Function at 0x425b80
Capabilities:
Access peb ldr_data
Check os version
Contain obfuscated stackstrings
Encode data using base64
Get ntdll base address
Get process heap flags
Get process heap force flags
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x6a6fdc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x1c8], esi
call fcn.00497230
xor ebx, ebx
lea ecx, [esi + 8]
mov dword [esp + 0x244], ebx
call fcn.004ba5a0
mov al, byte [esp + 0x13]
mov dword [esi + 0x24], ebx
mov byte [esi + 0x20], al
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
lea ecx, [esi + 0x30]
mov byte [esp + 0x244], 2
call fcn.0060d180
lea ecx, [esi + 0x54]
mov byte [esp + 0x244], 3
call fcn.0060d180
mov cl, byte [esp + 0x13]
mov dword [esi + 0x90], ebx
mov byte [esi + 0x8c], cl
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dl, byte [esp + 0x13]
mov dword [esi + 0xa0], ebx
mov byte [esi + 0x9c], dl
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
lea ecx, [esi + 0xac]
mov byte [esp + 0x244], 6
call fcn.0060fe70
mov al, byte [esp + 0x13]
mov dword [esi + 0xb4], ebx
mov byte [esi + 0xb0], al
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov cl, byte [esp + 0x13]
mov dword [esi + 0xc4], ebx
mov byte [esi + 0xc0], cl
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
lea edi, [esi + 0xd0]
mov byte [esp + 0x244], 9
mov dword [esp + 0x2c], edi
lea ecx, [edi + 4]
call fcn.0060fe70
mov dl, byte [esp + 0x13]
mov dword [edi + 0xc], ebx
mov byte [edi + 8], dl
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
lea eax, [esp + 0x13]
lea ecx, [edi + 0x18]
push eax
mov byte [esp + 0x248], 0xb
call fcn.0064dca0
lea ecx, [esp + 0x37]
mov byte [esp + 0x244], 0xc
push ecx
lea ecx, [edi + 0x28]
call fcn.0064dca0
mov byte [esp + 0x244], 0xd
lea edi, [esi + 0x108]
lea ecx, [edi + 4]
mov dword [esp + 0x2c], edi
call fcn.0060fe70
lea ecx, [edi + 8]
mov byte [esp + 0x244], 0xe
call fcn.0060fe70
mov dl, byte [esp + 0x13]
mov dword [edi + 0x10], ebx
mov byte [edi + 0xc], dl
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
lea eax, [esp + 0x13]
lea ecx, [edi + 0x1c]
push eax
mov byte [esp + 0x248], 0x10
call fcn.0064dca0
lea ecx, [esp + 0x37]
mov byte [esp + 0x244], 0x11
push ecx
lea ecx, [edi + 0x2c]
call fcn.0064dca0
mov dl, byte [esp + 0x13]
lea eax, [esi + 0x144]
mov dword [esp + 0x2c], eax
mov byte [eax + 4], dl
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
lea ecx, [esp + 0x13]
mov byte [esp + 0x244], 0x13
push ecx
lea ecx, [eax + 0x14]
call fcn.0064dca0
mov dl, byte [esp + 0x13]
mov dword [esi + 0x16c], ebx
mov byte [esi + 0x168], dl
mov dword [esi + 0x170], ebx
mov dword [esi + 0x174], ebx
mov al, byte [esp + 0x13]
mov dword [esi + 0x17c], ebx
mov byte [esi + 0x178], al
mov dword [esi + 0x180], ebx
mov dword [esi + 0x184], ebx
mov cl, byte [esp + 0x13]
mov dword [esi + 0x18c], ebx
mov byte [esi + 0x188], cl
mov dword [esi + 0x190], ebx
mov dword [esi + 0x194], ebx
mov dl, byte [esp + 0x13]
mov dword [esi + 0x19c], ebx
mov byte [esi + 0x198], dl
mov dword [esi + 0x1a0], ebx
mov dword [esi + 0x1a4], ebx
mov al, byte [esp + 0x13]
mov dword [esi + 0x1ac], ebx
mov byte [esi + 0x1a8], al
mov dword [esi + 0x1b0], ebx
mov dword [esi + 0x1b4], ebx
lea edi, [esi + 0x1b8]
mov byte [esp + 0x244], 0x19
mov dword [esp + 0x2c], edi
lea ecx, [edi + 4]
call fcn.0060fe70
lea ecx, [edi + 8]
mov byte [esp + 0x244], 0x1a
call fcn.0060fe70
mov cl, byte [esp + 0x13]
mov byte [edi + 0xc], cl
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
lea edx, [esp + 0x13]
lea ecx, [edi + 0x1c]
push edx
mov byte [esp + 0x248], 0x1c
call fcn.0064dca0
lea eax, [esp + 0x37]
lea ecx, [edi + 0x2c]
push eax
mov byte [esp + 0x248], 0x1d
call fcn.0064dca0
lea ecx, [esp + 0x36]
mov byte [esp + 0x244], 0x1e
push ecx
lea ecx, [edi + 0x3c]
call fcn.0064dca0
mov dl, byte [esp + 0x13]
mov dword [esi + 0x208], ebx
mov byte [esi + 0x204], dl
mov dword [esi + 0x20c], ebx
mov dword [esi + 0x210], ebx
mov al, byte [esp + 0x13]
mov dword [esi + 0x218], ebx
mov byte [esi + 0x214], al
mov dword [esi + 0x21c], ebx
mov dword [esi + 0x220], ebx
mov cl, byte [esp + 0x13]
mov dword [esi], 0x6ce348
mov byte [esp + 0x18], cl
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x168]
mov byte [esp + 0x244], 0x22
call fcn.0060e1f0
push 6
push 0x7033c0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x24c], 0x23
mov dword [esp + 0x68], ebx
call fcn.0060ff10
push 6
push 0x7033c0
lea ecx, [esp + 0x40]
mov byte [esp + 0x24c], 0x24
call fcn.0060ff10
lea ecx, [esp + 0x144]
mov byte [esp + 0x244], 0x25
call fcn.0060fe70
mov dl, byte [esp + 0x13]
mov dword [esp + 0x14c], ebx
mov byte [esp + 0x148], dl
mov dword [esp + 0x150], ebx
mov dword [esp + 0x154], ebx
lea eax, [esp + 0x4e]
lea ecx, [esp + 0x158]
push eax
mov byte [esp + 0x248], 0x27
call fcn.0064dca0
lea ecx, [esp + 0x10c]
mov byte [esp + 0x244], 0x28
call fcn.0060fe70
mov cl, byte [esp + 0x4e]
mov byte [esp + 0x110], cl
mov dword [esp + 0x114], ebx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], ebx
lea edx, [esp + 0x4f]
lea ecx, [esp + 0x120]
push edx
mov byte [esp + 0x248], 0x2a
call fcn.0064dca0
mov ecx, dword [esp + 0x24c]
sub esp, 0x10
mov eax, ecx
mov ebp, esp
shr eax, 0x10
mov dword [esp + 0x74], eax
mov al, byte [esp + 0x5f]
mov dword [esi + 0x7c], ecx
mov dword [esp + 0x3c], esp
push ebx
mov ecx, ebp
mov byte [esp + 0x258], 0x2b
mov byte [ebp], al
call fcn.004138a0
mov edi, str.db_index.db
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.db_index.db
mov ecx, ebp
call fcn.00414030
lea ecx, [esp + 0x178]
call fcn.0060e5e0
xor ecx, ecx
mov cl, byte [esp + 0x65]
push ecx
push 4
lea ecx, [esp + 0x1c]
movzx di, al
call fcn.006102b0
mov edx, dword [esp + 0x64]
lea ecx, [esp + 0x14]
push edx
push 5
call fcn.006102b0
cmp di, bx
je 0x4286f5
push 0x20
push 1
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ebx
push 2
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ebx
push 3
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0060fe80
lea ecx, [esp + 0x3c]
call fcn.006101a0
lea ecx, [esp + 0x14]
lea edx, [esp + 0x50]
push ecx
push edx
lea ecx, [esp + 0x170]
call fcn.0060eaf0
mov edi, eax
lea eax, [esp + 0x18]
mov byte [esp + 0x244], 0x2c
cmp eax, edi
je 0x426197
mov eax, dword [edi + 4]
cmp eax, ebx
jne 0x426091
xor ebp, ebp
jmp 0x426099
mov ebp, dword [edi + 8]
sub ebp, eax
sar ebp, 2
lea ecx, [esp + 0x18]
call fcn.00639f30
cmp ebp, eax
ja 0x4260e1
mov edx, dword [esp + 0x1c]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push edx
push eax
push ecx
call fcn.00414b20
mov ecx, dword [esp + 0x2c]
add esp, 0xc
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00413d00
mov ecx, edi
call fcn.00639f30
mov edx, dword [esp + 0x1c]
lea eax, [edx + eax*4]
mov dword [esp + 0x20], eax
jmp 0x426197
mov ecx, edi
call fcn.00639f30
lea ecx, [esp + 0x18]
mov ebp, eax
call fcn.0063a250
cmp ebp, eax
ja 0x426140
mov ebp, dword [edi + 4]
lea ecx, [esp + 0x18]
call fcn.00639f30
mov ecx, dword [esp + 0x1c]
lea ebp, [ebp + eax*4]
mov eax, dword [edi + 4]
push ecx
push ebp
push eax
call fcn.00414b20
mov edx, dword [esp + 0x2c]
mov eax, dword [edi + 8]
add esp, 0xc
lea ecx, [esp + 0x18]
push edx
push eax
push ebp
call fcn.00413d30
mov ecx, edi
call fcn.00639f30
mov ecx, dword [esp + 0x1c]
lea edx, [ecx + eax*4]
mov dword [esp + 0x20], edx
jmp 0x426197
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00413d00
mov edx, dword [esp + 0x1c]
push edx
call fcn.00697880
add esp, 4
mov ecx, edi
call fcn.00639f30
cmp eax, ebx
jge 0x42616d
xor eax, eax
shl eax, 2
push eax
call fcn.00697be2
add esp, 4
mov dword [esp + 0x1c], eax
mov ecx, dword [edi + 8]
mov edi, dword [edi + 4]
push eax
push ecx
push edi
lea ecx, [esp + 0x24]
call fcn.00413d30
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov ebp, dword [esp + 0x58]
mov edi, dword [esp + 0x54]
cmp edi, ebp
mov byte [esp + 0x244], 0x2b
je 0x4261be
push ebx
mov ecx, edi
call fcn.00415aa0
add edi, 4
cmp edi, ebp
jne 0x4261ab
mov edi, dword [esp + 0x54]
push edi
call fcn.00697880
mov ecx, dword [esp + 0x20]
add esp, 4
cmp ecx, ebx
je 0x42639d
mov edi, dword [esp + 0x20]
sub edi, ecx
sar edi, 2
cmp di, 1
jne 0x42639b
push ebx
lea ecx, [esp + 0x1c]
call fcn.00413600
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0060fe80
lea ecx, [esp + 0x18]
call fcn.006101a0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
push edx
lea ecx, [esp + 0x20]
call fcn.00413cb0
lea eax, [esp + 0x14]
lea ecx, [esp + 0x50]
push eax
push ecx
lea ecx, [esp + 0x170]
call fcn.0060eaf0
mov edi, eax
lea edx, [esp + 0x18]
mov byte [esp + 0x244], 0x2d
cmp edx, edi
je 0x426356
mov eax, dword [edi + 4]
cmp eax, ebx
jne 0x426250
xor ebp, ebp
jmp 0x426258
mov ebp, dword [edi + 8]
sub ebp, eax
sar ebp, 2
lea ecx, [esp + 0x18]
call fcn.00639f30
cmp ebp, eax
ja 0x4262a0
mov edx, dword [esp + 0x1c]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push edx
push eax
push ecx
call fcn.00414b20
mov ecx, dword [esp + 0x2c]
add esp, 0xc
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00413d00
mov ecx, edi
call fcn.00639f30
mov edx, dword [esp + 0x1c]
lea eax, [edx + eax*4]
mov dword [esp + 0x20], eax
jmp 0x426356
mov ecx, edi
call fcn.00639f30
lea ecx, [esp + 0x18]
mov ebp, eax
call fcn.0063a250
cmp ebp, eax
ja 0x4262ff
mov ebp, dword [edi + 4]
lea ecx, [esp + 0x18]
call fcn.00639f30
mov ecx, dword [esp + 0x1c]
lea ebp, [ebp + eax*4]
mov eax, dword [edi + 4]
push ecx
push ebp
push eax
call fcn.00414b20
mov edx, dword [esp + 0x2c]
mov eax, dword [edi + 8]
add esp, 0xc
lea ecx, [esp + 0x18]
push edx
push eax
push ebp
call fcn.00413d30
mov ecx, edi
call fcn.00639f30
mov ecx, dword [esp + 0x1c]
lea edx, [ecx + eax*4]
mov dword [esp + 0x20], edx
jmp 0x426356
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00413d00
mov edx, dword [esp + 0x1c]
push edx
call fcn.00697880
add esp, 4
mov ecx, edi
call fcn.00639f30
cmp eax, ebx
jge 0x42632c
xor eax, eax
shl eax, 2
push eax
call fcn.00697be2
add esp, 4
mov dword [esp + 0x1c], eax
mov ecx, dword [edi + 8]
mov edi, dword [edi + 4]
push eax
push ecx
push edi
lea ecx, [esp + 0x24]
call fcn.00413d30
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov ebp, dword [esp + 0x58]
mov edi, dword [esp + 0x54]
cmp edi, ebp
mov byte [esp + 0x244], 0x2b
je 0x42637d
push ebx
mov ecx, edi
call fcn.00415aa0
add edi, 4
cmp edi, ebp
jne 0x42636a
mov edi, dword [esp + 0x54]
push edi
call fcn.00697880
mov ecx, dword [esp + 0x20]
add esp, 4
cmp ecx, ebx
je 0x42639d
mov edi, dword [esp + 0x20]
sub edi, ecx
sar edi, 2
cmp di, 1
jge 0x4263a7
mov edi, 1
jmp 0x428702
push ebx
call fcn.00610190
cmp di, 6
mov byte [esi + 0xd0], al
jne 0x426a77
push 1
lea ecx, [esp + 0x1c]
call fcn.00413600
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0060fe80
lea ecx, [esi + 0xd4]
call fcn.006101a0
mov ecx, dword [esp + 0x1c]
push ebx
add ecx, 8
call fcn.00610190
mov edx, dword [esp + 0x1c]
mov byte [esi + 0x82], al
add edx, 0xc
lea eax, [esp + 0x50]
push edx
push eax
lea ecx, [esp + 0x170]
call fcn.0060eaf0
mov ebp, eax
mov dword [esp + 0x40], ebp
lea edi, [esi + 0xd8]
mov byte [esp + 0x244], 0x2e
cmp edi, ebp
je 0x426548
mov ecx, dword [ebp + 4]
cmp ecx, ebx
jne 0x426435
mov dword [esp + 0x44], ebx
jmp 0x426441
mov eax, dword [ebp + 8]
sub eax, ecx
sar eax, 2
mov dword [esp + 0x44], eax
mov ecx, edi
call fcn.00639f30
cmp dword [esp + 0x44], eax
ja 0x426483
mov edx, dword [edi + 4]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 4]
push edx
push eax
push ecx
call fcn.00414b20
mov ecx, dword [edi + 8]
add esp, 0xc
push ecx
push eax
mov ecx, edi
call fcn.00413d00
mov ecx, ebp
call fcn.00639f30
mov edx, dword [edi + 4]
lea eax, [edx + eax*4]
mov dword [edi + 8], eax
jmp 0x426548
mov ecx, edi
call fcn.0063a250
mov edx, eax
mov ecx, ebp
mov dword [esp + 0x28], edx
call fcn.00639f30
mov ecx, dword [esp + 0x28]
cmp eax, ecx
ja 0x4264f3
mov ebp, dword [esp + 0x40]
mov ecx, edi
mov edx, dword [ebp + 4]
mov dword [esp + 0x28], edx
call fcn.00639f30
mov ecx, dword [esp + 0x28]
mov edx, dword [edi + 4]
push edx
lea ecx, [ecx + eax*4]
mov eax, dword [ebp + 4]
push ecx
push eax
mov dword [esp + 0x34], ecx
call fcn.00414b20
mov ecx, dword [edi + 8]
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x34]
add esp, 0xc
push ecx
push eax
push edx
mov ecx, edi
call fcn.00413d30
mov ecx, ebp
call fcn.00639f30
mov ecx, dword [edi + 4]
lea edx, [ecx + eax*4]
mov dword [edi + 8], edx
jmp 0x426548
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
mov ecx, edi
call fcn.00413d00
mov eax, dword [edi + 4]
push eax
call fcn.00697880
mov ebp, dword [esp + 0x44]
add esp, 4
mov ecx, ebp
call fcn.00639f30
cmp eax, ebx
jge 0x42651f
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.00697be2
add esp, 4
mov dword [edi + 4], eax
mov ecx, dword [ebp + 8]
mov ebp, dword [ebp + 4]
push eax
push ecx
push ebp
mov ecx, edi
call fcn.00413d30
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov ebp, dword [esp + 0x58]
mov edi, dword [esp + 0x54]
cmp edi, ebp
mov byte [esp + 0x244], 0x2b
je 0x42656f
push ebx
mov ecx, edi
call fcn.00415aa0
add edi, 4
cmp edi, ebp
jne 0x42655c
mov edi, dword [esp + 0x54]
push edi
call fcn.00697880
mov eax, dword [esp + 0x20]
add esp, 4
add eax, 0x10
lea ecx, [esp + 0x50]
push eax
push ecx
lea ecx, [esp + 0x170]
call fcn.0060eaf0
mov ebp, eax
mov dword [esp + 0x40], ebp
lea edi, [esi + 0xe8]
mov byte [esp + 0x244], 0x2f
cmp edi, ebp
je 0x4266c5
mov ecx, dword [ebp + 4]
cmp ecx, ebx
jne 0x4265ba
mov dword [esp + 0x44], ebx
jmp 0x4265c6
mov eax, dword [ebp + 8]
sub eax, ecx
sar eax, 2
mov dword [esp + 0x44], eax
mov ecx, edi
call fcn.00639f30
cmp dword [esp + 0x44], eax
ja 0x426608
mov edx, dword [edi + 4]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 4]
push edx
push eax
push ecx
call fcn.00414b20
mov ecx, dword [edi + 8]
add esp, 0xc
push ecx
push eax
mov ecx, edi
call fcn.00413d00
mov ecx, ebp
call fcn.00639f30
mov edx, dword [edi + 4]
lea eax, [edx + eax*4]
mov dword [edi + 8], eax
jmp 0x4266c5
mov ecx, ebp
call fcn.00639f30
mov ecx, edi
mov ebp, eax
call fcn.0063a250
cmp ebp, eax
ja 0x426670
mov ebp, dword [esp + 0x40]
mov ecx, dword [ebp + 4]
mov dword [esp + 0x28], ecx
mov ecx, edi
call fcn.00639f30
mov edx, dword [esp + 0x28]
lea ecx, [edx + eax*4]
mov edx, dword [edi + 4]
mov eax, dword [ebp + 4]
push edx
push ecx
push eax
mov dword [esp + 0x34], ecx
call fcn.00414b20
mov ecx, dword [edi + 8]
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x34]
add esp, 0xc
push ecx
push eax
push edx
mov ecx, edi
call fcn.00413d30
mov ecx, ebp
call fcn.00639f30
mov ecx, dword [edi + 4]
lea edx, [ecx + eax*4]
mov dword [edi + 8], edx
jmp 0x4266c5
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
mov ecx, edi
call fcn.00413d00
mov eax, dword [edi + 4]
push eax
call fcn.00697880
mov ebp, dword [esp + 0x44]
add esp, 4
mov ecx, ebp
call fcn.00639f30
cmp eax, ebx
jge 0x42669c
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.00697be2
add esp, 4
mov dword [edi + 4], eax
mov ecx, dword [ebp + 8]
mov ebp, dword [ebp + 4]
push eax
push ecx
push ebp
mov ecx, edi
call fcn.00413d30
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov ebp, dword [esp + 0x58]
mov edi, dword [esp + 0x54]
cmp edi, ebp
mov byte [esp + 0x244], 0x2b
je 0x4266ec
push ebx
mov ecx, edi
call fcn.00415aa0
add edi, 4
cmp edi, ebp
jne 0x4266d9
mov edi, dword [esp + 0x54]
push edi
call fcn.00697880
mov eax, dword [esp + 0x20]
add esp, 4
add eax, 0x14
lea ecx, [esp + 0x50]
push eax
push ecx
lea ecx, [esp + 0x170]
call fcn.0060eaf0
mov ebp, eax
mov dword [esp + 0x40], ebp
lea edi, [esi + 0xf8]
mov byte [esp + 0x244], 0x30
cmp edi, ebp
je 0x426842
mov ecx, dword [ebp + 4]
cmp ecx, ebx
jne 0x426737
mov dword [esp + 0x44], ebx
jmp 0x426743
mov eax, dword [ebp + 8]
sub eax, ecx
sar eax, 2
mov dword [esp + 0x44], eax
mov ecx, edi
call fcn.00639f30
cmp dword [esp + 0x44], eax
ja 0x426785
mov edx, dword [edi + 4]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 4]
push edx
push eax
push ecx
call fcn.00414b20
mov ecx, dword [edi + 8]
add esp, 0xc
push ecx
push eax
mov ecx, edi
call fcn.00413d00
mov ecx, ebp
call fcn.00639f30
mov edx, dword [edi + 4]
lea eax, [edx + eax*4]
mov dword [edi + 8], eax
jmp 0x426842
mov ecx, ebp
call fcn.00639f30
mov ecx, edi
mov ebp, eax
call fcn.0063a250
cmp ebp, eax
ja 0x4267ed
mov ebp, dword [esp + 0x40]
mov ecx, dword [ebp + 4]
mov dword [esp + 0x28], ecx
mov ecx, edi
call fcn.00639f30
mov edx, dword [esp + 0x28]
lea ecx, [edx + eax*4]
mov edx, dword [edi + 4]
mov eax, dword [ebp + 4]
push edx
push ecx
push eax
mov dword [esp + 0x34], ecx
call fcn.00414b20
mov ecx, dword [edi + 8]
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x34]
add esp, 0xc
push ecx
push eax
push edx
mov ecx, edi
call fcn.00413d30
mov ecx, ebp
call fcn.00639f30
mov ecx, dword [edi + 4]
lea edx, [ecx + eax*4]
mov dword [edi + 8], edx
jmp 0x426842
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
mov ecx, edi
call fcn.00413d00
mov eax, dword [edi + 4]
push eax
call fcn.00697880
mov ebp, dword [esp + 0x44]
add esp, 4
mov ecx, ebp
call fcn.00639f30
cmp eax, ebx
jge 0x426819
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.00697be2
add esp, 4
mov dword [edi + 4], eax
mov ecx, dword [ebp + 8]
mov ebp, dword [ebp + 4]
push eax
push ecx
push ebp
mov ecx, edi
call fcn.00413d30
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov ebp, dword [esp + 0x58]
mov edi, dword [esp + 0x54]
cmp edi, ebp
mov byte [esp + 0x244], 0x2b
je 0x426869
push ebx
mov ecx, edi
call fcn.00415aa0
add edi, 4
cmp edi, ebp
jne 0x426856
mov edi, dword [esp + 0x54]
push edi
call fcn.00697880
add esp, 4
lea edi, [esi + 0xd4]
mov ecx, edi
push ebx
call fcn.00610190
push 1
mov ecx, edi
mov byte [esi + 0x80], al
call fcn.00610190
xor ecx, ecx
lea edx, [esp + 0x38]
mov ch, byte [esi + 0x80]
mov byte [esi + 0x81], al
mov cl, al
push ecx
mov word [esi + 0x88], cx
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.0060fe80
lea ecx, [esp + 0x18]
call fcn.006101a0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00413cb0
push ebx
push 1
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ebx
push 2
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ebx
push 3
lea ecx, [esp + 0x1c]
call fcn.006102b0
lea edx, [esp + 0x14]
lea eax, [esp + 0x50]
push edx
push eax
lea ecx, [esp + 0x170]
call fcn.0060eaf0
mov edi, eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x244], 0x31
cmp ecx, edi
je 0x426a34
mov eax, dword [edi + 4]
cmp eax, ebx
jne 0x42692e
xor ebp, ebp
jmp 0x426936
mov ebp, dword [edi + 8]
sub ebp, eax
sar ebp, 2
lea ecx, [esp + 0x18]
call fcn.00639f30
cmp ebp, eax
ja 0x42697e
mov edx, dword [esp + 0x1c]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push edx
push eax
push ecx
call fcn.00414b20
mov ecx, dword [esp + 0x2c]
add esp, 0xc
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00413d00
mov ecx, edi
call fcn.00639f30
mov edx, dword [esp + 0x1c]
lea eax, [edx + eax*4]
mov dword [esp + 0x20], eax
jmp 0x426a34
mov ecx, edi
call fcn.00639f30
lea ecx, [esp + 0x18]
mov ebp, eax
call fcn.0063a250
cmp ebp, eax
ja 0x4269dd
mov ebp, dword [edi + 4]
lea ecx, [esp + 0x18]
call fcn.00639f30
mov ecx, dword [esp + 0x1c]
lea ebp, [ebp + eax*4]
mov eax, dword [edi + 4]
push ecx
push ebp
push eax
call fcn.00414b20
mov edx, dword [esp + 0x2c]
mov eax, dword [edi + 8]
add esp, 0xc
lea ecx, [esp + 0x18]
push edx
push eax
push ebp
call fcn.00413d30
mov ecx, edi
call fcn.00639f30
mov ecx, dword [esp + 0x1c]
lea edx, [ecx + eax*4]
mov dword [esp + 0x20], edx
jmp 0x426a34
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00413d00
mov edx, dword [esp + 0x1c]
push edx
call fcn.00697880
add esp, 4
mov ecx, edi
call fcn.00639f30
cmp eax, ebx
jge 0x426a0a
xor eax, eax
shl eax, 2
push eax
call fcn.00697be2
add esp, 4
mov dword [esp + 0x1c], eax
mov ecx, dword [edi + 8]
mov edi, dword [edi + 4]
push eax
push ecx
push edi
lea ecx, [esp + 0x24]
call fcn.00413d30
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov ebp, dword [esp + 0x58]
mov edi, dword [esp + 0x54]
cmp edi, ebp
mov byte [esp + 0x244], 0x2b
je 0x426a5b
push ebx
mov ecx, edi
call fcn.00415aa0
add edi, 4
cmp edi, ebp
jne 0x426a48
mov edi, dword [esp + 0x54]
push edi
call fcn.00697880
mov eax, dword [esp + 0x20]
add esp, 4
cmp eax, ebx
je 0x426a77
mov ecx, dword [esp + 0x20]
sub ecx, eax
sar ecx, 2
jne 0x426a81
mov edi, 1
jmp 0x428702
push ebx
lea ecx, [esp + 0x1c]
call fcn.00413600
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0060fe80
lea edi, [esi + 0xac]
mov ecx, edi
call fcn.006101a0
push ebx
mov ecx, edi
call fcn.00610190
cmp al, bl
mov byte [esp + 0x13], al
mov byte [esp + 0x3f], bl
jbe 0x4286f5
movzx dx, byte [esp + 0x3f]
inc edx
lea ecx, [esi + 0xac]
push edx
call fcn.00610190
cmp al, 1
jne 0x42719f
push 1
push 1
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ebx
push 2
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ebx
push 3
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0060fe80
lea ecx, [esp + 0x3c]
call fcn.006101a0
lea ecx, [esp + 0x14]
lea edx, [esp + 0x78]
push ecx
push edx
lea ecx, [esp + 0x170]
call fcn.0060eaf0
mov ebp, eax
mov dword [esp + 0x28], ebp
lea edi, [esi + 0x9c]
mov byte [esp + 0x244], 0x32
cmp edi, ebp
je 0x426c69
mov ecx, dword [ebp + 4]
cmp ecx, ebx
jne 0x426b56
mov dword [esp + 0x30], ebx
jmp 0x426b62
mov eax, dword [ebp + 8]
sub eax, ecx
sar eax, 2
mov dword [esp + 0x30], eax
mov ecx, edi
call fcn.00639f30
cmp dword [esp + 0x30], eax
ja 0x426ba4
mov edx, dword [edi + 4]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 4]
push edx
push eax
push ecx
call fcn.00414b20
mov ecx, dword [edi + 8]
add esp, 0xc
push ecx
push eax
mov ecx, edi
call fcn.00413d00
mov ecx, ebp
call fcn.00639f30
mov edx, dword [edi + 4]
lea eax, [edx + eax*4]
mov dword [edi + 8], eax
jmp 0x426c69
mov ecx, edi
call fcn.0063a250
mov edx, eax
mov ecx, ebp
mov dword [esp + 0x30], edx
call fcn.00639f30
mov ecx, dword [esp + 0x30]
cmp eax, ecx
ja 0x426c14
mov ebp, dword [esp + 0x28]
mov ecx, edi
mov edx, dword [ebp + 4]
mov dword [esp + 0x28], edx
call fcn.00639f30
mov ecx, dword [esp + 0x28]
mov edx, dword [edi + 4]
push edx
lea eax, [ecx + eax*4]
mov ecx, dword [ebp + 4]
push eax
push ecx
mov dword [esp + 0x34], eax
call fcn.00414b20
mov ecx, dword [edi + 8]
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x34]
add esp, 0xc
push ecx
push eax
push edx
mov ecx, edi
call fcn.00413d30
mov ecx, ebp
call fcn.00639f30
mov ecx, dword [edi + 4]
lea edx, [ecx + eax*4]
mov dword [edi + 8], edx
jmp 0x426c69
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
mov ecx, edi
call fcn.00413d00
mov eax, dword [edi + 4]
push eax
call fcn.00697880
mov ebp, dword [esp + 0x2c]
add esp, 4
mov ecx, ebp
call fcn.00639f30
cmp eax, ebx
jge 0x426c40
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.00697be2
add esp, 4
mov dword [edi + 4], eax
mov ecx, dword [ebp + 8]
mov ebp, dword [ebp + 4]
push eax
push ecx
push ebp
mov ecx, edi
call fcn.00413d30
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x7c]
push eax
push ecx
lea ecx, [esp + 0x80]
mov byte [esp + 0x24c], 0x2b
call fcn.00413d00
mov edx, dword [esp + 0x7c]
push edx
call fcn.00697880
mov ecx, dword [edi + 4]
add esp, 4
cmp ecx, ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
je 0x4286d3
mov eax, dword [edi + 8]
sub eax, ecx
sar eax, 2
cmp ax, 1
jne 0x426e86
push ebx
mov ecx, edi
call fcn.00413600
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0060fe80
lea ecx, [esp + 0x18]
call fcn.006101a0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
mov ecx, edi
call fcn.00413cb0
lea eax, [esp + 0x14]
lea ecx, [esp + 0x68]
push eax
push ecx
lea ecx, [esp + 0x170]
call fcn.0060eaf0
mov ebp, eax
mov dword [esp + 0x30], ebp
cmp edi, ebp
mov byte [esp + 0x244], 0x33
je 0x426e3f
mov ecx, dword [ebp + 4]
cmp ecx, ebx
jne 0x426d2c
mov dword [esp + 0x28], ebx
jmp 0x426d38
mov eax, dword [ebp + 8]
sub eax, ecx
sar eax, 2
mov dword [esp + 0x28], eax
mov ecx, edi
call fcn.00639f30
cmp dword [esp + 0x28], eax
ja 0x426d7a
mov edx, dword [edi + 4]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 4]
push edx
push eax
push ecx
call fcn.00414b20
mov ecx, dword [edi + 8]
add esp, 0xc
push ecx
push eax
mov ecx, edi
call fcn.00413d00
mov ecx, ebp
call fcn.00639f30
mov edx, dword [edi + 4]
lea eax, [edx + eax*4]
mov dword [edi + 8], eax
jmp 0x426e3f
mov ecx, edi
call fcn.0063a250
mov edx, eax
mov ecx, ebp
mov dword [esp + 0x28], edx
call fcn.00639f30
mov ecx, dword [esp + 0x28]
cmp eax, ecx
ja 0x426dea
mov ebp, dword [esp + 0x30]
mov ecx, edi
mov edx, dword [ebp + 4]
mov dword [esp + 0x28], edx
call fcn.00639f30
mov ecx, dword [esp + 0x28]
mov edx, dword [edi + 4]
push edx
lea eax, [ecx + eax*4]
mov ecx, dword [ebp + 4]
push eax
push ecx
mov dword [esp + 0x34], eax
call fcn.00414b20
mov ecx, dword [edi + 8]
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x34]
add esp, 0xc
push ecx
push eax
push edx
mov ecx, edi
call fcn.00413d30
mov ecx, ebp
call fcn.00639f30
mov ecx, dword [edi + 4]
lea edx, [ecx + eax*4]
mov dword [edi + 8], edx
jmp 0x426e3f
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
mov ecx, edi
call fcn.00413d00
mov eax, dword [edi + 4]
push eax
call fcn.00697880
mov ebp, dword [esp + 0x34]
add esp, 4
mov ecx, ebp
call fcn.00639f30
cmp eax, ebx
jge 0x426e16
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.00697be2
add esp, 4
mov dword [edi + 4], eax
mov ecx, dword [ebp + 8]
mov ebp, dword [ebp + 4]
push eax
push ecx
push ebp
mov ecx, edi
call fcn.00413d30
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x6c]
push eax
push ecx
lea ecx, [esp + 0x70]
mov byte [esp + 0x24c], 0x2b
call fcn.00413d00
mov edx, dword [esp + 0x6c]
push edx
call fcn.00697880
mov ecx, dword [edi + 4]
add esp, 4
cmp ecx, ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
je 0x4286d3
mov eax, dword [edi + 8]
sub eax, ecx
sar eax, 2
cmp ax, 2
jl 0x4286d3
mov eax, dword [esi + 0x94]
mov ecx, dword [esi + 0x90]
lea edi, [esi + 0x8c]
push eax
push ecx
mov ecx, edi
call fcn.00413cb0
mov eax, dword [esi + 0xa0]
mov ecx, dword [edi + 8]
add eax, 4
push eax
push ecx
mov ecx, edi
call fcn.00413b20
mov ecx, dword [esi + 0x90]
push ebx
call fcn.00610190
movzx ax, al
cmp ax, bx
mov dword [esp + 0x28], eax
mov byte [esp + 0x36], bl
jle 0x42718e
xor edi, edi
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00413cb0
mov ecx, dword [esi + 0x90]
inc edi
push edi
call fcn.00610190
push eax
push 2
lea ecx, [esp + 0x1c]
call fcn.006102b0
lea edx, [esp + 0x14]
lea eax, [esp + 0x130]
push edx
push eax
lea ecx, [esp + 0x170]
call fcn.0060eaf0
mov edi, eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x244], 0x34
cmp ecx, edi
je 0x42704f
mov eax, dword [edi + 4]
cmp eax, ebx
jne 0x426f49
xor ebp, ebp
jmp 0x426f51
mov ebp, dword [edi + 8]
sub ebp, eax
sar ebp, 2
lea ecx, [esp + 0x18]
call fcn.00639f30
cmp ebp, eax
ja 0x426f99
mov edx, dword [esp + 0x1c]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push edx
push eax
push ecx
call fcn.00414b20
mov ecx, dword [esp + 0x2c]
add esp, 0xc
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00413d00
mov ecx, edi
call fcn.00639f30
mov edx, dword [esp + 0x1c]
lea eax, [edx + eax*4]
mov dword [esp + 0x20], eax
jmp 0x42704f
mov ecx, edi
call fcn.00639f30
lea ecx, [esp + 0x18]
mov ebp, eax
call fcn.0063a250
cmp ebp, eax
ja 0x426ff8
mov ebp, dword [edi + 4]
lea ecx, [esp + 0x18]
call fcn.00639f30
mov ecx, dword [esp + 0x1c]
lea ebp, [ebp + eax*4]
mov eax, dword [edi + 4]
push ecx
push ebp
push eax
call fcn.00414b20
mov edx, dword [esp + 0x2c]
mov eax, dword [edi + 8]
add esp, 0xc
lea ecx, [esp + 0x18]
push edx
push eax
push ebp
call fcn.00413d30
mov ecx, edi
call fcn.00639f30
mov ecx, dword [esp + 0x1c]
lea edx, [ecx + eax*4]
mov dword [esp + 0x20], edx
jmp 0x42704f
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00413d00
mov edx, dword [esp + 0x1c]
push edx
call fcn.00697880
add esp, 4
mov ecx, edi
call fcn.00639f30
cmp eax, ebx
jge 0x427025
xor eax, eax
shl eax, 2
push eax
call fcn.00697be2
add esp, 4
mov dword [esp + 0x1c], eax
mov ecx, dword [edi + 8]
mov edi, dword [edi + 4]
push eax
push ecx
push edi
lea ecx, [esp + 0x24]
call fcn.00413d30
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x138]
mov edx, dword [esp + 0x134]
push ecx
push edx
lea ecx, [esp + 0x138]
mov byte [esp + 0x24c], 0x2b
call fcn.00413d00
mov eax, dword [esp + 0x134]
push eax
call fcn.00697880
mov eax, dword [esp + 0x20]
add esp, 4
cmp eax, ebx
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], ebx
mov dword [esp + 0x13c], ebx
je 0x4286d3
mov ecx, dword [esp + 0x20]
sub ecx, eax
sar ecx, 2
cmp ecx, 4
jb 0x4286d3
mov edx, dword [esp + 0x118]
mov eax, dword [esp + 0x114]
push edx
push eax
lea ecx, [esp + 0x118]
call fcn.00413cb0
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x124]
push ecx
push edx
lea ecx, [esp + 0x128]
call fcn.00413cb0
mov ecx, dword [esp + 0x1c]
push ebx
call fcn.00610190
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x10c], al
call fcn.00413600
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0060fe80
lea ecx, [esp + 0x110]
call fcn.006101a0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x128]
add eax, 8
push eax
push ecx
lea ecx, [esp + 0x128]
call fcn.00413b20
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x118]
add edx, 0xc
lea ecx, [esp + 0x110]
push edx
push eax
call fcn.00413b20
mov eax, dword [esi + 0x180]
lea ecx, [esi + 0x178]
lea edx, [esp + 0x108]
push edx
push eax
call fcn.00434f30
mov al, byte [esp + 0x36]
inc al
movzx di, al
cmp di, word [esp + 0x28]
mov byte [esp + 0x36], al
jl 0x426ee3
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
jmp 0x4286ae
cmp al, 2
jne 0x427a92
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
push edx
lea ecx, [esp + 0x20]
call fcn.00413cb0
push 2
push 1
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ebx
push 2
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ebx
push 3
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0060fe80
lea ecx, [esp + 0x3c]
call fcn.006101a0
lea ecx, [esp + 0x14]
lea edx, [esp + 0xa8]
push ecx
push edx
lea ecx, [esp + 0x170]
call fcn.0060eaf0
mov edi, eax
lea eax, [esp + 0x18]
mov byte [esp + 0x244], 0x35
cmp eax, edi
je 0x42732f
mov ecx, edi
call fcn.00639f30
lea ecx, [esp + 0x18]
mov ebp, eax
call fcn.00639f30
cmp ebp, eax
ja 0x427279
mov edx, dword [esp + 0x1c]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push edx
push eax
push ecx
call fcn.00414b20
mov ecx, dword [esp + 0x2c]
add esp, 0xc
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00413d00
mov ecx, edi
call fcn.00639f30
mov edx, dword [esp + 0x1c]
lea eax, [edx + eax*4]
mov dword [esp + 0x20], eax
jmp 0x42732f
mov ecx, edi
call fcn.00639f30
lea ecx, [esp + 0x18]
mov ebp, eax
call fcn.0063a250
cmp ebp, eax
ja 0x4272d8
mov ebp, dword [edi + 4]
lea ecx, [esp + 0x18]
call fcn.00639f30
mov ecx, dword [esp + 0x1c]
lea ebp, [ebp + eax*4]
mov eax, dword [edi + 4]
push ecx
push ebp
push eax
call fcn.00414b20
mov edx, dword [esp + 0x2c]
mov eax, dword [edi + 8]
add esp, 0xc
lea ecx, [esp + 0x18]
push edx
push eax
push ebp
call fcn.00413d30
mov ecx, edi
call fcn.00639f30
mov ecx, dword [esp + 0x1c]
lea edx, [ecx + eax*4]
mov dword [esp + 0x20], edx
jmp 0x42732f
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00413d00
mov edx, dword [esp + 0x1c]
push edx
call fcn.00697880
add esp, 4
mov ecx, edi
call fcn.00639f30
cmp eax, ebx
jge 0x427305
xor eax, eax
shl eax, 2
push eax
call fcn.00697be2
add esp, 4
mov dword [esp + 0x1c], eax
mov ecx, dword [edi + 8]
mov edi, dword [edi + 4]
push eax
push ecx
push edi
lea ecx, [esp + 0x24]
call fcn.00413d30
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0xb0]
mov edx, dword [esp + 0xac]
push ecx
push edx
lea ecx, [esp + 0xb0]
mov byte [esp + 0x24c], 0x2b
call fcn.00413d00
mov eax, dword [esp + 0xac]
push eax
call fcn.00697880
mov ecx, dword [esp + 0x20]
add esp, 4
cmp ecx, ebx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
je 0x426a77
mov eax, dword [esp + 0x20]
sub eax, ecx
sar eax, 2
cmp ax, 1
jne 0x42755e
push ebx
lea ecx, [esp + 0x1c]
call fcn.00413600
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0060fe80
lea ecx, [esp + 0x18]
call fcn.006101a0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
push edx
lea ecx, [esp + 0x20]
call fcn.00413cb0
lea eax, [esp + 0x14]
lea ecx, [esp + 0xe8]
push eax
push ecx
lea ecx, [esp + 0x170]
call fcn.0060eaf0
mov edi, eax
lea edx, [esp + 0x18]
mov byte [esp + 0x244], 0x36
cmp edx, edi
je 0x427500
mov ecx, edi
call fcn.00639f30
lea ecx, [esp + 0x18]
mov ebp, eax
call fcn.00639f30
cmp ebp, eax
ja 0x42744a
mov edx, dword [esp + 0x1c]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push edx
push eax
push ecx
call fcn.00414b20
mov ecx, dword [esp + 0x2c]
add esp, 0xc
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00413d00
mov ecx, edi
call fcn.00639f30
mov edx, dword [esp + 0x1c]
lea eax, [edx + eax*4]
mov dword [esp + 0x20], eax
jmp 0x427500
mov ecx, edi
call fcn.00639f30
lea ecx, [esp + 0x18]
mov ebp, eax
call fcn.0063a250
cmp ebp, eax
ja 0x4274a9
mov ebp, dword [edi + 4]
lea ecx, [esp + 0x18]
call fcn.00639f30
mov ecx, dword [esp + 0x1c]
lea ebp, [ebp + eax*4]
mov eax, dword [edi + 4]
push ecx
push ebp
push eax
call fcn.00414b20
mov edx, dword [esp + 0x2c]
mov eax, dword [edi + 8]
add esp, 0xc
lea ecx, [esp + 0x18]
push edx
push eax
push ebp
call fcn.00413d30
mov ecx, edi
call fcn.00639f30
mov ecx, dword [esp + 0x1c]
lea edx, [ecx + eax*4]
mov dword [esp + 0x20], edx
jmp 0x427500
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00413d00
mov edx, dword [esp + 0x1c]
push edx
call fcn.00697880
add esp, 4
mov ecx, edi
call fcn.00639f30
cmp eax, ebx
jge 0x4274d6
xor eax, eax
shl eax, 2
push eax
call fcn.00697be2
add esp, 4
mov dword [esp + 0x1c], eax
mov ecx, dword [edi + 8]
mov edi, dword [edi + 4]
push eax
push ecx
push edi
lea ecx, [esp + 0x24]
call fcn.00413d30
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0xf0]
mov edx, dword [esp + 0xec]
push ecx
push edx
lea ecx, [esp + 0xf0]
mov byte [esp + 0x24c], 0x2b
call fcn.00413d00
mov eax, dword [esp + 0xec]
push eax
call fcn.00697880
mov ecx, dword [esp + 0x20]
add esp, 4
cmp ecx, ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xf4], ebx
je 0x426a77
mov eax, dword [esp + 0x20]
sub eax, ecx
sar eax, 2
cmp ax, 5
jl 0x426a77
push ebx
call fcn.00610190
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0xc8]
add ecx, 4
mov byte [esi + 0x108], al
push ecx
push edx
lea ecx, [esp + 0x170]
call fcn.0060eaf0
mov dword [esp + 0x30], eax
lea edi, [esi + 0x124]
mov byte [esp + 0x244], 0x37
cmp edi, eax
je 0x4276b6
mov ecx, eax
call fcn.00639f30
mov ecx, edi
mov ebp, eax
call fcn.00639f30
cmp ebp, eax
ja 0x4275f7
mov ebp, dword [esp + 0x30]
mov edx, dword [edi + 4]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 4]
push eax
push ecx
call fcn.00414b20
mov ecx, dword [edi + 8]
add esp, 0xc
push ecx
push eax
mov ecx, edi
call fcn.00413d00
mov ecx, ebp
call fcn.00639f30
mov edx, dword [edi + 4]
lea eax, [edx + eax*4]
mov dword [edi + 8], eax
jmp 0x4276b6
mov ecx, dword [esp + 0x30]
call fcn.00639f30
mov ecx, edi
mov ebp, eax
call fcn.0063a250
cmp ebp, eax
ja 0x427661
mov ebp, dword [esp + 0x30]
mov ecx, dword [ebp + 4]
mov dword [esp + 0x28], ecx
mov ecx, edi
call fcn.00639f30
mov edx, dword [esp + 0x28]
mov ecx, dword [ebp + 4]
lea eax, [edx + eax*4]
mov edx, dword [edi + 4]
push edx
push eax
push ecx
mov dword [esp + 0x34], eax
call fcn.00414b20
mov ecx, dword [edi + 8]
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x34]
add esp, 0xc
push ecx
push eax
push edx
mov ecx, edi
call fcn.00413d30
mov ecx, ebp
call fcn.00639f30
mov ecx, dword [edi + 4]
lea edx, [ecx + eax*4]
mov dword [edi + 8], edx
jmp 0x4276b6
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
mov ecx, edi
call fcn.00413d00
mov eax, dword [edi + 4]
push eax
call fcn.00697880
mov ebp, dword [esp + 0x34]
add esp, 4
mov ecx, ebp
call fcn.00639f30
cmp eax, ebx
jge 0x42768d
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.00697be2
add esp, 4
mov dword [edi + 4], eax
mov ecx, dword [ebp + 8]
mov ebp, dword [ebp + 4]
push eax
push ecx
push ebp
mov ecx, edi
call fcn.00413d30
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0xd0]
mov ecx, dword [esp + 0xcc]
push eax
push ecx
lea ecx, [esp + 0xd0]
mov byte [esp + 0x24c], 0x2b
call fcn.00413d00
mov edx, dword [esp + 0xcc]
push edx
call fcn.00697880
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
push 2
mov dword [esp + 0xd8], ebx
call fcn.00413600
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0060fe80
lea ecx, [esi + 0x10c]
call fcn.006101a0
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0xf8]
add eax, 0xc
push eax
push ecx
lea ecx, [esp + 0x170]
call fcn.0060eaf0
mov dword [esp + 0x30], eax
lea edi, [esi + 0x114]
mov byte [esp + 0x244], 0x38
cmp edi, eax
je 0x427864
mov ecx, eax
call fcn.00639f30
mov ecx, edi
mov ebp, eax
call fcn.00639f30
cmp ebp, eax
ja 0x4277a5
mov ebp, dword [esp + 0x30]
mov edx, dword [edi + 4]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 4]
push eax
push ecx
call fcn.00414b20
mov ecx, dword [edi + 8]
add esp, 0xc
push ecx
push eax
mov ecx, edi
call fcn.00413d00
mov ecx, ebp
call fcn.00639f30
mov edx, dword [edi + 4]
lea eax, [edx + eax*4]
mov dword [edi + 8], eax
jmp 0x427864
mov ecx, dword [esp + 0x30]
call fcn.00639f30
mov ecx, edi
mov ebp, eax
call fcn.0063a250
cmp ebp, eax
ja 0x42780f
mov ebp, dword [esp + 0x30]
mov ecx, dword [ebp + 4]
mov dword [esp + 0x28], ecx
mov ecx, edi
call fcn.00639f30
mov edx, dword [esp + 0x28]
mov ecx, dword [ebp + 4]
lea eax, [edx + eax*4]
mov edx, dword [edi + 4]
push edx
push eax
push ecx
mov dword [esp + 0x34], eax
call fcn.00414b20
mov ecx, dword [edi + 8]
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x34]
add esp, 0xc
push ecx
push eax
push edx
mov ecx, edi
call fcn.00413d30
mov ecx, ebp
call fcn.00639f30
mov ecx, dword [edi + 4]
lea edx, [ecx + eax*4]
mov dword [edi + 8], edx
jmp 0x427864
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
mov ecx, edi
call fcn.00413d00
mov eax, dword [edi + 4]
push eax
call fcn.00697880
mov ebp, dword [esp + 0x34]
add esp, 4
mov ecx, ebp
call fcn.00639f30
cmp eax, ebx
jge 0x42783b
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.00697be2
add esp, 4
mov dword [edi + 4], eax
mov ecx, dword [ebp + 8]
mov ebp, dword [ebp + 4]
push eax
push ecx
push ebp
mov ecx, edi
call fcn.00413d30
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x100]
mov ecx, dword [esp + 0xfc]
push eax
push ecx
lea ecx, [esp + 0x100]
mov byte [esp + 0x24c], 0x2b
call fcn.00413d00
mov edx, dword [esp + 0xfc]
push edx
call fcn.00697880
mov eax, dword [esp + 0x20]
add esp, 4
add eax, 0x10
lea ecx, [esp + 0x88]
push eax
push ecx
lea ecx, [esp + 0x170]
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], ebx
call fcn.0060eaf0
mov dword [esp + 0x30], eax
lea edi, [esi + 0x134]
mov byte [esp + 0x244], 0x39
cmp edi, eax
je 0x4279ef
mov ecx, eax
call fcn.00639f30
mov ecx, edi
mov ebp, eax
call fcn.00639f30
cmp ebp, eax
ja 0x427930
mov ebp, dword [esp + 0x30]
mov edx, dword [edi + 4]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 4]
push eax
push ecx
call fcn.00414b20
mov ecx, dword [edi + 8]
add esp, 0xc
push ecx
push eax
mov ecx, edi
call fcn.00413d00
mov ecx, ebp
call fcn.00639f30
mov edx, dword [edi + 4]
lea eax, [edx + eax*4]
mov dword [edi + 8], eax
jmp 0x4279ef
mov ecx, dword [esp + 0x30]
call fcn.00639f30
mov ecx, edi
mov ebp, eax
call fcn.0063a250
cmp ebp, eax
ja 0x42799a
mov ebp, dword [esp + 0x30]
mov ecx, dword [ebp + 4]
mov dword [esp + 0x28], ecx
mov ecx, edi
call fcn.00639f30
mov edx, dword [esp + 0x28]
mov ecx, dword [ebp + 4]
lea eax, [edx + eax*4]
mov edx, dword [edi + 4]
push edx
push eax
push ecx
mov dword [esp + 0x34], eax
call fcn.00414b20
mov ecx, dword [edi + 8]
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x34]
add esp, 0xc
push ecx
push eax
push edx
mov ecx, edi
call fcn.00413d30
mov ecx, ebp
call fcn.00639f30
mov ecx, dword [edi + 4]
lea edx, [ecx + eax*4]
mov dword [edi + 8], edx
jmp 0x4279ef
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
mov ecx, edi
call fcn.00413d00
mov eax, dword [edi + 4]
push eax
call fcn.00697880
mov ebp, dword [esp + 0x34]
add esp, 4
mov ecx, ebp
call fcn.00639f30
cmp eax, ebx
jge 0x4279c6
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.00697be2
add esp, 4
mov dword [edi + 4], eax
mov ecx, dword [ebp + 8]
mov ebp, dword [ebp + 4]
push eax
push ecx
push ebp
mov ecx, edi
call fcn.00413d30
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x8c]
push eax
push ecx
lea ecx, [esp + 0x90]
mov byte [esp + 0x24c], 0x2b
call fcn.00413d00
mov edx, dword [esp + 0x8c]
push edx
call fcn.00697880
mov eax, dword [esp + 0x20]
add esp, 4
cmp eax, ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
je 0x427a68
mov ecx, dword [esp + 0x20]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x18
jne 0x427a68
push 5
lea ecx, [esp + 0x1c]
call fcn.00413600
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0060fe80
jmp 0x427a7b
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 6
push 0x7033e8
call fcn.0060ff10
lea ecx, [esi + 0x110]
call fcn.006101a0
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
jmp 0x4286a9
cmp al, 3
jne 0x428061
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00413cb0
push 3
push 1
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ebx
push 2
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ebx
push 3
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.0060fe80
lea ecx, [esp + 0x3c]
call fcn.006101a0
lea eax, [esp + 0x14]
lea ecx, [esp + 0x98]
push eax
push ecx
lea ecx, [esp + 0x170]
call fcn.0060eaf0
mov edi, eax
lea edx, [esp + 0x18]
mov byte [esp + 0x244], 0x3a
cmp edx, edi
je 0x427c22
mov ecx, edi
call fcn.00639f30
lea ecx, [esp + 0x18]
mov ebp, eax
call fcn.00639f30
cmp ebp, eax
ja 0x427b6c
mov edx, dword [esp + 0x1c]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push edx
push eax
push ecx
call fcn.00414b20
mov ecx, dword [esp + 0x2c]
add esp, 0xc
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00413d00
mov ecx, edi
call fcn.00639f30
mov edx, dword [esp + 0x1c]
lea eax, [edx + eax*4]
mov dword [esp + 0x20], eax
jmp 0x427c22
mov ecx, edi
call fcn.00639f30
lea ecx, [esp + 0x18]
mov ebp, eax
call fcn.0063a250
cmp ebp, eax
ja 0x427bcb
mov ebp, dword [edi + 4]
lea ecx, [esp + 0x18]
call fcn.00639f30
mov ecx, dword [esp + 0x1c]
lea ebp, [ebp + eax*4]
mov eax, dword [edi + 4]
push ecx
push ebp
push eax
call fcn.00414b20
mov edx, dword [esp + 0x2c]
mov eax, dword [edi + 8]
add esp, 0xc
lea ecx, [esp + 0x18]
push edx
push eax
push ebp
call fcn.00413d30
mov ecx, edi
call fcn.00639f30
mov ecx, dword [esp + 0x1c]
lea edx, [ecx + eax*4]
mov dword [esp + 0x20], edx
jmp 0x427c22
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00413d00
mov edx, dword [esp + 0x1c]
push edx
call fcn.00697880
add esp, 4
mov ecx, edi
call fcn.00639f30
cmp eax, ebx
jge 0x427bf8
xor eax, eax
shl eax, 2
push eax
call fcn.00697be2
add esp, 4
mov dword [esp + 0x1c], eax
mov ecx, dword [edi + 8]
mov edi, dword [edi + 4]
push eax
push ecx
push edi
lea ecx, [esp + 0x24]
call fcn.00413d30
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 0x9c]
push ecx
push edx
lea ecx, [esp + 0xa0]
mov byte [esp + 0x24c], 0x2b
call fcn.00413d00
mov eax, dword [esp + 0x9c]
push eax
call fcn.00697880
mov ecx, dword [esp + 0x20]
add esp, 4
cmp ecx, ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
je 0x426a77
mov eax, dword [esp + 0x20]
sub eax, ecx
sar eax, 2
cmp ax, 1
jne 0x427e51
push ebx
lea ecx, [esp + 0x1c]
call fcn.00413600
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0060fe80
lea ecx, [esp + 0x18]
call fcn.006101a0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
push edx
lea ecx, [esp + 0x20]
call fcn.00413cb0
lea eax, [esp + 0x14]
lea ecx, [esp + 0xb8]
push eax
push ecx
lea ecx, [esp + 0x170]
call fcn.0060eaf0
mov edi, eax
lea edx, [esp + 0x18]
mov byte [esp + 0x244], 0x3b
cmp edx, edi
je 0x427df3
mov ecx, edi
call fcn.00639f30
lea ecx, [esp + 0x18]
mov ebp, eax
call fcn.00639f30
cmp ebp, eax
ja 0x427d3d
mov edx, dword [esp + 0x1c]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push edx
push eax
push ecx
call fcn.00414b20
mov ecx, dword [esp + 0x2c]
add esp, 0xc
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00413d00
mov ecx, edi
call fcn.00639f30
mov edx, dword [esp + 0x1c]
lea eax, [edx + eax*4]
mov dword [esp + 0x20], eax
jmp 0x427df3
mov ecx, edi
call fcn.00639f30
lea ecx, [esp + 0x18]
mov ebp, eax
call fcn.0063a250
cmp ebp, eax
ja 0x427d9c
mov ebp, dword [edi + 4]
lea ecx, [esp + 0x18]
call fcn.00639f30
mov ecx, dword [esp + 0x1c]
lea ebp, [ebp + eax*4]
mov eax, dword [edi + 4]
push ecx
push ebp
push eax
call fcn.00414b20
mov edx, dword [esp + 0x2c]
mov eax, dword [edi + 8]
add esp, 0xc
lea ecx, [esp + 0x18]
push edx
push eax
push ebp
call fcn.00413d30
mov ecx, edi
call fcn.00639f30
mov ecx, dword [esp + 0x1c]
lea edx, [ecx + eax*4]
mov dword [esp + 0x20], edx
jmp 0x427df3
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00413d00
mov edx, dword [esp + 0x1c]
push edx
call fcn.00697880
add esp, 4
mov ecx, edi
call fcn.00639f30
cmp eax, ebx
jge 0x427dc9
xor eax, eax
shl eax, 2
push eax
call fcn.00697be2
add esp, 4
mov dword [esp + 0x1c], eax
mov ecx, dword [edi + 8]
mov edi, dword [edi + 4]
push eax
push ecx
push edi
lea ecx, [esp + 0x24]
call fcn.00413d30
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0xc0]
mov edx, dword [esp + 0xbc]
push ecx
push edx
lea ecx, [esp + 0xc0]
mov byte [esp + 0x24c], 0x2b
call fcn.00413d00
mov eax, dword [esp + 0xbc]
push eax
call fcn.00697880
mov ecx, dword [esp + 0x20]
add esp, 4
cmp ecx, ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
je 0x426a77
mov eax, dword [esp + 0x20]
sub eax, ecx
sar eax, 2
cmp ax, 3
jl 0x426a77
push ebx
call fcn.00610190
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0xd8]
add ecx, 4
mov byte [esi + 0x144], al
push ecx
push edx
lea ecx, [esp + 0x170]
call fcn.0060eaf0
mov ebp, eax
mov dword [esp + 0x30], ebp
lea edi, [esi + 0x158]
mov byte [esp + 0x244], 0x3c
cmp edi, ebp
je 0x427faf
mov ecx, edi
call fcn.00639f30
mov edx, eax
mov ecx, ebp
mov dword [esp + 0x28], edx
call fcn.00639f30
mov ecx, dword [esp + 0x28]
cmp eax, ecx
ja 0x427ef0
mov edx, dword [edi + 4]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 4]
push edx
push eax
push ecx
call fcn.00414b20
mov ecx, dword [edi + 8]
add esp, 0xc
push ecx
push eax
mov ecx, edi
call fcn.00413d00
mov ecx, ebp
call fcn.00639f30
mov edx, dword [edi + 4]
lea eax, [edx + eax*4]
mov dword [edi + 8], eax
jmp 0x427faf
mov ecx, edi
call fcn.0063a250
mov ecx, dword [esp + 0x30]
mov ebp, eax
call fcn.00639f30
cmp eax, ebp
ja 0x427f5a
mov ebp, dword [esp + 0x30]
mov ecx, dword [ebp + 4]
mov dword [esp + 0x28], ecx
mov ecx, edi
call fcn.00639f30
mov edx, dword [esp + 0x28]
mov ecx, dword [ebp + 4]
lea eax, [edx + eax*4]
mov edx, dword [edi + 4]
push edx
push eax
push ecx
mov dword [esp + 0x34], eax
call fcn.00414b20
mov ecx, dword [edi + 8]
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x34]
add esp, 0xc
push ecx
push eax
push edx
mov ecx, edi
call fcn.00413d30
mov ecx, ebp
call fcn.00639f30
mov ecx, dword [edi + 4]
lea edx, [ecx + eax*4]
mov dword [edi + 8], edx
jmp 0x427faf
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
mov ecx, edi
call fcn.00413d00
mov eax, dword [edi + 4]
push eax
call fcn.00697880
mov ebp, dword [esp + 0x34]
add esp, 4
mov ecx, ebp
call fcn.00639f30
cmp eax, ebx
jge 0x427f86
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.00697be2
add esp, 4
mov dword [edi + 4], eax
mov ecx, dword [ebp + 8]
mov ebp, dword [ebp + 4]
push eax
push ecx
push ebp
mov ecx, edi
call fcn.00413d30
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xdc]
push eax
push ecx
lea ecx, [esp + 0xe0]
mov byte [esp + 0x24c], 0x2b
call fcn.00413d00
mov edx, dword [esp + 0xdc]
push edx
call fcn.00697880
mov eax, dword [esp + 0x20]
add esp, 4
add eax, 8
lea ecx, [esp + 0x50]
push eax
push ecx
lea ecx, [esp + 0x170]
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
call fcn.0060eaf0
push eax
lea ecx, [esi + 0x148]
mov byte [esp + 0x248], 0x3d
call fcn.00413430
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
push edx
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x24c], 0x2b
call fcn.00413d00
mov ecx, dword [esp + 0x54]
push ecx
call fcn.00697880
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov ecx, esp
mov dword [esp + 0x30], esp
jmp 0x4286a9
cmp al, 4
jne 0x42842c
push 4
push 1
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ebx
push 2
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ebx
push 3
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0060fe80
lea ecx, [esp + 0x3c]
call fcn.006101a0
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1ec]
push ecx
push edx
lea ecx, [esp + 0x170]
call fcn.0060eaf0
lea edi, [esi + 0xc0]
push eax
mov ecx, edi
mov byte [esp + 0x248], 0x3e
call fcn.00413430
lea ecx, [esp + 0x1ec]
mov byte [esp + 0x244], 0x2b
call fcn.004133f0
mov ecx, dword [edi + 4]
cmp ecx, ebx
je 0x426a77
mov eax, dword [edi + 8]
sub eax, ecx
sar eax, 2
cmp ax, 1
jne 0x42816d
push ebx
mov ecx, edi
call fcn.00413600
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0060fe80
lea ecx, [esp + 0x18]
call fcn.006101a0
mov ecx, edi
call fcn.00434c20
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20c]
push eax
push ecx
lea ecx, [esp + 0x170]
call fcn.0060eaf0
push eax
mov ecx, edi
mov byte [esp + 0x248], 0x3f
call fcn.00413430
lea ecx, [esp + 0x20c]
mov byte [esp + 0x244], 0x2b
call fcn.004133f0
mov ecx, edi
call fcn.00639f30
cmp ax, 2
jl 0x426a77
lea edi, [esi + 0xb0]
mov ecx, edi
call fcn.00434c20
mov eax, dword [esi + 0xc4]
mov ecx, dword [edi + 8]
add eax, 4
push eax
push ecx
mov ecx, edi
call fcn.00413b20
mov ecx, dword [esi + 0xb4]
push ebx
call fcn.00610190
movzx di, al
lea ecx, [esp + 0x48]
mov dword [esp + 0x2c], edi
call fcn.0060fe70
cmp di, bx
mov byte [esp + 0x244], 0x40
mov byte [esp + 0x36], bl
jle 0x4283fc
xor edi, edi
lea ecx, [esp + 0x18]
call fcn.00434c20
mov ecx, dword [esi + 0xb4]
inc edi
push edi
call fcn.00610190
push eax
push 2
lea ecx, [esp + 0x1c]
call fcn.006102b0
lea edx, [esp + 0x14]
lea eax, [esp + 0x22c]
push edx
push eax
lea ecx, [esp + 0x170]
call fcn.0060eaf0
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x248], 0x41
call fcn.00413430
lea ecx, [esp + 0x22c]
mov byte [esp + 0x244], 0x40
call fcn.004133f0
lea ecx, [esp + 0x18]
call fcn.00639f30
cmp ax, 4
mov dword [esp + 0x30], eax
jl 0x4286dd
lea ecx, [esp + 0x148]
call fcn.00434c20
lea ecx, [esp + 0x158]
call fcn.00434c20
mov ecx, dword [esp + 0x1c]
push ebx
call fcn.00610190
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x144], al
call fcn.00413600
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0060fe80
lea ecx, [esp + 0x148]
call fcn.006101a0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x160]
add ecx, 8
push ecx
push edx
lea ecx, [esp + 0x160]
call fcn.00413b20
push 5
lea ecx, [esp + 0x148]
call fcn.00610190
mov byte [esp + 0x40], al
mov eax, dword [esp + 0x1c]
push ebx
lea ecx, [eax + 0xc]
call fcn.00610190
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x37], al
add ecx, 0xc
call fcn.00610330
push ecx
mov ebp, eax
mov ecx, esp
mov dword [esp + 0x2c], esp
push ebx
mov byte [esp + 0x4c], bl
call fcn.0060fea0
lea ecx, [esp + 0x4c]
call fcn.006101a0
push ebx
lea ecx, [esp + 0x4c]
call fcn.00610310
movzx ax, byte [esp + 0x37]
cmp ax, bx
jle 0x42836a
movsx edx, ax
mov dword [esp + 0x28], edx
mov edi, 1
cmp bp, di
jle 0x428338
mov eax, dword [esp + 0x1c]
push edi
lea ecx, [eax + 0xc]
call fcn.00610190
cmp al, byte [esp + 0x40]
je 0x428338
inc edi
cmp di, bp
jl 0x42831f
cmp di, bp
jne 0x428355
mov cl, byte [esp + 0x44]
inc cl
mov byte [esp + 0x44], cl
mov ecx, dword [esp + 0x40]
push ecx
lea ecx, [esp + 0x4c]
call fcn.00610310
mov cl, byte [esp + 0x40]
mov eax, dword [esp + 0x28]
inc cl
dec eax
mov byte [esp + 0x40], cl
mov dword [esp + 0x28], eax
jne 0x428315
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x48]
push edx
push ebx
call fcn.006102b0
mov ecx, dword [esp + 0x150]
lea eax, [esp + 0x48]
push eax
push ecx
lea ecx, [esp + 0x150]
call fcn.00413b20
cmp word [esp + 0x30], 4
jle 0x4283c9
movsx edi, word [esp + 0x30]
mov ebp, 0x10
sub edi, 4
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x150]
lea eax, [edx + ebp]
push eax
push ecx
lea ecx, [esp + 0x150]
call fcn.00413b20
add ebp, 4
dec edi
jne 0x4283a7
mov eax, dword [esi + 0x170]
lea ecx, [esi + 0x168]
lea edx, [esp + 0x140]
push edx
push eax
call fcn.00434d20
mov al, byte [esp + 0x36]
inc al
movzx di, al
cmp di, word [esp + 0x2c]
mov byte [esp + 0x36], al
jl 0x4281cd
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0060fe80
lea ecx, [esp + 0x18]
call fcn.006101a0
lea ecx, [esp + 0x48]
mov byte [esp + 0x244], 0x2b
call fcn.0060ffb0
jmp 0x4286bc
cmp al, 5
jne 0x42856d
lea ecx, [esp + 0x18]
call fcn.00434c20
push 5
push 1
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ebx
push 2
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ebx
push 3
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.0060fe80
lea ecx, [esp + 0x3c]
call fcn.006101a0
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1dc]
push eax
push ecx
lea ecx, [esp + 0x170]
call fcn.0060eaf0
lea edi, [esi + 0x198]
push eax
mov ecx, edi
mov byte [esp + 0x248], 0x42
call fcn.00413430
lea ecx, [esp + 0x1dc]
mov byte [esp + 0x244], 0x2b
call fcn.004133f0
mov ecx, edi
call fcn.00639f30
cmp ax, 1
jne 0x428535
push ebx
mov ecx, edi
call fcn.00413600
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0060fe80
lea ecx, [esp + 0x18]
call fcn.006101a0
mov ecx, edi
call fcn.00434c20
lea edx, [esp + 0x14]
lea eax, [esp + 0x21c]
push edx
push eax
lea ecx, [esp + 0x170]
call fcn.0060eaf0
push eax
mov ecx, edi
mov byte [esp + 0x248], 0x43
call fcn.00413430
lea ecx, [esp + 0x21c]
mov byte [esp + 0x244], 0x2b
call fcn.004133f0
mov ecx, edi
call fcn.00639f30
cmp ax, 2
jl 0x426a77
lea edi, [esi + 0x1a8]
mov ecx, edi
call fcn.00434c20
mov eax, dword [esi + 0x19c]
mov ecx, dword [edi + 8]
add eax, 4
push eax
push ecx
mov ecx, edi
call fcn.00413b20
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
jmp 0x4286a9
cmp al, 6
jne 0x4286bc
lea ecx, [esp + 0x18]
call fcn.00434c20
push 6
push 1
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ebx
push 2
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ebx
push 3
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0060fe80
lea ecx, [esp + 0x3c]
call fcn.006101a0
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1fc]
push ecx
push edx
lea ecx, [esp + 0x170]
call fcn.0060eaf0
lea edi, [esi + 0x204]
push eax
mov ecx, edi
mov byte [esp + 0x248], 0x44
call fcn.00413430
lea ecx, [esp + 0x1fc]
mov byte [esp + 0x244], 0x2b
call fcn.004133f0
mov ecx, edi
call fcn.00639f30
cmp ax, 1
jne 0x428676
push ebx
mov ecx, edi
call fcn.00413600
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0060fe80
lea ecx, [esp + 0x18]
call fcn.006101a0
mov ecx, edi
call fcn.00434c20
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1cc]
push eax
push ecx
lea ecx, [esp + 0x170]
call fcn.0060eaf0
push eax
mov ecx, edi
mov byte [esp + 0x248], 0x45
call fcn.00413430
lea ecx, [esp + 0x1cc]
mov byte [esp + 0x244], 0x2b
call fcn.004133f0
mov ecx, edi
call fcn.00639f30
cmp ax, 2
jl 0x426a77
lea edi, [esi + 0x214]
mov ecx, edi
call fcn.00434c20
mov eax, dword [esi + 0x208]
mov ecx, dword [edi + 8]
add eax, 4
push eax
push ecx
mov ecx, edi
call fcn.00413b20
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
lea edx, [esp + 0x3c]
push edx
call fcn.0060fe80
lea ecx, [esp + 0x18]
call fcn.006101a0
mov al, byte [esp + 0x3f]
mov cl, byte [esp + 0x13]
inc al
cmp al, cl
mov byte [esp + 0x3f], al
jae 0x4286f5
jmp 0x426abd
mov dword [esp + 0x60], 1
jmp 0x4286fe
lea ecx, [esp + 0x48]
mov edi, 1
mov byte [esp + 0x244], 0x2b
call fcn.0060ffb0
jmp 0x428702
mov ax, word [esp + 0x64]
mov word [esi + 0x78], ax
mov edi, dword [esp + 0x60]
lea ecx, [esp + 0x168]
call fcn.0060e830
cmp di, bx
jle 0x428756
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push 6
push 0x7033ac
call fcn.0060ff10
push ecx
mov byte [esp + 0x254], 0x46
mov ecx, esp
mov dword [esp + 0x38], esp
push 6
push 0x7033a4
call fcn.0060ff10
mov ecx, 0x71b930
mov byte [esp + 0x254], 0x2b
call fcn.006115e0
lea ecx, [esp + 0x108]
mov byte [esp + 0x244], 0x28
call fcn.00428c50
lea ecx, [esp + 0x140]
mov byte [esp + 0x244], 0x25
call fcn.00428ba0
lea ecx, [esp + 0x38]
mov byte [esp + 0x244], 0x24
call fcn.0060ffb0
lea ecx, [esp + 0x14]
mov byte [esp + 0x244], 0x23
call fcn.0060ffb0
lea ecx, [esp + 0x168]
mov byte [esp + 0x244], 0x22
call fcn.0060e350
lea ecx, [esp + 0x18]
mov byte [esp + 0x244], 0x21
call fcn.004133f0
mov ecx, dword [esp + 0x23c]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x238
ret 4