, [ebp + 0xc]
push eax
mov eax, dword [esp + 0x5ac]
push ecx
mov ecx, dword [esp + 0x5ac]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x78]
inc edi
cmp edi, 2
jl 0x407ee2
mov edx, dword [ebx]
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x1c]
add eax, 2
cmp eax, 0x10
mov dword [esp + 0x1c], eax
jl 0x407ee0
jmp 0x40e299
mov ecx, ebp
mov dword [ebp + 0x28], 0x64
call fcn.00407ce0
xor edi, edi
mov ecx, dword [esp + 0x5a4]
mov edx, dword [esi]
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 4]
push eax
mov eax, dword [esp + 0x5ac]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x78]
mov eax, dword [esp + 0x5ac]
test eax, eax
mov edx, dword [ebx]
mov ecx, ebx
jne 0x407f77
lea eax, [ebp + 0xc]
push eax
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
inc edi
cmp edi, 0x10
jl 0x407f45
jmp 0x40e299
mov edx, dword [esi + 0x20]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push edx
mov edx, dword [esi + 0x18]
push edx
call dword [eax + 4]
mov ebx, dword [esp + 0x5a4]
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x5a0]
mov eax, dword [ecx]
lea edi, [ebp + 0xc]
push edi
push esi
push ebx
push edx
call dword [eax + 0x60]
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x5a0]
mov eax, dword [esi]
push edi
push ecx
push ebx
push edx
mov ecx, esi
call dword [eax + 0x60]
mov ecx, dword [ebp + 4]
mov edx, dword [esp + 0x5a0]
mov eax, dword [esi]
push 0x40
push edi
push ecx
push ebx
push edx
mov ecx, esi
call dword [eax + 0x88]
push edi
mov ecx, 0x4ae0d8
call fcn.00407b60
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x40e299
mov eax, dword [esi + 0x20]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push eax
mov eax, dword [esi + 0x18]
push eax
call dword [edx + 4]
mov ebx, dword [esp + 0x5a4]
mov ecx, dword [ebp + 8]
mov eax, dword [esp + 0x5a0]
mov edx, dword [ecx]
lea edi, [ebp + 0xc]
push edi
push esi
push ebx
push eax
call dword [edx + 0x60]
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x5a0]
mov edx, dword [esi]
push edi
push eax
push ebx
push ecx
mov ecx, esi
call dword [edx + 0x60]
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0x5a0]
mov edx, dword [esi]
push 0x80
push edi
push eax
push ebx
push ecx
mov ecx, esi
call dword [edx + 0x88]
push edi
mov ecx, 0x4ae0d8
call fcn.00407b60
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx + 8]
jmp 0x40e299
mov edx, dword [esi + 0x20]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push edx
mov edx, dword [esi + 0x18]
push edx
call dword [eax + 4]
mov ebx, dword [esp + 0x5a4]
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x5a0]
mov eax, dword [ecx]
lea edi, [ebp + 0xc]
push edi
push esi
push ebx
push edx
call dword [eax + 0x60]
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x5a0]
mov eax, dword [esi]
push edi
push ecx
push ebx
push edx
mov ecx, esi
call dword [eax + 0x60]
mov ecx, dword [ebp + 4]
mov edx, dword [esp + 0x5a0]
mov eax, dword [esi]
push 0xc0
push edi
push ecx
push ebx
push edx
mov ecx, esi
call dword [eax + 0x88]
push edi
mov ecx, 0x4ae0d8
call fcn.00407b60
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x40e299
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x28], 0xa
mov eax, dword [esi + 0x20]
mov edx, dword [ecx]
push eax
mov eax, dword [esi + 0x18]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x5a4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
lea edi, [ebp + 0xc]
push edi
push esi
push eax
mov eax, dword [esp + 0x5ac]
push eax
call dword [edx + 0x60]
mov ecx, ebp
call fcn.00407ce0
mov dword [esp + 0x10], 1
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x5a4]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [esp + 0x5a8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x60]
mov ecx, dword [ebp + 4]
mov edx, dword [esi]
xor eax, eax
mov al, byte [esp + 0x10]
shl al, 6
push eax
mov eax, dword [esp + 0x5a8]
push edi
push ecx
mov ecx, dword [esp + 0x5ac]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x88]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 4
mov dword [esp + 0x10], eax
jl 0x408132
mov ecx, dword [ebp + 4]
mov edx, dword [esp + 0x5a4]
mov eax, dword [esi]
push edi
push ecx
mov ecx, dword [esp + 0x5a8]
push edx
push ecx
mov ecx, esi
call dword [eax + 0x60]
jmp 0x40d9b3
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x28], 0x64
mov eax, dword [esi + 0x20]
mov edx, dword [ecx]
push eax
mov eax, dword [esi + 0x18]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x5a4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
lea edi, [ebp + 0xc]
push edi
push esi
push eax
mov eax, dword [esp + 0x5ac]
push eax
call dword [edx + 0x60]
mov ecx, ebp
call fcn.00407ce0
mov dword [esp + 0x10], 1
jmp 0x408200
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x5a4]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [esp + 0x5a8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x60]
mov ecx, dword [ebp + 4]
mov edx, dword [esi]
xor eax, eax
mov al, byte [esp + 0x10]
shl al, 6
push eax
mov eax, dword [esp + 0x5a8]
push edi
push ecx
mov ecx, dword [esp + 0x5ac]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x88]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 4
mov dword [esp + 0x10], eax
jl 0x408200
jmp 0x408194
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x28], 0x64
mov eax, dword [esi + 0x20]
mov edx, dword [ecx]
push eax
mov eax, dword [esi + 0x18]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x5a4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
lea edi, [ebp + 0xc]
push edi
push esi
push eax
mov eax, dword [esp + 0x5ac]
push eax
call dword [edx + 0x60]
mov ecx, ebp
call fcn.00407ce0
mov dword [esp + 0x10], 1
lea ebx, [ebx]
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x5a4]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [esp + 0x5a8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x60]
mov ecx, dword [ebp + 4]
mov edx, dword [esi]
xor eax, eax
mov al, byte [esp + 0x10]
shl al, 5
push eax
mov eax, dword [esp + 0x5a8]
push edi
push ecx
mov ecx, dword [esp + 0x5ac]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x88]
mov eax, dword [esp + 0x5ac]
test eax, eax
mov edx, dword [ebx]
mov ecx, ebx
je 0x408307
push eax
jmp 0x408308
push edi
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 8
mov dword [esp + 0x10], eax
jl 0x4082b0
jmp 0x408194
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x28], 0x64
mov eax, dword [esi + 0x20]
mov edx, dword [ecx]
push eax
mov eax, dword [esi + 0x18]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x5a4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
lea edi, [ebp + 0xc]
push edi
push esi
push eax
mov eax, dword [esp + 0x5ac]
push eax
call dword [edx + 0x60]
mov ecx, ebp
call fcn.00407ce0
mov dword [esp + 0x10], 1
jmp 0x408370
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x5a4]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [esp + 0x5a8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x60]
mov ecx, dword [ebp + 4]
mov edx, dword [esi]
xor eax, eax
mov al, byte [esp + 0x10]
shl al, 4
push eax
mov eax, dword [esp + 0x5a8]
push edi
push ecx
mov ecx, dword [esp + 0x5ac]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x88]
mov eax, dword [esp + 0x5ac]
test eax, eax
mov edx, dword [ebx]
mov ecx, ebx
je 0x4083c7
push eax
jmp 0x4083c8
push edi
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x10
mov dword [esp + 0x10], eax
jl 0x408370
jmp 0x408194
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x28], 0x64
mov eax, dword [esi + 0x20]
mov edx, dword [ecx]
push eax
mov eax, dword [esi + 0x18]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x5a4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
lea edi, [ebp + 0xc]
push edi
push esi
push eax
mov eax, dword [esp + 0x5ac]
push eax
call dword [edx + 0x60]
mov ecx, ebp
call fcn.00407ce0
mov dword [esp + 0x10], 1
jmp 0x408430
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x5a4]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [esp + 0x5a8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x60]
mov ecx, dword [ebp + 4]
mov edx, dword [esi]
xor eax, eax
mov al, byte [esp + 0x10]
shl al, 3
push eax
mov eax, dword [esp + 0x5a8]
push edi
push ecx
mov ecx, dword [esp + 0x5ac]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x88]
mov eax, dword [esp + 0x5ac]
test eax, eax
mov edx, dword [ebx]
mov ecx, ebx
je 0x408487
push eax
jmp 0x408488
push edi
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x20
mov dword [esp + 0x10], eax
jl 0x408430
jmp 0x408194
mov dword [ebp + 0x28], 0x64
cmp dword [0x49e960], 0x18
mov edx, dword [ebx]
mov ecx, ebx
push 0
jne 0x40891b
call dword [edx + 0x18]
mov edi, eax
mov eax, dword [ebx]
push 0
mov ecx, ebx
mov dword [esp + 0x6c], edi
call dword [eax + 0x18]
mov ecx, dword [esi + 0x18]
mov edx, dword [edi]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x20]
push eax
push ecx
mov ecx, edi
call dword [edx + 4]
mov ecx, dword [esp + 0x5a0]
mov edx, dword [edi]
lea eax, [ebp + 0xc]
push eax
mov eax, dword [esp + 0x5a8]
push esi
push eax
push ecx
mov ecx, edi
call dword [edx + 0x60]
mov ecx, dword [esp + 0x5a4]
mov edx, dword [edi]
push 0xf
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 4]
push eax
mov eax, dword [esp + 0x5ac]
push ecx
push eax
mov ecx, edi
call dword [edx + 0x88]
mov eax, dword [esi + 0x20]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push eax
mov eax, dword [esi + 0x18]
push eax
call dword [edx + 4]
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x20]
xor edx, edx
test eax, eax
mov dword [esp + 0x18], edx
jle 0x40870e
mov ecx, dword [esi + 0x18]
mov eax, ecx
imul eax, edx
test ecx, ecx
jle 0x4086fe
mov edx, dword [esp + 0x20]
mov edi, 5
lea eax, [edx + eax*4]
mov dword [esp + 0x64], edi
mov dword [esp + 0x5c], eax
xor eax, eax
xor edx, edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x58], eax
lea eax, [edi - 0xa]
test eax, eax
setl dl
mov dword [esp + 0x38], ecx
dec edx
and edx, eax
cmp edi, ecx
mov dword [esp + 0x30], edx
jg 0x4085ad
mov dword [esp + 0x38], edi
mov edi, dword [esp + 0x18]
add edi, 5
xor edx, edx
lea eax, [edi - 0xa]
test eax, eax
setl dl
dec edx
and edx, eax
mov eax, dword [esi + 0x20]
cmp edi, eax
mov dword [esp + 0x6c], edx
jg 0x4085ce
mov eax, edi
cmp edx, eax
mov dword [esp + 0x60], eax
jge 0x408683
lea edi, [ecx*8]
imul ecx, edx
mov dword [esp + 0x70], edi
add ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x3c]
lea edi, [edi + ecx*4]
mov ecx, eax
sub ecx, edx
dec ecx
shr ecx, 1
inc ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x50], ecx
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x30], eax
jge 0x40866c
mov edx, eax
sub edx, dword [esp + 0x30]
dec edx
shr edx, 1
mov dword [esp + 0x1c], edi
inc edx
jmp 0x408620
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edi, dword [esp + 0x34]
mov eax, ecx
shr eax, 0x10
add edi, eax
mov eax, ecx
mov dword [esp + 0x34], edi
mov edi, dword [esp + 0x2c]
and eax, 0xff00
add edi, eax
and ecx, 0xff
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x58]
add edi, ecx
mov ecx, dword [esp + 0x1c]
add ecx, 8
dec edx
mov dword [esp + 0x58], edi
mov dword [esp + 0x1c], ecx
jne 0x408620
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x6c]
mov edi, dword [esp + 0x24]
add edi, dword [esp + 0x70]
dec ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x50], ecx
jne 0x408603
mov eax, dword [esp + 0x60]
sub eax, edx
mov edi, dword [esp + 0x30]
inc eax
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x38]
sub eax, edi
sar ecx, 1
inc eax
cdq
sub eax, edx
mov edx, dword [esp + 0x34]
sar eax, 1
imul ecx, eax
lea eax, [ecx + edx - 1]
cdq
idiv ecx
mov edi, eax
mov eax, dword [esp + 0x2c]
sar eax, 8
lea eax, [eax + ecx - 1]
cdq
idiv ecx
or edi, 0xff00
shl edi, 8
or edi, eax
mov eax, dword [esp + 0x58]
lea eax, [ecx + eax - 1]
cdq
idiv ecx
shl edi, 8
or edi, eax
mov eax, dword [esp + 0x5c]
mov dword [eax], edi
mov edi, dword [esp + 0x64]
mov ecx, dword [esi + 0x18]
add eax, 4
inc edi
lea edx, [edi - 5]
cmp edx, ecx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x64], edi
jl 0x408582
mov edx, dword [esp + 0x18]
mov eax, dword [esi + 0x20]
inc edx
cmp edx, eax
mov dword [esp + 0x18], edx
jl 0x408561
cmp dword [esp + 0x28], 0x1e
jne 0x408858
mov edx, dword [esi + 0x20]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push edx
mov edx, dword [esi + 0x18]
push edx
call dword [eax + 4]
mov edx, dword [esp + 0x5a4]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
lea edi, [ebp + 0xc]
push edi
push esi
push edx
mov edx, dword [esp + 0x5ac]
push edx
call dword [eax + 0x60]
mov ecx, ebp
call fcn.00407ce0
mov dword [esp + 0x10], 1
jmp 0x408760
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x5a4]
mov eax, dword [esi]
push edi
push ecx
mov ecx, dword [esp + 0x5a8]
push edx
push ecx
mov ecx, esi
call dword [eax + 0x60]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi]
xor eax, eax
mov al, byte [esp + 0x10]
shl al, 4
push eax
mov eax, dword [esp + 0x5a8]
push edi
push ecx
mov ecx, dword [esp + 0x5ac]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x88]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x10
mov dword [esp + 0x10], eax
jl 0x408760
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x5a4]
mov eax, dword [esi]
push edi
push ecx
mov ecx, dword [esp + 0x5a8]
push edx
push ecx
mov ecx, esi
call dword [eax + 0x60]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov dword [esp + 0x10], 1
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x5a4]
mov eax, dword [esi]
push edi
push ecx
mov ecx, dword [esp + 0x5a8]
push edx
push ecx
mov ecx, esi
call dword [eax + 0x60]
mov ecx, dword [ebp + 4]
mov edx, dword [esi]
xor eax, eax
mov al, byte [esp + 0x10]
shl al, 2
push eax
mov eax, dword [esp + 0x5a8]
push edi
push ecx
mov ecx, dword [esp + 0x5ac]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x88]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x40
mov dword [esp + 0x10], eax
jl 0x4087f0
jmp 0x408ca3
mov ecx, ebp
call fcn.00407ce0
mov dword [esp + 0x10], 0
jmp 0x408870
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi]
push eax
mov eax, dword [esp + 0x5a8]
lea edi, [ebp + 0xc]
push edi
push ecx
mov ecx, dword [esp + 0x5ac]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x78]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x10
mov dword [esp + 0x10], eax
jl 0x408870
mov dword [esp + 0x10], 0
lea ebx, [ebx]
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 4]
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0x5a8]
push edi
push edx
mov edx, dword [esp + 0x5ac]
push ecx
push edx
mov ecx, esi
call dword [eax + 0x78]
mov eax, dword [ebx]
push edi
mov ecx, ebx
call dword [eax + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x10
mov dword [esp + 0x10], eax
jl 0x4088c0
mov eax, dword [esp + 0x68]
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0x1c]
mov eax, dword [esp + 0x14]
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0x1c]
jmp 0x40e299
call dword [edx + 0x18]
mov edi, eax
mov eax, dword [ebx]
push 0
mov ecx, ebx
mov dword [esp + 0x6c], edi
call dword [eax + 0x18]
mov ecx, dword [esi + 0x18]
mov edx, dword [edi]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x20]
push eax
push ecx
mov ecx, edi
call dword [edx + 4]
mov ecx, dword [esp + 0x5a0]
mov edx, dword [edi]
lea eax, [ebp + 0xc]
push eax
mov eax, dword [esp + 0x5a8]
push esi
push eax
push ecx
mov ecx, edi
call dword [edx + 0x60]
mov ecx, dword [esp + 0x5a4]
mov edx, dword [edi]
push 0xf
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 4]
push eax
mov eax, dword [esp + 0x5ac]
push ecx
push eax
mov ecx, edi
call dword [edx + 0x88]
mov eax, dword [esi + 0x20]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push eax
mov eax, dword [esi + 0x18]
push eax
call dword [edx + 4]
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x20]
xor edx, edx
test eax, eax
mov dword [esp + 0x18], edx
jle 0x408b67
mov ecx, dword [esi + 0x18]
lea ecx, [ecx]
mov eax, edx
imul eax, ecx
test ecx, ecx
jle 0x408b57
mov edx, dword [esp + 0x20]
mov edi, 5
lea eax, [edx + eax*2]
mov dword [esp + 0x64], edi
mov dword [esp + 0x5c], eax
xor eax, eax
xor edx, edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x58], eax
lea eax, [edi - 0xa]
test eax, eax
setl dl
mov dword [esp + 0x38], ecx
dec edx
and edx, eax
cmp edi, ecx
mov dword [esp + 0x30], edx
jg 0x408a0c
mov dword [esp + 0x38], edi
mov edi, dword [esp + 0x18]
add edi, 5
xor edx, edx
lea eax, [edi - 0xa]
test eax, eax
setl dl
dec edx
and edx, eax
mov eax, dword [esi + 0x20]
cmp edi, eax
mov dword [esp + 0x6c], edx
jg 0x408a2d
mov eax, edi
cmp edx, eax
mov dword [esp + 0x60], eax
jge 0x408ae1
lea edi, [ecx*4]
mov dword [esp + 0x70], edi
mov edi, edx
imul edi, ecx
add edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x3c]
lea edi, [ecx + edi*2]
mov ecx, eax
sub ecx, edx
dec ecx
shr ecx, 1
inc ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x50], ecx
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x30], eax
jge 0x408aca
mov edx, eax
sub edx, dword [esp + 0x30]
dec edx
shr edx, 1
mov dword [esp + 0x1c], edi
inc edx
lea esp, [esp]
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax]
mov edi, dword [esp + 0x2c]
mov eax, ecx
shr eax, 0xa
add edi, eax
mov eax, ecx
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x34]
and eax, 0x3e0
add edi, eax
and ecx, 0x1f
mov dword [esp + 0x34], edi
mov edi, dword [esp + 0x58]
add edi, ecx
mov ecx, dword [esp + 0x1c]
add ecx, 4
dec edx
mov dword [esp + 0x58], edi
mov dword [esp + 0x1c], ecx
jne 0x408a80
mov edx, dword [esp + 0x6c]
mov ecx, dword [esp + 0x50]
mov edi, dword [esp + 0x24]
add edi, dword [esp + 0x70]
dec ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x50], ecx
jne 0x408a64
mov eax, dword [esp + 0x60]
sub eax, edx
mov edi, dword [esp + 0x30]
inc eax
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x38]
sub eax, edi
sar ecx, 1
inc eax
cdq
sub eax, edx
sar eax, 1
imul ecx, eax
mov eax, dword [esp + 0x34]
sar eax, 5
lea eax, [eax + ecx - 1]
cdq
idiv ecx
mov edx, dword [esp + 0x2c]
mov edi, eax
lea eax, [ecx + edx - 1]
cdq
idiv ecx
shl eax, 5
or edi, eax
mov eax, dword [esp + 0x58]
lea eax, [ecx + eax - 1]
cdq
idiv ecx
shl edi, 5
or edi, eax
mov eax, dword [esp + 0x5c]
mov word [eax], di
mov edi, dword [esp + 0x64]
mov ecx, dword [esi + 0x18]
add eax, 2
inc edi
lea edx, [edi - 5]
cmp edx, ecx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x64], edi
jl 0x4089e1
mov edx, dword [esp + 0x18]
mov eax, dword [esi + 0x20]
inc edx
cmp edx, eax
mov dword [esp + 0x18], edx
jl 0x4089c0
cmp dword [esp + 0x28], 0x1e
jne 0x408cd4
mov edx, dword [esi + 0x20]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push edx
mov edx, dword [esi + 0x18]
push edx
call dword [eax + 4]
mov edx, dword [esp + 0x5a4]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
lea edi, [ebp + 0xc]
push edi
push esi
push edx
mov edx, dword [esp + 0x5ac]
push edx
call dword [eax + 0x60]
mov ecx, ebp
call fcn.00407ce0
mov dword [esp + 0x10], 1
mov edi, edi
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x5a4]
mov eax, dword [esi]
push edi
push ecx
mov ecx, dword [esp + 0x5a8]
push edx
push ecx
mov ecx, esi
call dword [eax + 0x60]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi]
xor eax, eax
mov al, byte [esp + 0x10]
shl al, 4
push eax
mov eax, dword [esp + 0x5a8]
push edi
push ecx
mov ecx, dword [esp + 0x5ac]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x88]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x10
mov dword [esp + 0x10], eax
jl 0x408bb0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x5a4]
mov eax, dword [esi]
push edi
push ecx
mov ecx, dword [esp + 0x5a8]
push edx
push ecx
mov ecx, esi
call dword [eax + 0x60]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov dword [esp + 0x10], 1
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x5a4]
mov eax, dword [esi]
push edi
push ecx
mov ecx, dword [esp + 0x5a8]
push edx
push ecx
mov ecx, esi
call dword [eax + 0x60]
mov ecx, dword [ebp + 4]
mov edx, dword [esi]
xor eax, eax
mov al, byte [esp + 0x10]
shl al, 2
push eax
mov eax, dword [esp + 0x5a8]
push edi
push ecx
mov ecx, dword [esp + 0x5ac]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x88]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x40
mov dword [esp + 0x10], eax
jl 0x408c40
mov ecx, dword [ebp + 4]
mov edx, dword [esp + 0x5a4]
mov eax, dword [esi]
push edi
push ecx
mov ecx, dword [esp + 0x5a8]
push edx
push ecx
mov ecx, esi
call dword [eax + 0x60]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x4088fe
mov ecx, ebp
call fcn.00407ce0
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi]
push eax
mov eax, dword [esp + 0x5a8]
lea edi, [ebp + 0xc]
push edi
push ecx
mov ecx, dword [esp + 0x5ac]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x78]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x10
mov dword [esp + 0x10], eax
jl 0x408ce3
mov dword [esp + 0x10], 0
lea ecx, [ecx]
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 4]
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0x5a8]
push edi
push edx
mov edx, dword [esp + 0x5ac]
push ecx
push edx
mov ecx, esi
call dword [eax + 0x78]
mov eax, dword [ebx]
push edi
mov ecx, ebx
call dword [eax + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x10
mov dword [esp + 0x10], eax
jl 0x408d30
jmp 0x4088fe
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x20], ecx
xor edi, edi
mov ecx, ebp
mov dword [ebp + 0x28], 0x1e
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], 0x320
call fcn.00407ce0
jmp 0x408da0
cmp edi, 0x258
mov eax, edi
mov dword [esp + 0x44], eax
jge 0x408ddc
mov edi, edi
lea ecx, [esp + 0x40]
push ecx
mov ecx, dword [ebp + 4]
push ecx
lea edx, [eax + 1]
push eax
mov dword [esp + 0x58], edx
mov edx, dword [esi]
push 0
mov ecx, esi
call dword [edx + 0x60]
mov eax, dword [esp + 0x44]
add eax, 0x14
cmp eax, 0x258
mov dword [esp + 0x44], eax
jl 0x408db0
mov edx, dword [ebx]
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
inc edi
cmp edi, 0x14
jl 0x408da0
mov eax, dword [esp + 0x20]
mov dword [ebp + 0x28], eax
jmp 0x40e299
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x3c], ecx
mov eax, 1
mov ecx, 0x29
lea edi, [esp + 0x268]
rep stosd dword es:[edi], eax
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x20]
mov dword [ebp + 0x28], 0xa
lea edx, [esp + 0x314]
mov ecx, 0xf
xor edi, edi
jmp 0x408e40
mov dword [edx - 4], eax
mov dword [edx - 8], edi
mov dword [edx], 0x320
add eax, ecx
add edx, 0x10
cmp eax, 0x266
jl 0x408e40
xor edi, edi
mov dword [esp + 0x590], 0xffffffff
mov dword [esp + 0x308], ecx
mov dword [esp + 0x144], ecx
mov dword [esp + 0x148], 0x11
mov dword [esp + 0x14c], 0x13
mov dword [esp + 0x150], 0x15
mov dword [esp + 0x154], 0x17
mov dword [esp + 0x158], 0x19
mov dword [esp + 0x15c], 0x1b
mov dword [esp + 0x160], 0x1d
mov dword [esp + 0x164], 0x1f
mov dword [esp + 0x168], 0x21
mov dword [esp + 0x16c], 0x23
mov dword [esp + 0x170], 0x25
mov dword [esp + 0x174], 0x27
mov dword [esp + 0x178], 0x29
mov dword [esp + 0x17c], 0x2b
mov dword [esp + 0x180], 0x2d
mov dword [esp + 0x184], 0x2f
mov dword [esp + 0x188], 0x31
mov dword [esp + 0x18c], 0x33
mov dword [esp + 0x190], 0x35
mov dword [esp + 0x194], 0x37
mov dword [esp + 0x198], 0x39
mov dword [esp + 0x19c], 0x3b
mov dword [esp + 0x1a0], 0x3d
mov dword [esp + 0x1a4], 0x3f
mov dword [esp + 0x1a8], 0x41
mov dword [esp + 0x1ac], 0x43
mov dword [esp + 0x1b0], 0x45
mov dword [esp + 0x1b4], 0x47
mov dword [esp + 0x1b8], 0x49
mov dword [esp + 0x1bc], 0x4b
mov dword [esp + 0x1c0], 0x4d
mov dword [esp + 0x1c4], 0x4f
mov dword [esp + 0x1c8], 0x51
mov dword [esp + 0x1cc], 0x53
mov dword [esp + 0x1d0], 0x55
mov dword [esp + 0x1d4], 0x57
mov dword [esp + 0x1d8], 0x59
mov dword [esp + 0x1dc], 0x5b
mov dword [esp + 0x1e0], 0x5d
mov dword [esp + 0x1e4], edi
mov dword [esp + 0xa0], edi
mov dword [esp + 0xa4], 2
mov dword [esp + 0xa8], 4
mov dword [esp + 0xac], 6
mov dword [esp + 0xb0], 8
mov dword [esp + 0xb4], 0xa
mov dword [esp + 0xb8], 0xc
mov dword [esp + 0xbc], 0xe
mov dword [esp + 0xc0], 0x10
mov dword [esp + 0xc4], 0x12
mov dword [esp + 0xc8], 0x14
mov dword [esp + 0xcc], 0x16
mov dword [esp + 0xd0], 0x18
mov dword [esp + 0xd4], 0x1a
mov dword [esp + 0xd8], 0x1c
mov dword [esp + 0xdc], 0x1e
mov dword [esp + 0xe0], 0x20
mov dword [esp + 0xe4], 0x22
mov dword [esp + 0xe8], 0x24
mov dword [esp + 0xec], 0x26
mov dword [esp + 0xf0], 0x28
mov dword [esp + 0xf4], 0x2a
mov dword [esp + 0xf8], 0x2c
mov dword [esp + 0xfc], 0x2e
mov dword [esp + 0x100], 0x30
mov dword [esp + 0x104], 0x32
mov dword [esp + 0x108], 0x34
mov dword [esp + 0x10c], 0x36
mov dword [esp + 0x110], 0x38
mov dword [esp + 0x114], 0x3a
mov dword [esp + 0x118], 0x3c
mov dword [esp + 0x11c], 0x3e
mov dword [esp + 0x120], 0x40
mov dword [esp + 0x124], 0x42
mov dword [esp + 0x128], 0x44
mov dword [esp + 0x12c], 0x46
mov dword [esp + 0x130], 0x48
mov ecx, ebp
mov dword [esp + 0x134], 0x4a
mov dword [esp + 0x138], 0x4c
mov dword [esp + 0x13c], 0x4e
mov dword [esp + 0x140], 0xfffffff1
call fcn.00407ce0
mov dword [esp + 0x10], edi
xor ecx, ecx
lea edi, [esp + 0x310]
mov dword [esp + 0x1c], ecx
mov edi, edi
mov edx, dword [esp + ecx + 0x144]
mov eax, dword [esp + 0x10]
add edx, 0xf
cmp eax, edx
jg 0x40926e
cmp eax, dword [esp + ecx + 0xa0]
jle 0x40926e
mov eax, dword [edi]
lea edx, [esp + ecx + 0x268]
mov ecx, dword [edx]
inc eax
inc ecx
test eax, eax
mov dword [edi], eax
mov dword [esp + 0x20], edx
mov dword [edx], ecx
jl 0x40926a
shl ecx, 4
cmp ecx, 0x100
lea edx, [eax + 1]
mov dword [edi + 8], edx
jl 0x40924a
or cl, 0xff
jmp 0x409254
mov ecx, dword [esp + 0x20]
movzx ecx, byte [ecx]
shl cl, 4
mov edx, dword [esi]
push ecx
lea ecx, [edi - 4]
push ecx
mov ecx, dword [ebp + 4]
push ecx
push eax
push 0
mov ecx, esi
call dword [edx + 0x88]
mov ecx, dword [esp + 0x1c]
add ecx, 4
add edi, 0x10
cmp ecx, 0xa4
mov dword [esp + 0x1c], ecx
jl 0x409200
mov edx, dword [ebx]
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x6c
mov dword [esp + 0x10], eax
jl 0x4091f1
mov eax, dword [esp + 0x3c]
mov dword [ebp + 0x28], eax
jmp 0x40e299
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x3c], ecx
mov ecx, 0x29
mov eax, 1
lea edi, [esp + 0x268]
rep stosd dword es:[edi], eax
mov dword [ebp + 0x28], 0xa
mov dword [esp + 0x24], 0xffffffff
lea edx, [esp + 0x314]
xor ecx, ecx
mov eax, dword [esp + 0x24]
mov dword [edx - 4], eax
add eax, 0xf
mov dword [edx - 8], ecx
mov dword [edx], 0x320
add edx, 0x10
cmp eax, 0x266
mov dword [esp + 0x24], eax
jl 0x4092e2
mov eax, 0xf
mov dword [esp + 0x308], eax
mov dword [esp + 0x144], eax
mov edi, 0x1c
mov edx, 0x22
mov ecx, 0x24
mov eax, 0x26
mov dword [esp + 0x590], 0xffffffff
mov dword [esp + 0x148], 0x10
mov dword [esp + 0x14c], 0x11
mov dword [esp + 0x150], 0x12
mov dword [esp + 0x154], 0x13
mov dword [esp + 0x158], 0x14
mov dword [esp + 0x15c], 0x15
mov dword [esp + 0x160], 0x16
mov dword [esp + 0x164], 0x17
mov dword [esp + 0x168], 0x18
mov dword [esp + 0x16c], 0x19
mov dword [esp + 0x170], 0x1a
mov dword [esp + 0x174], 0x1b
mov dword [esp + 0x178], edi
mov dword [esp + 0x17c], 0x1d
mov dword [esp + 0x180], 0x1e
mov dword [esp + 0x184], 0x1f
mov dword [esp + 0x188], 0x20
mov dword [esp + 0x18c], 0x21
mov dword [esp + 0x190], edx
mov dword [esp + 0x194], 0x23
mov dword [esp + 0x198], ecx
mov dword [esp + 0x19c], 0x25
mov dword [esp + 0x1a0], eax
mov dword [esp + 0x1a4], 0x27
mov dword [esp + 0x1a8], 0x28
mov dword [esp + 0x1ac], 0x29
mov dword [esp + 0x1b0], 0x2a
mov dword [esp + 0x1b4], 0x2b
mov dword [esp + 0x1b8], 0x2c
mov dword [esp + 0x1bc], 0x2d
mov dword [esp + 0x1c0], 0x2e
mov dword [esp + 0x1c4], 0x2f
mov dword [esp + 0x1c8], 0x30
mov dword [esp + 0x1cc], 0x31
mov dword [esp + 0x1d0], 0x32
mov dword [esp + 0x1d4], 0x33
mov dword [esp + 0x1d8], 0x34
mov dword [esp + 0x1dc], 0x35
mov dword [esp + 0x1e0], 0x36
mov dword [esp + 0x1e4], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 1
mov dword [esp + 0xa8], 2
mov dword [esp + 0xac], 3
mov dword [esp + 0xb0], 4
mov dword [esp + 0xb4], 5
mov dword [esp + 0xb8], 6
mov dword [esp + 0xbc], 7
mov dword [esp + 0xc0], 8
mov dword [esp + 0xc4], 9
mov dword [esp + 0xc8], 0xa
mov dword [esp + 0xcc], 0xb
mov dword [esp + 0xd0], 0xc
mov dword [esp + 0xd4], 0xd
mov dword [esp + 0xd8], 0xe
mov dword [esp + 0xdc], 0xf
mov dword [esp + 0xe0], 0x10
mov dword [esp + 0xe4], 0x11
mov dword [esp + 0xe8], 0x12
mov dword [esp + 0xec], 0x13
mov dword [esp + 0xf0], 0x14
mov dword [esp + 0xf4], 0x15
mov dword [esp + 0xf8], 0x16
mov dword [esp + 0xfc], 0x17
mov dword [esp + 0x100], 0x18
mov dword [esp + 0x104], 0x19
mov dword [esp + 0x108], 0x1a
mov dword [esp + 0x10c], 0x1b
mov dword [esp + 0x110], edi
mov dword [esp + 0x114], 0x1d
mov dword [esp + 0x118], 0x1e
mov dword [esp + 0x11c], 0x1f
mov dword [esp + 0x120], 0x20
mov dword [esp + 0x130], ecx
mov ecx, ebp
mov dword [esp + 0x124], 0x21
mov dword [esp + 0x128], edx
mov dword [esp + 0x12c], 0x23
mov dword [esp + 0x134], 0x25
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], 0x27
mov dword [esp + 0x140], 0xfffffff1
call fcn.00407ce0
mov dword [esp + 0x10], 0
nop
xor ecx, ecx
lea edi, [esp + 0x310]
mov dword [esp + 0x1c], ecx
lea ecx, [ecx]
mov edx, dword [esp + ecx + 0x144]
mov eax, dword [esp + 0x10]
add edx, 0xf
cmp eax, edx
jg 0x409729
cmp eax, dword [esp + ecx + 0xa0]
jle 0x409729
mov eax, dword [edi]
lea edx, [esp + ecx + 0x268]
mov ecx, dword [edx]
inc eax
inc ecx
test eax, eax
mov dword [edi], eax
mov dword [esp + 0x20], edx
mov dword [edx], ecx
jl 0x409725
shl ecx, 4
cmp ecx, 0x100
lea edx, [eax + 1]
mov dword [edi + 8], edx
jl 0x4096fa
or cl, 0xff
jmp 0x409704
mov ecx, dword [esp + 0x20]
movzx ecx, byte [ecx]
shl cl, 4
mov edx, dword [esi]
push ecx
lea ecx, [edi - 4]
push ecx
mov ecx, dword [ebp + 4]
push ecx
push eax
push 0
mov ecx, esi
call dword [edx + 0x88]
mov edx, dword [ebx]
lea eax, [edi - 4]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, dword [esp + 0x1c]
add ecx, 4
add edi, 0x10
cmp ecx, 0xa4
mov dword [esp + 0x1c], ecx
jl 0x4096b0
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x45
mov dword [esp + 0x10], eax
jl 0x4096a0
mov eax, dword [esp + 0x3c]
mov dword [ebp + 0x28], eax
jmp 0x40e299
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x20], ecx
mov dword [ebp + 0x28], 0x14
mov edx, dword [ebx]
push 0
mov ecx, ebx
call dword [edx + 0x18]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
mov edi, eax
mov eax, dword [edi]
push ecx
push edx
mov ecx, edi
call dword [eax + 4]
mov ecx, dword [esp + 0x5a0]
mov edx, dword [edi]
lea eax, [ebp + 0xc]
push eax
mov eax, dword [esp + 0x5a8]
push esi
push eax
push ecx
mov ecx, edi
call dword [edx + 0x60]
mov ecx, ebp
call fcn.00407ce0
push 0x258
push 0x320
xor eax, eax
push 0x258
push eax
lea edx, [esp + 0xa0]
push edx
mov dword [esp + 0x58], eax
mov dword [esp + 0x60], 0x258
mov dword [esp + 0x5c], 0x320
mov dword [esp + 0x54], eax
call dword [0x47a208]
mov dword [esp + 0x10], 1
nop
mov edx, dword [esp + 0x10]
mov eax, dword [esi]
lea ecx, [esp + 0x40]
push ecx
push edi
push edx
push 0
mov ecx, esi
call dword [eax + 0x60]
mov edx, dword [ebp + 4]
mov eax, dword [esi]
lea ecx, [esp + 0x90]
push ecx
push edx
push 0
push 0
mov ecx, esi
call dword [eax + 0x60]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x94]
mov eax, 0x14
sub ecx, eax
sub edx, eax
lea eax, [ebp + 0xc]
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x94], edx
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
add eax, 0x14
cmp eax, 0x258
mov dword [esp + 0x10], eax
jl 0x4097f0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x5a4]
mov dword [ebp + 0x28], eax
mov edx, dword [esi]
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 4]
push eax
mov eax, dword [esp + 0x5a8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x60]
mov edx, dword [ebx]
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov eax, dword [ebx]
push edi
mov ecx, ebx
call dword [eax + 0x1c]
jmp 0x40e299
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x20], ecx
mov dword [ebp + 0x28], 0x14
mov edx, dword [ebx]
push 0
mov ecx, ebx
call dword [edx + 0x18]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
mov edi, eax
mov eax, dword [edi]
push ecx
push edx
mov ecx, edi
call dword [eax + 4]
mov ecx, dword [esp + 0x5a0]
mov edx, dword [edi]
lea eax, [ebp + 0xc]
push eax
mov eax, dword [esp + 0x5a8]
push esi
push eax
push ecx
mov ecx, edi
call dword [edx + 0x60]
mov ecx, ebp
call fcn.00407ce0
xor eax, eax
push eax
push 0x320
push eax
push eax
lea edx, [esp + 0xa0]
push edx
mov dword [esp + 0x58], eax
mov dword [esp + 0x60], 0x258
mov dword [esp + 0x5c], 0x320
mov dword [esp + 0x54], eax
call dword [0x47a208]
mov dword [esp + 0x1c], 0x257
nop
mov eax, dword [esi]
lea ecx, [esp + 0x40]
push ecx
push edi
push 0
push 0
mov ecx, esi
call dword [eax + 0x60]
mov ecx, dword [ebp + 4]
mov edx, dword [esi]
lea eax, [esp + 0x90]
push eax
mov eax, dword [esp + 0x20]
push ecx
push eax
push 0
mov ecx, esi
call dword [edx + 0x60]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x9c]
mov eax, 0x14
add ecx, eax
add edx, eax
lea eax, [ebp + 0xc]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x9c], edx
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x1c]
sub eax, 0x14
test eax, eax
mov dword [esp + 0x1c], eax
jg 0x409920
jmp 0x40985e
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x20], ecx
mov dword [ebp + 0x28], 0x14
mov edx, dword [ebx]
push 0
mov ecx, ebx
call dword [edx + 0x18]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
mov edi, eax
mov eax, dword [edi]
push ecx
push edx
mov ecx, edi
call dword [eax + 4]
mov ecx, dword [esp + 0x5a0]
mov edx, dword [edi]
lea eax, [ebp + 0xc]
push eax
mov eax, dword [esp + 0x5a8]
push esi
push eax
push ecx
mov ecx, edi
call dword [edx + 0x60]
mov ecx, ebp
call fcn.00407ce0
mov eax, dword [ebp + 4]
xor edx, edx
mov dword [esp + 0x44], edx
mov dword [esp + 0x4c], 0x258
mov dword [esp + 0x48], 0x320
mov dword [esp + 0x40], edx
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0x20]
push eax
push ecx
push edx
push ecx
lea ecx, [esp + 0xa0]
push ecx
call dword [0x47a208]
mov dword [esp + 0x10], 0
jmp 0x409a20
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
lea eax, [esp + 0x40]
push eax
push edi
push 0
push ecx
mov ecx, esi
call dword [edx + 0x60]
mov ecx, dword [ebp + 4]
mov edx, dword [esi]
lea eax, [esp + 0x90]
push eax
push ecx
push 0
push 0
mov ecx, esi
call dword [edx + 0x60]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x90]
mov eax, 0x14
sub ecx, eax
sub edx, eax
lea eax, [ebp + 0xc]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x90], edx
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
add eax, 0x14
cmp eax, 0x320
mov dword [esp + 0x10], eax
jl 0x409a20
jmp 0x40985e
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x20], ecx
mov dword [ebp + 0x28], 0x14
mov edx, dword [ebx]
push 0
mov ecx, ebx
call dword [edx + 0x18]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
mov edi, eax
mov eax, dword [edi]
push ecx
push edx
mov ecx, edi
call dword [eax + 4]
mov ecx, dword [esp + 0x5a0]
mov edx, dword [edi]
lea eax, [ebp + 0xc]
push eax
mov eax, dword [esp + 0x5a8]
push esi
push eax
push ecx
mov ecx, edi
call dword [edx + 0x60]
mov ecx, ebp
call fcn.00407ce0
xor eax, eax
push 0x258
push eax
push eax
push eax
lea edx, [esp + 0xa0]
push edx
mov dword [esp + 0x58], eax
mov dword [esp + 0x60], 0x258
mov dword [esp + 0x5c], 0x320
mov dword [esp + 0x54], eax
call dword [0x47a208]
mov dword [esp + 0x10], 0x320
mov eax, dword [esi]
lea ecx, [esp + 0x40]
push ecx
push edi
push 0
push 0
mov ecx, esi
call dword [eax + 0x60]
mov ecx, dword [ebp + 4]
mov edx, dword [esi]
lea eax, [esp + 0x90]
push eax
mov eax, dword [esp + 0x14]
push ecx
push 0
push eax
mov ecx, esi
call dword [edx + 0x60]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x98]
mov eax, 0x14
add ecx, eax
add edx, eax
lea eax, [ebp + 0xc]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x98], edx
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
sub dword [esp + 0x10], 0x14
jns 0x409b16
jmp 0x40985e
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x28], 4
mov eax, dword [esi + 0x20]
mov edx, dword [ecx]
push eax
mov eax, dword [esi + 0x18]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x5a4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
lea edi, [ebp + 0xc]
push edi
push esi
push eax
mov eax, dword [esp + 0x5ac]
push eax
call dword [edx + 0x60]
mov ecx, ebp
call fcn.00407ce0
mov dword [esp + 0x1c], 0xfffffff6
mov dword [esp + 0x10], 1
lea esp, [esp]
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
inc eax
mov dword [esp + 0x14], eax
imul eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
push 0
push ecx
fild dword [esp + 0x28]
fmul dword [0x47a5b0]
fstp dword [esp]
push esi
call dword [edx + 0x5c]
mov edx, dword [ebp + 4]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov cl, byte [esp + 0x10]
shl cl, 4
sub eax, 3
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0x5a8]
push edi
push edx
mov edx, dword [esp + 0x5ac]
push ecx
push edx
mov ecx, esi
call dword [eax + 0x88]
mov eax, dword [ebx]
push edi
mov ecx, ebx
call dword [eax + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x14]
cmp eax, 0x10
mov dword [esp + 0x10], eax
jl 0x409bd0
jmp 0x40d997
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x28], 4
mov eax, dword [esi + 0x20]
mov edx, dword [ecx]
push eax
mov eax, dword [esi + 0x18]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x5a4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
lea edi, [ebp + 0xc]
push edi
push esi
push eax
mov eax, dword [esp + 0x5ac]
push eax
call dword [edx + 0x60]
mov ecx, ebp
call fcn.00407ce0
mov dword [esp + 0x1c], 0xa
mov dword [esp + 0x10], 1
jmp 0x409ca0
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
inc eax
mov dword [esp + 0x14], eax
imul eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
push 0
push ecx
fild dword [esp + 0x28]
fmul dword [0x47a5b0]
fstp dword [esp]
push esi
call dword [edx + 0x5c]
mov edx, dword [ebp + 4]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov cl, byte [esp + 0x10]
shl cl, 4
add eax, 3
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0x5a8]
push edi
push edx
mov edx, dword [esp + 0x5ac]
push ecx
push edx
mov ecx, esi
call dword [eax + 0x88]
mov eax, dword [ebx]
push edi
mov ecx, ebx
call dword [eax + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x14]
cmp eax, 0x10
mov dword [esp + 0x10], eax
jl 0x409ca0
jmp 0x40d997
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x28], 4
mov eax, dword [esi + 0x20]
mov edx, dword [ecx]
push eax
mov eax, dword [esi + 0x18]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x5a4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
lea edi, [ebp + 0xc]
push edi
push esi
push eax
mov eax, dword [esp + 0x5ac]
push eax
call dword [edx + 0x60]
mov ecx, ebp
call fcn.00407ce0
mov dword [esp + 0x1c], 0xfffffff6
mov dword [esp + 0x10], 1
jmp 0x409d70
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
inc eax
mov dword [esp + 0x14], eax
imul eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
push 0
push ecx
fild dword [esp + 0x28]
fmul dword [0x47a5b0]
fstp dword [esp]
push esi
call dword [edx + 0x5c]
mov edx, dword [ebp + 4]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov cl, byte [esp + 0x10]
shl cl, 3
sub eax, 2
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0x5a8]
push edi
push edx
mov edx, dword [esp + 0x5ac]
push ecx
push edx
mov ecx, esi
call dword [eax + 0x88]
mov eax, dword [ebx]
push edi
mov ecx, ebx
call dword [eax + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x14]
cmp eax, 0x20
mov dword [esp + 0x10], eax
jl 0x409d70
jmp 0x40d997
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x28], 4
mov eax, dword [esi + 0x20]
mov edx, dword [ecx]
push eax
mov eax, dword [esi + 0x18]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x5a4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
lea edi, [ebp + 0xc]
push edi
push esi
push eax
mov eax, dword [esp + 0x5ac]
push eax
call dword [edx + 0x60]
mov ecx, ebp
call fcn.00407ce0
mov dword [esp + 0x1c], 0xa
mov dword [esp + 0x10], 1
jmp 0x409e40
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
inc eax
mov dword [esp + 0x14], eax
imul eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
push 0
push ecx
fild dword [esp + 0x28]
fmul dword [0x47a5b0]
fstp dword [esp]
push esi
call dword [edx + 0x5c]
mov edx, dword [ebp + 4]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov cl, byte [esp + 0x10]
shl cl, 3
add eax, 2
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0x5a8]
push edi
push edx
mov edx, dword [esp + 0x5ac]
push ecx
push edx
mov ecx, esi
call dword [eax + 0x88]
mov eax, dword [ebx]
push edi
mov ecx, ebx
call dword [eax + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x14]
cmp eax, 0x20
mov dword [esp + 0x10], eax
jl 0x409e40
jmp 0x40d997
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x20], ecx
mov dword [ebp + 0x28], 0x1e
mov edx, dword [ebx]
push 0
mov ecx, ebx
call dword [edx + 0x18]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
mov edi, eax
mov eax, dword [edi]
push ecx
push edx
mov ecx, edi
mov dword [esp + 0x24], edi
call dword [eax + 4]
mov ecx, dword [esp + 0x5a0]
mov edx, dword [edi]
lea eax, [ebp + 0xc]
push eax
mov eax, dword [esp + 0x5a8]
push esi
push eax
push ecx
mov ecx, edi
call dword [edx + 0x60]
xor edi, edi
mov ecx, ebp
mov dword [esp + 0x44], edi
mov dword [esp + 0x4c], 0x258
call fcn.00407ce0
mov dword [esp + 0x10], edi
mov edi, 0x190
mov edx, dword [esp + 0x10]
mov eax, dword [esi]
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x44], edx
mov edx, dword [esp + 0x20]
push edx
push 0
push 0
mov ecx, esi
mov dword [esp + 0x58], 0x190
call dword [eax + 0x60]
mov edx, dword [esi]
lea ecx, [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x20]
lea eax, [edi + 0x190]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x14]
push ecx
add eax, 0x190
push 0
push eax
mov ecx, esi
mov dword [esp + 0x50], 0x190
call dword [edx + 0x60]
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 4]
mov edx, dword [esi]
add eax, 0x190
mov dword [esp + 0x48], eax
lea eax, [esp + 0x40]
push eax
push ecx
push 0
push edi
mov ecx, esi
mov dword [esp + 0x50], edi
call dword [edx + 0x60]
mov edx, dword [ebx]
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov edx, dword [esp + 0x10]
add edx, 0x14
sub edi, 0x14
test edi, edi
mov dword [esp + 0x10], edx
jg 0x409f26
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x5a4]
mov dword [ebp + 0x28], eax
mov eax, dword [ebp + 4]
mov edx, dword [esi]
lea edi, [ebp + 0xc]
push edi
push eax
mov eax, dword [esp + 0x5a8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x60]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, dword [esp + 0x1c]
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0x1c]
jmp 0x40e299
mov edx, dword [ebp + 0x28]
mov dword [ebp + 0x28], 0x1e
mov eax, dword [ebx]
push 0
mov ecx, ebx
mov dword [esp + 0x24], edx
call dword [eax + 0x18]
mov ecx, dword [esi + 0x18]
mov edi, eax
mov eax, dword [esi + 0x20]
mov edx, dword [edi]
push eax
push ecx
mov ecx, edi
call dword [edx + 4]
mov ecx, dword [esp + 0x5a0]
mov edx, dword [edi]
lea eax, [ebp + 0xc]
push eax
mov eax, dword [esp + 0x5a8]
push esi
push eax
push ecx
mov ecx, edi
call dword [edx + 0x60]
mov ecx, ebp
call fcn.00407ce0
mov dword [esp + 0x10], 0xffffffb0
mov dword [esp + 0x58], 0x190
mov dword [esp + 0x24], 0x28
jmp 0x40a070
mov eax, dword [esp + 0x10]
add eax, 0x50
cmp eax, 0x190
jg 0x40a10e
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
add eax, 0x50
mov dword [esp + 0x40], eax
lea eax, [esp + 0x40]
push eax
push edi
push 0
push 0
mov ecx, esi
mov dword [esp + 0x54], 0
mov dword [esp + 0x5c], 0x78
mov dword [esp + 0x58], 0x190
call dword [edx + 0x60]
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
add ecx, 0x190
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x40]
push ecx
push edi
add eax, 0x1e0
push 0
push eax
mov ecx, esi
mov dword [esp + 0x50], 0x190
call dword [edx + 0x60]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x58]
mov edx, dword [esi]
add ecx, 0x1e0
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x40]
push ecx
mov ecx, dword [ebp + 4]
push ecx
push 0
push eax
mov ecx, esi
mov dword [esp + 0x50], eax
call dword [edx + 0x60]
mov eax, dword [esp + 0x10]
add eax, 0x50
cmp eax, 0x1e0
jg 0x40a1be
cmp eax, 0x50
jl 0x40a1be
mov eax, dword [esp + 0x10]
mov edx, eax
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x44], eax
add eax, 0x50
push edi
sub edx, eax
mov eax, dword [esi]
push 0x78
add edx, 0x1e0
push 0
mov ecx, esi
mov dword [esp + 0x54], 0x78
mov dword [esp + 0x5c], 0xf0
mov dword [esp + 0x58], edx
call dword [eax + 0x60]
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x40]
push ecx
push edi
add edx, 0x1e0
add eax, 0x190
push 0x78
mov dword [esp + 0x54], edx
mov edx, dword [esi]
push eax
mov ecx, esi
mov dword [esp + 0x50], 0x190
call dword [edx + 0x60]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x58]
mov edx, dword [esi]
add ecx, 0x190
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x40]
push ecx
mov ecx, dword [ebp + 4]
push ecx
add eax, 0x50
push 0x78
push eax
mov ecx, esi
mov dword [esp + 0x50], eax
call dword [edx + 0x60]
mov eax, dword [esp + 0x10]
add eax, 0x50
cmp eax, 0x230
jg 0x40a27b
cmp eax, 0xa0
jl 0x40a27b
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
lea eax, [ecx - 0x50]
mov dword [esp + 0x40], eax
add ecx, 0x50
sub eax, ecx
add eax, 0x230
mov dword [esp + 0x48], eax
lea eax, [esp + 0x40]
push eax
push edi
push 0xf0
push 0
mov ecx, esi
mov dword [esp + 0x54], 0xf0
mov dword [esp + 0x5c], 0x168
call dword [edx + 0x60]
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
add ecx, 0x230
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x40]
push ecx
push edi
add eax, 0x154
push 0xf0
push eax
mov ecx, esi
mov dword [esp + 0x50], 0x190
call dword [edx + 0x60]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x58]
mov edx, dword [esi]
add ecx, 0x154
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x40]
push ecx
mov ecx, dword [ebp + 4]
push ecx
add eax, 0xa0
push 0xf0
push eax
mov ecx, esi
mov dword [esp + 0x50], eax
call dword [edx + 0x60]
mov eax, dword [esp + 0x10]
add eax, 0x50
cmp eax, 0x280
jg 0x40a33b
cmp eax, 0xf0
jl 0x40a33b
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
lea eax, [ecx - 0xa0]
mov dword [esp + 0x40], eax
add ecx, 0x50
sub eax, ecx
add eax, 0x280
mov dword [esp + 0x48], eax
lea eax, [esp + 0x40]
push eax
push edi
push 0x168
push 0
mov ecx, esi
mov dword [esp + 0x54], 0x168
mov dword [esp + 0x5c], 0x1e0
call dword [edx + 0x60]
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
add ecx, 0x280
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x40]
push ecx
push edi
add eax, 0x104
push 0x168
push eax
mov ecx, esi
mov dword [esp + 0x50], 0x190
call dword [edx + 0x60]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x58]
mov edx, dword [esi]
add ecx, 0x104
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x40]
push ecx
mov ecx, dword [ebp + 4]
push ecx
add eax, 0xf0
push 0x168
push eax
mov ecx, esi
mov dword [esp + 0x50], eax
call dword [edx + 0x60]
mov eax, dword [esp + 0x10]
add eax, 0x50
cmp eax, 0x2d0
jg 0x40a3fb
cmp eax, 0x140
jl 0x40a3fb
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
lea eax, [ecx - 0xf0]
mov dword [esp + 0x40], eax
add ecx, 0x50
sub eax, ecx
add eax, 0x2d0
mov dword [esp + 0x48], eax
lea eax, [esp + 0x40]
push eax
push edi
push 0x1e0
push 0
mov ecx, esi
mov dword [esp + 0x54], 0x1e0
mov dword [esp + 0x5c], 0x258
call dword [edx + 0x60]
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
add ecx, 0x2d0
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x40]
push ecx
push edi
add eax, 0xb4
push 0x1e0
push eax
mov ecx, esi
mov dword [esp + 0x50], 0x190
call dword [edx + 0x60]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x58]
mov edx, dword [esi]
add ecx, 0xb4
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x40]
push ecx
mov ecx, dword [ebp + 4]
push ecx
add eax, 0x140
push 0x1e0
push eax
mov ecx, esi
mov dword [esp + 0x50], eax
call dword [edx + 0x60]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x58]
mov eax, 0x14
add ecx, eax
sub edx, eax
lea eax, [ebp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x58], edx
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
dec dword [esp + 0x24]
jne 0x40a070
jmp 0x40985e
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x20], ecx
xor edi, edi
mov ecx, ebp
mov dword [ebp + 0x28], 0x1e
mov dword [esp + 0x44], edi
mov dword [esp + 0x4c], 0x258
call fcn.00407ce0
jmp 0x40a460
cmp edi, 0x320
mov eax, edi
mov dword [esp + 0x40], eax
jge 0x40a49c
mov edi, edi
lea ecx, [esp + 0x40]
push ecx
mov ecx, dword [ebp + 4]
push ecx
lea edx, [eax + 1]
push 0
mov dword [esp + 0x54], edx
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x60]
mov eax, dword [esp + 0x40]
add eax, 0x14
cmp eax, 0x320
mov dword [esp + 0x40], eax
jl 0x40a470
mov edx, dword [ebx]
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
inc edi
cmp edi, 0x14
jl 0x40a460
mov eax, dword [esp + 0x20]
mov dword [ebp + 0x28], eax
jmp 0x40e299
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x3c], ecx
mov ecx, 0x29
mov eax, 1
lea edi, [esp + 0x268]
rep stosd dword es:[edi], eax
mov dword [ebp + 0x28], 0xa
lea edx, [esp + 0x30c]
mov dword [esp + 0x24], 0x13
mov edi, 0x258
xor ecx, ecx
mov eax, dword [esp + 0x24]
mov dword [edx], eax
add eax, 0x14
mov dword [edx + 4], ecx
mov dword [edx + 0xc], edi
add edx, 0x10
cmp eax, 0x347
mov dword [esp + 0x24], eax
jl 0x40a4f7
mov edi, 0x1c
mov edx, 0x22
mov ecx, 0x24
mov eax, 0x26
mov dword [esp + 0x144], 0x14
mov dword [esp + 0x148], 0x16
mov dword [esp + 0x14c], 0x18
mov dword [esp + 0x150], 0x1a
mov dword [esp + 0x154], edi
mov dword [esp + 0x158], 0x1e
mov dword [esp + 0x15c], 0x20
mov dword [esp + 0x160], edx
mov dword [esp + 0x164], ecx
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], 0x28
mov dword [esp + 0x170], 0x2a
mov dword [esp + 0x174], 0x2c
mov dword [esp + 0x178], 0x2e
mov dword [esp + 0x17c], 0x30
mov dword [esp + 0x180], 0x32
mov dword [esp + 0x184], 0x34
mov dword [esp + 0x188], 0x36
mov dword [esp + 0x18c], 0x38
mov dword [esp + 0x190], 0x3a
mov dword [esp + 0x194], 0x3c
mov dword [esp + 0x198], 0x3e
mov dword [esp + 0x19c], 0x40
mov dword [esp + 0x1a0], 0x42
mov dword [esp + 0x1a4], 0x44
mov dword [esp + 0x1a8], 0x46
mov dword [esp + 0x1ac], 0x48
mov dword [esp + 0x1b0], 0x4a
mov dword [esp + 0x1b4], 0x4c
mov dword [esp + 0x1b8], 0x4e
mov dword [esp + 0x1bc], 0x50
mov dword [esp + 0x1c0], 0x52
mov dword [esp + 0x1c4], 0x54
mov dword [esp + 0x1c8], 0x56
mov dword [esp + 0x1cc], 0x58
mov dword [esp + 0x1d0], 0x5a
mov dword [esp + 0x1d4], 0x5c
mov dword [esp + 0x1d8], 0x5e
mov dword [esp + 0x1dc], 0x60
mov dword [esp + 0x1e0], 0x62
mov dword [esp + 0x1e4], 0x64
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 2
mov dword [esp + 0xa8], 4
mov dword [esp + 0xac], 6
mov dword [esp + 0xb0], 8
mov dword [esp + 0xb4], 0xa
mov dword [esp + 0xb8], 0xc
mov dword [esp + 0xbc], 0xe
mov dword [esp + 0xc0], 0x10
mov dword [esp + 0xc4], 0x12
mov dword [esp + 0xc8], 0x14
mov dword [esp + 0xcc], 0x16
mov dword [esp + 0xd0], 0x18
mov dword [esp + 0xd4], 0x1a
mov dword [esp + 0xd8], edi
mov dword [esp + 0xdc], 0x1e
mov dword [esp + 0xe0], 0x20
mov dword [esp + 0xe4], edx
mov dword [esp + 0xe8], ecx
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], 0x28
mov dword [esp + 0xf4], 0x2a
mov dword [esp + 0xf8], 0x2c
mov dword [esp + 0xfc], 0x2e
mov dword [esp + 0x100], 0x30
mov dword [esp + 0x104], 0x32
mov dword [esp + 0x108], 0x34
mov dword [esp + 0x10c], 0x36
mov dword [esp + 0x110], 0x38
mov dword [esp + 0x114], 0x3a
mov dword [esp + 0x118], 0x3c
mov dword [esp + 0x11c], 0x3e
mov dword [esp + 0x120], 0x40
mov dword [esp + 0x124], 0x42
mov dword [esp + 0x128], 0x44
mov dword [esp + 0x12c], 0x46
mov ecx, ebp
mov dword [esp + 0x130], 0x48
mov dword [esp + 0x134], 0x4a
mov dword [esp + 0x138], 0x4c
mov dword [esp + 0x13c], 0x4e
mov dword [esp + 0x140], 0x50
call fcn.00407ce0
mov dword [esp + 0x10], 0
lea ecx, [ecx]
lea edx, [esp + 0x30c]
mov dword [esp + 0x28], edx
mov dword [esp + 0x14], 0
jmp 0x40a8c0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + eax + 0x144]
mov eax, dword [esp + 0x10]
add ecx, 0x14
cmp eax, ecx
jg 0x40a940
mov edx, eax
mov eax, dword [esp + 0x14]
cmp edx, dword [esp + eax + 0xa0]
jle 0x40a940
mov edx, dword [esp + 0x28]
mov edi, dword [edx]
mov ecx, eax
mov eax, dword [esp + ecx + 0x268]
lea ecx, [esp + ecx + 0x268]
dec edi
inc eax
test edi, edi
mov dword [edx], edi
mov dword [esp + 0x20], ecx
mov dword [ecx], eax
jl 0x40a940
imul eax, eax, 0xd
cmp eax, 0x100
lea ecx, [edi + 1]
mov dword [edx + 8], ecx
jl 0x40a91d
or al, 0xff
jmp 0x40a929
mov edx, dword [esp + 0x20]
xor eax, eax
mov al, byte [edx]
mov cl, 0xd
imul cl
mov ecx, dword [ebp + 4]
mov edx, dword [esi]
push eax
mov eax, dword [esp + 0x2c]
push eax
push ecx
push 0
push edi
mov ecx, esi
call dword [edx + 0x88]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x28]
add eax, 4
add edx, 0x10
cmp eax, 0xa4
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], edx
jl 0x40a8c0
mov edx, dword [ebx]
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x76
mov dword [esp + 0x10], eax
jl 0x40a8a0
mov eax, dword [esp + 0x3c]
mov dword [ebp + 0x28], eax
jmp 0x40e299
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x3c], ecx
mov ecx, 0x29
mov eax, 1
lea edi, [esp + 0x268]
rep stosd dword es:[edi], eax
mov dword [ebp + 0x28], 0xa
lea edx, [esp + 0x30c]
mov dword [esp + 0x24], 0x13
mov edi, 0x258
xor ecx, ecx
jmp 0x40a9d0
mov eax, dword [esp + 0x24]
mov dword [edx], eax
add eax, 0x14
mov dword [edx + 4], ecx
mov dword [edx + 0xc], edi
add edx, 0x10
cmp eax, 0x347
mov dword [esp + 0x24], eax
jl 0x40a9d0
mov edi, 0x1c
mov edx, 0x22
mov ecx, 0x24
mov eax, 0x26
mov dword [esp + 0x144], 0x14
mov dword [esp + 0x148], 0x15
mov dword [esp + 0x14c], 0x16
mov dword [esp + 0x150], 0x17
mov dword [esp + 0x154], 0x18
mov dword [esp + 0x158], 0x19
mov dword [esp + 0x15c], 0x1a
mov dword [esp + 0x160], 0x1b
mov dword [esp + 0x164], edi
mov dword [esp + 0x168], 0x1d
mov dword [esp + 0x16c], 0x1e
mov dword [esp + 0x170], 0x1f
mov dword [esp + 0x174], 0x20
mov dword [esp + 0x178], 0x21
mov dword [esp + 0x17c], edx
mov dword [esp + 0x180], 0x23
mov dword [esp + 0x184], ecx
mov dword [esp + 0x188], 0x25
mov dword [esp + 0x18c], eax
mov dword [esp + 0x190], 0x27
mov dword [esp + 0x194], 0x28
mov dword [esp + 0x198], 0x29
mov dword [esp + 0x19c], 0x2a
mov dword [esp + 0x1a0], 0x2b
mov dword [esp + 0x1a4], 0x2c
mov dword [esp + 0x1a8], 0x2d
mov dword [esp + 0x1ac], 0x2e
mov dword [esp + 0x1b0], 0x2f
mov dword [esp + 0x1b4], 0x30
mov dword [esp + 0x1b8], 0x31
mov dword [esp + 0x1bc], 0x32
mov dword [esp + 0x1c0], 0x33
mov dword [esp + 0x1c4], 0x34
mov dword [esp + 0x1c8], 0x35
mov dword [esp + 0x1cc], 0x36
mov dword [esp + 0x1d0], 0x37
mov dword [esp + 0x1d4], 0x38
mov dword [esp + 0x1d8], 0x39
mov dword [esp + 0x1dc], 0x3a
mov dword [esp + 0x1e0], 0x3b
mov dword [esp + 0x1e4], 0x3c
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 1
mov dword [esp + 0xa8], 2
mov dword [esp + 0xac], 3
mov dword [esp + 0xb0], 4
mov dword [esp + 0xb4], 5
mov dword [esp + 0xb8], 6
mov dword [esp + 0xbc], 7
mov dword [esp + 0xc0], 8
mov dword [esp + 0xc4], 9
mov dword [esp + 0xc8], 0xa
mov dword [esp + 0xcc], 0xb
mov dword [esp + 0xd0], 0xc
mov dword [esp + 0xd4], 0xd
mov dword [esp + 0xd8], 0xe
mov dword [esp + 0xdc], 0xf
mov dword [esp + 0xe0], 0x10
mov dword [esp + 0xe4], 0x11
mov dword [esp + 0xe8], 0x12
mov dword [esp + 0xec], 0x13
mov dword [esp + 0xf0], 0x14
mov dword [esp + 0xf4], 0x15
mov dword [esp + 0xf8], 0x16
mov dword [esp + 0xfc], 0x17
mov dword [esp + 0x100], 0x18
mov dword [esp + 0x104], 0x19
mov dword [esp + 0x108], 0x1a
mov dword [esp + 0x10c], 0x1b
mov dword [esp + 0x110], edi
mov dword [esp + 0x114], 0x1d
mov dword [esp + 0x118], 0x1e
mov dword [esp + 0x11c], 0x1f
mov dword [esp + 0x120], 0x20
mov dword [esp + 0x124], 0x21
mov dword [esp + 0x128], edx
mov dword [esp + 0x12c], 0x23
mov dword [esp + 0x130], ecx
mov ecx, ebp
mov dword [esp + 0x134], 0x25
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], 0x27
mov dword [esp + 0x140], 0x28
call fcn.00407ce0
mov dword [esp + 0x10], 0
jmp 0x40ad80
xor eax, eax
lea edi, [esp + 0x30c]
mov dword [esp + 0x1c], eax
lea ecx, [ecx]
mov edx, dword [esp + eax + 0x144]
mov ecx, dword [esp + 0x10]
add edx, 0x14
cmp ecx, edx
jg 0x40ae02
cmp ecx, dword [esp + eax + 0xa0]
jle 0x40ae02
mov ecx, dword [edi]
lea edx, [esp + eax + 0x268]
mov eax, dword [edx]
dec ecx
inc eax
test ecx, ecx
mov dword [edi], ecx
mov dword [esp + 0x20], edx
mov dword [edx], eax
jl 0x40adfe
imul eax, eax, 0xd
cmp eax, 0x100
lea edx, [ecx + 1]
mov dword [edi + 8], edx
jl 0x40add8
or al, 0xff
jmp 0x40ade3
mov eax, dword [esp + 0x20]
movzx eax, byte [eax]
mov dl, 0xd
imul dl
mov edx, dword [esi]
push eax
mov eax, dword [ebp + 4]
push edi
push eax
push 0
push ecx
mov ecx, esi
call dword [edx + 0x88]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov eax, dword [esp + 0x1c]
add eax, 4
add edi, 0x10
cmp eax, 0xa4
mov dword [esp + 0x1c], eax
jl 0x40ad90
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x50
mov dword [esp + 0x10], eax
jl 0x40ad80
mov eax, dword [esp + 0x3c]
mov dword [ebp + 0x28], eax
jmp 0x40e299
push 0x500
call fcn.0043484f
mov edi, eax
add esp, 4
test edi, edi
mov dword [esp + 0x3c], edi
jne 0x40ae76
mov edx, dword [0x49e8c0]
push 0x30
mov ecx, 0x49e8c0
call dword [edx + 0xc]
push eax
push 0x47a4c0
push edi
call dword [0x47a18c]
push edi
call fcn.00434ab8
xor eax, eax
jmp 0x40ae80
mov dword [edi + eax*4], eax
inc eax
cmp eax, 0x140
jl 0x40ae80
mov dword [esp + 0x24], 0x3e8
call fcn.00434b02
cdq
mov ecx, 0x140
idiv ecx
mov dword [esp + 0x20], edx
call fcn.00434b02
cdq
mov ecx, 0x140
idiv ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [edi + eax*4]
mov dword [esp + 0x20], ecx
mov ecx, dword [edi + edx*4]
mov dword [edi + eax*4], ecx
mov eax, dword [esp + 0x20]
mov dword [edi + edx*4], eax
dec dword [esp + 0x24]
jne 0x40ae93
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x20], ecx
mov ecx, ebp
mov dword [ebp + 0x28], 0x1e
call fcn.00407ce0
mov dword [esp + 0x10], 0
mov edx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 0x24], eax
mov ecx, dword [edi + eax*4]
cmp edx, ecx
jg 0x40af4c
add edx, 0xa
cmp ecx, edx
jge 0x40af48
cdq
mov ecx, 0x14
idiv ecx
lea edi, [esp + 0x40]
push edi
mov edi, dword [ebp + 4]
push edi
lea ecx, [edx + edx*4]
shl ecx, 3
lea edx, [ecx + 0x28]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esp + 0x50], edx
lea edx, [eax + 0x28]
push eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x58], edx
mov edx, dword [esi]
push ecx
mov ecx, esi
mov dword [esp + 0x54], eax
call dword [edx + 0x60]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x3c]
mov edx, dword [esp + 0x10]
inc eax
cmp eax, 0x140
mov dword [esp + 0x24], eax
jl 0x40aef6
mov eax, edx
cdq
mov ecx, 0xa
idiv ecx
cmp edx, 9
jne 0x40af79
mov edx, dword [ebx]
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov edx, dword [esp + 0x10]
inc edx
cmp edx, 0x140
mov dword [esp + 0x10], edx
jl 0x40aef0
mov ecx, dword [esp + 0x20]
push edi
mov dword [ebp + 0x28], ecx
call fcn.0043484a
add esp, 4
jmp 0x40e299
cmp dword [0x49e960], 0x18
jne 0x40b59d
call dword [0x47a238]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x20]
push eax
mov eax, dword [esi + 0x18]
push eax
call dword [edx + 4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
lea eax, [ebp + 0xc]
push eax
mov eax, dword [esp + 0x5a8]
push esi
push eax
mov eax, dword [esp + 0x5ac]
push eax
call dword [edx + 0x60]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x84], eax
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [ebp + 4]
mov edx, dword [ecx]
mov dword [esp + 0x80], eax
call dword [edx + 0xc]
mov ecx, dword [esp + 0x80]
sub ecx, eax
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x84]
mov edx, ecx
sub edx, eax
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x80]
sub eax, ecx
mov edi, 0xfffffc19
mov dword [esp + 0x6c], edx
mov dword [esp + 0x70], eax
mov edi, edi
call dword [0x47a238]
sub eax, dword [esp + 0x20]
mov ecx, eax
imul ecx, ecx, 0x678
mov dword [esp + 0x88], eax
mov eax, 0x10624dd3
mul ecx
shr edx, 7
mov eax, edx
sub eax, edi
mov dword [esp + 0x1c], eax
xor ecx, ecx
mov eax, edx
mov dword [esp + 0x54], edx
neg edx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x1c]
test edx, edx
jle 0x40b0c5
mov edi, dword [esp + 0x84]
sub eax, edx
lea edx, [eax + ecx]
lea ecx, [edi + edx*4]
mov edx, dword [esp + 0x68]
sub edx, edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x24], edi
test eax, eax
jl 0x40b0b6
cmp eax, 0x320
jge 0x40b0b6
mov edi, dword [edx + ecx]
mov dword [ecx], edi
mov edi, dword [esp + 0x24]
add ecx, 4
inc eax
dec edi
mov dword [esp + 0x24], edi
jne 0x40b0a6
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x80]
add eax, edi
lea ecx, [ecx + eax*4 + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x84]
lea ecx, [ecx + eax*4 + 4]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x68]
lea ecx, [ecx + eax*4]
mov eax, 1
sub eax, edi
mov dword [esp + 0x24], eax
mov eax, 2
lea edx, [edi + 1]
sub eax, edi
mov dword [esp + 0x5c], 1
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], 0x20000
mov dword [esp + 0x34], 0x200
mov dword [esp + 0x64], ecx
mov dword [esp + 0x8c], eax
lea eax, [edx - 1]
test eax, eax
jl 0x40b21e
cmp eax, 0x320
jge 0x40b21e
mov eax, dword [esp + 0x3c]
mov eax, dword [eax + ecx]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x38]
lea edx, [eax + edx - 1]
mov eax, edx
mov edi, dword [ecx]
or eax, 0xffffff00
shl eax, 8
or eax, edx
shl eax, 8
or eax, edx
mov edx, eax
shr edx, 0x10
and edx, 0xff
mov dword [esp + 0x7c], edx
mov edx, eax
and eax, 0xff
shr edx, 8
and edx, 0xff
mov dword [esp + 0x14], eax
mov ebx, edi
and ebx, 0xff00
mov eax, 0xff
sub eax, edx
imul ebx, eax
mov eax, dword [esp + 0x18]
and eax, 0xff00
imul eax, edx
add ebx, eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x78], edi
and edi, 0xff0000
mov edx, 0xff
sub edx, eax
imul edi, edx
mov edx, dword [esp + 0x18]
and edx, 0xff0000
imul edx, eax
mov eax, dword [esp + 0x78]
add edi, edx
and ebx, 0xff0000
and edi, 0xff0000ff
or ebx, edi
mov edi, dword [esp + 0x14]
and eax, 0xff
mov edx, 0xff
sub edx, edi
imul eax, edx
mov edx, dword [esp + 0x18]
and edx, 0xff
imul edx, edi
add eax, edx
mov edx, dword [esp + 0x30]
or ebx, eax
mov eax, dword [esp + 0x6c]
shr ebx, 8
mov dword [eax + ecx], ebx
mov ebx, dword [esp + 0x58]
test edx, edx
jl 0x40b315
cmp edx, 0x320
jge 0x40b315
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x70]
mov edx, dword [edx + eax]
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x5c]
add eax, 0xffffff00
add edi, 0xffff0000
or eax, edi
or eax, ebx
or eax, 0xff000000
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov dword [esp + 0x18], edx
mov edx, dword [ecx + 4]
mov dword [esp + 0x7c], edi
mov edi, eax
and eax, 0xff
mov dword [esp + 0x14], eax
mov ebx, edx
shr edi, 8
and edi, 0xff
and ebx, 0xff00
mov eax, 0xff
sub eax, edi
imul ebx, eax
mov eax, dword [esp + 0x18]
and eax, 0xff00
imul eax, edi
add ebx, eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x78], edx
and edx, 0xff0000
mov edi, 0xff
sub edi, eax
imul edx, edi
mov edi, dword [esp + 0x18]
and edi, 0xff0000
imul edi, eax
mov eax, dword [esp + 0x78]
add edx, edi
mov edi, dword [esp + 0x14]
and edx, 0xff0000ff
and ebx, 0xff0000
or ebx, edx
and eax, 0xff
mov edx, 0xff
sub edx, edi
imul eax, edx
mov edx, dword [esp + 0x18]
and edx, 0xff
imul edx, edi
add eax, edx
mov edx, dword [esp + 0x30]
or ebx, eax
mov eax, dword [esp + 0x28]
shr ebx, 8
mov dword [eax], ebx
mov ebx, dword [esp + 0x58]
lea eax, [edx + 1]
test eax, eax
jl 0x40b3fb
cmp eax, 0x320
jge 0x40b3fb
mov eax, dword [esp + 0x10]
mov eax, dword [eax - 4]
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 8]
mov ecx, dword [esp + 0x24]
add edx, ecx
or edx, ebx
or edx, edi
or edx, 0xff000000
mov ecx, edx
mov edi, edx
and edx, 0xff
mov dword [esp + 0x14], edx
shr edi, 8
and edi, 0xff
mov ebx, eax
and ebx, 0xff00
mov edx, 0xff
sub edx, edi
imul ebx, edx
mov edx, dword [esp + 0x18]
and edx, 0xff00
imul edx, edi
add ebx, edx
shr ecx, 0x10
and ecx, 0xff
mov edx, eax
and edx, 0xff0000
mov edi, 0xff
sub edi, ecx
imul edx, edi
mov edi, dword [esp + 0x18]
and edi, 0xff0000
imul edi, ecx
add edx, edi
and edx, 0xff0000ff
and ebx, 0xff0000
or ebx, edx
mov edx, dword [esp + 0x14]
and eax, 0xff
mov ecx, 0xff
sub ecx, edx
imul eax, ecx
mov ecx, dword [esp + 0x18]
and ecx, 0xff
imul ecx, edx
mov edx, dword [esp + 0x28]
add eax, ecx
mov ecx, dword [esp + 0x64]
or ebx, eax
shr ebx, 8
mov dword [edx + 4], ebx
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x58]
lea eax, [edx + 2]
test eax, eax
jl 0x40b4ef
cmp eax, 0x320
jge 0x40b4ef
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [esp + 0x8c]
add edx, ecx
mov ecx, dword [esp + 0x34]
add ecx, 0x100
or edx, ecx
mov ecx, dword [esp + 0x2c]
add ecx, 0x10000
or edx, ecx
or edx, 0xff000000
mov ecx, edx
mov edi, edx
and edx, 0xff
mov dword [esp + 0x14], edx
shr edi, 8
and edi, 0xff
mov ebx, eax
and ebx, 0xff00
mov edx, 0xff
sub edx, edi
imul ebx, edx
mov edx, dword [esp + 0x18]
and edx, 0xff00
imul edx, edi
add ebx, edx
shr ecx, 0x10
and ecx, 0xff
mov edx, eax
and edx, 0xff0000
mov edi, 0xff
sub edi, ecx
imul edx, edi
mov edi, dword [esp + 0x18]
and edi, 0xff0000
imul edi, ecx
add edx, edi
and edx, 0xff0000ff
and ebx, 0xff0000
or ebx, edx
mov edx, dword [esp + 0x14]
and eax, 0xff
mov ecx, 0xff
sub ecx, edx
imul eax, ecx
mov ecx, dword [esp + 0x18]
and ecx, 0xff
imul ecx, edx
mov edx, dword [esp + 0x28]
add eax, ecx
mov ecx, dword [esp + 0x64]
or ebx, eax
shr ebx, 8
mov dword [edx + 8], ebx
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x58]
mov edi, dword [esp + 0x28]
mov eax, 0x10
add edi, eax
add ecx, eax
mov dword [esp + 0x28], edi
mov edi, dword [esp + 0x10]
add edi, eax
add dword [esp + 0x34], 0x400
mov eax, dword [esp + 0x5c]
add eax, 4
add edx, 4
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x2c]
add edi, 0x40000
lea eax, [eax + edx - 1]
cmp eax, 0x100
mov dword [esp + 0x64], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], edi
jl 0x40b130
mov ecx, dword [esp + 0x60]
mov eax, dword [esp + 0x38]
add ecx, 0x320
inc eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x50]
dec eax
cmp ecx, 0x75300
mov dword [esp + 0x60], ecx
mov dword [esp + 0x50], eax
jl 0x40b081
mov edx, dword [ebx]
mov edi, dword [esp + 0x54]
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call dword [edx + 0x28]
cmp dword [esp + 0x88], 0x7d0
jb 0x40b040
lea edi, [ebp + 0xc]
jmp 0x408194
call dword [0x47a238]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [esp + 0x88], eax
mov eax, dword [esi + 0x20]
push eax
mov eax, dword [esi + 0x18]
push eax
call dword [edx + 4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
lea eax, [ebp + 0xc]
push eax
mov eax, dword [esp + 0x5a8]
push esi
push eax
mov eax, dword [esp + 0x5ac]
push eax
call dword [edx + 0x60]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x50], eax
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [ebp + 4]
mov edx, dword [ecx]
mov edi, eax
mov dword [esp + 0x54], edi
call dword [edx + 0xc]
mov edx, dword [esp + 0x50]
mov ecx, edi
sub ecx, eax
mov dword [esp + 0x20], ecx
mov ecx, edx
sub ecx, eax
sub edi, edx
mov dword [esp + 0x78], eax
mov dword [esp + 0x68], 0xfffffc19
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x6c], edi
mov edi, edi
call dword [0x47a238]
sub eax, dword [esp + 0x88]
mov ecx, eax
imul ecx, ecx, 0x598
mov dword [esp + 0x80], eax
mov eax, 0x10624dd3
mul ecx
mov eax, dword [esp + 0x68]
shr edx, 7
mov ecx, edx
sub ecx, eax
xor edi, edi
mov eax, edx
mov dword [esp + 0x84], edx
mov dword [esp + 0x68], ecx
mov dword [esp + 0x64], edi
mov dword [esp + 0x14], eax
jmp 0x40b670
mov ecx, dword [esp + 0x68]
jmp 0x40b670
test ecx, ecx
jle 0x40b6b1
sub eax, ecx
lea edx, [eax + edi]
mov edi, dword [esp + 0x50]
lea ecx, [edi + edx*2]
mov edx, dword [esp + 0x78]
sub edx, edi
mov edi, dword [esp + 0x68]
mov dword [esp + 0x24], edi
mov edi, edi
test eax, eax
jl 0x40b6a2
cmp eax, 0x320
jge 0x40b6a2
mov di, word [edx + ecx]
mov word [ecx], di
mov edi, dword [esp + 0x24]
add ecx, 2
inc eax
dec edi
mov dword [esp + 0x24], edi
jne 0x40b690
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x64]
lea edx, [eax + 1]
add eax, edi
mov edi, dword [esp + 0x54]
lea edi, [edi + eax*2 + 6]
mov dword [esp + 0x38], edi
mov edi, dword [esp + 0x50]
lea edi, [edi + eax*2 + 2]
mov dword [esp + 0x28], edi
mov edi, dword [esp + 0x78]
lea eax, [edi + eax*2]
mov edi, dword [esp + 0x14]
sub edi, edx
mov dword [esp + 0x8c], edi
mov edi, dword [esp + 0x14]
sub edi, edx
add edi, 2
mov dword [esp + 0x70], edi
mov edi, dword [esp + 0x14]
xor ecx, ecx
sub edi, edx
add edi, 3
mov dword [esp + 0x24], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x7c], edi
mov edi, edi
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x8c]
inc edx
add edx, ecx
add edi, edx
test edi, edi
mov dword [esp + 0x60], edx
jl 0x40b827
cmp edi, 0x320
jge 0x40b827
mov di, word [eax]
mov edx, dword [esp + 0x20]
mov dx, word [edx + eax]
mov eax, ecx
or eax, 0xffe0
movzx edi, di
shl eax, 5
or eax, ecx
mov dword [esp + 0x18], edi
shl eax, 5
or eax, ecx
mov edi, eax
shr edi, 5
and edi, 0x1f
movzx edx, dx
movzx ecx, ax
mov dword [esp + 0x10], edx
and edx, 0x3e0
mov ebx, 0x1f
sub ebx, edi
mov edi, dword [esp + 0x18]
and edi, 0x3e0
imul ebx, edi
mov edi, ecx
shr edi, 5
and edi, 0x1f
imul edi, edx
add ebx, edi
mov edx, eax
shr edx, 0xa
and edx, 0x1f
mov edi, 0x1f
sub edi, edx
movzx edx, di
mov edi, dword [esp + 0x18]
mov dword [esp + 0x2c], ecx
shr ecx, 0xa
and edi, 0x7c00
imul edx, edi
mov edi, dword [esp + 0x10]
and ecx, 0x1f
and edi, 0x7c00
imul ecx, edi
add edx, ecx
sar edx, 5
and eax, 0x1f
and edx, 0x7c00
sar ebx, 5
and ebx, 0x3e0
or ebx, edx
mov ecx, 0x1f
sub ecx, eax
mov eax, dword [esp + 0x18]
movzx edx, cx
mov ecx, dword [esp + 0x2c]
and eax, 0x1f
imul edx, eax
mov eax, dword [esp + 0x10]
and ecx, 0x1f
and eax, 0x1f
imul eax, ecx
mov ecx, dword [esp + 0x3c]
add edx, eax
mov eax, dword [esp + 0x34]
sar edx, 5
or ebx, edx
mov edx, dword [esp + 0x60]
mov word [ecx + eax], bx
mov ebx, dword [esp + 0x58]
mov ecx, dword [esp + 0x24]
test edx, edx
jl 0x40b93c
cmp edx, 0x320
jge 0x40b93c
mov bx, word [eax + 2]
mov edx, dword [esp + 0x6c]
mov edi, dword [esp + 0x28]
mov di, word [edx + edi]
movzx edi, di
mov dword [esp + 0x10], edi
movzx edi, bx
mov dword [esp + 0x18], edi
lea eax, [ecx + 1]
shl eax, 0xa
lea edx, [ecx + 1]
shl edx, 5
or eax, edx
lea edx, [ecx + 1]
or eax, edx
or eax, 0x8000
mov edi, eax
movzx edx, ax
shr edi, 5
and edi, 0x1f
mov dword [esp + 0x2c], edx
shr edx, 5
and edx, 0x1f
mov ebx, 0x1f
sub ebx, edi
mov edi, dword [esp + 0x18]
and edi, 0x3e0
imul ebx, edi
mov edi, dword [esp + 0x10]
and edi, 0x3e0
imul edx, edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x30], eax
add ebx, edx
shr eax, 0xa
and eax, 0x1f
mov edx, 0x1f
sub edx, eax
movzx eax, dx
mov edx, dword [esp + 0x18]
and edx, 0x7c00
imul eax, edx
mov edx, dword [esp + 0x2c]
shr edx, 0xa
and edx, 0x1f
and edi, 0x7c00
imul edx, edi
add eax, edx
sar eax, 5
and eax, 0x7c00
sar ebx, 5
and ebx, 0x3e0
or ebx, eax
mov eax, dword [esp + 0x30]
and eax, 0x1f
mov edx, 0x1f
sub edx, eax
mov eax, dword [esp + 0x18]
and eax, 0x1f
movzx edi, dx
mov edx, dword [esp + 0x2c]
imul edi, eax
mov eax, dword [esp + 0x10]
and eax, 0x1f
and edx, 0x1f
imul eax, edx
mov edx, dword [esp + 0x60]
add edi, eax
mov eax, dword [esp + 0x28]
sar edi, 5
or ebx, edi
mov word [eax], bx
mov ebx, dword [esp + 0x58]
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x70]
add edi, edx
test edi, edi
jl 0x40ba59
cmp edi, 0x320
jge 0x40ba59
mov ax, word [eax + 4]
mov edx, dword [esp + 0x38]
mov di, word [edx - 2]
mov word [esp + 0x5c], ax
movzx edi, di
mov dword [esp + 0x10], edi
movzx edi, word [esp + 0x5c]
lea edx, [ecx + 2]
mov eax, edx
shl eax, 0xa
mov ebx, edx
shl ebx, 5
or eax, ebx
or eax, edx
or eax, 0x8000
mov dword [esp + 0x18], edi
mov edi, eax
movzx edx, ax
shr edi, 5
and edi, 0x1f
mov dword [esp + 0x2c], edx
shr edx, 5
and edx, 0x1f
mov ebx, 0x1f
sub ebx, edi
mov edi, dword [esp + 0x18]
and edi, 0x3e0
imul ebx, edi
mov edi, dword [esp + 0x10]
and edi, 0x3e0
imul edx, edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x30], eax
add ebx, edx
shr eax, 0xa
and eax, 0x1f
mov edx, 0x1f
sub edx, eax
movzx eax, dx
mov edx, dword [esp + 0x18]
and edx, 0x7c00
imul eax, edx
mov edx, dword [esp + 0x2c]
shr edx, 0xa
and edx, 0x1f
and edi, 0x7c00
imul edx, edi
add eax, edx
sar eax, 5
and eax, 0x7c00
sar ebx, 5
and ebx, 0x3e0
or ebx, eax
mov eax, dword [esp + 0x30]
and eax, 0x1f
mov edx, 0x1f
sub edx, eax
mov eax, dword [esp + 0x18]
and eax, 0x1f
movzx edi, dx
mov edx, dword [esp + 0x2c]
imul edi, eax
mov eax, dword [esp + 0x10]
and eax, 0x1f
and edx, 0x1f
imul eax, edx
mov edx, dword [esp + 0x60]
add edi, eax
mov eax, dword [esp + 0x28]
sar edi, 5
or ebx, edi
mov word [eax + 2], bx
mov ebx, dword [esp + 0x58]
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x7c]
add edx, edi
test edx, edx
jl 0x40bb71
cmp edx, 0x320
jge 0x40bb71
mov ax, word [eax + 6]
mov edx, dword [esp + 0x38]
mov di, word [edx]
mov word [esp + 0x5c], ax
movzx edi, di
mov dword [esp + 0x10], edi
movzx edi, word [esp + 0x5c]
lea edx, [ecx + 3]
mov eax, edx
shl eax, 0xa
mov ebx, edx
shl ebx, 5
or eax, ebx
or eax, edx
or eax, 0x8000
mov dword [esp + 0x18], edi
mov edi, eax
movzx edx, ax
shr edi, 5
and edi, 0x1f
mov dword [esp + 0x2c], edx
shr edx, 5
and edx, 0x1f
mov ebx, 0x1f
sub ebx, edi
mov edi, dword [esp + 0x18]
and edi, 0x3e0
imul ebx, edi
mov edi, dword [esp + 0x10]
and edi, 0x3e0
imul edx, edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x30], eax
add ebx, edx
shr eax, 0xa
and eax, 0x1f
mov edx, 0x1f
sub edx, eax
movzx eax, dx
mov edx, dword [esp + 0x18]
and edx, 0x7c00
imul eax, edx
mov edx, dword [esp + 0x2c]
shr edx, 0xa
and edx, 0x1f
and edi, 0x7c00
imul edx, edi
add eax, edx
sar eax, 5
and eax, 0x7c00
sar ebx, 5
and ebx, 0x3e0
or ebx, eax
mov eax, dword [esp + 0x30]
and eax, 0x1f
mov edx, 0x1f
sub edx, eax
mov eax, dword [esp + 0x18]
and eax, 0x1f
movzx edi, dx
mov edx, dword [esp + 0x2c]
imul edi, eax
mov eax, dword [esp + 0x10]
and eax, 0x1f
and edx, 0x1f
imul eax, edx
add edi, eax
mov eax, dword [esp + 0x28]
sar edi, 5
or ebx, edi
mov word [eax + 4], bx
mov ebx, dword [esp + 0x58]
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x28]
mov edx, 8
add edi, edx
mov dword [esp + 0x28], edi
mov edi, dword [esp + 0x38]
add ecx, 4
add eax, edx
add edi, edx
cmp ecx, 0x20
mov dword [esp + 0x24], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], edi
jl 0x40b710
mov edi, dword [esp + 0x64]
mov eax, dword [esp + 0x14]
add edi, 0x320
dec eax
cmp edi, 0x75300
mov dword [esp + 0x64], edi
mov dword [esp + 0x14], eax
jl 0x40b667
mov ecx, dword [esp + 0x84]
mov edx, dword [ebx]
mov dword [esp + 0x68], ecx
lea edi, [ebp + 0xc]
push edi
mov ecx, ebx
call dword [edx + 0x28]
cmp dword [esp + 0x80], 0x7d0
jb 0x40b620
jmp 0x408194
mov eax, dword [0x49e960]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
cmp eax, 0x18
mov eax, dword [esi + 0x20]
push eax
mov eax, dword [esi + 0x18]
push eax
jne 0x40c39e
call dword [edx + 4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
lea eax, [ebp + 0xc]
push eax
mov eax, dword [esp + 0x5a8]
push esi
push eax
mov eax, dword [esp + 0x5ac]
push eax
call dword [edx + 0x60]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x60], eax
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [ebp + 4]
mov edx, dword [ecx]
mov dword [esp + 0x50], eax
call dword [edx + 0xc]
mov edi, eax
xor eax, eax
mov ecx, ebp
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], 0x320
mov dword [esp + 0x4c], 0x100
mov dword [ebp + 0x28], 0x1e
call fcn.00407ce0
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x60]
add ecx, 0xfff3800c
lea eax, [edi - 0xc8000]
add edx, 0xfff38004
mov dword [esp + 0x38], 0xffffff00
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], edx
jmp 0x40bcb0
mov eax, dword [esp + 0x38]
lea ecx, [eax + 0x100]
cmp ecx, 0x258
mov dword [esp + 0x6c], ecx
jl 0x40bccf
mov ecx, 0x258
mov dword [esp + 0x6c], ecx
cmp eax, ecx
mov dword [esp + 0x1c], eax
jge 0x40c339
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x78], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x64], edx
mov edx, dword [esp + 0x80]
xor ecx, ecx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x5c], edx
nop
test eax, eax
jl 0x40c305
cmp eax, 0x258
jge 0x40c305
mov ebp, dword [esp + 0x50]
mov eax, ecx
or eax, 0xffffff00
shl eax, 8
or eax, ecx
shl eax, 8
or eax, ecx
mov edx, eax
sub ebp, edi
shr edx, 8
mov ecx, eax
and edx, 0xff
mov dword [esp + 0x88], ebp
mov ebp, dword [esp + 0x60]
mov esi, 0xff
sub esi, edx
and eax, 0xff
sub ebp, edi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x34], esi
shr ecx, 0x10
and ecx, 0xff
mov esi, 0xff
sub esi, eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x5c]
mov ebx, 0xff
mov dword [esp + 0x8c], ebp
mov ebp, dword [esp + 0x60]
sub ebx, ecx
sub edi, ebp
mov dword [esp + 0x30], esi
mov esi, dword [esp + 0x64]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x68], 0x50
jmp 0x40bdb0
mov ebx, dword [esp + 0x2c]
lea ebx, [ebx]
mov edi, dword [esp + 0x88]
mov edi, dword [edi + eax]
mov dword [esp + 0x10], edi
mov edi, dword [eax]
mov ebp, edi
and ebp, 0xff0000
imul ebp, ebx
mov ebx, dword [esp + 0x10]
and ebx, 0xff0000
imul ebx, ecx
add ebp, ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x18], edi
and edi, 0xff00
imul edi, dword [esp + 0x34]
and ebx, 0xff00
imul ebx, edx
add edi, ebx
and edi, 0xff0000
and ebp, 0xff0000ff
or ebp, edi
mov edi, dword [esp + 0x18]
and edi, 0xff
imul edi, dword [esp + 0x30]
mov dword [esp + 0x54], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x54]
and edi, 0xff
imul edi, dword [esp + 0x28]
add ebx, edi
mov edi, dword [esp + 0x8c]
or ebp, ebx
shr ebp, 8
mov dword [edi + eax], ebp
mov edi, dword [esp + 0x20]
mov ebx, dword [edi + esi]
mov edi, dword [eax + 4]
mov ebp, edi
mov dword [esp + 0x10], ebx
and ebp, 0xff0000
imul ebp, dword [esp + 0x2c]
and ebx, 0xff0000
imul ebx, ecx
add ebp, ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x18], edi
and edi, 0xff00
imul edi, dword [esp + 0x34]
and ebx, 0xff00
imul ebx, edx
add edi, ebx
and edi, 0xff0000
and ebp, 0xff0000ff
or ebp, edi
mov edi, dword [esp + 0x18]
and edi, 0xff
imul edi, dword [esp + 0x30]
mov dword [esp + 0x54], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x54]
and edi, 0xff
imul edi, dword [esp + 0x28]
add ebx, edi
mov edi, dword [esp + 0x14]
or ebp, ebx
shr ebp, 8
mov dword [esi], ebp
mov ebx, dword [edi - 4]
mov edi, dword [eax + 8]
mov ebp, edi
mov dword [esp + 0x10], ebx
and ebp, 0xff0000
imul ebp, dword [esp + 0x2c]
and ebx, 0xff0000
imul ebx, ecx
add ebp, ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x18], edi
and edi, 0xff00
and ebp, 0xff0000ff
imul edi, dword [esp + 0x34]
and ebx, 0xff00
imul ebx, edx
add edi, ebx
and edi, 0xff0000
or ebp, edi
mov edi, dword [esp + 0x18]
and edi, 0xff
imul edi, dword [esp + 0x30]
mov dword [esp + 0x54], edi
mov edi, dword [esp + 0x10]
and edi, 0xff
imul edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x54]
add ebx, edi
or ebp, ebx
mov edi, dword [esp + 0x14]
shr ebp, 8
mov dword [esi + 4], ebp
mov ebx, dword [edi]
mov edi, dword [eax + 0xc]
mov ebp, edi
mov dword [esp + 0x10], ebx
and ebx, 0xff0000
and ebp, 0xff0000
imul ebx, ecx
imul ebp, dword [esp + 0x2c]
add ebp, ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x18], edi
and edi, 0xff00
imul edi, dword [esp + 0x34]
and ebx, 0xff00
imul ebx, edx
add edi, ebx
and edi, 0xff0000
and ebp, 0xff0000ff
or ebp, edi
mov edi, dword [esp + 0x18]
and edi, 0xff
imul edi, dword [esp + 0x30]
mov dword [esp + 0x54], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x54]
and edi, 0xff
imul edi, dword [esp + 0x28]
add ebx, edi
mov edi, dword [esp + 0x14]
or ebp, ebx
shr ebp, 8
mov dword [esi + 8], ebp
mov ebx, dword [edi + 4]
mov edi, dword [eax + 0x10]
mov ebp, edi
mov dword [esp + 0x10], ebx
and ebx, 0xff0000
and ebp, 0xff0000
imul ebx, ecx
imul ebp, dword [esp + 0x2c]
add ebp, ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x18], edi
and edi, 0xff00
imul edi, dword [esp + 0x34]
and ebx, 0xff00
imul ebx, edx
add edi, ebx
and edi, 0xff0000
and ebp, 0xff0000ff
or ebp, edi
mov edi, dword [esp + 0x18]
and edi, 0xff
imul edi, dword [esp + 0x30]
mov dword [esp + 0x54], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x54]
and edi, 0xff
imul edi, dword [esp + 0x28]
add ebx, edi
or ebp, ebx
shr ebp, 8
mov dword [esi + 0xc], ebp
mov edi, dword [esp + 0x14]
mov ebx, dword [edi + 8]
mov edi, dword [eax + 0x14]
mov ebp, edi
mov dword [esp + 0x10], ebx
and ebp, 0xff0000
imul ebp, dword [esp + 0x2c]
and ebx, 0xff0000
imul ebx, ecx
add ebp, ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x18], edi
and edi, 0xff00
imul edi, dword [esp + 0x34]
and ebx, 0xff00
imul ebx, edx
add edi, ebx
and edi, 0xff0000
and ebp, 0xff0000ff
or ebp, edi
mov edi, dword [esp + 0x18]
and edi, 0xff
imul edi, dword [esp + 0x30]
mov dword [esp + 0x54], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x54]
and edi, 0xff
imul edi, dword [esp + 0x28]
add ebx, edi
mov edi, dword [esp + 0x14]
or ebp, ebx
shr ebp, 8
mov dword [esi + 0x10], ebp
mov ebx, dword [edi + 0xc]
mov edi, dword [eax + 0x18]
mov ebp, edi
mov dword [esp + 0x10], ebx
and ebp, 0xff0000
imul ebp, dword [esp + 0x2c]
and ebx, 0xff0000
imul ebx, ecx
add ebp, ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x18], edi
and edi, 0xff00
imul edi, dword [esp + 0x34]
and ebx, 0xff00
imul ebx, edx
add edi, ebx
and edi, 0xff0000
and ebp, 0xff0000ff
or ebp, edi
mov edi, dword [esp + 0x18]
and edi, 0xff
imul edi, dword [esp + 0x30]
mov dword [esp + 0x54], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x54]
and edi, 0xff
imul edi, dword [esp + 0x28]
add ebx, edi
mov edi, dword [esp + 0x14]
or ebp, ebx
shr ebp, 8
mov dword [esi + 0x14], ebp
mov ebx, dword [edi + 0x10]
mov edi, dword [eax + 0x1c]
mov dword [esp + 0x10], ebx
mov ebp, edi
and ebp, 0xff0000
imul ebp, dword [esp + 0x2c]
and ebx, 0xff0000
imul ebx, ecx
add ebp, ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x18], edi
and edi, 0xff00
imul edi, dword [esp + 0x34]
and ebx, 0xff00
and ebp, 0xff0000ff
imul ebx, edx
add edi, ebx
and edi, 0xff0000
or ebp, edi
mov edi, dword [esp + 0x18]
and edi, 0xff
imul edi, dword [esp + 0x30]
mov dword [esp + 0x54], edi
mov edi, dword [esp + 0x10]
and edi, 0xff
imul edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x54]
add ebx, edi
or ebp, ebx
mov edi, dword [esp + 0x14]
shr ebp, 8
mov dword [esi + 0x18], ebp
mov ebx, dword [edi + 0x14]
mov edi, dword [eax + 0x20]
mov ebp, edi
mov dword [esp + 0x10], ebx
and ebp, 0xff0000
imul ebp, dword [esp + 0x2c]
and ebx, 0xff0000
imul ebx, ecx
add ebp, ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x18], edi
and edi, 0xff00
imul edi, dword [esp + 0x34]
and ebx, 0xff00
imul ebx, edx
add edi, ebx
and edi, 0xff0000
and ebp, 0xff0000ff
or ebp, edi
mov edi, dword [esp + 0x18]
and edi, 0xff
imul edi, dword [esp + 0x30]
mov dword [esp + 0x54], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x54]
and edi, 0xff
imul edi, dword [esp + 0x28]
add ebx, edi
mov edi, dword [esp + 0x14]
or ebp, ebx
shr ebp, 8
mov dword [esi + 0x1c], ebp
mov ebx, dword [edi + 0x18]
mov edi, dword [eax + 0x24]
mov ebp, edi
mov dword [esp + 0x10], ebx
and ebp, 0xff0000
imul ebp, dword [esp + 0x2c]
and ebx, 0xff0000
imul ebx, ecx
add ebp, ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x18], edi
and edi, 0xff00
imul edi, dword [esp + 0x34]
and ebx, 0xff00
imul ebx, edx
add edi, ebx
and edi, 0xff0000
and ebp, 0xff0000ff
or ebp, edi
mov edi, dword [esp + 0x18]
and edi, 0xff
imul edi, dword [esp + 0x30]
mov dword [esp + 0x54], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x54]
and edi, 0xff
imul edi, dword [esp + 0x28]
add ebx, edi
or ebp, ebx
shr ebp, 8
mov dword [esi + 0x20], ebp
add eax, 0x28
add esi, 0x28
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x68]
add ebx, 0x28
dec edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x68], edi
jne 0x40bda6
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x3c]
mov esi, dword [esp + 0x74]
mov ebx, dword [esp + 0x58]
mov ebp, dword [esp + 0x24]
add dword [esp + 0x5c], 0xc80
add dword [esp + 0x64], 0xc80
mov edx, dword [esp + 0x78]
add edx, 0xc80
inc eax
mov dword [esp + 0x78], edx
mov edx, dword [esp + 0x6c]
inc ecx
cmp eax, edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x70], ecx
jl 0x40bd00
mov edx, dword [ebx]
lea eax, [esp + 0x40]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x44], eax
add eax, 0x100
mov ecx, ebp
mov dword [esp + 0x4c], eax
call fcn.00407d00
mov edx, dword [esp + 0x7c]
mov eax, dword [esp + 0x38]
mov ecx, 0x6400
add edx, ecx
mov dword [esp + 0x7c], edx
add dword [esp + 0x84], ecx
mov edx, dword [esp + 0x80]
add eax, 8
add edx, ecx
cmp eax, 0x258
mov dword [esp + 0x38], eax
mov dword [esp + 0x80], edx
jl 0x40bcb0
jmp 0x40d994
call dword [edx + 4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
lea eax, [ebp + 0xc]
push eax
mov eax, dword [esp + 0x5a8]
push esi
push eax
mov eax, dword [esp + 0x5ac]
push eax
call dword [edx + 0x60]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x60], eax
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [ebp + 4]
mov edx, dword [ecx]
mov dword [esp + 0x50], eax
call dword [edx + 0xc]
mov dword [esp + 0x6c], eax
xor eax, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], 0x320
mov dword [esp + 0x4c], 0x20
call dword [0x47a238]
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x60]
add eax, 0xffff3800
add ecx, 0xffff3806
mov edi, 0xffffffe0
add edx, 0xffff3802
mov dword [esp + 0x20], edi
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], edx
lea esp, [esp]
lea eax, [edi + 0x20]
cmp eax, 0x258
mov ecx, eax
mov dword [esp + 0x3c], ecx
jl 0x40c459
mov ecx, 0x258
mov dword [esp + 0x3c], ecx
cmp edi, ecx
mov eax, edi
mov dword [esp + 0x68], eax
jge 0x40c7ae
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x78], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x64], edx
mov edx, dword [esp + 0x80]
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x5c], edx
jmp 0x40c490
test eax, eax
jl 0x40c77a
cmp eax, 0x258
jge 0x40c77a
mov eax, ecx
or eax, 0xffe0
shl eax, 5
or eax, ecx
shl eax, 5
or eax, ecx
movzx eax, ax
mov edx, eax
shr edx, 0xa
mov edi, eax
and eax, 0x1f
and edx, 0x1f
mov ecx, 0x1f
sub ecx, edx
mov ebp, 0x1f
sub ebp, eax
mov dword [esp + 0x34], edx
movzx edx, cx
movzx ecx, bp
mov ebp, dword [esp + 0x6c]
shr edi, 5
and edi, 0x1f
mov ebx, 0x1f
sub ebx, edi
mov dword [esp + 0x18], eax
movzx eax, bx
mov ebx, dword [esp + 0x60]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x64]
sub ebx, ebp
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x5c]
sub ecx, ebp
mov ebp, dword [esp + 0x60]
mov dword [esp + 0x88], ebx
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x78]
sub ebx, ebp
mov dword [esp + 0x30], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x74], ecx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x70], 0xc8
jmp 0x40c550
mov ecx, dword [esp + 0x74]
mov edi, dword [esp + 0x30]
nop
mov cx, word [ecx + eax]
movzx eax, word [eax]
movzx ecx, cx
mov ebx, eax
and ebx, 0x3e0
imul ebx, dword [esp + 0x38]
mov ebp, ecx
and ebp, 0x3e0
imul ebp, edi
add ebx, ebp
mov ebp, eax
mov edi, ecx
and edi, 0x7c00
imul edi, dword [esp + 0x34]
and eax, 0x1f
imul eax, dword [esp + 0x2c]
and ecx, 0x1f
imul ecx, dword [esp + 0x18]
and ebp, 0x7c00
imul ebp, edx
add edi, ebp
add eax, ecx
mov ecx, dword [esp + 0x88]
sar ebx, 5
sar edi, 5
and edi, 0x7c00
and ebx, 0x3e0
or ebx, edi
mov edi, dword [esp + 0x28]
sar eax, 5
or ebx, eax
mov eax, dword [esp + 0x14]
mov word [ecx + eax], bx
movzx eax, word [eax + 2]
mov ecx, dword [esp + 0x54]
mov cx, word [ecx + edi]
movzx ecx, cx
mov edi, eax
and edi, 0x3e0
imul edi, dword [esp + 0x38]
mov ebx, ecx
and ebx, 0x3e0
imul ebx, dword [esp + 0x30]
add edi, ebx
mov ebp, eax
mov ebx, ecx
and ebx, 0x7c00
imul ebx, dword [esp + 0x34]
and eax, 0x1f
imul eax, dword [esp + 0x2c]
and ebp, 0x7c00
and ecx, 0x1f
imul ebp, edx
imul ecx, dword [esp + 0x18]
sar edi, 5
add ebx, ebp
and edi, 0x3e0
sar ebx, 5
add eax, ecx
mov ecx, dword [esp + 0x10]
and ebx, 0x7c00
or edi, ebx
sar eax, 5
or edi, eax
mov eax, dword [esp + 0x28]
mov word [eax], di
mov cx, word [ecx - 2]
mov eax, dword [esp + 0x14]
movzx eax, word [eax + 4]
movzx ecx, cx
mov edi, eax
and edi, 0x3e0
imul edi, dword [esp + 0x38]
mov ebx, ecx
and ebx, 0x3e0
imul ebx, dword [esp + 0x30]
add edi, ebx
sar edi, 5
mov ebx, ecx
and edi, 0x3e0
and ebx, 0x7c00
imul ebx, dword [esp + 0x34]
mov ebp, eax
and eax, 0x1f
imul eax, dword [esp + 0x2c]
and ecx, 0x1f
imul ecx, dword [esp + 0x18]
and ebp, 0x7c00
imul ebp, edx
add ebx, ebp
add eax, ecx
mov ecx, dword [esp + 0x28]
sar ebx, 5
and ebx, 0x7c00
or edi, ebx
sar eax, 5
or edi, eax
mov eax, dword [esp + 0x10]
mov word [ecx + 2], di
mov cx, word [eax]
mov eax, dword [esp + 0x14]
movzx eax, word [eax + 6]
movzx ecx, cx
mov edi, eax
and edi, 0x3e0
imul edi, dword [esp + 0x38]
mov ebx, ecx
and ebx, 0x3e0
imul ebx, dword [esp + 0x30]
add edi, ebx
mov ebx, ecx
mov ebp, eax
and ebx, 0x7c00
imul ebx, dword [esp + 0x34]
and ebp, 0x7c00
and eax, 0x1f
imul ebp, edx
imul eax, dword [esp + 0x2c]
and ecx, 0x1f
imul ecx, dword [esp + 0x18]
sar edi, 5
add ebx, ebp
add eax, ecx
mov ecx, dword [esp + 0x28]
and edi, 0x3e0
sar ebx, 5
and ebx, 0x7c00
or edi, ebx
sar eax, 5
or edi, eax
mov eax, dword [esp + 0x14]
mov word [ecx + 4], di
mov edi, dword [esp + 0x10]
add ecx, 8
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x70]
add eax, 8
add edi, 8
dec ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x70], ecx
jne 0x40c547
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x58]
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
add dword [esp + 0x5c], 0x640
add dword [esp + 0x64], 0x640
mov edx, dword [esp + 0x78]
add edx, 0x640
inc eax
mov dword [esp + 0x78], edx
mov edx, dword [esp + 0x3c]
inc ecx
cmp eax, edx
mov dword [esp + 0x68], eax
mov dword [esp + 0x1c], ecx
jl 0x40c490
mov edx, dword [ebx]
lea eax, [esp + 0x40]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x84]
lea eax, [edi + 0x20]
mov dword [esp + 0x4c], eax
mov eax, 0x640
add ecx, eax
mov dword [esp + 0x7c], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x44], edi
inc edi
add edx, eax
add ecx, eax
cmp edi, 0x258
mov dword [esp + 0x20], edi
mov dword [esp + 0x84], edx
mov dword [esp + 0x80], ecx
jl 0x40c440
jmp 0x40d994
mov eax, dword [0x49e960]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
cmp eax, 0x18
mov eax, dword [esi + 0x20]
push eax
mov eax, dword [esi + 0x18]
push eax
jne 0x40cc9a
call dword [edx + 4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
lea eax, [ebp + 0xc]
push eax
mov eax, dword [esp + 0x5a8]
push esi
push eax
mov eax, dword [esp + 0x5ac]
push eax
call dword [edx + 0x60]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x60], eax
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [ebp + 4]
mov edx, dword [ecx]
mov dword [esp + 0x50], eax
call dword [edx + 0xc]
mov dword [esp + 0x20], eax
xor eax, eax
mov ecx, ebp
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], 0x100
mov dword [esp + 0x4c], 0x258
mov dword [ebp + 0x28], 0x1e
call fcn.00407ce0
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x20]
add eax, 0xfffffc00
add ecx, 0x1500
mov edi, 0xffffff00
add edx, 0x880
mov dword [esp + 0x68], edi
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], edx
jmp 0x40c8d0
lea ecx, [edi + 0x100]
cmp edi, ecx
mov eax, edi
mov dword [esp + 0x6c], eax
jge 0x40cc32
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x5c], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x78], edx
mov edx, dword [esp + 0x80]
xor ecx, ecx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x64], edx
test eax, eax
jl 0x40cc05
cmp eax, 0x320
jge 0x40cc05
mov eax, ecx
or eax, 0xffffff00
shl eax, 8
or eax, ecx
shl eax, 8
or eax, ecx
mov edx, eax
shr edx, 0x10
and edx, 0xff
mov ecx, 0xff
sub ecx, edx
mov dword [esp + 0x2c], ecx
mov ecx, eax
and eax, 0xff
mov dword [esp + 0x10], eax
mov ebx, 0xff
sub ebx, eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x20]
sub eax, ebx
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x60]
sub eax, ebx
mov ebx, dword [esp + 0x60]
shr ecx, 8
and ecx, 0xff
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x50]
mov edi, 0xff
sub edi, ecx
sub eax, ebx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x54], eax
mov dword [esp + 0x3c], 0x96
jmp 0x40c9c3
mov edi, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov eax, dword [eax - 0xc80]
mov ebx, eax
and ebx, 0xff00
imul ebx, edi
mov edi, dword [esp + 0x14]
and edi, 0xff00
imul edi, ecx
add ebx, edi
mov edi, dword [esp + 0x14]
and edi, 0xff0000
mov ecx, eax
imul edi, edx
and ecx, 0xff0000
imul ecx, dword [esp + 0x2c]
add ecx, edi
and ebx, 0xff0000
and ecx, 0xff0000ff
or ebx, ecx
mov ecx, dword [esp + 0x14]
and ecx, 0xff
imul ecx, dword [esp + 0x10]
and eax, 0xff
imul eax, dword [esp + 0x18]
add eax, ecx
mov ecx, dword [esp + 0x74]
or ebx, eax
mov eax, dword [esp + 0x30]
shr ebx, 8
mov dword [eax - 0x1900], ebx
mov eax, dword [esp + 0x28]
mov ecx, dword [ecx + eax]
mov eax, dword [eax]
mov ebx, ecx
and ebx, 0xff00
imul ebx, dword [esp + 0x34]
mov edi, eax
and edi, 0xff00
imul edi, dword [esp + 0x38]
add edi, ebx
mov dword [esp + 0x14], ecx
mov ebx, eax
and ebx, 0xff0000
imul ebx, dword [esp + 0x2c]
and ecx, 0xff0000
imul ecx, edx
add ebx, ecx
mov ecx, dword [esp + 0x14]
and eax, 0xff
imul eax, dword [esp + 0x18]
and ecx, 0xff
imul ecx, dword [esp + 0x10]
and edi, 0xff0000
and ebx, 0xff0000ff
or edi, ebx
add eax, ecx
mov ecx, dword [esp + 0x88]
or edi, eax
mov eax, dword [esp + 0x28]
shr edi, 8
mov dword [ecx + eax], edi
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x54]
mov ecx, dword [ecx + edi]
mov eax, dword [eax + 0xc80]
mov ebx, ecx
and ebx, 0xff00
imul ebx, dword [esp + 0x34]
mov edi, eax
and edi, 0xff00
imul edi, dword [esp + 0x38]
add edi, ebx
mov ebx, eax
and ebx, 0xff0000
imul ebx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
and edi, 0xff0000
and ecx, 0xff0000
imul ecx, edx
add ebx, ecx
mov ecx, dword [esp + 0x14]
and eax, 0xff
imul eax, dword [esp + 0x18]
and ecx, 0xff
imul ecx, dword [esp + 0x10]
add eax, ecx
mov ecx, dword [esp + 0x1c]
and ebx, 0xff0000ff
or edi, ebx
or edi, eax
mov eax, dword [esp + 0x30]
shr edi, 8
mov dword [eax], edi
mov ecx, dword [ecx + 0x2580]
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 0x1900]
mov edi, eax
and edi, 0xff00
imul edi, dword [esp + 0x38]
mov ebx, ecx
and ebx, 0xff00
imul ebx, dword [esp + 0x34]
add edi, ebx
mov ebx, eax
mov dword [esp + 0x14], ecx
and ebx, 0xff0000
imul ebx, dword [esp + 0x2c]
and ecx, 0xff0000
imul ecx, edx
add ebx, ecx
mov ecx, dword [esp + 0x14]
and eax, 0xff
imul eax, dword [esp + 0x18]
and ecx, 0xff
imul ecx, dword [esp + 0x10]
and edi, 0xff0000
and ebx, 0xff0000ff
or edi, ebx
mov ebx, dword [esp + 0x28]
add eax, ecx
or edi, eax
mov eax, dword [esp + 0x30]
shr edi, 8
mov dword [eax + 0xc80], edi
mov edi, dword [esp + 0x1c]
mov ecx, 0x3200
add eax, ecx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x3c]
add edi, ecx
add ebx, ecx
dec eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x3c], eax
jne 0x40c9bb
mov edi, dword [esp + 0x68]
mov eax, dword [esp + 0x6c]
mov ebx, dword [esp + 0x58]
mov ecx, dword [esp + 0x70]
add dword [esp + 0x5c], 4
add dword [esp + 0x64], 4
mov edx, dword [esp + 0x78]
add edx, 4
inc eax
mov dword [esp + 0x78], edx
inc ecx
lea edx, [edi + 0x100]
cmp eax, edx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ecx
jl 0x40c908
mov edx, dword [ebx]
lea eax, [esp + 0x40]
push eax
mov ecx, ebx
call dword [edx + 0x28]
lea eax, [edi + 0x100]
mov ecx, ebp
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], eax
call fcn.00407d00
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x84]
mov eax, 0x40
add ecx, eax
mov dword [esp + 0x7c], ecx
mov ecx, dword [esp + 0x80]
add edi, 0x10
add edx, eax
add ecx, eax
cmp edi, 0x320
mov dword [esp + 0x68], edi
mov dword [esp + 0x84], edx
mov dword [esp + 0x80], ecx
jl 0x40c8d0
jmp 0x40d994
call dword [edx + 4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
lea eax, [ebp + 0xc]
push eax
mov eax, dword [esp + 0x5a8]
push esi
push eax
mov eax, dword [esp + 0x5ac]
push eax
call dword [edx + 0x60]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x6c], eax
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [ebp + 4]
mov edx, dword [ecx]
mov dword [esp + 0x20], eax
call dword [edx + 0xc]
mov dword [esp + 0x3c], eax
xor eax, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], 0x20
mov dword [esp + 0x4c], 0x258
call dword [0x47a238]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x3c]
add eax, 0xffffffc0
add ecx, 0xc40
mov edi, 0xffffffe0
add edx, 0x600
mov dword [esp + 0x80], edi
mov dword [esp + 0x64], eax
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x78], edx
lea ecx, [edi + 0x20]
cmp edi, ecx
mov eax, edi
mov dword [esp + 0x68], eax
jge 0x40d0a9
mov edx, dword [esp + 0x64]
mov dword [esp + 0x50], edx
mov edx, dword [esp + 0x78]
mov dword [esp + 0x5c], edx
mov edx, dword [esp + 0x7c]
xor ecx, ecx
mov dword [esp + 0x84], ecx
mov dword [esp + 0x60], edx
test eax, eax
jl 0x40d07c
cmp eax, 0x320
jge 0x40d07c
mov eax, ecx
or eax, 0xffe0
shl eax, 5
or eax, ecx
shl eax, 5
or eax, ecx
mov ecx, eax
shr ecx, 0xa
and ecx, 0x1f
mov edx, 0x1f
sub edx, ecx
movzx ecx, dx
mov edx, eax
mov ebp, dword [esp + 0x3c]
mov dword [esp + 0x38], ecx
movzx ecx, ax
shr edx, 5
and edx, 0x1f
mov ebx, 0x1f
sub ebx, edx
movzx edx, bx
mov ebx, ecx
shr ebx, 5
and eax, 0x1f
and ebx, 0x1f
mov dword [esp + 0x30], ebx
mov ebx, 0x1f
sub ebx, eax
mov edi, ecx
movzx eax, bx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x60]
and ecx, 0x1f
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x5c]
mov eax, ebx
sub eax, ebp
mov dword [esp + 0x74], eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x6c]
mov eax, ecx
sub eax, ebp
shr edi, 0xa
mov dword [esp + 0x88], eax
and edi, 0x1f
mov eax, ebx
sub eax, ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x54], eax
mov dword [esp + 0x70], 0x96
jmp 0x40ce30
mov edi, dword [esp + 0x1c]
mov edi, edi
mov eax, dword [esp + 0x18]
mov ax, word [eax]
mov ecx, dword [esp + 0x14]
movzx ecx, word [ecx - 0x640]
movzx eax, ax
mov ebx, eax
and ebx, 0x7c00
imul ebx, edi
mov edi, ecx
and edi, 0x7c00
imul edi, dword [esp + 0x38]
add ebx, edi
mov edi, eax
and edi, 0x3e0
imul edi, dword [esp + 0x30]
mov ebp, ecx
and eax, 0x1f
imul eax, dword [esp + 0x34]
and ebp, 0x3e0
and ecx, 0x1f
imul ebp, edx
imul ecx, dword [esp + 0x2c]
add edi, ebp
sar edi, 5
sar ebx, 5
and edi, 0x3e0
add eax, ecx
mov ecx, dword [esp + 0x74]
and ebx, 0x7c00
or ebx, edi
sar eax, 5
or ebx, eax
mov eax, dword [esp + 0x28]
mov word [eax - 0xc80], bx
mov eax, dword [esp + 0x14]
mov di, word [ecx + eax]
movzx ecx, word [eax]
movzx eax, di
mov edi, eax
and edi, 0x7c00
imul edi, dword [esp + 0x1c]
mov ebx, ecx
and ebx, 0x7c00
imul ebx, dword [esp + 0x38]
add edi, ebx
mov ebx, eax
and ebx, 0x3e0
imul ebx, dword [esp + 0x30]
mov ebp, ecx
and ebp, 0x3e0
and eax, 0x1f
imul ebp, edx
imul eax, dword [esp + 0x34]
and ecx, 0x1f
imul ecx, dword [esp + 0x2c]
sar edi, 5
and edi, 0x7c00
add ebx, ebp
sar ebx, 5
add eax, ecx
mov ecx, dword [esp + 0x88]
and ebx, 0x3e0
or edi, ebx
sar eax, 5
or edi, eax
mov eax, dword [esp + 0x14]
mov word [eax + ecx], di
mov ecx, dword [esp + 0x54]
mov edi, dword [esp + 0x28]
mov di, word [edi + ecx]
movzx ecx, word [eax + 0x640]
movzx eax, di
mov edi, eax
and edi, 0x7c00
imul edi, dword [esp + 0x1c]
mov ebx, ecx
and ebx, 0x7c00
imul ebx, dword [esp + 0x38]
add edi, ebx
sar edi, 5
and edi, 0x7c00
mov ebx, eax
and ebx, 0x3e0
imul ebx, dword [esp + 0x30]
mov ebp, ecx
and eax, 0x1f
imul eax, dword [esp + 0x34]
and ebp, 0x3e0
imul ebp, edx
add ebx, ebp
and ecx, 0x1f
imul ecx, dword [esp + 0x2c]
add eax, ecx
mov ecx, dword [esp + 0x18]
sar ebx, 5
and ebx, 0x3e0
or edi, ebx
sar eax, 5
or edi, eax
mov eax, dword [esp + 0x28]
mov word [eax], di
mov ax, word [ecx + 0x12c0]
mov ecx, dword [esp + 0x14]
movzx ecx, word [ecx + 0xc80]
movzx eax, ax
mov edi, eax
and edi, 0x7c00
imul edi, dword [esp + 0x1c]
mov ebx, ecx
and ebx, 0x7c00
imul ebx, dword [esp + 0x38]
add edi, ebx
mov ebx, eax
and ebx, 0x3e0
imul ebx, dword [esp + 0x30]
mov ebp, ecx
and ebp, 0x3e0
and eax, 0x1f
imul ebp, edx
imul eax, dword [esp + 0x34]
and ecx, 0x1f
imul ecx, dword [esp + 0x2c]
add ebx, ebp
mov ebp, dword [esp + 0x18]
sar edi, 5
sar ebx, 5
add eax, ecx
and ebx, 0x3e0
and edi, 0x7c00
sar eax, 5
or edi, ebx
mov ebx, dword [esp + 0x14]
or edi, eax
mov eax, dword [esp + 0x28]
mov ecx, 0x1900
mov word [eax + 0x640], di
add eax, ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x70]
add ebp, ecx
add ebx, ecx
dec eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x70], eax
jne 0x40ce2a
mov ecx, dword [esp + 0x84]
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x58]
mov eax, dword [esp + 0x68]
mov edi, dword [esp + 0x80]
add dword [esp + 0x50], 2
add dword [esp + 0x60], 2
mov edx, dword [esp + 0x5c]
add edx, 2
inc eax
mov dword [esp + 0x5c], edx
inc ecx
lea edx, [edi + 0x20]
cmp eax, edx
mov dword [esp + 0x68], eax
mov dword [esp + 0x84], ecx
jl 0x40cd62
mov edx, dword [ebx]
lea eax, [esp + 0x40]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x78]
lea eax, [edi + 0x20]
mov dword [esp + 0x48], eax
mov eax, 2
add ecx, eax
mov dword [esp + 0x64], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x40], edi
inc edi
add edx, eax
add ecx, eax
cmp edi, 0x320
mov dword [esp + 0x80], edi
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], ecx
jl 0x40cd30
jmp 0x40d994
mov ecx, dword [ebp + 0x28]
xor edi, edi
mov eax, 0x258
mov dword [esp + 0x74], ecx
mov ecx, ebp
mov dword [ebp + 0x28], 0xa
mov dword [esp + 0x44], edi
mov dword [esp + 0x4c], eax
mov dword [esp + 0x94], edi
mov dword [esp + 0x9c], eax
call fcn.00407ce0
mov dword [esp + 0x24], edi
mov edi, 0x318
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x40]
push ecx
mov ecx, dword [ebp + 4]
push ecx
lea edx, [eax + 8]
push 0
mov dword [esp + 0x54], edx
mov edx, dword [esi]
push eax
mov ecx, esi
mov dword [esp + 0x50], eax
call dword [edx + 0x60]
mov eax, dword [esi]
lea edx, [edi + 8]
lea ecx, [esp + 0x90]
push ecx
mov dword [esp + 0x9c], edx
mov edx, dword [ebp + 4]
push edx
push 0
push edi
mov ecx, esi
mov dword [esp + 0xa0], edi
call dword [eax + 0x60]
mov edx, dword [ebx]
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov edx, dword [esp + 0x24]
add edx, 0x10
sub edi, 0x10
cmp edi, 0xfffffff8
mov dword [esp + 0x24], edx
jg 0x40d137
mov eax, dword [esp + 0x74]
mov dword [ebp + 0x28], eax
jmp 0x40e299
cmp dword [0x49e960], 0x18
mov ecx, dword [ebp + 8]
jne 0x40d97a
mov eax, dword [esi + 0x20]
mov edx, dword [ecx]
push eax
mov eax, dword [esi + 0x18]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x5a8]
mov edx, dword [ebp + 8]
add ecx, 0x20
push ecx
push edx
mov ecx, 0x49e860
call fcn.00402230
test eax, eax
je 0x40b595
mov edx, dword [ebx]
xor eax, eax
push eax
mov ecx, ebx
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], 0x320
mov dword [esp + 0xa0], 0x258
call dword [edx + 0x18]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
mov edi, eax
mov eax, dword [edi]
push ecx
push edx
mov ecx, edi
mov dword [esp + 0x64], edi
call dword [eax + 4]
mov eax, dword [edi]
lea ecx, [esp + 0x90]
push ecx
push esi
push 0
push 0
mov ecx, edi
call dword [eax + 0x60]
mov edx, dword [ebp + 0x28]
mov ecx, ebp
mov dword [esp + 0x60], edx
mov dword [ebp + 0x28], 0x29
call fcn.00407ce0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [esp + 0x50], eax
call dword [edx + 0xc]
mov esi, eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
mov ecx, dword [ebp + 4]
mov edx, dword [ecx]
mov dword [esp + 0x54], eax
call dword [edx + 0xc]
mov ecx, 0x20
mov dword [esp + 0x8c], eax
mov dword [esp + 0x1e8], 0x11
mov dword [esp + 0x1ec], 0x12
mov dword [esp + 0x1f0], 0x13
mov dword [esp + 0x1f4], 0x14
mov dword [esp + 0x1f8], 0x15
mov dword [esp + 0x1fc], 0x16
mov dword [esp + 0x200], 0x17
mov dword [esp + 0x204], 0x18
mov dword [esp + 0x208], 0x19
mov dword [esp + 0x20c], 0x1a
mov dword [esp + 0x210], 0x1b
mov dword [esp + 0x214], 0x1c
mov dword [esp + 0x218], 0x1d
mov dword [esp + 0x21c], 0x1e
mov dword [esp + 0x220], 0x1f
mov dword [esp + 0x224], ecx
mov dword [esp + 0x228], 0x21
mov dword [esp + 0x22c], 0x22
mov dword [esp + 0x230], 0x23
mov dword [esp + 0x234], 0x24
mov dword [esp + 0x238], 0x25
mov dword [esp + 0x23c], 0x26
mov dword [esp + 0x240], 0x27
mov dword [esp + 0x244], 0x28
mov dword [esp + 0x248], 0x29
mov dword [esp + 0x24c], 0x2a
mov dword [esp + 0x250], 0x2b
mov dword [esp + 0x254], 0x2c
mov dword [esp + 0x258], 0x2d
mov dword [esp + 0x25c], 0x2e
mov dword [esp + 0x260], 0x2f
mov dword [esp + 0x264], 0x30
xor eax, eax
lea edi, [esp + 0x268]
rep stosd dword es:[edi], eax
lea edi, [esi + 8]
mov eax, edi
mov edx, 0xbb80
mov ecx, dword [eax - 8]
and ecx, 0xff
mov esi, dword [esp + ecx*4 + 0x268]
lea ecx, [esp + ecx*4 + 0x268]
inc esi
mov dword [ecx], esi
mov ecx, dword [eax - 4]
and ecx, 0xff
mov esi, dword [esp + ecx*4 + 0x268]
lea ecx, [esp + ecx*4 + 0x268]
inc esi
mov dword [ecx], esi
mov ecx, dword [eax]
and ecx, 0xff
mov esi, dword [esp + ecx*4 + 0x268]
lea ecx, [esp + ecx*4 + 0x268]
inc esi
mov dword [ecx], esi
mov ecx, dword [eax + 4]
and ecx, 0xff
mov esi, dword [esp + ecx*4 + 0x268]
lea ecx, [esp + ecx*4 + 0x268]
inc esi
mov dword [ecx], esi
mov ecx, dword [eax + 8]
and ecx, 0xff
mov esi, dword [esp + ecx*4 + 0x268]
lea ecx, [esp + ecx*4 + 0x268]
inc esi
mov dword [ecx], esi
mov ecx, dword [eax + 0xc]
and ecx, 0xff
mov esi, dword [esp + ecx*4 + 0x268]
lea ecx, [esp + ecx*4 + 0x268]
inc esi
mov dword [ecx], esi
mov ecx, dword [eax + 0x10]
and ecx, 0xff
mov esi, dword [esp + ecx*4 + 0x268]
lea ecx, [esp + ecx*4 + 0x268]
inc esi
mov dword [ecx], esi
mov ecx, dword [eax + 0x14]
and ecx, 0xff
mov esi, dword [esp + ecx*4 + 0x268]
lea ecx, [esp + ecx*4 + 0x268]
inc esi
mov dword [ecx], esi
mov ecx, dword [eax + 0x18]
and ecx, 0xff
mov esi, dword [esp + ecx*4 + 0x268]
lea ecx, [esp + ecx*4 + 0x268]
inc esi
mov dword [ecx], esi
mov ecx, dword [eax + 0x1c]
and ecx, 0xff
mov esi, dword [esp + ecx*4 + 0x268]
lea ecx, [esp + ecx*4 + 0x268]
inc esi
add eax, 0x28
dec edx
mov dword [ecx], esi
jne 0x40d400
xor esi, esi
nop
mov eax, dword [esp + esi + 0x268]
shl eax, 2
push eax
call fcn.0043484f
add esp, 4
test eax, eax
mov dword [esp + esi + 0xa0], eax
je 0x40d825
mov dword [esp + esi + 0x268], 0
add esi, 4
cmp esi, 0x80
jl 0x40d510
mov eax, 2
mov ecx, edi
nop
mov edx, dword [ecx - 8]
and edx, 0xff
cmp edx, 0x1f
jg 0x40d57f
lea esi, [esp + edx*4 + 0x268]
mov edx, dword [esp + edx*4 + 0xa0]
mov dword [esp + 0x18], esi
mov esi, dword [esi]
lea edi, [eax - 2]
mov dword [edx + esi*4], edi
mov edx, dword [esp + 0x18]
inc esi
mov dword [edx], esi
mov edx, dword [ecx - 4]
and edx, 0xff
cmp edx, 0x1f
jg 0x40d5ae
lea esi, [esp + edx*4 + 0x268]
mov edx, dword [esp + edx*4 + 0xa0]
mov dword [esp + 0x18], esi
mov esi, dword [esi]
lea edi, [eax - 1]
mov dword [edx + esi*4], edi
mov edx, dword [esp + 0x18]
inc esi
mov dword [edx], esi
mov edx, dword [ecx]
and edx, 0xff
cmp edx, 0x1f
jg 0x40d5d6
mov edi, dword [esp + edx*4 + 0x268]
lea esi, [esp + edx*4 + 0x268]
mov edx, dword [esp + edx*4 + 0xa0]
mov dword [edx + edi*4], eax
inc edi
mov dword [esi], edi
mov edx, dword [ecx + 4]
and edx, 0xff
cmp edx, 0x1f
jg 0x40d605
lea esi, [esp + edx*4 + 0x268]
mov edx, dword [esp + edx*4 + 0xa0]
mov dword [esp + 0x18], esi
mov esi, dword [esi]
lea edi, [eax + 1]
mov dword [edx + esi*4], edi
mov edx, dword [esp + 0x18]
inc esi
mov dword [edx], esi
mov edx, dword [ecx + 8]
and edx, 0xff
cmp edx, 0x1f
jg 0x40d634
lea esi, [esp + edx*4 + 0x268]
mov edx, dword [esp + edx*4 + 0xa0]
mov dword [esp + 0x18], esi
mov esi, dword [esi]
lea edi, [eax + 2]
mov dword [edx + esi*4], edi
mov edx, dword [esp + 0x18]
inc esi
mov dword [edx], esi
mov edx, dword [ecx + 0xc]
and edx, 0xff
cmp edx, 0x1f
jg 0x40d663
lea esi, [esp + edx*4 + 0x268]
mov edx, dword [esp + edx*4 + 0xa0]
mov dword [esp + 0x18], esi
mov esi, dword [esi]
lea edi, [eax + 3]
mov dword [edx + esi*4], edi
mov edx, dword [esp + 0x18]
inc esi
mov dword [edx], esi
mov edx, dword [ecx + 0x10]
and edx, 0xff
cmp edx, 0x1f
jg 0x40d692
lea esi, [esp + edx*4 + 0x268]
mov edx, dword [esp + edx*4 + 0xa0]
mov dword [esp + 0x18], esi
mov esi, dword [esi]
lea edi, [eax + 4]
mov dword [edx + esi*4], edi
mov edx, dword [esp + 0x18]
inc esi
mov dword [edx], esi
mov edx, dword [ecx + 0x14]
and edx, 0xff
cmp edx, 0x1f
jg 0x40d6c1
lea esi, [esp + edx*4 + 0x268]
mov edx, dword [esp + edx*4 + 0xa0]
mov dword [esp + 0x18], esi
mov esi, dword [esi]
lea edi, [eax + 5]
mov dword [edx + esi*4], edi
mov edx, dword [esp + 0x18]
inc esi
mov dword [edx], esi
mov edx, dword [ecx + 0x18]
and edx, 0xff
cmp edx, 0x1f
jg 0x40d6f0
lea esi, [esp + edx*4 + 0x268]
mov edx, dword [esp + edx*4 + 0xa0]
mov dword [esp + 0x18], esi
mov esi, dword [esi]
lea edi, [eax + 6]
mov dword [edx + esi*4], edi
mov edx, dword [esp + 0x18]
inc esi
mov dword [edx], esi
mov edx, dword [ecx + 0x1c]
and edx, 0xff
cmp edx, 0x1f
jg 0x40d71f
lea esi, [esp + edx*4 + 0x268]
mov edx, dword [esp + edx*4 + 0xa0]
mov dword [esp + 0x18], esi
mov esi, dword [esi]
lea edi, [eax + 7]
mov dword [edx + esi*4], edi
mov edx, dword [esp + 0x18]
inc esi
mov dword [edx], esi
add eax, 0xa
lea edx, [eax - 2]
add ecx, 0x28
cmp edx, 0x75300
jl 0x40d550
mov dword [esp + 0x10], 0
lea esp, [esp]
mov eax, dword [esp + 0x10]
shl eax, 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x24], eax
jmp 0x40d760
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + ecx*4 + 0x1e8]
jge 0x40d8eb
mov edx, ecx
cmp eax, edx
jl 0x40d8eb
mov eax, dword [esp + 0x24]
cmp eax, 0x100
jl 0x40d78f
mov eax, 0xff
mov ecx, 0xff
sub ecx, eax
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x144], ecx
mov eax, ecx
or eax, 0xffffff00
shl eax, 8
or eax, ecx
shl eax, 8
or eax, ecx
mov edx, eax
shr edx, 8
and edx, 0xff
mov ecx, 0xff
sub ecx, edx
mov dword [esp + 0x6c], ecx
mov esi, eax
and eax, 0xff
mov ecx, 0xff
sub ecx, eax
mov dword [esp + 0x70], ecx
mov ecx, dword [esp + 0x14]
shr esi, 0x10
and esi, 0xff
lea ecx, [esp + ecx*4 + 0x268]
mov dword [esp + 0x68], eax
mov eax, dword [ecx]
mov edi, 0xff
sub edi, esi
test eax, eax
mov dword [esp + 0x74], esi
mov dword [esp + 0x88], edi
jle 0x40d8eb
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0xa0]
mov ecx, dword [ecx]
mov dword [esp + 0x20], eax
mov dword [esp + 0x3c], ecx
jmp 0x40d855
mov edx, dword [0x49e8c0]
push 0x30
mov ecx, 0x49e8c0
call dword [edx + 0xc]
push eax
push 0x47a4c0
push 0
call dword [0x47a18c]
push 0
call fcn.00434ab8
mov esi, dword [esp + 0x74]
mov edi, dword [esp + 0x88]
mov eax, dword [eax]
mov ecx, dword [esp + 0x54]
mov ecx, dword [ecx + eax*4]
mov ebx, dword [esp + 0x8c]
mov eax, dword [ebx + eax*4]
mov ebx, eax
and ebx, 0xff0000
imul ebx, edi
mov edi, ecx
and edi, 0xff0000
imul edi, esi
add ebx, edi
mov esi, eax
mov edi, ecx
and esi, 0xff00
imul esi, dword [esp + 0x6c]
and edi, 0xff00
and eax, 0xff
imul edi, edx
imul eax, dword [esp + 0x70]
and ecx, 0xff
imul ecx, dword [esp + 0x68]
add esi, edi
and ebx, 0xff0000ff
add eax, ecx
and esi, 0xff0000
or ebx, esi
mov esi, dword [esp + 0x50]
or ebx, eax
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
shr ebx, 8
mov dword [esi + ecx*4], ebx
mov ecx, dword [esp + 0x3c]
add eax, 4
dec ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x3c], ecx
jne 0x40d84a
mov ebx, dword [esp + 0x58]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
inc eax
sub edx, 0x10
cmp eax, 0x20
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], edx
jl 0x40d760
mov edx, dword [ebx]
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x31
mov dword [esp + 0x10], eax
jl 0x40d740
mov eax, dword [esp + 0x60]
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x28], eax
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [esp + 0x5c]
mov eax, dword [ecx]
call dword [eax + 8]
xor esi, esi
jmp 0x40d950
mov eax, dword [esp + esi*4 + 0xa0]
test eax, eax
je 0x40d96f
push eax
call fcn.0043484a
add esp, 4
mov dword [esp + esi*4 + 0xa0], 0
inc esi
cmp esi, 0x20
jl 0x40d950
jmp 0x40e299
mov edi, dword [esp + 0x5a8]
add edi, 0x20
push edi
push ecx
mov ecx, 0x49e860
call fcn.00402230
test eax, eax
jne 0x40d9c8
lea edi, [ebp + 0xc]
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0x5a4]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [esp + 0x5a8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x60]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x40e299
mov eax, dword [esi + 0x20]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push eax
mov eax, dword [esi + 0x18]
push eax
call dword [edx + 4]
mov ecx, dword [ebp + 8]
push edi
push ecx
mov ecx, 0x49e860
call fcn.00402230
mov edx, dword [ebp + 0x28]
mov ecx, ebp
mov dword [esp + 0x68], edx
mov dword [ebp + 0x28], 0x50
call fcn.00407ce0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov edi, eax
call dword [edx + 0xc]
mov ecx, dword [ebp + 4]
mov dword [esp + 0x74], eax
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [esp + 0x74]
lea edx, [ecx + 8]
mov dword [esp + 0x74], edx
lea edx, [edi + 4]
mov dword [esp + 0x88], edx
lea edx, [eax + 2]
mov dword [esp + 0x54], edx
mov edx, ecx
sub edx, eax
mov dword [esp + 0x8c], edx
mov edx, edi
sub edx, eax
xor esi, esi
sub ecx, edi
mov dword [esp + 0x6c], edx
mov dword [esp + 0x70], ecx
mov ecx, dword [esp + 0x88]
mov edi, dword [esp + 0x74]
mov eax, dword [esp + 0x54]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x3c], 0xbb80
jmp 0x40da70
xor edx, edx
mov dl, byte [edi - 8]
and edx, 0x1f
cmp edx, esi
jne 0x40da84
mov dx, word [eax - 2]
mov word [ecx - 4], dx
mov edx, dword [esp + 0x8c]
movzx edx, byte [edx + eax]
and edx, 0x1f
cmp edx, esi
jne 0x40daa5
mov cx, word [eax]
mov edx, dword [esp + 0x6c]
mov word [edx + eax], cx
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x70]
movzx edx, byte [edx + ecx]
and edx, 0x1f
cmp edx, esi
jne 0x40dabb
mov dx, word [eax + 2]
mov word [ecx], dx
xor edx, edx
mov dl, byte [edi - 2]
and edx, 0x1f
cmp edx, esi
jne 0x40dacf
mov dx, word [eax + 4]
mov word [ecx + 2], dx
xor edx, edx
mov dl, byte [edi]
and edx, 0x1f
cmp edx, esi
jne 0x40dae2
mov dx, word [eax + 6]
mov word [ecx + 4], dx
xor edx, edx
mov dl, byte [edi + 2]
and edx, 0x1f
cmp edx, esi
jne 0x40daf6
mov dx, word [eax + 8]
mov word [ecx + 6], dx
xor edx, edx
mov dl, byte [edi + 4]
and edx, 0x1f
cmp edx, esi
jne 0x40db0a
mov dx, word [eax + 0xa]
mov word [ecx + 8], dx
xor edx, edx
mov dl, byte [edi + 6]
and edx, 0x1f
cmp edx, esi
jne 0x40db1e
mov dx, word [eax + 0xc]
mov word [ecx + 0xa], dx
xor edx, edx
mov dl, byte [edi + 8]
and edx, 0x1f
cmp edx, esi
jne 0x40db32
mov dx, word [eax + 0xe]
mov word [ecx + 0xc], dx
xor edx, edx
mov dl, byte [edi + 0xa]
and edx, 0x1f
cmp edx, esi
jne 0x40db46
mov dx, word [eax + 0x10]
mov word [ecx + 0xe], dx
mov edx, dword [esp + 0x3c]
add ecx, 0x14
add eax, 0x14
add edi, 0x14
dec edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x3c], edx
jne 0x40da70
mov edx, dword [ebx]
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
inc esi
cmp esi, 0x10
jl 0x40da50
mov eax, dword [esp + 0x68]
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x28], eax
mov edx, dword [ecx]
call dword [edx + 8]
jmp 0x40e299
mov dword [ebp + 0x28], 0x1e
mov eax, dword [ebx]
push 0
mov ecx, ebx
call dword [eax + 0x18]
mov ecx, dword [esi + 0x20]
mov edx, dword [eax]
push ecx
mov ecx, dword [esi + 0x18]
push ecx
mov ecx, eax
mov dword [esp + 0x2c], eax
call dword [edx + 4]
mov eax, dword [esp + 0x5a4]
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
lea edi, [ebp + 0xc]
push edi
push esi
push eax
mov eax, dword [esp + 0x5ac]
push eax
call dword [edx + 0x60]
mov ecx, ebp
call fcn.00407ce0
push 0x258
push 0x320
push 0
push 0
lea ecx, [esp + 0xa0]
push ecx
call dword [0x47a208]
mov dword [esp + 0x14], 8
mov edi, edi
mov ecx, dword [esp + 0x14]
mov edx, dword [esi]
push 0
push 0
push 1
lea eax, [esp + 0x9c]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x50]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x5a4]
mov eax, dword [esi]
push edi
push ecx
mov ecx, dword [esp + 0x5a8]
push edx
push ecx
mov ecx, esi
call dword [eax + 0x60]
mov eax, dword [esp + 0x14]
shl eax, 1
cmp eax, 0x80
mov dword [esp + 0x14], eax
jl 0x40dc00
mov ecx, dword [ebp + 4]
mov edx, dword [esi]
lea eax, [esp + 0x90]
push eax
mov eax, dword [esp + 0x5a8]
push ecx
mov ecx, dword [esp + 0x5a8]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x60]
mov dword [esp + 0x14], 0x80
mov ecx, dword [esp + 0x14]
mov edx, dword [esi]
push 0x258
push 0x320
push 1
lea eax, [esp + 0x9c]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x50]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov ecx, dword [ebp + 4]
mov edx, dword [esp + 0x5a4]
mov eax, dword [esi]
push edi
push ecx
mov ecx, dword [esp + 0x5a8]
push edx
push ecx
mov ecx, esi
call dword [eax + 0x60]
mov eax, dword [esp + 0x14]
sar eax, 1
cmp eax, 7
mov dword [esp + 0x14], eax
jg 0x40dc82
jmp 0x40de3a
mov dword [ebp + 0x28], 0xa0
mov edx, dword [ebx]
push 0
mov ecx, ebx
call dword [edx + 0x18]
mov ecx, dword [esi + 0x20]
mov edx, dword [eax]
push ecx
mov ecx, dword [esi + 0x18]
push ecx
mov ecx, eax
mov dword [esp + 0x2c], eax
call dword [edx + 4]
mov eax, dword [esp + 0x5a4]
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
lea edi, [ebp + 0xc]
push edi
push esi
push eax
mov eax, dword [esp + 0x5ac]
push eax
call dword [edx + 0x60]
mov ecx, ebp
call fcn.00407ce0
push 0x258
push 0x320
push 0
push 0
lea ecx, [esp + 0xa0]
push ecx
call dword [0x47a208]
mov dword [esp + 0x10], 2
lea ecx, [ecx]
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
push 0
push 0
push 1
lea eax, [esp + 0x9c]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x50]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x5a4]
mov eax, dword [esi]
push edi
push ecx
mov ecx, dword [esp + 0x5a8]
push edx
push ecx
mov ecx, esi
call dword [eax + 0x60]
mov eax, dword [esp + 0x10]
shl eax, 1
cmp eax, 0x200
mov dword [esp + 0x10], eax
jl 0x40dd50
mov ecx, dword [ebp + 4]
mov edx, dword [esi]
lea eax, [esp + 0x90]
push eax
mov eax, dword [esp + 0x5a8]
push ecx
mov ecx, dword [esp + 0x5a8]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x60]
mov dword [ebp + 0x28], 0x64
mov dword [esp + 0x10], 0x100
lea esp, [esp]
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
push 0x258
push 0x320
push 1
lea eax, [esp + 0x9c]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x50]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
mov ecx, dword [ebp + 4]
mov edx, dword [esp + 0x5a4]
mov eax, dword [esi]
push edi
push ecx
mov ecx, dword [esp + 0x5a8]
push edx
push ecx
mov ecx, esi
call dword [eax + 0x60]
mov eax, dword [esp + 0x10]
sar eax, 1
cmp eax, 2
mov dword [esp + 0x10], eax
jg 0x40dde0
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0x5a4]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [esp + 0x5a8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x60]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, dword [esp + 0x24]
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0x1c]
jmp 0x40e299
mov edi, dword [esp + 0x5a8]
mov eax, dword [edi]
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
mov dword [esp + 0x20], eax
call dword [0x47a238]
mov edx, dword [esp + 0x20]
push 0x258
push 0x320
push 0
add eax, edx
push 0
lea edx, [esp + 0xa0]
push edx
mov dword [esp + 0x38], eax
call dword [0x47a208]
mov eax, dword [ebx]
push 0
mov ecx, ebx
call dword [eax + 0x18]
mov edx, dword [eax]
push 0x258
push 0x320
mov ecx, eax
mov dword [esp + 0x58], eax
call dword [edx + 4]
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx]
lea edx, [esp + 0x90]
push edx
push esi
push 0
push 0
call dword [eax + 0x60]
mov edx, dword [edi + 0x10]
mov eax, dword [edi + 4]
sub eax, edx
cdq
and edx, 0x1f
add eax, edx
mov edx, dword [edi + 0x14]
sar eax, 5
neg eax
mov dword [esp + 0x74], eax
mov eax, dword [edi + 8]
sub eax, edx
cdq
and edx, 0x1f
add eax, edx
mov edx, dword [edi + 0x18]
sar eax, 5
neg eax
mov dword [esp + 0x88], eax
mov eax, dword [edi + 0xc]
sub eax, edx
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
neg eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x10], 1
jmp 0x40df40
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x90]
push eax
mov al, byte [esp + 0x78]
imul cl
add al, byte [edi + 4]
mov edi, dword [esp + 0x8c]
imul edi, ecx
mov ecx, dword [esp + 0x5ac]
add di, word [ecx + 8]
movzx eax, al
or eax, 0xffffff00
shl eax, 8
movzx ecx, di
mov edi, dword [esp + 0x5ac]
or eax, ecx
mov cl, byte [edi + 0xc]
mov edx, dword [esi]
shl eax, 8
mov dword [esp + 0x90], eax
mov al, byte [esp + 0x58]
imul byte [esp + 0x14]
add al, cl
mov ecx, dword [esp + 0x90]
movzx eax, al
or ecx, eax
push ecx
mov ecx, esi
call dword [edx + 0x40]
mov edx, dword [ebx]
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov edx, dword [esp + 0x50]
mov eax, dword [esi]
lea ecx, [esp + 0x90]
push ecx
push edx
push 0
push 0
mov ecx, esi
call dword [eax + 0x60]
call dword [0x47a238]
cmp dword [esp + 0x24], eax
jbe 0x40dff4
jmp 0x40dfe0
push 1
call dword [0x47a0e4]
call dword [0x47a238]
cmp dword [esp + 0x24], eax
ja 0x40dfe0
call dword [0x47a238]
add eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x20
mov dword [esp + 0x10], eax
jl 0x40df40
movzx edx, byte [edi + 0x10]
mov eax, dword [esi]
lea ecx, [esp + 0x90]
push ecx
movzx ecx, word [edi + 0x14]
or edx, 0xffffff00
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 0x18]
shl edx, 8
or edx, ecx
push edx
mov ecx, esi
call dword [eax + 0x40]
mov edx, dword [ebx]
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, dword [esp + 0x50]
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0x1c]
jmp 0x40e299
mov edx, dword [esp + 0x5a8]
mov eax, dword [edx]
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
mov ecx, ebp
mov dword [ebp + 0x28], eax
call fcn.00407ce0
push 0x258
push 0x320
push 0
push 0
lea eax, [esp + 0xa0]
push eax
call dword [0x47a208]
mov edx, dword [ebx]
push 0
mov ecx, ebx
call dword [edx + 0x18]
mov edi, eax
mov eax, dword [edi]
push 0x258
push 0x320
mov ecx, edi
mov dword [esp + 0x7c], edi
call dword [eax + 4]
mov edx, dword [edi]
lea eax, [esp + 0x90]
push eax
push esi
push 0
push 0
mov ecx, edi
call dword [edx + 0x60]
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x40e13f
mov dword [esp + 0x10], 0
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
movzx eax, cl
lea edi, [esp + 0x90]
push edi
mov edi, eax
or edi, 0xffffff00
movzx ecx, cx
shl edi, 8
or edi, ecx
shl edi, 8
or edi, eax
push edi
mov ecx, esi
call dword [edx + 0x40]
mov edx, dword [ebx]
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov edi, dword [esp + 0x74]
mov eax, dword [esi]
lea ecx, [esp + 0x90]
push ecx
push edi
push 0
push 0
mov ecx, esi
call dword [eax + 0x60]
mov ecx, ebp
call fcn.00407d00
mov eax, dword [esp + 0x10]
add eax, 8
cmp eax, 0x100
mov dword [esp + 0x10], eax
jl 0x40e0d7
mov edx, dword [esi]
lea eax, [esp + 0x90]
push eax
push 0xffffffffffffffff
mov ecx, esi
call dword [edx + 0x40]
mov edx, dword [ebx]
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call dword [edx + 0x28]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x1c]
jmp 0x40e299
mov eax, dword [esp + 0x5a8]
mov ecx, dword [eax + 8]
mov dword [ebp + 0x28], ecx
mov ecx, ebp
call fcn.00407ce0
mov eax, dword [esi + 0x20]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push eax
mov eax, dword [esi + 0x18]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x5a4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
lea edi, [ebp + 0xc]
push edi
push esi
push eax
mov eax, dword [esp + 0x5ac]
push eax
call dword [edx + 0x60]
call dword [0x47a238]
mov ecx, dword [esp + 0x5a8]
add eax, dword [ecx + 0xc]
mov dword [esp + 0x6c], eax
call dword [0x47a238]
cmp dword [esp + 0x6c], eax
jbe 0x40e27e
lea ecx, [ecx]
mov edx, dword [esp + 0x5a8]
cmp dword [edx], 0
je 0x40e1fc
mov eax, edx
mov ecx, dword [eax]
mov dword [esp + 0x74], ecx
call fcn.00434b02
mov ecx, dword [esp + 0x74]
cdq
idiv ecx
shl edx, 1
mov eax, edx
sub eax, ecx
mov dword [esp + 0x20], eax
jmp 0x40e204
mov dword [esp + 0x20], 0
mov edx, dword [esp + 0x5a8]
mov eax, dword [edx + 4]
test eax, eax
je 0x40e233
mov eax, edx
mov ecx, dword [eax + 4]
mov dword [esp + 0x74], ecx
call fcn.00434b02
mov ecx, dword [esp + 0x74]
cdq
idiv ecx
shl edx, 1
mov eax, edx
sub eax, ecx
mov dword [esp + 0x3c], eax
jmp 0x40e23b
mov dword [esp + 0x3c], 0
mov edx, dword [esi]
push 0
push 0xff000000
mov ecx, esi
call dword [edx + 0x30]
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x20]
mov eax, dword [esi]
push edi
push ecx
mov ecx, dword [esp + 0x44]
push edx
push ecx
mov ecx, esi
call dword [eax + 0x60]
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x28]
mov ecx, ebp
call fcn.00407d00
call dword [0x47a238]
cmp dword [esp + 0x6c], eax
ja 0x40e1d0
mov ecx, dword [ebp + 4]
mov eax, dword [esi]
push edi
push ecx
push 0
push 0
mov ecx, esi
call dword [eax + 0x60]
jmp 0x40d9b3
mov eax, dword [ebx]
push edi
call dword [eax + 0x28]
mov dword [ebp + 0x2c], 0
pop esi
pop ebx
pop edi
mov eax, 1
pop ebp
add esp, 0x58c
ret 0x10