Function at 0x527cb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1b
push 0
push 0
dec ecx
jne 0x527cb8
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x529dbf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68e770]
mov byte [eax], 2
mov eax, dword [0x68e9b0]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov eax, dword [eax + 0xf0]
add eax, 0x60
mov edx, dword [0x68e9b0]
add eax, dword [edx]
push eax
lea eax, [ebp - 0x94]
push eax
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov ecx, dword [eax + 0xec]
add ecx, 0xc0
mov eax, dword [0x68e9d8]
add ecx, dword [eax]
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov edx, dword [eax + 0xf0]
add edx, 0x60
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov eax, dword [eax + 0xec]
add eax, 0xc0
call fcn.004819d4
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
push eax
push 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
xor ecx, ecx
xor edx, edx
call fcn.00486038
mov eax, dword [0x68e9d8]
cmp dword [eax], 0x400
jne 0x527d92
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov edx, 0xffffff40
sub edx, dword [eax + 0xec]
add edx, 0x1e
add edx, 0xe
mov dword [ebp - 0x30], edx
jmp 0x527daa
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov edx, 0xfffffee0
sub edx, dword [eax + 0xec]
add edx, 0x1e
mov dword [ebp - 0x30], edx
mov eax, dword [0x68e9b0]
cmp dword [eax], 0x300
jne 0x527dce
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov edx, 0xffffffc0
sub edx, dword [eax + 0xf0]
mov dword [ebp - 0x34], edx
jmp 0x527de3
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov edx, 0xffffff60
sub edx, dword [eax + 0xf0]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x34], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0x38], edx
mov eax, dword [ebp - 0x34]
sub eax, 0x20
mov dword [ebp - 0x20], eax
xor edx, edx
push ebp
push 0x528280
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x68f0c8]
mov eax, dword [eax]
mov eax, dword [eax + 0xa6f85]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa8]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
mov edx, dword [edx + 0xa6f8d]
mov ecx, dword [0x68f0c8]
mov ecx, dword [ecx]
sub edx, dword [ecx + 0xa6fa8]
add edx, 0x23
sub edx, eax
jl 0x528276
inc edx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x527e64
add dword [ebp - 0x20], 0x20
jmp 0x52826a
mov edi, dword [ebp - 0x30]
sub edi, 0x60
mov eax, dword [0x68f0c8]
mov eax, dword [eax]
mov eax, dword [eax + 0xa6f81]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa4]
sub eax, 2
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
mov edx, dword [edx + 0xa6f89]
mov ecx, dword [0x68f0c8]
mov ecx, dword [ecx]
sub edx, dword [ecx + 0xa6fa4]
add edx, 2
sub edx, eax
jl 0x528266
inc edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x528254
cmp dword [ebp - 0x10], 0x5a
jge 0x528254
cmp dword [ebp - 0x14], 0
jl 0x528254
cmp dword [ebp - 0x14], 0x5a
jge 0x528254
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*8]
movzx ecx, word [eax + edx*4 + 0xe]
test ecx, ecx
jle 0x52810e
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*8]
cmp byte [eax + edx*4 + 0x20], 0
jbe 0x52810e
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*8]
movzx ebx, byte [eax + edx*4 + 0x20]
mov byte [ebp - 0x5d], 0
test ebx, 0x80
jle 0x527f59
mov byte [ebp - 0x5d], 1
and ebx, 0x7f
test ebx, ebx
jle 0x527fc5
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*8]
movzx eax, word [eax + edx*4 + 0x1e]
shr eax, 0xc
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov edx, ebx
imul edx, dword [ebp - 0x3c]
add ebx, edx
cdq
idiv ebx
mov eax, edx
mov edx, dword [ebp - 0x3c]
inc edx
mov ebx, edx
cdq
idiv ebx
imul edx, dword [ebp - 0x10], 0x441
mov ebx, dword [0x68f0c8]
mov ebx, dword [ebx]
lea edx, [ebx + edx*4]
mov ebx, dword [ebp - 0x14]
lea ebx, [ebx + ebx*8]
movzx edx, word [edx + ebx*4 + 0x1e]
and dx, 0xfff
movzx edx, dx
imul edx
add ecx, eax
dec ecx
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*8]
movzx eax, byte [eax + edx*4 + 0x19]
cmp eax, 5
ja case.0x527fec.0
jmp dword [eax*4 + 0x527ff3]
lea eax, [ebp - 0x50]
push eax
mov eax, dword [0x68e7e0]
mov eax, dword [eax]
lea edx, [ebp - 0x4c]
xchg ecx, edx
call fcn.0048eb10
mov ebx, eax
jmp 0x52809f
lea eax, [ebp - 0x50]
push eax
mov eax, dword [0x68e2f8]
mov eax, dword [eax]
lea edx, [ebp - 0x4c]
xchg ecx, edx
call fcn.0048eb10
mov ebx, eax
jmp 0x52809f
lea eax, [ebp - 0x50]
push eax
mov eax, dword [0x68ee24]
mov eax, dword [eax]
lea edx, [ebp - 0x4c]
xchg ecx, edx
call fcn.0048eb10
mov ebx, eax
jmp 0x52809f
lea eax, [ebp - 0x50]
push eax
mov eax, dword [0x68e57c]
mov eax, dword [eax]
lea edx, [ebp - 0x4c]
xchg ecx, edx
call fcn.0048eb10
mov ebx, eax
jmp 0x52809f
lea eax, [ebp - 0x50]
push eax
mov eax, dword [0x68e458]
mov eax, dword [eax]
lea edx, [ebp - 0x4c]
xchg ecx, edx
call fcn.0048eb10
mov ebx, eax
jmp 0x52809f
lea eax, [ebp - 0x50]
push eax
mov eax, dword [0x68eb08]
mov eax, dword [eax]
lea edx, [ebp - 0x4c]
xchg ecx, edx
call fcn.0048eb10
mov ebx, eax
test ebx, ebx
je 0x52810e
cmp byte [ebp - 0x5d], 0
je 0x5280ca
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x24], eax
push ebx
push 1
mov edx, dword [ebp - 0x4c]
add edx, edi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
call fcn.005b8c5c
jmp 0x52810e
mov eax, ebx
mov si, 0xfff8
call fcn.00404528
mov edx, dword [ebp - 0x20]
add edx, 0x20
sub edx, eax
add edx, dword [ebp - 0x50]
mov dword [ebp - 0x24], edx
lea edx, [ebp - 0x94]
mov eax, ebx
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
push ebx
push 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
mov edx, edi
call fcn.00486038
imul edx, dword [ebp - 0x10], 0x441
mov ecx, dword [0x68f0c8]
mov ecx, dword [ecx]
lea edx, [ecx + edx*4]
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*8]
movzx ecx, word [edx + eax*4 + 0x1a]
and cx, 0x7fff
movzx ecx, cx
test ecx, ecx
jle 0x528254
imul edx, dword [ebp - 0x10], 0x441
mov ebx, dword [0x68f0c8]
mov ebx, dword [ebx]
lea edx, [ebx + edx*4]
movzx ebx, byte [edx + eax*4 + 0x21]
mov byte [ebp - 0x5d], 0
test ebx, 0x80
jle 0x528165
mov byte [ebp - 0x5d], 1
and ebx, 0x7f
test ebx, ebx
jle 0x5281cd
imul edx, dword [ebp - 0x10], 0x441
mov esi, dword [0x68f0c8]
mov esi, dword [esi]
lea edx, [esi + edx*4]
push edx
pop edx
movzx eax, word [edx + eax*4 + 0x22]
shr eax, 0xc
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov edx, ebx
imul edx, dword [ebp - 0x3c]
add ebx, edx
cdq
idiv ebx
mov eax, edx
mov edx, dword [ebp - 0x3c]
inc edx
mov ebx, edx
cdq
idiv ebx
imul edx, dword [ebp - 0x10], 0x441
mov ebx, dword [0x68f0c8]
mov ebx, dword [ebx]
lea edx, [ebx + edx*4]
mov ebx, dword [ebp - 0x14]
lea ebx, [ebx + ebx*8]
movzx edx, word [edx + ebx*4 + 0x22]
and dx, 0xfff
movzx edx, dx
imul edx
add ecx, eax
dec ecx
lea eax, [ebp - 0x50]
push eax
mov eax, dword [0x68e808]
mov eax, dword [eax]
lea edx, [ebp - 0x4c]
xchg ecx, edx
call fcn.0048eb10
mov ebx, eax
test ebx, ebx
je 0x528254
cmp byte [ebp - 0x5d], 0
je 0x528210
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x24], eax
push ebx
push 1
mov edx, dword [ebp - 0x4c]
add edx, edi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
call fcn.005b8c5c
jmp 0x528254
mov eax, ebx
mov si, 0xfff8
call fcn.00404528
mov edx, dword [ebp - 0x20]
add edx, 0x20
sub edx, eax
add edx, dword [ebp - 0x50]
mov dword [ebp - 0x24], edx
lea edx, [ebp - 0x94]
mov eax, ebx
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
push ebx
push 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
mov edx, edi
call fcn.00486038
add edi, 0x30
inc dword [ebp - 0x10]
dec dword [ebp - 0x84]
jne 0x527eb9
add dword [ebp - 0x20], 0x20
inc dword [ebp - 0x14]
dec dword [ebp - 0x80]
jne 0x527e55
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52828a
mov eax, dword [ebp - 0x34]
sub eax, 0x20
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x7c], eax
xor edx, edx
push ebp
push 0x5298a4
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0x10]
lea ebx, [ebx + ebx*2]
mov eax, dword [ebp - 8]
mov eax, dword [eax + ebx*8 + 0x44]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + ebx*8 + 0x48]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + ebx*8 + 0x50]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + ebx*8 + 0x4c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + ebx*8 + 0x54]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + ebx*8 + 0x58]
mov edx, dword [eax]
call dword [edx + 8]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x29
jne 0x5282ab
mov dword [ebp - 0x7c], 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x420]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x68eaec]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x5283f5
mov dword [ebp - 0x10], eax
mov eax, dword [0x68eaec]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x10]
call fcn.0041a308
mov ecx, eax
mov eax, dword [ecx + 4]
mov edx, dword [0x68eab8]
mov edx, dword [edx]
sub eax, dword [edx + 0xc]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xf
jle 0x528396
mov eax, dword [ecx + 8]
mov edx, dword [0x68eab8]
mov edx, dword [edx]
sub eax, dword [edx + 0x10]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xf
jle 0x528396
cmp byte [ecx + 0x68], 0
jne 0x528396
mov eax, ecx
call fcn.0040432c
mov eax, dword [0x68eaec]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x10]
call fcn.0041a1fc
jmp 0x5283f5
mov eax, dword [ecx + 8]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa8]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
mov edx, dword [edx + 0xa6f85]
mov ebx, dword [0x68f0c8]
mov ebx, dword [ebx]
sub edx, dword [ebx + 0xa6fa8]
sub eax, edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x5283e8
cmp dword [ebp - 0x18], 0x28
jg 0x5283e8
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x58]
mov edx, ecx
call fcn.0041a1b0
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffff
jne 0x528331
mov dword [ebp - 0x7c], 2
mov eax, dword [0x68e3f0]
mov eax, dword [eax]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x528506
mov dword [ebp - 0x10], eax
mov eax, dword [0x68e3f0]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
call fcn.0041a308
mov ebx, eax
mov eax, dword [ebx]
mov edx, dword [0x68eab8]
mov edx, dword [edx]
sub eax, dword [edx + 0xc]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x14
jle 0x52846d
mov eax, dword [ebx + 4]
mov edx, dword [0x68eab8]
mov edx, dword [edx]
sub eax, dword [edx + 0x10]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x14
jle 0x52846d
xor edx, edx
mov eax, ebx
call fcn.005828a4
mov eax, dword [0x68e3f0]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
call fcn.0041a1fc
jmp 0x5284a7
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub eax, dword [ebx]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xa
jg 0x5284f9
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
sub eax, dword [ebx + 4]
cmp eax, 0xa
jg 0x5284f9
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
sub eax, dword [ebx + 4]
cmp eax, 0xfffffff2
jl 0x5284f9
mov eax, dword [ebx + 4]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa8]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
mov edx, dword [edx + 0xa6f85]
mov ecx, dword [0x68f0c8]
mov ecx, dword [ecx]
sub edx, dword [ecx + 0xa6fa8]
sub eax, edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x5284f9
cmp dword [ebp - 0x18], 0x28
jg 0x5284f9
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x44]
mov edx, ebx
call fcn.0041a1b0
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffff
jne 0x528413
mov dword [ebp - 0x7c], 3
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x424]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x528668
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x424]
mov edx, dword [ebp - 0x10]
call fcn.0041a308
mov edi, eax
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub eax, dword [edi + 0xc]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xa
jg 0x52865c
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
sub eax, dword [edi + 0x10]
cmp eax, 0xa
jg 0x52865c
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
sub eax, dword [edi + 0x10]
cmp eax, 0xfffffff2
jl 0x52865c
mov eax, dword [edi + 0x154]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa8]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
mov edx, dword [edx + 0xa6f85]
mov ecx, dword [0x68f0c8]
mov ecx, dword [ecx]
sub edx, dword [ecx + 0xa6fa8]
sub eax, edx
sub eax, dword [edi + 0x158]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x52865c
cmp dword [ebp - 0x18], 0x28
jg 0x52865c
cmp byte [edi + 0x2bd], 0
je 0x5285ef
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x420]
mov edx, edi
call fcn.0041a1b0
cmp byte [edi + 0x31], 0
je 0x528616
mov eax, dword [0x68e600]
cmp byte [eax + 0x38], 0
jne 0x52865c
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x4c]
mov edx, edi
call fcn.0041a1b0
jmp 0x52865c
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x48]
mov edx, edi
call fcn.0041a1b0
cmp byte [edi + 0x134], 0
je 0x52865c
cmp byte [edi + 0x16], 0
jne 0x52865c
cmp byte [edi + 0x136], 0
je 0x52865c
cmp dword [ebp - 0x18], 0
jle 0x52865c
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x38]
mov edx, edi
call fcn.0041a1b0
inc dword [ebp - 0x10]
dec dword [ebp - 0x80]
jne 0x52852d
mov dword [ebp - 0x7c], 4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x42c]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x5286f8
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x42c]
mov edx, dword [ebp - 0x10]
call fcn.0041a308
mov esi, eax
mov eax, dword [esi + 0x34]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa8]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
mov edx, dword [edx + 0xa6f85]
mov ecx, dword [0x68f0c8]
mov ecx, dword [ecx]
sub edx, dword [ecx + 0xa6fa8]
sub eax, edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x5286f0
cmp dword [ebp - 0x18], 0x28
jg 0x5286f0
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x54]
mov edx, esi
call fcn.0041a1b0
inc dword [ebp - 0x10]
dec dword [ebp - 0x80]
jne 0x52868b
mov dword [ebp - 0x7c], 5
mov eax, dword [0x68f0c8]
mov eax, dword [eax]
mov eax, dword [eax + 0xa6f85]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa8]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
mov edx, dword [edx + 0xa6f8d]
mov ecx, dword [0x68f0c8]
mov ecx, dword [ecx]
sub edx, dword [ecx + 0xa6fa8]
add edx, 0x23
sub edx, eax
jl 0x5291eb
inc edx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x528757
add dword [ebp - 0x20], 0x20
jmp 0x5291df
mov edi, dword [ebp - 0x30]
sub edi, 0x60
mov eax, dword [0x68f0c8]
mov eax, dword [eax]
mov eax, dword [eax + 0xa6f81]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa4]
sub eax, 2
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
mov edx, dword [edx + 0xa6f89]
mov ecx, dword [0x68f0c8]
mov ecx, dword [ecx]
sub edx, dword [ecx + 0xa6fa4]
add edx, 2
sub edx, eax
jl 0x528b25
inc edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x528b13
cmp dword [ebp - 0x10], 0x5a
jge 0x528b13
cmp dword [ebp - 0x14], 0
jl 0x528b13
cmp dword [ebp - 0x14], 0x5a
jge 0x528b13
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
mov esi, dword [ebp - 0x14]
lea esi, [esi + esi*8]
movzx ecx, word [eax + esi*4 + 0x10]
and cx, 0x7fff
movzx ecx, cx
test ecx, ecx
jle 0x528b13
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
movzx ebx, byte [eax + esi*4 + 0x14]
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
push eax
pop eax
movzx eax, byte [eax + esi*4 + 0x16]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x5d], 0
test ebx, 0x80
jle 0x528847
mov byte [ebp - 0x5d], 1
and ebx, 0x7f
test ebx, ebx
jle 0x528885
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
push eax
pop eax
movzx eax, byte [eax + esi*4 + 0x15]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov edx, ebx
imul edx, dword [ebp - 0x3c]
add ebx, edx
cdq
idiv ebx
mov eax, edx
mov edx, dword [ebp - 0x3c]
inc edx
mov ebx, edx
cdq
idiv ebx
add ecx, eax
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
test byte [eax + esi*4 + 0x13], 0x80
jbe 0x5288db
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
test byte [eax + esi*4 + 0x12], 0x7f
jbe 0x5288db
imul eax, dword [ebp - 0x10], 0x441
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*8]
movzx eax, byte [eax + edx*4 + 0x13]
and al, 0x7f
movzx eax, al
mov dh, 0xc0
add ecx, eax
dec ecx
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x4c]
mov edx, ecx
mov ecx, dword [ebp - 0x38]
xchg ecx, eax
call fcn.00582ca8
mov ebx, eax
test ebx, ebx
je 0x528b13
cmp byte [ebp - 0x5d], 0
je 0x52898b
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x50]
sub eax, 0x44
mov dword [ebp - 0x24], eax
test edi, edi
jle 0x528961
mov eax, ebx
mov si, 0xfff8
call fcn.00404528
add eax, dword [ebp - 0x24]
test eax, eax
jle 0x528961
mov eax, ebx
mov si, 0xfff9
call fcn.00404528
add eax, edi
mov edx, dword [0x68e9d8]
cmp eax, dword [edx]
jge 0x528961
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x58]
jge 0x528961
push ebx
push 1
mov edx, dword [ebp - 0x4c]
add edx, edi
sub edx, 2
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
call fcn.005b8c5c
jmp 0x528b13
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x58]
jge 0x528b13
push ebx
push 1
mov edx, dword [ebp - 0x4c]
add edx, edi
sub edx, 2
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
call fcn.005b8c5c
jmp 0x528b13
mov eax, ebx
mov si, 0xfff9
call fcn.00404528
cmp eax, 0x30
jne 0x528a69
mov eax, ebx
mov si, 0xfff8
call fcn.00404528
cmp eax, 0x20
jne 0x528a69
mov eax, ebx
mov si, 0xfff8
call fcn.00404528
mov edx, dword [ebp - 0x20]
add edx, 0x20
sub edx, eax
mov dword [ebp - 0x24], edx
mov eax, ebx
mov si, 0xfff9
call fcn.00404528
add eax, edi
test eax, eax
jle 0x528a2d
mov eax, dword [0x68e9d8]
cmp edi, dword [eax]
jg 0x528a2d
mov eax, ebx
mov si, 0xfff8
call fcn.00404528
add eax, dword [ebp - 0x24]
test eax, eax
jle 0x528a2d
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x58]
jge 0x528a2d
lea edx, [ebp - 0x94]
mov eax, ebx
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
push ebx
push 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
mov edx, edi
call fcn.00486038
jmp 0x528b13
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x58]
jge 0x528b13
lea edx, [ebp - 0x94]
mov eax, ebx
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
push ebx
push 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
mov edx, edi
call fcn.00486038
jmp 0x528b13
mov eax, ebx
mov si, 0xfff8
call fcn.00404528
mov edx, dword [ebp - 0x20]
add edx, 0x20
sub edx, eax
mov dword [ebp - 0x24], edx
mov eax, ebx
mov si, 0xfff9
call fcn.00404528
add eax, edi
test eax, eax
jle 0x528ae0
mov eax, dword [0x68e9d8]
cmp edi, dword [eax]
jg 0x528ae0
mov eax, ebx
mov si, 0xfff8
call fcn.00404528
add eax, dword [ebp - 0x24]
test eax, eax
jle 0x528ae0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x58]
jge 0x528ae0
lea edx, [ebp - 0x94]
mov eax, ebx
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
push ebx
push 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
mov edx, edi
call fcn.00486038
jmp 0x528b13
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x58]
jge 0x528b13
lea edx, [ebp - 0x94]
mov eax, ebx
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
push ebx
push 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x24]
mov edx, edi
call fcn.00486038
add edi, 0x30
inc dword [ebp - 0x10]
dec dword [ebp - 0x84]
jne 0x5287ac
mov eax, dword [0x68f0c8]
mov eax, dword [eax]
mov eax, dword [eax + 0xa6f8d]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa8]
cmp eax, dword [ebp - 0x14]
jl 0x5291db
mov eax, dword [0x68e2fc]
cmp byte [eax], 0
jne 0x5291db
mov eax, dword [0x68f0c8]
mov eax, dword [eax]
mov eax, dword [eax + 0xa6f85]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6fa8]
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x58]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x528be1
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x58]
mov edx, dword [ebp - 0x1c]
call fcn.0041a308
mov ecx, eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ecx + 4]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
shl eax, 4
lea eax, [eax + eax*2]
add eax, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0xc]
xchg ecx, eax
mov si, 0xffff
call fcn.00404528
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x528b93
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x4c]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x528ccb
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x4c]
mov edx, dword [ebp - 0x1c]
call fcn.0041a308
mov edi, eax
mov eax, dword [edi + 0x150]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
shl eax, 4
lea eax, [eax + eax*2]
add eax, dword [ebp - 0x30]
add eax, dword [edi + 0xec]
add eax, 0x18
mov dword [edi + 0xd4], eax
mov eax, dword [ebp - 0x20]
add eax, 0x20
add eax, dword [edi + 0xf0]
add eax, 0x10
sub eax, 0x3c
mov edx, dword [edi + 0x158]
shl edx, 5
add eax, edx
mov dword [edi + 0xd8], eax
mov eax, dword [edi + 0x150]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
shl eax, 4
lea eax, [eax + eax*2]
add eax, dword [ebp - 0x30]
mov dword [edi + 0xdc], eax
mov eax, dword [edi + 0x158]
shl eax, 5
add eax, dword [ebp - 0x20]
mov dword [edi + 0xe0], eax
cmp byte [edi + 0x2bd], 0
jne 0x528cbe
push eax
push 0
push 1
mov ecx, dword [edi + 0xdc]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, edi
mov si, 0xffef
call fcn.00404528
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x528bfe
mov dword [ebp - 0x7c], 8
mov eax, dword [0x68e578]
cmp byte [eax], 0
je 0x528e13
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x44]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x528e13
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x44]
mov edx, dword [ebp - 0x1c]
call fcn.0041a308
mov ebx, eax
test ebx, ebx
je 0x528e06
mov eax, dword [ebx + 0x14]
call fcn.005829a0
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x528e06
mov eax, dword [ebx]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
mov edi, eax
shl edi, 4
lea edi, [edi + edi*2]
add edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [0x68f0c4]
cmp ebx, dword [eax]
jne 0x528da7
mov eax, dword [ebp - 0x5c]
push eax
push 2
push 0
push 0
mov eax, dword [ebp - 0x5c]
mov si, 0xfff8
call fcn.00404528
sar eax, 1
jns 0x528d78
adc eax, 0
mov edx, dword [ebp - 0x28]
add edx, 0x10
sub edx, eax
push edx
mov eax, dword [ebp - 0x5c]
mov si, 0xfff9
call fcn.00404528
sar eax, 1
jns 0x528d94
adc eax, 0
lea edx, [edi + 0x18]
sub edx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
pop ecx
call fcn.005b8fc0
jmp 0x528e06
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x5c]
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push 1
mov eax, dword [ebp - 0x5c]
mov si, 0xfff8
call fcn.00404528
sar eax, 1
jns 0x528dd9
adc eax, 0
mov edx, dword [ebp - 0x28]
add edx, 0x10
sub edx, eax
push edx
mov eax, dword [ebp - 0x5c]
mov si, 0xfff9
call fcn.00404528
sar eax, 1
jns 0x528df5
adc eax, 0
lea edx, [edi + 0x18]
sub edx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
pop ecx
call fcn.00486038
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x528cfd
mov dword [ebp - 0x7c], 9
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x50]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x528f1f
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x50]
mov edx, dword [ebp - 0x1c]
call fcn.0041a308
mov edi, eax
mov eax, dword [edi + 0x150]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
shl eax, 4
lea eax, [eax + eax*2]
add eax, dword [ebp - 0x30]
add eax, dword [edi + 0xec]
add eax, 0x18
mov dword [edi + 0xd4], eax
mov eax, dword [ebp - 0x20]
add eax, 0x20
add eax, dword [edi + 0xf0]
add eax, 0x10
sub eax, 0x5f
mov edx, dword [edi + 0x158]
shl edx, 5
add eax, edx
mov dword [edi + 0xd8], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x4c]
movzx eax, byte [edi + 0x135]
mov edx, eax
add edx, edx
add edx, 0x1ff
mov eax, dword [0x68f08c]
mov eax, dword [eax]
call fcn.0048eb10
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x528f10
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x5c]
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push 1
mov ecx, dword [edi + 0xd8]
add ecx, dword [ebp - 0x50]
mov edx, dword [edi + 0xd4]
add edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
call fcn.00486038
inc dword [ebp - 0x1c]
dec dword [ebp - 0x84]
jne 0x528e41
mov dword [ebp - 0x7c], 0xa
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x48]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x52917e
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x48]
mov edx, dword [ebp - 0x1c]
call fcn.0041a308
mov edi, eax
mov eax, dword [edi + 0x150]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
shl eax, 4
lea eax, [eax + eax*2]
add eax, dword [ebp - 0x30]
add eax, dword [edi + 0xec]
add eax, 0x18
mov dword [edi + 0xd4], eax
mov eax, dword [ebp - 0x20]
add eax, 0x20
add eax, dword [edi + 0xf0]
add eax, 0x10
sub eax, 0x5f
mov edx, dword [edi + 0x158]
shl edx, 5
add eax, edx
mov dword [edi + 0xd8], eax
mov eax, dword [edi + 0x150]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
shl eax, 4
lea eax, [eax + eax*2]
add eax, dword [ebp - 0x30]
mov dword [edi + 0xdc], eax
mov eax, dword [edi + 0x158]
shl eax, 5
add eax, dword [ebp - 0x20]
mov dword [edi + 0xe0], eax
cmp byte [edi + 0x2bd], 0
jne 0x52916f
mov eax, dword [0x68e600]
cmp byte [eax + 0x22], 0
je 0x52900f
cmp byte [edi + 0x16], 0
jne 0x52900f
mov eax, dword [0x68eab8]
cmp edi, dword [eax]
jne 0x529051
mov eax, dword [0x68e600]
cmp byte [eax + 0x23], 0
je 0x52902f
cmp byte [edi + 0x16], 0
jne 0x52902f
mov eax, dword [0x68eab8]
cmp edi, dword [eax]
je 0x52902f
cmp byte [edi + 0x58], 0xb4
je 0x529051
mov eax, dword [edi + 0xe0]
push eax
push 0
push 1
mov ecx, dword [edi + 0xdc]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, edi
mov si, 0xffef
call fcn.00404528
cmp byte [edi + 0x134], 0
je 0x5290f3
cmp byte [edi + 0x136], 0
jne 0x5290f3
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x4c]
movzx eax, byte [edi + 0x135]
mov edx, eax
add edx, edx
add edx, 0x1fe
mov eax, dword [0x68f08c]
mov eax, dword [eax]
call fcn.0048eb10
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x5290f3
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x5c]
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push 1
mov eax, dword [edi + 0x150]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
mov edx, eax
shl edx, 4
lea edx, [edx + edx*2]
add edx, dword [ebp - 0x30]
add edx, dword [ebp - 0x4c]
mov ecx, dword [edi + 0x158]
shl ecx, 5
add ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
call fcn.00486038
test byte [edi + 0x2f], 2
je 0x52916f
lea eax, [ebp - 0x50]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, 0xc8
xor edx, edx
div ecx
mov ecx, 0xa
xor edx, edx
div ecx
add edx, 0xe9c
lea ecx, [ebp - 0x4c]
mov eax, dword [0x68e640]
mov eax, dword [eax + 0x60]
call fcn.0048eb10
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x52916f
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x5c]
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push 0x7c
mov ecx, dword [edi + 0xe0]
add ecx, dword [ebp - 0x50]
mov edx, dword [edi + 0xdc]
add edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
call fcn.004860f4
inc dword [ebp - 0x1c]
dec dword [ebp - 0x84]
jne 0x528f4d
mov dword [ebp - 0x7c], 0xb
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x54]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x5291db
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x54]
mov edx, dword [ebp - 0x1c]
call fcn.0041a308
mov esi, eax
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, esi
mov si, 0xfffd
call fcn.00404528
inc dword [ebp - 0x1c]
dec dword [ebp - 0x84]
jne 0x5291a8
add dword [ebp - 0x20], 0x20
inc dword [ebp - 0x14]
dec dword [ebp - 0x80]
jne 0x528748
mov dword [ebp - 0x7c], 0xc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x420]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x52924b
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x420]
mov edx, dword [ebp - 0x10]
call fcn.0041a308
mov edi, eax
mov eax, dword [edi + 0xe0]
push eax
push 0
push 1
mov ecx, dword [edi + 0xdc]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, edi
mov si, 0xffef
call fcn.00404528
inc dword [ebp - 0x10]
dec dword [ebp - 0x80]
jne 0x52920e
mov dword [ebp - 0x7c], 0xd
xor eax, eax
call fcn.005b87cc
mov dword [ebp - 0x74], eax
mov al, 1
call fcn.005b87cc
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x74], 0
je 0x52989a
cmp dword [ebp - 0x78], 0
je 0x52989a
mov eax, dword [ebp - 0x74]
call fcn.00485bfc
mov eax, dword [ebp - 0x78]
call fcn.00485bfc
mov dword [ebp - 0x7c], 0xe
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x44]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x529471
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 0x44]
mov edx, dword [ebp - 0x1c]
call fcn.0041a308
mov ebx, eax
test ebx, ebx
je 0x529464
mov eax, dword [ebx]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
mov edi, eax
shl edi, 4
lea edi, [edi + edi*2]
add edi, dword [ebp - 0x30]
mov eax, dword [ebx + 4]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f85]
dec eax
shl eax, 5
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x1c]
mov edx, dword [0x68f16c]
cmp eax, dword [edx]
jbe 0x529333
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x1c], eax
mov byte [ebx + 0x28], 1
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x20], eax
xor eax, eax
mov dword [ebx + 0x24], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp byte [ebx + 0x28], 0
je 0x52936e
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x20]
cmp eax, 0x14
jb 0x529356
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x20], eax
inc dword [ebx + 0x24]
cmp dword [ebx + 0x24], 0
jl 0x52936a
cmp dword [ebx + 0x24], 0xa
jge 0x52936a
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x10], eax
jmp 0x52936e
mov byte [ebx + 0x28], 0
mov eax, dword [0x68f0c4]
cmp ebx, dword [eax]
je 0x52942c
mov eax, dword [ebx + 0x2c]
cmp byte [eax], 0
jne 0x5293a0
mov eax, dword [0x68e600]
cmp byte [eax + 6], 0
je 0x52942c
mov eax, dword [0x68e978]
cmp byte [eax], 0
je 0x52942c
mov eax, dword [0x68ef58]
cmp byte [eax + 0xd], 0
je 0x5293cd
movzx eax, byte [ebx + 0x29]
dec eax
sub al, 4
jae 0x5293cd
movzx eax, byte [ebx + 0x29]
mov edx, dword [0x68ec14]
movzx eax, byte [edx + eax - 1]
call fcn.004fda64
mov dword [ebp - 0x70], eax
jmp 0x5293ed
mov eax, dword [ebx + 0x2c]
movzx eax, byte [eax + 2]
mov eax, dword [eax*4 + 0x68a30c]
mov dword [ebp - 0x70], eax
mov eax, dword [ebx + 0x2c]
cmp byte [eax + 2], 0
jne 0x5293ed
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x98]
mov edx, dword [ebx + 0x18]
call fcn.00405adc
mov eax, dword [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x10
mov eax, dword [ebx + 0xc]
add eax, eax
sub ecx, eax
lea edx, [edi + 0x18]
mov eax, dword [ebx + 8]
sar eax, 1
jns 0x529420
adc eax, 0
sub edx, eax
mov eax, dword [ebp - 0x74]
call fcn.00486750
jmp 0x529464
cmp byte [ebx + 0x28], 0
je 0x529464
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x4c]
mov edx, dword [ebp - 0x10]
add edx, 0x730
mov eax, dword [0x68f08c]
mov eax, dword [eax]
call fcn.0048eb10
mov ebx, eax
push ebx
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
add edx, edi
mov eax, dword [ebp - 0x78]
call fcn.00485d84
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x5292b3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x29
jne 0x529296
mov dword [ebp - 0x7c], 0xf
mov eax, dword [0x68e600]
cmp byte [eax + 1], 0
jne 0x52949f
mov eax, dword [0x68e600]
cmp byte [eax + 3], 0
je 0x529885
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x424]
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 0x18]
jl 0x529885
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x424]
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 0x18]
jne 0x5294e6
mov edi, dword [0x68eab8]
mov edi, dword [edi]
mov eax, dword [0x68e600]
cmp byte [eax + 1], 0
je 0x529885
jmp 0x529582
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x424]
mov edx, dword [ebp - 0x18]
call fcn.0041a308
mov edi, eax
mov eax, dword [0x68eab8]
cmp edi, dword [eax]
je 0x52957a
cmp byte [edi + 0x16], 0
je 0x52950e
cmp byte [edi + 0x31], 0
jne 0x52957a
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub eax, dword [edi + 0xc]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xa
jg 0x52957a
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
sub eax, dword [edi + 0x10]
cmp eax, 0xa
jg 0x52957a
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
sub eax, dword [edi + 0x10]
cmp eax, 0xfffffff6
jl 0x52957a
cmp dword [edi + 0xd4], 0
je 0x52957a
cmp byte [edi + 0x2bc], 0
jne 0x529566
mov eax, dword [0x68e600]
cmp byte [eax + 3], 0
je 0x52957a
cmp byte [edi + 0x2bc], 0
je 0x529582
mov eax, dword [0x68e600]
cmp byte [eax + 1], 0
jne 0x529582
inc dword [ebp - 0x18]
jmp 0x5294a4
mov eax, dword [0x68ebac]
cmp edi, dword [eax]
je 0x52987d
mov eax, dword [0x68eab8]
cmp edi, dword [eax]
jne 0x529713
mov eax, dword [0x68eb40]
cmp byte [eax], 0
jne 0x52987d
mov eax, dword [0x68e600]
cmp byte [eax + 2], 0
je 0x5295fc
mov eax, dword [edi + 0xd8]
add eax, 0x1e
push eax
mov eax, dword [edi + 0x54]
push eax
push dword [edi + 0x3c]
push 0x529dd8
push dword [edi + 0x40]
lea eax, [ebp - 0x9c]
mov edx, 3
call fcn.004054fc
mov eax, dword [ebp - 0x9c]
push eax
push 1
mov ecx, dword [edi + 0xd4]
mov edx, dword [ebp - 0x74]
mov eax, edi
call fcn.00527b08
jmp 0x52987d
mov eax, dword [0x68e8b0]
cmp byte [eax], 0
je 0x5296d2
movzx eax, byte [edi + 0x23c]
dec eax
sub al, 5
jae 0x5296d2
push 0x529de4
lea edx, [ebp - 0xa8]
movzx eax, byte [edi + 0x23c]
call fcn.00582ec4
push dword [ebp - 0xa8]
push 0x529df0
lea eax, [ebp - 0xa4]
mov edx, 3
call fcn.004054fc
mov edx, dword [ebp - 0xa4]
lea eax, [ebp - 0xa0]
call fcn.00405adc
mov eax, dword [ebp - 0xa0]
push eax
movzx eax, byte [edi + 0x23c]
call fcn.00582e70
push eax
mov ecx, dword [edi + 0xd8]
add ecx, 0x1e
sub ecx, 6
mov edx, dword [edi + 0xd4]
sub edx, 0xc
mov eax, dword [ebp - 0x74]
call fcn.00486750
lea eax, [ebp - 0xac]
mov edx, dword [edi + 0x40]
call fcn.00405adc
mov eax, dword [ebp - 0xac]
push eax
mov eax, dword [edi + 0x54]
push eax
mov edx, dword [edi + 0xd4]
mov eax, dword [edi + 0x44]
sar eax, 1
jns 0x5296b7
adc eax, 0
sub edx, eax
mov ecx, dword [edi + 0xd8]
add ecx, 0x1e
add ecx, 6
mov eax, dword [ebp - 0x74]
call fcn.00486750
jmp 0x52987d
lea eax, [ebp - 0xb0]
mov edx, dword [edi + 0x40]
call fcn.00405adc
mov eax, dword [ebp - 0xb0]
push eax
mov eax, dword [edi + 0x54]
push eax
mov edx, dword [edi + 0xd4]
mov eax, dword [edi + 0x44]
sar eax, 1
jns 0x5296fb
adc eax, 0
sub edx, eax
mov ecx, dword [edi + 0xd8]
add ecx, 0x1e
mov eax, dword [ebp - 0x74]
call fcn.00486750
jmp 0x52987d
cmp byte [edi + 0x16], 0x32
jne 0x5297ec
cmp dword [edi + 0x3c], 0
je 0x5297ab
lea eax, [ebp - 0xb4]
mov edx, dword [edi + 0x3c]
call fcn.00405adc
mov eax, dword [ebp - 0xb4]
push eax
mov eax, dword [edi + 0x54]
push eax
mov edx, dword [edi + 0xd4]
mov eax, dword [edi + 0x48]
sar eax, 1
jns 0x529750
adc eax, 0
sub edx, eax
mov ecx, dword [edi + 0xd8]
add ecx, 0x1e
sub ecx, 6
mov eax, dword [ebp - 0x74]
call fcn.00486750
lea eax, [ebp - 0xb8]
mov edx, dword [edi + 0x40]
call fcn.00405adc
mov eax, dword [ebp - 0xb8]
push eax
push 0xffffff
mov edx, dword [edi + 0xd4]
mov eax, dword [edi + 0x44]
sar eax, 1
jns 0x529790
adc eax, 0
sub edx, eax
mov ecx, dword [edi + 0xd8]
add ecx, 0x1e
add ecx, 6
mov eax, dword [ebp - 0x74]
call fcn.00486750
jmp 0x52987d
lea eax, [ebp - 0xbc]
mov edx, dword [edi + 0x40]
call fcn.00405adc
mov eax, dword [ebp - 0xbc]
push eax
mov eax, dword [edi + 0x54]
push eax
mov edx, dword [edi + 0xd4]
mov eax, dword [edi + 0x44]
sar eax, 1
jns 0x5297d4
adc eax, 0
sub edx, eax
mov ecx, dword [edi + 0xd8]
add ecx, 0x1e
mov eax, dword [ebp - 0x74]
call fcn.00486750
jmp 0x52987d
mov eax, dword [0x68e600]
cmp byte [eax + 2], 0
je 0x529841
cmp byte [edi + 0x16], 0
jne 0x529841
mov eax, dword [edi + 0xd8]
add eax, 0x1e
push eax
mov eax, dword [edi + 0x54]
push eax
push dword [edi + 0x3c]
push 0x529dd8
push dword [edi + 0x40]
lea eax, [ebp - 0xc0]
mov edx, 3
call fcn.004054fc
mov eax, dword [ebp - 0xc0]
push eax
push 0
mov ecx, dword [edi + 0xd4]
mov edx, dword [ebp - 0x74]
mov eax, edi
call fcn.00527b08
jmp 0x52987d
lea eax, [ebp - 0xc4]
mov edx, dword [edi + 0x40]
call fcn.00405adc
mov eax, dword [ebp - 0xc4]
push eax
mov eax, dword [edi + 0x54]
push eax
mov edx, dword [edi + 0xd4]
mov eax, dword [edi + 0x44]
sar eax, 1
jns 0x52986a
adc eax, 0
sub edx, eax
mov ecx, dword [edi + 0xd8]
add ecx, 0x1e
mov eax, dword [ebp - 0x74]
call fcn.00486750
inc dword [ebp - 0x18]
jmp 0x5294a4
mov eax, dword [ebp - 0x78]
push eax
push 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
xor ecx, ecx
xor edx, edx
call fcn.005b8c5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5298dd
mov eax, dword [0x68e2fc]
cmp byte [eax], 0
jne 0x529adf
xor eax, eax
push ebp
push 0x529acb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68ef6c]
cmp byte [eax], 0
jne 0x529973
mov eax, dword [0x68eab8]
mov eax, dword [eax]
test byte [eax + 0x2e], 0x80
jne 0x529973
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov eax, dword [eax + 0x154]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f85]
dec eax
shl eax, 5
add eax, dword [ebp - 0x34]
push eax
push 1
push 0
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov eax, dword [eax + 0x150]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
mov ecx, eax
shl ecx, 4
lea ecx, [ecx + ecx*2]
add ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov si, 0xffef
call fcn.00404528
mov eax, dword [0x68ebac]
cmp dword [eax], 0
je 0x529a1a
mov edx, dword [0x68ebac]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.0052cf88
test al, al
je 0x529a1a
mov eax, dword [0x68ebac]
mov eax, dword [eax]
mov edx, dword [0x68eab8]
cmp eax, dword [edx]
je 0x529a1a
mov eax, dword [0x68ebac]
mov eax, dword [eax]
test byte [eax + 0x2e], 0x80
jne 0x529a1a
mov eax, dword [0x68ebac]
mov eax, dword [eax]
mov eax, dword [eax + 0x154]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f85]
dec eax
shl eax, 5
add eax, dword [ebp - 0x34]
push eax
push 1
push 0
mov eax, dword [0x68ebac]
mov eax, dword [eax]
mov eax, dword [eax + 0x150]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
mov ecx, eax
shl ecx, 4
lea ecx, [ecx + ecx*2]
add ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, dword [0x68ebac]
mov eax, dword [eax]
mov si, 0xffef
call fcn.00404528
mov eax, dword [0x68f1f0]
cmp dword [eax], 0
je 0x529ac1
mov edx, dword [0x68f1f0]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.0052cf88
test al, al
je 0x529ac1
mov eax, dword [0x68f1f0]
mov eax, dword [eax]
mov edx, dword [0x68eab8]
cmp eax, dword [edx]
je 0x529ac1
mov eax, dword [0x68f1f0]
mov eax, dword [eax]
test byte [eax + 0x2e], 0x80
jne 0x529ac1
mov eax, dword [0x68f1f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x154]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f85]
dec eax
shl eax, 5
add eax, dword [ebp - 0x34]
push eax
push 1
push 0
mov eax, dword [0x68f1f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x150]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
mov ecx, eax
shl ecx, 4
lea ecx, [ecx + ecx*2]
add ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, dword [0x68f1f0]
mov eax, dword [eax]
mov si, 0xffef
call fcn.00404528
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x529adf
xor eax, eax
push ebp
push 0x529bbd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x424]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x529bb3
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x424]
mov edx, dword [ebp - 0x18]
call fcn.0041a308
mov edi, eax
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub eax, dword [edi + 0xc]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xa
jg 0x529ba7
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
sub eax, dword [edi + 0x10]
cmp eax, 0xa
jg 0x529ba7
mov eax, dword [0x68eab8]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
sub eax, dword [edi + 0x10]
cmp eax, 0xfffffff2
jl 0x529ba7
mov eax, dword [edi + 0x154]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f85]
dec eax
shl eax, 5
add eax, dword [ebp - 0x34]
push eax
mov eax, dword [edi + 0x150]
mov edx, dword [0x68f0c8]
mov edx, dword [edx]
sub eax, dword [edx + 0xa6f81]
mov ecx, eax
shl ecx, 4
lea ecx, [ecx + ecx*2]
add ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, edi
mov si, 0xffee
call fcn.00404528
inc dword [ebp - 0x18]
dec dword [ebp - 0x80]
jne 0x529b0d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x529bd1
cmp dword [ebp - 0x74], 0
je 0x529cbc
mov eax, dword [0x68e58c]
cmp dword [eax], 0
jle 0x529c16
lea eax, [ebp - 0xd0]
mov edx, dword [0x68eec4]
mov edx, dword [edx]
call fcn.00405adc
mov eax, dword [ebp - 0xd0]
push eax
push 0xff00
mov ecx, 0x27
mov edx, 0x5c
mov eax, dword [ebp - 0x74]
call fcn.00486750
mov eax, dword [0x68efd0]
cmp dword [eax], 0
jle 0x529c53
lea eax, [ebp - 0xd4]
mov edx, dword [0x68e9a4]
mov edx, dword [edx]
call fcn.00405adc
mov eax, dword [ebp - 0xd4]
push eax
push 0xffff
mov ecx, 0x92
mov edx, 0x13f
mov eax, dword [ebp - 0x74]
call fcn.00486750
jmp 0x529c8e
mov eax, dword [0x68f1d0]
cmp dword [eax], 0
jle 0x529c8e
lea eax, [ebp - 0xd8]
mov edx, dword [0x68eb64]
mov edx, dword [edx]
call fcn.00405adc
mov eax, dword [ebp - 0xd8]
push eax
push 0xffff
mov ecx, 0x92
mov edx, 0xa0
mov eax, dword [ebp - 0x74]
call fcn.00486750
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x74]
mov si, 0xfffa
call fcn.00404528
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0x74]
push eax
push 0x7b
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
xor ecx, ecx
xor edx, edx
call fcn.004860f4
xor eax, eax
push ebp
push 0x529cdc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00526f68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x529cf0
xor eax, eax
push ebp
push 0x529d10
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00526c14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x529d24
call sub.kernel32.dll_GetTickCount
add eax, 0x32
mov edx, dword [ebp - 8]
mov dword [edx + 0x20], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x529dc9
lea eax, [ebp - 0xd8]
mov edx, 3
call fcn.00405988
lea eax, [ebp - 0xcc]
mov edx, 2
call fcn.0040517c
lea eax, [ebp - 0xc4]
call fcn.00405970
lea eax, [ebp - 0xc0]
call fcn.00405158
lea eax, [ebp - 0xbc]
mov edx, 5
call fcn.00405988
lea eax, [ebp - 0xa8]
mov edx, 2
call fcn.0040517c
lea eax, [ebp - 0xa0]
call fcn.00405970
lea eax, [ebp - 0x9c]
call fcn.00405158
lea eax, [ebp - 0x98]
call fcn.00405970
lea eax, [ebp - 4]
call fcn.00405158
ret