Function at 0x408794
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
mov edx, dword fs:[0]
push 0x40abbb
push edx
mov dword fs:[0], esp
sub esp, 8
sub esp, 0x1d4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x1c8], eax
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx]
lea ebx, [edx + 0xd8]
mov eax, dword [ebx + 4]
call fcn.0041e45c
call fcn.0041e3cc
call fcn.0041e3c4
mov esi, dword fs:[0x2c]
mov ecx, dword [esi]
mov dword [ecx + 0xd8], 0
mov dword [ecx + 0xdc], 0
mov edx, dword fs:[0x2c]
mov ebx, dword [edx]
lea eax, [ebx + 0xe0]
mov eax, dword [eax + 4]
call fcn.0041e45c
call fcn.0041e3cc
call fcn.0041e3c4
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx]
mov dword [edx + 0xe0], 0
mov dword [edx + 0xe4], 0
mov ebx, 0x40abc8
push ebx
push 0
push 8
push dword [ebp + 0x10]
call fcn.0041cd5c
mov esi, dword fs:[0x2c]
mov eax, dword [esi]
push dword [eax + 0xe4]
push dword [eax + 0xe0]
call fcn.0041894c
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx]
mov eax, dword [edx + 0xe0]
mov edx, dword [edx + 0xe4]
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x1bc], edx
mov dword [ebp - 0x1b8], 0
add esp, 0x10
mov ebx, dword [ebp - 0x1b8]
cmp ebx, dword [ebp - 0x1c0]
jae 0x408aa4
mov esi, dword [ebp - 0x1b8]
mov edx, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x1c0]
mov eax, dword [edx + esi*8]
mov edx, dword [edx + esi*8 + 4]
push edx
push eax
mov ecx, 0x470ce0
push ecx
push 1
call fcn.0040df9c
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1ac], edx
push 8
mov ebx, 0x4712a0
push ebx
call fcn.0042181c
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1b0], 0
jne 0x408925
push dword [ebp - 0x1b0]
push 0
push 0
push 0x521
mov esi, 0x470cb0
push esi
call fcn.0041bd28
mov edx, dword [ebp - 0x1ac]
mov ebx, dword [ebp - 0x1b0]
mov ecx, dword [edx + 4]
mov ebx, dword [edx]
mov dword [eax], ebx
mov dword [eax + 4], ecx
mov ecx, 0x471260
mov edi, 1
mov dword [eax + 8], edi
mov dword [eax + 0xc], ecx
cmp dword [ebp - 0x1b0], 1
mov dword [ebp - 0x1e8], ecx
mov dword [ebp - 0x1e0], edx
ja 0x40897a
push dword [ebp - 0x1b0]
push 1
push 0
push 0x521
mov esi, 0x470cb0
push esi
call fcn.0041bd28
mov ebx, dword [edx + 8]
mov edx, dword [edx + 0xc]
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], edi
mov dword [eax + 0x1c], ecx
mov esi, 2
cmp dword [ebp - 0x1b0], esi
ja 0x4089b2
push dword [ebp - 0x1b0]
push esi
push 0
push 0x521
mov edx, 0x470cb0
push edx
call fcn.0041bd28
mov ebx, dword [ebp - 0x1e0]
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebp - 0x1a0]
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], edx
mov edx, dword [ebp - 0x1e8]
mov dword [ecx + 0x28], edi
mov dword [ecx + 0x2c], edx
mov edi, 3
cmp dword [ebp - 0x1b0], edi
ja 0x4089fc
push dword [ebp - 0x1b0]
push edi
push 0
push 0x521
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x18]
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], edx
mov eax, 4
cmp dword [ebp - 0x1b0], eax
ja 0x408a2e
push dword [ebp - 0x1b0]
push eax
push 0
push 0x521
mov edx, 0x470cb0
push edx
call fcn.0041bd28
mov edx, dword [ebx + 0x24]
mov ebx, dword [ebx + 0x20]
mov dword [ecx + 0x38], ebx
mov dword [ecx + 0x3c], edx
mov ebx, 8
mov dword [ebp - 0x1a8], ebx
mov dword [ebp - 0x1a4], ecx
push 1
mov edx, dword fs:[0x2c]
mov edx, dword [edx]
lea edx, [edx + 0xd8]
push edx
mov edx, 0x471290
push edx
call fcn.0041d384
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x194], edx
mov ecx, dword [ebp - 0x1a4]
mov eax, ebx
mov ebx, dword [ebp - 0x198]
dec ebx
mov edx, dword [ebp - 0x194]
mov esi, dword [ebp - 0x198]
mov dword [edx + ebx*8], eax
mov dword [edx + ebx*8 + 4], ecx
add esp, 0x14
inc dword [ebp - 0x1b8]
jmp 0x4088a9
push 8
mov eax, 0x4712a0
push eax
call fcn.0042181c
mov ecx, 0x471270
mov ebx, 4
mov dword [eax], ebx
mov dword [eax + 4], ecx
mov edx, 0x471260
mov esi, 1
mov dword [eax + 8], esi
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], esi
mov dword [eax + 0x1c], edx
mov dword [eax + 0x20], ebx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], esi
mov dword [eax + 0x2c], edx
mov dword [eax + 0x30], ebx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], esi
mov dword [eax + 0x3c], edx
mov ecx, eax
mov eax, 8
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x18c], ecx
push 1
mov ebx, dword fs:[0x2c]
mov edx, dword [ebx]
lea esi, [edx + 0xd8]
push esi
mov ebx, 0x471290
push ebx
call fcn.0041d384
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], edx
mov ecx, dword [ebp - 0x18c]
mov ebx, dword [ebp - 0x190]
mov esi, dword [ebp - 0x188]
dec esi
mov dword [edx + esi*8], ebx
mov dword [edx + esi*8 + 4], ecx
xor eax, eax
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x178], 4
add esp, 0x14
cmp dword [ebp - 0x178], 0
js 0x40998a
xor edx, edx
mov dword [ebp - 0x180], edx
mov dword [ebp - 0x17c], edx
mov ecx, dword fs:[0x2c]
mov ebx, dword [ecx]
mov esi, dword [ebx + 0xd8]
cmp dword [ebp - 0x180], esi
mov dword [ebp - 0x1e8], esi
jb 0x408bb6
push esi
push dword [ebp - 0x180]
push 0
push 0x530
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword [ebp - 0x180]
shl edx, 3
mov ecx, dword fs:[0x2c]
mov ebx, dword [ecx]
lea ebx, [ebx + 0xd8]
mov ecx, dword [ebx + 4]
mov eax, dword [ebx]
mov eax, dword [edx + ecx]
mov ecx, dword [edx + ecx + 4]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], ecx
cmp dword [ebp - 0x178], eax
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 0x1e0], ebx
jb 0x408c64
mov ebx, dword [ebx]
cmp dword [ebp - 0x180], ebx
mov dword [ebp - 0x1e0], ebx
jb 0x408c23
push ebx
push dword [ebp - 0x180]
push 0
push 0x530
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx]
mov ecx, dword [eax + 0xdc]
mov eax, dword [eax + 0xd8]
mov eax, dword [edx + ecx]
mov edx, dword [edx + ecx + 4]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], edx
push eax
push dword [ebp - 0x178]
push 0
push 0x530
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x164]
mov ebx, dword [ebp - 0x168]
mov edx, dword [ecx + eax*8 + 4]
mov ebx, dword [ecx + eax*8]
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x16c], edx
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0x3b9ac9ff
jg 0x408dd3
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx]
mov ebx, dword [edx + 0xd8]
cmp dword [ebp - 0x160], ebx
mov dword [ebp - 0x1e8], ebx
jb 0x408cdb
push ebx
push dword [ebp - 0x160]
push 0
push 0x533
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov ecx, dword [ebp - 0x160]
shl ecx, 3
mov edx, dword fs:[0x2c]
mov eax, dword [edx]
lea ebx, [eax + 0xd8]
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
mov eax, dword [ecx + edx]
mov edx, dword [ecx + edx + 4]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], edx
cmp dword [ebp - 0x178], eax
mov dword [ebp - 0x1e8], ecx
mov dword [ebp - 0x1e0], ebx
jb 0x408d89
mov ebx, dword [ebx]
cmp dword [ebp - 0x160], ebx
mov dword [ebp - 0x1e0], ebx
jb 0x408d48
push ebx
push dword [ebp - 0x160]
push 0
push 0x533
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword fs:[0x2c]
mov eax, dword [edx]
mov edx, dword [eax + 0xdc]
mov eax, dword [eax + 0xd8]
mov eax, dword [ecx + edx]
mov edx, dword [ecx + edx + 4]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], edx
push eax
push dword [ebp - 0x178]
push 0
push 0x533
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov eax, dword [ebp - 0x178]
mov edx, dword [ebp - 0x154]
mov ebx, dword [ebp - 0x158]
mov ecx, dword [edx + eax*8 + 4]
mov ebx, dword [edx + eax*8]
push ecx
push ebx
push dword [ebp - 0x16c]
push dword [ebp - 0x170]
call fcn.0041dd3c
xor al, 1
je 0x408dc8
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x17c], eax
jmp 0x408dd3
inc dword [ebp - 0x160]
jmp 0x408c95
push dword [ebp + 0xc]
push dword [ebp + 8]
mov edx, 0x470cf0
push edx
push 4
call fcn.0041dd3c
test al, al
je 0x409059
mov ecx, dword [ebp - 0x178]
test ecx, ecx
jns 0x408df9
inc ecx
sar ecx, 1
mov eax, ecx
cdq
xor eax, edx
and eax, 1
add edx, eax
test edx, edx
jne 0x409059
mov dword [ebp - 0x1d8], 0xf423f
mov ebx, dword [ebp - 0x180]
mov dword [ebp - 0x150], ebx
mov edx, dword [ebp - 0x150]
cmp edx, dword [ebp - 0x17c]
jg 0x409059
mov ecx, dword [ebp - 0x178]
add ecx, 3
mov eax, dword fs:[0x2c]
mov ebx, dword [eax]
mov edx, dword [ebx + 0xd8]
cmp dword [ebp - 0x150], edx
mov dword [ebp - 0x1e8], ecx
mov dword [ebp - 0x1e0], edx
jb 0x408e7b
push edx
push dword [ebp - 0x150]
push 0
push 0x53f
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov ebx, dword [ebp - 0x150]
shl ebx, 3
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
lea esi, [eax + 0xd8]
mov edx, dword [esi + 4]
mov eax, dword [esi]
mov eax, dword [ebx + edx]
mov edx, dword [ebx + edx + 4]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], edx
cmp ecx, eax
mov dword [ebp - 0x1e0], ebx
jb 0x408f13
mov esi, dword [esi]
cmp dword [ebp - 0x150], esi
jb 0x408ed7
push esi
push dword [ebp - 0x150]
push 0
push 0x53f
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword fs:[0x2c]
mov eax, dword [edx]
mov edx, dword [eax + 0xdc]
mov eax, dword [eax + 0xd8]
mov eax, dword [ebx + edx]
mov edx, dword [ebx + edx + 4]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], edx
push eax
push ecx
push 0
push 0x53f
mov ebx, 0x470cb0
push ebx
call fcn.0041bd28
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x148]
mov eax, dword [edx + ecx*8]
mov edx, dword [edx + ecx*8 + 4]
push edx
push eax
call fcn.0040c69c
cmp eax, dword [ebp - 0x1d8]
jge 0x40904e
mov ecx, dword [ebp - 0x178]
add ecx, 3
push ecx
mov eax, dword fs:[0x2c]
mov edx, dword [eax]
mov eax, dword [edx + 0xd8]
cmp dword [ebp - 0x150], eax
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1e0], ecx
jb 0x408f7e
push eax
push dword [ebp - 0x150]
push 0
push 0x541
mov edx, 0x470cb0
push edx
call fcn.0041bd28
mov edx, dword [ebp - 0x150]
shl edx, 3
push edx
mov ebx, dword fs:[0x2c]
mov ebx, dword [ebx]
lea ebx, [ebx + 0xd8]
mov dword [ebp - 0x1e8], edx
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
mov eax, edx
pop edx
mov ecx, dword [edx + eax + 4]
mov esi, dword [edx + eax]
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x13c], ecx
pop ecx
cmp ecx, esi
jb 0x409028
mov ebx, dword [ebx]
cmp dword [ebp - 0x150], ebx
jb 0x408fe0
push ebx
push dword [ebp - 0x150]
push 0
push 0x541
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword [ebp - 0x1e8]
mov ecx, dword fs:[0x2c]
mov esi, dword [ecx]
mov ecx, dword [esi + 0xdc]
mov eax, dword [esi + 0xd8]
mov eax, dword [edx + ecx]
mov edx, dword [edx + ecx + 4]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], edx
push eax
mov esi, dword [ebp - 0x1e0]
push esi
push 0
push 0x541
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov eax, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x13c]
mov esi, dword [ebp - 0x140]
mov ecx, dword [edx + eax*8 + 4]
mov esi, dword [edx + eax*8]
push ecx
push esi
call fcn.0040c69c
mov dword [ebp - 0x1d8], eax
inc dword [ebp - 0x150]
jmp 0x408e25
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, 0x470cf0
push eax
push 4
call fcn.0041dd3c
test al, al
je 0x4092ee
mov edx, dword [ebp - 0x178]
test edx, edx
jns 0x40907f
inc edx
sar edx, 1
mov eax, edx
cdq
xor eax, edx
and eax, 1
add edx, eax
cmp edx, 1
jne 0x4092ee
mov dword [ebp - 0x1d8], 0xfff0bdc1
mov ecx, dword [ebp - 0x180]
mov dword [ebp - 0x138], ecx
mov esi, dword [ebp - 0x138]
cmp esi, dword [ebp - 0x17c]
jg 0x4092ee
mov edx, dword [ebp - 0x178]
add edx, 3
push edx
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xd8]
cmp dword [ebp - 0x138], esi
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 0x1e0], esi
jb 0x409103
push esi
push dword [ebp - 0x138]
push 0
push 0x54b
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov ecx, dword [ebp - 0x138]
shl ecx, 3
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
lea ebx, [eax + 0xd8]
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
mov eax, dword [ecx + edx]
mov edx, dword [ecx + edx + 4]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], edx
pop edx
cmp edx, eax
mov dword [ebp - 0x1e0], ecx
jb 0x4091a2
mov ebx, dword [ebx]
cmp dword [ebp - 0x138], ebx
jb 0x409160
push ebx
push dword [ebp - 0x138]
push 0
push 0x54b
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword fs:[0x2c]
mov eax, dword [edx]
mov edx, dword [eax + 0xdc]
mov eax, dword [eax + 0xd8]
mov eax, dword [ecx + edx]
mov edx, dword [ecx + edx + 4]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], edx
push eax
mov ecx, dword [ebp - 0x1e8]
push ecx
push 0
push 0x54b
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x130]
mov eax, dword [ecx + edx*8]
mov edx, dword [ecx + edx*8 + 4]
push edx
push eax
call fcn.0040c69c
cmp eax, dword [ebp - 0x1d8]
jle 0x4092e3
mov ecx, dword [ebp - 0x178]
add ecx, 3
push ecx
mov eax, dword fs:[0x2c]
mov edx, dword [eax]
mov eax, dword [edx + 0xd8]
cmp dword [ebp - 0x138], eax
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1e0], ecx
jb 0x409213
push eax
push dword [ebp - 0x138]
push 0
push 0x54d
mov edx, 0x470cb0
push edx
call fcn.0041bd28
mov edx, dword [ebp - 0x138]
shl edx, 3
push edx
mov ebx, dword fs:[0x2c]
mov ebx, dword [ebx]
lea ebx, [ebx + 0xd8]
mov dword [ebp - 0x1e8], edx
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
mov eax, edx
pop edx
mov ecx, dword [edx + eax + 4]
mov esi, dword [edx + eax]
mov dword [ebp - 0x128], esi
mov dword [ebp - 0x124], ecx
pop ecx
cmp ecx, esi
jb 0x4092bd
mov ebx, dword [ebx]
cmp dword [ebp - 0x138], ebx
jb 0x409275
push ebx
push dword [ebp - 0x138]
push 0
push 0x54d
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword [ebp - 0x1e8]
mov ecx, dword fs:[0x2c]
mov esi, dword [ecx]
mov ecx, dword [esi + 0xdc]
mov eax, dword [esi + 0xd8]
mov eax, dword [edx + ecx]
mov edx, dword [edx + ecx + 4]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], edx
push eax
mov esi, dword [ebp - 0x1e0]
push esi
push 0
push 0x54d
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov eax, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x124]
mov esi, dword [ebp - 0x128]
mov ecx, dword [edx + eax*8 + 4]
mov esi, dword [edx + eax*8]
push ecx
push esi
call fcn.0040c69c
mov dword [ebp - 0x1d8], eax
inc dword [ebp - 0x138]
jmp 0x4090ac
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, 0x4707b0
push eax
push 6
call fcn.0041dd3c
test al, al
je 0x409582
mov edx, dword [ebp - 0x178]
test edx, edx
jns 0x409314
inc edx
sar edx, 1
mov eax, edx
cdq
xor eax, edx
and eax, 1
add edx, eax
test edx, edx
jne 0x409582
mov dword [ebp - 0x1d8], 0xfff0bdc1
mov ecx, dword [ebp - 0x180]
mov dword [ebp - 0x120], ecx
mov esi, dword [ebp - 0x120]
cmp esi, dword [ebp - 0x17c]
jg 0x409582
mov edx, dword [ebp - 0x178]
add edx, 3
push edx
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xd8]
cmp dword [ebp - 0x120], esi
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 0x1e0], esi
jb 0x409397
push esi
push dword [ebp - 0x120]
push 0
push 0x557
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov ecx, dword [ebp - 0x120]
shl ecx, 3
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
lea ebx, [eax + 0xd8]
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
mov eax, dword [ecx + edx]
mov edx, dword [ecx + edx + 4]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], edx
pop edx
cmp edx, eax
mov dword [ebp - 0x1e0], ecx
jb 0x409436
mov ebx, dword [ebx]
cmp dword [ebp - 0x120], ebx
jb 0x4093f4
push ebx
push dword [ebp - 0x120]
push 0
push 0x557
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword fs:[0x2c]
mov eax, dword [edx]
mov edx, dword [eax + 0xdc]
mov eax, dword [eax + 0xd8]
mov eax, dword [ecx + edx]
mov edx, dword [ecx + edx + 4]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], edx
push eax
mov ecx, dword [ebp - 0x1e8]
push ecx
push 0
push 0x557
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x118]
mov eax, dword [ecx + edx*8]
mov edx, dword [ecx + edx*8 + 4]
push edx
push eax
call fcn.0040c69c
cmp eax, dword [ebp - 0x1d8]
jle 0x409577
mov ecx, dword [ebp - 0x178]
add ecx, 3
push ecx
mov eax, dword fs:[0x2c]
mov edx, dword [eax]
mov eax, dword [edx + 0xd8]
cmp dword [ebp - 0x120], eax
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1e0], ecx
jb 0x4094a7
push eax
push dword [ebp - 0x120]
push 0
push 0x559
mov edx, 0x470cb0
push edx
call fcn.0041bd28
mov edx, dword [ebp - 0x120]
shl edx, 3
push edx
mov ebx, dword fs:[0x2c]
mov ebx, dword [ebx]
lea ebx, [ebx + 0xd8]
mov dword [ebp - 0x1e8], edx
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
mov eax, edx
pop edx
mov ecx, dword [edx + eax + 4]
mov esi, dword [edx + eax]
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x10c], ecx
pop ecx
cmp ecx, esi
jb 0x409551
mov ebx, dword [ebx]
cmp dword [ebp - 0x120], ebx
jb 0x409509
push ebx
push dword [ebp - 0x120]
push 0
push 0x559
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword [ebp - 0x1e8]
mov ecx, dword fs:[0x2c]
mov esi, dword [ecx]
mov ecx, dword [esi + 0xdc]
mov eax, dword [esi + 0xd8]
mov eax, dword [edx + ecx]
mov edx, dword [edx + ecx + 4]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], edx
push eax
mov esi, dword [ebp - 0x1e0]
push esi
push 0
push 0x559
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov eax, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x10c]
mov esi, dword [ebp - 0x110]
mov ecx, dword [edx + eax*8 + 4]
mov esi, dword [edx + eax*8]
push ecx
push esi
call fcn.0040c69c
mov dword [ebp - 0x1d8], eax
inc dword [ebp - 0x120]
jmp 0x409340
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, 0x4707b0
push eax
push 6
call fcn.0041dd3c
test al, al
je 0x409817
mov edx, dword [ebp - 0x178]
test edx, edx
jns 0x4095a8
inc edx
sar edx, 1
mov eax, edx
cdq
xor eax, edx
and eax, 1
add edx, eax
cmp edx, 1
jne 0x409817
mov dword [ebp - 0x1d8], 0xf423f
mov ecx, dword [ebp - 0x180]
mov dword [ebp - 0x108], ecx
mov esi, dword [ebp - 0x108]
cmp esi, dword [ebp - 0x17c]
jg 0x409817
mov edx, dword [ebp - 0x178]
add edx, 3
push edx
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xd8]
cmp dword [ebp - 0x108], esi
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 0x1e0], esi
jb 0x40962c
push esi
push dword [ebp - 0x108]
push 0
push 0x563
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov ecx, dword [ebp - 0x108]
shl ecx, 3
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
lea ebx, [eax + 0xd8]
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
mov eax, dword [ecx + edx]
mov edx, dword [ecx + edx + 4]
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], edx
pop edx
cmp edx, eax
mov dword [ebp - 0x1e0], ecx
jb 0x4096cb
mov ebx, dword [ebx]
cmp dword [ebp - 0x108], ebx
jb 0x409689
push ebx
push dword [ebp - 0x108]
push 0
push 0x563
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword fs:[0x2c]
mov eax, dword [edx]
mov edx, dword [eax + 0xdc]
mov eax, dword [eax + 0xd8]
mov eax, dword [ecx + edx]
mov edx, dword [ecx + edx + 4]
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], edx
push eax
mov ecx, dword [ebp - 0x1e8]
push ecx
push 0
push 0x563
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x100]
mov eax, dword [ecx + edx*8]
mov edx, dword [ecx + edx*8 + 4]
push edx
push eax
call fcn.0040c69c
cmp eax, dword [ebp - 0x1d8]
jge 0x40980c
mov ecx, dword [ebp - 0x178]
add ecx, 3
push ecx
mov eax, dword fs:[0x2c]
mov edx, dword [eax]
mov eax, dword [edx + 0xd8]
cmp dword [ebp - 0x108], eax
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1e0], ecx
jb 0x40973c
push eax
push dword [ebp - 0x108]
push 0
push 0x565
mov edx, 0x470cb0
push edx
call fcn.0041bd28
mov edx, dword [ebp - 0x108]
shl edx, 3
push edx
mov ebx, dword fs:[0x2c]
mov ebx, dword [ebx]
lea ebx, [ebx + 0xd8]
mov dword [ebp - 0x1e8], edx
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
mov eax, edx
pop edx
mov ecx, dword [edx + eax + 4]
mov esi, dword [edx + eax]
mov dword [ebp - 0xf8], esi
mov dword [ebp - 0xf4], ecx
pop ecx
cmp ecx, esi
jb 0x4097e6
mov ebx, dword [ebx]
cmp dword [ebp - 0x108], ebx
jb 0x40979e
push ebx
push dword [ebp - 0x108]
push 0
push 0x565
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword [ebp - 0x1e8]
mov ecx, dword fs:[0x2c]
mov esi, dword [ecx]
mov ecx, dword [esi + 0xdc]
mov eax, dword [esi + 0xd8]
mov eax, dword [edx + ecx]
mov edx, dword [edx + ecx + 4]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], edx
push eax
mov esi, dword [ebp - 0x1e0]
push esi
push 0
push 0x565
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov eax, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0xf4]
mov esi, dword [ebp - 0xf8]
mov ecx, dword [edx + eax*8 + 4]
mov esi, dword [edx + eax*8]
push ecx
push esi
call fcn.0040c69c
mov dword [ebp - 0x1d8], eax
inc dword [ebp - 0x108]
jmp 0x4095d5
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0xf0], eax
mov edx, dword [ebp - 0xf0]
cmp edx, dword [ebp - 0x17c]
jg 0x40994d
mov ecx, dword [ebp - 0x178]
inc ecx
mov esi, dword fs:[0x2c]
mov eax, dword [esi]
mov edx, dword [eax + 0xd8]
cmp dword [ebp - 0xf0], edx
mov dword [ebp - 0x1e8], ecx
mov dword [ebp - 0x1e0], edx
jb 0x409878
push edx
push dword [ebp - 0xf0]
push 0
push 0x56c
mov esi, 0x470cb0
push esi
call fcn.0041bd28
mov eax, dword [ebp - 0xf0]
shl eax, 3
mov esi, dword fs:[0x2c]
mov esi, dword [esi]
lea esi, [esi + 0xd8]
mov edx, dword [esi + 4]
mov ebx, dword [esi]
mov ebx, dword [eax + edx]
mov edx, dword [eax + edx + 4]
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], edx
cmp ecx, ebx
mov dword [ebp - 0x1e0], eax
jb 0x409917
mov esi, dword [esi]
cmp dword [ebp - 0xf0], esi
jb 0x4098d5
push esi
push dword [ebp - 0xf0]
push 0
push 0x56c
mov edx, 0x470cb0
push edx
call fcn.0041bd28
mov ebx, dword fs:[0x2c]
mov edx, dword [ebx]
mov ebx, dword [edx + 0xd8]
mov edx, dword [edx + 0xdc]
mov ecx, dword [eax + edx + 4]
mov ebx, dword [eax + edx]
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], ecx
push ebx
mov eax, dword [ebp - 0x1e8]
push eax
push 0
push 0x56c
mov edx, 0x470cb0
push edx
call fcn.0041bd28
mov edx, dword [ebp - 0xe4]
mov ebx, dword [ebp - 0xe8]
lea ecx, [edx + ecx*8]
mov dword [ebp - 0xe0], ecx
mov eax, dword [ebp - 0x1d8]
call fcn.0040d41c
mov ebx, dword [ebp - 0xe0]
mov dword [ebx], eax
mov dword [ebx + 4], edx
inc dword [ebp - 0xf0]
jmp 0x409823
mov edx, dword [ebp - 0x17c]
inc edx
mov dword [ebp - 0x180], edx
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx]
mov ebx, dword [eax + 0xd8]
dec ebx
cmp ebx, dword [ebp - 0x180]
jne 0x408b80
mov edx, dword [ebp - 0x178]
add edx, 0xfffffffe
mov dword [ebp - 0x178], edx
jmp 0x408b65
mov dword [ebp - 0xdc], 0
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx]
mov ebx, dword [eax + 0xd8]
dec ebx
cmp dword [ebp - 0xdc], ebx
jae 0x40a2ac
mov edx, dword fs:[0x2c]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xd8]
cmp dword [ebp - 0xdc], eax
mov dword [ebp - 0x1e8], eax
jb 0x4099e6
push eax
push dword [ebp - 0xdc]
push 0
push 0x57a
mov ebx, 0x470cb0
push ebx
call fcn.0041bd28
mov edx, dword [ebp - 0xdc]
shl edx, 3
mov ecx, dword fs:[0x2c]
mov ebx, dword [ecx]
lea ebx, [ebx + 0xd8]
mov ecx, dword [ebx + 4]
mov eax, dword [ebx]
mov eax, dword [edx + ecx]
mov ecx, dword [edx + ecx + 4]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], ecx
mov ecx, 2
cmp eax, ecx
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 0x1e0], ebx
ja 0x409a90
mov ebx, dword [ebx]
cmp dword [ebp - 0xdc], ebx
mov dword [ebp - 0x1e0], ebx
jb 0x409a54
push ebx
push dword [ebp - 0xdc]
push 0
push 0x57a
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xdc]
mov eax, dword [eax + 0xd8]
mov eax, dword [edx + ecx]
mov edx, dword [edx + ecx + 4]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], edx
push eax
push 2
push 0
push 0x57a
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov edx, dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd8]
mov eax, dword [edx + 0x10]
mov edx, dword [edx + 0x14]
push edx
push eax
mov eax, 0x4711c0
push eax
push 4
call fcn.0041dd3c
test al, al
je 0x409bed
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx]
push dword [edx + 0x14]
push dword [edx + 0x10]
mov eax, 0x4707b0
push eax
push 6
call fcn.0041dd3c
test al, al
je 0x409bed
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx]
mov eax, dword [edx + 0xd8]
cmp dword [ebp - 0xdc], eax
mov dword [ebp - 0x1e8], eax
jb 0x409b19
push eax
push dword [ebp - 0xdc]
push 0
push 0x57b
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov edx, dword [ebp - 0xdc]
shl edx, 3
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx]
lea ebx, [ecx + 0xd8]
mov ecx, dword [ebx + 4]
mov eax, dword [ebx]
mov eax, dword [edx + ecx]
mov ecx, dword [edx + ecx + 4]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], ecx
mov ecx, 1
cmp eax, ecx
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 0x1e0], ebx
ja 0x409bc3
mov ebx, dword [ebx]
cmp dword [ebp - 0xdc], ebx
mov dword [ebp - 0x1e0], ebx
jb 0x409b87
push ebx
push dword [ebp - 0xdc]
push 0
push 0x57b
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xdc]
mov eax, dword [eax + 0xd8]
mov eax, dword [edx + ecx]
mov edx, dword [edx + ecx + 4]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], edx
push eax
push 1
push 0
push 0x57b
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov edx, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xd0]
add edx, 8
mov dword [ebp - 0xc8], edx
mov eax, 0xfff0bdc2
call fcn.0040d41c
mov ecx, dword [ebp - 0xc8]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov edx, dword fs:[0x2c]
mov eax, dword [edx]
mov ecx, dword [eax + 0xd8]
cmp dword [ebp - 0xdc], ecx
mov dword [ebp - 0x1e8], ecx
jb 0x409c23
push ecx
push dword [ebp - 0xdc]
push 0
push 0x57c
mov edx, 0x470cb0
push edx
call fcn.0041bd28
mov eax, dword [ebp - 0xdc]
shl eax, 3
mov edx, dword fs:[0x2c]
mov edx, dword [edx]
lea ebx, [edx + 0xd8]
mov edx, dword [ebx + 4]
mov esi, dword [ebx]
mov esi, dword [eax + edx]
mov edx, dword [eax + edx + 4]
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0xbc], edx
mov edx, 2
cmp esi, edx
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1e0], ebx
ja 0x409cce
mov ebx, dword [ebx]
cmp dword [ebp - 0xdc], ebx
mov dword [ebp - 0x1e0], ebx
jb 0x409c91
push ebx
push dword [ebp - 0xdc]
push 0
push 0x57c
mov esi, 0x470cb0
push esi
call fcn.0041bd28
mov esi, dword fs:[0x2c]
mov esi, dword [esi]
mov edx, dword [esi + 0xdc]
mov esi, dword [esi + 0xd8]
mov ecx, dword [eax + edx + 4]
mov esi, dword [eax + edx]
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0xbc], ecx
push esi
push 2
push 0
push 0x57c
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword [ebp - 0xbc]
mov esi, dword [ebp - 0xc0]
mov esi, dword [edx + 0x10]
mov edx, dword [edx + 0x14]
push edx
push esi
mov edx, 0x4711c0
push edx
push 4
call fcn.0041dd3c
test al, al
je 0x409e2b
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx]
push dword [eax + 0x14]
push dword [eax + 0x10]
mov esi, 0x470cf0
push esi
push 4
call fcn.0041dd3c
test al, al
je 0x409e2b
mov edx, dword fs:[0x2c]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xd8]
cmp dword [ebp - 0xdc], eax
mov dword [ebp - 0x1e8], eax
jb 0x409d57
push eax
push dword [ebp - 0xdc]
push 0
push 0x57d
mov esi, 0x470cb0
push esi
call fcn.0041bd28
mov edx, dword [ebp - 0xdc]
shl edx, 3
mov ecx, dword fs:[0x2c]
mov esi, dword [ecx]
lea esi, [esi + 0xd8]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov eax, dword [edx + ecx]
mov ecx, dword [edx + ecx + 4]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], ecx
mov ecx, 1
cmp eax, ecx
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 0x1e0], esi
ja 0x409e01
mov esi, dword [esi]
cmp dword [ebp - 0xdc], esi
mov dword [ebp - 0x1e0], esi
jb 0x409dc5
push esi
push dword [ebp - 0xdc]
push 0
push 0x57d
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xdc]
mov eax, dword [eax + 0xd8]
mov eax, dword [edx + ecx]
mov edx, dword [edx + ecx + 4]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], edx
push eax
push 1
push 0
push 0x57d
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov edx, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb8]
add edx, 8
mov dword [ebp - 0xb0], edx
mov eax, 0xf423e
call fcn.0040d41c
mov ecx, dword [ebp - 0xb0]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov edx, dword fs:[0x2c]
mov eax, dword [edx]
mov ecx, dword [eax + 0xd8]
cmp dword [ebp - 0xdc], ecx
mov dword [ebp - 0x1e8], ecx
jb 0x409e61
push ecx
push dword [ebp - 0xdc]
push 0
push 0x57e
mov edx, 0x470cb0
push edx
call fcn.0041bd28
mov eax, dword [ebp - 0xdc]
shl eax, 3
mov edx, dword fs:[0x2c]
mov edx, dword [edx]
lea ebx, [edx + 0xd8]
mov edx, dword [ebx + 4]
mov esi, dword [ebx]
mov esi, dword [eax + edx]
mov edx, dword [eax + edx + 4]
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xa4], edx
mov edx, 2
cmp esi, edx
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1e0], ebx
ja 0x409f0c
mov ebx, dword [ebx]
cmp dword [ebp - 0xdc], ebx
mov dword [ebp - 0x1e0], ebx
jb 0x409ecf
push ebx
push dword [ebp - 0xdc]
push 0
push 0x57e
mov esi, 0x470cb0
push esi
call fcn.0041bd28
mov esi, dword fs:[0x2c]
mov esi, dword [esi]
mov edx, dword [esi + 0xdc]
mov esi, dword [esi + 0xd8]
mov ecx, dword [eax + edx + 4]
mov esi, dword [eax + edx]
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xa4], ecx
push esi
push 2
push 0
push 0x57e
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword [ebp - 0xa4]
mov esi, dword [ebp - 0xa8]
mov esi, dword [edx + 0x10]
mov edx, dword [edx + 0x14]
push edx
push esi
mov edx, 0x4711d0
push edx
push 4
call fcn.0041dd3c
test al, al
je 0x40a069
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx]
push dword [eax + 0x14]
push dword [eax + 0x10]
mov esi, 0x4707b0
push esi
push 6
call fcn.0041dd3c
test al, al
je 0x40a069
mov edx, dword fs:[0x2c]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xd8]
cmp dword [ebp - 0xdc], eax
mov dword [ebp - 0x1e8], eax
jb 0x409f95
push eax
push dword [ebp - 0xdc]
push 0
push 0x57f
mov esi, 0x470cb0
push esi
call fcn.0041bd28
mov edx, dword [ebp - 0xdc]
shl edx, 3
mov ecx, dword fs:[0x2c]
mov esi, dword [ecx]
lea esi, [esi + 0xd8]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov eax, dword [edx + ecx]
mov ecx, dword [edx + ecx + 4]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], ecx
mov ecx, 1
cmp eax, ecx
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 0x1e0], esi
ja 0x40a03f
mov esi, dword [esi]
cmp dword [ebp - 0xdc], esi
mov dword [ebp - 0x1e0], esi
jb 0x40a003
push esi
push dword [ebp - 0xdc]
push 0
push 0x57f
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xdc]
mov eax, dword [eax + 0xd8]
mov eax, dword [edx + ecx]
mov edx, dword [edx + ecx + 4]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], edx
push eax
push 1
push 0
push 0x57f
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov edx, dword [ebp - 0x9c]
mov eax, dword [ebp - 0xa0]
add edx, 8
mov dword [ebp - 0x98], edx
mov eax, 0xf423d
call fcn.0040d41c
mov ecx, dword [ebp - 0x98]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov edx, dword fs:[0x2c]
mov eax, dword [edx]
mov ecx, dword [eax + 0xd8]
cmp dword [ebp - 0xdc], ecx
mov dword [ebp - 0x1e8], ecx
jb 0x40a09f
push ecx
push dword [ebp - 0xdc]
push 0
push 0x580
mov edx, 0x470cb0
push edx
call fcn.0041bd28
mov eax, dword [ebp - 0xdc]
shl eax, 3
mov edx, dword fs:[0x2c]
mov edx, dword [edx]
lea ebx, [edx + 0xd8]
mov edx, dword [ebx + 4]
mov esi, dword [ebx]
mov esi, dword [eax + edx]
mov edx, dword [eax + edx + 4]
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x8c], edx
mov edx, 2
cmp esi, edx
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1e0], ebx
ja 0x40a14a
mov ebx, dword [ebx]
cmp dword [ebp - 0xdc], ebx
mov dword [ebp - 0x1e0], ebx
jb 0x40a10d
push ebx
push dword [ebp - 0xdc]
push 0
push 0x580
mov esi, 0x470cb0
push esi
call fcn.0041bd28
mov esi, dword fs:[0x2c]
mov esi, dword [esi]
mov edx, dword [esi + 0xdc]
mov esi, dword [esi + 0xd8]
mov ecx, dword [eax + edx + 4]
mov esi, dword [eax + edx]
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x8c], ecx
push esi
push 2
push 0
push 0x580
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword [ebp - 0x8c]
mov esi, dword [ebp - 0x90]
mov esi, dword [edx + 0x10]
mov edx, dword [edx + 0x14]
push edx
push esi
mov edx, 0x4711d0
push edx
push 4
call fcn.0041dd3c
test al, al
je 0x40a2a1
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx]
push dword [eax + 0x14]
push dword [eax + 0x10]
mov esi, 0x470cf0
push esi
push 4
call fcn.0041dd3c
test al, al
je 0x40a2a1
mov edx, dword fs:[0x2c]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xd8]
cmp dword [ebp - 0xdc], eax
mov dword [ebp - 0x1e8], eax
jb 0x40a1d3
push eax
push dword [ebp - 0xdc]
push 0
push 0x581
mov esi, 0x470cb0
push esi
call fcn.0041bd28
mov edx, dword [ebp - 0xdc]
shl edx, 3
mov ecx, dword fs:[0x2c]
mov esi, dword [ecx]
lea esi, [esi + 0xd8]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov eax, dword [edx + ecx]
mov ecx, dword [edx + ecx + 4]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], ecx
mov ecx, 1
cmp eax, ecx
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 0x1e0], esi
ja 0x40a27d
mov esi, dword [esi]
cmp dword [ebp - 0xdc], esi
mov dword [ebp - 0x1e0], esi
jb 0x40a241
push esi
push dword [ebp - 0xdc]
push 0
push 0x581
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xdc]
mov eax, dword [eax + 0xd8]
mov eax, dword [edx + ecx]
mov edx, dword [edx + ecx + 4]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], edx
push eax
push 1
push 0
push 0x581
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x88]
add edx, 8
mov dword [ebp - 0x80], edx
mov eax, 0xfff0bdc3
call fcn.0040d41c
mov ecx, dword [ebp - 0x80]
mov dword [ecx], eax
mov dword [ecx + 4], edx
inc dword [ebp - 0xdc]
jmp 0x409994
mov edx, dword fs:[0x2c]
mov eax, dword [edx]
push dword [eax + 0x14]
push dword [eax + 0x10]
mov ecx, 0x4707b0
push ecx
push 6
call fcn.0041dd3c
test al, al
je 0x40a6c1
mov dword [ebp - 0x1d8], 0xfff0bdc1
mov dword [ebp - 0x7c], 0
mov edx, dword fs:[0x2c]
mov eax, dword [edx]
mov ecx, dword [eax + 0xd8]
dec ecx
cmp dword [ebp - 0x7c], ecx
jae 0x40a4ca
mov edx, dword fs:[0x2c]
mov eax, dword [edx]
mov ecx, dword [eax + 0xd8]
cmp dword [ebp - 0x7c], ecx
mov dword [ebp - 0x1e8], ecx
jb 0x40a330
push ecx
push dword [ebp - 0x7c]
push 0
push 0x58e
mov edx, 0x470cb0
push edx
call fcn.0041bd28
mov eax, dword [ebp - 0x7c]
shl eax, 3
mov edx, dword fs:[0x2c]
mov edx, dword [edx]
lea ebx, [edx + 0xd8]
mov edx, dword [ebx + 4]
mov esi, dword [ebx]
mov esi, dword [eax + edx]
mov edx, dword [eax + edx + 4]
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], edx
mov edx, 1
cmp esi, edx
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1e0], ebx
ja 0x40a3c6
mov ebx, dword [ebx]
cmp dword [ebp - 0x7c], ebx
mov dword [ebp - 0x1e0], ebx
jb 0x40a38f
push ebx
push dword [ebp - 0x7c]
push 0
push 0x58e
mov esi, 0x470cb0
push esi
call fcn.0041bd28
mov esi, dword fs:[0x2c]
mov esi, dword [esi]
mov edx, dword [esi + 0xdc]
mov esi, dword [esi + 0xd8]
mov ecx, dword [eax + edx + 4]
mov esi, dword [eax + edx]
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], ecx
push esi
push 1
push 0
push 0x58e
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword [ebp - 0x74]
mov esi, dword [ebp - 0x78]
mov esi, dword [edx + 8]
mov edx, dword [edx + 0xc]
push edx
push esi
call fcn.0040c69c
cmp eax, dword [ebp - 0x1d8]
jle 0x40a4c2
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx]
mov edx, dword [eax + 0xd8]
cmp dword [ebp - 0x7c], edx
mov dword [ebp - 0x1e8], edx
jb 0x40a415
push edx
push dword [ebp - 0x7c]
push 0
push 0x590
mov esi, 0x470cb0
push esi
call fcn.0041bd28
mov ecx, dword [ebp - 0x7c]
shl ecx, 3
mov eax, dword fs:[0x2c]
mov esi, dword [eax]
lea esi, [esi + 0xd8]
mov edx, dword [esi + 4]
mov eax, dword [esi]
mov eax, dword [ecx + edx]
mov edx, dword [ecx + edx + 4]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
mov edx, 1
cmp eax, edx
mov dword [ebp - 0x1e8], ecx
mov dword [ebp - 0x1e0], esi
ja 0x40a4a9
mov esi, dword [esi]
cmp dword [ebp - 0x7c], esi
mov dword [ebp - 0x1e0], esi
jb 0x40a473
push esi
push dword [ebp - 0x7c]
push 0
push 0x590
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov edx, dword [eax + 0xdc]
mov eax, dword [eax + 0xd8]
mov eax, dword [ecx + edx]
mov edx, dword [ecx + edx + 4]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
push eax
push 1
push 0
push 0x590
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x70]
mov eax, dword [edx + 8]
mov edx, dword [edx + 0xc]
push edx
push eax
call fcn.0040c69c
mov dword [ebp - 0x1d8], eax
inc dword [ebp - 0x7c]
jmp 0x40a2e7
push 0
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx]
mov eax, dword [eax + 0xd8]
dec eax
call fcn.0041a96c
mov dword [ebp - 0x1c8], eax
mov edx, dword fs:[0x2c]
mov ecx, dword [edx]
mov eax, dword [ecx + 0xd8]
cmp dword [ebp - 0x1c8], eax
mov dword [ebp - 0x1e8], eax
jb 0x40a51d
push eax
push dword [ebp - 0x1c8]
push 0
push 0x596
mov edx, 0x470cb0
push edx
call fcn.0041bd28
mov ecx, dword [ebp - 0x1c8]
shl ecx, 3
mov edx, dword fs:[0x2c]
mov edx, dword [edx]
lea ebx, [edx + 0xd8]
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
mov eax, dword [ecx + edx]
mov edx, dword [ecx + edx + 4]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], edx
mov edx, 1
cmp eax, edx
mov dword [ebp - 0x1e8], ecx
mov dword [ebp - 0x1e0], ebx
ja 0x40a5bb
mov ebx, dword [ebx]
cmp dword [ebp - 0x1c8], ebx
mov dword [ebp - 0x1e0], ebx
jb 0x40a585
push ebx
push dword [ebp - 0x1c8]
push 0
push 0x596
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov edx, dword [eax + 0xdc]
mov eax, dword [eax + 0xd8]
mov eax, dword [ecx + edx]
mov edx, dword [ecx + edx + 4]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], edx
push eax
push 1
push 0
push 0x596
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x68]
mov eax, dword [edx + 8]
mov edx, dword [edx + 0xc]
push edx
push eax
call fcn.0040c69c
cmp eax, dword [ebp - 0x1d8]
jne 0x40a4ca
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx]
mov edx, dword [eax + 0xd8]
cmp dword [ebp - 0x1c8], edx
mov dword [ebp - 0x1e8], edx
jb 0x40a610
push edx
push dword [ebp - 0x1c8]
push 0
push 0x599
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov eax, dword [ebp - 0x1c8]
shl eax, 3
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx]
lea ebx, [ecx + 0xd8]
mov ecx, dword [ebx + 4]
mov esi, dword [ebx]
mov esi, dword [eax + ecx]
mov ecx, dword [eax + ecx + 4]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], ecx
test esi, esi
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1e0], ebx
jne 0x40a6aa
mov ebx, dword [ebx]
cmp dword [ebp - 0x1c8], ebx
mov dword [ebp - 0x1e0], ebx
jb 0x40a673
push ebx
push dword [ebp - 0x1c8]
push 0
push 0x599
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov esi, dword fs:[0x2c]
mov ecx, dword [esi]
mov esi, dword [ecx + 0xd8]
mov ecx, dword [ecx + 0xdc]
mov edx, dword [eax + ecx + 4]
mov esi, dword [eax + ecx]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], edx
push esi
push 0
push 0
push 0x599
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov ecx, dword [ebp - 0x5c]
mov esi, dword [ebp - 0x60]
mov esi, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x1d0], esi
mov dword [ebp - 0x1cc], ecx
mov ecx, dword fs:[0x2c]
mov esi, dword [ecx]
push dword [esi + 0x14]
push dword [esi + 0x10]
mov ecx, 0x470cf0
push ecx
push 4
call fcn.0041dd3c
test al, al
je 0x40a8de
mov dword [ebp - 0x1d8], 0xf423f
mov dword [ebp - 0x58], 0
mov eax, dword fs:[0x2c]
mov edx, dword [eax]
mov esi, dword [edx + 0xd8]
dec esi
cmp dword [ebp - 0x58], esi
jae 0x40a8de
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx]
mov edx, dword [eax + 0xd8]
cmp dword [ebp - 0x58], edx
mov dword [ebp - 0x1e8], edx
jb 0x40a744
push edx
push dword [ebp - 0x58]
push 0
push 0x5a2
mov esi, 0x470cb0
push esi
call fcn.0041bd28
mov ecx, dword [ebp - 0x58]
shl ecx, 3
mov eax, dword fs:[0x2c]
mov esi, dword [eax]
lea esi, [esi + 0xd8]
mov edx, dword [esi + 4]
mov eax, dword [esi]
mov eax, dword [ecx + edx]
mov edx, dword [ecx + edx + 4]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov edx, 1
cmp eax, edx
mov dword [ebp - 0x1e8], ecx
mov dword [ebp - 0x1e0], esi
ja 0x40a7d8
mov esi, dword [esi]
cmp dword [ebp - 0x58], esi
mov dword [ebp - 0x1e0], esi
jb 0x40a7a2
push esi
push dword [ebp - 0x58]
push 0
push 0x5a2
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov edx, dword [eax + 0xdc]
mov eax, dword [eax + 0xd8]
mov eax, dword [ecx + edx]
mov edx, dword [ecx + edx + 4]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push eax
push 1
push 0
push 0x5a2
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x50]
mov eax, dword [edx + 8]
mov edx, dword [edx + 0xc]
push edx
push eax
call fcn.0040c69c
cmp eax, dword [ebp - 0x1d8]
jge 0x40a8d6
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx]
mov edx, dword [eax + 0xd8]
cmp dword [ebp - 0x58], edx
mov dword [ebp - 0x1e8], edx
jb 0x40a827
push edx
push dword [ebp - 0x58]
push 0
push 0x5a4
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov eax, dword [ebp - 0x58]
shl eax, 3
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx]
lea ebx, [ecx + 0xd8]
mov ecx, dword [ebx + 4]
mov esi, dword [ebx]
mov esi, dword [eax + ecx]
mov ecx, dword [eax + ecx + 4]
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], ecx
mov ecx, 1
cmp esi, ecx
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1e0], ebx
ja 0x40a8bd
mov ebx, dword [ebx]
cmp dword [ebp - 0x58], ebx
mov dword [ebp - 0x1e0], ebx
jb 0x40a886
push ebx
push dword [ebp - 0x58]
push 0
push 0x5a4
mov esi, 0x470cb0
push esi
call fcn.0041bd28
mov esi, dword fs:[0x2c]
mov esi, dword [esi]
mov edx, dword [esi + 0xdc]
mov esi, dword [esi + 0xd8]
mov ecx, dword [eax + edx + 4]
mov esi, dword [eax + edx]
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], ecx
push esi
push 1
push 0
push 0x5a4
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov esi, dword [edx + 8]
mov edx, dword [edx + 0xc]
push edx
push esi
call fcn.0040c69c
mov dword [ebp - 0x1d8], eax
inc dword [ebp - 0x58]
jmp 0x40a6fc
push 0
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx]
mov eax, dword [eax + 0xd8]
dec eax
call fcn.0041a96c
mov dword [ebp - 0x1c8], eax
mov edx, dword fs:[0x2c]
mov esi, dword [edx]
mov ecx, dword [esi + 0xd8]
cmp dword [ebp - 0x1c8], ecx
mov dword [ebp - 0x1e8], ecx
jb 0x40a931
push ecx
push dword [ebp - 0x1c8]
push 0
push 0x5b1
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov edx, dword [ebp - 0x1c8]
shl edx, 3
mov esi, dword fs:[0x2c]
mov eax, dword [esi]
lea esi, [eax + 0xd8]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov eax, dword [edx + ecx]
mov ecx, dword [edx + ecx + 4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ecx
mov ecx, 1
cmp eax, ecx
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 0x1e0], esi
ja 0x40a9cf
mov esi, dword [esi]
cmp dword [ebp - 0x1c8], esi
mov dword [ebp - 0x1e0], esi
jb 0x40a999
push esi
push dword [ebp - 0x1c8]
push 0
push 0x5b1
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xdc]
mov eax, dword [eax + 0xd8]
mov eax, dword [edx + ecx]
mov edx, dword [edx + ecx + 4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push eax
push 1
push 0
push 0x5b1
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov eax, dword [edx + 8]
mov edx, dword [edx + 0xc]
push edx
push eax
call fcn.0040c69c
cmp eax, dword [ebp - 0x1d8]
jne 0x40a8de
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx]
mov edx, dword [eax + 0xd8]
cmp dword [ebp - 0x1c8], edx
mov dword [ebp - 0x1e8], edx
jb 0x40aa24
push edx
push dword [ebp - 0x1c8]
push 0
push 0x5b4
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov eax, dword [ebp - 0x1c8]
shl eax, 3
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx]
lea ebx, [ecx + 0xd8]
mov ecx, dword [ebx + 4]
mov esi, dword [ebx]
mov esi, dword [eax + ecx]
mov ecx, dword [eax + ecx + 4]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], ecx
test esi, esi
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1e0], ebx
jne 0x40aabe
mov ebx, dword [ebx]
cmp dword [ebp - 0x1c8], ebx
mov dword [ebp - 0x1e0], ebx
jb 0x40aa87
push ebx
push dword [ebp - 0x1c8]
push 0
push 0x5b4
mov ecx, 0x470cb0
push ecx
call fcn.0041bd28
mov esi, dword fs:[0x2c]
mov ecx, dword [esi]
mov esi, dword [ecx + 0xd8]
mov ecx, dword [ecx + 0xdc]
mov edx, dword [eax + ecx + 4]
mov esi, dword [eax + ecx]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], edx
push esi
push 0
push 0
push 0x5b4
mov eax, 0x470cb0
push eax
call fcn.0041bd28
mov ecx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x38]
mov esi, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x1d0], esi
mov dword [ebp - 0x1cc], ecx
mov ecx, dword fs:[0x2c]
mov esi, dword [ecx]
cmp byte [esi + 0x19], 1
jne 0x40ab9b
lea ecx, [ebp - 0x30]
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov esi, 0x471280
push esi
push 0xb
mov eax, 0x470ef0
push eax
push 1
mov eax, ecx
call fcn.0041be0c
mov dword [ebp - 4], 0
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx]
mov eax, dword [edx + 0xd8]
mov edx, dword [edx + 0xdc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov esi, dword [ebp - 0x18]
cmp esi, dword [ebp - 0x20]
jae 0x40ab5f
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [edx + ecx*8]
mov edx, dword [edx + ecx*8 + 4]
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.0041aad8
inc dword [ebp - 0x18]
jmp 0x40ab38
lea eax, [ebp - 0x30]
call fcn.0041c4a4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc]
push 0xffffffffffffffff
push ecx
push 0x4700a0
call fcn.00421814
add esp, 0xc
call fcn.0040ab8b
jmp 0x40ab9b
mov edx, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x1d0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc