Function at 0x41a680
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x917967
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa1c
push ebx
mov ebx, ecx
push esi
push edi
lea ecx, [esp + 0xb8]
call fcn.00911f0c
xor esi, esi
lea ecx, [esp + 0xc]
mov dword [esp + 0xa30], esi
call fcn.00911f0c
lea ecx, [esp + 0x20]
mov byte [esp + 0xa30], 1
call fcn.00911f0c
lea ecx, [esp + 0x68]
mov byte [esp + 0xa30], 2
call fcn.00911f0c
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa30], 3
call fcn.00911f0c
lea ecx, [esp + 0x40]
mov byte [esp + 0xa30], 4
call fcn.00911f0c
lea ecx, [esp + 0x38]
mov byte [esp + 0xa30], 5
call fcn.00911f0c
lea ecx, [esp + 0x30]
mov byte [esp + 0xa30], 6
call fcn.00911f0c
lea ecx, [esp + 0x64]
mov byte [esp + 0xa30], 7
call fcn.00911f0c
lea ecx, [esp + 0x60]
mov byte [esp + 0xa30], 8
call fcn.00911f0c
push esi
lea ecx, [esp + 0x16c]
mov byte [esp + 0xa34], 9
mov dword [esp + 0x2c], esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x28], 1
mov dword [esp + 0x14], esi
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x98], esi
mov dword [esp + 0x9c], esi
mov byte [esp + 0x1f], 0
call fcn.00735050
mov ecx, ebx
mov byte [esp + 0xa30], 0xa
call fcn.004ce970
mov eax, dword [0xa8e80c]
push eax
nop
call fcn.00b1462f
fstp qword [esp + 0xc0]
add esp, 4
mov ecx, ebx
call fcn.0043e0f0
mov ecx, dword [0xa8e738]
lea edx, [esp + 0x20]
fstp qword [esp + 0xa4]
push ecx
push 0xa
push 0x25
push 0xa771b0
push edx
call fcn.00911f42
mov eax, dword [0xa8e73c]
push eax
push 0xa
push 0x25
lea ecx, [esp + 0x88]
push 0xa771b0
push ecx
call fcn.00911f42
add esp, 0x28
lea edx, [esp + 0x1c]
mov ecx, 0xa90270
push edx
call fcn.009121e2
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0xa34], 0xb
call fcn.00911f3c
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa30], 0xa
call fcn.00911ee2
lea ecx, [esp + 0x2c]
call fcn.009121b2
mov ecx, dword [0xa8e874]
mov edi, 0xa7647c
mov esi, ecx
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x41a87a
test al, al
je 0x41a876
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x41a87a
add esi, 2
add edi, 2
test al, al
jne 0x41a856
xor eax, eax
jmp 0x41a87f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41a8c7
mov edi, 0xa76474
mov esi, ecx
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x41a8b2
test al, al
je 0x41a8ae
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x41a8b2
add esi, 2
add edi, 2
test al, al
jne 0x41a88a
xor eax, eax
jmp 0x41a8b7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41a8c7
push 0xa907a4
push str..GCA
jmp 0x41a8d1
push 0xa907a4
push str..GCZ
lea ecx, [esp + 0x34]
call fcn.009121a0
lea eax, [esp + 0x2c]
lea ecx, [esp + 0xc]
push eax
call fcn.00911f3c
mov ecx, dword [0xa8e874]
mov esi, 0xa7647c
mov edi, ecx
mov dl, byte [edi]
mov al, dl
cmp dl, byte [esi]
jne 0x41a919
test al, al
je 0x41a915
mov dl, byte [edi + 1]
mov al, dl
cmp dl, byte [esi + 1]
jne 0x41a919
add edi, 2
add esi, 2
test al, al
jne 0x41a8f5
xor eax, eax
jmp 0x41a91e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41a966
mov edi, 0xa76474
mov esi, ecx
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x41a951
test al, al
je 0x41a94d
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x41a951
add esi, 2
add edi, 2
test al, al
jne 0x41a929
xor eax, eax
jmp 0x41a956
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41a966
push 0xa907a4
push str..GCA
jmp 0x41a970
push 0xa907a4
push str..GCZ
lea ecx, [esp + 0x14]
call fcn.009121a0
lea eax, [esp + 0xc]
push str..HZB
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.009121dc
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa34], 0xc
call fcn.00911f3c
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa30], 0xa
call fcn.00911ee2
lea edx, [esp + 0xc]
push 0xa771ac
lea eax, [esp + 0x20]
push edx
push eax
call fcn.009121dc
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0xa34], 0xd
call fcn.00911f3c
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa30], 0xa
call fcn.00911ee2
push ecx
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.0091203e
lea ecx, [esp + 0x16c]
call fcn.007351b0
test eax, eax
je 0x41b903
cmp dword [0xa8fd14], 3
je 0x41b903
mov eax, dword [esp + 0x38]
push 0xa900d8
push 0
push eax
mov ecx, 0xa90210
call fcn.009121ca
test eax, eax
jne 0x41aa55
push ecx
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.0091203e
lea ecx, [esp + 0x16c]
call fcn.007355a0
jmp 0x41b903
push 0
mov ecx, ebx
call fcn.004175c0
mov eax, dword [ebx + 0x2748]
push ecx
lea edx, [esp + 0x34]
dec eax
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
mov dword [ebx + 0x8c4], eax
call fcn.0091203e
lea ecx, [esp + 0x16c]
call fcn.007351b0
test eax, eax
je 0x41aadd
mov eax, dword [esp + 0x30]
push 0xa900f0
push 0
push eax
mov ecx, 0xa90220
mov byte [esp + 0x27], 1
call fcn.009121ca
test eax, eax
jne 0x41aaca
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.0091203e
lea ecx, [esp + 0x16c]
call fcn.007355a0
jmp 0x41aadd
push 0
mov ecx, ebx
call fcn.004152e0
mov eax, dword [ebx + 0x2878]
mov dword [esp + 0x1c], eax
mov edx, dword [ebx + 0x9cc]
mov eax, dword [0xa8e570]
mov esi, dword [ebp + 8]
mov ecx, dword [0xa8e758]
mov dword [esp + 0x58], edx
mov dword [ebx + 0x23f0], eax
mov edx, dword [esi]
mov dword [esp + 0x5c], ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov edx, dword [esi]
push 4
mov ecx, esi
call dword [edx + 0x3c]
mov eax, dword [esi + 8]
push 6
push eax
nop
call fcn.00b14638
push eax
call fcn.00912368
lea ecx, [ebx + 0x2198]
mov dword [ebx + 0x2194], eax
mov edx, dword [eax + 4]
push ecx
push 0x3c
push edx
nop
call fcn.00b14641
mov ecx, 0x1e
xor eax, eax
lea edi, [esp + 0xc8]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x54]
lea ecx, [esp + 0x10]
push eax
push ecx
push esi
mov ecx, ebx
call fcn.0041bab0
mov ecx, dword [ebx + 0x8c4]
xor eax, eax
test ecx, ecx
jle 0x41b698
lea edi, [eax + 1]
mov ecx, ebx
push edi
mov dword [esp + 0x38], edi
call fcn.004175c0
mov al, byte [ebx + 0x27b3]
cmp al, 0x59
je 0x41ab8e
test al, al
jne 0x41b688
mov edx, dword [ebx + 0x598]
mov eax, dword [ebx + 0x9cc]
push 0
mov ecx, dword [esp + 0x14]
push 1
push edx
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
push ecx
push esi
mov ecx, ebx
call fcn.00460a00
mov edx, dword [0xa8e750]
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x10]
add edx, eax
mov al, byte [ebx + 0x516]
sub ecx, edx
test al, al
mov dword [esp + 0x10], ecx
je 0x41ac08
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0xc]
push ecx
push 0xa771a8
push edx
call fcn.00911f42
mov ecx, dword [esp + 0x18]
mov eax, dword [0xa8e758]
mov edi, dword [esi]
add esp, 0xc
mov edx, dword [ecx - 8]
add eax, 3
push edx
push ecx
mov ecx, dword [esp + 0x18]
push ecx
push eax
mov ecx, esi
call dword [edi + 0x64]
mov al, byte [ebx + 0x517]
test al, al
je 0x41ac67
mov edx, dword [ebx + 0x2748]
lea eax, [esp + 0xc]
push edx
push str.__5d
push eax
call fcn.00911f42
mov eax, dword [ebx + 0x9c8]
mov edi, dword [esi]
imul eax, dword [ebx + 0x734]
cdq
sub eax, edx
mov edx, dword [ebx + 0x978]
mov ecx, eax
add esp, 0xc
mov eax, dword [ebx + edx*4 + 0x484]
sar ecx, 1
sub eax, ecx
mov ecx, dword [esp + 0xc]
sub eax, 3
mov edx, dword [ecx - 8]
push edx
push ecx
mov ecx, dword [esp + 0x18]
push ecx
push eax
mov ecx, esi
call dword [edi + 0x64]
mov al, byte [ebx + 0x518]
test al, al
je 0x41acd9
mov eax, dword [ebx + 0x274c]
cmp eax, 0x2710
push eax
jle 0x41ac8b
lea edx, [esp + 0x10]
push 0xa761d8
push edx
jmp 0x41ac95
lea eax, [esp + 0x10]
push str._05ld
push eax
call fcn.00911f42
mov eax, dword [ebx + 0x9c8]
mov edi, dword [esi]
imul eax, dword [ebx + 0x738]
cdq
sub eax, edx
mov edx, dword [ebx + 0x97c]
mov ecx, eax
add esp, 0xc
mov eax, dword [ebx + edx*4 + 0x484]
sar ecx, 1
sub eax, ecx
mov ecx, dword [esp + 0xc]
sub eax, 3
mov edx, dword [ecx - 8]
push edx
push ecx
mov ecx, dword [esp + 0x18]
push ecx
push eax
mov ecx, esi
call dword [edi + 0x64]
mov al, byte [ebx + 0x519]
test al, al
je 0x41ade8
lea edx, [ebx + 0x2760]
lea eax, [esp + 0xc]
push edx
push 0xa76fa0
push eax
call fcn.00911f42
mov ecx, dword [esp + 0x18]
mov edx, dword [ebx + 0x73c]
add esp, 0xc
mov ecx, dword [ecx - 8]
cmp ecx, edx
jle 0x41adb3
mov eax, dword [esp + 0xc]
lea edi, [ebx + 0x2378]
lea esi, [ebx + 0x224c]
mov ecx, 0xf
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax - 8]
mov eax, edx
imul eax, dword [ebx + 0x237c]
cdq
idiv ecx
lea edi, [ebx + 0x215c]
mov dword [ebx + 0x237c], eax
lea eax, [ebx + 0x2378]
push eax
nop
call fcn.00b1464a
push eax
mov ecx, edi
call fcn.00912338
mov esi, dword [ebp + 8]
push edi
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x30]
mov eax, dword [ebx + 0x9c8]
mov ecx, dword [ebx + 0x960]
imul eax, dword [ebx + 0x73c]
cdq
sub eax, edx
mov edi, dword [esi]
mov edx, eax
mov eax, dword [ebx + ecx*4 + 0x574]
mov ecx, dword [esp + 0xc]
sar edx, 1
sub eax, edx
mov edx, dword [ecx - 8]
push edx
push ecx
mov ecx, dword [esp + 0x18]
sub eax, 3
push ecx
push eax
mov ecx, esi
call dword [edi + 0x64]
mov edx, dword [esi]
lea eax, [ebx + 0x2144]
push eax
mov ecx, esi
call dword [edx + 0x30]
jmp 0x41ade8
mov eax, dword [ebx + 0x9c8]
mov edi, dword [ebx + 0x960]
imul eax, edx
cdq
sub eax, edx
push ecx
mov ecx, dword [esp + 0x10]
mov edx, eax
mov eax, dword [ebx + edi*4 + 0x574]
push ecx
mov ecx, dword [esp + 0x18]
sar edx, 1
sub eax, edx
mov edx, dword [esi]
sub eax, 3
push ecx
push eax
mov ecx, esi
call dword [edx + 0x64]
mov al, byte [ebx + 0x51a]
test al, al
je 0x41b27a
mov al, byte [0xa8e784]
lea edi, [ebx + 0x27a8]
test al, al
push edi
lea ecx, [esp + 0x10]
je 0x41b070
call fcn.00911f06
mov edx, dword [esp + 0xc]
push 0xa76f28
lea ecx, [esp + 0x10]
mov eax, dword [edx - 8]
mov dword [esp + 0x18], eax
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x41af01
push 0xa77194
lea ecx, [esp + 0x10]
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x41af01
push 0xa77190
lea ecx, [esp + 0x10]
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x41af01
push 0xa76f34
lea ecx, [esp + 0x10]
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x41af01
push edi
lea ecx, [esp + 0x7c]
call fcn.00911edc
mov ecx, dword [ebx + 0x96c]
mov eax, dword [ebx + 0x968]
mov edi, dword [ebx + 0x740]
mov edx, dword [esp + 0x14]
sub ecx, eax
mov eax, edi
sub eax, edx
mov byte [esp + 0xa30], 0x10
imul eax, dword [ebx + 0x9c8]
cdq
sub eax, edx
mov ecx, dword [ebx + ecx*4 + 0x59c]
sar eax, 1
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov eax, edi
imul eax, dword [ebx + 0x9c8]
cdq
sub eax, edx
mov edi, dword [esi]
sar eax, 1
sub ecx, eax
mov eax, dword [esp + 0x78]
sub ecx, 5
mov edx, dword [eax - 8]
push edx
mov edx, dword [esp + 0x14]
push eax
push edx
push ecx
mov ecx, esi
call dword [edi + 0x64]
lea ecx, [esp + 0x78]
mov byte [esp + 0xa30], 0xa
call fcn.00911ee2
jmp 0x41b27a
lea eax, [esp + 0xb4]
push 1
push eax
lea ecx, [esp + 0x14]
call fcn.0091218e
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0xa34], 0xe
call fcn.00911f3c
lea ecx, [esp + 0xb4]
mov byte [esp + 0xa30], 0xa
call fcn.00911ee2
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0xa0]
lea eax, [edi - 1]
push eax
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x58], eax
call fcn.00912044
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0xa34], 0xf
call fcn.00911f3c
lea ecx, [esp + 0xa0]
mov byte [esp + 0xa30], 0xa
call fcn.00911ee2
mov eax, dword [ebx + 0x740]
mov ecx, dword [ebx + 0x9c8]
mov edx, dword [ebx + 0x96c]
sub eax, edi
sub edx, dword [ebx + 0x968]
imul eax, ecx
mov dword [esp + 0x3c], edx
mov edi, dword [esi]
cdq
sub eax, edx
sar eax, 1
cdq
sub eax, edx
mov edx, dword [esp + 0x3c]
sar eax, 1
mov ecx, dword [ebx + edx*4 + 0x59c]
add ecx, eax
mov eax, dword [ebx + 0x740]
imul eax, dword [ebx + 0x9c8]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
mov eax, dword [esp + 0xc]
sub ecx, 3
mov edx, dword [eax - 8]
push edx
push eax
mov eax, dword [esp + 0x18]
push eax
push ecx
mov ecx, esi
call dword [edi + 0x64]
mov edx, dword [esi]
lea eax, [ebx + 0x2154]
push eax
mov ecx, esi
call dword [edx + 0x30]
mov ecx, dword [ebx + 0x96c]
mov edx, dword [ebx + 0x968]
mov eax, dword [ebx + 0x740]
mov edi, dword [ebx + 0x9c8]
sub ecx, edx
mov edx, dword [esp + 0x14]
sub eax, edx
imul eax, edi
cdq
sub eax, edx
sar eax, 1
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ebx + ecx*4 + 0x59c]
add ecx, eax
mov eax, dword [esp + 0x50]
imul eax, edi
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov eax, dword [ebx + 0x740]
imul eax, edi
cdq
sub eax, edx
mov edi, dword [esi]
sar eax, 1
sub ecx, eax
mov eax, dword [esp + 0x40]
sub ecx, 3
mov edx, dword [eax - 8]
push edx
mov edx, dword [esp + 0x14]
push eax
push edx
push ecx
mov ecx, esi
call dword [edi + 0x64]
mov eax, dword [esi]
lea ecx, [ebx + 0x2144]
push ecx
mov ecx, esi
call dword [eax + 0x30]
jmp 0x41b27a
call fcn.00911f06
push 0xa76f28
lea ecx, [esp + 0x10]
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x41b142
push 0xa77194
lea ecx, [esp + 0x10]
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x41b142
push 0xa77190
lea ecx, [esp + 0x10]
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x41b142
push 0xa76f34
lea ecx, [esp + 0x10]
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x41b142
push edi
lea ecx, [esp + 0x94]
call fcn.00911edc
mov ecx, dword [ebx + 0x96c]
mov eax, dword [ebx + 0x968]
sub ecx, eax
mov eax, dword [ebx + 0x9c8]
imul eax, dword [ebx + 0x740]
cdq
sub eax, edx
mov edi, dword [esi]
mov edx, eax
mov eax, dword [ebx + ecx*4 + 0x59c]
mov ecx, dword [esp + 0x90]
mov byte [esp + 0xa30], 0x13
sar edx, 1
sub eax, edx
mov edx, dword [ecx - 8]
push edx
push ecx
mov ecx, dword [esp + 0x18]
sub eax, 3
push ecx
push eax
mov ecx, esi
call dword [edi + 0x64]
lea ecx, [esp + 0x90]
mov byte [esp + 0xa30], 0xa
call fcn.00911ee2
jmp 0x41b27a
lea edx, [esp + 0x9c]
push 1
push edx
lea ecx, [esp + 0x14]
call fcn.0091218e
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0xa34], 0x11
call fcn.00911f3c
lea ecx, [esp + 0x9c]
mov byte [esp + 0xa30], 0xa
call fcn.00911ee2
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0xb0]
mov eax, dword [eax - 8]
dec eax
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.00912044
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0xa34], 0x12
call fcn.00911f3c
lea ecx, [esp + 0xb0]
mov byte [esp + 0xa30], 0xa
call fcn.00911ee2
mov ecx, dword [ebx + 0x96c]
mov eax, dword [ebx + 0x968]
sub ecx, eax
mov eax, dword [ebx + 0x9c8]
imul eax, dword [ebx + 0x740]
cdq
sub eax, edx
mov edi, dword [esi]
mov edx, eax
mov eax, dword [ebx + ecx*4 + 0x59c]
mov ecx, dword [esp + 0xc]
sar edx, 1
sub eax, edx
mov edx, dword [ecx - 8]
push edx
push ecx
mov ecx, dword [esp + 0x18]
sub eax, 3
push ecx
push eax
mov ecx, esi
call dword [edi + 0x64]
mov edx, dword [esi]
lea eax, [ebx + 0x2154]
push eax
mov ecx, esi
call dword [edx + 0x30]
mov ecx, dword [esp + 0xc]
mov edx, dword [ebx + 0x96c]
mov eax, dword [ebx + 0x968]
mov edi, dword [ebx + 0x9c8]
mov ecx, dword [ecx - 8]
sub edx, eax
mov eax, edi
mov dword [esp + 0x50], edx
imul eax, ecx
cdq
sub eax, edx
mov edx, dword [esp + 0x50]
sar eax, 1
mov ecx, dword [ebx + edx*4 + 0x59c]
add ecx, eax
mov eax, edi
imul eax, dword [ebx + 0x740]
cdq
sub eax, edx
mov edi, dword [esi]
sar eax, 1
sub ecx, eax
mov eax, dword [esp + 0x40]
sub ecx, 3
mov edx, dword [eax - 8]
push edx
push eax
mov eax, dword [esp + 0x18]
push eax
push ecx
mov ecx, esi
call dword [edi + 0x64]
mov edx, dword [esi]
lea eax, [ebx + 0x2144]
push eax
mov ecx, esi
call dword [edx + 0x30]
mov al, byte [ebx + 0x51b]
test al, al
je 0x41b326
mov ecx, dword [ebx + 0x27c4]
mov edx, dword [ebx + 0x27c0]
push ecx
push edx
mov ecx, ebx
call fcn.008f5ce0
fld dword [ebx + 0x9d8]
fcompp
fnstsw ax
test ah, 1
je 0x41b326
mov eax, dword [0xa8e738]
mov ecx, dword [ebx + 0x744]
push eax
push ecx
push 0x25
lea edx, [esp + 0x2c]
push 0xa771b0
push edx
call fcn.00911f42
mov eax, dword [ebx + 0x27c4]
mov ecx, dword [ebx + 0x27c0]
mov edx, dword [esp + 0x7c]
push eax
push ecx
lea eax, [esp + 0x28]
push edx
push eax
call fcn.00911f42
mov eax, dword [ebx + 0x9c8]
mov ecx, dword [ebx + 0x96c]
imul eax, dword [ebx + 0x744]
cdq
sub eax, edx
mov edi, dword [esi]
mov edx, eax
mov eax, dword [ebx + ecx*4 + 0x550]
mov ecx, dword [esp + 0x30]
add esp, 0x24
sar edx, 1
sub eax, edx
mov edx, dword [ecx - 8]
push edx
push ecx
mov ecx, dword [esp + 0x18]
sub eax, 3
push ecx
push eax
mov ecx, esi
call dword [edi + 0x64]
mov eax, dword [ebx + 0x27dc]
mov edx, dword [ebx + 0x27d8]
mov dword [esp + 0x70], eax
mov al, byte [esp + 0x1b]
test al, al
mov dword [esp + 0x6c], edx
je 0x41b3e8
lea ecx, [ebx + 0x2760]
push ecx
lea ecx, [esp + 0x68]
call fcn.00911f06
mov ecx, dword [esp + 0x1c]
xor eax, eax
test ecx, ecx
jle 0x41b3e8
inc eax
mov ecx, ebx
push eax
mov dword [esp + 0x54], eax
call fcn.004152e0
lea eax, [ebx + 0x2890]
lea ecx, [esp + 0x60]
push eax
call fcn.00911f06
mov edx, dword [ebx + 0x2878]
mov eax, dword [ebx + 0x2748]
cmp edx, eax
jne 0x41b3c6
mov eax, dword [esp + 0x60]
mov edi, dword [esp + 0x64]
mov dl, byte [edi]
mov cl, dl
cmp dl, byte [eax]
jne 0x41b3bd
test cl, cl
je 0x41b3b9
mov dl, byte [edi + 1]
mov cl, dl
cmp dl, byte [eax + 1]
jne 0x41b3bd
add edi, 2
add eax, 2
test cl, cl
jne 0x41b399
xor eax, eax
jmp 0x41b3c2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41b3d4
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
jl 0x41b364
jmp 0x41b3e8
mov eax, dword [ebx + 0x2908]
mov ecx, dword [ebx + 0x290c]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ecx
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
push edx
push eax
mov ecx, ebx
call fcn.008f5ce0
fld dword [ebx + 0x9d8]
fcompp
fnstsw ax
test ah, 0x41
jne 0x41b410
fld qword [ebx + 0x27d0]
jmp 0x41b414
fld qword [esp + 0x6c]
fst qword [esp + 0x100]
fmul qword [ebx + 0x27c0]
mov eax, dword [ebx + 0x27d0]
mov ecx, dword [ebx + 0x27c8]
mov edx, dword [ebx + 0x27cc]
mov dword [esp + 0x120], eax
mov dword [esp + 0x110], ecx
mov ecx, dword [ebx + 0x27d4]
fst qword [esp + 0x108]
fadd qword [esp + 0x7c]
mov dword [esp + 0x114], edx
mov dword [esp + 0x124], ecx
fstp qword [esp + 0x7c]
fld qword [ebx + 0x27c0]
fmul qword [ebx + 0x27c8]
fst qword [esp + 0x118]
fadd qword [esp + 0x94]
fstp qword [esp + 0x94]
fld qword [ebx + 0x27c0]
fmul qword [ebx + 0x27d0]
fst qword [esp + 0x128]
fadd qword [esp + 0x44]
fstp qword [esp + 0x44]
fld dword [ebx + 0x9e4]
fcomp qword [esp + 0xbc]
fnstsw ax
test ah, 1
je 0x41b4d2
fld qword [ebx + 0x27c0]
fdiv qword [esp + 0xbc]
mov edx, dword [ebx + 0x95c]
xor edi, edi
fstp qword [esp + edx*8 + 0xd8]
jmp 0x41b4e8
mov eax, dword [ebx + 0x95c]
xor edi, edi
mov dword [esp + eax*8 + 0xd8], edi
mov dword [esp + eax*8 + 0xdc], edi
mov ecx, dword [esp + 0xa8]
mov edx, dword [esp + 0xa4]
push ecx
push edx
mov ecx, ebx
call fcn.008f5ce0
fld dword [ebx + 0x9e4]
fcompp
fnstsw ax
test ah, 1
je 0x41b530
fld qword [ebx + 0x27c0]
fmul qword [0x9cb970]
mov eax, dword [ebx + 0x95c]
fdiv qword [esp + 0xa4]
fstp qword [esp + eax*8 + 0xe0]
jmp 0x41b544
mov ecx, dword [ebx + 0x95c]
mov dword [esp + ecx*8 + 0xe0], edi
mov dword [esp + ecx*8 + 0xe4], edi
lea edx, [esp + 0x100]
mov dword [esp + 0x14], 7
mov dword [esp + 0x3c], edx
lea edi, [ebx + 0x748]
push 0xa907a4
lea ecx, [esp + 0x10]
call fcn.00911f06
mov eax, dword [esp + 0x14]
mov cl, byte [ebx + eax + 0x515]
test cl, cl
je 0x41b61f
mov eax, dword [esp + 0x3c]
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov eax, edx
mov dword [esp + 0x84], ecx
push eax
push ecx
mov ecx, ebx
mov dword [esp + 0x90], edx
call fcn.008f5ce0
fcomp qword [0x9cb968]
fnstsw ax
test ah, 0x41
jne 0x41b61f
mov edx, dword [0xa8e738]
mov eax, dword [edi]
push edx
push eax
push 0x25
lea ecx, [esp + 0x2c]
push 0xa771b0
push ecx
call fcn.00911f42
mov edx, dword [esp + 0x9c]
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x34]
push edx
push eax
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.00911f42
mov eax, dword [ebx + 0x9c8]
add esp, 0x24
imul eax, dword [edi]
cdq
sub eax, edx
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [edi - 0x190]
sar ecx, 1
sub eax, ecx
mov ecx, dword [edx - 8]
mov edx, dword [esi]
push ecx
mov ecx, dword [esp + 0x10]
sub eax, 3
push ecx
mov ecx, dword [esp + 0x18]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x64]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x3c]
inc eax
add edi, 4
add edx, 8
cmp eax, 0x11
mov dword [esp + 0x14], eax
mov dword [esp + 0x3c], edx
jl 0x41b55d
mov edx, dword [0xa8e750]
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x28]
add edx, eax
push eax
sub ecx, edx
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x58]
push eax
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x68]
push edx
inc edi
push eax
push esi
mov ecx, ebx
mov dword [esp + 0x40], edi
call fcn.0041ba10
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x34]
inc eax
mov dword [esp + 0x24], eax
mov ecx, dword [ebx + 0x8c4]
mov eax, edi
cmp eax, ecx
jl 0x41ab6d
mov edx, dword [esp + 0x80]
mov ecx, 0x1e
xor eax, eax
lea edi, [esp + 0xc8]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x104], edx
mov edx, dword [esp + 0x44]
mov dword [esp + 0x124], eax
mov eax, dword [ebx + 0x9cc]
mov dword [esp + 0x120], edx
mov dword [esp + 0x100], ecx
mov ecx, dword [esp + 0x98]
push 0
cdq
sub eax, edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x118], ecx
mov ecx, dword [ebx + 0x598]
sar eax, 1
push 1
sub edx, eax
push ecx
push edx
push esi
mov ecx, ebx
call fcn.00460a00
mov eax, dword [0xa8e750]
mov ecx, dword [esp + 0x58]
add eax, ecx
mov ecx, dword [esp + 0x10]
sub ecx, eax
mov al, byte [ebx + 0x519]
test al, al
mov dword [esp + 0x10], ecx
je 0x41b7a3
lea edx, [esp + 0xc]
push 0xa77188
push edx
call fcn.00911f42
mov eax, dword [0xa8e738]
mov ecx, dword [ebx + 0x73c]
push eax
push ecx
push 0x25
lea edx, [esp + 0x34]
push 0xa771b0
push edx
call fcn.00911f42
mov eax, dword [ebx + 0x9c8]
mov ecx, dword [ebx + 0x960]
imul eax, dword [ebx + 0x73c]
cdq
sub eax, edx
mov edi, dword [esi]
mov edx, eax
mov eax, dword [ebx + ecx*4 + 0x574]
mov ecx, dword [esp + 0x28]
add esp, 0x1c
sar edx, 1
sub eax, edx
mov edx, dword [ecx - 8]
push edx
push ecx
mov ecx, dword [esp + 0x18]
sub eax, 3
push ecx
push eax
mov ecx, esi
call dword [edi + 0x64]
lea edx, [esp + 0xf8]
mov dword [esp + 0x14], 6
mov dword [esp + 0x24], edx
lea edi, [ebx + 0x748]
push 0xa907a4
lea ecx, [esp + 0x10]
call fcn.00911f06
mov eax, dword [esp + 0x14]
mov cl, byte [ebx + eax + 0x516]
test cl, cl
je 0x41b872
mov eax, dword [esp + 0x24]
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov eax, edx
mov dword [esp + 0x44], ecx
push eax
push ecx
mov ecx, ebx
mov dword [esp + 0x50], edx
call fcn.008f5ce0
fcomp qword [0x9cb968]
fnstsw ax
test ah, 0x41
jne 0x41b872
mov edx, dword [0xa8e738]
mov eax, dword [edi]
push edx
push eax
push 0x25
lea ecx, [esp + 0x2c]
push 0xa771b0
push ecx
call fcn.00911f42
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x34]
push edx
push eax
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.00911f42
mov eax, dword [ebx + 0x9c8]
add esp, 0x24
imul eax, dword [edi]
cdq
sub eax, edx
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [edi - 0x190]
sar ecx, 1
sub eax, ecx
mov ecx, dword [edx - 8]
mov edx, dword [esi]
push ecx
mov ecx, dword [esp + 0x10]
sub eax, 3
push ecx
mov ecx, dword [esp + 0x18]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x64]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
inc eax
add edi, 4
add edx, 8
cmp eax, 0xc
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], edx
jl 0x41b7bc
mov edx, dword [0xa8e750]
mov edi, dword [esp + 0x58]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
add edx, edi
push edi
sub ecx, edx
inc eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x58]
push eax
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x68]
push edx
push eax
push esi
mov ecx, ebx
call fcn.0041ba10
mov ecx, dword [esp + 0x54]
lea edx, [esp + 0x10]
push ecx
push edi
push edx
push esi
mov ecx, ebx
call fcn.00419a10
mov ecx, 0xa90210
call fcn.009121d0
mov ecx, 0xa90220
call fcn.009121d0
mov ecx, dword [ebx + 0x2194]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x30]
push fcn.00911ee2
push 0x12d
lea edx, [esp + 0x1d4]
push 4
push edx
mov byte [esp + 0xa40], 0x14
call fcn.009128f2
lea ecx, [esp + 0x168]
mov byte [esp + 0xa30], 9
call fcn.00911f36
lea ecx, [esp + 0x60]
mov byte [esp + 0xa30], 8
call fcn.00911ee2
lea ecx, [esp + 0x64]
mov byte [esp + 0xa30], 7
call fcn.00911ee2
lea ecx, [esp + 0x30]
mov byte [esp + 0xa30], 6
call fcn.00911ee2
lea ecx, [esp + 0x38]
mov byte [esp + 0xa30], 5
call fcn.00911ee2
lea ecx, [esp + 0x40]
mov byte [esp + 0xa30], 4
call fcn.00911ee2
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa30], 3
call fcn.00911ee2
lea ecx, [esp + 0x68]
mov byte [esp + 0xa30], 2
call fcn.00911ee2
lea ecx, [esp + 0x20]
mov byte [esp + 0xa30], 1
call fcn.00911ee2
lea ecx, [esp + 0xc]
mov byte [esp + 0xa30], 0
call fcn.00911ee2
lea ecx, [esp + 0xb8]
mov dword [esp + 0xa30], 0xffffffff
call fcn.00911ee2
mov ecx, dword [esp + 0xa28]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4