Function at 0x527d90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x79c
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push str.CreateOnePage
mov dword [esp + 0x78], 0xffffffff
mov dword [esp + 0x84], ebp
mov dword [esp + 0x9c], ebp
mov dword [esp + 0xe0], ebp
mov dword [esp + 0xcc], ebp
mov dword [esp + 0x90], ebp
call fcn.004e4630
mov edi, dword [esp + 0x7b8]
mov esi, dword [esp + 0x7b4]
push edi
push esi
call fcn.005374e0
mov ecx, dword [esi + 0x3a10]
lea eax, [edi + edi*8]
add eax, eax
add eax, eax
add eax, eax
mov dword [esp + 0x30], eax
add eax, ecx
mov dword [esi + 0x3a08], ebp
mov dword [esp + 0xb0], ebp
mov ebx, dword [eax]
lea ecx, [edi + 1]
add esp, 0xc
cmp ecx, dword [esi + 0x39e8]
mov dword [esp + 0xd4], ebp
mov dword [esp + 0xf4], ebx
jl 0x527e38
mov eax, dword [esi + 0x5e4]
sub eax, 1
mov dword [esp + 0x88], eax
jmp 0x527e42
mov edx, dword [eax + 4]
mov dword [esp + 0x88], edx
cmp dword [esp + 0x7b8], ebp
jne 0x527e8e
mov edx, 1
cmp dword [esi + 0x734], edx
jle 0x527e85
mov ecx, 0x98
lea ecx, [ecx]
mov eax, dword [esi + 0x72c]
add eax, ecx
cmp dword [eax + 0x24], edi
jne 0x527e74
and dword [eax + 0x28], 0xfffe7fff
add edx, 1
add ecx, 0x98
cmp edx, dword [esi + 0x734]
jl 0x527e60
lea ecx, [ebx - 1]
mov dword [esi + 0xb70], ecx
push ebx
push esi
call fcn.005268f0
push edi
push esi
call fcn.00525c80
add esp, 0x10
nop
mov edx, dword [esp + 0x88]
mov eax, dword [esi + 0x5e4]
add edx, 1
cmp edx, eax
jl 0x527ebe
add eax, 0xffffffff
mov dword [esp + 0x88], eax
cmp ebx, dword [esp + 0x88]
mov eax, ebx
mov dword [esp + 0x44], eax
jg 0x527f1f
lea ecx, [ecx]
mov ecx, dword [esi + 0x138]
lea edx, [ecx + eax*4]
mov ecx, dword [edx]
cmp dword [ecx + 0x34], edi
mov eax, dword [ecx + 0x30]
jne 0x527f0b
mov edx, ecx
and dword [edx + 0x38], 0xffff7fdf
cmp eax, ebp
jle 0x527f0b
cmp eax, dword [esi + 0x734]
jge 0x527f0b
mov edx, dword [esi + 0x72c]
imul eax, eax, 0x98
mov dword [eax + edx], 1
mov eax, dword [esp + 0x44]
add eax, 1
cmp eax, dword [esp + 0x88]
mov dword [esp + 0x44], eax
jle 0x527ed0
push ebx
push esi
mov dword [esp + 0x40], ebx
call fcn.004aea30
mov ecx, dword [esi + 0x3a10]
mov edi, eax
mov eax, dword [esp + 0x2c]
add esp, 8
cmp dword [esp + 0x7b4], ebp
mov dword [esp + 0x78], edi
mov dword [esp + 0x18], edi
mov dword [ecx + eax + 0x2c], edi
je 0x527f80
mov edx, dword [esi + 0x3a10]
cmp dword [edx + eax - 0x1c], edi
je 0x527f6f
lea eax, [ebx - 1]
push eax
push esi
call fcn.004aea30
add esp, 8
cmp edi, eax
mov eax, dword [esp + 0x24]
jne 0x527f80
mov ecx, dword [esi + 0x3a10]
and dword [ecx + eax + 0x28], 0xfffffffd
lea eax, [ecx + eax + 0x28]
jmp 0x527f8f
mov edx, dword [esi + 0x3a10]
or dword [edx + eax + 0x28], 2
lea eax, [edx + eax + 0x28]
mov edi, dword [esp + 0x7b4]
push 1
push ebp
push edi
push esi
call fcn.00526180
push ebp
push edi
push esi
mov dword [esp + 0x6c], eax
call fcn.005262b0
mov ecx, dword [esi + 0x3a10]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x40]
mov dword [ecx + eax + 0x24], ebp
mov edx, dword [esi + 0x3a10]
mov dword [edx + eax + 0xc], ebp
mov ecx, dword [esi + 0x3a10]
push ebx
push esi
mov dword [esp + 0x84], ebp
mov dword [esp + 0xe4], ebp
mov dword [esp + 0x11c], ebp
mov dword [esp + 0x110], ebp
mov dword [esp + 0x114], ebp
mov dword [esp + 0xf0], ebp
mov dword [esp + 0xf4], ebp
mov dword [esp + 0xfc], ebp
mov dword [esp + 0xe8], ebp
mov dword [esp + 0xd4], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x94], ebp
mov dword [esp + 0x8c], ebp
mov dword [ecx + eax + 8], ebp
mov dword [esp + 0x78], 0xffffffff
call fcn.005132c0
add esp, 0x24
mov dword [esp + 0xbc], eax
xor edi, edi
xor eax, eax
mov dword [esp + 0x9c], ebp
mov dword [esi + 0xb7c], ebp
mov dword [esp + 0xac], ebp
mov byte [esp + 0x12], 0
mov dword [esp + 0x6c], ebp
mov dword [esp + 0xb8], ebp
mov dword [esp + 0x280], eax
mov dword [esp + 0x284], eax
mov dword [esp + 0x288], eax
mov dword [esp + 0x28c], eax
mov dword [esp + 0x290], eax
mov dword [esp + 0x294], eax
mov dword [esp + 0x298], eax
mov dword [esp + 0x29c], eax
mov dword [esp + 0x2a0], eax
mov dword [esp + 0x2a4], eax
mov dword [esp + 0x2a8], eax
mov dword [esp + 0x2ac], eax
mov dword [esp + 0x2b0], eax
mov dword [esp + 0x2b4], eax
mov dword [esp + 0x2b8], eax
mov dword [esp + 0x2bc], eax
mov dword [esp + 0x2c0], eax
mov dword [esp + 0x2c4], eax
mov dword [esp + 0x2c8], eax
mov dword [esp + 0x2cc], eax
mov dword [esp + 0x2d0], eax
mov dword [esp + 0x2d4], eax
mov dword [esp + 0x2d8], eax
mov dword [esp + 0x2dc], eax
mov dword [esp + 0x2e0], eax
mov dword [esp + 0x2e4], eax
mov dword [esp + 0x2e8], eax
mov dword [esp + 0x2ec], eax
mov dword [esp + 0x2f0], eax
mov dword [esp + 0x2f4], eax
mov dword [esp + 0x460], eax
mov dword [esp + 0x464], eax
mov dword [esp + 0x468], eax
mov dword [esp + 0x46c], eax
mov dword [esp + 0x470], eax
mov dword [esp + 0x474], eax
mov dword [esp + 0x478], eax
mov dword [esp + 0x47c], eax
mov dword [esp + 0x480], eax
mov dword [esp + 0x484], eax
mov dword [esp + 0x488], eax
mov dword [esp + 0x48c], eax
mov dword [esp + 0x490], eax
mov dword [esp + 0x494], eax
mov dword [esp + 0x498], eax
mov dword [esp + 0x49c], eax
mov dword [esp + 0x4a0], eax
mov dword [esp + 0x4a4], eax
mov dword [esp + 0x4a8], eax
mov dword [esp + 0x4ac], eax
mov dword [esp + 0x4b0], eax
mov dword [esp + 0x4b4], eax
mov dword [esp + 0x4b8], eax
mov dword [esp + 0x4bc], eax
mov dword [esp + 0x4c0], eax
mov dword [esp + 0x4c4], eax
mov dword [esp + 0x4c8], eax
mov dword [esp + 0x4cc], eax
mov dword [esp + 0x4d0], eax
mov dword [esp + 0x4d4], eax
mov dword [esp + 0x4d8], eax
mov dword [esp + 0x4dc], eax
mov dword [esp + 0x4e0], eax
mov dword [esp + 0x4e4], eax
mov dword [esp + 0x4e8], eax
mov dword [esp + 0x4ec], eax
mov dword [esp + 0x4f0], eax
mov dword [esp + 0x4f4], eax
mov dword [esp + 0x4f8], eax
mov dword [esp + 0x4fc], eax
mov dword [esp + 0x500], eax
mov dword [esp + 0x504], eax
mov dword [esp + 0x508], eax
mov dword [esp + 0x50c], eax
mov dword [esp + 0x510], eax
mov dword [esp + 0x514], eax
mov dword [esp + 0x518], eax
mov dword [esp + 0x51c], eax
mov dword [esp + 0x520], eax
mov dword [esp + 0x524], eax
mov dword [esp + 0x528], eax
mov dword [esp + 0x52c], eax
mov dword [esp + 0x530], eax
mov dword [esp + 0x534], eax
mov dword [esp + 0x538], eax
mov dword [esp + 0x53c], eax
mov dword [esp + 0x540], eax
mov dword [esp + 0x544], eax
mov dword [esp + 0x548], eax
mov dword [esp + 0x54c], eax
mov dword [esp + 0x208], eax
mov dword [esp + 0x20c], eax
mov dword [esp + 0x210], eax
mov dword [esp + 0x214], eax
mov dword [esp + 0x218], eax
mov dword [esp + 0x21c], eax
mov dword [esp + 0x220], eax
mov dword [esp + 0x224], eax
mov dword [esp + 0x228], eax
mov dword [esp + 0x22c], eax
mov dword [esp + 0x230], eax
mov dword [esp + 0x234], eax
mov dword [esp + 0x238], eax
mov dword [esp + 0x23c], eax
mov dword [esp + 0x240], eax
mov dword [esp + 0x244], eax
mov dword [esp + 0x248], eax
mov dword [esp + 0x24c], eax
mov dword [esp + 0x250], eax
mov dword [esp + 0x254], eax
mov dword [esp + 0x258], eax
mov dword [esp + 0x25c], eax
mov dword [esp + 0x260], eax
mov dword [esp + 0x264], eax
mov dword [esp + 0x268], eax
mov dword [esp + 0x26c], eax
mov dword [esp + 0x270], eax
mov dword [esp + 0x274], eax
mov dword [esp + 0x278], eax
mov dword [esp + 0x27c], eax
mov dword [esp + 0x100], eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], eax
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], eax
mov dword [esp + 0x144], eax
mov dword [esp + 0x148], eax
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], eax
mov dword [esp + 0x158], eax
mov dword [esp + 0x15c], eax
mov dword [esp + 0x160], eax
mov dword [esp + 0x164], eax
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov dword [esp + 0x190], eax
mov dword [esp + 0x194], eax
mov dword [esp + 0x198], eax
mov dword [esp + 0x19c], eax
mov dword [esp + 0x1a0], eax
mov dword [esp + 0x1a4], eax
mov dword [esp + 0x1a8], eax
mov dword [esp + 0x1ac], eax
mov dword [esp + 0x1b0], eax
mov dword [esp + 0x1b4], eax
mov dword [esp + 0x1b8], eax
mov dword [esp + 0x1bc], eax
mov dword [esp + 0x1c0], eax
mov dword [esp + 0x1c4], eax
mov dword [esp + 0x1c8], eax
mov dword [esp + 0x1cc], eax
mov dword [esp + 0x1d0], eax
mov dword [esp + 0x1d4], eax
mov dword [esp + 0x1d8], eax
mov dword [esp + 0x1dc], eax
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], eax
mov dword [esp + 0x1e8], eax
mov dword [esp + 0x1ec], eax
mov dword [esp + 0x1f0], eax
mov dword [esp + 0x1f4], eax
mov dword [esp + 0x1f8], eax
mov dword [esp + 0x1fc], eax
mov dword [esp + 0x200], eax
mov dword [esp + 0x204], eax
mov dword [esp + 0x3e8], eax
mov dword [esp + 0x3ec], eax
mov dword [esp + 0x3f0], eax
mov dword [esp + 0x3f4], eax
mov dword [esp + 0x3f8], eax
mov dword [esp + 0x3fc], eax
mov dword [esp + 0x400], eax
mov dword [esp + 0x404], eax
mov dword [esp + 0x408], eax
mov dword [esp + 0x40c], eax
mov dword [esp + 0x410], eax
mov dword [esp + 0x414], eax
mov dword [esp + 0x418], eax
mov dword [esp + 0x41c], eax
mov dword [esp + 0x420], eax
mov dword [esp + 0x424], eax
mov dword [esp + 0x428], eax
mov dword [esp + 0x42c], eax
mov dword [esp + 0x430], eax
mov dword [esp + 0x434], eax
mov dword [esp + 0x438], eax
mov dword [esp + 0x43c], eax
mov dword [esp + 0x440], eax
mov dword [esp + 0x444], eax
mov dword [esp + 0x448], eax
mov dword [esp + 0x44c], eax
mov dword [esp + 0x450], eax
mov dword [esp + 0x454], eax
mov dword [esp + 0x458], eax
mov dword [esp + 0x45c], eax
mov dword [esp + 0x370], eax
mov dword [esp + 0x374], eax
mov dword [esp + 0x378], eax
mov dword [esp + 0x37c], eax
mov dword [esp + 0x380], eax
mov dword [esp + 0x384], eax
mov dword [esp + 0x388], eax
mov dword [esp + 0x38c], eax
mov dword [esp + 0x390], eax
mov dword [esp + 0x394], eax
mov dword [esp + 0x398], eax
mov dword [esp + 0x39c], eax
mov dword [esp + 0x3a0], eax
mov dword [esp + 0x3a4], eax
mov dword [esp + 0x3a8], eax
mov dword [esp + 0x3ac], eax
mov dword [esp + 0x3b0], eax
mov dword [esp + 0x3b4], eax
mov dword [esp + 0x3b8], eax
mov dword [esp + 0x3bc], eax
mov dword [esp + 0x3c0], eax
mov dword [esp + 0x3c4], eax
mov dword [esp + 0x3c8], eax
mov dword [esp + 0x3cc], eax
mov dword [esp + 0x3d0], eax
mov dword [esp + 0x3d4], eax
mov dword [esp + 0x3d8], eax
mov dword [esp + 0x3dc], eax
mov dword [esp + 0x3e0], eax
mov dword [esp + 0x3e4], eax
mov dword [esp + 0x5c8], eax
mov dword [esp + 0x5cc], eax
mov dword [esp + 0x5d0], eax
mov dword [esp + 0x5d4], eax
mov dword [esp + 0x5d8], eax
mov dword [esp + 0x5dc], eax
mov dword [esp + 0x5e0], eax
mov dword [esp + 0x5e4], eax
mov dword [esp + 0x5e8], eax
mov dword [esp + 0x5ec], eax
mov dword [esp + 0x5f0], eax
mov dword [esp + 0x5f4], eax
mov dword [esp + 0x5f8], eax
mov dword [esp + 0x5fc], eax
mov dword [esp + 0x600], eax
mov dword [esp + 0x604], eax
mov dword [esp + 0x608], eax
mov dword [esp + 0x60c], eax
mov dword [esp + 0x610], eax
mov dword [esp + 0x614], eax
mov dword [esp + 0x618], eax
mov dword [esp + 0x61c], eax
mov dword [esp + 0x620], eax
mov dword [esp + 0x624], eax
mov dword [esp + 0x628], eax
mov dword [esp + 0x62c], eax
mov dword [esp + 0x630], eax
mov dword [esp + 0x634], eax
mov dword [esp + 0x638], eax
mov dword [esp + 0x63c], eax
mov dword [esp + 0x550], ebx
mov dword [esp + 0x554], ebx
mov dword [esp + 0x558], ebx
mov dword [esp + 0x55c], ebx
mov dword [esp + 0x560], ebx
mov dword [esp + 0x564], ebx
mov dword [esp + 0x568], ebx
mov dword [esp + 0x56c], ebx
mov dword [esp + 0x570], ebx
mov dword [esp + 0x574], ebx
mov dword [esp + 0x578], ebx
mov dword [esp + 0x57c], ebx
mov dword [esp + 0x580], ebx
mov dword [esp + 0x584], ebx
mov dword [esp + 0x588], ebx
mov dword [esp + 0x58c], ebx
mov dword [esp + 0x590], ebx
mov dword [esp + 0x594], ebx
mov dword [esp + 0x598], ebx
mov dword [esp + 0x59c], ebx
mov dword [esp + 0x5a0], ebx
mov dword [esp + 0x5a4], ebx
mov dword [esp + 0x5a8], ebx
mov dword [esp + 0x5ac], ebx
mov dword [esp + 0x5b0], ebx
mov dword [esp + 0x5b4], ebx
mov dword [esp + 0x5b8], ebx
mov dword [esp + 0x5bc], ebx
mov dword [esp + 0x5c0], ebx
mov dword [esp + 0x5c4], ebx
mov dword [esp + 0x2f8], ebx
mov dword [esp + 0x2fc], ebx
mov dword [esp + 0x300], ebx
mov dword [esp + 0x304], ebx
mov dword [esp + 0x308], ebx
mov dword [esp + 0x30c], ebx
mov dword [esp + 0x310], ebx
mov dword [esp + 0x314], ebx
mov dword [esp + 0x318], ebx
mov dword [esp + 0x31c], ebx
mov dword [esp + 0x320], ebx
mov dword [esp + 0x324], ebx
mov dword [esp + 0x328], ebx
mov dword [esp + 0x32c], ebx
mov dword [esp + 0x330], ebx
mov dword [esp + 0x334], ebx
mov dword [esp + 0x338], ebx
mov dword [esp + 0x33c], ebx
mov dword [esp + 0x340], ebx
mov dword [esp + 0x344], ebx
mov dword [esp + 0x348], ebx
mov dword [esp + 0x34c], ebx
mov dword [esp + 0x350], ebx
mov dword [esp + 0x354], ebx
mov dword [esp + 0x358], ebx
mov dword [esp + 0x35c], ebx
mov dword [esp + 0x360], ebx
mov dword [esp + 0x364], ebx
mov dword [esp + 0x368], ebx
mov dword [esp + 0x36c], ebx
jmp 0x528980
cmp edi, dword [esp + 0xbc]
mov dword [esp + edi*4 + 0x644], ebp
jg 0x5289e7
cmp ebx, ebp
jle 0x5289e7
mov edx, dword [esi + 0x138]
mov eax, dword [edx + ebx*4]
cmp dword [eax + 0x2c], ebp
jle 0x5289e7
push ebx
push edi
push esi
call fcn.00513250
lea ecx, [ebx - 1]
push ecx
push edi
push esi
mov dword [esp + 0x54], eax
call fcn.00513250
imul eax, eax, 0x84
mov ecx, dword [esp + 0x54]
mov edx, dword [esi + 0x588c]
imul ecx, ecx, 0x84
mov ecx, dword [ecx + edx + 4]
add esp, 0x18
cmp ecx, dword [eax + edx + 4]
jne 0x5289e7
mov dword [esp + edi*4 + 0x644], 1
add edi, 1
cmp edi, 0x1e
jl 0x528980
mov edi, dword [esp + 0x78]
fild dword [esi + 0x514]
mov edx, dword [esi + 0x39c4]
mov eax, edi
imul eax, eax, 0x70
fstp dword [esp + 0x34]
fld dword [eax + edx + 0x60]
fmul qword [0x5debe8]
fld dword [esp + 0x34]
fld st(0)
fmulp st(2)
fxch st(1)
mov dword [esp + 0x180], eax
lea eax, [eax + edx + 0x60]
mov dword [esp + 0x3c], eax
call fcn.005ac350
mov ecx, dword [esi + 0x39c0]
mov dword [esp + 0x17c], eax
mov eax, edi
imul eax, eax, 0x98
fld dword [eax + ecx + 0x3c]
fstp dword [esp + 0x30]
cmp dword [esp + 0x58], ebp
lea edi, [eax + ecx]
mov dword [esp + 0x178], eax
jne 0x528a64
fld dword [edi + 0x10]
fstp dword [esp + 0x30]
mov edx, dword [esp + 0x3c]
fld dword [edx]
fsub dword [esp + 0x30]
fmul st(1)
call fcn.005ac350
cmp dword [esp + 0x50], ebp
mov dword [esp + 0xa8], eax
jle 0x528a87
fmul dword [edi + 0x38]
jmp 0x528a8a
fmul dword [edi + 0xc]
call fcn.005ac350
mov edi, dword [esp + 0xa8]
sub edi, eax
cmp dword [esi + 0x20], ebp
mov dword [esp + 0x48], edi
je 0x528ab9
cmp dword [esi + 0x3a58], ebp
jne 0x528ab9
push esi
call fcn.00537640
add esp, 4
imul edi, eax
mov dword [esp + 0x48], edi
sub edi, dword [esp + 0x58]
mov eax, dword [esi + 0x3a10]
sub edi, dword [esp + 0x50]
mov ecx, dword [esp + 0x24]
mov dword [eax + ecx + 0x1c], edi
lea edx, [esp + 0xe4]
push edx
lea eax, [esp + 0x88]
push eax
mov eax, dword [esp + 0x80]
lea ecx, [esp + 0xe8]
push ecx
lea edx, [esp + 0xa0]
push edx
push eax
push eax
push esi
call fcn.00526aa0
mov eax, dword [esi + 0x3a10]
mov ecx, dword [esp + 0x40]
mov edx, dword [eax + ecx + 0x30]
mov eax, dword [esi + 0x514]
add esp, 0x1c
push 0x5a0
push eax
push 0x5a0
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x34], ebp
mov byte [esp + 0x1f], 0
mov dword [esp + 0xac], edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
sub edi, eax
cmp dword [esp + 0xa0], edi
jl 0x528b4c
mov dword [esp + 0xa0], ebp
mov ecx, dword [esi + 0x3a10]
mov eax, dword [esp + 0xa0]
mov edx, dword [esp + 0x24]
mov dword [ecx + edx + 0x30], eax
mov edx, dword [esp + 0x7b4]
mov ecx, dword [esp + 0x50]
add eax, ecx
push edx
push esi
mov dword [esp + 0x64], eax
mov dword [esp + 0x24], eax
call fcn.005270a0
add esp, 8
cmp ebx, dword [esi + 0x5e4]
mov edi, ebx
jge 0x52b181
mov edi, edi
cmp edi, dword [esi + 0xb70]
jle 0x528ba6
mov eax, dword [esp + 0x18]
push eax
push esi
call fcn.00526430
add esp, 8
cmp edi, dword [esi + 0x5e4]
jge 0x52b181
test edi, edi
jle 0x528bca
lea ecx, [edi - 1]
push ecx
push esi
call fcn.005132c0
add esp, 8
mov dword [esp + 0xbc], eax
push edi
push esi
call fcn.005132c0
add esp, 8
cmp dword [esp + 0x6c], 0
mov ebp, eax
mov dword [esp + 0x2c], ebp
jle 0x528c5a
mov edx, dword [esi + 0x138]
mov ecx, dword [edx + edi*4]
mov eax, dword [esp + 0x6c]
cmp dword [ecx + 0x2c], eax
jne 0x528c07
push 0x10
push edi
push esi
call fcn.004e08a0
add esp, 0xc
test eax, eax
jne 0x528c52
mov eax, dword [esp + 0x6c]
mov edx, dword [esi + 0x138]
mov ecx, dword [edx + edi*4]
cmp dword [ecx + 0x2c], eax
je 0x528c27
mov edx, dword [esi + 0x588c]
imul eax, eax, 0x84
cmp ebp, dword [edx + eax + 0x54]
jle 0x528c52
mov eax, dword [esp + 0x7b4]
cmp dword [ecx + 0x34], eax
jg 0x528c42
cmp edi, dword [esp + 0xdc]
jl 0x528c42
add eax, 1
mov dword [ecx + 0x34], eax
mov dword [esp + 0xb8], 1
jmp 0x52ae7b
mov dword [esp + 0x6c], 0
lea eax, [esp + 0x188]
push eax
lea ecx, [esp + 0x20c]
push ecx
lea edx, [esp + 0x18c]
push edx
lea eax, [esp + 0x37c]
push eax
lea ecx, [esp + 0x4e8]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x11c]
push ecx
lea edx, [esp + 0x1b0]
push edx
mov edx, dword [esp + 0x7d8]
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0x410]
push ecx
push edx
mov edx, dword [esp + 0xec]
lea eax, [esp + 0x674]
push eax
lea ecx, [esp + 0x2b4]
push ecx
push edx
push ebp
push edi
push esi
call fcn.00525890
add esp, 0x48
test eax, eax
je 0x528d82
cmp dword [esp + 0x188], 0
je 0x528d35
mov ecx, dword [esp + ebp*4 + 0x208]
lea eax, [esp + 0x98]
push eax
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + ebp*4 + 0x290]
lea ecx, [esp + ebp*4 + 0x6cc]
push ecx
mov ecx, dword [esp + ebp*4 + 0x658]
lea edx, [esp + ebp*4 + 0x1a4]
push edx
mov edx, dword [esp + 0x7cc]
push eax
push ecx
push edx
push edi
push esi
call fcn.00527360
add esp, 0x2c
cmp dword [esp + ebp*4 + 0x280], 0
je 0x528d72
push 0x10
push edi
push esi
call fcn.004e08a0
add esp, 0xc
test eax, eax
jne 0x528d72
mov eax, dword [esi + 0x138]
mov eax, dword [eax + edi*4]
mov ecx, dword [esp + 0x7b4]
cmp dword [eax + 0x34], ecx
jl 0x528d72
mov edx, dword [eax + 0x2c]
mov dword [esp + 0x6c], edx
mov dword [esp + 0xdc], edi
mov dword [esp + 0xb8], 1
jmp 0x52ae7b
xor ecx, ecx
cmp dword [esp + 0x184], ecx
jne 0x52b10d
cmp dword [esp + 0xb8], ecx
je 0x528e79
xor eax, eax
mov dword [esp + 0x100], eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], eax
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], eax
mov dword [esp + 0x144], eax
mov dword [esp + 0x148], eax
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], eax
mov dword [esp + 0x158], eax
mov dword [esp + 0x15c], eax
mov dword [esp + 0x160], eax
mov dword [esp + 0x164], eax
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov dword [esp + 0xb8], ecx
mov eax, dword [esi + 0x138]
mov eax, dword [eax + edi*4]
test dword [eax + 0x38], 0x10000
mov edx, dword [eax + 0x18]
mov dword [esp + 0x44], edx
mov dword [esp + 0xb4], ecx
je 0x528eff
mov eax, dword [esp + 0x18]
push ecx
push ecx
push eax
push edi
push ecx
push ecx
mov ecx, dword [esi + 0x3a0]
push ecx
push esi
call fcn.00537660
mov ebp, dword [esp + 0x88]
mov edx, dword [esi + 0x3a10]
add ebp, eax
mov eax, dword [esp + 0x44]
add esp, 0x20
cmp dword [edx + eax + 0x24], 0
mov dword [esp + 0x68], ebp
jne 0x528ef1
test ebp, ebp
jle 0x528ef1
mov ecx, dword [esi + 0x514]
push 0x5a0
push ecx
push 0x32
call dword [sym.imp.KERNEL32.dll_MulDiv]
lea ebp, [ebp + eax*2]
mov dword [esp + 0x68], ebp
mov edx, dword [esi + 0x3a10]
mov eax, dword [esp + 0x24]
mov dword [edx + eax + 0x24], ebp
mov ecx, dword [esp + 0x60]
mov eax, dword [esi + 0x138]
mov dl, byte [esp + 0x12]
mov ebp, dword [esi + 0x2b38]
mov dword [esp + 0x20], ecx
lea ecx, [eax + edi*4]
mov eax, dword [ecx]
mov byte [esp + 0x7f], dl
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0x30]
imul edx, edx, 0x58
mov ebp, dword [edx + ebp + 0x18]
mov dword [esp + 0x90], ebp
and ebp, 0x3000
mov dword [esp + 0x60], eax
mov byte [esp + 0x12], 0
je 0x528f86
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x38]
test ecx, 0x80000
mov dl, byte [esp + 0x13]
mov byte [esp + 0x12], dl
je 0x528f5f
mov byte [esp + 0x12], 0x11
test ecx, 0x100000
je 0x528f6c
mov byte [esp + 0x12], 0x10
test ecx, 0x20000
je 0x528f79
mov byte [esp + 0x12], 0x19
test ecx, 0x40000
je 0x528f86
mov byte [esp + 0x12], 0x1a
test ebp, ebp
jne 0x528f96
test eax, eax
mov dword [esp + 0x64], 1
jle 0x528f9e
mov dword [esp + 0x64], 0
test eax, eax
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x14], edx
jne 0x528fde
cmp dword [esp + 0x20], eax
jle 0x528fde
mov eax, dword [esp + 0xcc]
mov ebp, dword [esp + 0xd0]
mov ecx, dword [esp + 0xc4]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xd8]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x5c], eax
mov dword [esp + 0x40], ecx
jmp 0x528fe6
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
test ecx, ecx
jle 0x529036
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x529036
cmp ecx, edx
je 0x529036
mov edx, dword [esp + 0xcc]
imul ecx, ecx, 0x98
mov ebp, dword [esp + 0xd0]
mov eax, dword [esp + 0xd8]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0xc4]
mov dword [esp + 0x40], edx
mov edx, dword [esi + 0x72c]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x5c], eax
mov dword [edx + ecx + 0x2c], edi
cmp byte [esp + 0x13], 0
je 0x5291da
cmp byte [esp + 0x12], 0
jne 0x5291da
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 0x39c4]
mov eax, ecx
imul eax, eax, 0x70
cmp dword [edx + eax], 0
lea ebp, [edx + eax]
jl 0x529099
mov edx, dword [esi + 0x39c0]
imul ecx, ecx, 0x98
test byte [ecx + edx + 0x28], 1
jne 0x529095
mov eax, dword [esp + 0xf8]
mov ebp, dword [esp + 0xec]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xf0]
jmp 0x5291d2
mov ecx, dword [esp + 0x18]
mov dl, byte [esp + 0x13]
cmp dl, 0x11
jne 0x5290fb
mov edx, dword [esp + 0x14]
imul ecx, ecx, 0x98
mov dword [ebp + 0x10], edx
mov edx, dword [esi + 0x39c4]
fild dword [esi + 0x514]
lea ebp, [edx + eax + 0x10]
mov eax, dword [esi + 0x39c0]
add ecx, eax
fstp dword [esp + 0x34]
fild dword [ebp]
fld dword [esp + 0x34]
fld st(0)
fdivp st(2)
fld dword [ecx + 0x38]
faddp st(2)
fld dword [ecx + 0xc]
fcomp st(2)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x52915d
fld dword [ecx + 0xc]
fsub dword [ecx + 0x38]
fmulp st(1)
call fcn.005ac350
mov dword [ebp], eax
jmp 0x52915f
cmp dl, 0x19
jne 0x52915f
mov ecx, dword [esp + 0x14]
mov dword [ebp + 0x38], ecx
fild dword [esi + 0x514]
mov edx, dword [esi + 0x39c4]
lea ebp, [edx + eax + 0x38]
fstp dword [esp + 0x34]
mov eax, dword [esp + 0x18]
fild dword [ebp]
mov ecx, dword [esi + 0x39c0]
imul eax, eax, 0x98
fld dword [esp + 0x34]
fld st(0)
fdivp st(2)
add ecx, eax
fld dword [ecx + 0x38]
faddp st(2)
fld dword [ecx + 0xc]
fcomp st(2)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x52915d
fld dword [ecx + 0xc]
fsub dword [ecx + 0x38]
fmulp st(1)
call fcn.005ac350
mov dword [ebp], eax
jmp 0x52915f
fstp st(0)
mov edx, dword [esp + 0x7b4]
push 1
push 0
push edx
push esi
call fcn.00526180
add esp, 0x10
test eax, eax
mov dword [esp + 0x50], eax
jle 0x5291a8
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x39c0]
imul eax, eax, 0x98
fld dword [eax + ecx + 0x38]
fimul dword [esi + 0x514]
call fcn.005ac350
mov ecx, dword [esp + 0xa8]
sub ecx, eax
mov dword [esp + 0x48], ecx
mov edx, dword [esp + 0x7b4]
push 0
push edx
push esi
call fcn.005262b0
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0xac]
add eax, ecx
add esp, 0xc
mov dword [esp + 0x1c], eax
xor ebp, ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x5c], eax
mov ecx, dword [esp + 0x60]
test ecx, ecx
mov edx, dword [esp + 0x18]
je 0x529219
cmp ecx, dword [esp + 0x20]
je 0x529215
mov edx, ecx
mov ecx, dword [esi + 0x72c]
imul edx, edx, 0x98
add ecx, edx
mov edx, dword [ecx + 0x24]
cmp edx, dword [esp + 0x7b4]
mov edx, dword [esp + 0x18]
je 0x529219
and dword [ecx + 0x28], 0xffff7fff
jmp 0x529219
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x60]
test ecx, ecx
jle 0x529260
cmp dword [esp + 0x20], 0
jne 0x529260
mov edx, dword [esp + 0x1c]
imul ecx, ecx, 0x98
mov dword [esp + 0xcc], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0xc4], edx
mov edx, dword [esi + 0x72c]
mov dword [edx + ecx + 0x2c], edi
mov edx, dword [esp + 0x18]
mov dword [esp + 0xd0], ebp
mov dword [esp + 0xd8], eax
cmp byte [esp + 0x12], 0
mov cl, byte [esp + 0x13]
je 0x52928e
test cl, cl
jne 0x529295
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xf8], ecx
mov cl, byte [esp + 0x13]
mov dword [esp + 0xec], ebp
mov dword [esp + 0xf0], eax
jmp 0x5292d7
cmp byte [esp + 0x13], 0
je 0x5292c1
cmp cl, 0x11
jne 0x5292a0
cmp byte [esp + 0x12], cl
jmp 0x5292bf
cmp cl, 0x10
jne 0x5292ab
cmp byte [esp + 0x12], cl
jmp 0x5292bf
cmp cl, 0x19
jne 0x5292b6
cmp byte [esp + 0x12], cl
jmp 0x5292bf
cmp cl, 0x1a
jne 0x5292c1
cmp byte [esp + 0x12], cl
jne 0x5292d7
mov eax, dword [esp + 0x60]
cmp eax, dword [esp + 0x20]
je 0x52952a
test eax, eax
jle 0x52952a
mov eax, dword [esp + 0x2c]
xor ebp, ebp
cmp cl, 0x11
mov dword [esp + 0x40], ebp
mov dword [esp + eax*4 + 0x208], ebp
mov dword [esp + eax*4 + 0x190], ebp
mov dword [esp + eax*4 + 0x100], ebp
jne 0x52938f
cmp byte [esp + 0x12], cl
je 0x5294d0
mov ecx, dword [esi + 0x39c4]
mov ebp, dword [esp + 0x14]
mov eax, edx
imul eax, eax, 0x70
mov dword [ecx + eax + 0x10], ebp
mov ecx, dword [esi + 0x39c4]
lea ebp, [ecx + eax + 0x10]
fild dword [esi + 0x514]
mov eax, dword [esi + 0x39c0]
imul edx, edx, 0x98
fstp dword [esp + 0x34]
fild dword [ebp]
fld dword [esp + 0x34]
fld st(0)
fdivp st(2)
lea ecx, [edx + eax]
fld dword [ecx + 0x38]
faddp st(2)
fld dword [ecx + 0xc]
fcomp st(2)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x52936f
fld dword [ecx + 0xc]
fsub dword [ecx + 0x38]
fmulp st(1)
call fcn.005ac350
mov dword [ebp], eax
jmp 0x529371
fstp st(0)
mov ecx, dword [esp + 0x7b4]
push 1
push 0
push ecx
push esi
call fcn.00526180
add esp, 0x10
mov dword [esp + 0x50], eax
jmp 0x5294cc
cmp cl, 0x19
jne 0x5293c0
cmp byte [esp + 0x12], cl
je 0x5294d0
mov ecx, dword [esi + 0x39c4]
mov ebp, dword [esp + 0x14]
mov eax, edx
imul eax, eax, 0x70
mov dword [ecx + eax + 0x38], ebp
mov ecx, dword [esi + 0x39c4]
lea ebp, [ecx + eax + 0x38]
jmp 0x529326
cmp cl, 0x10
jne 0x529414
cmp byte [esp + 0x12], cl
je 0x5294d0
mov ecx, dword [esp + 0x8c]
cmp ecx, ebp
jne 0x5293de
mov ecx, dword [esp + 0x14]
mov ebp, dword [esi + 0x39c4]
mov eax, edx
imul eax, eax, 0x70
mov dword [eax + ebp + 0x28], ecx
mov ebp, dword [esi + 0x39c4]
mov dword [eax + ebp + 0x24], ecx
mov ecx, dword [esi + 0x39c4]
mov ebp, dword [esp + 0xac]
mov dword [ecx + eax + 0x2c], ebp
mov ecx, dword [esi + 0x39c4]
lea ebp, [ecx + eax + 0x24]
jmp 0x52946a
cmp cl, 0x1a
jne 0x5294d0
cmp byte [esp + 0x12], cl
je 0x5294d0
mov ecx, dword [esp + 0x8c]
cmp ecx, ebp
jne 0x529436
mov ecx, dword [esp + 0x14]
mov ebp, dword [esi + 0x39c4]
mov eax, edx
imul eax, eax, 0x70
mov dword [eax + ebp + 0x50], ecx
mov ebp, dword [esi + 0x39c4]
mov dword [eax + ebp + 0x4c], ecx
mov ecx, dword [esi + 0x39c4]
mov ebp, dword [esp + 0xac]
mov dword [ecx + eax + 0x54], ebp
mov ecx, dword [esi + 0x39c4]
lea ebp, [ecx + eax + 0x4c]
fild dword [esi + 0x514]
mov eax, dword [esi + 0x39c0]
imul edx, edx, 0x98
fstp dword [esp + 0x34]
fild dword [ebp]
fld dword [esp + 0x34]
fld st(0)
fdivp st(2)
lea ecx, [edx + eax]
fld dword [ecx + 0x3c]
faddp st(2)
fld dword [ecx + 0x10]
fcomp st(2)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x5294b3
fld dword [ecx + 0x10]
fsub dword [ecx + 0x3c]
fmulp st(1)
call fcn.005ac350
mov dword [ebp], eax
jmp 0x5294b5
fstp st(0)
mov ecx, dword [esp + 0x7b4]
push 0
push ecx
push esi
call fcn.005262b0
mov dword [esp + 0x64], eax
add esp, 0xc
mov edx, dword [esp + 0x18]
cmp dword [esp + 0x50], 0
jle 0x529507
mov edx, dword [esp + 0x18]
mov eax, dword [esi + 0x39c0]
imul edx, edx, 0x98
fld dword [edx + eax + 0x38]
fimul dword [esi + 0x514]
call fcn.005ac350
mov ecx, dword [esp + 0xa8]
mov edx, dword [esp + 0x18]
sub ecx, eax
mov dword [esp + 0x48], ecx
cmp byte [esp + 0x12], 0
je 0x52952a
xor eax, eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0xac], eax
mov al, byte [esp + 0x12]
cmp al, 0x11
jne 0x529578
mov ecx, dword [esi + 0x39c4]
mov eax, edx
imul eax, eax, 0x70
mov ebp, dword [ecx + eax + 0xc]
add ecx, eax
add ebp, 1
cmp edi, ebp
je 0x529551
mov dword [ecx + 8], 0xffffffff
mov ecx, dword [esi + 0x39c4]
cmp dword [ecx + eax + 8], 0
lea ecx, [ecx + eax + 8]
jge 0x529564
mov dword [ecx], edi
mov ecx, dword [esi + 0x39c4]
mov dword [ecx + eax + 0xc], edi
mov byte [esp + 0x13], 0x11
jmp 0x529655
cmp al, 0x19
jne 0x5295c2
mov ecx, dword [esi + 0x39c4]
mov eax, edx
imul eax, eax, 0x70
mov ebp, dword [ecx + eax + 0x34]
add ecx, eax
add ebp, 1
cmp edi, ebp
je 0x52959b
mov dword [ecx + 0x30], 0xffffffff
mov ecx, dword [esi + 0x39c4]
cmp dword [ecx + eax + 0x30], 0
lea ecx, [ecx + eax + 0x30]
jge 0x5295ae
mov dword [ecx], edi
mov ecx, dword [esi + 0x39c4]
mov dword [ecx + eax + 0x34], edi
mov byte [esp + 0x13], 0x19
jmp 0x529655
cmp al, 0x10
jne 0x529609
mov ecx, dword [esi + 0x39c4]
mov eax, edx
imul eax, eax, 0x70
mov ebp, dword [ecx + eax + 0x20]
add ecx, eax
add ebp, 1
cmp edi, ebp
je 0x5295e5
mov dword [ecx + 0x1c], 0xffffffff
mov ecx, dword [esi + 0x39c4]
cmp dword [ecx + eax + 0x1c], 0
lea ecx, [ecx + eax + 0x1c]
jge 0x5295f8
mov dword [ecx], edi
mov ecx, dword [esi + 0x39c4]
mov dword [ecx + eax + 0x20], edi
mov byte [esp + 0x13], 0x10
jmp 0x529655
cmp al, 0x1a
jne 0x529650
mov ecx, dword [esi + 0x39c4]
mov eax, edx
imul eax, eax, 0x70
mov ebp, dword [ecx + eax + 0x48]
add ecx, eax
add ebp, 1
cmp edi, ebp
je 0x52962c
mov dword [ecx + 0x44], 0xffffffff
mov ecx, dword [esi + 0x39c4]
cmp dword [ecx + eax + 0x44], 0
lea ecx, [ecx + eax + 0x44]
jge 0x52963f
mov dword [ecx], edi
mov ecx, dword [esi + 0x39c4]
mov dword [ecx + eax + 0x48], edi
mov byte [esp + 0x13], 0x1a
jmp 0x529655
mov byte [esp + 0x13], 0
mov ecx, dword [esp + 0x60]
test ecx, ecx
mov eax, dword [esp + 0x20]
jle 0x529736
cmp ecx, eax
je 0x529736
mov eax, dword [esi + 0x72c]
imul ecx, ecx, 0x98
add eax, ecx
test dword [eax + 0x28], 0x380
mov dword [esp + 0x3c], eax
jne 0x529720
lea eax, [edi + 1]
cmp eax, dword [esi + 0x5e4]
jge 0x529720
mov ecx, dword [esi + 0x138]
lea ecx, [ecx + eax*4]
mov ebp, dword [ecx]
cmp dword [ebp + 0x30], 0
je 0x5296ba
add eax, 1
add ecx, 4
cmp eax, dword [esi + 0x5e4]
jl 0x5296a4
cmp eax, dword [esi + 0x5e4]
jge 0x529720
mov ecx, dword [esi + 0x138]
mov eax, dword [ecx + eax*4]
mov ecx, dword [esp + 0x48]
sub ecx, dword [esp + 0x68]
mov ebp, dword [eax + 0x18]
sub ecx, dword [esp + 0x58]
add ebp, dword [esp + 0x1c]
cmp ebp, ecx
jle 0x529720
cmp byte [esp + 0x13], 0
jne 0x529720
cmp dword [eax + 0x2c], 0
jne 0x529720
cmp edi, dword [esp + 0x4c]
jle 0x529720
mov eax, dword [esi + 0x39c0]
imul edx, edx, 0x98
mov ecx, dword [edx + eax + 0x14]
sub ecx, 1
cmp dword [esp + 0x40], ecx
jne 0x529720
mov eax, dword [esp + 0x7b4]
cmp eax, 0x1193
jl 0x52b1bd
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x7b4]
mov ecx, dword [esp + 0x60]
mov dword [eax + 0x24], edx
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x529786
cmp eax, ecx
je 0x529786
mov ecx, dword [esi + 0x72c]
imul eax, eax, 0x98
mov eax, dword [eax + ecx + 0x28]
test eax, 0x4000
jne 0x529786
test eax, 0x8000
jne 0x52977b
cmp byte [esp + 0x7f], 0
jne 0x52977b
cmp byte [esp + 0x12], 0
je 0x529773
cmp dword [esi + 0x5b84], 0
je 0x52977b
mov dword [esp + 0x70], 1
mov dword [esp + 0x80], 1
cmp edi, ebx
jle 0x529854
mov edx, dword [esi + 0x138]
mov eax, dword [edx + edi*4]
mov ebp, 0x4000
test dword [eax + 0x38], ebp
je 0x5297e6
mov ecx, dword [esp + 0x7b4]
push ecx
push edi
push esi
call fcn.00526740
add esp, 0xc
test eax, eax
je 0x5297e6
mov edx, dword [esi + 0x138]
mov eax, dword [edx + edi*4]
mov ecx, dword [eax + 0x14]
mov edx, dword [esi + 0x2b38]
imul ecx, ecx, 0x58
test dword [ecx + edx + 0x18], 0x3000
jne 0x5297e6
cmp dword [eax + 0x30], 0
jne 0x5297e6
cmp dword [eax + 0x2c], 0
je 0x52b1d5
mov eax, dword [esi + 0x138]
mov ecx, dword [eax + edi*4 - 4]
test dword [ecx + 0x38], ebp
je 0x529854
mov edx, dword [esp + 0x7b4]
push edx
lea ebp, [edi - 1]
push ebp
push esi
call fcn.00526640
add esp, 0xc
test eax, eax
je 0x529854
mov eax, dword [esi + 0x138]
mov ecx, dword [eax + edi*4 - 4]
mov edx, dword [ecx + 0x14]
mov eax, dword [esi + 0x2b38]
imul edx, edx, 0x58
test dword [edx + eax + 0x18], 0x3000
je 0x529837
cmp dword [esi + 0x5b84], 0
je 0x529854
push 0
push ebp
push esi
mov dword [esp + 0x7c], 1
call fcn.004f6e40
add esp, 0xc
mov dword [esp + 0xd4], eax
jmp 0x52985b
cmp dword [esp + 0x70], 0
je 0x529873
cmp dword [esp + 0x60], 0
jne 0x529873
cmp byte [esp + 0x12], 0
jne 0x529873
cmp edi, dword [esp + 0x74]
jg 0x52b21e
mov ecx, dword [esi + 0x138]
mov eax, dword [ecx + edi*4]
mov edx, dword [eax + 0x14]
mov ebp, dword [esi + 0x2b38]
imul edx, edx, 0x58
test byte [edx + ebp + 0x2c], 0x40
lea ecx, [ecx + edi*4]
je 0x5298b4
test byte [eax + 0x38], 4
je 0x5298b4
xor edx, edx
cmp dword [eax + 0x2c], edx
jne 0x5298b6
cmp dword [eax + 0x30], edx
jne 0x5298b6
cmp dword [esp + 0x64], edx
je 0x5298b6
mov dword [esp + 0x14], 1
jmp 0x5298ba
xor edx, edx
mov dword [esp + 0x14], edx
cmp edi, edx
jle 0x5298da
mov ecx, dword [ecx - 4]
mov ebp, dword [esp + 0x7b4]
cmp dword [ecx + 0x34], ebp
jl 0x5298d6
test dword [ecx + 0x38], 0x1e0000
je 0x5298da
mov dword [esp + 0x14], edx
mov eax, dword [eax + 0x10]
cmp eax, edx
je 0x5298ea
test byte [eax], 0x2e
je 0x5298ea
mov dword [esp + 0x14], edx
cmp edi, dword [esp + 0x4c]
jne 0x5298f4
mov dword [esp + 0x14], edx
xor ebp, ebp
test eax, eax
mov dword [esp + 0x3c], 1
je 0x529907
test byte [eax], 0x2e
jne 0x529912
cmp dword [esp + 0x14], 0
je 0x52a177
mov eax, dword [esp + 0x1c]
push 0
push edi
push esi
mov dword [esp + 0x3c], eax
call fcn.004badf0
mov ecx, dword [esp + 0x50]
mov edx, dword [esi + 0x138]
add eax, ecx
add dword [esp + 0x28], eax
add dword [esp + 0x34], eax
mov eax, dword [edx + edi*4]
mov ecx, dword [esp + 0x7c0]
push 2
push edi
push esi
mov dword [esp + 0x50], edi
mov dword [eax + 0x34], ecx
call fcn.004e08a0
add esp, 0x18
test eax, eax
je 0x529e5e
cmp dword [esp + 0x64], 0
je 0x529e5e
mov edx, dword [esp + 0x2c]
cmp dword [esp + edx*4 + 0x100], 0
jne 0x529e5e
mov eax, dword [esi + 0x514]
mov ecx, dword [esi + 0x39c0]
cdq
and edx, 3
add eax, edx
mov edx, dword [esp + 0x48]
sar eax, 2
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x18]
imul eax, eax, 0x98
mov ecx, dword [eax + ecx + 0x14]
mov ebp, edx
sub ebp, dword [esp + 0x5c]
mov dword [esp + 0x40], edi
sub ebp, dword [esp + 0x58]
cmp ecx, 1
mov dword [esp + 0x20], eax
jle 0x529cf9
mov eax, dword [esp + 0x28]
cdq
idiv ecx
add eax, 1
cmp eax, ebp
mov dword [esp + 0x28], eax
jg 0x529a73
mov eax, dword [esp + 0x78]
xor edx, edx
cmp dword [esp + 0x18], eax
sete dl
mov dword [esp + 0x30], edx
jmp 0x5299f0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0xb4]
push eax
mov eax, dword [esp + 0x30]
push ebp
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [esi + 0x39c0]
push edx
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [edx + ecx + 0x14]
push eax
push esi
call fcn.00527ac0
mov edi, dword [esp + 0x64]
mov ecx, dword [esi + 0x138]
mov edx, dword [ecx + edi*4]
mov dword [esp + 0x1ac], eax
mov eax, dword [edx + 0x18]
add esp, 0x20
cmp edi, dword [esp + 0x40]
mov dword [esp + 0x44], eax
je 0x529a73
mov eax, dword [esp + 0x28]
cmp eax, ebp
jge 0x529a68
add eax, dword [esp + 0x34]
cmp eax, ebp
mov dword [esp + 0x28], eax
jle 0x5299f0
mov dword [esp + 0x28], ebp
jmp 0x5299f0
mov dword [esp + 0xb4], 1
mov eax, dword [esp + 0x40]
cmp edi, eax
mov ecx, dword [esp + 0x18c]
mov dword [esp + 0x28], ecx
jge 0x529aa2
cmp edi, dword [esp + 0x4c]
jg 0x529d32
mov edx, dword [esi + 0x138]
mov edi, eax
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x44], ecx
mov eax, dword [esp + 0x20]
mov edx, dword [esi + 0x39c0]
mov ecx, dword [esp + 0x7b4]
mov ebp, dword [esp + 0x28]
mov dword [eax + edx + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 0x39c4]
imul ecx, ecx, 0x70
mov dword [edx + ecx + 0x68], ebp
mov edx, dword [esi + 0x39c0]
mov dword [eax + edx + 0x20], edi
mov edx, dword [esi + 0x39c4]
mov ecx, dword [edx + ecx + 4]
test ecx, ecx
mov eax, dword [esp + 0x18]
mov dword [esp + 0xb0], eax
mov dword [esp + 0x18], ecx
jge 0x529b0c
push esi
call fcn.004aec90
lea eax, [edi + 1]
push eax
push esi
call fcn.004aea30
add esp, 0xc
mov dword [esp + 0x18], eax
mov ecx, eax
mov ebp, ecx
mov ecx, dword [esi + 0x39c0]
imul ebp, ebp, 0x98
lea eax, [edi + 1]
mov dword [ecx + ebp + 0x1c], eax
mov edx, dword [esi + 0x39c0]
mov dword [edx + ebp + 0x2c], 0xffffffff
cmp eax, dword [esi + 0x5e4]
mov dword [esp + 0x20], ebp
jge 0x529cdc
mov eax, dword [esi + 0x138]
mov ecx, dword [eax + edi*4 + 4]
mov edx, dword [ecx + 0x14]
mov eax, dword [esi + 0x2b38]
imul edx, edx, 0x58
test dword [edx + eax + 0x18], 0x3000
jne 0x529cdc
mov eax, dword [esp + 0xb0]
mov ebp, dword [esp + 0x18]
imul eax, eax, 0x70
mov ecx, dword [esi + 0x39c4]
imul ebp, ebp, 0x70
mov edx, dword [eax + ecx + 0x10]
mov dword [ecx + ebp + 0x10], edx
mov ecx, dword [esi + 0x39c4]
mov dword [esp + 0x48], eax
lea eax, [eax + ecx + 8]
push eax
push esi
call fcn.00525e20
add esp, 8
test eax, eax
jne 0x529bda
mov eax, dword [esi + 0x39c4]
lea ecx, [eax + ebp + 8]
push ecx
push esi
call fcn.00525e60
mov edx, dword [esi + 0x39c0]
mov eax, dword [esp + 0x28]
fld dword [eax + edx + 0xc]
add eax, edx
fsub dword [eax + 0x38]
add esp, 8
fimul dword [esi + 0x514]
call fcn.005ac350
mov ecx, dword [esi + 0x39c4]
mov dword [ecx + ebp + 0x10], eax
mov eax, dword [esi + 0x39c4]
mov ecx, dword [esp + 0x48]
mov edx, dword [ecx + eax + 0x24]
mov dword [eax + ebp + 0x24], edx
mov eax, dword [esi + 0x39c4]
mov edx, dword [ecx + eax + 0x28]
mov dword [eax + ebp + 0x28], edx
mov eax, dword [esi + 0x39c4]
lea eax, [ecx + eax + 0x1c]
push eax
push esi
call fcn.00525e20
add esp, 8
test eax, eax
jne 0x529c4e
mov eax, dword [esi + 0x39c4]
lea ecx, [eax + ebp + 0x1c]
push ecx
push esi
call fcn.00525e60
mov edx, dword [esi + 0x39c0]
mov eax, dword [esp + 0x28]
fld dword [eax + edx + 0x10]
add eax, edx
fsub dword [eax + 0x3c]
add esp, 8
fimul dword [esi + 0x514]
call fcn.005ac350
mov ecx, dword [esi + 0x39c4]
mov dword [ecx + ebp + 0x24], eax
mov eax, dword [esi + 0x39c4]
mov ecx, dword [esp + 0x48]
mov edx, dword [ecx + eax + 0x38]
mov dword [eax + ebp + 0x38], edx
mov eax, dword [esi + 0x39c4]
lea eax, [ecx + eax + 0x30]
push eax
push esi
call fcn.00525e20
add esp, 8
test eax, eax
jne 0x529c8c
mov eax, dword [esi + 0x39c4]
lea ecx, [eax + ebp + 0x30]
push ecx
push esi
call fcn.00525e60
add esp, 8
mov eax, dword [esi + 0x39c4]
mov ecx, dword [esp + 0x48]
mov edx, dword [ecx + eax + 0x4c]
mov dword [eax + ebp + 0x4c], edx
mov eax, dword [esi + 0x39c4]
mov edx, dword [ecx + eax + 0x50]
mov dword [eax + ebp + 0x50], edx
mov eax, dword [esi + 0x39c4]
lea eax, [ecx + eax + 0x44]
push eax
push esi
call fcn.00525e20
add esp, 8
test eax, eax
jne 0x529cd8
mov eax, dword [esi + 0x39c4]
lea ecx, [eax + ebp + 0x44]
push ecx
push esi
call fcn.00525e60
add esp, 8
mov ebp, dword [esp + 0x20]
mov edx, dword [esi + 0x39c0]
test byte [edx + ebp + 0x28], 2
lea eax, [edx + ebp]
je 0x529d62
movzx eax, word [eax + 0x34]
mov dword [esp + 0xc0], eax
jmp 0x529d6d
sub edx, dword [esp + 0x68]
sub edx, dword [esp + 0x58]
cmp dword [esp + 0x30], edx
jle 0x529aa6
cmp edi, dword [esp + 0x4c]
jle 0x529aa6
mov edx, dword [esi + 0x138]
mov ecx, dword [edx + edi*4]
mov eax, dword [esp + 0x7b4]
add eax, 1
lea edx, [edi - 1]
mov dword [ecx + 0x34], eax
mov dword [esp + 0x38], edx
mov ecx, dword [esi + 0x3a10]
mov eax, dword [esp + 0x24]
mov dword [ecx + eax + 0x48], edi
mov edx, dword [esi + 0x3a10]
mov ecx, dword [esp + 0x38]
mov dword [edx + eax + 4], ecx
mov edx, dword [esi + 0x3a10]
and dword [edx + eax + 0x70], 0xfffffffe
lea eax, [edx + eax + 0x70]
jmp 0x52b181
mov dword [esp + 0xc0], 0
mov eax, dword [esp + 0x5c]
add eax, dword [esp + 0x28]
lea ecx, [esp + 0xe4]
push ecx
mov dword [esp + 0x60], eax
mov dword [esp + 0x20], eax
lea eax, [edi + 1]
mov dword [esp + 0xb4], eax
mov dword [esp + 0x50], eax
lea edx, [esp + 0x88]
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0xe8]
push eax
mov eax, dword [esp + 0x84]
lea ecx, [esp + 0xa0]
push ecx
push edx
push eax
push esi
call fcn.00526aa0
mov ecx, dword [esi + 0x39c4]
mov edx, dword [esp + 0x19c]
fld dword [edx + ecx + 0x60]
mov eax, dword [esi + 0x39c0]
mov ecx, dword [esp + 0x194]
fsub dword [ecx + eax + 0x38]
add esp, 0x1c
fsub dword [eax + ebp + 0x3c]
fimul dword [esi + 0x514]
call fcn.005ac350
xor ecx, ecx
cmp dword [esi + 0x20], ecx
mov ebp, eax
mov dword [esp + 0x48], ebp
je 0x529e19
cmp dword [esi + 0x3a58], ecx
jne 0x529e19
push esi
call fcn.00537640
imul eax, ebp
add esp, 4
mov dword [esp + 0x48], eax
xor ecx, ecx
cmp dword [esi + 0x20], ecx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + eax*4 + 0x208], ecx
mov dword [esp + eax*4 + 0x190], ecx
mov dword [esp + eax*4 + 0x100], ecx
jne 0x52ae7b
mov edx, dword [esp + 0x18]
push edx
push esi
call fcn.005272d0
add esp, 8
test eax, eax
je 0x52ae7b
mov ebp, 1
push 8
push edi
push esi
call fcn.004e08a0
add esp, 0xc
test eax, eax
je 0x529f8d
mov ecx, dword [esp + 0x2c]
cmp dword [esp + ecx*4 + 0x100], 0
lea ecx, [esp + ecx*4 + 0x100]
jne 0x529f8d
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x40]
imul edx, edx, 0x98
mov ebp, dword [esi + 0x39c0]
add eax, 1
cmp eax, dword [edx + ebp + 0x14]
jge 0x529eed
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x1c], edx
lea edx, [edi + 1]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x4c], edx
xor edx, edx
mov dword [esp + eax*4 + 0x208], edx
mov dword [esp + eax*4 + 0x190], edx
mov eax, dword [esp + 0x94]
mov dword [ecx], edx
mov ecx, dword [esp + 0xe0]
add eax, ecx
add dword [esp + 0x84], eax
jmp 0x52ae7b
mov ebp, 1
test ebp, ebp
jne 0x529f0d
mov edx, dword [esi + 0x138]
mov eax, dword [edx + edi*4]
mov ecx, dword [eax + 0x10]
test byte [ecx], 4
je 0x529f33
cmp dword [esi + 0x20], 0
jne 0x529f33
cmp dword [esp + 0x7b4], 0x1193
jge 0x529f33
cmp dword [esp + 0x64], 0
je 0x529f33
mov edx, dword [esp + 0x2c]
cmp dword [esp + edx*4 + 0x100], 0
je 0x52b2cd
mov eax, dword [esi + 0x138]
mov ecx, dword [eax + edi*4]
mov edx, dword [ecx + 0x10]
test byte [edx], 0x20
je 0x52a177
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + eax*4 + 0x100]
test eax, eax
mov dword [esp + 0x14], eax
jle 0x52a177
mov eax, dword [esp + 0x2c]
lea ecx, [esp + eax*4 + 0x644]
mov dword [esp + 0x30], ecx
mov ecx, dword [ecx]
test ecx, ecx
je 0x529fc9
mov ecx, dword [esp + 0x14]
lea edx, [ecx*8]
sub edx, ecx
mov ecx, dword [esi + 0x5888]
mov ecx, dword [ecx + edx*4 + 4]
jmp 0x52a00a
test ebp, ebp
jne 0x529f0d
cmp dword [esp + 0x14], ebp
je 0x529ef6
test edi, edi
jle 0x529f0d
mov edx, dword [esi + 0x138]
mov eax, dword [esp + 0x7b4]
mov ecx, dword [edx + edi*4]
add eax, 1
sub edi, 1
mov dword [ecx + 0x34], eax
mov dword [esp + 0x38], edi
jmp 0x529f0d
cmp dword [esp + eax*4 + 0x280], 0
je 0x529feb
mov ecx, dword [esp + 0x14]
lea edx, [ecx*8]
sub edx, ecx
mov ecx, dword [esi + 0x5888]
mov ecx, dword [ecx + edx*4]
jmp 0x52a00a
mov ebp, dword [esp + 0x14]
push ebp
push esi
call fcn.00526f80
mov edx, dword [esi + 0x5884]
mov eax, dword [esp + 0x34]
add esp, 8
imul ebp, ebp, 0x68
mov ecx, dword [edx + ebp + 0x14]
mov ebp, dword [esp + 0x48]
sub ebp, dword [esp + 0x68]
mov edx, dword [esp + 0x1c]
sub ebp, dword [esp + 0x58]
add edx, ecx
cmp edx, ebp
mov dword [esp + 0x14], edx
jle 0x52a4d6
mov ebp, dword [esp + 0x1c]
cmp ebp, dword [esp + 0x50]
jle 0x52a4d6
cmp dword [esi + 0x648], 0
je 0x52a050
test eax, eax
je 0x52a050
cmp dword [esi + 0x3a58], 0
je 0x52a4d6
cmp dword [esp + 0x64], 0
je 0x52a4d6
cmp dword [esp + 0x7b4], 0x1193
jge 0x52a4d6
mov ebp, dword [esp + 0x30]
cmp dword [ebp], 0
jne 0x52a4d6
cmp dword [esp + eax*4 + 0x280], 0
jne 0x52a4d6
mov ebp, dword [esp + eax*4 + 0x550]
mov edx, dword [esp + 0x4c]
cmp ebp, edx
jle 0x52a4d2
mov ecx, dword [esp + 0x54]
cmp ecx, edx
mov dword [esp + 0x30], ecx
jg 0x52a0ab
mov dword [esp + 0x30], edx
mov edx, dword [esi + 0x138]
mov ecx, dword [edx + edi*4]
mov edi, dword [esp + eax*4 + 0x2f8]
cmp edi, dword [esp + 0x30]
mov ecx, dword [ecx + 0x2c]
mov ebp, 1
mov dword [esp + 0x14], ebp
jg 0x52a0d4
mov edi, dword [esp + eax*4 + 0x550]
mov edx, dword [edx + edi*4]
imul ecx, ecx, 0x84
add eax, 0xffffffff
mov edx, dword [edx + 0x18]
mov dword [esp + 0x44], edx
mov edx, dword [esi + 0x588c]
mov ecx, dword [ecx + edx + 0x58]
mov dword [esp + 0x30], ecx
js 0x52a163
test ecx, ecx
jle 0x52a163
mov ebp, dword [esi + 0x5884]
mov dword [esp + eax*4 + 0x3e8], ecx
mov ecx, dword [esp + eax*4 + 0x100]
mov edx, ecx
imul edx, edx, 0x68
or dword [edx + ebp + 0x24], 0x10
lea edx, [edx + ebp + 0x24]
mov ebp, dword [esp + 0x7b4]
lea edx, [ecx*8]
sub edx, ecx
mov ecx, dword [esi + 0x5888]
mov dword [ecx + edx*4 + 0xc], ebp
mov edx, dword [esp + 0x30]
mov ecx, dword [esi + 0x588c]
imul edx, edx, 0x84
sub eax, 1
mov ecx, dword [edx + ecx + 0x58]
mov ebp, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x284], 1
mov dword [esp + 0x30], ecx
jns 0x52a0f7
mov eax, dword [esp + 0x2c]
xor ecx, ecx
mov dword [esp + eax*4 + 0x100], ecx
mov dword [esp + eax*4 + 0x190], ecx
test ebp, ebp
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
jne 0x52a19d
mov eax, dword [esp + 0x48]
sub eax, dword [esp + 0x68]
mov ebp, dword [esp + 0x44]
sub eax, dword [esp + 0x58]
add ebp, edx
cmp ebp, eax
jle 0x52a36b
cmp dword [esp + 0x64], 0
je 0x52a36b
cmp dword [esi + 0x648], 0
je 0x52a1c2
test ecx, ecx
je 0x52a1c2
cmp dword [esi + 0x3a58], 0
je 0x52a36b
mov eax, dword [esp + ecx*4 + 0x100]
test eax, eax
je 0x52a1db
cmp dword [esp + ecx*4 + 0x460], 0
jne 0x52a36b
cmp edx, dword [esp + 0x50]
jle 0x52a36b
mov edx, dword [esp + 0x4c]
cmp edi, edx
jle 0x52a36b
cmp dword [esp + 0x7b4], 0x1193
jge 0x52a36b
test eax, eax
jg 0x52ae8f
cmp dword [esp + 0x54], edx
mov ebp, dword [esp + 0x54]
jg 0x52a216
mov ebp, edx
test ecx, ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x30], edi
mov dword [esp + 0x20], ecx
jle 0x52a2e2
mov ecx, dword [esi + 0x138]
mov edx, dword [ecx + edi*4]
mov eax, dword [edx + 0x2c]
test eax, eax
je 0x52a25b
neg eax
push eax
push esi
call fcn.00537420
add esp, 8
test eax, eax
je 0x52a25b
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + eax*4 + 0x2f8]
cmp eax, ebp
jle 0x52a25b
mov edi, eax
mov ecx, dword [esi + 0x138]
mov edx, dword [ecx + edi*4]
cmp dword [edx + 0x2c], 0
je 0x52a2ba
mov eax, dword [esp + 0x2c]
add eax, 0xffffffff
js 0x52a2ba
mov edx, dword [esi + 0x588c]
lea esp, [esp]
mov ebp, dword [ecx + edi*4]
mov ebp, dword [ebp + 0x2c]
imul ebp, ebp, 0x84
cmp dword [edx + ebp + 0x58], 0
je 0x52a2ba
cmp dword [esp + eax*4 + 0x460], 0
je 0x52a2b5
mov edi, dword [esp + eax*4 + 0x2f8]
cmp edi, dword [esp + 0x14]
jg 0x52a2b1
mov edi, dword [esp + eax*4 + 0x550]
mov dword [esp + 0x2c], eax
sub eax, 1
jns 0x52a280
cmp dword [esp + 0x2c], 0
jle 0x52a2e2
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x39c0]
imul eax, eax, 0x98
mov edx, dword [eax + ecx + 0x14]
sub edx, 1
cmp dword [esp + 0x40], edx
jge 0x52afe6
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x39c0]
imul eax, eax, 0x98
mov edx, dword [eax + ecx + 0x14]
sub edx, 1
cmp dword [esp + 0x40], edx
jge 0x52b31c
mov ecx, dword [esp + 0x78]
mov ebp, dword [esp + 0x4c]
xor eax, eax
cmp dword [esp + 0x18], ecx
sete al
push eax
push ebp
push edi
push esi
call fcn.00527620
mov edx, dword [esi + 0x138]
add dword [esp + 0x50], 1
mov edi, eax
mov ecx, dword [edx + edi*4]
lea eax, [edx + edi*4]
mov edx, dword [ecx + 0x18]
add esp, 0x10
cmp edi, ebp
mov dword [esp + 0x44], edx
jle 0x52a35b
mov eax, ecx
or dword [eax + 0x38], 0x20
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0xe0]
add eax, ecx
add dword [esp + 0x84], eax
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x4c], edi
mov dword [esp + 0x1c], edx
xor ebp, ebp
lea eax, [ecx*4]
cmp dword [esp + eax + 0x190], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], eax
jne 0x52a42f
mov eax, dword [esi + 0x138]
mov edx, dword [eax + edi*4]
mov edx, dword [edx + 0x2c]
cmp edx, ebp
lea eax, [eax + edi*4]
mov dword [esp + 0x14], eax
jle 0x52a42f
test ecx, ecx
mov eax, edx
mov dword [esp + 0x2c], 1
jl 0x52a3e0
test eax, eax
jle 0x52a3e0
cmp dword [esp + ecx*4 + 0x190], 0
jne 0x52a3e0
mov ebp, dword [esi + 0x588c]
mov dword [esp + ecx*4 + 0x190], eax
imul eax, eax, 0x84
sub ecx, 1
mov eax, dword [eax + ebp + 0x58]
jns 0x52a3b6
mov eax, dword [esi + 0x588c]
imul edx, edx, 0x84
test dword [eax + edx + 0x40], 0x10000
lea ebp, [ecx + 1]
je 0x52a42f
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov edx, dword [eax + 0x2c]
mov eax, dword [eax + 0x1c]
imul edx, edx, 0x34
mov ecx, dword [esi + 0x5890]
mov dword [edx + ecx + 0x24], eax
mov ecx, dword [esi + 0x138]
mov edx, dword [ecx + edi*4]
mov eax, dword [edx + 0x2c]
mov ecx, dword [esi + 0x5890]
imul eax, eax, 0x34
mov dword [eax + ecx + 0x28], 0
cmp ebp, dword [esp + 0x34]
jg 0x52a8f6
lea esp, [esp]
cmp dword [esp + 0x2c], 0
je 0x52a8f6
mov eax, dword [esp + ebp*4 + 0x190]
mov edx, dword [esi + 0x588c]
imul eax, eax, 0x84
mov ebx, dword [esp + 0x7b4]
lea ecx, [edx + eax]
mov dword [esp + 0x20], eax
mov eax, dword [ecx + 4]
lea edx, [eax*8]
sub edx, eax
mov eax, dword [esi + 0x5888]
cmp dword [eax + edx*4 + 8], ebx
jne 0x52a487
mov dword [ecx + 0x34], edi
mov ebx, dword [esp + ebp*4 + 0x190]
mov ecx, dword [esi + 0x588c]
imul ebx, ebx, 0x34
mov edx, dword [esp + 0x20]
mov dword [ecx + edx + 0x38], edi
mov eax, dword [esi + 0x5890]
and dword [ebx + eax + 0x10], 0xfffffffe
lea eax, [ebx + eax + 0x10]
xor eax, eax
cmp ebp, eax
mov dword [esp + ebp*4 + 0x208], eax
mov dword [esp + ebp*4 + 0x3e8], eax
jne 0x52a5a5
mov dword [esp + 0x4d8], eax
jmp 0x52a5ce
mov edx, dword [esp + 0x14]
add dword [esp + 0x28], ecx
test eax, eax
mov dword [esp + 0x1c], edx
jle 0x52a4e9
add dword [esp + eax*4 + 0x204], ecx
cmp dword [esp + eax*4 + 0x280], 0
lea ebp, [esp + eax*4 + 0x280]
mov dword [esp + 0x3c], ebp
je 0x52a587
test eax, eax
je 0x52b181
mov edx, dword [esi + 0x138]
mov eax, dword [edx + edi*4 + 4]
mov eax, dword [eax + 0x2c]
mov edx, dword [esi + 0x588c]
mov ecx, eax
imul ecx, ecx, 0x84
add ecx, edx
test eax, eax
mov edx, dword [ecx + 4]
jle 0x52a57a
mov eax, dword [esp + 0x2c]
cmp dword [ecx + 0x54], eax
jne 0x52a57a
push edx
push esi
call fcn.00537420
add esp, 8
test eax, eax
je 0x52a57a
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + ecx*4 + 0x2f8]
cmp eax, edi
jg 0x52a57a
mov edx, dword [esp + 0x7b4]
jmp 0x52a560
mov ecx, dword [esi + 0x138]
mov ebp, dword [ecx + eax*4]
add eax, 1
cmp eax, edi
lea ecx, [edx + 1]
mov dword [ebp + 0x34], ecx
jle 0x52a560
mov ebp, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x9c], edx
mov eax, edx
xor ecx, ecx
mov dword [esp + eax*4 + 0x100], ecx
mov dword [esp + eax*4 + 0x190], ecx
mov eax, dword [esp + 0x30]
mov dword [ebp], ecx
mov dword [eax], ecx
jmp 0x52ae7b
mov ecx, dword [esp + ebp*4 + 0xfc]
mov edx, dword [esi + 0x5884]
imul ecx, ecx, 0x68
mov ecx, dword [ecx + edx + 0x50]
add ecx, dword [esp + ebp*4 + 0x36c]
add ecx, dword [esp + ebp*4 + 0x4d4]
mov dword [esp + ebp*4 + 0x4d8], ecx
cmp dword [esp + ebp*4 + 0x100], eax
mov edx, dword [esi + 0x5890]
mov dword [ebx + edx + 4], eax
mov ecx, dword [esi + 0x5890]
mov dword [ebx + ecx], eax
jne 0x52a60e
mov edx, dword [esi + 0x5b84]
mov eax, dword [esp + 0x1c]
neg edx
sbb edx, edx
not edx
and edx, dword [esp + 0x50]
sub eax, edx
add eax, dword [esp + 0xe4]
mov dword [esp + ebp*4 + 0x734], eax
mov ecx, dword [esi + 0x588c]
mov edx, dword [esp + 0x20]
mov eax, dword [ecx + edx + 0x18]
mov ecx, dword [esp + 0x7b4]
push 0
push ecx
lea edx, [esp + 0x104]
mov dword [esp + 0x104], eax
mov eax, dword [esp + ebp*4 + 0x198]
push edx
push eax
push esi
call fcn.004bdac0
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x7c8]
push 0
push eax
mov eax, dword [esp + ebp*4 + 0x1ac]
lea ecx, [esp + 0x118]
push ecx
push eax
push esi
call fcn.004bdbc0
mov edx, dword [esi + 0x5890]
and dword [ebx + edx + 0x10], 0xfffffffd
mov ecx, dword [esi + 0x514]
add esp, 0x28
lea ebx, [ebx + edx + 0x10]
mov edx, dword [esp + 0x14]
push 0x5a0
push ecx
add eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
add dword [esp + 0x1c], eax
add dword [esp + 0x28], eax
cmp dword [esp + ebp*4 + 0x100], 0
mov dword [esp + ebp*4 + 0x208], eax
mov dword [esp + ebp*4 + 0x6bc], 0
jne 0x52a8ac
test ebp, ebp
mov eax, dword [esi + 0x588c]
mov ecx, dword [esp + 0x20]
mov ebx, dword [eax + ecx + 4]
mov dword [esp + 0x14], ebx
mov dword [esp + ebp*4 + 0x100], ebx
jle 0x52a6e1
push ebx
push esi
call fcn.00535590
add esp, 8
cmp dword [esp + ebp*4 + 0x644], 0
jne 0x52a72a
mov eax, dword [esi + 0x5884]
mov edx, ebx
imul edx, edx, 0x68
and dword [eax + edx + 0x24], 0xffffffef
mov ecx, dword [esi + 0x5888]
lea eax, [eax + edx + 0x24]
mov edx, dword [esp + 0x7b4]
lea eax, [ebx*8]
sub eax, ebx
add eax, eax
add eax, eax
mov dword [ecx + eax + 8], edx
mov ecx, dword [esi + 0x5888]
mov dword [eax + ecx], 0
mov ebx, dword [esp + 0x14]
mov edx, dword [esi + 0x5888]
lea eax, [ebx*8]
sub eax, ebx
imul ebx, ebx, 0x68
add eax, eax
add eax, eax
mov dword [edx + eax + 4], 0
mov ecx, dword [esi + 0x5888]
mov edx, dword [esp + 0x7b4]
mov dword [ecx + eax + 0xc], edx
mov eax, dword [esi + 0x5884]
add eax, ebx
test dword [eax + 0x24], 0x2004
jne 0x52a7d7
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 0x39c0]
imul ecx, ecx, 0x98
cmp dword [ecx + edx + 0x14], 1
jg 0x52a7d7
cmp byte [esp + 0x13], 0
jne 0x52a7d7
cmp dword [eax + 0x4c], 0
jl 0x52a7d7
push 0
push edi
push esi
call fcn.00526ec0
add esp, 0xc
test eax, eax
jne 0x52a7d7
test ebp, ebp
jle 0x52a7d3
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.00537420
add esp, 8
test eax, eax
jne 0x52a7d7
mov ecx, dword [esp + 0x14]
push ecx
push esi
call fcn.00537480
add esp, 8
test eax, eax
jne 0x52a7d7
cmp dword [esp + ebp*4 + 0x45c], eax
jne 0x52a7d7
xor eax, eax
jmp 0x52a7dc
mov eax, 1
cmp edi, dword [esp + 0x4c]
mov dword [esp + ebp*4 + 0x460], eax
jne 0x52a7f4
mov dword [esp + ebp*4 + 0x460], 0
cmp dword [esp + ebp*4 + 0x460], 0
je 0x52a812
mov edx, dword [esi + 0x5884]
or dword [ebx + edx + 0x24], 0x40000
lea eax, [ebx + edx + 0x24]
jmp 0x52a824
mov eax, dword [esi + 0x5884]
and dword [ebx + eax + 0x24], 0xfffbffff
lea eax, [ebx + eax + 0x24]
mov ecx, dword [esi + 0x5884]
mov eax, dword [ebx + ecx + 0x4c]
test eax, eax
mov edx, dword [esi + 0x514]
push 0x5a0
push edx
jge 0x52a840
neg eax
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, dword [esi + 0x5884]
mov dword [ebx + ecx + 0x14], eax
mov eax, dword [esp + 0x14]
mov edx, dword [esi + 0x5884]
push eax
push esi
mov dword [ebx + edx + 0x54], 0
call fcn.00537420
add esp, 8
test eax, eax
jne 0x52a883
mov ecx, dword [esp + 0x14]
mov dword [esp + ebp*4 + 0x5c8], ecx
mov dword [esp + ebp*4 + 0x2f8], edi
mov edx, dword [esi + 0x5884]
test byte [ebx + edx + 0x24], 4
mov dword [esp + ebp*4 + 0x550], edi
je 0x52a8a1
mov dword [esp + 0x54], 0xffffffff
jmp 0x52a8ac
cmp dword [esp + 0x54], 0xffffffff
jne 0x52a8ac
mov dword [esp + 0x54], edi
mov ecx, dword [esi + 0x588c]
mov eax, dword [esp + 0x20]
mov eax, dword [ecx + eax + 0xc]
test eax, eax
jle 0x52a8e2
mov edx, dword [esi + 0x510]
imul eax, eax, 0x84
mov eax, dword [eax + ecx + 0x14]
push 0x5a0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
add dword [esp + ebp*4 + 0x370], eax
mov ebx, dword [esp + 0xf4]
add ebp, 1
cmp ebp, dword [esp + 0x34]
jle 0x52a440
mov edx, dword [esi + 0x138]
mov eax, dword [edx + edi*4]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x84]
mov dword [esp + 0x2c], ecx
mov ecx, dword [eax + 0x24]
mov dword [eax + 0x28], edx
cmp dword [esi + 0x5b84], 0
mov eax, dword [esp + 0xe4]
mov dword [esp + 0xe8], ecx
mov ecx, dword [esp + 0x1c]
lea ebp, [ecx + eax]
jne 0x52a93f
cmp dword [esi + 0x654], 0
jne 0x52a93f
sub ebp, dword [esp + 0x50]
mov edx, dword [esi + 0x138]
mov eax, dword [edx + edi*4]
mov dword [eax + 0x24], ebp
mov ecx, dword [esi + 0x138]
mov eax, dword [ecx + edi*4]
mov edx, dword [eax + 0x2c]
test edx, edx
mov ecx, dword [esp + 0x30]
je 0x52ab11
cmp edi, dword [esp + ecx + 0x2f8]
jne 0x52ab11
cmp dword [eax + 0x30], 0
jne 0x52aa4c
mov edx, dword [esp + 0x18]
push edx
push edi
push esi
call fcn.004be970
mov ecx, dword [esi + 0x138]
mov edx, dword [ecx + edi*4]
mov dword [esp + 0x20], eax
add eax, ebp
mov ebp, dword [esp + 0x40]
add esp, 0xc
test ebp, ebp
mov dword [edx + 0x24], eax
jl 0x52ab4d
jmp 0x52a9b0
cmp edi, dword [esp + ebp*4 + 0x2f8]
jne 0x52ab4d
mov ecx, dword [esp + ebp*4 + 0x100]
mov eax, dword [esp + 0x14]
imul ecx, ecx, 0x68
mov edx, dword [esi + 0x5884]
add dword [esp + ebp*4 + 0x734], eax
test ebp, ebp
mov dword [edx + ecx + 0x10], eax
jne 0x52a9e9
mov eax, dword [esp + 0x94]
jmp 0x52aa1b
mov eax, dword [esp + ebp*4 + 0x18c]
mov ecx, dword [esi + 0x588c]
imul eax, eax, 0x84
mov edx, dword [esi + 0x510]
add eax, ecx
mov ecx, dword [eax + 0x2c]
push 0x5a0
push edx
mov edx, dword [eax + 0x14]
add ecx, ecx
sub edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [esp + ebp*4 + 0x108]
push eax
push edi
push esi
call fcn.00513b00
add esp, 0x14
sub ebp, 1
mov dword [esp + ebp*4 + 0x374], 0
jns 0x52a9b0
jmp 0x52ab4d
mov dword [eax + 0x24], ebp
mov ebp, dword [esp + 0x34]
test ebp, ebp
mov dword [esp + 0x14], 0
jl 0x52ab4d
cmp edi, dword [esp + ebp*4 + 0x2f8]
jne 0x52ab4d
mov ecx, dword [esp + ebp*4 + 0x100]
mov edx, dword [esi + 0x5884]
imul ecx, ecx, 0x68
test ebp, ebp
mov dword [edx + ecx + 0x10], 0
push 0x5a0
jne 0x52aab6
mov ecx, dword [esi + 0x138]
mov eax, dword [esi + 0x510]
mov edx, dword [ecx + edi*4]
mov ecx, dword [esi + 0x72c]
push eax
mov eax, dword [edx + 0x30]
imul eax, eax, 0x98
mov edx, dword [eax + ecx + 0x10]
jmp 0x52aadc
mov eax, dword [esp + ebp*4 + 0x190]
mov ecx, dword [esi + 0x588c]
imul eax, eax, 0x84
mov edx, dword [esi + 0x510]
add eax, ecx
mov ecx, dword [eax + 0x2c]
push edx
mov edx, dword [eax + 0x14]
add ecx, ecx
sub edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [esp + ebp*4 + 0x108]
push eax
push edi
push esi
call fcn.00513b00
add esp, 0x14
sub ebp, 1
mov dword [esp + ebp*4 + 0x374], 0
jns 0x52aa63
jmp 0x52ab4d
test edx, edx
mov dword [esp + 0x14], 0
je 0x52ab4d
mov eax, dword [esp + ecx + 0x5c8]
mov ecx, dword [esp + ecx + 0x100]
imul eax, eax, 0x68
mov edx, dword [esi + 0x5884]
imul ecx, ecx, 0x68
mov ebp, dword [edx + eax + 0x50]
mov dword [edx + ecx + 0x50], ebp
mov edx, dword [esi + 0x5884]
mov eax, dword [edx + eax + 0x20]
mov dword [edx + ecx + 0x20], eax
mov ecx, dword [esi + 0x138]
mov edx, dword [ecx + edi*4]
cmp dword [edx + 0x2c], 0
lea eax, [ecx + edi*4]
je 0x52ab8a
mov ecx, dword [esp + 0x30]
mov ebp, dword [esi + 0x5884]
mov eax, edx
mov edx, dword [esp + ecx + 0x100]
imul edx, edx, 0x68
mov edx, dword [edx + ebp + 0x50]
add edx, dword [esp + ecx + 0x4d8]
add edx, dword [esp + ecx + 0x370]
add dword [eax + 0x28], edx
mov eax, dword [esi + 0x138]
mov ecx, dword [eax + edi*4]
cmp dword [ecx + 0x30], 0
mov ebp, dword [esp + 0x7b4]
jne 0x52ac45
mov edx, dword [esp + 0x18]
push ebp
push 0
push edx
push edi
push esi
call fcn.004be9c0
add esp, 0x14
test eax, eax
mov dword [esp + 0x20], eax
jle 0x52ac4d
cmp dword [esp + 0x3c], 0
je 0x52ac4d
mov eax, dword [esp + 0x48]
sub eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x20]
sub eax, dword [esp + 0x58]
add edx, ecx
add edx, dword [esp + 0x1c]
cmp edx, eax
jle 0x52ac4d
cmp dword [esp + 0x64], 0
je 0x52ac4d
lea ecx, [edi - 1]
cmp ecx, ebx
jle 0x52ac33
lea esp, [esp]
mov eax, dword [esi + 0x138]
mov edx, dword [eax + edi*4 - 4]
mov eax, dword [edx + 0x30]
test eax, eax
jle 0x52ac33
mov edx, dword [esi + 0x72c]
imul eax, eax, 0x98
and dword [eax + edx + 0x28], 0xffff7fff
lea eax, [eax + edx + 0x28]
sub ecx, 1
sub edi, 1
cmp ecx, ebx
jg 0x52ac00
mov ebp, 1
mov dword [esp + 0x3c], 0
jmp 0x52a177
mov dword [esp + 0x20], 0
mov ecx, dword [esi + 0x138]
mov eax, dword [ecx + edi*4]
mov edx, dword [esp + 0x20]
add dword [eax + 0x24], edx
mov eax, dword [esi + 0x138]
mov ecx, dword [eax + edi*4]
cmp dword [ecx + 0x30], 0
lea eax, [eax + edi*4]
jne 0x52acef
cmp dword [esp + 0x80], 0
je 0x52acef
mov edx, dword [esp + 0xe8]
cmp dword [ecx + 0x24], edx
je 0x52acef
cmp edi, dword [esp + 0x74]
jle 0x52acef
xor ecx, ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x38], ecx
mov edx, dword [eax]
cmp dword [edx + 0x10], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x64], ecx
je 0x52acbb
mov eax, edx
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x70]
mov edx, dword [eax + 0x74]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x64], edx
push 0
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x38]
push ecx
push 0
push edi
push esi
call fcn.004bf700
mov edx, dword [esp + 0x54]
add esp, 0x18
cmp dword [esp + 0x30], edx
jne 0x52b38e
mov eax, dword [esp + 0x64]
cmp dword [esp + 0x38], eax
jne 0x52b38e
test dword [esp + 0x90], 0x2000
je 0x52ad44
cmp dword [esp + 0x8c], 0
jne 0x52ad44
mov ecx, dword [esi + 0x138]
mov edx, dword [ecx + edi*4]
cmp dword [edx + 0x30], 0
jne 0x52ad44
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x44]
lea edx, [eax + ecx]
mov eax, dword [esp + 0x1c]
add edx, eax
add edx, dword [esp + 0x14]
cmp edx, dword [esp + 0x17c]
jle 0x52ad44
mov dword [esp + 0x8c], eax
lea eax, [edi - 1]
mov dword [esp + 0xac], eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x44]
lea eax, [ecx + edx]
mov ecx, dword [esp + 0x14]
lea edx, [eax + ecx]
add dword [esp + 0x1c], edx
add eax, ecx
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + ecx*4 + 0x208]
add dword [esp + 0x28], eax
add edx, dword [esp + 0x20]
mov eax, dword [esp + 0x44]
lea ecx, [esp + ecx*4 + 0x208]
add eax, edx
mov dword [ecx], eax
mov ecx, dword [esi + 0x138]
mov dword [esp + 0xe8], eax
mov eax, dword [ecx + edi*4]
cmp dword [eax + 0x2c], 0
je 0x52adea
test dword [eax + 0x38], 0x4000
je 0x52adea
mov edx, dword [esi + 0x514]
push 0x5a0
push edx
push 0x3c
call dword [sym.imp.KERNEL32.dll_MulDiv]
push edi
push esi
mov dword [esp + 0x98], eax
call fcn.005269b0
mov ecx, dword [esp + 0x98]
add ecx, eax
mov eax, dword [esp + 0x3c]
sub ecx, dword [esp + eax*4 + 0x73c]
lea eax, [esp + eax*4 + 0x6c4]
add esp, 8
cmp ecx, dword [eax]
mov dword [esp + 0x90], ecx
jle 0x52adea
mov dword [eax], ecx
mov edx, dword [esi + 0x138]
mov eax, dword [edx + edi*4]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x52ae60
test byte [eax], 0x10
je 0x52ae60
mov eax, dword [esp + 0x34]
cmp dword [esp + eax*4 + 0x190], 0
lea ecx, [esp + eax*4 + 0x190]
jle 0x52ae60
cmp dword [esp + eax*4 + 0x100], 0
jle 0x52ae60
mov eax, dword [esp + 0xe8]
lea edx, [esp + 0x98]
push edx
push eax
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x44]
lea edx, [esp + eax*4 + 0x6cc]
push edx
mov edx, dword [esp + eax*4 + 0x658]
push ecx
mov ecx, dword [esp + eax*4 + 0x298]
push ecx
push edx
push ebp
push edi
push esi
call fcn.00527360
add esp, 0x2c
push ebp
push edi
push esi
call fcn.00525c10
mov eax, dword [esi + 0x138]
mov ecx, dword [eax + edi*4]
add esp, 0xc
mov dword [esp + 0x38], edi
mov dword [ecx + 0x34], ebp
add edi, 1
cmp edi, dword [esi + 0x5e4]
jl 0x528b90
jmp 0x52b181
test ecx, ecx
mov eax, dword [esi + 0x138]
mov edx, dword [eax + edi*4]
mov ebp, dword [edx + 0x2c]
mov dword [esp + 0x14], ecx
jl 0x52af64
jmp 0x52aeb4
mov ecx, dword [esp + 0x2c]
test ebp, ebp
jle 0x52af64
cmp dword [esp + 0x14], ecx
jne 0x52aee5
push 0x10
push edi
push esi
call fcn.004e08a0
add esp, 0xc
test eax, eax
je 0x52aee5
push 0x20
lea eax, [edi + 1]
push eax
push esi
call fcn.004e08a0
add esp, 0xc
test eax, eax
je 0x52aef6
mov eax, dword [esp + 0x14]
add eax, eax
add eax, eax
mov dword [esp + eax + 0x3e8], ebp
jmp 0x52af09
mov eax, dword [esp + 0x14]
add eax, eax
add eax, eax
mov dword [esp + eax + 0x3e8], 0
mov edx, dword [esi + 0x5884]
imul ebp, ebp, 0x84
mov dword [esp + eax + 0x280], 1
mov eax, dword [esp + eax + 0x100]
mov ecx, eax
imul ecx, ecx, 0x68
or dword [edx + ecx + 0x24], 0x10
lea ecx, [edx + ecx + 0x24]
mov edx, dword [esi + 0x5888]
lea ecx, [eax*8]
sub ecx, eax
sub dword [esp + 0x14], 1
mov eax, dword [esp + 0x7b4]
mov dword [edx + ecx*4 + 0xc], eax
mov ecx, dword [esi + 0x588c]
mov ebp, dword [ecx + ebp + 0x58]
jns 0x52aeb0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + eax*4 + 0x208]
mov ebp, dword [esp + 0x7b4]
lea edx, [esp + 0x98]
push edx
push ecx
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + eax*4 + 0x6cc]
push edx
mov edx, dword [esp + eax*4 + 0x294]
lea ecx, [esp + eax*4 + 0x1a4]
mov eax, dword [esp + eax*4 + 0x658]
push ecx
push edx
push eax
push ebp
push edi
push esi
call fcn.00527360
mov ecx, dword [esi + 0x138]
mov eax, dword [ecx + edi*4]
mov edx, dword [eax + 0x2c]
lea ecx, [ecx + edi*4]
add esp, 0x2c
cmp dword [eax + 0x34], ebp
mov dword [esp + 0x6c], edx
mov dword [esp + 0xdc], edi
jg 0x52ae7b
mov ecx, eax
mov eax, ebp
add eax, 1
mov dword [ecx + 0x34], eax
jmp 0x52ae7b
mov edx, dword [esi + 0x138]
mov eax, dword [esp + 0x30]
mov ecx, dword [edx + eax*4]
mov ebp, dword [ecx + 0x2c]
mov edx, eax
push edx
push esi
call fcn.005132c0
imul ebp, ebp, 0x84
mov ecx, dword [esp + 0x28]
mov edx, dword [esi + 0x588c]
mov dword [esp + 0xa4], ecx
mov ecx, dword [edx + ebp + 0x58]
mov ebp, dword [esp + 0x7bc]
add esp, 8
add eax, 0xffffffff
mov dword [esp + 0x3c], ecx
js 0x52b098
lea ecx, [ecx]
test ecx, ecx
jle 0x52b098
mov ebp, dword [esi + 0x5884]
mov dword [esp + eax*4 + 0x3e8], ecx
mov ecx, dword [esp + eax*4 + 0x100]
mov edx, ecx
imul edx, edx, 0x68
or dword [edx + ebp + 0x24], 0x10
lea edx, [edx + ebp + 0x24]
mov ebp, dword [esp + 0x7b4]
lea edx, [ecx*8]
sub edx, ecx
mov ecx, dword [esi + 0x5888]
mov dword [ecx + edx*4 + 0xc], ebp
mov edx, dword [esp + 0x3c]
mov ecx, dword [esi + 0x588c]
imul edx, edx, 0x84
sub eax, 1
mov ecx, dword [edx + ecx + 0x58]
mov dword [esp + eax*4 + 0x284], 1
mov dword [esp + 0x3c], ecx
jns 0x52b030
mov edx, dword [esi + 0x138]
mov eax, dword [edx + edi*4]
cmp dword [eax + 0x34], ebp
jg 0x52b0ac
lea ecx, [ebp + 1]
mov dword [eax + 0x34], ecx
cmp edi, dword [esp + 0x30]
jge 0x52ae7b
cmp edi, dword [esi + 0x5e4]
jge 0x52b0fd
mov edi, edi
mov eax, dword [esi + 0x138]
mov eax, dword [eax + edi*4]
cmp dword [eax + 0x34], ebp
jg 0x52b0d4
lea ecx, [ebp + 1]
mov dword [eax + 0x34], ecx
push edi
push esi
call fcn.005132c0
add esp, 8
test eax, eax
jne 0x52b0f2
push 0x10
push edi
push esi
call fcn.004e08a0
add esp, 0xc
test eax, eax
jne 0x52b0fd
add edi, 1
cmp edi, dword [esi + 0x5e4]
jl 0x52b0c0
mov dword [esp + 0x9c], 0
jmp 0x52ae7b
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x4c]
xor eax, eax
cmp dword [esp + 0x18], ecx
sete al
push eax
push edx
push edi
push esi
call fcn.00527620
mov edi, eax
mov eax, dword [esp + 0x7c4]
add eax, 1
push eax
push esi
mov dword [esp + 0xcc], 1
call fcn.005374e0
mov eax, dword [esi + 0x3a10]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x50]
mov dword [eax + ecx + 4], edx
mov eax, dword [esi + 0x3a10]
mov dword [eax + ecx + 0x48], edi
mov edx, dword [esi + 0x3a10]
and dword [edx + ecx + 0x70], 0xfffffffe
lea eax, [edx + ecx + 0x70]
mov eax, dword [esi + 0x3a10]
add esp, 0x18
add eax, ecx
mov ecx, dword [eax + 0x2c]
mov dword [eax + 0x74], ecx
mov eax, dword [esp + 0x48]
sub eax, dword [esp + 0x68]
mov ecx, dword [esi + 0x3a10]
sub eax, dword [esp + 0x58]
mov ebp, dword [esp + 0x24]
sub eax, dword [esp + 0x50]
cmp dword [esp + 0xd4], 0
mov dword [ecx + ebp + 0x1c], eax
jne 0x52b3a9
mov dword [esp + 0xa4], 0
jmp 0x52b3ca
mov edx, dword [esi + 0x138]
mov ecx, dword [edx + edi*4]
add eax, 1
mov dword [ecx + 0x34], eax
mov ecx, dword [esp + 0x38]
sub ecx, 1
jmp 0x52b1ee
mov edx, dword [esi + 0x138]
mov eax, dword [esp + 0x7b4]
mov ecx, dword [edx + edi*4]
add eax, 1
mov dword [ecx + 0x34], eax
lea ecx, [edi - 1]
mov edx, dword [esi + 0x3a10]
mov eax, dword [esp + 0x24]
mov dword [edx + eax + 0x48], edi
mov edx, dword [esi + 0x3a10]
mov dword [edx + eax + 4], ecx
mov dword [esp + 0x38], ecx
mov ecx, dword [esi + 0x3a10]
and dword [ecx + eax + 0x70], 0xfffffffe
lea eax, [ecx + eax + 0x70]
jmp 0x52b181
mov edx, dword [esi + 0x3a10]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x38]
mov dword [edx + ebp + 0x48], edi
mov eax, dword [esi + 0x3a10]
mov dword [eax + ebp + 4], ecx
mov edx, dword [esi + 0x3a10]
and dword [edx + ebp + 0x70], 0xfffffffe
lea eax, [edx + ebp + 0x70]
mov eax, dword [esp + 0x7b4]
add eax, 2
cmp dword [esi + 0x39e8], eax
jge 0x52b261
mov dword [esi + 0x39e8], eax
mov eax, dword [esp + 0x7b4]
push eax
push eax
push 0
push esi
call fcn.005517e0
mov eax, dword [esi + 0x3a10]
mov ecx, dword [esi + 0x5e4]
mov dword [eax + ebp + 0x48], ecx
mov edx, dword [esi + 0x5e4]
mov eax, dword [esi + 0x3a10]
sub edx, 1
mov dword [eax + ebp + 4], edx
mov ecx, dword [esi + 0x3a10]
and dword [ecx + ebp + 0x70], 0xfffffffe
lea ebp, [ecx + ebp + 0x70]
lea edx, [ebx - 1]
add esp, 0x10
mov dword [esp + 0x74], edi
mov edi, dword [esp + 0x7b4]
mov dword [esi + 0xb70], edx
mov dword [esp + 0x80], 1
xor ebp, ebp
jmp 0x527ea0
mov eax, dword [esp + 0x7b4]
add eax, 1
push eax
push esi
call fcn.005374e0
mov ecx, dword [esi + 0x3a10]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x40]
mov dword [ecx + eax + 4], edx
mov edx, dword [esi + 0x3a10]
lea ecx, [edi + 1]
mov dword [edx + eax + 0x48], ecx
mov ecx, dword [esi + 0x3a10]
or dword [ecx + eax + 0x70], 1
mov edx, dword [esi + 0x3a10]
lea ecx, [ecx + eax + 0x70]
add esp, 8
add eax, edx
jmp 0x52b17b
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x4c]
xor edx, edx
cmp dword [esp + 0x18], eax
sete dl
push edx
push ecx
push edi
push esi
call fcn.00527620
mov edi, eax
mov eax, dword [esp + 0x7c4]
add eax, 1
push eax
push esi
mov dword [esp + 0xcc], 1
call fcn.005374e0
mov edx, dword [esi + 0x3a10]
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x50]
mov dword [edx + ecx + 4], eax
mov edx, dword [esi + 0x3a10]
mov dword [edx + ecx + 0x48], edi
mov eax, dword [esi + 0x3a10]
lea eax, [eax + ecx + 0x70]
add esp, 0x18
and dword [eax], 0xfffffffe
mov edx, dword [esi + 0x3a10]
lea eax, [edx + ecx]
jmp 0x52b17b
lea edx, [ebx - 1]
mov dword [esp + 0x74], edi
mov edi, dword [esp + 0x7b4]
mov dword [esi + 0xb70], edx
xor ebp, ebp
jmp 0x527ea0
mov ecx, dword [esp + 0xd4]
lea edx, [esp + 0x640]
push edx
lea eax, [esp + 0xa8]
push eax
push ecx
push esi
call fcn.004f88e0
add esp, 0x10
cmp edi, dword [esp + 0xa4]
jg 0x52b43c
mov dword [esp + 0x3c], 1
mov ebp, edi
lea ecx, [ecx]
mov edx, dword [esi + 0x138]
mov eax, dword [edx + ebp*4]
mov ecx, dword [eax + 0x34]
cmp ecx, dword [esp + 0x7b4]
jne 0x52b42c
test dword [eax + 0x38], 0x4000
je 0x52b42c
push ebp
push esi
call fcn.005268f0
add esp, 8
cmp dword [esp + 0x3c], 0
je 0x52b424
mov eax, dword [esp + 0x7b4]
add eax, 1
push eax
push ebp
push esi
call fcn.00526810
add esp, 0xc
mov dword [esp + 0x3c], 0
add ebp, 1
cmp ebp, dword [esp + 0xa4]
jle 0x52b3e0
mov ebp, dword [esp + 0x24]
cmp dword [esp + 0xb4], 0
mov eax, dword [esp + 0x38]
je 0x52b4c3
cmp edi, eax
jg 0x52b4c3
mov edx, dword [esp + 0x7b4]
mov ebp, edi
jmp 0x52b460
mov eax, dword [esi + 0x138]
mov eax, dword [eax + ebp*4]
cmp dword [eax + 0x34], edx
jne 0x52b4ad
lea ecx, [edx + 1]
mov dword [eax + 0x34], ecx
mov eax, dword [esi + 0x138]
mov eax, dword [eax + ebp*4]
mov eax, dword [eax + 0x30]
test eax, eax
je 0x52b4ad
mov edx, dword [esi + 0x72c]
imul eax, eax, 0x98
and dword [eax + edx + 0x28], 0xffff7fff
lea edx, [eax + edx + 0x28]
mov edx, dword [esi + 0x72c]
mov dword [eax + edx + 0x24], ecx
mov edx, dword [esp + 0x7b4]
add ebp, 1
cmp ebp, dword [esp + 0x38]
jle 0x52b460
mov ebp, dword [esp + 0x24]
add edi, 0xffffffff
mov dword [esp + 0x38], edi
mov eax, edi
mov ecx, dword [esi + 0x5e4]
cmp eax, ecx
jl 0x52b4d0
lea eax, [ecx - 1]
mov ecx, dword [esi + 0x3a10]
mov edi, dword [esp + 0x7b4]
cmp edi, 1
mov dword [ecx + ebp + 4], eax
mov eax, dword [esi + 0x3a10]
mov edx, dword [eax + 4]
mov dword [esp + 0x54], edx
jl 0x52b52f
mov ecx, 0x48
jmp 0x52b500
mov edx, dword [esi + 0x5e4]
cmp dword [ecx + eax + 4], edx
jl 0x52b513
add edx, 0xffffffff
mov dword [ecx + eax + 4], edx
mov eax, dword [esi + 0x3a10]
mov edx, dword [ecx + eax + 4]
cmp edx, dword [esp + 0x54]
jle 0x52b527
mov dword [esp + 0x54], edx
add ecx, 0x48
sub edi, 1
jne 0x52b500
mov eax, dword [esi + 0x3a10]
lea edx, [eax + ebp]
mov eax, dword [edx]
add eax, 1
cmp eax, dword [esp + 0x54]
jg 0x52b56a
mov ecx, dword [esi + 0x138]
mov edi, dword [esp + 0x7b4]
lea ecx, [ecx + eax*4]
mov ebp, dword [ecx]
cmp dword [ebp + 0x34], edi
jg 0x52b566
add eax, 1
add ecx, 4
cmp eax, dword [esp + 0x54]
jle 0x52b553
mov ebp, dword [esp + 0x24]
mov ecx, dword [esi + 0x5e4]
cmp eax, ecx
jle 0x52b576
mov eax, ecx
mov dword [edx + 0x48], eax
mov edi, dword [esi + 0x5e4]
xor edx, edx
cmp eax, edi
sete dl
mov eax, edx
test eax, eax
mov dword [esi + 0x3a08], eax
je 0x52b5c9
mov eax, dword [esp + 0x7b4]
mov ecx, dword [esi + 0x3a10]
add eax, 1
mov dword [esi + 0x39e8], eax
lea eax, [eax + eax*8]
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [esi + 0x39e8]
lea edx, [eax + eax*8]
mov eax, dword [esi + 0x3a10]
and dword [eax + edx*8 + 0x28], 0xfffffffe
lea eax, [eax + edx*8 + 0x28]
jmp 0x52b60b
mov eax, dword [esp + 0xc0]
test ax, ax
je 0x52b5da
movsx eax, ax
jmp 0x52b5e8
mov ecx, dword [esi + 0x3a10]
movsx eax, word [ecx + ebp + 0x10]
add eax, 1
mov edx, dword [esi + 0x3a10]
mov word [edx + ebp + 0x58], ax
mov eax, dword [esp + 0x7b4]
add eax, 2
cmp eax, dword [esi + 0x39e8]
jle 0x52b60b
mov dword [esi + 0x39e8], eax
mov eax, dword [esi + 0x3a10]
lea edi, [eax + ebp]
mov eax, dword [edi]
cmp eax, dword [edi + 4]
jg 0x52b672
mov ecx, dword [esi + 0x138]
lea ecx, [ecx + eax*4]
mov edx, dword [ecx]
cmp dword [edx + 0x2c], 0
je 0x52b63c
mov ebp, dword [esp + 0x7b4]
cmp dword [edx + 0x34], ebp
mov ebp, dword [esp + 0x24]
je 0x52b64e
mov edx, dword [esi + 0x3a10]
add eax, 1
add ecx, 4
cmp eax, dword [edx + ebp + 4]
jle 0x52b624
cmp eax, dword [edi + 4]
jg 0x52b672
mov ecx, dword [esi + 0x138]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx + 0x2c]
mov ecx, dword [esi + 0x588c]
imul eax, eax, 0x84
mov edx, dword [eax + ecx + 4]
mov dword [edi + 8], edx
mov eax, dword [esi + 0x3a10]
lea edi, [eax + ebp]
mov eax, dword [edi + 4]
cmp eax, dword [edi]
jl 0x52b6dc
mov ecx, dword [esi + 0x138]
lea ecx, [ecx + eax*4]
jmp 0x52b690
mov edx, dword [ecx]
cmp dword [edx + 0x2c], 0
je 0x52b6a8
mov ebp, dword [esp + 0x7b4]
cmp dword [edx + 0x34], ebp
mov ebp, dword [esp + 0x24]
je 0x52b6b9
mov edx, dword [esi + 0x3a10]
sub eax, 1
sub ecx, 4
cmp eax, dword [edx + ebp]
jge 0x52b690
cmp eax, dword [edi]
jl 0x52b6dc
mov ecx, dword [esi + 0x138]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx + 0x2c]
mov ecx, dword [esi + 0x588c]
imul eax, eax, 0x84
mov edx, dword [eax + ecx + 4]
mov dword [edi + 0xc], edx
mov eax, dword [esi + 0x3a10]
mov ecx, dword [eax + ebp]
add eax, ebp
cmp ecx, dword [eax + 4]
jg 0x52b734
mov edi, dword [esp + 0x7b4]
mov edx, dword [esi + 0x138]
mov edx, dword [edx + ecx*4]
mov eax, dword [edx + 0x2c]
test eax, eax
je 0x52b725
cmp dword [edx + 0x34], edi
jne 0x52b725
mov edx, dword [esi + 0x588c]
imul eax, eax, 0x84
mov eax, dword [edx + eax + 4]
mov edx, dword [esi + 0x5884]
imul eax, eax, 0x68
mov dword [eax + edx + 0x58], edi
mov eax, dword [esi + 0x3a10]
add ecx, 1
cmp ecx, dword [eax + ebp + 4]
jle 0x52b6f3
mov eax, dword [esp + 0x54]
lea ecx, [eax + 1]
cmp ecx, dword [esi + 0x5e4]
jge 0x52b783
mov edx, dword [esi + 0x138]
mov eax, dword [edx + eax*4 + 4]
test dword [eax + 0x38], 0x4000
je 0x52b783
cmp dword [eax + 0x30], 0
jne 0x52b783
cmp dword [eax + 0x2c], 0
jne 0x52b783
mov eax, dword [esp + 0x7b4]
add eax, 1
push eax
push ecx
push esi
call fcn.00526810
mov ebp, dword [esp + 0x30]
add esp, 0xc
mov dword [esp + 0x70], 1
cmp dword [esi + 0x3a08], 0
je 0x52b797
mov eax, dword [esi + 0x5e4]
sub eax, 1
jmp 0x52b7a1
mov eax, dword [esi + 0x3a10]
mov eax, dword [eax + ebp + 4]
mov ecx, dword [esi + 0x138]
mov edx, dword [ecx + eax*4]
test dword [edx + 0x38], 0x4000
je 0x52b7db
mov ecx, dword [esp + 0x7b4]
push ecx
push eax
push esi
call fcn.00526640
add esp, 0xc
test eax, eax
je 0x52b7db
mov eax, 1
mov dword [esp + 0x80], eax
mov dword [esp + 0x70], eax
jmp 0x52b7fb
cmp dword [esp + 0x80], 0
jne 0x52b7fb
cmp dword [esi + 0x20], 0
jne 0x52b7fb
cmp dword [esp + 0x70], 0
jne 0x52b7fb
cmp dword [esi + 0x3a08], 0
je 0x52b84b
mov eax, dword [esp + 0x7b4]
push eax
push eax
push 0
push esi
call fcn.005517e0
add esp, 0x10
cmp dword [esp + 0x70], 0
je 0x52b84b
mov edx, dword [esi + 0x3a10]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x74]
cmp dword [edx + eax + 4], ecx
lea eax, [edx + eax + 4]
jle 0x52b84b
mov edi, dword [esp + 0x7b4]
lea edx, [ebx - 1]
mov dword [esi + 0xb70], edx
mov eax, dword [eax]
mov dword [esp + 0x74], eax
xor ebp, ebp
jmp 0x527ea0
mov eax, dword [esp + 0x80]
add dword [esp + 0xc8], 1
test eax, eax
jne 0x52b888
cmp dword [esp + 0x98], eax
jne 0x52b888
cmp dword [esi + 0xb7c], eax
jne 0x52b888
cmp dword [esi + 0x5bf0], eax
jne 0x52b888
mov ecx, dword [esi + 0x3a10]
mov edx, dword [esp + 0x24]
test byte [ecx + edx + 0x28], 4
je 0x52b8d4
cmp dword [esp + 0xc8], 2
jge 0x52b8b1
mov edi, dword [esp + 0x7b4]
lea eax, [ebx - 1]
mov dword [esi + 0xb70], eax
mov dword [esp + 0x74], 0xffffffff
xor ebp, ebp
jmp 0x527ea0
test eax, eax
je 0x52b8d4
mov ecx, dword [esi + 0x3a10]
mov edx, dword [esp + 0x24]
mov eax, dword [ecx + edx + 0x48]
cmp dword [esi + 0xb70], eax
jl 0x52b8d4
add eax, 0xffffffff
mov dword [esi + 0xb70], eax
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x79c
ret