Function at 0x5272dc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1b
push 0
push 0
dec ecx
jne 0x5272e4
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5293f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x688754]
mov byte [eax], 2
mov eax, dword [0x688994]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov eax, dword [eax + 0xf0]
add eax, 0xa0
mov edx, dword [0x688994]
add eax, dword [edx]
push eax
lea eax, [ebp - 0x94]
push eax
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xec]
add ecx, 0xc0
mov eax, dword [0x6889bc]
add ecx, dword [eax]
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov edx, dword [eax + 0xf0]
add edx, 0xa0
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov eax, dword [eax + 0xec]
add eax, 0xc0
call fcn.004819d4
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
push eax
push 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
xor ecx, ecx
xor edx, edx
call fcn.00486038
mov eax, dword [0x6889bc]
cmp dword [eax], 0x400
jne 0x5273c3
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov edx, 0xffffff40
sub edx, dword [eax + 0xec]
add edx, 0x1e
add edx, 0xe
mov dword [ebp - 0x30], edx
jmp 0x5273db
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov edx, 0xfffffee0
sub edx, dword [eax + 0xec]
add edx, 0x1e
mov dword [ebp - 0x30], edx
mov eax, dword [0x688994]
cmp dword [eax], 0x300
jne 0x5273ff
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov edx, 0xffffff80
sub edx, dword [eax + 0xf0]
mov dword [ebp - 0x34], edx
jmp 0x527414
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov edx, 0xffffff20
sub edx, dword [eax + 0xf0]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x34], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0x38], edx
mov eax, dword [ebp - 0x34]
sub eax, 0x20
mov dword [ebp - 0x20], eax
xor edx, edx
push ebp
push 0x5278b1
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x6890a8]
mov eax, dword [eax]
mov eax, dword [eax + 0xa6f85]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa8]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
mov edx, dword [edx + 0xa6f8d]
mov ecx, dword [0x6890a8]
mov ecx, dword [ecx]
sub edx, dword [ecx + 0xa6fa8]
add edx, 0x23
sub edx, eax
jl 0x5278a7
inc edx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x527495
add dword [ebp - 0x20], 0x20
jmp 0x52789b
mov edi, dword [ebp - 0x30]
sub edi, 0x60
mov eax, dword [0x6890a8]
mov eax, dword [eax]
mov eax, dword [eax + 0xa6f81]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa4]
sub eax, 2
mov edx, dword [0x6890a8]
mov edx, dword [edx]
mov edx, dword [edx + 0xa6f89]
mov ecx, dword [0x6890a8]
mov ecx, dword [ecx]
sub edx, dword [ecx + 0xa6fa4]
add edx, 2
sub edx, eax
jl 0x527897
inc edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x527885
cmp dword [ebp - 0x10], 0x5a
jge 0x527885
cmp dword [ebp - 0x14], 0
jl 0x527885
cmp dword [ebp - 0x14], 0x5a
jge 0x527885
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x6890a8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*8]
movzx ecx, word [eax + edx*4 + 0xe]
test ecx, ecx
jle 0x52773f
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x6890a8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*8]
cmp byte [eax + edx*4 + 0x20], 0
jbe 0x52773f
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x6890a8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*8]
movzx ebx, byte [eax + edx*4 + 0x20]
mov byte [ebp - 0x5d], 0
test ebx, 0x80
jle 0x52758a
mov byte [ebp - 0x5d], 1
and ebx, 0x7f
test ebx, ebx
jle 0x5275f6
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x6890a8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*8]
movzx eax, word [eax + edx*4 + 0x1e]
shr eax, 0xc
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov edx, ebx
imul edx, dword [ebp - 0x3c]
add ebx, edx
cdq
idiv ebx
mov eax, edx
mov edx, dword [ebp - 0x3c]
inc edx
mov ebx, edx
cdq
idiv ebx
imul edx, dword [ebp - 0x10], 0x441
mov ebx, dword [0x6890a8]
mov ebx, dword [ebx]
lea edx, [ebx + edx*4]
mov ebx, dword [ebp - 0x14]
lea ebx, [ebx + ebx*8]
movzx edx, word [edx + ebx*4 + 0x1e]
and dx, 0xfff
movzx edx, dx
imul edx
add ecx, eax
dec ecx
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x6890a8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*8]
movzx eax, byte [eax + edx*4 + 0x19]
cmp eax, 5
ja case.0x52761d.0
jmp dword [eax*4 + 0x527624]
lea eax, [ebp - 0x50]
push eax
mov eax, dword [0x6887c4]
mov eax, dword [eax]
lea edx, [ebp - 0x4c]
xchg ecx, edx
call fcn.0048ea88
mov ebx, eax
jmp 0x5276d0
lea eax, [ebp - 0x50]
push eax
mov eax, dword [0x6882dc]
mov eax, dword [eax]
lea edx, [ebp - 0x4c]
xchg ecx, edx
call fcn.0048ea88
mov ebx, eax
jmp 0x5276d0
lea eax, [ebp - 0x50]
push eax
mov eax, dword [0x688e08]
mov eax, dword [eax]
lea edx, [ebp - 0x4c]
xchg ecx, edx
call fcn.0048ea88
mov ebx, eax
jmp 0x5276d0
lea eax, [ebp - 0x50]
push eax
mov eax, dword [0x688560]
mov eax, dword [eax]
lea edx, [ebp - 0x4c]
xchg ecx, edx
call fcn.0048ea88
mov ebx, eax
jmp 0x5276d0
lea eax, [ebp - 0x50]
push eax
mov eax, dword [0x68843c]
mov eax, dword [eax]
lea edx, [ebp - 0x4c]
xchg ecx, edx
call fcn.0048ea88
mov ebx, eax
jmp 0x5276d0
lea eax, [ebp - 0x50]
push eax
mov eax, dword [0x688aec]
mov eax, dword [eax]
lea edx, [ebp - 0x4c]
xchg ecx, edx
call fcn.0048ea88
mov ebx, eax
test ebx, ebx
je 0x52773f
cmp byte [ebp - 0x5d], 0
je 0x5276fb
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x24], eax
push ebx
push 1
mov edx, dword [ebp - 0x4c]
add edx, edi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
call fcn.005b31f4
jmp 0x52773f
mov eax, ebx
mov si, 0xfff8
call fcn.00404528
mov edx, dword [ebp - 0x20]
add edx, 0x20
sub edx, eax
add edx, dword [ebp - 0x50]
mov dword [ebp - 0x24], edx
lea edx, [ebp - 0x94]
mov eax, ebx
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
push ebx
push 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
mov edx, edi
call fcn.00486038
imul edx, dword [ebp - 0x10], 0x441
mov ecx, dword [0x6890a8]
mov ecx, dword [ecx]
lea edx, [ecx + edx*4]
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*8]
movzx ecx, word [edx + eax*4 + 0x1a]
and cx, 0x7fff
movzx ecx, cx
test ecx, ecx
jle 0x527885
imul edx, dword [ebp - 0x10], 0x441
mov ebx, dword [0x6890a8]
mov ebx, dword [ebx]
lea edx, [ebx + edx*4]
movzx ebx, byte [edx + eax*4 + 0x21]
mov byte [ebp - 0x5d], 0
test ebx, 0x80
jle 0x527796
mov byte [ebp - 0x5d], 1
and ebx, 0x7f
test ebx, ebx
jle 0x5277fe
imul edx, dword [ebp - 0x10], 0x441
mov esi, dword [0x6890a8]
mov esi, dword [esi]
lea edx, [esi + edx*4]
push edx
pop edx
movzx eax, word [edx + eax*4 + 0x22]
shr eax, 0xc
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov edx, ebx
imul edx, dword [ebp - 0x3c]
add ebx, edx
cdq
idiv ebx
mov eax, edx
mov edx, dword [ebp - 0x3c]
inc edx
mov ebx, edx
cdq
idiv ebx
imul edx, dword [ebp - 0x10], 0x441
mov ebx, dword [0x6890a8]
mov ebx, dword [ebx]
lea edx, [ebx + edx*4]
mov ebx, dword [ebp - 0x14]
lea ebx, [ebx + ebx*8]
movzx edx, word [edx + ebx*4 + 0x22]
and dx, 0xfff
movzx edx, dx
imul edx
add ecx, eax
dec ecx
lea eax, [ebp - 0x50]
push eax
mov eax, dword [0x6887ec]
mov eax, dword [eax]
lea edx, [ebp - 0x4c]
xchg ecx, edx
call fcn.0048ea88
mov ebx, eax
test ebx, ebx
je 0x527885
cmp byte [ebp - 0x5d], 0
je 0x527841
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x24], eax
push ebx
push 1
mov edx, dword [ebp - 0x4c]
add edx, edi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
call fcn.005b31f4
jmp 0x527885
mov eax, ebx
mov si, 0xfff8
call fcn.00404528
mov edx, dword [ebp - 0x20]
add edx, 0x20
sub edx, eax
add edx, dword [ebp - 0x50]
mov dword [ebp - 0x24], edx
lea edx, [ebp - 0x94]
mov eax, ebx
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
push ebx
push 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
mov edx, edi
call fcn.00486038
add edi, 0x30
inc dword [ebp - 0x10]
dec dword [ebp - 0x84]
jne 0x5274ea
add dword [ebp - 0x20], 0x20
inc dword [ebp - 0x14]
dec dword [ebp - 0x80]
jne 0x527486
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5278bb
mov eax, dword [ebp - 0x34]
sub eax, 0x20
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x7c], eax
xor edx, edx
push ebp
push 0x528ed5
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0x10]
lea ebx, [ebx + ebx*2]
mov eax, dword [ebp - 8]
mov eax, dword [eax + ebx*8 + 0x44]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + ebx*8 + 0x48]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + ebx*8 + 0x50]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + ebx*8 + 0x4c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + ebx*8 + 0x54]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + ebx*8 + 0x58]
mov edx, dword [eax]
call dword [edx + 8]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x29
jne 0x5278dc
mov dword [ebp - 0x7c], 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x420]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x688ad0]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x527a26
mov dword [ebp - 0x10], eax
mov eax, dword [0x688ad0]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x10]
call fcn.0041a308
mov ecx, eax
mov eax, dword [ecx + 4]
mov edx, dword [0x688a9c]
mov edx, dword [edx]
sub eax, dword [edx + 0xc]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xf
jle 0x5279c7
mov eax, dword [ecx + 8]
mov edx, dword [0x688a9c]
mov edx, dword [edx]
sub eax, dword [edx + 0x10]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xf
jle 0x5279c7
cmp byte [ecx + 0x68], 0
jne 0x5279c7
mov eax, ecx
call fcn.0040432c
mov eax, dword [0x688ad0]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x10]
call fcn.0041a1fc
jmp 0x527a26
mov eax, dword [ecx + 8]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa8]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
mov edx, dword [edx + 0xa6f85]
mov ebx, dword [0x6890a8]
mov ebx, dword [ebx]
sub edx, dword [ebx + 0xa6fa8]
sub eax, edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x527a19
cmp dword [ebp - 0x18], 0x28
jg 0x527a19
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x58]
mov edx, ecx
call fcn.0041a1b0
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffff
jne 0x527962
mov dword [ebp - 0x7c], 2
mov eax, dword [0x6883d4]
mov eax, dword [eax]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x527b37
mov dword [ebp - 0x10], eax
mov eax, dword [0x6883d4]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
call fcn.0041a308
mov ebx, eax
mov eax, dword [ebx]
mov edx, dword [0x688a9c]
mov edx, dword [edx]
sub eax, dword [edx + 0xc]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x14
jle 0x527a9e
mov eax, dword [ebx + 4]
mov edx, dword [0x688a9c]
mov edx, dword [edx]
sub eax, dword [edx + 0x10]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x14
jle 0x527a9e
xor edx, edx
mov eax, ebx
call fcn.0057be14
mov eax, dword [0x6883d4]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
call fcn.0041a1fc
jmp 0x527ad8
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub eax, dword [ebx]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xa
jg 0x527b2a
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
sub eax, dword [ebx + 4]
cmp eax, 0xa
jg 0x527b2a
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
sub eax, dword [ebx + 4]
cmp eax, 0xfffffff2
jl 0x527b2a
mov eax, dword [ebx + 4]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa8]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
mov edx, dword [edx + 0xa6f85]
mov ecx, dword [0x6890a8]
mov ecx, dword [ecx]
sub edx, dword [ecx + 0xa6fa8]
sub eax, edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x527b2a
cmp dword [ebp - 0x18], 0x28
jg 0x527b2a
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x44]
mov edx, ebx
call fcn.0041a1b0
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffff
jne 0x527a44
mov dword [ebp - 0x7c], 3
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x424]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x527c99
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x424]
mov edx, dword [ebp - 0x10]
call fcn.0041a308
mov edi, eax
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub eax, dword [edi + 0xc]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xa
jg 0x527c8d
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
sub eax, dword [edi + 0x10]
cmp eax, 0xa
jg 0x527c8d
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
sub eax, dword [edi + 0x10]
cmp eax, 0xfffffff2
jl 0x527c8d
mov eax, dword [edi + 0x154]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa8]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
mov edx, dword [edx + 0xa6f85]
mov ecx, dword [0x6890a8]
mov ecx, dword [ecx]
sub edx, dword [ecx + 0xa6fa8]
sub eax, edx
sub eax, dword [edi + 0x158]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x527c8d
cmp dword [ebp - 0x18], 0x28
jg 0x527c8d
cmp byte [edi + 0x2bd], 0
je 0x527c20
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x420]
mov edx, edi
call fcn.0041a1b0
cmp byte [edi + 0x31], 0
je 0x527c47
mov eax, dword [0x6885e4]
cmp byte [eax + 0x38], 0
jne 0x527c8d
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x4c]
mov edx, edi
call fcn.0041a1b0
jmp 0x527c8d
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x48]
mov edx, edi
call fcn.0041a1b0
cmp byte [edi + 0x134], 0
je 0x527c8d
cmp byte [edi + 0x16], 0
jne 0x527c8d
cmp byte [edi + 0x136], 0
je 0x527c8d
cmp dword [ebp - 0x18], 0
jle 0x527c8d
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x38]
mov edx, edi
call fcn.0041a1b0
inc dword [ebp - 0x10]
dec dword [ebp - 0x80]
jne 0x527b5e
mov dword [ebp - 0x7c], 4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x42c]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x527d29
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x42c]
mov edx, dword [ebp - 0x10]
call fcn.0041a308
mov esi, eax
mov eax, dword [esi + 0x34]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa8]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
mov edx, dword [edx + 0xa6f85]
mov ecx, dword [0x6890a8]
mov ecx, dword [ecx]
sub edx, dword [ecx + 0xa6fa8]
sub eax, edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x527d21
cmp dword [ebp - 0x18], 0x28
jg 0x527d21
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x54]
mov edx, esi
call fcn.0041a1b0
inc dword [ebp - 0x10]
dec dword [ebp - 0x80]
jne 0x527cbc
mov dword [ebp - 0x7c], 5
mov eax, dword [0x6890a8]
mov eax, dword [eax]
mov eax, dword [eax + 0xa6f85]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa8]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
mov edx, dword [edx + 0xa6f8d]
mov ecx, dword [0x6890a8]
mov ecx, dword [ecx]
sub edx, dword [ecx + 0xa6fa8]
add edx, 0x23
sub edx, eax
jl 0x52881c
inc edx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x527d88
add dword [ebp - 0x20], 0x20
jmp 0x528810
mov edi, dword [ebp - 0x30]
sub edi, 0x60
mov eax, dword [0x6890a8]
mov eax, dword [eax]
mov eax, dword [eax + 0xa6f81]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa4]
sub eax, 2
mov edx, dword [0x6890a8]
mov edx, dword [edx]
mov edx, dword [edx + 0xa6f89]
mov ecx, dword [0x6890a8]
mov ecx, dword [ecx]
sub edx, dword [ecx + 0xa6fa4]
add edx, 2
sub edx, eax
jl 0x528156
inc edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x528144
cmp dword [ebp - 0x10], 0x5a
jge 0x528144
cmp dword [ebp - 0x14], 0
jl 0x528144
cmp dword [ebp - 0x14], 0x5a
jge 0x528144
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x6890a8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
mov esi, dword [ebp - 0x14]
lea esi, [esi + esi*8]
movzx ecx, word [eax + esi*4 + 0x10]
and cx, 0x7fff
movzx ecx, cx
test ecx, ecx
jle 0x528144
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x6890a8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
movzx ebx, byte [eax + esi*4 + 0x14]
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x6890a8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
push eax
pop eax
movzx eax, byte [eax + esi*4 + 0x16]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x5d], 0
test ebx, 0x80
jle 0x527e78
mov byte [ebp - 0x5d], 1
and ebx, 0x7f
test ebx, ebx
jle 0x527eb6
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x6890a8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
push eax
pop eax
movzx eax, byte [eax + esi*4 + 0x15]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov edx, ebx
imul edx, dword [ebp - 0x3c]
add ebx, edx
cdq
idiv ebx
mov eax, edx
mov edx, dword [ebp - 0x3c]
inc edx
mov ebx, edx
cdq
idiv ebx
add ecx, eax
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x6890a8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
test byte [eax + esi*4 + 0x13], 0x80
jbe 0x527f0c
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x6890a8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
test byte [eax + esi*4 + 0x12], 0x7f
jbe 0x527f0c
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x6890a8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*8]
movzx eax, byte [eax + edx*4 + 0x13]
and al, 0x7f
movzx eax, al
add ecx, eax
dec ecx
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x4c]
mov edx, ecx
mov ecx, dword [ebp - 0x38]
xchg ecx, eax
call fcn.0057c218
mov ebx, eax
test ebx, ebx
je 0x528144
cmp byte [ebp - 0x5d], 0
je 0x527fbc
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x50]
sub eax, 0x44
mov dword [ebp - 0x24], eax
test edi, edi
jle 0x527f92
mov eax, ebx
mov si, 0xfff8
call fcn.00404528
add eax, dword [ebp - 0x24]
test eax, eax
jle 0x527f92
mov eax, ebx
mov si, 0xfff9
call fcn.00404528
add eax, edi
mov edx, dword [0x6889bc]
cmp eax, dword [edx]
jge 0x527f92
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x58]
jge 0x527f92
push ebx
push 1
mov edx, dword [ebp - 0x4c]
add edx, edi
sub edx, 2
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
call fcn.005b31f4
jmp 0x528144
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x58]
jge 0x528144
push ebx
push 1
mov edx, dword [ebp - 0x4c]
add edx, edi
sub edx, 2
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
call fcn.005b31f4
jmp 0x528144
mov eax, ebx
mov si, 0xfff9
call fcn.00404528
cmp eax, 0x30
jne 0x52809a
mov eax, ebx
mov si, 0xfff8
call fcn.00404528
cmp eax, 0x20
jne 0x52809a
mov eax, ebx
mov si, 0xfff8
call fcn.00404528
mov edx, dword [ebp - 0x20]
add edx, 0x20
sub edx, eax
mov dword [ebp - 0x24], edx
mov eax, ebx
mov si, 0xfff9
call fcn.00404528
add eax, edi
test eax, eax
jle 0x52805e
mov eax, dword [0x6889bc]
cmp edi, dword [eax]
jg 0x52805e
mov eax, ebx
mov si, 0xfff8
call fcn.00404528
add eax, dword [ebp - 0x24]
test eax, eax
jle 0x52805e
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x58]
jge 0x52805e
lea edx, [ebp - 0x94]
mov eax, ebx
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
push ebx
push 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
mov edx, edi
call fcn.00486038
jmp 0x528144
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x58]
jge 0x528144
lea edx, [ebp - 0x94]
mov eax, ebx
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
push ebx
push 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
mov edx, edi
call fcn.00486038
jmp 0x528144
mov eax, ebx
mov si, 0xfff8
call fcn.00404528
mov edx, dword [ebp - 0x20]
add edx, 0x20
sub edx, eax
mov dword [ebp - 0x24], edx
mov eax, ebx
mov si, 0xfff9
call fcn.00404528
add eax, edi
test eax, eax
jle 0x528111
mov eax, dword [0x6889bc]
cmp edi, dword [eax]
jg 0x528111
mov eax, ebx
mov si, 0xfff8
call fcn.00404528
add eax, dword [ebp - 0x24]
test eax, eax
jle 0x528111
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x58]
jge 0x528111
lea edx, [ebp - 0x94]
mov eax, ebx
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
push ebx
push 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
mov edx, edi
call fcn.00486038
jmp 0x528144
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x58]
jge 0x528144
lea edx, [ebp - 0x94]
mov eax, ebx
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
push ebx
push 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
mov edx, edi
call fcn.00486038
add edi, 0x30
inc dword [ebp - 0x10]
dec dword [ebp - 0x84]
jne 0x527ddd
mov eax, dword [0x6890a8]
mov eax, dword [eax]
mov eax, dword [eax + 0xa6f8d]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa8]
cmp eax, dword [ebp - 0x14]
jl 0x52880c
mov eax, dword [0x6882e0]
cmp byte [eax], 0
jne 0x52880c
mov eax, dword [0x6890a8]
mov eax, dword [eax]
mov eax, dword [eax + 0xa6f85]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa8]
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x58]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x528212
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x58]
mov edx, dword [ebp - 0x1c]
call fcn.0041a308
mov ecx, eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ecx + 4]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
shl eax, 4
lea eax, [eax + eax*2]
add eax, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0xc]
xchg ecx, eax
mov si, 0xffff
call fcn.00404528
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x5281c4
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x4c]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x5282fc
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x4c]
mov edx, dword [ebp - 0x1c]
call fcn.0041a308
mov edi, eax
mov eax, dword [edi + 0x150]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
shl eax, 4
lea eax, [eax + eax*2]
add eax, dword [ebp - 0x30]
add eax, dword [edi + 0xec]
add eax, 0x18
mov dword [edi + 0xd4], eax
mov eax, dword [ebp - 0x20]
add eax, 0x20
add eax, dword [edi + 0xf0]
add eax, 0x10
sub eax, 0x3c
mov edx, dword [edi + 0x158]
shl edx, 5
add eax, edx
mov dword [edi + 0xd8], eax
mov eax, dword [edi + 0x150]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
shl eax, 4
lea eax, [eax + eax*2]
add eax, dword [ebp - 0x30]
mov dword [edi + 0xdc], eax
mov eax, dword [edi + 0x158]
shl eax, 5
add eax, dword [ebp - 0x20]
mov dword [edi + 0xe0], eax
cmp byte [edi + 0x2bd], 0
jne 0x5282ef
push eax
push 0
push 1
mov ecx, dword [edi + 0xdc]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, edi
mov si, 0xffef
call fcn.00404528
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x52822f
mov dword [ebp - 0x7c], 8
mov eax, dword [0x68855c]
cmp byte [eax], 0
je 0x528444
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x44]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x528444
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x44]
mov edx, dword [ebp - 0x1c]
call fcn.0041a308
mov ebx, eax
test ebx, ebx
je 0x528437
mov eax, dword [ebx + 0x14]
call fcn.0057bf10
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x528437
mov eax, dword [ebx]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
mov edi, eax
shl edi, 4
lea edi, [edi + edi*2]
add edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [0x6890a4]
cmp ebx, dword [eax]
jne 0x5283d8
mov eax, dword [ebp - 0x5c]
push eax
push 2
push 0
push 0
mov eax, dword [ebp - 0x5c]
mov si, 0xfff8
call fcn.00404528
sar eax, 1
jns 0x5283a9
adc eax, 0
mov edx, dword [ebp - 0x28]
add edx, 0x10
sub edx, eax
push edx
mov eax, dword [ebp - 0x5c]
mov si, 0xfff9
call fcn.00404528
sar eax, 1
jns 0x5283c5
adc eax, 0
lea edx, [edi + 0x18]
sub edx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
pop ecx
call fcn.005b3558
jmp 0x528437
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x5c]
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push 1
mov eax, dword [ebp - 0x5c]
mov si, 0xfff8
call fcn.00404528
sar eax, 1
jns 0x52840a
adc eax, 0
mov edx, dword [ebp - 0x28]
add edx, 0x10
sub edx, eax
push edx
mov eax, dword [ebp - 0x5c]
mov si, 0xfff9
call fcn.00404528
sar eax, 1
jns 0x528426
adc eax, 0
lea edx, [edi + 0x18]
sub edx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
pop ecx
call fcn.00486038
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x52832e
mov dword [ebp - 0x7c], 9
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x50]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x528550
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x50]
mov edx, dword [ebp - 0x1c]
call fcn.0041a308
mov edi, eax
mov eax, dword [edi + 0x150]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
shl eax, 4
lea eax, [eax + eax*2]
add eax, dword [ebp - 0x30]
add eax, dword [edi + 0xec]
add eax, 0x18
mov dword [edi + 0xd4], eax
mov eax, dword [ebp - 0x20]
add eax, 0x20
add eax, dword [edi + 0xf0]
add eax, 0x10
sub eax, 0x5f
mov edx, dword [edi + 0x158]
shl edx, 5
add eax, edx
mov dword [edi + 0xd8], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x4c]
movzx eax, byte [edi + 0x135]
mov edx, eax
add edx, edx
add edx, 0x1ff
mov eax, dword [0x68906c]
mov eax, dword [eax]
call fcn.0048ea88
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x528541
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x5c]
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push 1
mov ecx, dword [edi + 0xd8]
add ecx, dword [ebp - 0x50]
mov edx, dword [edi + 0xd4]
add edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
call fcn.00486038
inc dword [ebp - 0x1c]
dec dword [ebp - 0x84]
jne 0x528472
mov dword [ebp - 0x7c], 0xa
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x48]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x5287af
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x48]
mov edx, dword [ebp - 0x1c]
call fcn.0041a308
mov edi, eax
mov eax, dword [edi + 0x150]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
shl eax, 4
lea eax, [eax + eax*2]
add eax, dword [ebp - 0x30]
add eax, dword [edi + 0xec]
add eax, 0x18
mov dword [edi + 0xd4], eax
mov eax, dword [ebp - 0x20]
add eax, 0x20
add eax, dword [edi + 0xf0]
add eax, 0x10
sub eax, 0x5f
mov edx, dword [edi + 0x158]
shl edx, 5
add eax, edx
mov dword [edi + 0xd8], eax
mov eax, dword [edi + 0x150]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
shl eax, 4
lea eax, [eax + eax*2]
add eax, dword [ebp - 0x30]
mov dword [edi + 0xdc], eax
mov eax, dword [edi + 0x158]
shl eax, 5
add eax, dword [ebp - 0x20]
mov dword [edi + 0xe0], eax
cmp byte [edi + 0x2bd], 0
jne 0x5287a0
mov eax, dword [0x6885e4]
cmp byte [eax + 0x22], 0
je 0x528640
cmp byte [edi + 0x16], 0
jne 0x528640
mov eax, dword [0x688a9c]
cmp edi, dword [eax]
jne 0x528682
mov eax, dword [0x6885e4]
cmp byte [eax + 0x23], 0
je 0x528660
cmp byte [edi + 0x16], 0
jne 0x528660
mov eax, dword [0x688a9c]
cmp edi, dword [eax]
je 0x528660
cmp byte [edi + 0x58], 0xb4
je 0x528682
mov eax, dword [edi + 0xe0]
push eax
push 0
push 1
mov ecx, dword [edi + 0xdc]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, edi
mov si, 0xffef
call fcn.00404528
cmp byte [edi + 0x134], 0
je 0x528724
cmp byte [edi + 0x136], 0
jne 0x528724
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x4c]
movzx eax, byte [edi + 0x135]
mov edx, eax
add edx, edx
add edx, 0x1fe
mov eax, dword [0x68906c]
mov eax, dword [eax]
call fcn.0048ea88
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x528724
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x5c]
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push 1
mov eax, dword [edi + 0x150]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
mov edx, eax
shl edx, 4
lea edx, [edx + edx*2]
add edx, dword [ebp - 0x30]
add edx, dword [ebp - 0x4c]
mov ecx, dword [edi + 0x158]
shl ecx, 5
add ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
call fcn.00486038
test byte [edi + 0x2f], 2
je 0x5287a0
lea eax, [ebp - 0x50]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, 0xc8
xor edx, edx
div ecx
mov ecx, 0xa
xor edx, edx
div ecx
add edx, 0xe9c
lea ecx, [ebp - 0x4c]
mov eax, dword [0x688624]
mov eax, dword [eax + 0x60]
call fcn.0048ea88
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x5287a0
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x5c]
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push 0x7c
mov ecx, dword [edi + 0xe0]
add ecx, dword [ebp - 0x50]
mov edx, dword [edi + 0xdc]
add edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
call fcn.004860f4
inc dword [ebp - 0x1c]
dec dword [ebp - 0x84]
jne 0x52857e
mov dword [ebp - 0x7c], 0xb
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x54]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x52880c
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x54]
mov edx, dword [ebp - 0x1c]
call fcn.0041a308
mov esi, eax
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, esi
mov si, 0xfffd
call fcn.00404528
inc dword [ebp - 0x1c]
dec dword [ebp - 0x84]
jne 0x5287d9
add dword [ebp - 0x20], 0x20
inc dword [ebp - 0x14]
dec dword [ebp - 0x80]
jne 0x527d79
mov dword [ebp - 0x7c], 0xc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x420]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x52887c
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x420]
mov edx, dword [ebp - 0x10]
call fcn.0041a308
mov edi, eax
mov eax, dword [edi + 0xe0]
push eax
push 0
push 1
mov ecx, dword [edi + 0xdc]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, edi
mov si, 0xffef
call fcn.00404528
inc dword [ebp - 0x10]
dec dword [ebp - 0x80]
jne 0x52883f
mov dword [ebp - 0x7c], 0xd
xor eax, eax
call fcn.005b2d64
mov dword [ebp - 0x74], eax
mov al, 1
call fcn.005b2d64
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x74], 0
je 0x528ecb
cmp dword [ebp - 0x78], 0
je 0x528ecb
mov eax, dword [ebp - 0x74]
call fcn.00485bfc
mov eax, dword [ebp - 0x78]
call fcn.00485bfc
mov dword [ebp - 0x7c], 0xe
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x44]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x528aa2
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x44]
mov edx, dword [ebp - 0x1c]
call fcn.0041a308
mov ebx, eax
test ebx, ebx
je 0x528a95
mov eax, dword [ebx]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
mov edi, eax
shl edi, 4
lea edi, [edi + edi*2]
add edi, dword [ebp - 0x30]
mov eax, dword [ebx + 4]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f85]
dec eax
shl eax, 5
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x1c]
mov edx, dword [0x68914c]
cmp eax, dword [edx]
jbe 0x528964
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x1c], eax
mov byte [ebx + 0x28], 1
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x20], eax
xor eax, eax
mov dword [ebx + 0x24], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp byte [ebx + 0x28], 0
je 0x52899f
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x20]
cmp eax, 0x14
jb 0x528987
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x20], eax
inc dword [ebx + 0x24]
cmp dword [ebx + 0x24], 0
jl 0x52899b
cmp dword [ebx + 0x24], 0xa
jge 0x52899b
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x10], eax
jmp 0x52899f
mov byte [ebx + 0x28], 0
mov eax, dword [0x6890a4]
cmp ebx, dword [eax]
je 0x528a5d
mov eax, dword [ebx + 0x2c]
cmp byte [eax], 0
jne 0x5289d1
mov eax, dword [0x6885e4]
cmp byte [eax + 6], 0
je 0x528a5d
mov eax, dword [0x68895c]
cmp byte [eax], 0
je 0x528a5d
mov eax, dword [0x688f38]
cmp byte [eax + 0xd], 0
je 0x5289fe
movzx eax, byte [ebx + 0x29]
dec eax
sub al, 4
jae 0x5289fe
movzx eax, byte [ebx + 0x29]
mov edx, dword [0x688bfc]
movzx eax, byte [edx + eax - 1]
call fcn.004fd290
mov dword [ebp - 0x70], eax
jmp 0x528a1e
mov eax, dword [ebx + 0x2c]
movzx eax, byte [eax + 2]
mov eax, dword [eax*4 + 0x68430c]
mov dword [ebp - 0x70], eax
mov eax, dword [ebx + 0x2c]
cmp byte [eax + 2], 0
jne 0x528a1e
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x98]
mov edx, dword [ebx + 0x18]
call fcn.00405adc
mov eax, dword [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x10
mov eax, dword [ebx + 0xc]
add eax, eax
sub ecx, eax
lea edx, [edi + 0x18]
mov eax, dword [ebx + 8]
sar eax, 1
jns 0x528a51
adc eax, 0
sub edx, eax
mov eax, dword [ebp - 0x74]
call fcn.00486750
jmp 0x528a95
cmp byte [ebx + 0x28], 0
je 0x528a95
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x4c]
mov edx, dword [ebp - 0x10]
add edx, 0x730
mov eax, dword [0x68906c]
mov eax, dword [eax]
call fcn.0048ea88
mov ebx, eax
push ebx
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
add edx, edi
mov eax, dword [ebp - 0x78]
call fcn.00485d84
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x5288e4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x29
jne 0x5288c7
mov dword [ebp - 0x7c], 0xf
mov eax, dword [0x6885e4]
cmp byte [eax + 1], 0
jne 0x528ad0
mov eax, dword [0x6885e4]
cmp byte [eax + 3], 0
je 0x528eb6
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x424]
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 0x18]
jl 0x528eb6
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x424]
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 0x18]
jne 0x528b17
mov edi, dword [0x688a9c]
mov edi, dword [edi]
mov eax, dword [0x6885e4]
cmp byte [eax + 1], 0
je 0x528eb6
jmp 0x528bb3
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x424]
mov edx, dword [ebp - 0x18]
call fcn.0041a308
mov edi, eax
mov eax, dword [0x688a9c]
cmp edi, dword [eax]
je 0x528bab
cmp byte [edi + 0x16], 0
je 0x528b3f
cmp byte [edi + 0x31], 0
jne 0x528bab
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub eax, dword [edi + 0xc]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xa
jg 0x528bab
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
sub eax, dword [edi + 0x10]
cmp eax, 0xa
jg 0x528bab
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
sub eax, dword [edi + 0x10]
cmp eax, 0xfffffff6
jl 0x528bab
cmp dword [edi + 0xd4], 0
je 0x528bab
cmp byte [edi + 0x2bc], 0
jne 0x528b97
mov eax, dword [0x6885e4]
cmp byte [eax + 3], 0
je 0x528bab
cmp byte [edi + 0x2bc], 0
je 0x528bb3
mov eax, dword [0x6885e4]
cmp byte [eax + 1], 0
jne 0x528bb3
inc dword [ebp - 0x18]
jmp 0x528ad5
mov eax, dword [0x688b90]
cmp edi, dword [eax]
je 0x528eae
mov eax, dword [0x688a9c]
cmp edi, dword [eax]
jne 0x528d44
mov eax, dword [0x688b24]
cmp byte [eax], 0
jne 0x528eae
mov eax, dword [0x6885e4]
cmp byte [eax + 2], 0
je 0x528c2d
mov eax, dword [edi + 0xd8]
add eax, 0x1e
push eax
mov eax, dword [edi + 0x54]
push eax
push dword [edi + 0x3c]
push 0x52940c
push dword [edi + 0x40]
lea eax, [ebp - 0x9c]
mov edx, 3
call fcn.004054fc
mov eax, dword [ebp - 0x9c]
push eax
push 1
mov ecx, dword [edi + 0xd4]
mov edx, dword [ebp - 0x74]
mov eax, edi
call fcn.00527134
jmp 0x528eae
mov eax, dword [0x688894]
cmp byte [eax], 0
je 0x528d03
movzx eax, byte [edi + 0x23c]
dec eax
sub al, 5
jae 0x528d03
push 0x529418
lea edx, [ebp - 0xa8]
movzx eax, byte [edi + 0x23c]
call fcn.0057c434
push dword [ebp - 0xa8]
push 0x529424
lea eax, [ebp - 0xa4]
mov edx, 3
call fcn.004054fc
mov edx, dword [ebp - 0xa4]
lea eax, [ebp - 0xa0]
call fcn.00405adc
mov eax, dword [ebp - 0xa0]
push eax
movzx eax, byte [edi + 0x23c]
call fcn.0057c3e0
push eax
mov ecx, dword [edi + 0xd8]
add ecx, 0x1e
sub ecx, 6
mov edx, dword [edi + 0xd4]
sub edx, 0xc
mov eax, dword [ebp - 0x74]
call fcn.00486750
lea eax, [ebp - 0xac]
mov edx, dword [edi + 0x40]
call fcn.00405adc
mov eax, dword [ebp - 0xac]
push eax
mov eax, dword [edi + 0x54]
push eax
mov edx, dword [edi + 0xd4]
mov eax, dword [edi + 0x44]
sar eax, 1
jns 0x528ce8
adc eax, 0
sub edx, eax
mov ecx, dword [edi + 0xd8]
add ecx, 0x1e
add ecx, 6
mov eax, dword [ebp - 0x74]
call fcn.00486750
jmp 0x528eae
lea eax, [ebp - 0xb0]
mov edx, dword [edi + 0x40]
call fcn.00405adc
mov eax, dword [ebp - 0xb0]
push eax
mov eax, dword [edi + 0x54]
push eax
mov edx, dword [edi + 0xd4]
mov eax, dword [edi + 0x44]
sar eax, 1
jns 0x528d2c
adc eax, 0
sub edx, eax
mov ecx, dword [edi + 0xd8]
add ecx, 0x1e
mov eax, dword [ebp - 0x74]
call fcn.00486750
jmp 0x528eae
cmp byte [edi + 0x16], 0x32
jne 0x528e1d
cmp dword [edi + 0x3c], 0
je 0x528ddc
lea eax, [ebp - 0xb4]
mov edx, dword [edi + 0x3c]
call fcn.00405adc
mov eax, dword [ebp - 0xb4]
push eax
mov eax, dword [edi + 0x54]
push eax
mov edx, dword [edi + 0xd4]
mov eax, dword [edi + 0x48]
sar eax, 1
jns 0x528d81
adc eax, 0
sub edx, eax
mov ecx, dword [edi + 0xd8]
add ecx, 0x1e
sub ecx, 6
mov eax, dword [ebp - 0x74]
call fcn.00486750
lea eax, [ebp - 0xb8]
mov edx, dword [edi + 0x40]
call fcn.00405adc
mov eax, dword [ebp - 0xb8]
push eax
push 0xffffff
mov edx, dword [edi + 0xd4]
mov eax, dword [edi + 0x44]
sar eax, 1
jns 0x528dc1
adc eax, 0
sub edx, eax
mov ecx, dword [edi + 0xd8]
add ecx, 0x1e
add ecx, 6
mov eax, dword [ebp - 0x74]
call fcn.00486750
jmp 0x528eae
lea eax, [ebp - 0xbc]
mov edx, dword [edi + 0x40]
call fcn.00405adc
mov eax, dword [ebp - 0xbc]
push eax
mov eax, dword [edi + 0x54]
push eax
mov edx, dword [edi + 0xd4]
mov eax, dword [edi + 0x44]
sar eax, 1
jns 0x528e05
adc eax, 0
sub edx, eax
mov ecx, dword [edi + 0xd8]
add ecx, 0x1e
mov eax, dword [ebp - 0x74]
call fcn.00486750
jmp 0x528eae
mov eax, dword [0x6885e4]
cmp byte [eax + 2], 0
je 0x528e72
cmp byte [edi + 0x16], 0
jne 0x528e72
mov eax, dword [edi + 0xd8]
add eax, 0x1e
push eax
mov eax, dword [edi + 0x54]
push eax
push dword [edi + 0x3c]
push 0x52940c
push dword [edi + 0x40]
lea eax, [ebp - 0xc0]
mov edx, 3
call fcn.004054fc
mov eax, dword [ebp - 0xc0]
push eax
push 0
mov ecx, dword [edi + 0xd4]
mov edx, dword [ebp - 0x74]
mov eax, edi
call fcn.00527134
jmp 0x528eae
lea eax, [ebp - 0xc4]
mov edx, dword [edi + 0x40]
call fcn.00405adc
mov eax, dword [ebp - 0xc4]
push eax
mov eax, dword [edi + 0x54]
push eax
mov edx, dword [edi + 0xd4]
mov eax, dword [edi + 0x44]
sar eax, 1
jns 0x528e9b
adc eax, 0
sub edx, eax
mov ecx, dword [edi + 0xd8]
add ecx, 0x1e
mov eax, dword [ebp - 0x74]
call fcn.00486750
inc dword [ebp - 0x18]
jmp 0x528ad5
mov eax, dword [ebp - 0x78]
push eax
push 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
xor ecx, ecx
xor edx, edx
call fcn.005b31f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x528f0e
mov eax, dword [0x6882e0]
cmp byte [eax], 0
jne 0x529110
xor eax, eax
push ebp
push 0x5290fc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x688f4c]
cmp byte [eax], 0
jne 0x528fa4
mov eax, dword [0x688a9c]
mov eax, dword [eax]
test byte [eax + 0x2e], 0x80
jne 0x528fa4
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov eax, dword [eax + 0x154]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f85]
dec eax
shl eax, 5
add eax, dword [ebp - 0x34]
push eax
push 1
push 0
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov eax, dword [eax + 0x150]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
mov ecx, eax
shl ecx, 4
lea ecx, [ecx + ecx*2]
add ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov si, 0xffef
call fcn.00404528
mov eax, dword [0x688b90]
cmp dword [eax], 0
je 0x52904b
mov edx, dword [0x688b90]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.0052c31c
test al, al
je 0x52904b
mov eax, dword [0x688b90]
mov eax, dword [eax]
mov edx, dword [0x688a9c]
cmp eax, dword [edx]
je 0x52904b
mov eax, dword [0x688b90]
mov eax, dword [eax]
test byte [eax + 0x2e], 0x80
jne 0x52904b
mov eax, dword [0x688b90]
mov eax, dword [eax]
mov eax, dword [eax + 0x154]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f85]
dec eax
shl eax, 5
add eax, dword [ebp - 0x34]
push eax
push 1
push 0
mov eax, dword [0x688b90]
mov eax, dword [eax]
mov eax, dword [eax + 0x150]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
mov ecx, eax
shl ecx, 4
lea ecx, [ecx + ecx*2]
add ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, dword [0x688b90]
mov eax, dword [eax]
mov si, 0xffef
call fcn.00404528
mov eax, dword [0x6891d0]
cmp dword [eax], 0
je 0x5290f2
mov edx, dword [0x6891d0]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.0052c31c
test al, al
je 0x5290f2
mov eax, dword [0x6891d0]
mov eax, dword [eax]
mov edx, dword [0x688a9c]
cmp eax, dword [edx]
je 0x5290f2
mov eax, dword [0x6891d0]
mov eax, dword [eax]
test byte [eax + 0x2e], 0x80
jne 0x5290f2
mov eax, dword [0x6891d0]
mov eax, dword [eax]
mov eax, dword [eax + 0x154]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f85]
dec eax
shl eax, 5
add eax, dword [ebp - 0x34]
push eax
push 1
push 0
mov eax, dword [0x6891d0]
mov eax, dword [eax]
mov eax, dword [eax + 0x150]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
mov ecx, eax
shl ecx, 4
lea ecx, [ecx + ecx*2]
add ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, dword [0x6891d0]
mov eax, dword [eax]
mov si, 0xffef
call fcn.00404528
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x529110
xor eax, eax
push ebp
push 0x5291ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x424]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x5291e4
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x424]
mov edx, dword [ebp - 0x18]
call fcn.0041a308
mov edi, eax
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub eax, dword [edi + 0xc]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xa
jg 0x5291d8
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
sub eax, dword [edi + 0x10]
cmp eax, 0xa
jg 0x5291d8
mov eax, dword [0x688a9c]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
sub eax, dword [edi + 0x10]
cmp eax, 0xfffffff2
jl 0x5291d8
mov eax, dword [edi + 0x154]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f85]
dec eax
shl eax, 5
add eax, dword [ebp - 0x34]
push eax
mov eax, dword [edi + 0x150]
mov edx, dword [0x6890a8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
mov ecx, eax
shl ecx, 4
lea ecx, [ecx + ecx*2]
add ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, edi
mov si, 0xffee
call fcn.00404528
inc dword [ebp - 0x18]
dec dword [ebp - 0x80]
jne 0x52913e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x529202
cmp dword [ebp - 0x74], 0
je 0x5292ed
mov eax, dword [0x688570]
cmp dword [eax], 0
jle 0x529247
lea eax, [ebp - 0xd0]
mov edx, dword [0x688ea4]
mov edx, dword [edx]
call fcn.00405adc
mov eax, dword [ebp - 0xd0]
push eax
push 0xff00
mov ecx, 3
mov edx, 0x28
mov eax, dword [ebp - 0x74]
call fcn.00486750
mov eax, dword [0x688fb0]
cmp dword [eax], 0
jle 0x529284
lea eax, [ebp - 0xd4]
mov edx, dword [0x688988]
mov edx, dword [edx]
call fcn.00405adc
mov eax, dword [ebp - 0xd4]
push eax
push 0xffff
mov ecx, 0x88
mov edx, 0x13f
mov eax, dword [ebp - 0x74]
call fcn.00486750
jmp 0x5292bf
mov eax, dword [0x6891b0]
cmp dword [eax], 0
jle 0x5292bf
lea eax, [ebp - 0xd8]
mov edx, dword [0x688b48]
mov edx, dword [edx]
call fcn.00405adc
mov eax, dword [ebp - 0xd8]
push eax
push 0xffff
mov ecx, 0x88
mov edx, 0xa0
mov eax, dword [ebp - 0x74]
call fcn.00486750
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x74]
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0x74]
push eax
push 0x7b
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
xor ecx, ecx
xor edx, edx
call fcn.004860f4
xor eax, eax
push ebp
push 0x52930d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0052658c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x529321
xor eax, eax
push ebp
push 0x529341
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00526250
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x529355
call sub.kernel32.dll_GetTickCount
add eax, 0x32
mov edx, dword [ebp - 8]
mov dword [edx + 0x20], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5293fa
lea eax, [ebp - 0xd8]
mov edx, 3
call fcn.00405988
lea eax, [ebp - 0xcc]
mov edx, 2
call fcn.0040517c
lea eax, [ebp - 0xc4]
call fcn.00405970
lea eax, [ebp - 0xc0]
call fcn.00405158
lea eax, [ebp - 0xbc]
mov edx, 5
call fcn.00405988
lea eax, [ebp - 0xa8]
mov edx, 2
call fcn.0040517c
lea eax, [ebp - 0xa0]
call fcn.00405970
lea eax, [ebp - 0x9c]
call fcn.00405158
lea eax, [ebp - 0x98]
call fcn.00405970
lea eax, [ebp - 4]
call fcn.00405158
ret