Function at 0x1006b7f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x88
push ebx
push ebp
push esi
mov esi, dword [esp + 0xb0]
xor ebx, ebx
push edi
push 0x10030
call fcn.1000151e
mov ebp, dword [esp + 0xa4]
add esp, 4
mov dword [esp + 0x48], eax
mov edi, ebp
mov eax, dword [esp + 0xa8]
mov ecx, ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x6c], edi
mov eax, dword [eax]
add eax, ebp
mov dword [esp + 0x88], eax
lea edx, [eax - 0xc]
add eax, 0xfffffffb
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xac]
add eax, dword [esp + 0xa4]
cmp dword [esp + 0x48], ebx
je 0x1006e187
mov ebx, dword [esp + 0xa8]
cmp dword [esp + 0xb8], 2
mov dword [ebx], 0
lea ebx, [eax - 5]
cmovne ebx, eax
cmp esi, 0x1000
mov eax, 0xfff
mov dword [esp + 0x78], ebx
cmovb eax, esi
mov dword [esp + 0x94], eax
cmp ebp, edx
ja 0x1006e09f
mov esi, dword [esp + 0x9c]
lea eax, [esi + 0x20000]
mov dword [esp + 0x84], eax
nop word [eax + eax]
mov edx, dword [esi + 0x4000c]
mov eax, ecx
mov ebx, dword [esi + 0x40004]
sub eax, edi
mov dword [esp + 0x50], eax
mov edi, 3
mov eax, dword [esi + 0x4001c]
mov esi, dword [esi + 0x40010]
mov ebp, esi
mov dword [esp + 0x64], eax
mov eax, edx
push dword [esp + 0x28]
sub eax, ebx
mov dword [esp + 0x28], 0
add ecx, eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], ecx
lea eax, [esi + 0x10000]
add ecx, 0xffff0001
mov dword [esp + 0x78], 0
cmp eax, dword [esp + 0x38]
mov dword [esp + 0x14], edi
cmovbe ebp, ecx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x20], ebp
mov ebp, dword [esp + 0xa0]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x44], esi
mov dword [esp + 0x64], 0
mov eax, dword [ebp + 0x40008]
mov dword [esp + 0x3c], eax
sub eax, esi
mov dword [esp + 0x58], eax
add eax, edx
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x50], eax
call fcn.1006f740
mov esi, dword [ebp + 0x40014]
mov ecx, eax
mov ebp, dword [esp + 0x38]
xor eax, eax
add esp, 4
mov dword [esp + 0x20], ecx
mov dword [esp + 0x68], eax
mov dword [esp + 0x7c], eax
cmp esi, ebp
jae 0x1006b9df
mov edi, esi
sub edi, edx
add edi, ebx
mov ebx, dword [esp + 0x9c]
nop dword [eax + eax]
push edi
call fcn.1006ecc0
lea edx, [ebx + eax*4]
mov ecx, esi
sub ecx, dword [edx]
add esp, 4
cmp ecx, 0xffff
mov eax, 0xffff
cmova ecx, eax
movzx eax, si
inc edi
mov word [ebx + eax*2 + 0x20000], cx
mov dword [edx], esi
inc esi
cmp esi, ebp
jb 0x1006b9a0
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
jmp 0x1006b9e6
mov ebx, dword [esp + 0x9c]
push dword [esp + 0x28]
mov dword [ebx + 0x40014], ebp
call fcn.1006ecc0
mov esi, dword [esp + 0x20]
add esp, 4
mov ebx, dword [ebx + eax*4]
mov dword [esp + 0x14], ebx
cmp ebx, esi
jb 0x1006c011
jmp 0x1006ba18
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x4c]
test eax, eax
jle 0x1006c00d
xor ebp, ebp
dec eax
mov dword [esp + 0x4c], eax
cmp dword [esp + 0xc4], ebp
je 0x1006ba43
mov eax, dword [esp + 0x34]
sub eax, ebx
cmp eax, 8
jb 0x1006bd2b
cmp ebx, edx
jb 0x1006bb62
mov eax, ebx
sub eax, edx
mov edx, dword [esp + 0x44]
add edx, eax
mov eax, dword [esp + 0x28]
dec eax
mov dword [esp + 0x5c], edx
add eax, edi
push eax
call fcn.1006f730
mov cx, ax
lea eax, [edx - 1]
add eax, edi
push eax
call fcn.1006f730
add esp, 8
cmp cx, ax
jne 0x1006bd2b
push edx
call fcn.1006f740
add esp, 4
cmp eax, dword [esp + 0x20]
jne 0x1006bd2b
mov edi, dword [esp + 0x30]
lea esi, [edx + 4]
mov edx, dword [esp + 0x28]
add edi, 0xfffffffd
add edx, 4
mov ebp, edx
cmp edx, edi
jae 0x1006baef
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006bb48
add edx, 4
add esi, 4
cmp edx, edi
jae 0x1006baef
nop dword [eax]
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006bb53
add edx, 4
add esi, 4
cmp edx, edi
jb 0x1006bad0
mov edi, dword [esp + 0x30]
lea eax, [edi - 1]
cmp edx, eax
jae 0x1006bb17
push edx
call fcn.1006f730
push esi
mov cx, ax
call fcn.1006f730
add esp, 8
cmp ax, cx
jne 0x1006bb17
add edx, 2
add esi, 2
cmp edx, edi
jae 0x1006bb22
mov al, byte [esi]
cmp al, byte [edx]
jne 0x1006bb22
inc edx
mov eax, edx
sub eax, ebp
lea ebp, [eax + 4]
mov eax, dword [esp + 0x10]
cmp ebp, eax
jle 0x1006bd31
mov ecx, dword [esp + 0x5c]
mov eax, ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0x74], ecx
jmp 0x1006bd37
push ecx
call fcn.1006ef00
add esp, 4
jmp 0x1006bb26
push ecx
call fcn.1006ef00
sub edx, ebp
add esp, 4
add eax, edx
jmp 0x1006bb26
mov esi, ebx
lea eax, [edx - 4]
sub esi, dword [esp + 0x40]
add esi, dword [esp + 0x38]
cmp ebx, eax
ja 0x1006bd2b
push esi
call fcn.1006f740
add esp, 4
cmp eax, ecx
jne 0x1006bd2b
mov ecx, dword [esp + 0x28]
mov ebx, edx
sub ebx, dword [esp + 0x14]
add ebx, ecx
cmp ebx, dword [esp + 0x30]
lea edx, [ecx + 4]
cmova ebx, dword [esp + 0x30]
mov ebp, edx
add esi, 4
lea edi, [ebx - 3]
cmp edx, edi
jae 0x1006bbf3
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006bcf1
add edx, 4
add esi, 4
cmp edx, edi
jae 0x1006bbf3
nop
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006bcff
add edx, 4
add esi, 4
cmp edx, edi
jb 0x1006bbd0
lea eax, [ebx - 1]
cmp edx, eax
jae 0x1006bc17
push edx
call fcn.1006f730
push esi
mov cx, ax
call fcn.1006f730
add esp, 8
cmp ax, cx
jne 0x1006bc17
add edx, 2
add esi, 2
cmp edx, ebx
jae 0x1006bc22
mov al, byte [esi]
cmp al, byte [edx]
jne 0x1006bc22
inc edx
mov eax, edx
sub eax, ebp
mov edx, dword [esp + 0x28]
lea ebp, [eax + 4]
add edx, ebp
cmp edx, ebx
jne 0x1006bccf
mov edi, dword [esp + 0x30]
cmp ebx, edi
jae 0x1006bccf
mov esi, dword [esp + 0x44]
add edi, 0xfffffffd
mov ebx, edx
cmp edx, edi
jae 0x1006bc96
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006bd11
add edx, 4
add esi, 4
cmp edx, edi
jae 0x1006bc96
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006bd1c
add edx, 4
add esi, 4
cmp edx, edi
jb 0x1006bc73
mov edi, dword [esp + 0x30]
lea eax, [edi - 1]
cmp edx, eax
jae 0x1006bcbe
push edx
call fcn.1006f730
push esi
mov cx, ax
call fcn.1006f730
add esp, 8
cmp ax, cx
jne 0x1006bcbe
add edx, 2
add esi, 2
cmp edx, edi
jae 0x1006bcc9
mov al, byte [esi]
cmp al, byte [edx]
jne 0x1006bcc9
inc edx
mov eax, edx
sub eax, ebx
add ebp, eax
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp ebp, eax
jle 0x1006bd31
mov ecx, ebx
mov dword [esp + 0x10], ebp
sub ecx, dword [esp + 0x18]
mov eax, ebp
add ecx, dword [esp + 0x44]
mov dword [esp + 0x74], ecx
jmp 0x1006bd37
push ecx
call fcn.1006ef00
add esp, 4
jmp 0x1006bc26
push ecx
call fcn.1006ef00
sub edx, ebp
add esp, 4
add eax, edx
jmp 0x1006bc26
push ecx
call fcn.1006ef00
add esp, 4
jmp 0x1006bccd
push ecx
call fcn.1006ef00
sub edx, ebx
add esp, 4
add eax, edx
jmp 0x1006bccd
mov eax, dword [esp + 0x10]
cmp ebp, eax
jne 0x1006bdc3
add eax, ebx
cmp eax, dword [esp + 0x34]
ja 0x1006bdc3
mov eax, dword [esp + 0x10]
mov ebp, 1
add eax, 0xfffffffd
xor ebx, ebx
lea esi, [ebp + 0xf]
test eax, eax
jle 0x1006bdc3
nop dword [eax + eax]
mov eax, dword [esp + 0x14]
mov edx, esi
mov ecx, dword [esp + 0x84]
add eax, ebx
movzx eax, ax
inc esi
sar edx, 4
movzx ecx, word [ecx + eax*2]
mov eax, 0x10
cmp ecx, ebp
mov edi, ecx
cmova esi, eax
cmovbe edi, ebp
mov eax, ebx
mov ebp, edi
cmovbe eax, dword [esp + 0x60]
add ebx, edx
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffffd
cmp ebx, eax
jl 0x1006bd60
mov ebp, dword [esp + 0x60]
mov dword [esp + 0x60], ebp
cmp edi, 1
jbe 0x1006bdc7
mov ebx, dword [esp + 0x14]
cmp edi, ebx
ja 0x1006c009
sub ebx, edi
jmp 0x1006be59
mov ebp, dword [esp + 0x60]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x84]
movzx eax, cx
cmp word [edx + eax*2], 1
jne 0x1006be42
test ebp, ebp
jne 0x1006be42
mov ebx, dword [esp + 0x68]
lea edi, [ecx - 1]
test ebx, ebx
jne 0x1006be72
mov ecx, dword [esp + 0x20]
mov eax, ecx
shr eax, 0x18
mov edx, ecx
cmp cl, al
movzx eax, cx
sete bl
shr edx, 0x10
xor ecx, ecx
cmp eax, edx
sete cl
test ecx, ebx
je 0x1006be3a
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
push esi
push dword [esp + 0x34]
add eax, 4
mov dword [esp + 0x70], 2
push eax
call fcn.1006ec10
add esp, 0xc
add eax, 4
mov dword [esp + 0x7c], eax
jmp 0x1006be7b
mov dword [esp + 0x68], 1
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x84]
lea eax, [ebx + ebp]
movzx eax, ax
movzx eax, word [ecx + eax*2]
sub ebx, eax
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x14], ebx
cmp ebx, esi
jae 0x1006ba10
jmp 0x1006c00d
cmp ebx, 2
jne 0x1006be42
mov esi, dword [esp + 0x20]
cmp edi, dword [esp + 0x1c]
jb 0x1006be42
mov ecx, dword [esp + 0x18]
push edi
push ecx
call fcn.1006ed50
add esp, 8
test eax, eax
je 0x1006be42
mov ebx, dword [esp + 0x44]
sub ebx, ecx
cmp edi, ecx
cmovb ebx, dword [esp + 0x54]
add ebx, edi
push ebx
call fcn.1006f740
add esp, 4
cmp eax, esi
jne 0x1006be42
mov ebp, dword [esp + 0x30]
lea eax, [ebx + 4]
cmp edi, ecx
push esi
cmovb ebp, dword [esp + 0x5c]
push ebp
push eax
call fcn.1006ec10
mov ecx, dword [esp + 0x24]
add esp, 0xc
lea esi, [eax + 4]
cmp edi, ecx
jae 0x1006bf12
lea eax, [esi + ebx]
cmp eax, ebp
jne 0x1006bf12
push dword [esp + 0x20]
push esi
call fcn.1006ede0
mov ebp, dword [esp + 0x4c]
push eax
push dword [esp + 0x3c]
push ebp
call fcn.1006ec10
push dword [esp + 0x34]
add esi, eax
cmp edi, dword [esp + 0x30]
mov eax, ebp
cmovb eax, dword [esp + 0x50]
push eax
push ebx
call fcn.1006ed70
add esp, 0x20
mov ebp, eax
jmp 0x1006bf62
push dword [esp + 0x20]
mov eax, dword [esp + 0x48]
cmp edi, ecx
cmovb eax, dword [esp + 0x3c]
push eax
push ebx
call fcn.1006ed70
mov edx, dword [esp + 0x24]
add esp, 0xc
mov ebp, eax
cmp edi, edx
jb 0x1006bf66
sub ebx, ebp
cmp ebx, dword [esp + 0x44]
jne 0x1006bf66
cmp dword [esp + 0x40], edx
jae 0x1006bf66
push dword [esp + 0x20]
neg eax
push eax
call fcn.1006ede0
push eax
push dword [esp + 0x44]
push dword [esp + 0x68]
call fcn.1006ed70
add esp, 0x14
add ebp, eax
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov eax, edi
sub eax, ebp
mov ecx, esi
mov ebp, dword [esp + 0x7c]
cmp eax, ebx
cmova ebx, eax
sub ecx, ebx
add ecx, edi
cmp ecx, ebp
jb 0x1006bf9f
cmp esi, ebp
ja 0x1006bf9f
sub esi, ebp
add esi, edi
push esi
push edx
call fcn.1006ed50
add esp, 8
mov ebx, edx
test eax, eax
cmovne ebx, esi
jmp 0x1006be5d
push ebx
push edx
call fcn.1006ed50
add esp, 8
test eax, eax
jne 0x1006bfb4
mov ebx, edx
jmp 0x1006be5d
cmp ecx, ebp
mov edx, ebp
cmovb edx, ecx
cmp dword [esp + 0x10], edx
jae 0x1006bfec
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x44]
sub eax, ebx
sub eax, ecx
add eax, dword [esp + 0x28]
cmp eax, 0xffff
ja 0x1006c009
mov dword [esp + 0x10], edx
mov ebp, ebx
mov edx, dword [esp + 0x18]
sub ebp, edx
add ebp, ecx
mov dword [esp + 0x74], ebp
jmp 0x1006bff0
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x84]
movzx eax, bx
movzx eax, word [ecx + eax*2]
cmp eax, ebx
ja 0x1006c009
sub ebx, eax
jmp 0x1006be5d
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x34]
cmp dword [esp + 0xc0], 1
jne 0x1006c1bc
mov edx, dword [esp + 0x4c]
test edx, edx
jle 0x1006c1bc
mov eax, ebp
sub eax, esi
cmp eax, 0xffff
jae 0x1006c1bc
mov ebx, dword [esp + 0x64]
push dword [esp + 0x28]
mov ecx, dword [ebx + 0x40000]
sub ecx, dword [ebx + 0x40004]
add ecx, dword [ebx + 0x4000c]
mov dword [esp + 0x5c], ecx
call fcn.1006ecc0
sub esi, ecx
add esp, 4
mov ebp, dword [ebx + eax*4]
add esi, ebp
mov eax, dword [esp + 0x34]
sub eax, esi
mov dword [esp + 0x1c], esi
cmp eax, 0xffff
ja 0x1006c1bc
nop dword [eax]
mov eax, edx
dec edx
mov dword [esp + 0x4c], edx
test eax, eax
je 0x1006c1bc
mov esi, ebp
sub esi, dword [ebx + 0x4000c]
add esi, dword [ebx + 0x40004]
push esi
call fcn.1006f740
add esp, 4
cmp eax, dword [esp + 0x20]
jne 0x1006c194
mov edi, ecx
mov ecx, dword [esp + 0x28]
sub edi, ebp
add edi, ecx
cmp edi, dword [esp + 0x30]
lea edx, [ecx + 4]
cmova edi, dword [esp + 0x30]
add esi, 4
mov dword [esp + 0x40], edx
lea ebx, [edi - 3]
cmp edx, ebx
jae 0x1006c116
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006c178
add edx, 4
add esi, 4
cmp edx, ebx
jae 0x1006c116
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006c183
add edx, 4
add esi, 4
cmp edx, ebx
jb 0x1006c0f7
lea eax, [edi - 1]
cmp edx, eax
jae 0x1006c13a
push edx
call fcn.1006f730
push esi
mov cx, ax
call fcn.1006f730
add esp, 8
cmp ax, cx
jne 0x1006c13a
add edx, 2
add esi, 2
cmp edx, edi
jae 0x1006c145
mov al, byte [esi]
cmp al, byte [edx]
jne 0x1006c145
inc edx
mov eax, edx
sub eax, dword [esp + 0x40]
mov esi, dword [esp + 0x1c]
add eax, 4
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x4c]
mov ebx, dword [esp + 0x64]
cmp eax, dword [esp + 0x10]
jle 0x1006c198
mov dword [esp + 0x10], eax
mov eax, esi
sub eax, dword [esp + 0x18]
add eax, dword [esp + 0x44]
mov dword [esp + 0x74], eax
jmp 0x1006c198
push ecx
call fcn.1006ef00
add esp, 4
jmp 0x1006c14b
push ecx
call fcn.1006ef00
sub edx, dword [esp + 0x44]
add esp, 4
add eax, edx
jmp 0x1006c14b
mov esi, dword [esp + 0x1c]
movzx eax, bp
movzx eax, word [ebx + eax*2 + 0x20000]
sub esi, eax
sub ebp, eax
mov eax, dword [esp + 0x34]
sub eax, esi
mov dword [esp + 0x1c], esi
cmp eax, 0xffff
jbe 0x1006c080
mov edx, dword [esp + 0x10]
cmp edx, 3
jle 0x1006c1ff
cmp dword [esp + 0xc4], 0
je 0x1006c1e9
xor ecx, ecx
cmp edx, 0x24
setle cl
xor eax, eax
cmp edx, 0x12
setg al
test eax, ecx
mov eax, 0x12
cmovne edx, eax
mov ecx, dword [esp + 0x28]
mov esi, edx
mov eax, ecx
mov dword [esp + 0x2c], esi
sub eax, dword [esp + 0x74]
mov dword [esp + 0x24], eax
jmp 0x1006c209
mov eax, dword [esp + 0x24]
mov esi, eax
mov ecx, dword [esp + 0x28]
test esi, esi
jne 0x1006c217
inc ecx
mov dword [esp + 0x28], ecx
jmp 0x1006dea5
cmp esi, dword [esp + 0x94]
jbe 0x1006c3bf
mov esi, dword [esp + 0xb8]
mov edi, ecx
mov ecx, dword [esp + 0x50]
sub edi, eax
mov eax, dword [esp + 0x3c]
mov ebp, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x5c], eax
inc eax
mov dword [esp + 0x3c], eax
test esi, esi
je 0x1006c26d
mov eax, 0x80808081
mul ecx
mov eax, dword [esp + 0x3c]
shr edx, 7
add eax, 8
add edx, ecx
add eax, edx
cmp eax, dword [esp + 0x78]
ja 0x1006dece
mov eax, dword [esp + 0x3c]
cmp ecx, 0xf
jb 0x1006c2c8
lea ebx, [ecx - 0xf]
mov byte [ebp], 0xf0
cmp ebx, 0xff
jb 0x1006c2bf
mov eax, 0x80808081
mul ebx
mov eax, dword [esp + 0x3c]
mov esi, edx
shr esi, 7
push esi
push 0xff
push eax
call fcn.10002d38
mov eax, dword [esp + 0x48]
add esp, 0xc
add eax, esi
nop word [eax + eax]
sub ebx, 0xff
sub esi, 1
jne 0x1006c2b0
mov ecx, dword [esp + 0x50]
mov byte [eax], bl
inc eax
mov dword [esp + 0x3c], eax
jmp 0x1006c2d0
mov al, cl
shl al, 4
mov byte [ebp], al
mov ebx, dword [esp + 0x3c]
mov edx, dword [esp + 0x6c]
sub edx, ebx
lea esi, [ecx + ebx]
nop dword [eax]
mov eax, dword [ebx + edx]
mov ecx, dword [ebx + edx + 4]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
add ebx, 8
cmp ebx, esi
jb 0x1006c2e0
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x5c]
sub eax, edi
push eax
push esi
call fcn.1006f9b0
mov ecx, dword [esp + 0x34]
add esi, 2
add esp, 8
mov dword [esp + 0x3c], esi
add ecx, 0xfffffffc
cmp dword [esp + 0xb8], 0
je 0x1006c338
mov eax, 0x80808081
mul ecx
shr edx, 7
lea eax, [edx + 6]
add eax, esi
cmp eax, dword [esp + 0x78]
ja 0x1006dec7
mov al, byte [ebx]
cmp ecx, 0xf
jb 0x1006c3a3
add al, 0xf
sub ecx, 0xf
mov byte [ebp], al
cmp ecx, 0x1fe
jb 0x1006c373
mov eax, 0x80808081
mul ecx
shr edx, 8
nop dword [eax]
mov word [esi], 0xffff
sub ecx, 0x1fe
add esi, 2
sub edx, 1
jne 0x1006c360
cmp ecx, 0xff
jb 0x1006c385
sub ecx, 0xff
mov byte [esi], 0xff
inc esi
mov byte [esi], cl
inc esi
mov ecx, dword [esp + 0x28]
add ecx, dword [esp + 0x2c]
mov edi, ecx
mov dword [esp + 0x3c], esi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x6c], edi
jmp 0x1006dea9
add al, cl
mov ecx, dword [esp + 0x28]
add ecx, dword [esp + 0x2c]
mov edi, ecx
mov byte [ebp], al
mov dword [esp + 0x28], ecx
mov dword [esp + 0x6c], edi
jmp 0x1006dea9
mov ebx, dword [esp + 0x50]
mov eax, ebx
cmp ebx, 0xf
jl 0x1006c3e3
lea ecx, [ebx - 0xf]
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
inc eax
add eax, edx
add eax, ebx
mov edi, dword [esp + 0x48]
lea esi, [ebx + 1]
mov dword [edi], eax
mov eax, esi
mov dword [edi + 8], 1
mov dword [edi + 4], 0
mov dword [edi + 0xc], ebx
cmp esi, 0xf
jl 0x1006c41f
lea ecx, [ebx - 0xe]
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, 2
add eax, edx
add eax, ebx
mov dword [edi + 0x1c], esi
lea esi, [ebx + 2]
mov dword [edi + 0x10], eax
mov eax, esi
mov dword [edi + 0x18], 1
mov dword [edi + 0x14], 0
cmp esi, 0xf
jl 0x1006c458
lea ecx, [ebx - 0xd]
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, 3
add eax, edx
add eax, ebx
lea ebp, [ebx + 3]
mov dword [edi + 0x20], eax
mov dword [edi + 0x28], 1
mov eax, ebp
mov dword [edi + 0x24], 0
mov dword [edi + 0x2c], esi
cmp ebp, 0xf
jl 0x1006c491
lea ecx, [ebx - 0xc]
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, 4
add eax, edx
add eax, ebx
mov dword [edi + 0x38], 1
mov dword [edi + 0x34], 0
mov dword [edi + 0x3c], ebp
mov dword [edi + 0x30], eax
mov edi, 4
cmp dword [esp + 0x2c], edi
jl 0x1006c571
mov esi, dword [esp + 0x48]
add esi, 0x44
cmp ebx, 0xf
jl 0x1006c526
lea ecx, [ebx - 0xf]
mov eax, 0x80808081
imul ecx
mov eax, dword [esp + 0x50]
add edx, ecx
mov ecx, dword [esp + 0x24]
sar edx, 7
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov edx, dword [esp + 0x2c]
add ebp, ebx
lea ebx, [ebp + 4]
cmp edi, 0x13
jl 0x1006c511
lea ecx, [edi - 0x13]
mov eax, 0x80808081
imul ecx
inc ebx
add edx, ecx
mov ecx, dword [esp + 0x24]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x2c]
add ebx, eax
mov eax, dword [esp + 0x50]
mov dword [esi + 4], edi
inc edi
mov dword [esi], ecx
mov dword [esi + 8], eax
mov dword [esi - 4], ebx
add esi, 0x10
cmp edi, edx
jle 0x1006c4e4
jmp 0x1006c571
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
mov ebx, ebp
cmp edi, 0x13
jl 0x1006c55e
lea ecx, [edi - 0x13]
mov eax, 0x80808081
imul ecx
inc ebx
add edx, ecx
mov ecx, dword [esp + 0x24]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x2c]
add ebx, eax
mov eax, dword [esp + 0x50]
mov dword [esi + 4], edi
inc edi
mov dword [esi], ecx
mov dword [esi + 8], eax
mov dword [esi - 4], ebx
add esi, 0x10
cmp edi, edx
jle 0x1006c532
mov edi, dword [esp + 0x2c]
mov ebp, 1
mov ebx, dword [esp + 0x48]
mov ecx, edi
add ecx, ecx
mov dword [esp + 0x44], ebp
lea edx, [edi + 1]
shl edx, 4
add edx, ebx
mov dword [edx + 8], 1
mov dword [edx + 4], 0
mov dword [edx + 0xc], 1
mov eax, dword [ebx + ecx*8]
inc eax
mov dword [edx + 0x18], 1
mov dword [edx], eax
mov dword [edx + 0x14], 0
mov dword [edx + 0x1c], 2
mov eax, dword [ebx + ecx*8]
add eax, 2
mov dword [edx + 0x28], 1
mov dword [edx + 0x10], eax
lea eax, [edi + 3]
add eax, eax
mov dword [edx + 0x24], 0
mov dword [edx + 0x2c], 3
mov ecx, dword [ebx + ecx*8]
add ecx, 3
mov dword [ebx + eax*8], ecx
cmp edi, ebp
jle 0x1006dc69
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x88]
add esi, ebp
add eax, 0xfffffff4
mov dword [esp + 0x24], esi
cmp esi, eax
ja 0x1006dc69
mov eax, ebp
add eax, eax
cmp dword [esp + 0xbc], 0
mov ecx, dword [ebx + eax*8 + 0x10]
mov eax, dword [ebx + eax*8]
je 0x1006c63a
cmp ecx, eax
jg 0x1006c642
lea ecx, [ebp + 4]
add eax, 3
add ecx, ecx
cmp dword [ebx + ecx*8], eax
jl 0x1006dc5c
jmp 0x1006c642
cmp ecx, eax
jle 0x1006dc5c
cmp dword [esp + 0xbc], 0
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x74], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x38], 0
mov edi, dword [eax + 0x4001c]
mov ebp, dword [eax + 0x40004]
mov ebx, dword [eax + 0x4000c]
mov edx, dword [eax + 0x40010]
mov dword [esp + 0x7c], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x50], edx
push esi
je 0x1006cf96
mov eax, ebx
mov dword [esp + 0x50], 0
sub eax, ebp
mov edi, 3
mov dword [esp + 0x14], edi
lea ebp, [eax + esi]
lea eax, [edx + 0x10000]
mov dword [esp + 0x6c], ebp
cmp eax, ebp
lea ecx, [ebp - 0xffff]
mov eax, dword [esp + 0xa0]
cmovbe edx, ecx
mov dword [esp + 0x24], edx
mov ecx, dword [eax + 0x40008]
mov eax, ecx
sub eax, dword [esp + 0x54]
add eax, ebx
mov dword [esp + 0x68], ecx
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x74], eax
call fcn.1006f740
mov edx, eax
add esp, 4
xor eax, eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x58], eax
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x9c]
mov esi, dword [eax + 0x40014]
cmp esi, ebp
jae 0x1006c763
mov edi, esi
sub edi, ebx
mov ebx, eax
add edi, dword [esp + 0x18]
push edi
call fcn.1006ecc0
lea edx, [ebx + eax*4]
mov ecx, esi
sub ecx, dword [edx]
add esp, 4
cmp ecx, 0xffff
mov eax, 0xffff
cmova ecx, eax
movzx eax, si
inc edi
mov word [ebx + eax*2 + 0x20000], cx
mov dword [edx], esi
inc esi
cmp esi, ebp
jb 0x1006c724
mov edi, dword [esp + 0x10]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x64]
jmp 0x1006c765
mov ebx, eax
push dword [esp + 0x24]
mov dword [ebx + 0x40014], ebp
call fcn.1006ecc0
mov esi, dword [esp + 0x24]
add esp, 4
mov ebx, dword [ebx + eax*4]
mov dword [esp + 0x14], ebx
cmp ebx, esi
jb 0x1006cd9e
mov eax, ecx
sub eax, dword [esp + 0x50]
mov dword [esp + 0x5c], eax
jmp 0x1006c7a8
mov edi, dword [esp + 0x10]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x70]
test eax, eax
jle 0x1006cd9a
xor ebp, ebp
dec eax
mov dword [esp + 0x70], eax
cmp dword [esp + 0xc4], ebp
je 0x1006c7d3
mov eax, dword [esp + 0x68]
sub eax, ebx
cmp eax, 8
jb 0x1006caab
mov eax, dword [esp + 0x1c]
cmp ebx, eax
jb 0x1006c8e1
sub ebx, eax
add ebx, dword [esp + 0x18]
lea eax, [ebx - 1]
add eax, edi
push eax
call fcn.1006f730
mov cx, ax
mov eax, dword [esp + 0x28]
dec eax
add eax, edi
push eax
call fcn.1006f730
add esp, 8
cmp ax, cx
jne 0x1006caab
push ebx
call fcn.1006f740
add esp, 4
cmp eax, edx
jne 0x1006caab
mov edx, dword [esp + 0x24]
lea esi, [ebx + 4]
mov edi, dword [esp + 0x30]
add edx, 4
add edi, 0xfffffffd
mov ebp, edx
cmp edx, edi
jae 0x1006c872
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006c8c7
add edx, 4
add esi, 4
cmp edx, edi
jae 0x1006c872
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006c8d2
add edx, 4
add esi, 4
cmp edx, edi
jb 0x1006c853
mov edi, dword [esp + 0x30]
lea eax, [edi - 1]
cmp edx, eax
jae 0x1006c89a
push edx
call fcn.1006f730
push esi
mov cx, ax
call fcn.1006f730
add esp, 8
cmp ax, cx
jne 0x1006c89a
add edx, 2
add esi, 2
cmp edx, edi
jae 0x1006c8a5
mov al, byte [esi]
cmp al, byte [edx]
jne 0x1006c8a5
inc edx
mov eax, edx
sub eax, ebp
lea ebp, [eax + 4]
mov eax, dword [esp + 0x10]
cmp ebp, eax
jle 0x1006cab1
mov dword [esp + 0x10], ebp
mov eax, ebp
mov dword [esp + 0x38], ebx
jmp 0x1006cab7
push ecx
call fcn.1006ef00
add esp, 4
jmp 0x1006c8a9
push ecx
call fcn.1006ef00
sub edx, ebp
add esp, 4
add eax, edx
jmp 0x1006c8a9
mov esi, ebx
add eax, 0xfffffffc
sub esi, dword [esp + 0x50]
add esi, ecx
cmp ebx, eax
ja 0x1006caab
push esi
call fcn.1006f740
add esp, 4
cmp eax, edx
jne 0x1006caab
mov ebx, dword [esp + 0x1c]
sub ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
add ebx, eax
cmp ebx, dword [esp + 0x30]
cmova ebx, dword [esp + 0x30]
add esi, 4
lea edx, [eax + 4]
mov ebp, edx
lea edi, [ebx - 3]
cmp edx, edi
jae 0x1006c973
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006ca71
add edx, 4
add esi, 4
cmp edx, edi
jae 0x1006c973
nop
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006ca7f
add edx, 4
add esi, 4
cmp edx, edi
jb 0x1006c950
lea eax, [ebx - 1]
cmp edx, eax
jae 0x1006c997
push edx
call fcn.1006f730
push esi
mov cx, ax
call fcn.1006f730
add esp, 8
cmp ax, cx
jne 0x1006c997
add edx, 2
add esi, 2
cmp edx, ebx
jae 0x1006c9a2
mov al, byte [esi]
cmp al, byte [edx]
jne 0x1006c9a2
inc edx
mov eax, edx
sub eax, ebp
mov edx, dword [esp + 0x24]
lea ebp, [eax + 4]
add edx, ebp
cmp edx, ebx
jne 0x1006ca4f
mov edi, dword [esp + 0x30]
cmp ebx, edi
jae 0x1006ca4f
mov esi, dword [esp + 0x18]
add edi, 0xfffffffd
mov ebx, edx
cmp edx, edi
jae 0x1006ca16
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006ca91
add edx, 4
add esi, 4
cmp edx, edi
jae 0x1006ca16
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006ca9c
add edx, 4
add esi, 4
cmp edx, edi
jb 0x1006c9f3
mov edi, dword [esp + 0x30]
lea eax, [edi - 1]
cmp edx, eax
jae 0x1006ca3e
push edx
call fcn.1006f730
push esi
mov cx, ax
call fcn.1006f730
add esp, 8
cmp ax, cx
jne 0x1006ca3e
add edx, 2
add esi, 2
cmp edx, edi
jae 0x1006ca49
mov al, byte [esi]
cmp al, byte [edx]
jne 0x1006ca49
inc edx
mov eax, edx
sub eax, ebx
add ebp, eax
mov eax, dword [esp + 0x10]
cmp ebp, eax
jle 0x1006cab1
mov edx, dword [esp + 0x18]
mov eax, ebp
sub edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
add edx, ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x38], edx
jmp 0x1006cabb
push ecx
call fcn.1006ef00
add esp, 4
jmp 0x1006c9a6
push ecx
call fcn.1006ef00
sub edx, ebp
add esp, 4
add eax, edx
jmp 0x1006c9a6
push ecx
call fcn.1006ef00
add esp, 4
jmp 0x1006ca4d
push ecx
call fcn.1006ef00
sub edx, ebx
add esp, 4
add eax, edx
jmp 0x1006ca4d
mov eax, dword [esp + 0x10]
cmp ebp, eax
jne 0x1006cb4a
mov ecx, dword [esp + 0x14]
add eax, ecx
cmp eax, dword [esp + 0x68]
ja 0x1006cb4e
mov eax, dword [esp + 0x10]
mov ebp, 1
add eax, 0xfffffffd
xor ebx, ebx
lea esi, [ebp + 0xf]
test eax, eax
jle 0x1006cb4e
nop dword [eax]
lea eax, [ebx + ecx]
mov edx, esi
mov ecx, dword [esp + 0x9c]
inc esi
movzx eax, ax
sar edx, 4
movzx ecx, word [ecx + eax*2 + 0x20000]
mov eax, 0x10
cmp ecx, ebp
mov edi, ecx
mov ecx, dword [esp + 0x14]
cmova esi, eax
cmovbe edi, ebp
mov eax, ebx
mov ebp, edi
cmovbe eax, dword [esp + 0x4c]
add ebx, edx
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffffd
cmp ebx, eax
jl 0x1006cae0
mov ebp, dword [esp + 0x4c]
mov dword [esp + 0x4c], ebp
cmp edi, 1
jbe 0x1006cbc5
mov ebx, ecx
cmp edi, ebx
ja 0x1006cd96
sub ebx, edi
jmp 0x1006cbee
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x4c]
mov edx, dword [esp + 0x9c]
movzx eax, cx
cmp word [edx + eax*2 + 0x20000], 1
jne 0x1006cbd3
test ebp, ebp
jne 0x1006cbd3
mov ebx, dword [esp + 0x58]
lea edi, [ecx - 1]
test ebx, ebx
jne 0x1006cc07
mov ecx, dword [esp + 0x34]
mov eax, ecx
shr eax, 0x18
mov edx, ecx
cmp cl, al
movzx eax, cx
sete bl
shr edx, 0x10
xor ecx, ecx
cmp eax, edx
sete cl
test ecx, ebx
je 0x1006cbcb
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
push esi
push dword [esp + 0x34]
add eax, 4
mov dword [esp + 0x60], 2
push eax
call fcn.1006ec10
add esp, 0xc
add eax, 4
mov dword [esp + 0x54], eax
jmp 0x1006cc10
mov ecx, dword [esp + 0x14]
jmp 0x1006cb52
mov dword [esp + 0x58], 1
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x9c]
lea eax, [ebx + ebp]
movzx eax, ax
movzx eax, word [ecx + eax*2 + 0x20000]
sub ebx, eax
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x14], ebx
cmp ebx, esi
jae 0x1006c7a0
jmp 0x1006cd9a
cmp ebx, 2
jne 0x1006cbd3
mov esi, dword [esp + 0x34]
cmp edi, dword [esp + 0x20]
jb 0x1006cbd3
mov ecx, dword [esp + 0x1c]
push edi
push ecx
call fcn.1006ed50
add esp, 8
test eax, eax
je 0x1006cbd3
mov ebx, dword [esp + 0x18]
sub ebx, ecx
cmp edi, ecx
cmovb ebx, dword [esp + 0x5c]
add ebx, edi
push ebx
call fcn.1006f740
add esp, 4
cmp eax, esi
jne 0x1006cbd3
mov ebp, dword [esp + 0x30]
lea eax, [ebx + 4]
cmp edi, ecx
push esi
cmovb ebp, dword [esp + 0x44]
push ebp
push eax
call fcn.1006ec10
mov ecx, dword [esp + 0x28]
add esp, 0xc
lea esi, [eax + 4]
cmp edi, ecx
jae 0x1006cca6
lea eax, [esi + ebx]
cmp eax, ebp
jne 0x1006cca6
mov ebp, dword [esp + 0x34]
push ebp
push esi
call fcn.1006ede0
push eax
push dword [esp + 0x3c]
push dword [esp + 0x28]
call fcn.1006ec10
add esi, eax
mov eax, dword [esp + 0x2c]
cmp edi, dword [esp + 0x30]
push ebp
cmovb eax, dword [esp + 0x7c]
push eax
push ebx
call fcn.1006ed70
add esp, 0x20
mov ebp, eax
jmp 0x1006ccf6
push dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
cmp edi, ecx
cmovb eax, dword [esp + 0x68]
push eax
push ebx
call fcn.1006ed70
mov edx, dword [esp + 0x28]
add esp, 0xc
mov ebp, eax
cmp edi, edx
jb 0x1006ccfa
sub ebx, ebp
cmp ebx, dword [esp + 0x18]
jne 0x1006ccfa
cmp dword [esp + 0x50], edx
jae 0x1006ccfa
push dword [esp + 0x34]
neg eax
push eax
call fcn.1006ede0
push eax
push dword [esp + 0x70]
push dword [esp + 0x50]
call fcn.1006ed70
add esp, 0x14
add ebp, eax
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov eax, edi
sub eax, ebp
mov ecx, esi
mov ebp, dword [esp + 0x54]
cmp eax, ebx
cmova ebx, eax
sub ecx, ebx
add ecx, edi
cmp ecx, ebp
jb 0x1006cd33
cmp esi, ebp
ja 0x1006cd33
sub esi, ebp
add esi, edi
push esi
push edx
call fcn.1006ed50
add esp, 8
mov ebx, edx
test eax, eax
cmovne ebx, esi
jmp 0x1006cbee
push ebx
push edx
call fcn.1006ed50
add esp, 8
test eax, eax
jne 0x1006cd48
mov ebx, edx
jmp 0x1006cbee
cmp ecx, ebp
mov edx, ebp
cmovb edx, ecx
cmp dword [esp + 0x10], edx
jae 0x1006cd7c
mov ecx, dword [esp + 0x1c]
mov eax, ecx
mov edi, dword [esp + 0x18]
sub eax, ebx
sub eax, edi
add eax, dword [esp + 0x24]
cmp eax, 0xffff
ja 0x1006cd96
mov ebp, ebx
mov dword [esp + 0x10], edx
sub ebp, ecx
add ebp, edi
mov dword [esp + 0x38], ebp
mov ecx, dword [esp + 0x9c]
movzx eax, bx
movzx eax, word [ecx + eax*2 + 0x20000]
cmp eax, ebx
jbe 0x1006cbec
mov esi, dword [esp + 0x20]
mov ebp, dword [esp + 0x68]
cmp dword [esp + 0xc0], 1
jne 0x1006cf50
mov edx, dword [esp + 0x70]
test edx, edx
jle 0x1006cf50
mov eax, ebp
sub eax, esi
cmp eax, 0xffff
jae 0x1006cf50
mov edi, dword [esp + 0x7c]
mov ebx, dword [esp + 0x24]
push ebx
mov ecx, dword [edi + 0x40000]
sub ecx, dword [edi + 0x40004]
add ecx, dword [edi + 0x4000c]
mov dword [esp + 0x44], ecx
call fcn.1006ecc0
sub esi, ecx
add esp, 4
mov ebp, dword [edi + eax*4]
add esi, ebp
mov eax, dword [esp + 0x68]
sub eax, esi
mov dword [esp + 0x20], esi
cmp eax, 0xffff
ja 0x1006cf50
nop word [eax + eax]
mov eax, edx
dec edx
mov dword [esp + 0x70], edx
test eax, eax
je 0x1006cf50
mov esi, dword [edi + 0x40004]
sub esi, dword [edi + 0x4000c]
add esi, ebp
push esi
call fcn.1006f740
add esp, 4
cmp eax, dword [esp + 0x34]
jne 0x1006cf28
mov edi, ecx
lea edx, [ebx + 4]
sub edi, ebp
mov dword [esp + 0x54], edx
add edi, ebx
cmp edi, dword [esp + 0x30]
cmova edi, dword [esp + 0x30]
add esi, 4
lea ebx, [edi - 3]
cmp edx, ebx
jae 0x1006cea6
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006cf0c
add edx, 4
add esi, 4
cmp edx, ebx
jae 0x1006cea6
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006cf17
add edx, 4
add esi, 4
cmp edx, ebx
jb 0x1006ce83
lea eax, [edi - 1]
cmp edx, eax
jae 0x1006ceca
push edx
call fcn.1006f730
push esi
mov cx, ax
call fcn.1006f730
add esp, 8
cmp ax, cx
jne 0x1006ceca
add edx, 2
add esi, 2
cmp edx, edi
jae 0x1006ced5
mov al, byte [esi]
cmp al, byte [edx]
jne 0x1006ced5
inc edx
mov eax, edx
sub eax, dword [esp + 0x54]
mov esi, dword [esp + 0x20]
add eax, 4
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x70]
mov edi, dword [esp + 0x7c]
cmp eax, dword [esp + 0x10]
jle 0x1006cf2c
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x1c]
add eax, esi
mov dword [esp + 0x38], eax
jmp 0x1006cf2c
push ecx
call fcn.1006ef00
add esp, 4
jmp 0x1006cedb
push ecx
call fcn.1006ef00
sub edx, dword [esp + 0x58]
add esp, 4
add eax, edx
jmp 0x1006cedb
mov esi, dword [esp + 0x20]
movzx eax, bp
movzx eax, word [edi + eax*2 + 0x20000]
sub esi, eax
sub ebp, eax
mov eax, dword [esp + 0x68]
sub eax, esi
mov dword [esp + 0x20], esi
cmp eax, 0xffff
jbe 0x1006ce10
mov edx, dword [esp + 0x10]
cmp edx, 3
jle 0x1006d8d0
cmp dword [esp + 0xc4], 0
je 0x1006cf81
xor ecx, ecx
cmp edx, 0x24
setle cl
xor eax, eax
cmp edx, 0x12
setg al
test eax, ecx
mov eax, 0x12
cmovne edx, eax
mov ebx, dword [esp + 0x24]
sub ebx, dword [esp + 0x38]
mov dword [esp + 0x60], edx
mov dword [esp + 0x74], ebx
jmp 0x1006d8d6
mov ecx, dword [esp + 0x30]
mov edx, ebx
sub ecx, dword [esp + 0x48]
sub edx, ebp
mov ebp, dword [esp + 0x54]
add edx, esi
mov edi, ecx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x68], 0
mov dword [esp + 0x14], edi
lea eax, [ebp + 0x10000]
mov dword [esp + 0x50], edx
cmp eax, edx
lea ecx, [edx - 0xffff]
mov eax, dword [esp + 0xa0]
cmovbe ebp, ecx
mov dword [esp + 0x38], ebp
mov ecx, dword [eax + 0x40008]
mov eax, ecx
sub eax, dword [esp + 0x54]
add eax, ebx
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x74], eax
call fcn.1006f740
mov edx, eax
add esp, 4
xor eax, eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x40], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x18]
sub ebx, eax
add ebx, esi
mov esi, dword [esp + 0x9c]
mov esi, dword [esi + 0x40014]
cmp esi, ebx
jae 0x1006d087
mov ebp, dword [esp + 0x9c]
mov edi, esi
sub edi, dword [esp + 0x1c]
add edi, eax
nop
push edi
call fcn.1006ecc0
mov ecx, esi
add esp, 4
lea edx, [eax*4]
mov eax, 0xffff
sub ecx, dword [edx + ebp]
cmp ecx, 0xffff
cmova ecx, eax
movzx eax, si
inc edi
mov word [ebp + eax*2 + 0x20000], cx
mov dword [edx + ebp], esi
inc esi
cmp esi, ebx
jb 0x1006d040
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x34]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x9c]
mov esi, dword [esp + 0x24]
push esi
mov dword [eax + 0x40014], ebx
call fcn.1006ecc0
mov ebx, dword [esp + 0xa0]
add esp, 4
mov ebx, dword [ebx + eax*4]
mov dword [esp + 0x14], ebx
cmp ebx, ebp
jb 0x1006d6d4
mov eax, ecx
sub eax, dword [esp + 0x50]
mov dword [esp + 0x80], eax
jmp 0x1006d0dc
mov edi, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x70]
test eax, eax
jle 0x1006d6d4
xor ebp, ebp
dec eax
mov dword [esp + 0x70], eax
cmp dword [esp + 0xc4], ebp
je 0x1006d107
mov eax, dword [esp + 0x4c]
sub eax, ebx
cmp eax, 8
jb 0x1006d3eb
mov eax, dword [esp + 0x1c]
cmp ebx, eax
jb 0x1006d21d
mov edx, ebx
sub edx, eax
add edx, dword [esp + 0x18]
mov dword [esp + 0x58], edx
lea eax, [edx - 1]
add eax, edi
push eax
call fcn.1006f730
mov cx, ax
lea eax, [esi - 1]
add eax, edi
push eax
call fcn.1006f730
add esp, 8
cmp ax, cx
jne 0x1006d3eb
push edx
call fcn.1006f740
add esp, 4
cmp eax, dword [esp + 0x20]
jne 0x1006d3eb
mov ebp, dword [esp + 0x30]
lea esi, [edx + 4]
mov edx, dword [esp + 0x24]
add edx, 4
mov ebx, edx
lea edi, [ebp - 3]
cmp edx, edi
jae 0x1006d1b0
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006d203
add edx, 4
add esi, 4
cmp edx, edi
jae 0x1006d1b0
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006d20e
add edx, 4
add esi, 4
cmp edx, edi
jb 0x1006d191
lea eax, [ebp - 1]
cmp edx, eax
jae 0x1006d1d4
push edx
call fcn.1006f730
push esi
mov cx, ax
call fcn.1006f730
add esp, 8
cmp ax, cx
jne 0x1006d1d4
add edx, 2
add esi, 2
cmp edx, ebp
jae 0x1006d1df
mov al, byte [esi]
cmp al, byte [edx]
jne 0x1006d1df
inc edx
mov eax, edx
sub eax, ebx
lea ebp, [eax + 4]
mov eax, dword [esp + 0x10]
cmp ebp, eax
jle 0x1006d3f1
mov eax, dword [esp + 0x58]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x64], eax
jmp 0x1006d3fb
push ecx
call fcn.1006ef00
add esp, 4
jmp 0x1006d1e3
push ecx
call fcn.1006ef00
sub edx, ebx
add esp, 4
add eax, edx
jmp 0x1006d1e3
mov esi, ebx
add eax, 0xfffffffc
sub esi, dword [esp + 0x50]
add esi, ecx
cmp ebx, eax
ja 0x1006d3eb
push esi
call fcn.1006f740
add esp, 4
cmp eax, edx
jne 0x1006d3eb
mov ebx, dword [esp + 0x1c]
sub ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
add ebx, eax
cmp ebx, dword [esp + 0x30]
cmova ebx, dword [esp + 0x30]
add esi, 4
lea edx, [eax + 4]
mov ebp, edx
lea edi, [ebx - 3]
cmp edx, edi
jae 0x1006d2b3
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006d3b1
add edx, 4
add esi, 4
cmp edx, edi
jae 0x1006d2b3
nop word [eax + eax]
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006d3bf
add edx, 4
add esi, 4
cmp edx, edi
jb 0x1006d290
lea eax, [ebx - 1]
cmp edx, eax
jae 0x1006d2d7
push edx
call fcn.1006f730
push esi
mov cx, ax
call fcn.1006f730
add esp, 8
cmp ax, cx
jne 0x1006d2d7
add edx, 2
add esi, 2
cmp edx, ebx
jae 0x1006d2e2
mov al, byte [esi]
cmp al, byte [edx]
jne 0x1006d2e2
inc edx
mov eax, edx
sub eax, ebp
mov edx, dword [esp + 0x24]
lea ebp, [eax + 4]
add edx, ebp
cmp edx, ebx
jne 0x1006d391
mov edi, dword [esp + 0x30]
cmp ebx, edi
jae 0x1006d391
mov eax, dword [esp + 0x18]
add edi, 0xfffffffd
mov esi, eax
mov ebx, edx
cmp edx, edi
jae 0x1006d358
push eax
call fcn.1006f750
push edx
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006d3d1
add edx, 4
add esi, 4
cmp edx, edi
jae 0x1006d358
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006d3dc
add edx, 4
add esi, 4
cmp edx, edi
jb 0x1006d335
mov edi, dword [esp + 0x30]
lea eax, [edi - 1]
cmp edx, eax
jae 0x1006d380
push edx
call fcn.1006f730
push esi
mov cx, ax
call fcn.1006f730
add esp, 8
cmp ax, cx
jne 0x1006d380
add edx, 2
add esi, 2
cmp edx, edi
jae 0x1006d38b
mov al, byte [esi]
cmp al, byte [edx]
jne 0x1006d38b
inc edx
mov eax, edx
sub eax, ebx
add ebp, eax
mov eax, dword [esp + 0x10]
cmp ebp, eax
jle 0x1006d3f1
mov edx, dword [esp + 0x18]
sub edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
add edx, ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x64], edx
jmp 0x1006d3ff
push ecx
call fcn.1006ef00
add esp, 4
jmp 0x1006d2e6
push ecx
call fcn.1006ef00
sub edx, ebp
add esp, 4
add eax, edx
jmp 0x1006d2e6
push ecx
call fcn.1006ef00
add esp, 4
jmp 0x1006d38f
push ecx
call fcn.1006ef00
sub edx, ebx
add esp, 4
add eax, edx
jmp 0x1006d38f
mov eax, dword [esp + 0x10]
cmp ebp, eax
jne 0x1006d483
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
lea eax, [ecx + ebp]
cmp eax, dword [esp + 0x4c]
ja 0x1006d487
add ebp, 0xfffffffd
mov dword [esp + 0x58], 1
xor ebx, ebx
mov edi, 0x10
test ebp, ebp
jle 0x1006d487
lea eax, [ebx + ecx]
mov edx, edi
mov ecx, dword [esp + 0x9c]
inc edi
movzx eax, ax
mov esi, 0x10
sar edx, 4
movzx ecx, word [ecx + eax*2 + 0x20000]
mov eax, ebx
cmp ecx, dword [esp + 0x58]
cmovbe eax, dword [esp + 0x38]
cmova edi, esi
mov esi, ecx
mov dword [esp + 0x38], eax
cmovbe esi, dword [esp + 0x58]
add ebx, edx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x58], esi
cmp ebx, ebp
jl 0x1006d422
mov dword [esp + 0x38], eax
cmp esi, 1
jbe 0x1006d483
mov ebx, ecx
cmp esi, ebx
ja 0x1006d6d0
sub ebx, esi
jmp 0x1006d524
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x9c]
movzx eax, cx
cmp word [edx + eax*2 + 0x20000], 1
jne 0x1006d506
cmp dword [esp + 0x38], 0
jne 0x1006d506
mov ebx, dword [esp + 0x40]
lea ebp, [ecx - 1]
test ebx, ebx
jne 0x1006d53d
mov ecx, dword [esp + 0x20]
mov eax, ecx
shr eax, 0x18
mov edx, ecx
cmp cl, al
movzx eax, cx
sete bl
shr edx, 0x10
xor ecx, ecx
cmp eax, edx
sete cl
test ecx, ebx
je 0x1006d4fe
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x30]
add eax, 4
push esi
push ebx
push eax
mov dword [esp + 0x4c], 2
call fcn.1006ec10
add esp, 0xc
add eax, 4
mov dword [esp + 0x5c], eax
jmp 0x1006d54a
mov dword [esp + 0x40], 1
mov eax, dword [esp + 0x38]
mov ebx, dword [esp + 0x14]
add eax, ebx
mov ecx, dword [esp + 0x9c]
movzx eax, ax
movzx eax, word [ecx + eax*2 + 0x20000]
sub ebx, eax
mov ebp, dword [esp + 0x34]
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x14], ebx
cmp ebx, ebp
jae 0x1006d0d0
jmp 0x1006d6d4
cmp ebx, 2
jne 0x1006d506
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x30]
cmp ebp, dword [esp + 0x34]
jb 0x1006d506
mov ecx, dword [esp + 0x1c]
push ebp
push ecx
call fcn.1006ed50
add esp, 8
test eax, eax
je 0x1006d506
mov edi, dword [esp + 0x18]
sub edi, ecx
cmp ebp, ecx
cmovb edi, dword [esp + 0x80]
add edi, ebp
push edi
call fcn.1006f740
add esp, 4
cmp eax, esi
jne 0x1006d506
cmp ebp, ecx
lea eax, [edi + 4]
push esi
cmovb ebx, dword [esp + 0x58]
push ebx
push eax
call fcn.1006ec10
mov ecx, dword [esp + 0x28]
add esp, 0xc
lea esi, [eax + 4]
cmp ebp, ecx
jae 0x1006d5e2
lea eax, [esi + edi]
cmp eax, ebx
jne 0x1006d5e2
mov ebx, dword [esp + 0x20]
push ebx
push esi
call fcn.1006ede0
push eax
push dword [esp + 0x3c]
push dword [esp + 0x28]
call fcn.1006ec10
add esi, eax
mov eax, dword [esp + 0x2c]
cmp ebp, dword [esp + 0x30]
push ebx
cmovb eax, dword [esp + 0x80]
push eax
push edi
call fcn.1006ed70
add esp, 0x20
mov ebx, eax
jmp 0x1006d632
push dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
cmp ebp, ecx
cmovb eax, dword [esp + 0x6c]
push eax
push edi
call fcn.1006ed70
mov edx, dword [esp + 0x28]
add esp, 0xc
mov ebx, eax
cmp ebp, edx
jb 0x1006d636
sub edi, ebx
cmp edi, dword [esp + 0x18]
jne 0x1006d636
cmp dword [esp + 0x50], edx
jae 0x1006d636
push dword [esp + 0x20]
neg eax
push eax
call fcn.1006ede0
push eax
push dword [esp + 0x74]
push dword [esp + 0x64]
call fcn.1006ed70
add esp, 0x14
add ebx, eax
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x5c]
mov eax, ebp
sub eax, ebx
mov ecx, esi
mov ebx, dword [esp + 0x34]
cmp eax, ebx
cmova ebx, eax
sub ecx, ebx
add ecx, ebp
cmp ecx, edi
jb 0x1006d66f
cmp esi, edi
ja 0x1006d66f
sub esi, edi
add esi, ebp
push esi
push edx
call fcn.1006ed50
add esp, 8
mov ebx, edx
test eax, eax
cmovne ebx, esi
jmp 0x1006d524
push ebx
push edx
call fcn.1006ed50
add esp, 8
test eax, eax
jne 0x1006d684
mov ebx, edx
jmp 0x1006d524
cmp ecx, edi
mov edx, edi
cmovb edx, ecx
cmp dword [esp + 0x10], edx
jae 0x1006d6b6
mov ecx, dword [esp + 0x1c]
mov eax, ecx
mov ebp, dword [esp + 0x18]
sub eax, ebp
sub eax, ebx
add eax, dword [esp + 0x24]
cmp eax, 0xffff
ja 0x1006d6d0
sub ebp, ecx
mov dword [esp + 0x10], edx
add ebp, ebx
mov dword [esp + 0x64], ebp
mov ecx, dword [esp + 0x9c]
movzx eax, bx
movzx eax, word [ecx + eax*2 + 0x20000]
cmp eax, ebx
jbe 0x1006d522
mov ebp, dword [esp + 0x34]
cmp dword [esp + 0xc0], 1
jne 0x1006d869
mov ebx, dword [esp + 0x70]
test ebx, ebx
jle 0x1006d869
mov esi, dword [esp + 0x4c]
mov eax, esi
mov edi, dword [esp + 0x24]
sub eax, ebp
cmp eax, 0xffff
jae 0x1006d86d
mov ecx, dword [esp + 0x7c]
push edi
mov edx, dword [ecx + 0x40000]
sub edx, dword [ecx + 0x40004]
add edx, dword [ecx + 0x4000c]
mov dword [esp + 0x58], edx
call fcn.1006ecc0
add esp, 4
mov ebp, dword [ecx + eax*4]
mov ecx, ebp
sub ecx, edx
mov eax, esi
add ecx, dword [esp + 0x34]
sub eax, ecx
mov dword [esp + 0x40], ecx
cmp eax, 0xffff
ja 0x1006d86d
mov eax, ebx
dec ebx
mov dword [esp + 0x70], ebx
test eax, eax
je 0x1006d869
mov eax, dword [esp + 0x7c]
mov esi, dword [eax + 0x40004]
sub esi, dword [eax + 0x4000c]
add esi, ebp
push esi
call fcn.1006f740
add esp, 4
cmp eax, dword [esp + 0x20]
jne 0x1006d840
mov eax, dword [esp + 0x24]
mov edi, eax
sub edi, ebp
add edi, edx
cmp edi, dword [esp + 0x30]
lea edx, [eax + 4]
cmova edi, dword [esp + 0x30]
add esi, 4
mov dword [esp + 0x5c], edx
lea ebx, [edi - 3]
cmp edx, ebx
jae 0x1006d7e4
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006d8ae
add edx, 4
add esi, 4
cmp edx, ebx
jae 0x1006d7e4
push edx
call fcn.1006f750
push esi
mov ecx, eax
call fcn.1006f750
add esp, 8
xor ecx, eax
jne 0x1006d8bc
add edx, 4
add esi, 4
cmp edx, ebx
jb 0x1006d7c1
lea eax, [edi - 1]
cmp edx, eax
jae 0x1006d808
push edx
call fcn.1006f730
push esi
mov cx, ax
call fcn.1006f730
add esp, 8
cmp ax, cx
jne 0x1006d808
add edx, 2
add esi, 2
cmp edx, edi
jae 0x1006d813
mov al, byte [esi]
cmp al, byte [edx]
jne 0x1006d813
inc edx
mov eax, edx
sub eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x40]
add eax, 4
mov edx, dword [esp + 0x54]
mov ebx, dword [esp + 0x70]
cmp eax, dword [esp + 0x10]
jle 0x1006d840
mov dword [esp + 0x10], eax
mov eax, ecx
sub eax, dword [esp + 0x1c]
add eax, dword [esp + 0x18]
mov dword [esp + 0x64], eax
mov edi, dword [esp + 0x7c]
mov esi, dword [esp + 0x4c]
movzx eax, bp
movzx eax, word [edi + eax*2 + 0x20000]
sub ecx, eax
sub ebp, eax
sub esi, ecx
mov dword [esp + 0x40], ecx
cmp esi, 0xffff
jbe 0x1006d746
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x8c]
jle 0x1006d8d0
cmp dword [esp + 0xc4], 0
je 0x1006d89e
xor ecx, ecx
cmp edx, 0x24
setle cl
xor eax, eax
cmp edx, 0x12
setg al
test eax, ecx
mov eax, 0x12
cmovne edx, eax
mov ebx, edi
mov dword [esp + 0x60], edx
sub ebx, dword [esp + 0x64]
mov dword [esp + 0x74], ebx
jmp 0x1006d8d6
push ecx
call fcn.1006ef00
add esp, 4
jmp 0x1006d819
push ecx
call fcn.1006ef00
sub edx, dword [esp + 0x60]
add esp, 4
add eax, edx
jmp 0x1006d819
mov edx, dword [esp + 0x60]
mov ebx, edx
mov eax, edx
mov dword [esp + 0x90], 0
mov ecx, ebx
test eax, eax
je 0x1006dc50
mov esi, eax
mov ebx, dword [esp + 0x44]
cmp eax, dword [esp + 0x94]
ja 0x1006dcfc
add eax, ebx
cmp eax, 0x1000
jge 0x1006dcfc
mov ecx, dword [esp + 0x48]
mov eax, ebx
add eax, eax
mov esi, dword [ecx + eax*8 + 0xc]
mov ebx, esi
lea edi, [esi - 0xf]
cmp esi, 0xf
jl 0x1006d939
mov eax, 0x80808081
imul edi
add edx, edi
sar edx, 7
mov ebx, edx
shr ebx, 0x1f
inc ebx
add ebx, edx
add ebx, esi
lea ebp, [esi + 1]
mov ecx, ebp
cmp ebp, 0xf
jl 0x1006d95e
lea ecx, [ebp - 0xf]
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, 2
add ecx, edx
add ecx, esi
mov edx, dword [esp + 0x44]
mov eax, edx
mov ebp, dword [esp + 0x48]
add eax, eax
mov eax, dword [ebp + eax*8]
sub eax, ebx
lea ebx, [edx + 1]
add eax, ecx
add ebx, ebx
mov ecx, ebp
lea ebp, [esi + 1]
cmp eax, dword [ecx + ebx*8]
jge 0x1006d998
mov dword [ecx + ebx*8 + 8], 1
mov dword [ecx + ebx*8 + 4], 0
mov dword [ecx + ebx*8 + 0xc], ebp
mov dword [ecx + ebx*8], eax
cmp esi, 0xf
jl 0x1006d9b5
mov eax, 0x80808081
imul edi
add edx, edi
sar edx, 7
mov edi, edx
shr edi, 0x1f
inc edi
add edi, edx
add edi, esi
jmp 0x1006d9b7
mov edi, esi
inc ebp
mov ecx, ebp
cmp ebp, 0xf
jl 0x1006d9da
lea ecx, [esi - 0xd]
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, 3
add ecx, edx
add ecx, esi
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
add eax, eax
mov eax, dword [edx + eax*8]
sub eax, edi
add eax, ecx
cmp eax, dword [edx + ebx*8 + 0x10]
jge 0x1006da09
mov dword [edx + ebx*8 + 0x18], 1
mov dword [edx + ebx*8 + 0x14], 0
mov dword [edx + ebx*8 + 0x1c], ebp
mov dword [edx + ebx*8 + 0x10], eax
mov ebx, esi
cmp esi, 0xf
jl 0x1006da29
lea ecx, [esi - 0xf]
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ebx, edx
shr ebx, 0x1f
inc ebx
add ebx, edx
add ebx, esi
lea edi, [esi + 3]
mov edx, edi
cmp edi, 0xf
jl 0x1006da4e
lea ecx, [esi - 0xc]
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
add edx, 4
shr eax, 0x1f
add edx, eax
add edx, esi
mov ebp, dword [esp + 0x44]
mov eax, ebp
mov ecx, dword [esp + 0x48]
add eax, eax
mov ecx, dword [ecx + eax*8]
sub ecx, ebx
mov ebx, dword [esp + 0x48]
add ecx, edx
lea edx, [ebp + 3]
add edx, edx
cmp ecx, dword [ebx + edx*8]
jge 0x1006da92
mov eax, ebp
mov dword [ebx + edx*8], ecx
add eax, eax
mov dword [ebx + eax*8 + 0x38], 1
mov eax, ebp
add eax, eax
mov dword [ebx + eax*8 + 0x34], 0
mov eax, ebp
add eax, eax
mov dword [ebx + eax*8 + 0x3c], edi
mov esi, 4
cmp dword [esp + 0x60], esi
jl 0x1006dbe2
mov ecx, ebp
mov edx, ebp
shl ecx, 4
shl edx, 4
add ecx, 8
add edx, 0xc
shl ebp, 4
add ecx, ebx
add edx, ebx
add ebp, ebx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x80], edx
mov dword [esp + 0x54], ebp
lea ebx, [ebp + 0x44]
nop
cmp dword [ecx], 1
jne 0x1006db45
mov edi, dword [edx]
mov eax, dword [esp + 0x44]
cmp eax, edi
jle 0x1006daf0
mov ecx, dword [esp + 0x48]
sub eax, edi
add eax, eax
mov eax, dword [ecx + eax*8]
mov dword [esp + 0x5c], eax
jmp 0x1006daf8
mov dword [esp + 0x5c], 0
mov ebp, edi
cmp edi, 0xf
jl 0x1006db18
lea ecx, [edi - 0xf]
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ebp, edx
shr ebp, 0x1f
inc ebp
add ebp, edx
add ebp, edi
add ebp, 3
cmp esi, 0x13
jl 0x1006db39
lea ecx, [esi - 0x13]
mov eax, 0x80808081
imul ecx
inc ebp
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebp, eax
mov ecx, dword [esp + 0x5c]
add ecx, ebp
mov ebp, dword [esp + 0x54]
jmp 0x1006db6d
xor edi, edi
lea eax, [edi + 3]
cmp esi, 0x13
jl 0x1006db68
lea ecx, [esi - 0x13]
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, 4
add eax, edx
mov ecx, dword [ebp]
add ecx, eax
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x2c]
add edx, esi
add eax, 3
cmp edx, eax
jg 0x1006db8c
mov eax, dword [ebx - 4]
sub eax, dword [esp + 0xc4]
cmp ecx, eax
jg 0x1006dbbc
mov eax, dword [esp + 0x60]
cmp esi, eax
jne 0x1006dbab
mov ebp, dword [esp + 0x2c]
cmp ebp, edx
cmovl ebp, edx
mov edx, ebp
mov dword [esp + 0x2c], ebp
mov ebp, dword [esp + 0x54]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x74]
mov dword [ebx + 4], esi
mov dword [ebx], edx
mov dword [ebx + 8], edi
mov dword [ebx - 4], ecx
jmp 0x1006dbc0
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x8c]
inc esi
mov edx, dword [esp + 0x80]
add ebx, 0x10
cmp esi, eax
jle 0x1006dad0
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x48]
mov edi, dword [esp + 0x2c]
mov ecx, edi
add ecx, ecx
lea edx, [edi + 1]
shl edx, 4
add edx, ebx
mov dword [edx + 8], 1
mov dword [edx + 4], 0
mov dword [edx + 0xc], 1
mov eax, dword [ebx + ecx*8]
inc eax
mov dword [edx + 0x18], 1
mov dword [edx], eax
mov dword [edx + 0x14], 0
mov dword [edx + 0x1c], 2
mov eax, dword [ebx + ecx*8]
add eax, 2
mov dword [edx + 0x28], 1
mov dword [edx + 0x10], eax
lea eax, [edi + 3]
mov dword [edx + 0x24], 0
mov dword [edx + 0x2c], 3
mov ecx, dword [ebx + ecx*8]
add ecx, 3
add eax, eax
mov dword [ebx + eax*8], ecx
jmp 0x1006dc5c
mov ebp, dword [esp + 0x44]
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x48]
inc ebp
mov dword [esp + 0x44], ebp
cmp ebp, edi
jl 0x1006c5f2
mov eax, edi
add eax, eax
mov esi, dword [ebx + eax*8 + 8]
mov ecx, dword [ebx + eax*8 + 4]
mov ebx, edi
sub ebx, esi
mov edi, dword [esp + 0x48]
mov eax, ebx
mov ebp, dword [esp + 0x48]
add eax, eax
mov edx, dword [edi + eax*8 + 8]
mov edi, dword [edi + eax*8 + 4]
mov dword [ebp + eax*8 + 8], esi
mov esi, ebp
mov ebp, dword [esp + 0x2c]
mov dword [esi + eax*8 + 4], ecx
mov esi, edx
cmp edx, ebx
jg 0x1006dcc6
mov ebp, dword [esp + 0x48]
sub ebx, edx
mov ecx, ebx
shl ecx, 4
add ecx, ebp
mov edx, dword [ecx + 8]
mov eax, dword [ecx + 4]
mov dword [ecx + 8], esi
mov esi, edx
mov dword [ecx + 4], edi
mov edi, eax
cmp edx, ebx
jle 0x1006dca5
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
test ebp, ebp
jle 0x1006dea1
mov ecx, dword [esp + 0x48]
mov eax, ebx
add eax, eax
mov esi, dword [ecx + eax*8 + 8]
mov ecx, dword [ecx + eax*8 + 4]
mov dword [esp + 0x54], esi
mov dword [esp + 0x38], ecx
cmp esi, 1
jne 0x1006dd08
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x6c]
inc ecx
inc ebx
jmp 0x1006de93
lea ebp, [ebx + 1]
mov dword [esp + 0x2c], ebp
jmp 0x1006dc79
mov edi, dword [esp + 0x3c]
add ebx, esi
mov eax, dword [esp + 0x28]
mov ebp, edi
sub eax, ecx
mov dword [esp + 0x40], edi
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x6c]
mov dword [esp + 0x58], edi
inc edi
cmp dword [esp + 0xb8], 0
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x80], eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x5c], ecx
je 0x1006dd62
mov eax, 0x80808081
mul ecx
lea eax, [ecx + 8]
shr edx, 7
add eax, edx
add eax, edi
cmp eax, dword [esp + 0x78]
ja 0x1006ded4
cmp ecx, 0xf
jb 0x1006ddb2
lea ebx, [ecx - 0xf]
mov byte [ebp], 0xf0
cmp ebx, 0xff
jb 0x1006dda2
mov eax, 0x80808081
mul ebx
mov esi, edx
shr esi, 7
push esi
push 0xff
push edi
call fcn.10002d38
add esp, 0xc
add edi, esi
sub ebx, 0xff
sub esi, 1
jne 0x1006dd93
mov ecx, dword [esp + 0x5c]
mov byte [edi], bl
inc edi
mov ebx, dword [esp + 0x8c]
mov dword [esp + 0x3c], edi
jmp 0x1006ddba
mov al, cl
shl al, 4
mov byte [ebp], al
mov esi, dword [esp + 0x6c]
mov edx, edi
add edi, ecx
sub esi, dword [esp + 0x3c]
mov eax, dword [esi + edx]
mov ecx, dword [esi + edx + 4]
mov dword [edx], eax
mov dword [edx + 4], ecx
add edx, 8
cmp edx, edi
jb 0x1006ddc6
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x80]
mov edi, dword [esp + 0x3c]
add edi, dword [esp + 0x5c]
push eax
push edi
call fcn.1006f9b0
mov esi, dword [esp + 0x5c]
add edi, 2
add esp, 8
mov dword [esp + 0x3c], edi
cmp dword [esp + 0xb8], 0
lea ecx, [esi - 4]
je 0x1006de27
mov eax, 0x80808081
mul ecx
lea eax, [edi + 6]
shr edx, 7
add eax, edx
cmp eax, dword [esp + 0x78]
ja 0x1006ded4
mov eax, dword [esp + 0x58]
mov al, byte [eax]
cmp ecx, 0xf
jb 0x1006de7e
add al, 0xf
sub ecx, 0xf
mov byte [ebp], al
cmp ecx, 0x1fe
jb 0x1006de63
mov eax, 0x80808081
mul ecx
shr edx, 8
nop dword [eax]
mov word [edi], 0xffff
sub ecx, 0x1fe
add edi, 2
sub edx, 1
jne 0x1006de50
cmp ecx, 0xff
jb 0x1006de75
sub ecx, 0xff
mov byte [edi], 0xff
inc edi
mov byte [edi], cl
inc edi
mov dword [esp + 0x3c], edi
jmp 0x1006de83
add cl, al
mov byte [ebp], cl
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
add ecx, esi
mov edi, ecx
mov dword [esp + 0x6c], edi
mov dword [esp + 0x28], ecx
cmp ebx, ebp
jl 0x1006dcd0
jmp 0x1006dea9
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x6c]
mov eax, dword [esp + 0x88]
add eax, 0xfffffff4
cmp ecx, eax
ja 0x1006e099
mov esi, dword [esp + 0x9c]
jmp 0x1006b8c0
mov esi, dword [esp + 0xb8]
mov eax, dword [esp + 0x28]
jmp 0x1006dee9
mov eax, dword [esp + 0x28]
mov edi, eax
sub edi, dword [esp + 0x38]
mov dword [esp + 0x2c], esi
mov esi, dword [esp + 0xb8]
cmp esi, 2
jne 0x1006e185
mov ebp, dword [esp + 0x40]
mov ebx, eax
sub ebx, dword [esp + 0x6c]
mov eax, 0x80808081
mov dword [esp + 0x8c], ebx
mov esi, ebp
lea ecx, [ebx + 0xf0]
mul ecx
mov ecx, dword [esp + 0x78]
shr edx, 7
add ecx, 0xfffffffd
inc edx
add edx, ebx
lea eax, [edx + ebp]
cmp eax, ecx
ja 0x1006e0a5
sub ecx, edx
sub ecx, ebp
imul eax, ecx, 0xff
mov ecx, dword [esp + 0x2c]
add eax, 0x12
cmp ecx, eax
cmova ecx, eax
mov eax, dword [esp + 0x78]
sub eax, edx
mov dword [esp + 0x2c], ecx
sub eax, ebp
add eax, 2
add eax, ecx
cmp eax, 0xc
jl 0x1006e0a5
lea ecx, [ebp + 1]
mov dword [esp + 0x3c], ecx
cmp ebx, 0xf
jb 0x1006dfbb
add ebx, 0xfffffff1
mov byte [ebp], 0xf0
cmp ebx, 0xff
jb 0x1006dfab
mov eax, 0x80808081
mul ebx
mov esi, edx
shr esi, 7
push esi
push 0xff
push ecx
call fcn.10002d38
mov ecx, dword [esp + 0x48]
add esp, 0xc
add ecx, esi
nop word [eax + eax]
sub ebx, 0xff
sub esi, 1
jne 0x1006dfa0
mov byte [ecx], bl
inc ecx
mov ebx, dword [esp + 0x8c]
mov dword [esp + 0x3c], ecx
jmp 0x1006dfc3
mov al, bl
shl al, 4
mov byte [ebp], al
mov ebp, dword [esp + 0x6c]
lea esi, [ebx + ecx]
mov edx, ecx
sub ebp, ecx
nop
mov eax, dword [edx + ebp]
mov ecx, dword [edx + ebp + 4]
mov dword [edx], eax
mov dword [edx + 4], ecx
add edx, 8
cmp edx, esi
jb 0x1006dfd0
mov esi, dword [esp + 0x3c]
add esi, ebx
mov ebx, dword [esp + 0x28]
mov eax, ebx
sub eax, edi
push eax
push esi
call fcn.1006f9b0
mov edx, dword [esp + 0x34]
add esp, 8
mov ebp, dword [esp + 0x40]
add esi, 2
lea ecx, [edx - 4]
mov al, byte [ebp]
cmp ecx, 0xf
jb 0x1006e05e
add al, 0xf
sub ecx, 0xf
mov byte [ebp], al
cmp ecx, 0x1fe
jb 0x1006e047
mov eax, 0x80808081
mul ecx
shr edx, 8
nop dword [eax + eax]
mov word [esi], 0xffff
sub ecx, 0x1fe
add esi, 2
sub edx, 1
jne 0x1006e030
mov edx, dword [esp + 0x2c]
cmp ecx, 0xff
jb 0x1006e059
sub ecx, 0xff
mov byte [esi], 0xff
inc esi
mov byte [esi], cl
inc esi
jmp 0x1006e063
add cl, al
mov byte [ebp], cl
mov ebp, dword [esp + 0x88]
lea edi, [edx + ebx]
mov ebx, dword [esp + 0x78]
sub ebp, edi
mov eax, 0x80808081
mov dword [esp + 0x6c], edi
mov dword [esp + 0x38], ebp
lea ecx, [ebp + 0xf0]
mul ecx
mov ecx, dword [esp + 0xb8]
shr edx, 7
add edx, ebp
add ebx, 5
jmp 0x1006e0e1
mov esi, dword [esp + 0x3c]
jmp 0x1006e0a9
mov esi, dword [esp + 0x3c]
jmp 0x1006e0ad
mov edi, dword [esp + 0x6c]
mov ebx, dword [esp + 0x78]
mov ebp, dword [esp + 0x88]
mov eax, 0x80808081
sub ebp, edi
mov dword [esp + 0x38], ebp
lea ecx, [ebp + 0xf0]
mul ecx
mov ecx, dword [esp + 0xb8]
shr edx, 7
add edx, ebp
cmp ecx, 2
jne 0x1006e0dd
add ebx, 5
jmp 0x1006e0e1
test ecx, ecx
je 0x1006e107
lea eax, [esi + 1]
add eax, edx
cmp eax, ebx
jbe 0x1006e107
cmp ecx, 1
je 0x1006e185
sub ebx, esi
dec ebx
lea eax, [ebx + 0xf1]
shr eax, 8
sub ebx, eax
mov dword [esp + 0x38], ebx
jmp 0x1006e10b
mov ebx, dword [esp + 0x38]
lea ebp, [ebx + edi]
lea edi, [esi + 1]
cmp ebx, 0xf
jb 0x1006e155
add ebx, 0xfffffff1
mov byte [esi], 0xf0
cmp ebx, 0xff
jb 0x1006e14c
mov eax, 0x80808081
mul ebx
mov esi, edx
shr esi, 7
push esi
push 0xff
push edi
call fcn.10002d38
add esp, 0xc
add edi, esi
sub ebx, 0xff
sub esi, 1
jne 0x1006e141
mov byte [edi], bl
inc edi
mov ebx, dword [esp + 0x38]
jmp 0x1006e15c
mov al, bl
shl al, 4
mov byte [esi], al
push ebx
push dword [esp + 0x70]
push edi
call fcn.10004eda
mov eax, dword [esp + 0xb4]
add esp, 0xc
sub ebp, dword [esp + 0xa0]
sub ebx, dword [esp + 0xa4]
add ebx, edi
mov dword [eax], ebp
jmp 0x1006e187
xor ebx, ebx
push dword [esp + 0x48]
call fcn.10003b2f
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret