Function at 0x6aa857
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0xab452b
call fcn.00a6fc7c
sub esp, 0x134
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x90], ebx
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x40], esp
push 0x320
push eax
mov dword [ebp - 4], ebx
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], bl
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.004032b2
cmp eax, ebx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10], ebx
je 0x6aa8da
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x10]
call fcn.004053ee
cmp eax, ebx
jge 0x6aa8da
cmp eax, 0x80004002
je 0x6aa8da
push eax
call fcn.00a6ef01
lea eax, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 4
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6aa8f5
push eax
call fcn.00a6ef01
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], eax
call fcn.00415cb7
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
mov dword [ebp - 0x14], ebx
call fcn.006af8c2
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
lea edx, [eax + 0xc]
mov byte [ebp - 4], 6
mov esi, eax
call fcn.006a0b7b
mov ecx, dword [ebp + 8]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x24]
mov esi, eax
call fcn.006a0b7b
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x18]
xor ecx, ecx
mov esi, eax
call fcn.006a0b7b
push ecx
mov dword [esi + 0x20], eax
mov eax, esp
mov dword [ebp - 0x40], esp
push 0x322
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
mov byte [ebp - 4], 8
cmp word [ebp - 0xa0], 8
jne 0x6aac5e
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x4c]
push 0x5a0
push eax
mov byte [ebp - 4], 9
call fcn.007a48d0
mov ecx, eax
call fcn.0040634c
push dword [ebp - 0x98]
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 0xa
call fcn.004170a6
mov eax, dword [ebp - 0x4c]
add esp, 0xc
cmp eax, ebx
mov byte [ebp - 4], 9
je 0x6aa9dc
add eax, 0xfffffff4
push eax
call fcn.00403382
pop ecx
push dword [ebp - 0x98]
mov esi, dword [ebp - 0x14]
call fcn.00a70518
mov edi, eax
pop ecx
lea edx, [esi + 0x18]
mov ecx, edi
call fcn.006a0b7b
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x24]
mov ecx, edi
mov esi, eax
call fcn.006a0b7b
mov dword [esi + 0x2c], eax
mov esi, 0xbe7330
push esi
lea ecx, [ebp - 0xc0]
call fcn.0040318f
push esi
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0xb
call fcn.0040318f
push ebx
push ebx
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xc
call fcn.00414b5f
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0040339f
lea eax, [ebp - 0x8c]
push eax
mov byte [ebp - 4], 0xc
call fcn.00406548
mov ecx, eax
call fcn.00402680
mov ecx, eax
call fcn.00404a75
mov ecx, eax
mov byte [ebp - 4], 0xe
call fcn.004032b2
cmp eax, ebx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ebx
je 0x6aaaa5
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x44]
call fcn.004053ee
cmp eax, ebx
jge 0x6aaaa5
cmp eax, 0x80004002
je 0x6aaaa5
push eax
call fcn.00a6ef01
lea eax, [ebp - 0x8c]
push eax
mov byte [ebp - 4], 0x12
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6aaac0
push eax
call fcn.00a6ef01
lea eax, [ebp - 0xd0]
push eax
mov byte [ebp - 4], 0x11
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6aaadb
push eax
call fcn.00a6ef01
lea eax, [ebp - 0xc0]
push eax
mov byte [ebp - 4], 0x10
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6aaaf6
push eax
call fcn.00a6ef01
cmp dword [ebp - 0x44], ebx
je 0x6aac13
push dword [ebp - 0x44]
lea ecx, [ebp - 0x38]
call fcn.004027be
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x320
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x10
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
mov ecx, eax
mov byte [ebp - 4], 0x14
call fcn.004032b2
cmp eax, ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ebx
je 0x6aab6d
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004053ee
cmp eax, ebx
jge 0x6aab6d
cmp eax, 0x80004002
je 0x6aab6d
push eax
call fcn.00a6ef01
lea eax, [ebp - 0x74]
push eax
mov byte [ebp - 4], 0x16
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6aab85
push eax
call fcn.00a6ef01
cmp dword [ebp - 0x3c], ebx
je 0x6aac39
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x322
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x16
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x18
call fcn.0052a969
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x16
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6aabe5
push eax
call fcn.00a6ef01
lea ecx, [ebp - 0x3c]
call fcn.004027e9
lea ecx, [ebp - 0x44]
call fcn.004027e9
mov eax, dword [ebp - 0x24]
cmp eax, ebx
mov byte [ebp - 4], 8
je 0x6aa984
add eax, 0xfffffff4
push eax
call fcn.00403382
pop ecx
jmp 0x6aa984
lea ecx, [ebp - 0x44]
call fcn.004027e9
mov eax, dword [ebp - 0x24]
cmp eax, ebx
mov byte [ebp - 4], 8
je 0x6ad102
add eax, 0xfffffff4
push eax
call fcn.00403382
pop ecx
jmp 0x6ad102
lea ecx, [ebp - 0x3c]
call fcn.004027e9
lea ecx, [ebp - 0x44]
call fcn.004027e9
mov eax, dword [ebp - 0x24]
cmp eax, ebx
mov byte [ebp - 4], 8
je 0x6aac5e
add eax, 0xfffffff4
push eax
call fcn.00403382
pop ecx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
mov esi, 0xba29d0
push esi
call fcn.0040339f
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 8
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x1a
call fcn.00415344
mov edi, eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 8
call fcn.004029b7
add esp, 0xc
cmp eax, ebx
jge 0x6aacad
push eax
call fcn.00a6ef01
cmp edi, ebx
je 0x6aad12
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.0040339f
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 8
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x1c
call fcn.00415344
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.006af852
mov esi, eax
lea edx, [esi + 0x24]
mov ecx, edi
call fcn.006a0b7b
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 8
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6aad12
push eax
call fcn.00a6ef01
mov edi, dword [ebp + 8]
push ebx
lea eax, [ebp - 0x40]
mov esi, 0xbdeed8
push eax
mov ecx, esi
mov dword [ebp - 0x40], edi
call fcn.006afbfb
test eax, eax
jne 0x6ad102
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x40]
push eax
mov ecx, esi
mov dword [ebp - 0x40], edi
call fcn.006afc4f
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0xc54
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 8
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
mov ecx, dword [ebp - 0x14]
xor eax, eax
cmp word [ebp - 0x110], bx
push ecx
setne al
mov dword [ebp - 0x1c], esp
mov byte [ebp - 4], 0x1e
mov dword [ecx + 0x204], eax
mov eax, esp
push 0x156e
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x1e
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x1574
push eax
mov byte [ebp - 4], 0x20
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x20
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x371
push eax
mov byte [ebp - 4], 0x22
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x22
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
xor ecx, ecx
cmp word [ebp - 0x100], bx
mov byte [ebp - 4], 0x24
setne cl
xor eax, eax
cmp word [ebp - 0x130], bx
setne al
mov esi, eax
xor eax, eax
cmp word [ebp - 0x120], bx
setne al
cmp eax, ebx
je 0x6aae66
mov eax, dword [ebp - 0x14]
mov esi, eax
lea edx, [eax + 0x40]
push 3
jmp 0x6aae8c
cmp ecx, ebx
je 0x6aae7e
cmp esi, ebx
je 0x6ad096
mov eax, dword [ebp - 0x14]
mov esi, eax
lea edx, [eax + 0x40]
push 2
jmp 0x6aae8c
mov eax, dword [ebp - 0x14]
cmp esi, ebx
mov esi, eax
lea edx, [eax + 0x40]
je 0x6aae8f
push 1
pop ecx
jmp 0x6aae91
xor ecx, ecx
call fcn.00416e36
push ecx
mov dword [esi + 0x48], eax
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x157b
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x24
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp word [ebp - 0x140], bx
lea edx, [eax + 0x4c]
setne cl
mov byte [ebp - 4], 0x26
mov esi, eax
call fcn.006131b9
mov dword [esi + 0x54], eax
lea eax, [ebp - 0xe0]
push eax
call dword [sym.imp.oleaut32.dll_VariantInit]
push 0xbdd488
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5a3
push eax
mov byte [ebp - 4], 0x27
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x29
call fcn.00443ece
add esp, 4
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.00402c82
call fcn.004acf7a
mov edx, dword [ebp - 0x14]
pop ecx
mov esi, edx
add edx, 0x34
mov ecx, eax
call fcn.00416e36
mov dword [esi + 0x3c], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6aaf78
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5a4
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x2b
call fcn.00415344
mov esi, eax
pop ecx
neg esi
pop ecx
sbb esi, esi
lea ecx, [ebp - 0x18]
neg esi
call fcn.006af852
mov edi, eax
lea edx, [edi + 0x58]
mov ecx, esi
call fcn.006131b9
mov dword [edi + 0x60], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6aafeb
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5a5
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x2d
call fcn.00415344
mov esi, eax
pop ecx
neg esi
pop ecx
sbb esi, esi
lea ecx, [ebp - 0x18]
neg esi
call fcn.006af852
mov edi, eax
lea edx, [edi + 0x64]
mov ecx, esi
call fcn.006131b9
mov dword [edi + 0x6c], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab05e
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5a6
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x2f
call fcn.00415344
mov esi, eax
pop ecx
neg esi
pop ecx
sbb esi, esi
lea ecx, [ebp - 0x18]
neg esi
call fcn.006af852
mov dword [eax + 0x234], esi
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab0c8
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x1569
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x31
call fcn.00415344
mov esi, eax
pop ecx
neg esi
pop ecx
sbb esi, esi
lea ecx, [ebp - 0x18]
neg esi
call fcn.006af852
mov dword [eax + 0x238], esi
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab132
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x1364
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x33
call fcn.00415344
mov esi, eax
pop ecx
neg esi
pop ecx
sbb esi, esi
lea ecx, [ebp - 0x18]
neg esi
call fcn.006af852
mov dword [eax + 0x23c], esi
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab19c
push eax
call fcn.00a6ef01
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x238], ebx
jne 0x6ab360
mov dword [ebp - 0x3c], ebx
lea eax, [ebp - 0x40]
push 0x7e0
push eax
mov byte [ebp - 4], 0x34
call fcn.007a48d0
mov ecx, eax
call fcn.0040634c
push dword [ebp + 8]
mov byte [ebp - 4], 0x35
push dword [eax]
lea eax, [ebp - 0x3c]
push 0xba29c4
push eax
call fcn.004170a6
mov eax, dword [ebp - 0x40]
add esp, 0x10
cmp eax, ebx
mov byte [ebp - 4], 0x34
je 0x6ab1f6
add eax, 0xfffffff4
push eax
call fcn.00403382
pop ecx
mov esi, 0xbe7330
push esi
lea ecx, [ebp - 0xd0]
call fcn.0040318f
push esi
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 0x36
call fcn.0040318f
push ebx
push ebx
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x37
call fcn.00414b5f
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0040339f
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x37
call fcn.00406548
mov ecx, eax
call fcn.00402680
mov ecx, eax
call fcn.00404a75
mov ecx, eax
mov byte [ebp - 4], 0x39
call fcn.004032b2
cmp eax, ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x24], ebx
je 0x6ab28c
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
call fcn.004053ee
cmp eax, ebx
jge 0x6ab28c
cmp eax, 0x80004002
je 0x6ab28c
push eax
call fcn.00a6ef01
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x3d
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab2a4
push eax
call fcn.00a6ef01
lea eax, [ebp - 0xc0]
push eax
mov byte [ebp - 4], 0x3c
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab2bf
push eax
call fcn.00a6ef01
lea eax, [ebp - 0xd0]
push eax
mov byte [ebp - 4], 0x3b
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab2da
push eax
call fcn.00a6ef01
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5a1
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x3b
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
cmp word [eax], 8
mov byte [ebp - 4], 0x3f
jne 0x6ab318
mov eax, dword [eax + 8]
jmp 0x6ab31d
mov eax, 0xbdd488
mov ecx, dword [ebp - 0x14]
push 0xffffffffffffffff
add ecx, 0x30
push eax
call fcn.004674e6
lea eax, [ebp - 0x74]
push eax
mov byte [ebp - 4], 0x3b
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab343
push eax
call fcn.00a6ef01
lea ecx, [ebp - 0x24]
call fcn.004027e9
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
mov byte [ebp - 4], 0x27
je 0x6ab360
add eax, 0xfffffff4
push eax
call fcn.00403382
pop ecx
push 1
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5a7
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x41
call fcn.00415344
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.006af852
mov esi, eax
lea edx, [esi + 0x70]
mov ecx, edi
call fcn.00416e36
mov dword [esi + 0x78], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab3ce
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5a9
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x43
call fcn.00415344
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.006af852
mov esi, eax
lea edx, [esi + 0x7c]
mov ecx, edi
call fcn.00416e36
mov dword [esi + 0x84], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab43e
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5aa
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x45
call fcn.00415344
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.006af852
mov esi, eax
lea edx, [esi + 0x88]
mov ecx, edi
call fcn.00416e36
mov dword [esi + 0x90], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab4b1
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5ab
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x47
call fcn.00415344
add eax, 0x64
push eax
push ebx
call fcn.006afdae
mov esi, 0x8c
add esp, 0x10
cmp eax, esi
mov ecx, eax
jl 0x6ab505
mov ecx, esi
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x94]
mov edi, eax
call fcn.00416e36
mov dword [edi + 0x9c], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab533
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5ac
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x49
call fcn.00415344
add eax, 0x64
push eax
push ebx
call fcn.006afdae
add esp, 0x10
cmp eax, esi
mov ecx, eax
jl 0x6ab582
mov ecx, esi
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0xa0]
mov edi, eax
call fcn.00416e36
mov dword [edi + 0xa8], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab5b0
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5ad
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x4b
call fcn.00415344
add eax, 0x64
push eax
push ebx
call fcn.006afdae
add esp, 0x10
cmp eax, esi
jge 0x6ab5fd
mov esi, eax
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0xac]
mov ecx, esi
mov edi, eax
call fcn.00416e36
mov dword [edi + 0xb4], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab62d
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5ae
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x4d
call fcn.00415344
push eax
push ebx
call fcn.006afdae
mov esi, 0x7cf
add esp, 0x10
cmp eax, esi
mov ecx, eax
jl 0x6ab67e
mov ecx, esi
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0xb8]
mov edi, eax
call fcn.00416e36
mov dword [edi + 0xc0], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab6ac
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5af
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x4f
call fcn.00415344
push eax
push ebx
call fcn.006afdae
add esp, 0x10
cmp eax, esi
mov ecx, eax
jl 0x6ab6f8
mov ecx, esi
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0xc4]
mov edi, eax
call fcn.00416e36
mov dword [edi + 0xcc], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab726
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5b0
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x51
call fcn.00415344
push eax
push ebx
call fcn.006afdae
add esp, 0x10
cmp eax, esi
mov ecx, eax
jl 0x6ab772
mov ecx, esi
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0xd0]
mov edi, eax
call fcn.00416e36
mov dword [edi + 0xd8], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab7a0
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5b1
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x53
call fcn.00415344
push eax
push ebx
call fcn.006afdae
add esp, 0x10
cmp eax, esi
jge 0x6ab7ea
mov esi, eax
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0xdc]
mov ecx, esi
mov edi, eax
call fcn.00416e36
mov dword [edi + 0xe4], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab81a
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5b2
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x55
call fcn.00415344
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.006af852
mov esi, eax
lea edx, [esi + 0xe8]
mov ecx, edi
call fcn.00416e36
mov dword [esi + 0xf0], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab88d
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5b3
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x57
call fcn.00415344
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.006af852
mov esi, eax
lea edx, [esi + 0xf4]
mov ecx, edi
call fcn.00416e36
mov dword [esi + 0xfc], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab900
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5b4
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x59
call fcn.00415344
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.006af852
mov esi, eax
lea edx, [esi + 0x100]
mov ecx, edi
call fcn.00416e36
mov dword [esi + 0x108], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab973
push eax
call fcn.00a6ef01
push 1
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5b5
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x5b
call fcn.00415344
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.006af852
mov esi, eax
lea edx, [esi + 0x10c]
mov ecx, edi
call fcn.00416e36
mov dword [esi + 0x114], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ab9e7
push eax
call fcn.00a6ef01
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5b6
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], 0x5d
call fcn.00402c26
cmp eax, ebx
pop ecx
pop ecx
jge 0x6aba33
push eax
call fcn.00a6ef01
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6aba4b
push eax
call fcn.00a6ef01
cmp word [ebp - 0xe0], 8
mov eax, dword [ebp - 0xd8]
je 0x6aba60
mov eax, 0xbdd488
mov ecx, dword [ebp - 0x14]
add ecx, 0x118
push ecx
push eax
call fcn.006ad158
test eax, eax
pop ecx
pop ecx
jne 0x6abb87
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], 0x26
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6aba95
push eax
call fcn.00a6ef01
lea eax, [ebp - 0x140]
push eax
mov byte [ebp - 4], 0x24
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6abab0
push eax
call fcn.00a6ef01
lea eax, [ebp - 0x120]
push eax
mov byte [ebp - 4], 0x22
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6abacb
push eax
call fcn.00a6ef01
lea eax, [ebp - 0x130]
push eax
mov byte [ebp - 4], 0x20
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6abae6
push eax
call fcn.00a6ef01
lea eax, [ebp - 0x100]
push eax
mov byte [ebp - 4], 0x1e
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6abb01
push eax
call fcn.00a6ef01
lea eax, [ebp - 0x110]
push eax
mov byte [ebp - 4], 8
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6abb1c
push eax
call fcn.00a6ef01
lea eax, [ebp - 0xa0]
push eax
mov byte [ebp - 4], 6
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6abb37
push eax
call fcn.00a6ef01
cmp dword [ebp - 0x14], ebx
mov byte [ebp - 4], 5
je 0x6abb4c
push ebx
lea ecx, [ebp - 0x18]
call fcn.006af99f
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x38]
cmp eax, ebx
mov byte [ebp - 4], 4
je 0x6abb5d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
cmp eax, ebx
mov byte [ebp - 4], bl
je 0x6abb6d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x6ad141
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x6ad141
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5b7
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x5f
call fcn.00415344
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.006af852
mov dword [eax + 0x138], esi
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6abbeb
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5b8
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x61
call fcn.00415344
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.006af852
mov dword [eax + 0x13c], esi
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6abc4f
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x1582
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x63
call fcn.00415344
mov esi, eax
pop ecx
neg esi
pop ecx
sbb esi, esi
lea ecx, [ebp - 0x18]
neg esi
call fcn.006af852
mov edi, eax
lea edx, [edi + 0x140]
mov ecx, esi
call fcn.006131b9
mov dword [edi + 0x148], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6abcc8
push eax
call fcn.00a6ef01
cmp dword [ebp + 8], 0x9402a9
je 0x6abce3
cmp dword [ebp + 8], 0x9402aa
je 0x6abce3
cmp dword [ebp + 8], 0x9402ab
jne 0x6abcfc
mov eax, dword [ebp - 0x14]
push 1
lea edx, [eax + 0x140]
pop ecx
mov esi, eax
call fcn.006131b9
mov dword [esi + 0x148], eax
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5bc
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x65
call fcn.00415344
mov esi, eax
pop ecx
neg esi
pop ecx
sbb esi, esi
lea ecx, [ebp - 0x18]
neg esi
call fcn.006af852
mov edi, eax
lea edx, [edi + 0x170]
mov ecx, esi
call fcn.006131b9
mov dword [edi + 0x178], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6abd75
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5bd
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x67
call fcn.00415344
mov esi, eax
pop ecx
neg esi
pop ecx
sbb esi, esi
lea ecx, [ebp - 0x18]
neg esi
call fcn.006af852
mov edi, eax
lea edx, [edi + 0x17c]
mov ecx, esi
call fcn.006131b9
mov dword [edi + 0x184], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6abdee
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0xa5f
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x69
call fcn.00415344
mov esi, eax
pop ecx
neg esi
pop ecx
sbb esi, esi
lea ecx, [ebp - 0x18]
neg esi
call fcn.006af852
mov edi, eax
lea edx, [edi + 0x158]
mov ecx, esi
call fcn.006131b9
mov dword [edi + 0x160], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6abe67
push eax
call fcn.00a6ef01
push ecx
fld1
push ecx
fstp qword [esp]
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5be
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x6b
call fcn.00443ba9
fstp qword [ebp - 0x20]
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.006af852
fld qword [ebp - 0x20]
fstp qword [eax + 0x150]
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6abed6
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0xa94
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x6d
call fcn.00415344
mov esi, eax
pop ecx
neg esi
pop ecx
sbb esi, esi
lea ecx, [ebp - 0x18]
neg esi
call fcn.006af852
mov edi, eax
lea edx, [edi + 0x188]
mov ecx, esi
call fcn.006131b9
mov dword [edi + 0x190], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6abf4f
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x155e
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x6f
call fcn.00415344
mov esi, eax
pop ecx
neg esi
pop ecx
sbb esi, esi
lea ecx, [ebp - 0x18]
neg esi
call fcn.006af852
mov edi, eax
lea edx, [edi + 0x194]
mov ecx, esi
call fcn.006131b9
mov dword [edi + 0x19c], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6abfc8
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0xae6
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x71
call fcn.00415344
mov esi, eax
pop ecx
neg esi
pop ecx
sbb esi, esi
lea ecx, [ebp - 0x18]
neg esi
call fcn.006af852
mov dword [eax + 0x1a0], esi
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ac032
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0xba9
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x73
call fcn.00415344
mov esi, eax
pop ecx
neg esi
pop ecx
sbb esi, esi
lea ecx, [ebp - 0x18]
neg esi
call fcn.006af852
mov edi, eax
lea edx, [edi + 0x1a4]
mov ecx, esi
call fcn.006131b9
mov dword [edi + 0x1ac], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ac0ab
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5b9
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x75
call fcn.00415344
mov esi, eax
pop ecx
neg esi
pop ecx
sbb esi, esi
lea ecx, [ebp - 0x18]
neg esi
call fcn.006af852
mov edi, eax
lea edx, [edi + 0x1e0]
mov ecx, esi
call fcn.006131b9
mov dword [edi + 0x1e8], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ac124
push eax
call fcn.00a6ef01
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0xba29ac
call fcn.0040339f
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x77
call fcn.00415344
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.006af852
mov esi, eax
lea edx, [esi + 0x1ec]
mov ecx, edi
call fcn.00416e36
mov dword [esi + 0x1f4], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ac18f
push eax
call fcn.00a6ef01
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0xba2990
call fcn.0040339f
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x79
call fcn.00415344
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.006af852
mov esi, eax
lea edx, [esi + 0x1f8]
mov ecx, edi
call fcn.00416e36
mov dword [esi + 0x200], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ac1fa
push eax
call fcn.00a6ef01
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0xba2978
call fcn.0040339f
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x7b
call fcn.00415344
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.006af852
mov esi, eax
lea edx, [esi + 0x1b0]
mov ecx, edi
call fcn.00416e36
mov dword [esi + 0x1b8], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ac265
push eax
call fcn.00a6ef01
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0xba2954
call fcn.0040339f
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x7d
call fcn.00415344
mov esi, eax
pop ecx
neg esi
pop ecx
sbb esi, esi
lea ecx, [ebp - 0x18]
neg esi
call fcn.006af852
mov edi, eax
lea edx, [edi + 0x298]
mov ecx, esi
call fcn.006131b9
mov dword [edi + 0x2a0], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ac2d6
push eax
call fcn.00a6ef01
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0xba292c
call fcn.0040339f
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x7f
call fcn.00415344
mov esi, eax
pop ecx
neg esi
pop ecx
sbb esi, esi
lea ecx, [ebp - 0x18]
neg esi
call fcn.006af852
mov dword [eax + 0x2a8], esi
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ac338
push eax
call fcn.00a6ef01
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0xba291c
call fcn.0040339f
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x81
call fcn.00415344
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.006af852
mov esi, eax
lea edx, [esi + 0x1bc]
mov ecx, edi
call fcn.00416e36
mov dword [esi + 0x1c4], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ac3a3
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5ba
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x83
call fcn.00415344
mov esi, eax
pop ecx
neg esi
pop ecx
sbb esi, esi
lea ecx, [ebp - 0x18]
neg esi
call fcn.006af852
mov edi, eax
lea edx, [edi + 0x1c8]
mov ecx, esi
call fcn.00416e36
mov dword [edi + 0x1d0], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ac41c
push eax
call fcn.00a6ef01
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x5bb
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x85
call fcn.00415344
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.006af852
mov esi, eax
lea edx, [esi + 0x1d4]
mov ecx, edi
call fcn.00416e36
mov dword [esi + 0x1dc], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x27
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ac48f
push eax
call fcn.00a6ef01
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0xa5f
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x27
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
mov ecx, eax
mov byte [ebp - 4], 0x87
call fcn.004032b2
cmp eax, ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x5c], ebx
je 0x6ac4f2
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x5c]
call fcn.004053ee
cmp eax, ebx
jge 0x6ac4f2
cmp eax, 0x80004002
je 0x6ac4f2
push eax
call fcn.00a6ef01
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x89
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ac50a
push eax
call fcn.00a6ef01
cmp dword [ebp - 0x5c], ebx
je 0x6ac5a5
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x1552
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x89
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x8b
call fcn.00415344
mov esi, eax
lea eax, [ebp - 0x74]
push eax
mov byte [ebp - 4], 0x89
call fcn.004029b7
add esp, 0xc
cmp eax, ebx
jge 0x6ac569
push eax
call fcn.00a6ef01
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp esi, ebx
setne cl
lea edx, [eax + 0x158]
mov edi, eax
call fcn.006131b9
mov dword [edi + 0x160], eax
mov eax, dword [ebp - 0x14]
shr esi, 1
and esi, 1
lea edx, [eax + 0x164]
mov ecx, esi
mov edi, eax
call fcn.006131b9
mov dword [edi + 0x16c], eax
jmp 0x6ac5bd
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x158]
xor ecx, ecx
mov esi, eax
call fcn.006131b9
mov dword [esi + 0x160], eax
mov eax, dword [ebp + 8]
push 0x64
xor edx, edx
pop ecx
div ecx
cmp eax, 0x1776f
je 0x6ac602
cmp eax, 0x17779
je 0x6ac602
cmp eax, 0x17783
je 0x6ac602
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, 0x2710
div ecx
cmp eax, 0x3c1
mov eax, dword [ebp - 0x14]
mov esi, eax
lea edx, [eax + 0x210]
jne 0x6ac5fe
push 1
jmp 0x6ac60f
xor ecx, ecx
jmp 0x6ac610
mov eax, dword [ebp - 0x14]
mov esi, eax
lea edx, [eax + 0x210]
push 2
pop ecx
call fcn.00416e36
mov dword [esi + 0x218], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x230], ebx
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x22c], ebx
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x228], ebx
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x224], ebx
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.oleaut32.dll_VariantInit]
cmp dword [ebp - 0x38], ebx
mov byte [ebp - 4], 0x8c
mov edi, 0x80004003
jne 0x6ac660
push edi
call fcn.00a6ef01
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x48]
push eax
call fcn.00403baa
push eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x8d
call fcn.00403606
mov eax, dword [ebp - 0x48]
cmp eax, ebx
mov byte [ebp - 4], 0x8f
je 0x6ac68a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x60], ebx
mov esi, 0x157d
cmp dword [ebp - 0x50], ebx
jne 0x6ac69d
push edi
call fcn.00a6ef01
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax]
lea edx, [ebp - 0x60]
push edx
lea edx, [ebp - 0xb0]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x6ac84e
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040654e
pop ecx
pop ecx
lea eax, [ebp - 0x4c]
push 0x3d5
push eax
mov byte [ebp - 4], 0x90
call fcn.007a48d0
mov ecx, eax
call fcn.0040634c
mov ecx, dword [ebp - 0x24]
cmp ecx, ebx
mov eax, dword [eax]
je 0x6ac6f3
mov ecx, dword [ecx]
jmp 0x6ac6f5
xor ecx, ecx
push 6
push eax
push ecx
call fcn.00a72346
add esp, 0xc
neg eax
sbb al, al
inc al
lea ecx, [ebp - 0x4c]
mov byte [ebp + 0xb], al
call fcn.0040265e
cmp byte [ebp + 0xb], bl
je 0x6ac720
mov eax, dword [ebp - 0x14]
inc dword [eax + 0x224]
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.0040634c
mov ecx, dword [ebp - 0x24]
cmp ecx, ebx
mov eax, dword [eax]
je 0x6ac73e
mov ecx, dword [ecx]
jmp 0x6ac740
xor ecx, ecx
push 5
push eax
push ecx
call fcn.00a72346
add esp, 0xc
neg eax
sbb al, al
inc al
lea ecx, [ebp - 0x54]
mov byte [ebp + 0xb], al
call fcn.0040265e
cmp byte [ebp + 0xb], bl
je 0x6ac770
mov eax, dword [ebp - 0x14]
inc dword [eax + 0x228]
jmp 0x6ac822
lea eax, [ebp - 0x3c]
push 0x38f
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.0040634c
mov ecx, dword [ebp - 0x24]
cmp ecx, ebx
mov eax, dword [eax]
je 0x6ac792
mov ecx, dword [ecx]
jmp 0x6ac794
xor ecx, ecx
push 3
push eax
push ecx
call fcn.00a72346
add esp, 0xc
neg eax
sbb al, al
inc al
lea ecx, [ebp - 0x3c]
mov byte [ebp + 0xb], al
call fcn.0040265e
cmp byte [ebp + 0xb], bl
je 0x6ac7c5
lea ecx, [ebp - 0x18]
call fcn.006af852
add eax, 0x230
jmp 0x6ac820
lea eax, [ebp - 0x44]
push 0x156a
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.0040634c
push 3
mov ecx, eax
mov byte [ebp - 4], 0x91
call fcn.00414b5f
push eax
lea ecx, [ebp - 0x24]
call fcn.0040b42d
push eax
call fcn.00a72346
add esp, 0xc
neg eax
sbb al, al
inc al
lea ecx, [ebp - 0x44]
mov byte [ebp + 0xb], al
mov byte [ebp - 4], 0x90
call fcn.0040265e
cmp byte [ebp + 0xb], bl
je 0x6ac822
lea ecx, [ebp - 0x18]
call fcn.006af852
add eax, 0x22c
inc dword [eax]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x8f
call fcn.004033b1
lea eax, [ebp - 0xb0]
push eax
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ac692
push eax
call fcn.00a6ef01
jmp 0x6ac692
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push esi
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x8f
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
mov ecx, eax
mov byte [ebp - 4], 0x93
call fcn.004032b2
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x78]
call fcn.00432ea9
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x95
call fcn.00403ab5
push ebx
lea ecx, [ebp - 0x78]
call fcn.00548056
test al, al
je 0x6ac8d0
push ecx
lea eax, [ebp - 0x78]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.00429411
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x95
call fcn.006af852
mov ecx, eax
call fcn.006aebfa
push ebx
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push 0xd89
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x95
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x98
call fcn.00415344
mov esi, eax
pop ecx
neg esi
pop ecx
sbb esi, esi
lea ecx, [ebp - 0x18]
neg esi
call fcn.006af852
lea ecx, [ebp - 0x8c]
mov dword [eax + 0x208], esi
mov byte [ebp - 4], 0x95
call fcn.00403ab5
push ebx
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push 0xd8a
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x95
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0x9a
call fcn.00415344
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.006af852
lea ecx, [ebp - 0x8c]
mov dword [eax + 0x20c], esi
mov byte [ebp - 4], 0x95
call fcn.00403ab5
lea ecx, [ebp - 0x18]
call fcn.006af852
cmp dword [eax + 0x208], ebx
je 0x6aca9f
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0xf03
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x95
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
mov ecx, eax
mov byte [ebp - 4], 0x9c
call fcn.004032b2
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp + 8]
call fcn.00432ea9
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x9e
call fcn.00403ab5
lea ecx, [ebp + 8]
call fcn.0054804e
test al, al
je 0x6aca93
xor edi, edi
mov esi, 0x7fffffff
push 0x20
pop eax
call fcn.00a70270
mov eax, esp
push esi
push eax
push edi
call fcn.004150a7
pop ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0040339f
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x9e
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0xa0
call fcn.00415344
pop ecx
pop ecx
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0x9e
call fcn.00403ab5
cmp dword [ebp - 0x24], esi
je 0x6aca93
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
call fcn.006af852
mov ecx, eax
add ecx, 0x21c
call fcn.006af824
inc edi
jmp 0x6aca1a
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x95
call fcn.0040262e
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0xe1c
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x95
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
mov ecx, eax
mov byte [ebp - 4], 0xa2
call fcn.004032b2
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x7c]
call fcn.00432ea9
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0xa4
call fcn.00403ab5
push ebx
lea ecx, [ebp - 0x7c]
call fcn.00548056
test al, al
je 0x6acb53
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0xe1d
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0xa4
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
mov dword [ebp - 0x90], 1
push eax
mov byte [ebp - 4], 0xa6
call fcn.00415344
pop ecx
pop ecx
mov esi, eax
jmp 0x6acb55
xor esi, esi
lea ecx, [ebp - 0x18]
call fcn.006af852
test byte [ebp - 0x90], 1
mov dword [eax + 0x220], esi
mov dword [ebp - 4], 0xa4
je 0x6acb7b
lea ecx, [ebp - 0x74]
call fcn.00403ab5
push ebx
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0xf04
push eax
call fcn.007a48d0
mov ecx, eax
call fcn.00406368
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xa4
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
mov ecx, eax
mov byte [ebp - 4], 0xa8
call fcn.004032b2
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.00432ea9
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0xaa
call fcn.00403ab5
lea ecx, [ebp - 0x64]
call fcn.0054804e
test al, al
je 0x6acca5
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x64]
call fcn.0040263b
mov ecx, eax
call fcn.00403baa
push eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0xab
call fcn.006afdbd
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xaa
call fcn.00402621
mov dword [ebp - 0x60], ebx
lea ecx, [ebp - 0x50]
call fcn.005c6a0a
mov ecx, dword [eax]
lea edx, [ebp - 0x60]
push edx
lea edx, [ebp - 0xb0]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x6acca5
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push dword [ebp - 0xa8]
call fcn.0040339f
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0xaa
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0xad
call fcn.00415344
pop ecx
pop ecx
lea ecx, [ebp - 0x8c]
mov dword [ebp + 8], eax
mov byte [ebp - 4], 0xaa
call fcn.00403ab5
push 0xffffffffffffffff
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.006af852
mov ecx, eax
add ecx, 0x2a4
call fcn.0048102b
lea ecx, [ebp - 0xb0]
call fcn.0060311e
jmp 0x6acc11
lea ecx, [ebp - 0x18]
call fcn.006af852
or dword [eax + 0x294], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.006af852
mov ecx, eax
add ecx, 0x28c
call fcn.006afa9f
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
mov edi, 0xba2910
push edi
call fcn.0040339f
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xaa
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
mov ecx, eax
mov byte [ebp - 4], 0xaf
call fcn.004032b2
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x58]
call fcn.00432ea9
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0xb1
call fcn.00403ab5
lea ecx, [ebp - 0x58]
call fcn.0054804e
test al, al
je 0x6acfc2
push ebx
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push 0xba28f8
call fcn.0040339f
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xb1
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
push eax
mov byte [ebp - 4], 0xb3
call fcn.00415344
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.006af852
lea ecx, [ebp - 0x74]
mov dword [eax + 0x294], esi
mov byte [ebp - 4], 0xb1
call fcn.00403ab5
xor esi, esi
push 0x20
pop eax
call fcn.00a70270
mov eax, esp
push ebx
push ebx
push eax
push esi
call fcn.004150a7
pop ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0040339f
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xb1
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
mov ecx, eax
mov byte [ebp - 4], 0xb5
call fcn.004032b2
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp + 8]
call fcn.00432ea9
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0xb7
call fcn.00403ab5
push ebx
lea ecx, [ebp + 8]
call fcn.004149f1
test al, al
jne 0x6ace20
push 0xffffffffffffffff
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00429411
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xb7
call fcn.006af852
mov ecx, eax
call fcn.006ad240
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xb1
call fcn.0040262e
inc esi
jmp 0x6acd81
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xb1
call fcn.0040262e
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push 0xba28f0
call fcn.0040339f
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xb1
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
mov ecx, eax
mov byte [ebp - 4], 0xba
call fcn.004032b2
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x44]
call fcn.00432ea9
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0xbc
call fcn.00403ab5
lea ecx, [ebp - 0x44]
call fcn.0054804e
test al, al
je 0x6acea9
push ecx
lea eax, [ebp - 0x44]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.00429411
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xbc
call fcn.006af852
mov ecx, eax
call fcn.006ad47d
mov dword [ebp - 0x3c], ebx
mov esi, 0xbdd9b4
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.00405351
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0xbc
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
mov ecx, eax
mov byte [ebp - 4], 0xbf
call fcn.004032b2
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x24]
call fcn.00432ea9
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0xc1
call fcn.00403ab5
lea ecx, [ebp - 0x24]
call fcn.0054804e
test al, al
je 0x6acf9c
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edi
call fcn.0040339f
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xc1
call fcn.0040263b
mov ecx, eax
call fcn.00403ac7
mov ecx, eax
mov byte [ebp - 4], 0xc3
call fcn.004032b2
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp + 8]
call fcn.00432ea9
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0xc5
call fcn.00403ab5
lea ecx, [ebp + 8]
call fcn.0054804e
test al, al
je 0x6acf94
push dword [ebp - 0x3c]
lea eax, [ebp + 8]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00429411
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xc5
call fcn.006af852
mov ecx, eax
call fcn.006ad240
lea ecx, [ebp + 8]
call fcn.0040262e
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xbc
call fcn.0040262e
inc dword [ebp - 0x3c]
add esi, 4
cmp esi, 0xbdda54
jl 0x6aceb1
lea ecx, [ebp - 0x44]
call fcn.0040262e
lea ecx, [ebp - 0x58]
call fcn.0040262e
lea ecx, [ebp - 0x64]
call fcn.0040262e
lea ecx, [ebp - 0x7c]
call fcn.0040262e
lea ecx, [ebp - 0x78]
call fcn.0040262e
lea ecx, [ebp - 0x50]
call fcn.00402651
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x89
call fcn.00403ab5
lea ecx, [ebp - 0x5c]
call fcn.0040262e
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 0x26
call fcn.00403ab5
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 0x24
call fcn.00403ab5
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x22
call fcn.00403ab5
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x20
call fcn.00403ab5
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0x1e
call fcn.00403ab5
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 8
call fcn.00403ab5
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 6
call fcn.00403ab5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.006af83c
lea ecx, [ebp - 0x38]
call fcn.0040262e
lea ecx, [ebp - 0x10]
call fcn.0040262e
lea ecx, [ebp + 0xc]
call fcn.0040262e
push 1
pop eax
jmp 0x6ad143
lea eax, [ebp - 0x120]
push eax
mov byte [ebp - 4], 0x22
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ad0b1
push eax
call fcn.00a6ef01
lea eax, [ebp - 0x130]
push eax
mov byte [ebp - 4], 0x20
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ad0cc
push eax
call fcn.00a6ef01
lea eax, [ebp - 0x100]
push eax
mov byte [ebp - 4], 0x1e
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ad0e7
push eax
call fcn.00a6ef01
lea eax, [ebp - 0x110]
push eax
mov byte [ebp - 4], 8
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ad102
push eax
call fcn.00a6ef01
lea eax, [ebp - 0xa0]
push eax
mov byte [ebp - 4], 6
call fcn.004029b7
cmp eax, ebx
pop ecx
jge 0x6ad11d
push eax
call fcn.00a6ef01
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.006af8ea
lea ecx, [ebp - 0x38]
call fcn.004027e9
lea ecx, [ebp - 0x10]
call fcn.004027e9
lea ecx, [ebp + 0xc]
call fcn.004027e9
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x14c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret