Function at 0x4e5acc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test dword [0x84efac], 0xffffff80
jne 0x4e5afc
test dword [0x84efac], 0xffffffff
jne 0x4e87bc
call fcn.0079f000
jmp fcn.004e5acc
push edi
push esi
push ebp
push ebx
sub esp, 0x438
mov ebp, ecx
lea ecx, [esp + 0x1c]
call fcn.00736414
lea ecx, [esp + 0x20]
call fcn.00736414
lea ecx, [esp + 0x24]
call fcn.006ebda8
lea ecx, [esp + 0x24]
lea edi, [esp + 0x34]
lea esi, [esp + 0x1c]
lea ebx, [esp + 0x20]
lea edx, [esp + 0x30]
lea eax, [esp + 0x2c]
push eax
push edx
push ebx
push esi
push edi
push ecx
mov ecx, dword [esp + 0x468]
call fcn.006f169c
movzx eax, al
test eax, eax
je 0x4e5b87
mov eax, dword [esp + 0x34]
cmp eax, 0x70
je 0x4e5bb1
lea ecx, [esp + 0x24]
call fcn.004330e0
lea ecx, [esp + 0x20]
call fcn.00701810
lea ecx, [esp + 0x1c]
call fcn.00701810
xor eax, eax
add esp, 0x438
pop ebx
pop ebp
pop esi
pop edi
ret 8
lea ecx, [esp + 0x24]
call fcn.004330e0
lea ecx, [esp + 0x20]
call fcn.00701810
lea ecx, [esp + 0x1c]
call fcn.00701810
xor eax, eax
add esp, 0x438
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov edi, dword [esp + 0x20]
test edi, edi
je 0x4e5bcf
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4e5bcb
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x4e5bc3
test eax, eax
jg 0x4e5c22
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4e5be8
mov dword [esp + 0x24], 0
je 0x4e5be8
push 1
call fcn.00433260
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4e5c01
mov dword [esp + 0x28], 0
je 0x4e5c01
push 1
call fcn.00433290
lea ecx, [esp + 0x20]
call fcn.00701810
lea ecx, [esp + 0x1c]
call fcn.00701810
xor eax, eax
add esp, 0x438
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov eax, dword [esp + 0x2c]
test eax, eax
jl 0x4e5bcf
lea ecx, [esp + 0x38]
call fcn.00736414
lea ecx, [esp + 0x3c]
call fcn.00736414
lea ecx, [esp + 0x48]
call fcn.00736414
xor eax, eax
mov edx, 1
lea ecx, [esp + 0x54]
mov byte [esp + 0x42], al
mov byte [esp + 0x43], al
mov dword [esp + 0x4c], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x50], edx
mov byte [esp + 0x40], al
mov byte [esp + 0x41], dl
call fcn.006ebda8
lea ecx, [esp + 0x5c]
call fcn.006ebda8
lea ecx, [esp + 0x64]
call fcn.00736414
push 2
call fcn.006f4dfc
pop ecx
movzx eax, al
test eax, eax
je 0x4e602e
mov eax, 1
lea ecx, [esp + 0x64]
lea edx, [esp + 0x20]
mov dword [esp + 0x50], eax
mov byte [esp + 0x42], al
mov dword [esp + 0x4c], 0
push edx
call fcn.007017d0
lea ecx, [esp + 0x64]
push 1
call fcn.00701c60
mov ecx, 0x84fac0
lea eax, [esp + 0x68]
push 0
push eax
call fcn.006ecde8
lea ecx, [esp + 0x48]
lea eax, [esp + 0x68]
push eax
call fcn.007017d0
mov dword [esp + 0x44], 0
push edi
mov ecx, esp
lea eax, [esp + 0x68]
push eax
call fcn.00701760
lea ecx, [esp + 0x3c]
call fcn.0072bcf8
movzx eax, al
test eax, eax
jne 0x4e5df0
lea ecx, [esp + 0x68]
call fcn.00701810
lea ecx, [esp + 0x64]
call fcn.00701810
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x4e5d37
mov dword [esp + 0x5c], 0
je 0x4e5d37
push 1
call fcn.00433260
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4e5d50
mov dword [esp + 0x60], 0
je 0x4e5d50
push 1
call fcn.00433290
mov ecx, dword [esp + 0x54]
test ecx, ecx
je 0x4e5d69
mov dword [esp + 0x54], 0
je 0x4e5d69
push 1
call fcn.00433260
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x4e5d82
mov dword [esp + 0x58], 0
je 0x4e5d82
push 1
call fcn.00433290
lea ecx, [esp + 0x48]
call fcn.00701810
lea ecx, [esp + 0x3c]
call fcn.00701810
lea ecx, [esp + 0x38]
call fcn.00701810
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4e5db6
mov dword [esp + 0x24], 0
je 0x4e5db6
push 1
call fcn.00433260
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4e5dcf
mov dword [esp + 0x28], 0
je 0x4e5dcf
push 1
call fcn.00433290
lea ecx, [esp + 0x20]
call fcn.00701810
lea ecx, [esp + 0x1c]
call fcn.00701810
xor eax, eax
add esp, 0x438
pop ebx
pop ebp
pop esi
pop edi
ret 8
add esp, 0xfffffff8
mov ecx, esp
lea eax, [esp + 0x40]
push eax
call fcn.00701760
lea ecx, [esp + 0x5c]
xor eax, eax
mov word [esp + 4], ax
call fcn.006ee858
lea ecx, [esp + 0x74]
call fcn.006ebda8
add esp, 0xfffffff8
mov ecx, esp
lea eax, [esp + 0x44]
push eax
call fcn.00701760
lea ecx, [esp + 0x7c]
xor eax, eax
mov word [esp + 4], ax
call fcn.006ee858
lea ecx, [esp + 0x74]
call fcn.006ea05c
movzx eax, al
test eax, eax
je 0x4e5f0b
lea ecx, [esp + 0x24]
lea eax, [esp + 0x80]
push eax
call fcn.006ec268
lea ecx, [esp + 0x74]
lea eax, [esp + 0x80]
push eax
call fcn.006e9d34
mov ecx, dword [esp + 0x80]
test ecx, ecx
je 0x4e5e8c
mov dword [esp + 0x80], 0
je 0x4e5e8c
push 1
call fcn.00433260
mov ecx, dword [esp + 0x84]
test ecx, ecx
je 0x4e5eab
mov dword [esp + 0x84], 0
je 0x4e5eab
push 1
call fcn.00433290
lea ecx, [esp + 0x74]
lea eax, [esp + 0x88]
push eax
call fcn.006ed658
lea ecx, [esp + 0x74]
lea eax, [esp + 0x88]
push eax
call fcn.006e9d34
mov ecx, dword [esp + 0x88]
test ecx, ecx
je 0x4e5eec
mov dword [esp + 0x88], 0
je 0x4e5eec
push 1
call fcn.00433260
mov ecx, dword [esp + 0x8c]
test ecx, ecx
je 0x4e5f0b
mov dword [esp + 0x8c], 0
je 0x4e5f0b
push 1
call fcn.00433290
lea ecx, [esp + 0x74]
lea eax, [esp + 0x90]
push 0
push eax
call fcn.006ecde8
lea ecx, [esp + 0x68]
lea eax, [esp + 0x90]
push eax
call fcn.007017d0
lea ecx, [esp + 0x90]
call fcn.00701810
lea ecx, [esp + 0x68]
push 0x86d960
call fcn.007016c0
add esp, 0xfffffff8
mov ecx, esp
lea eax, [esp + 0x70]
push eax
call fcn.00701760
lea ecx, [esp + 0x7c]
xor eax, eax
mov word [esp + 4], ax
call fcn.006ee858
lea ecx, [esp + 0x74]
call fcn.00735574
lea ecx, [esp + 0x74]
call fcn.006ea19c
lea ecx, [esp + 0x54]
lea eax, [esp + 0x98]
push eax
call fcn.006ec404
lea ecx, [esp + 0x5c]
lea eax, [esp + 0x98]
push eax
call fcn.006e9d34
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x4e5fbb
mov dword [esp + 0x98], 0
je 0x4e5fbb
push 1
call fcn.00433260
mov ecx, dword [esp + 0x9c]
test ecx, ecx
je 0x4e5fda
mov dword [esp + 0x9c], 0
je 0x4e5fda
push 1
call fcn.00433290
lea ecx, [esp + 0x5c]
lea eax, [esp + 0x74]
push eax
call fcn.006ea37c
lea eax, [esp + 0x5c]
push eax
call fcn.006e882c
pop ecx
mov ecx, dword [esp + 0x74]
test ecx, ecx
je 0x4e600c
mov dword [esp + 0x74], 0
je 0x4e600c
push 1
call fcn.00433260
mov ecx, dword [esp + 0x78]
test ecx, ecx
je 0x4e6025
mov dword [esp + 0x78], 0
je 0x4e6025
push 1
call fcn.00433290
lea ecx, [esp + 0x68]
call fcn.00701810
mov edi, dword [esp + 0x44c]
mov eax, dword [ebp + edi*4 + 0x1f30]
mov edx, 1
xor edi, edi
cmp eax, 0
cmovne edi, edx
test edi, edi
je 0x4e6054
mov ecx, ebp
call fcn.005344a8
call fcn.006f50c8
lea ecx, [ebp + 0x1f30]
lea esi, [ebp + 4]
movzx edx, byte [0x84f85c]
mov dword [esp + 0x394], ecx
push eax
push edx
push esi
mov eax, dword [esp + 0x458]
push eax
call fcn.00444430
mov ebx, eax
mov edx, dword [esp + 0x44c]
mov ecx, ebp
push edx
call fcn.004dfb4c
test edi, edi
je 0x4e609c
mov ecx, ebp
call fcn.00534388
test ebx, ebx
je 0x4e86cc
lea ecx, [ebp + 0x328]
lea edx, [esp + 0x24]
mov dword [esp + 0x3a0], ecx
push edx
call fcn.0054200c
test eax, eax
je 0x4e61a7
cmp eax, 2
je 0x4e61a7
lea ecx, [esp + 0x64]
call fcn.00701810
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x4e60ee
mov dword [esp + 0x5c], 0
je 0x4e60ee
push 1
call fcn.00433260
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4e6107
mov dword [esp + 0x60], 0
je 0x4e6107
push 1
call fcn.00433290
mov ecx, dword [esp + 0x54]
test ecx, ecx
je 0x4e6120
mov dword [esp + 0x54], 0
je 0x4e6120
push 1
call fcn.00433260
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x4e6139
mov dword [esp + 0x58], 0
je 0x4e6139
push 1
call fcn.00433290
lea ecx, [esp + 0x48]
call fcn.00701810
lea ecx, [esp + 0x3c]
call fcn.00701810
lea ecx, [esp + 0x38]
call fcn.00701810
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4e616d
mov dword [esp + 0x24], 0
je 0x4e616d
push 1
call fcn.00433260
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4e6186
mov dword [esp + 0x28], 0
je 0x4e6186
push 1
call fcn.00433290
lea ecx, [esp + 0x20]
call fcn.00701810
lea ecx, [esp + 0x1c]
call fcn.00701810
xor eax, eax
add esp, 0x438
pop ebx
pop ebp
pop esi
pop edi
ret 8
lea ecx, [ebx + 0x8e20]
lea edx, [esp + 0x20]
push edx
call fcn.007017d0
lea ecx, [ebp + 0x760]
mov edx, dword [ebp + 0x760]
mov dword [esp + 0x3a4], ecx
call dword [edx + 0xc]
lea ecx, [eax + 0x6c]
mov edx, dword [eax + 0x6c]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push dword [esp + 0x2c]
call dword [edx + 0x34]
mov dword [esp + 0x3a8], eax
mov edi, eax
mov edx, dword [edi + 0x18]
lea ecx, [esp + 0xa0]
mov dword [esp + 0x3ac], edx
xor edx, edx
mov dword [esp + 0x3b0], edx
xor dl, dl
mov byte [esp + 0x3ec], dl
mov edx, 1
mov dword [esp + 0x3b4], edx
call fcn.00736414
lea ecx, [esp + 0xa4]
call fcn.006ebda8
add esp, 0xfffffff4
mov ecx, esp
push 0x86d96c
call fcn.00701780
lea ecx, [esp + 8]
call fcn.00736414
lea ecx, [esp + 0xc0]
mov byte [esp + 4], 1
call fcn.0072c890
mov eax, dword [esp + 0x3ac]
movss xmm1, dword [0x86dae4]
xor edx, edx
cvtsi2ss xmm0, eax
divss xmm1, xmm0
xor edi, edi
movss dword [esp + 0xcc], xmm1
test eax, eax
mov dword [esp + 0x3f4], edx
jg 0x4e6290
xor edx, edx
mov dword [esp + 0x3dc], edx
jmp 0x4e7901
lea eax, [esp + 0xe0]
and eax, 7
mov dword [esp + 0x42c], edx
mov dword [esp + 0x428], edx
mov dword [esp + 0x3f0], edx
mov edx, dword [esp + 0x3a8]
lea edx, [edx + 0x24]
movss dword [esp + 0x3e4], xmm0
mov dword [esp + 0x3c0], eax
mov dword [esp + 0x3bc], edx
mov dword [esp + 0x3b8], edi
mov dword [esp + 0x39c], ebx
mov dword [esp + 0x398], esi
mov dword [esp + 0x390], ebp
mov edx, dword [esp + 0x3a8]
mov eax, dword [edx + 0x24]
mov ecx, dword [esp + 0x3bc]
call dword [eax + 0xc]
mov ecx, eax
mov edx, dword [ecx]
mov ebx, dword [esp + 0x3b8]
push ebx
call dword [edx + 0x34]
mov dword [esp + 0x3c4], eax
mov edx, eax
lea ecx, [edx + 0x78]
mov eax, dword [edx + 0x78]
mov dword [esp + 0x3c8], ecx
call dword [eax + 0xc]
mov edi, dword [eax]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0x3d4], edx
xor ecx, ecx
xor ebx, ebx
xor al, al
xor esi, esi
mov byte [esp + 0x3e8], al
mov dword [esp + 0x3d8], ecx
mov dword [esp + 0x3cc], edi
lea esi, [esi]
lea edi, [edi]
mov eax, dword [esp + 0x3c4]
mov edx, dword [eax + 0x78]
mov ecx, dword [esp + 0x3c8]
call dword [edx + 0xc]
mov eax, dword [eax + esi + 0xac]
test eax, eax
jl 0x4e64f2
mov eax, dword [esp + 0x3c4]
mov edx, dword [eax + 0x78]
mov ecx, dword [esp + 0x3c8]
call dword [edx + 0xc]
mov eax, dword [eax + esi + 0x24]
cmp eax, 0x84
je 0x4e86ac
mov eax, dword [esp + 0x3c4]
mov edx, dword [eax + 0x78]
mov ecx, dword [esp + 0x3c8]
call dword [edx + 0xc]
mov eax, dword [eax + esi + 0x24]
cmp eax, 0x85
jne 0x4e642c
test ebp, ebp
je 0x4e63dc
mov al, 1
mov byte [esp + 0x3ec], al
jmp 0x4e64cc
mov al, 1
mov edx, dword [esp + 0x3c4]
mov ebp, dword [edx + 0x78]
mov byte [esp + 0x3e8], al
mov ecx, dword [esp + 0x3c8]
call dword [ebp + 0xc]
mov ebp, dword [eax + esi + 0x18]
mov eax, dword [esp + 0x3c4]
mov edx, dword [eax + 0x78]
mov ecx, dword [esp + 0x3c8]
call dword [edx + 0xc]
mov edx, 1
mov ecx, dword [eax + esi + 0x20]
shl edx, cl
mov dword [esp + 0x3d8], edx
jmp 0x4e64f2
mov eax, dword [esp + 0x3c4]
mov edx, dword [eax + 0x78]
mov ecx, dword [esp + 0x3c8]
call dword [edx + 0xc]
mov eax, dword [eax + esi + 0x24]
cmp eax, 0x80
jge 0x4e64cc
test ebp, ebp
je 0x4e646c
mov al, 1
mov byte [esp + 0x3ec], al
jmp 0x4e64cc
mov eax, dword [esp + 0x3c4]
mov edx, dword [eax + 0x78]
mov ecx, dword [esp + 0x3c8]
call dword [edx + 0xc]
mov eax, dword [eax + esi + 0x24]
mov edx, dword [esp + 0x3c4]
mov ebp, dword [edx + 0x78]
mov dword [esp + 0x3d4], eax
mov ecx, dword [esp + 0x3c8]
call dword [ebp + 0xc]
mov ebp, dword [eax + esi + 0x18]
mov eax, dword [esp + 0x3c4]
mov edx, dword [eax + 0x78]
mov ecx, dword [esp + 0x3c8]
call dword [edx + 0xc]
mov edx, 1
mov ecx, dword [eax + esi + 0x20]
shl edx, cl
mov dword [esp + 0x3d8], edx
jmp 0x4e64f2
mov eax, dword [esp + 0x3c4]
mov edx, dword [eax + 0x78]
mov ecx, dword [esp + 0x3c8]
call dword [edx + 0xc]
mov edx, dword [esp + 0x3b0]
or edx, dword [eax + esi + 0x18]
mov dword [esp + 0x3b0], edx
add esi, 0x98
cmp esi, 0x2f8
jl 0x4e635c
mov ecx, dword [esp + 0x3d8]
mov edi, dword [esp + 0x3cc]
mov eax, dword [esp + 0x3b8]
cvtsi2ss xmm0, eax
divss xmm0, dword [esp + 0x3e4]
xor eax, eax
mov edx, 0x20
mov esi, dword [esp + 0x3c0]
test esi, esi
je 0x4e654d
mov edx, esi
test dl, 3
jne 0x4e65f7
mov esi, 1
mov edx, 0x1f
and edx, 3
neg edx
add edx, 0x20
test esi, esi
je 0x4e656e
xor eax, eax
mov dword [esp + 0x160], eax
mov dword [esp + 0xe0], eax
mov eax, 1
pxor mm0, mm0
movq qword [esp + 0x430], mm0
mov dword [esp + 0x3d8], ecx
mov dword [esp + 0x3d0], ebp
mov dword [esp + 0x3cc], edi
jmp 0x4e65ac
movq qword [esp + eax*4 + 0x158], mm0
movq qword [esp + eax*4 + 0xd8], mm0
movq mm0, qword [esp + 0x430]
movq qword [esp + eax*4 + 0x160], mm0
movq qword [esp + eax*4 + 0xe0], mm0
add eax, 4
cmp eax, edx
jl 0x4e659c
movq qword [esp + eax*4 + 0x158], mm0
movq qword [esp + eax*4 + 0xd8], mm0
mov ecx, dword [esp + 0x3d8]
mov ebp, dword [esp + 0x3d0]
mov edi, dword [esp + 0x3cc]
emms
cmp eax, 0x20
jge 0x4e6637
mov dword [esp + 0x3d8], ecx
mov dword [esp + 0x3d0], ebp
mov dword [esp + 0x3cc], edi
xor edx, edx
mov dword [esp + eax*4 + 0x160], edx
mov dword [esp + eax*4 + 0xe0], edx
inc eax
cmp eax, 0x20
jl 0x4e660c
mov ecx, dword [esp + 0x3d8]
mov ebp, dword [esp + 0x3d0]
mov edi, dword [esp + 0x3cc]
xor eax, eax
test edi, edi
jle 0x4e869c
mov esi, ebp
or esi, ebx
mov edx, dword [esp + 0x3c4]
lea edx, [edx + 0x98]
mov dword [esp + 0x3f8], edx
mov dl, byte [esp + 0x3e8]
mov byte [esp + 0x3fc], dl
mov edx, dword [esp + 0x3a8]
lea edx, [edx + 0x44]
movss dword [esp + 0x3e0], xmm0
mov dword [esp + 0x414], edx
mov dword [esp + 0x410], esi
mov esi, dword [esp + 0x3c4]
mov dword [esp + 0x40c], ebx
mov dword [esp + 0x3d8], ecx
mov dword [esp + 0x3d0], ebp
mov ebp, eax
mov dword [esp + 0x3cc], edi
mov edx, dword [esi + 0x78]
mov ecx, dword [esp + 0x3c8]
call dword [edx + 0xc]
lea ecx, [eax + 4]
mov edx, dword [eax + 4]
call dword [edx + 0xc]
mov edx, dword [eax + ebp*4]
test edx, edx
mov dword [esp + 0x418], edx
jl 0x4e78ac
mov ebx, dword [esp + 0x390]
mov edx, dword [ebx + 0x760]
mov ecx, dword [esp + 0x3a4]
call dword [edx + 0xc]
lea ecx, [eax + 0xcc]
mov edx, dword [eax + 0xcc]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x30]
mov edx, dword [esp + 0x418]
cmp edx, eax
jae 0x4e78ac
test ebp, ebp
jne 0x4e6754
mov edx, dword [ebx + 0x760]
mov ecx, dword [esp + 0x3a4]
call dword [edx + 0xc]
lea ecx, [eax + 0xcc]
mov edx, dword [eax + 0xcc]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
movzx ebx, word [eax + 2]
mov ecx, 1
xor edx, edx
cmp ebx, 2
cmove edx, ecx
mov dword [esp + 0x3f0], edx
mov ebx, ebp
mov edx, dword [esi + 0x98]
mov ecx, dword [esp + 0x3f8]
and ebx, dword [esp + 0x410]
mov dword [esp + 0x3e8], ebx
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov edx, dword [eax + 0x68]
test edx, edx
jne 0x4e67cc
lea edx, [esp + ebx*4 + 0x160]
lea ecx, [esp + ebx*4 + 0xe0]
mov dword [esp + 0x41c], edx
xor edx, edx
mov dword [esp + ebx*4 + 0x160], 0
mov dword [esp + 0x420], ecx
mov ecx, 0x7f
mov dword [esp + ebx*4 + 0xe0], 0x7f
jmp 0x4e689d
mov edx, dword [esp + 0x3f0]
movzx ebx, dl
mov ecx, 2
mov edi, 1
cmp ebx, 0
cmovne edi, ecx
mov eax, ebp
cdq
idiv edi
test edx, edx
jne 0x4e686c
mov ecx, dword [esp + 0x3e8]
lea edi, [esp + ecx*4 + 0x160]
lea ebx, [esp + ecx*4 + 0xe0]
mov dword [esp + 0x41c], edi
mov edx, dword [esp + ecx*4 + 0xe0]
inc edx
mov dword [esp + 0x420], ebx
cmp edx, 0x7f
mov dword [esp + ecx*4 + 0x160], edx
jg 0x4e78ac
mov edx, dword [esi + 0x98]
mov ecx, dword [esp + 0x3f8]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov ecx, dword [eax + 0x68]
mov edx, dword [esp + 0x3e8]
mov dword [esp + edx*4 + 0xe0], ecx
mov edx, dword [esp + edx*4 + 0x160]
jmp 0x4e689d
mov ecx, dword [esp + 0x3e8]
lea edx, [esp + ecx*4 + 0x160]
lea ebx, [esp + ecx*4 + 0xe0]
mov dword [esp + 0x41c], edx
mov edx, dword [esp + ecx*4 + 0x160]
mov ecx, dword [esp + ecx*4 + 0xe0]
mov dword [esp + 0x420], ebx
cmp edx, ecx
jne 0x4e68bc
dec ecx
mov edx, dword [esp + 0x420]
mov dword [edx], ecx
jmp 0x4e78ac
jg 0x4e78ac
mov edx, dword [esp + 0x390]
push dword [edx + 0x1e68]
push dword [edx + 0x1ae4]
push 0xffffffffffffffff
mov ecx, dword [esp + 0x3a8]
call fcn.006b70b8
mov dword [esp + 0x424], eax
mov edx, dword [esp + 0x3b0]
test edx, ebp
je 0x4e6924
mov edx, dword [esp + 0x3f0]
movzx edi, dl
test edi, edi
je 0x4e691c
mov ecx, ebp
and ecx, 0xfffffffe
mov edx, eax
mov dword [edx + 0x9680], ecx
jmp 0x4e6924
mov edx, eax
mov dword [edx + 0x9680], ebp
mov edx, dword [esp + 0x40c]
and edx, ebp
mov dword [esp + 0x3dc], edx
jne 0x4e694c
xor dl, dl
mov byte [esp + 0x3e8], dl
jmp 0x4e6a48
mov bl, 1
mov edx, eax
mov ecx, dword [esp + 0x3f8]
mov byte [esp + 0x3e8], bl
mov byte [edx + 0x22], 1
mov edi, dword [esi + 0x98]
call dword [edi + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x28]
mov edx, dword [eax + 0x28]
call dword [edx + 0xc]
mov edx, dword [eax + 0x14]
cmp edx, 8
jne 0x4e699c
xor dl, dl
mov byte [esp + 0x3e8], dl
jmp 0x4e6a48
mov edx, dword [esi + 0x98]
mov ecx, dword [esp + 0x3f8]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x28]
mov edx, dword [eax + 0x28]
call dword [edx + 0xc]
mov edx, dword [eax + 0x14]
shr edx, 0x1f
fild dword [eax + 0x14]
fadd dword [edx*4 + 0x86db50]
fmul dword [0x86dae0]
fmul qword [0x86da70]
fadd qword [0x86da78]
fstp qword [esp]
call sub.MSVCRT.dll_exp
fadd st(0)
fstp qword [esp + 0x380]
mov edi, dword [esp + 0x380]
mov edx, dword [esp + 0x384]
mov ecx, edx
shr ecx, 0x14
and ecx, 0x7ff
cmp ecx, 0x3fe
jle 0x4e6a3c
mov ebx, edx
neg ecx
add ecx, 0x41e
shld ebx, edi, 0xb
or ebx, 0x80000000
shr ebx, cl
mov ecx, ebx
neg ecx
cmp edx, 0
cmovge ecx, ebx
jmp 0x4e6a3e
xor ecx, ecx
mov edx, dword [esp + 0x424]
mov dword [edx + 0x24], ecx
mov edx, dword [esp + 0x3d0]
test edx, edx
je 0x4e6b76
and edx, ebp
mov dword [esp + 0x428], edx
xor ecx, ecx
mov edx, dword [esp + 0x3d0]
mov dword [esp + 0x404], ebp
lea esi, [esi]
lea edi, [edi]
mov eax, edx
sar eax, cl
and eax, 1
cmp eax, 1
je 0x4e867c
inc ecx
cmp ecx, 0x20
jl 0x4e6a7c
mov ebp, dword [esp + 0x404]
mov esi, dword [esp + 0x3c4]
mov ebx, dword [esp + 0x428]
mov dl, byte [esp + 0x3fc]
sar ebx, cl
test dl, dl
mov dword [esp + 0x428], ebx
jne 0x4e6afc
mov eax, 0x80
xor edx, edx
mov ecx, dword [esp + 0x3d8]
idiv ecx
mov ecx, dword [esp + 0x424]
mov edx, dword [esp + 0x3d4]
mov dword [ecx + 0x28], 2
mov edi, eax
mov dword [ecx + 0x34], edx
imul edi, dword [esp + 0x428]
mov dword [ecx + 0x38], edi
lea ebx, [edi + eax - 1]
mov dword [ecx + 0x3c], ebx
jmp 0x4e6b76
mov ebx, dword [esp + 0x3a8]
mov edx, dword [ebx + 0x44]
mov ecx, dword [esp + 0x414]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov edi, dword [eax + 4]
mov edx, dword [ebx + 0x44]
mov dword [esp + 0x400], edi
mov ecx, dword [esp + 0x414]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov eax, dword [eax + 8]
mov ecx, edi
sub eax, ecx
inc eax
mov ebx, dword [esp + 0x3d8]
cdq
idiv ebx
mov edx, 1
cmp eax, 1
mov ebx, dword [esp + 0x424]
cmovg edx, eax
mov edi, edx
mov dword [ebx + 0x28], 1
imul edi, dword [esp + 0x428]
add ecx, edi
lea edi, [ecx + edx - 1]
mov dword [ebx + 0x2c], ecx
mov dword [ebx + 0x30], edi
mov edx, dword [esi + 0x98]
mov ecx, dword [esp + 0x3f8]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
lea ecx, [eax + 0x20]
mov edx, dword [eax + 0x20]
call dword [edx + 0xc]
mov ebx, dword [eax + 0x44]
mov ecx, 1
xor edx, edx
cmp ebx, 0
mov edi, dword [esp + 0x424]
cmove edx, ecx
mov ecx, dword [esp + 0x3f8]
mov byte [edi + 0x20], dl
mov ebx, dword [esi + 0x98]
call dword [ebx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x48]
mov edx, dword [eax + 0x48]
call dword [edx + 0xc]
mov edx, dword [eax]
test edx, edx
je 0x4e6cfe
mov edx, dword [esi + 0x98]
mov ecx, dword [esp + 0x3f8]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x48]
mov edx, dword [eax + 0x48]
call dword [edx + 0xc]
mov edx, dword [eax + 4]
test edx, edx
je 0x4e823c
cmp edx, 1
je 0x4e6c5c
cmp edx, 2
jne 0x4e6c3c
mov edx, edi
mov dword [edx + 0x95e8], 4
jmp 0x4e6c68
cmp edx, 3
jne 0x4e6c68
mov edx, edi
mov dword [edx + 0x95e8], 9
jmp 0x4e6c68
mov edx, edi
mov dword [edx + 0x95e8], 5
mov edx, dword [esi + 0x98]
mov ecx, dword [esp + 0x3f8]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x48]
mov edx, dword [eax + 0x48]
call dword [edx + 0xc]
push dword [eax + 0xc]
call fcn.00543b60
fstp qword [esp + 0x434]
add esp, 4
fld qword [esp + 0x430]
mov ebx, edi
mov ecx, dword [esp + 0x3f8]
fstp dword [ebx + 0x95f8]
mov edx, dword [esi + 0x98]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x48]
mov edx, dword [eax + 0x48]
call dword [edx + 0xc]
mov ecx, dword [eax + 0x14]
mov edx, ebx
cvtsi2ss xmm4, ecx
shr ecx, 0x1f
addss xmm4, dword [ecx*4 + 0x86db50]
mulss xmm4, dword [0x86dadc]
movss dword [edx + 0x95fc], xmm4
xor ebx, ebx
mov dword [esp + 0x404], ebp
nop
lea esi, [esi]
imul ebp, ebx, 0x3bc
lea eax, [edi + ebp]
mov ecx, dword [esp + 0x3f8]
mov dword [esp + 0x408], eax
mov dword [eax + 0x5a8], 1
mov dword [eax + 0x8bc], 2
mov dword [eax + 0x5dc], 0
mov dword [eax + 0x52c], 0x3f800000
mov edx, dword [esi + 0x98]
call dword [edx + 0xc]
mov ecx, eax
mov edx, dword [ecx]
mov eax, dword [esp + 0x404]
push eax
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x14]
mov eax, dword [eax + 0x14]
push ebx
call dword [eax + 0x34]
push dword [eax + 4]
call fcn.00543b30
fstp qword [esp + 0x434]
add esp, 4
fld qword [esp + 0x430]
mov eax, dword [esp + 0x408]
cmp ebx, 1
fmul qword [0x86da68]
fst qword [esp + 0x430]
fstp dword [eax + 0x5e4]
je 0x4e864c
mov dword [ebp + edi + 0x5e8], 0
mov eax, dword [esi + 0x98]
mov ecx, dword [esp + 0x3f8]
call dword [eax + 0xc]
mov ecx, eax
mov edx, dword [ecx]
mov eax, dword [esp + 0x404]
push eax
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x14]
mov eax, dword [eax + 0x14]
push ebx
call dword [eax + 0x34]
push dword [eax + 8]
call fcn.00543b30
fstp qword [esp + 0x434]
add esp, 4
fld qword [esp + 0x430]
mov ecx, dword [esp + 0x3f8]
fmul qword [0x86da68]
fstp dword [ebp + edi + 0x5ec]
mov eax, dword [esi + 0x98]
call dword [eax + 0xc]
mov ecx, eax
mov edx, dword [ecx]
mov eax, dword [esp + 0x404]
push eax
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x14]
mov eax, dword [eax + 0x14]
push ebx
call dword [eax + 0x34]
push dword [eax + 0x14]
call fcn.00543b30
fstp qword [esp + 0x434]
add esp, 4
fld qword [esp + 0x430]
mov ecx, dword [esp + 0x3f8]
fmul qword [0x86da68]
fstp dword [ebp + edi + 0x5f0]
mov eax, dword [esi + 0x98]
call dword [eax + 0xc]
mov ecx, eax
mov edx, dword [ecx]
mov eax, dword [esp + 0x404]
push eax
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x14]
mov eax, dword [eax + 0x14]
push ebx
call dword [eax + 0x34]
mov eax, dword [eax + 0x10]
inc ebx
cvtsi2ss xmm0, eax
shr eax, 0x1f
addss xmm0, dword [eax*4 + 0x86db50]
mulss xmm0, dword [0x86dad0]
cmp ebx, 2
movss dword [ebp + edi + 0x5e0], xmm0
jge 0x4e6eec
cmp ebx, 1
jne 0x4e6d0c
mov eax, dword [edi + 0x95e8]
test eax, eax
jne 0x4e6d0c
jmp 0x4e87a7
mov ebp, dword [esp + 0x404]
mov edx, 1
mov ebx, dword [esp + 0x424]
mov ecx, 4
mov word [ebx + 0x528], dx
movss xmm3, dword [ebx + 0x95f8]
mov edi, dword [ebx + 0x95f8]
mov word [ebx + 0x8e4], cx
mov ecx, dword [esp + 0x3f8]
mov dword [ebx + 0x964], edx
mov dword [ebx + 0x8e8], edi
mov dword [ebx + 0x95f8], 0
subss xmm3, dword [0x86dad4]
movss dword [ebx + 0x8e8], xmm3
mov edx, dword [esi + 0x98]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x14]
mov edx, dword [eax + 0x14]
push 2
call dword [edx + 0x34]
mov edx, dword [eax + 0x38]
test edx, edx
je 0x4e7048
mov edx, 2
mov edi, 3
mov dword [ebx + 0xd20], 1
mov ecx, dword [esp + 0x3f8]
mov dword [ebx + 0x1034], edx
mov dword [ebx + 0xd54], edx
mov word [ebx + 0xca0], di
mov edx, dword [esi + 0x98]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x14]
mov edx, dword [eax + 0x14]
push 2
call dword [edx + 0x34]
mov edi, dword [eax + 0x38]
mov ecx, dword [esp + 0x3f8]
cvtsi2ss xmm4, edi
mulss xmm4, dword [0x86dacc]
movss dword [ebx + 0xca4], xmm4
mov edx, dword [esi + 0x98]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x14]
mov edx, dword [eax + 0x14]
push 2
call dword [edx + 0x34]
push dword [eax + 4]
call fcn.00543b30
fstp qword [esp + 0x434]
add esp, 4
fld qword [esp + 0x430]
mov edx, ebx
fmul qword [0x86da68]
fstp dword [edx + 0xf50]
mov dword [edx + 0xf54], 0
mov dword [edx + 0xf4c], 0
xor ebx, ebx
mov edi, dword [esp + 0x424]
lea esi, [esi]
lea edi, [edi]
mov edx, dword [esi + 0x98]
mov ecx, dword [esp + 0x3f8]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebx
call dword [edx + 0x34]
mov edx, dword [eax + 4]
test edx, edx
je 0x4e7188
mov edx, 1
mov ecx, dword [esp + 0x3f8]
mov dword [edi + 0x10dc], edx
mov dword [edi + 0x13f0], edx
mov dword [edi + 0x10e4], 2
mov edx, dword [esi + 0x98]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebx
call dword [edx + 0x34]
push dword [eax]
call fcn.00543b30
fstp qword [esp + 0x434]
add esp, 4
fld qword [esp + 0x430]
mov ecx, dword [esp + 0x3f8]
fstp dword [edi + 0x13f8]
mov edx, dword [esi + 0x98]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebx
call dword [edx + 0x34]
mov edx, dword [eax + 4]
cvtsi2ss xmm3, edx
shr edx, 0x1f
addss xmm3, dword [edx*4 + 0x86db50]
mulss xmm3, dword [0x86dac8]
movss dword [edi + 0x1060], xmm3
test ebx, ebx
je 0x4e717c
cmp ebx, 1
jne 0x4e715c
mov edx, 4
mov word [edi + 0x105c], dx
jmp 0x4e7188
cmp ebx, 2
jne 0x4e7188
mov edx, 3
mov word [edi + 0x105c], dx
jmp 0x4e7188
mov edx, 1
mov word [edi + 0x105c], dx
inc ebx
cmp ebx, 3
jl 0x4e705c
mov ebx, 1
mov edx, dword [esp + 0x424]
mov ecx, dword [esp + 0x3f8]
mov dword [edx + 0x4168], ebx
mov byte [edx + 0x4386], bl
mov byte [edx + 0x4387], 6
mov word [edx + 0x40e8], bx
mov edi, dword [esi + 0x98]
call dword [edi + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x28]
mov edx, dword [eax + 0x28]
call dword [edx + 0xc]
mov edi, dword [eax + 4]
neg edi
add edi, 6
mov dword [esp + 0x388], edi
shr edi, 0x1f
mov ebx, dword [esp + 0x424]
fild dword [esp + 0x388]
mov ecx, dword [esp + 0x3f8]
fadd dword [edi*4 + 0x86db50]
fmul qword [0x86da60]
fst dword [ebx + 0x40ec]
fld dword [0x86dae4]
fcomi st(1)
fcmovnbe st(0), st(1)
fstp st(1)
fst dword [ebx + 0x40ec]
fld dword [0x86dad4]
fcomi st(1)
fcmovb st(0), st(1)
fstp st(1)
fstp dword [ebx + 0x40ec]
mov edx, dword [esi + 0x98]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x48]
mov edx, dword [eax + 0x48]
call dword [edx + 0xc]
mov edx, dword [eax + 0x20]
cmp edx, 0x64
jae 0x4e7331
mov ecx, 1
mov edx, ebx
mov ebx, 4
mov dword [edx + 0x4410], ecx
mov byte [edx + 0x462e], cl
mov byte [edx + 0x462f], 6
mov ecx, dword [esp + 0x3f8]
mov word [edx + 0x4390], bx
mov edi, dword [esi + 0x98]
call dword [edi + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x48]
mov edx, dword [eax + 0x48]
call dword [edx + 0xc]
mov ecx, dword [eax + 0x20]
neg ecx
add ecx, 0x64
cvtsi2ss xmm1, ecx
shr ecx, 0x1f
addss xmm1, dword [ecx*4 + 0x86db50]
mulss xmm1, dword [0x86dad0]
mulss xmm1, xmm1
mov edx, dword [esp + 0x424]
movss dword [edx + 0x4394], xmm1
minss xmm1, dword [0x86dae4]
movss xmm4, dword [edx + 0x8e8]
movss dword [edx + 0x4394], xmm1
movss xmm0, dword [0x86dac4]
addss xmm4, xmm1
comiss xmm4, xmm0
jbe 0x4e7331
subss xmm0, xmm1
movss dword [edx + 0x8e8], xmm0
maxss xmm0, dword [0x86dad4]
movss dword [edx + 0x8e8], xmm0
mov ebx, 1
mov edi, dword [esp + 0x424]
mov ecx, 3
mov dword [edi + 0x46b8], ebx
mov dl, byte [esp + 0x3e8]
test dl, dl
mov byte [edi + 0x48d6], bl
mov byte [edi + 0x48d7], bl
mov word [edi + 0x4638], cx
mov dword [edi + 0x463c], 0x3daaaaab
je 0x4e7399
mov edx, 1
mov dword [edi + 0x4960], edx
mov byte [edi + 0x4b7e], dl
mov byte [edi + 0x4b7f], 8
mov word [edi + 0x48e0], dx
mov dword [edi + 0x48e4], 0x3f800000
mov edi, 0x866c6c
mov ebx, 0x866c6c
mov eax, 0x86dec8
mov edx, 0x86ded4
mov ecx, dword [esp + 0x3dc]
test ecx, ecx
je 0x4e73ba
mov edi, eax
mov dword [esp + 0x400], edi
mov edi, dword [esp + 0x3d0]
je 0x4e73cc
mov ebx, edx
test edi, edi
je 0x4e7558
lea ebx, [esp + 0x1e0]
mov dl, byte [esp + 0x3fc]
test dl, dl
jne 0x4e744c
mov edi, dword [esp + 0x400]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4e73ff
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x4e73f7
mov edx, 0x86def0
mov ecx, 0x866c6c
cmp eax, 0
lea edi, [esp + 0x1e0]
cmova ecx, edx
mov edx, dword [esp + 0x428]
lea edx, [edx + 1]
mov eax, dword [esp + 0x3d4]
push eax
mov eax, dword [esp + 0x3dc]
push eax
push edx
push ecx
push 0x86def4
push edi
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
jmp 0x4e7558
mov edi, dword [esp + 0x400]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4e7465
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x4e745d
mov dword [esp + 0x3e8], eax
mov edx, dword [esp + 0x424]
mov ecx, dword [edx + 0x2c]
mov eax, 0x2aaaaaab
mov edi, ecx
imul ecx
sar edx, 1
sar edi, 0x1f
sub edx, edi
lea edi, [edx*8]
lea edi, [edi + edx*4]
neg edi
add edi, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
sar ecx, 0x1f
sub edx, ecx
add edx, 0xfffffffe
push edx
push dword [edi*4 + 0x7b22f0]
push 0x86dec0
lea edx, [esp + 0x2ec]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov edx, dword [esp + 0x424]
mov ecx, dword [edx + 0x30]
mov eax, 0x2aaaaaab
mov edi, ecx
sar edi, 0x1f
imul ecx
sar edx, 1
sub edx, edi
lea edi, [edx*8]
lea edi, [edi + edx*4]
neg edi
add edi, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
sar ecx, 0x1f
sub edx, ecx
add edx, 0xfffffffe
push edx
push dword [edi*4 + 0x7b22f0]
push 0x86dec0
lea edx, [esp + 0x2ec]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov ecx, 0x86def0
mov edx, 0x866c6c
mov edi, dword [esp + 0x3e8]
cmp edi, 0
lea edi, [esp + 0x2e0]
cmova edx, ecx
lea ecx, [esp + 0x1e0]
lea eax, [esp + 0x2e0]
push eax
push edi
push edx
push 0x86ded8
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
mov edx, dword [esp + 0x424]
mov ecx, dword [edx + 0x9680]
mov eax, 0x866c6c
mov edi, 0x86df0c
cmp ecx, 0
cmovge ebx, eax
mov ecx, dword [esp + 0x400]
cmovge ecx, edi
mov dword [esp + 0x400], ecx
push edx
mov ecx, dword [esp + 0x3a0]
call fcn.006c2a68
mov ecx, dword [esp + 0x424]
lea edx, [ecx + 4]
inc eax
push ebx
mov ebx, dword [esp + 0x404]
push ebx
push eax
push 0x86df24
push edx
call fcn.007020f0
add esp, 0x14
lea ecx, [esp + 0x54]
call fcn.006ea05c
movzx edx, al
test edx, edx
jne 0x4e75d7
mov edx, dword [esp + 0x424]
mov dword [edx + 0x9654], 3
mov edx, dword [esp + 0x424]
push edx
mov ecx, dword [esp + 0x3a0]
call fcn.004e3efc
mov ebx, eax
test ebx, ebx
jl 0x4e862c
mov edx, dword [esp + 0x424]
push edx
mov ecx, dword [esp + 0x3a0]
call fcn.006c2a68
push eax
mov ecx, dword [esp + 0x3a0]
call fcn.006c2bb8
mov edx, dword [esp + 0x39c]
mov ebx, dword [edx + ebx*4 + 0x4010]
mov dword [esp + 0x424], ebx
mov edx, dword [esp + 0x424]
push edx
mov ecx, dword [esp + 0x3a0]
call fcn.006c2a68
push eax
mov ecx, dword [esp + 0x3a0]
call fcn.006c2738
mov dword [esp + 0x408], eax
xor edx, edx
mov ecx, eax
mov dword [esp + 0x404], ebp
xor eax, eax
mov dword [edx + ecx + 0x58], eax
mov dword [edx + ecx + 0x5c], eax
mov dword [edx + ecx + 0x60], eax
mov dword [edx + ecx + 0x6c], eax
mov byte [edx + ecx + 0x64], al
mov dword [edx + ecx + 0x68], 0x3f800000
mov byte [edx + ecx + 0x65], al
mov byte [edx + ecx + 0x66], al
add edx, 0x18
cmp edx, 0xd8
jl 0x4e765e
mov ebp, dword [esp + 0x404]
mov esi, dword [esp + 0x3c4]
mov edx, dword [esi + 0x98]
mov ecx, dword [esp + 0x3f8]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
lea ecx, [eax + 0x20]
mov edx, dword [eax + 0x20]
call dword [edx + 0xc]
mov edx, dword [eax + 0x10]
test edx, edx
je 0x4e7789
and dword [esp + 0x42c], 0xff000000
mov edx, dword [esi + 0x98]
mov ecx, dword [esp + 0x3f8]
mov dword [esp + 0x2f8], 0x3f800000
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
lea ecx, [eax + 0x40]
mov edx, dword [eax + 0x40]
call dword [edx + 0xc]
mov ebx, dword [eax + 8]
mov edx, dword [esi + 0x98]
mov ecx, dword [esp + 0x3f8]
mov dword [esp + 0x400], ebx
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
lea ecx, [eax + 0x40]
mov edx, dword [eax + 0x40]
call dword [edx + 0xc]
mov ebx, dword [eax + 0xc]
mov edi, dword [esp + 0x42c]
or edi, 0x300
mov dword [esp + 0x42c], edi
mov edx, dword [esp + 0x400]
mov ecx, dword [esp + 0x408]
mov dword [ecx + 0x58], edx
test edx, edx
mov dword [ecx + 0x5c], ebx
mov ebx, 0
mov dword [ecx + 0x60], ebx
mov dword [ecx + 0x64], edi
mov edi, dword [esp + 0x2f8]
mov dword [ecx + 0x68], edi
mov dword [ecx + 0x6c], ebx
jge 0x4e777e
mov ecx, edx
mov edx, dword [esp + 0x408]
mov dword [edx + 0x6c], ecx
mov edx, dword [esp + 0x408]
mov byte [edx + 0x66], 1
mov ebx, dword [esp + 0x390]
mov edx, dword [ebx + 0x760]
mov ecx, dword [esp + 0x3a4]
call dword [edx + 0xc]
lea ecx, [eax + 0xcc]
mov edx, dword [eax + 0xcc]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ebx, dword [esp + 0x418]
mov ecx, eax
push ebx
call dword [edx + 0x34]
lea ecx, [esp + 0xa0]
add eax, 0x10
push eax
call fcn.007017d0
lea ecx, [esp + 0x300]
call fcn.00736414
lea ecx, [esp + 0xa4]
lea edx, [esp + 0x24]
lea ebx, [esp + 0xa0]
push 0xffffffffffffffff
mov edi, dword [esp + 0x41c]
push edi
push eax
push ebx
push edx
call fcn.006ef994
lea ecx, [esp + 0x300]
call fcn.00701810
push 0
call fcn.006f4c6c
mov dword [esp + 0x404], eax
add esp, 4
xor edx, edx
lea ecx, [esp + 0x54]
mov dword [esp + 0x3e8], edx
call fcn.006ea05c
movzx edx, al
test edx, edx
je 0x4e860c
lea edx, [esp + 0xa4]
lea ecx, [esp + 0xb4]
mov ebx, dword [esp + 0x3e8]
push ebx
mov ebx, dword [esp + 0x3b8]
push ebx
push 1
push ecx
push 0
mov edi, dword [esp + 0x414]
push edi
mov ebx, dword [esp + 0x3b0]
push ebx
push edx
mov ecx, dword [esp + 0x428]
call fcn.006e002c
mov ebx, eax
test ebx, ebx
je 0x4e7f57
mov edx, dword [esp + 0x408]
push edx
mov ecx, dword [esp + 0x3a0]
call fcn.006c29c8
push eax
mov ecx, dword [esp + 0x3a0]
call fcn.006c2b28
cmp ebx, 4
je 0x4e82c6
inc ebp
mov edx, dword [esp + 0x3cc]
cmp ebp, edx
jl 0x4e66ad
mov eax, dword [esp + 0x3f4]
movzx ebx, al
test ebx, ebx
jne 0x4e82ac
mov edx, dword [esp + 0x3b8]
inc edx
mov eax, dword [esp + 0x3ac]
mov dword [esp + 0x3b8], edx
cmp edx, eax
jl 0x4e62ec
mov dword [esp + 0x3dc], ebx
mov ebx, dword [esp + 0x39c]
mov ebp, dword [esp + 0x390]
mov dl, byte [esp + 0x3ec]
test dl, dl
je 0x4e7976
lea ecx, [esp + 0x340]
call fcn.00736414
mov dword [esp + 0x33c], 0
lea ecx, [esp + 0x14]
push 0x86df34
call fcn.00701780
lea edx, [esp + 0x33c]
lea ecx, [esp + 0x33c]
lea edi, [esp + 0x14]
mov dword [esp + 0x10], edx
mov esi, 5
mov dword [esp + 0x18], 5
and esi, 0xf
or esi, 0x10
push esi
push edi
call fcn.006f2434
lea ecx, [esp + 0x14]
call fcn.00701810
lea ecx, [esp + 0x340]
call fcn.00701810
lea ecx, [esp + 0x54]
call fcn.006ea05c
movzx edx, al
test edx, edx
jne 0x4e7c0b
xor eax, eax
mov edi, dword [ebx + 0x8e18]
test edi, edi
jle 0x4e79b5
lea esi, [esi]
mov edx, dword [ebx + eax*4 + 0x10]
mov esi, dword [edx + 0x28]
inc eax
mov byte [esi + 0x374], 0
mov edi, dword [ebx + 0x8e18]
cmp eax, edi
jl 0x4e799c
xor esi, esi
test edi, edi
jle 0x4e7c0b
mov edx, dword [ebx + esi*4 + 0x10]
mov eax, dword [edx + 0x28]
mov dl, byte [eax + 0x374]
test dl, dl
jne 0x4e7c02
mov byte [eax + 0x374], 1
lea ecx, [esp + 0x344]
call fcn.006ebda8
mov edi, dword [ebx + esi*4 + 0x10]
mov ecx, dword [edi + 0x28]
add ecx, 0x344
lea edx, [esp + 0x34c]
push edx
call fcn.006ec268
lea ecx, [esp + 0x34c]
lea edx, [esp + 0x354]
push 0
push edx
call fcn.006ecde8
lea edx, [esp + 0xa0]
push dword [esp + 0x354]
push 0x86d988
push edx
call fcn.007020f0
add esp, 0xc
lea ecx, [esp + 0x354]
call fcn.00701810
mov ecx, dword [esp + 0x34c]
test ecx, ecx
je 0x4e7a5e
mov dword [esp + 0x34c], 0
je 0x4e7a5e
push 1
call fcn.00433260
mov ecx, dword [esp + 0x350]
test ecx, ecx
je 0x4e7a7d
mov dword [esp + 0x350], 0
je 0x4e7a7d
push 1
call fcn.00433290
lea ecx, [esp + 0xa0]
push 1
call fcn.00701c60
lea ecx, [esp + 0x358]
call fcn.006ebda8
lea ecx, [esp + 0x358]
lea edx, [esp + 0x5c]
push edx
call fcn.006e9d34
lea ecx, [esp + 0x360]
lea edx, [esp + 0xa0]
push 0
push edx
call fcn.006ea08c
lea ecx, [esp + 0x358]
push eax
call fcn.006ea37c
mov ecx, dword [esp + 0x360]
test ecx, ecx
je 0x4e7aea
mov dword [esp + 0x360], 0
je 0x4e7aea
push 1
call fcn.00433260
mov ecx, dword [esp + 0x364]
test ecx, ecx
je 0x4e7b09
mov dword [esp + 0x364], 0
je 0x4e7b09
push 1
call fcn.00433290
add esp, 0xfffffff8
mov ecx, esp
push 0x86d9e4
call fcn.00701780
lea ecx, [esp + 0x360]
mov dword [esp + 4], 0xffffffff
call fcn.006eda14
call fcn.006f4c8c
mov edx, dword [ebx + esi*4 + 0x10]
mov edx, dword [edx + 0x28]
mov edi, dword [esp + 0x3a0]
mov dword [edx + 0x14], eax
mov edx, dword [ebx + esi*4 + 0x10]
mov edx, dword [edx + 0x28]
mov dword [edx + 0x10], edi
lea edi, [ebp + 0x1c]
mov edx, dword [ebx + esi*4 + 0x10]
mov edx, dword [edx + 0x28]
mov dword [edx + 0xc], edi
mov edi, dword [ebx + esi*4 + 0x10]
mov ecx, dword [edi + 0x28]
lea edx, [esp + 0x358]
push 0
push 1
push edx
call fcn.006c55f8
mov ecx, dword [esp + 0x358]
test ecx, ecx
je 0x4e7b90
mov dword [esp + 0x358], 0
je 0x4e7b90
push 1
call fcn.00433260
mov ecx, dword [esp + 0x35c]
test ecx, ecx
je 0x4e7baf
mov dword [esp + 0x35c], 0
je 0x4e7baf
push 1
call fcn.00433290
mov ecx, dword [esp + 0x344]
test ecx, ecx
je 0x4e7bce
mov dword [esp + 0x344], 0
je 0x4e7bce
push 1
call fcn.00433260
mov ecx, dword [esp + 0x348]
test ecx, ecx
je 0x4e829c
mov dword [esp + 0x348], 0
je 0x4e7bfc
push 1
call fcn.00433290
mov edi, dword [ebx + 0x8e18]
jmp 0x4e7c02
mov edi, dword [ebx + 0x8e18]
inc esi
cmp esi, edi
jl 0x4e79bf
mov edx, dword [esp + 0x3dc]
test edx, edx
jne 0x4e7e0f
mov edx, dword [ebx + 0x8e1c]
test edx, edx
jg 0x4e7c63
push dword [ebp + 0x1e68]
mov ecx, ebx
push dword [ebp + 0x1ae4]
push 0xffffffffffffffff
call fcn.006b70b8
mov esi, eax
lea ecx, [esp + 0x36c]
push 0x86df64
call fcn.00701780
add esi, 4
mov ecx, esi
push eax
call fcn.007017d0
lea ecx, [esp + 0x36c]
call fcn.00701810
lea ecx, [esp + 0x54]
call fcn.006ea05c
movzx edx, al
test edx, edx
jne 0x4e7cd4
add esp, 0xffffffd8
lea ecx, [esp + 4]
xor edx, edx
mov dword [esp + 4], edx
lea esi, [esp + 0x7c]
mov dword [esp + 8], edx
push esi
call fcn.006e9d34
lea ecx, [esp + 0xc]
xor edx, edx
lea esi, [esp + 0x84]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], edx
push esi
call fcn.006e9d34
mov esi, dword [esp + 0x474]
xor edx, edx
mov ecx, ebp
mov dword [esp], esi
mov byte [esp + 0x14], dl
mov dword [esp + 0x18], edx
mov byte [esp + 0x1c], dl
mov byte [esp + 0x20], dl
mov dword [esp + 0x24], 0xffffffff
call fcn.00523fb4
mov ecx, ebx
call fcn.006c26b8
lea ecx, [esp + 0xb4]
call fcn.0072ca64
mov ecx, dword [esp + 0xa4]
test ecx, ecx
je 0x4e7d06
mov dword [esp + 0xa4], 0
je 0x4e7d06
push 1
call fcn.00433260
mov ecx, dword [esp + 0xa8]
test ecx, ecx
je 0x4e7d25
mov dword [esp + 0xa8], 0
je 0x4e7d25
push 1
call fcn.00433290
lea ecx, [esp + 0xa0]
call fcn.00701810
lea ecx, [esp + 0x64]
call fcn.00701810
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x4e7d53
mov dword [esp + 0x5c], 0
je 0x4e7d53
push 1
call fcn.00433260
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4e7d6c
mov dword [esp + 0x60], 0
je 0x4e7d6c
push 1
call fcn.00433290
mov ecx, dword [esp + 0x54]
test ecx, ecx
je 0x4e7d85
mov dword [esp + 0x54], 0
je 0x4e7d85
push 1
call fcn.00433260
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x4e7d9e
mov dword [esp + 0x58], 0
je 0x4e7d9e
push 1
call fcn.00433290
lea ecx, [esp + 0x48]
call fcn.00701810
lea ecx, [esp + 0x3c]
call fcn.00701810
lea ecx, [esp + 0x38]
call fcn.00701810
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4e7dd2
mov dword [esp + 0x24], 0
je 0x4e7dd2
push 1
call fcn.00433260
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4e7deb
mov dword [esp + 0x28], 0
je 0x4e7deb
push 1
call fcn.00433290
lea ecx, [esp + 0x20]
call fcn.00701810
lea ecx, [esp + 0x1c]
call fcn.00701810
mov eax, 1
add esp, 0x438
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov eax, dword [esp + 0x44c]
push eax
mov ecx, dword [esp + 0x398]
call fcn.00444400
lea ecx, [esp + 0xb4]
call fcn.0072ca64
mov ecx, dword [esp + 0xa4]
test ecx, ecx
je 0x4e7e4e
mov dword [esp + 0xa4], 0
je 0x4e7e4e
push 1
call fcn.00433260
mov ecx, dword [esp + 0xa8]
test ecx, ecx
je 0x4e7e6d
mov dword [esp + 0xa8], 0
je 0x4e7e6d
push 1
call fcn.00433290
lea ecx, [esp + 0xa0]
call fcn.00701810
lea ecx, [esp + 0x64]
call fcn.00701810
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x4e7e9b
mov dword [esp + 0x5c], 0
je 0x4e7e9b
push 1
call fcn.00433260
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4e7eb4
mov dword [esp + 0x60], 0
je 0x4e7eb4
push 1
call fcn.00433290
mov ecx, dword [esp + 0x54]
test ecx, ecx
je 0x4e7ecd
mov dword [esp + 0x54], 0
je 0x4e7ecd
push 1
call fcn.00433260
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x4e7ee6
mov dword [esp + 0x58], 0
je 0x4e7ee6
push 1
call fcn.00433290
lea ecx, [esp + 0x48]
call fcn.00701810
lea ecx, [esp + 0x3c]
call fcn.00701810
lea ecx, [esp + 0x38]
call fcn.00701810
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4e7f1a
mov dword [esp + 0x24], 0
je 0x4e7f1a
push 1
call fcn.00433260
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4e7f33
mov dword [esp + 0x28], 0
je 0x4e7f33
push 1
call fcn.00433290
lea ecx, [esp + 0x20]
call fcn.00701810
lea ecx, [esp + 0x1c]
call fcn.00701810
mov eax, 1
add esp, 0x438
pop ebx
pop ebp
pop esi
pop edi
ret 8
xor edx, edx
lea ecx, [esp + 0x304]
mov dword [esp + 0x3b4], edx
call fcn.00736414
lea ecx, [esp + 0xa4]
lea edx, [esp + 0x308]
push edx
call fcn.006ec268
lea ecx, [esp + 0x308]
lea edx, [esp + 0x310]
push 0
push edx
call fcn.006ecde8
lea edx, [esp + 0x304]
push dword [esp + 0x310]
push 0x86c510
push edx
call fcn.007020f0
add esp, 0xc
lea ecx, [esp + 0x310]
call fcn.00701810
mov ecx, dword [esp + 0x308]
test ecx, ecx
je 0x4e7fdd
mov dword [esp + 0x308], 0
je 0x4e7fdd
push 1
call fcn.00433260
mov ecx, dword [esp + 0x30c]
test ecx, ecx
je 0x4e7ffc
mov dword [esp + 0x30c], 0
je 0x4e7ffc
push 1
call fcn.00433290
mov edx, dword [esp + 0x304]
add esp, 0xffffffec
lea ecx, [esp + 0xc8]
mov dword [esp], edx
movss xmm2, dword [esp + 0x3f4]
movss dword [esp + 4], xmm2
mov dword [esp + 8], 0
mov byte [esp + 0xc], 1
mov dword [esp + 0x10], 0x86d9c8
call fcn.0072cbe8
movzx ebx, al
mov ecx, 1
cmp ebx, 0
mov edx, dword [esp + 0x3f4]
cmovne edx, ecx
mov dword [esp + 0x3f4], edx
movzx ebx, dl
test ebx, ebx
jne 0x4e85ec
mov dl, byte [esi]
mov edi, dword [esp + 0x408]
mov ecx, dword [esp + 0x3f8]
mov byte [edi + 0x13a], dl
mov dl, byte [esi + 4]
mov byte [edi + 0x13b], dl
mov edx, dword [esp + 0x41c]
mov dl, byte [edx]
mov byte [edi + 0x138], dl
mov edx, dword [esp + 0x420]
mov bl, byte [edx]
mov byte [edi + 0x139], bl
mov edx, dword [esi + 0x98]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
lea ecx, [eax + 0x20]
mov edx, dword [eax + 0x20]
call dword [edx + 0xc]
mov dl, byte [eax + 4]
mov ecx, edi
mov byte [ecx + 0x140], dl
call fcn.006df43c
mov edx, dword [esi + 0x98]
mov ecx, dword [esp + 0x3f8]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
lea ecx, [eax + 0x20]
mov edx, dword [eax + 0x20]
call dword [edx + 0xc]
fld qword [0x86da58]
movsx edx, word [eax + 8]
fstp qword [esp]
mov dword [esp + 0x388], edx
fild dword [esp + 0x388]
fmul qword [0x86da50]
fstp qword [esp + 8]
call sub.MSVCRT.dll_pow
mov ebx, edi
mov ecx, dword [esp + 0x3f8]
fstp dword [ebx + 0x14c]
mov edx, dword [esi + 0x98]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
lea ecx, [eax + 0x20]
mov edx, dword [eax + 0x20]
call dword [edx + 0xc]
mov edx, dword [eax + 0xc]
cmp edx, 0x80000000
jne 0x4e815c
mov edx, ebx
mov dword [edx + 0x144], 0
jmp 0x4e81ac
mov edx, dword [esi + 0x98]
mov ecx, dword [esp + 0x3f8]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
lea ecx, [eax + 0x20]
mov edx, dword [eax + 0x20]
call dword [edx + 0xc]
fild dword [eax + 0xc]
fmul qword [0x86da48]
fld qword [0x86da58]
fxch st(1)
fchs
fxch st(1)
fstp qword [esp]
fmul qword [0x86da60]
fstp qword [esp + 8]
call sub.MSVCRT.dll_pow
mov edx, ebx
fstp dword [edx + 0x144]
mov edx, dword [esi + 0x98]
mov ecx, dword [esp + 0x3f8]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
lea ecx, [eax + 0x20]
mov edx, dword [eax + 0x20]
call dword [edx + 0xc]
mov edx, dword [eax + 0x38]
mov ecx, edx
neg ecx
add ecx, 0x3f
cmp edx, 0x3f
cmovg edx, ecx
add edx, 0x40
xor bl, bl
cvtsi2ss xmm4, edx
mulss xmm4, dword [0x86db80]
mov esi, dword [esp + 0x39c]
movss dword [edi + 0x148], xmm4
mov dword [esp + 0x404], ebp
nop
lea esi, [esi]
push 1
mov ecx, esi
push edi
call fcn.006c2c68
mov ebp, eax
test ebp, ebp
je 0x4e82dc
mov bl, 1
mov ecx, esi
push edi
call fcn.006c29c8
push eax
mov ecx, esi
call fcn.006c2b28
mov edi, ebp
jmp 0x4e820c
mov edx, dword [esi + 0x98]
mov ecx, dword [esp + 0x3f8]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebp
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x48]
mov edx, dword [eax + 0x48]
call dword [edx + 0xc]
mov edx, dword [eax + 8]
test edx, edx
je 0x4e827c
mov edx, edi
mov dword [edx + 0x95e8], 6
jmp 0x4e6c68
mov edx, edi
mov dword [edx + 0x95e8], 3
jmp 0x4e6c68
mov edi, dword [ebx + 0x8e18]
jmp 0x4e7c02
mov dword [esp + 0x3dc], ebx
mov ebx, dword [esp + 0x39c]
mov ebp, dword [esp + 0x390]
jmp 0x4e7901
mov eax, 1
mov ebx, 1
mov dword [esp + 0x3f4], eax
jmp 0x4e78c6
mov ebp, dword [esp + 0x404]
mov esi, dword [esp + 0x3c4]
test bl, bl
je 0x4e830c
lea ecx, [esp + 0x304]
call fcn.00701810
jmp 0x4e78ac
lea ecx, [esp + 0x54]
call fcn.006ea05c
movzx edx, al
test edx, edx
jne 0x4e85d7
mov ebx, dword [esp + 0x408]
mov ecx, dword [ebx + 0x28]
mov edx, dword [ecx + 0x234]
test edx, edx
je 0x4e85d7
lea ecx, [esp + 0x314]
call fcn.006ebda8
mov ecx, dword [ebx + 0x28]
add ecx, 0x344
lea edx, [esp + 0x31c]
push edx
call fcn.006ec268
lea ecx, [esp + 0x31c]
lea edx, [esp + 0x324]
push 0
push edx
call fcn.006ecde8
lea edx, [esp + 0xa0]
push dword [esp + 0x324]
push 0x86d988
push edx
call fcn.007020f0
add esp, 0xc
lea ecx, [esp + 0x324]
call fcn.00701810
mov ecx, dword [esp + 0x31c]
test ecx, ecx
je 0x4e83b7
mov dword [esp + 0x31c], 0
je 0x4e83b7
push 1
call fcn.00433260
mov ecx, dword [esp + 0x320]
test ecx, ecx
je 0x4e83d6
mov dword [esp + 0x320], 0
je 0x4e83d6
push 1
call fcn.00433290
lea ecx, [esp + 0xa0]
push 1
call fcn.00701c60
lea ecx, [esp + 0x328]
call fcn.006ebda8
lea ecx, [esp + 0x328]
lea edx, [esp + 0x5c]
push edx
call fcn.006e9d34
lea ecx, [esp + 0x330]
lea edx, [esp + 0xa0]
push 0
push edx
call fcn.006ea08c
lea ecx, [esp + 0x328]
push eax
call fcn.006ea37c
mov ecx, dword [esp + 0x330]
test ecx, ecx
je 0x4e8443
mov dword [esp + 0x330], 0
je 0x4e8443
push 1
call fcn.00433260
mov ecx, dword [esp + 0x334]
test ecx, ecx
je 0x4e8462
mov dword [esp + 0x334], 0
je 0x4e8462
push 1
call fcn.00433290
add esp, 0xfffffff8
mov ecx, esp
push 0x86d9e4
call fcn.00701780
lea ecx, [esp + 0x330]
mov dword [esp + 4], 0xffffffff
call fcn.006eda14
mov edi, ebx
mov ecx, dword [edi + 0x28]
lea edx, [esp + 0x328]
xor ebx, ebx
push ebx
push ebx
push ebx
push edx
call fcn.006c42c8
mov ebx, dword [edi + 0x28]
lea ecx, [ebx + 0x60]
mov dword [esp + 0x3e8], ebx
mov edx, dword [ebx + 0x60]
call dword [edx + 0x24]
lea ecx, [ebx + 0x98]
mov edx, dword [ebx + 0x98]
mov dword [ebx + 0x5c], 0
call dword [edx + 0x24]
lea ecx, [ebx + 0xd0]
mov edx, dword [ebx + 0xd0]
mov dword [ebx + 0x94], 0
call dword [edx + 0x24]
lea ecx, [ebx + 0x108]
mov edx, dword [ebx + 0x108]
mov dword [ebx + 0xcc], 0
call dword [edx + 0x24]
lea ecx, [ebx + 0x140]
mov edx, dword [ebx + 0x140]
mov dword [ebx + 0x104], 0
call dword [edx + 0x24]
lea ecx, [ebx + 0x178]
mov edx, dword [ebx + 0x178]
mov dword [ebx + 0x13c], 0
call dword [edx + 0x24]
xor ebx, ebx
mov ecx, dword [esp + 0x3e8]
mov edx, dword [esp + 0x424]
mov dword [ecx + 0x174], ebx
mov dword [ecx + 0x234], ebx
mov dword [ecx + 0x35c], ebx
mov dword [ecx + 0x360], ebx
mov dword [edx + 0x9654], 3
mov ecx, dword [esp + 0x328]
test ecx, ecx
je 0x4e857a
mov dword [esp + 0x328], 0
je 0x4e857a
push 1
call fcn.00433260
mov ecx, dword [esp + 0x32c]
test ecx, ecx
je 0x4e8599
mov dword [esp + 0x32c], 0
je 0x4e8599
push 1
call fcn.00433290
mov ecx, dword [esp + 0x314]
test ecx, ecx
je 0x4e85b8
mov dword [esp + 0x314], 0
je 0x4e85b8
push 1
call fcn.00433260
mov ecx, dword [esp + 0x318]
test ecx, ecx
je 0x4e85d7
mov dword [esp + 0x318], 0
je 0x4e85d7
push 1
call fcn.00433290
lea ecx, [esp + 0x304]
call fcn.00701810
jmp 0x4e78ac
lea ecx, [esp + 0x304]
call fcn.00701810
jmp 0x4e78c6
xor edx, edx
mov dword [esp + 0x400], edx
call fcn.006f4c8c
mov dword [esp + 0x3e8], eax
jmp 0x4e7838
mov ecx, dword [esp + 0x424]
call fcn.004e548c
jmp 0x4e762b
fld dword [0x86dad8]
fld qword [esp + 0x430]
fcompi st(1)
fstp st(0)
jae 0x4e6db0
mov dword [eax + 0x5e4], 0
jmp 0x4e6db0
mov ebp, dword [esp + 0x404]
mov esi, dword [esp + 0x3c4]
jmp 0x4e6aa0
mov eax, dword [esp + 0x3f4]
movzx ebx, al
jmp 0x4e78c6
mov eax, dword [esp + 0x3c4]
mov edx, dword [eax + 0x78]
mov ecx, dword [esp + 0x3c8]
call dword [edx + 0xc]
or ebx, dword [eax + esi + 0x18]
jmp 0x4e64f2
lea ecx, [esp + 0x64]
call fcn.00701810
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x4e86ee
mov dword [esp + 0x5c], 0
je 0x4e86ee
push 1
call fcn.00433260
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4e8707
mov dword [esp + 0x60], 0
je 0x4e8707
push 1
call fcn.00433290
mov ecx, dword [esp + 0x54]
test ecx, ecx
je 0x4e8720
mov dword [esp + 0x54], 0
je 0x4e8720
push 1
call fcn.00433260
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x4e8739
mov dword [esp + 0x58], 0
je 0x4e8739
push 1
call fcn.00433290
lea ecx, [esp + 0x48]
call fcn.00701810
lea ecx, [esp + 0x3c]
call fcn.00701810
lea ecx, [esp + 0x38]
call fcn.00701810
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4e876d
mov dword [esp + 0x24], 0
je 0x4e876d
push 1
call fcn.00433260
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4e8786
mov dword [esp + 0x28], 0
je 0x4e8786
push 1
call fcn.00433290
lea ecx, [esp + 0x20]
call fcn.00701810
lea ecx, [esp + 0x1c]
call fcn.00701810
xor eax, eax
add esp, 0x438
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov ebp, dword [esp + 0x404]
jmp 0x4e6ef3
push edi
push esi
push ebp
push ebx
sub esp, 0x434
mov ebp, ecx
lea ecx, [esp + 0x1c]
call fcn.00736414
lea ecx, [esp + 0x20]
call fcn.00736414
lea ecx, [esp + 0x24]
call fcn.006ebda8
lea ecx, [esp + 0x24]
lea edi, [esp + 0x34]
lea esi, [esp + 0x1c]
lea ebx, [esp + 0x20]
lea edx, [esp + 0x30]
lea eax, [esp + 0x2c]
push eax
push edx
push ebx
push esi
push edi
push ecx
mov ecx, dword [esp + 0x464]
call fcn.006f169c
movzx eax, al
test eax, eax
je 0x4e8847
mov eax, dword [esp + 0x34]
cmp eax, 0x70
je 0x4e8871
lea ecx, [esp + 0x24]
call fcn.004330e0
lea ecx, [esp + 0x20]
call fcn.00701810
lea ecx, [esp + 0x1c]
call fcn.00701810
xor eax, eax
add esp, 0x434
pop ebx
pop ebp
pop esi
pop edi
ret 8
lea ecx, [esp + 0x24]
call fcn.004330e0
lea ecx, [esp + 0x20]
call fcn.00701810
lea ecx, [esp + 0x1c]
call fcn.00701810
xor eax, eax
add esp, 0x434
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov edi, dword [esp + 0x20]
test edi, edi
je 0x4e888f
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4e888b
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x4e8883
test eax, eax
jg 0x4e88e2
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4e88a8
mov dword [esp + 0x24], 0
je 0x4e88a8
push 1
call fcn.00433260
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4e88c1
mov dword [esp + 0x28], 0
je 0x4e88c1
push 1
call fcn.00433290
lea ecx, [esp + 0x20]
call fcn.00701810
lea ecx, [esp + 0x1c]
call fcn.00701810
xor eax, eax
add esp, 0x434
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov eax, dword [esp + 0x2c]
test eax, eax
jl 0x4e888f
lea ecx, [esp + 0x38]
call fcn.00736414
lea ecx, [esp + 0x3c]
call fcn.00736414
lea ecx, [esp + 0x48]
call fcn.00736414
xor eax, eax
mov edx, 1
lea ecx, [esp + 0x54]
mov byte [esp + 0x42], al
mov byte [esp + 0x43], al
mov dword [esp + 0x4c], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x50], edx
mov byte [esp + 0x40], al
mov byte [esp + 0x41], dl
call fcn.006ebda8
lea ecx, [esp + 0x5c]
call fcn.006ebda8
lea ecx, [esp + 0x64]
call fcn.00736414
push 2
call fcn.006f4dfc
pop ecx
movzx eax, al
test eax, eax
je 0x4e8cee
mov eax, 1
lea ecx, [esp + 0x64]
lea edx, [esp + 0x20]
mov dword [esp + 0x50], eax
mov byte [esp + 0x42], al
mov dword [esp + 0x4c], 0
push edx
call fcn.007017d0
lea ecx, [esp + 0x64]
push 1
call fcn.00701c60
mov ecx, 0x84fac0
lea eax, [esp + 0x68]
push 0
push eax
call fcn.006ecde8
lea ecx, [esp + 0x48]
lea eax, [esp + 0x68]
push eax
call fcn.007017d0
mov dword [esp + 0x44], 0
push edi
mov ecx, esp
lea eax, [esp + 0x68]
push eax
call fcn.00701760
lea ecx, [esp + 0x3c]
call fcn.0072bcf8
movzx eax, al
test eax, eax
jne 0x4e8ab0
lea ecx, [esp + 0x68]
call fcn.00701810
lea ecx, [esp + 0x64]
call fcn.00701810
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x4e89f7
mov dword [esp + 0x5c], 0
je 0x4e89f7
push 1
call fcn.00433260
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4e8a10
mov dword [esp + 0x60], 0
je 0x4e8a10
push 1
call fcn.00433290
mov ecx, dword [esp + 0x54]
test ecx, ecx
je 0x4e8a29
mov dword [esp + 0x54], 0
je 0x4e8a29
push 1
call fcn.00433260
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x4e8a42
mov dword [esp + 0x58], 0
je 0x4e8a42
push 1
call fcn.00433290
lea ecx, [esp + 0x48]
call fcn.00701810
lea ecx, [esp + 0x3c]
call fcn.00701810
lea ecx, [esp + 0x38]
call fcn.00701810
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4e8a76
mov dword [esp + 0x24], 0
je 0x4e8a76
push 1
call fcn.00433260
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4e8a8f
mov dword [esp + 0x28], 0
je 0x4e8a8f
push 1
call fcn.00433290
lea ecx, [esp + 0x20]
call fcn.00701810
lea ecx, [esp + 0x1c]
call fcn.00701810
xor eax, eax
add esp, 0x434
pop ebx
pop ebp
pop esi
pop edi
ret 8
add esp, 0xfffffff8
mov ecx, esp
lea eax, [esp + 0x40]
push eax
call fcn.00701760
lea ecx, [esp + 0x5c]
xor eax, eax
mov word [esp + 4], ax
call fcn.006ee858
lea ecx, [esp + 0x74]
call fcn.006ebda8
add esp, 0xfffffff8
mov ecx, esp
lea eax, [esp + 0x44]
push eax
call fcn.00701760
lea ecx, [esp + 0x7c]
xor eax, eax
mov word [esp + 4], ax
call fcn.006ee858
lea ecx, [esp + 0x74]
call fcn.006ea05c
movzx eax, al
test eax, eax
je 0x4e8bcb
lea ecx, [esp + 0x24]
lea eax, [esp + 0x80]
push eax
call fcn.006ec268
lea ecx, [esp + 0x74]
lea eax, [esp + 0x80]
push eax
call fcn.006e9d34
mov ecx, dword [esp + 0x80]
test ecx, ecx
je 0x4e8b4c
mov dword [esp + 0x80], 0
je 0x4e8b4c
push 1
call fcn.00433260
mov ecx, dword [esp + 0x84]
test ecx, ecx
je 0x4e8b6b
mov dword [esp + 0x84], 0
je 0x4e8b6b
push 1
call fcn.00433290
lea ecx, [esp + 0x74]
lea eax, [esp + 0x88]
push eax
call fcn.006ed658
lea ecx, [esp + 0x74]
lea eax, [esp + 0x88]
push eax
call fcn.006e9d34
mov ecx, dword [esp + 0x88]
test ecx, ecx
je 0x4e8bac
mov dword [esp + 0x88], 0
je 0x4e8bac
push 1
call fcn.00433260
mov ecx, dword [esp + 0x8c]
test ecx, ecx
je 0x4e8bcb
mov dword [esp + 0x8c], 0
je 0x4e8bcb
push 1
call fcn.00433290
lea ecx, [esp + 0x74]
lea eax, [esp + 0x90]
push 0
push eax
call fcn.006ecde8
lea ecx, [esp + 0x68]
lea eax, [esp + 0x90]
push eax
call fcn.007017d0
lea ecx, [esp + 0x90]
call fcn.00701810
lea ecx, [esp + 0x68]
push 0x86d960
call fcn.007016c0
add esp, 0xfffffff8
mov ecx, esp
lea eax, [esp + 0x70]
push eax
call fcn.00701760
lea ecx, [esp + 0x7c]
xor eax, eax
mov word [esp + 4], ax
call fcn.006ee858
lea ecx, [esp + 0x74]
call fcn.00735574
lea ecx, [esp + 0x74]
call fcn.006ea19c
lea ecx, [esp + 0x54]
lea eax, [esp + 0x98]
push eax
call fcn.006ec404
lea ecx, [esp + 0x5c]
lea eax, [esp + 0x98]
push eax
call fcn.006e9d34
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x4e8c7b
mov dword [esp + 0x98], 0
je 0x4e8c7b
push 1
call fcn.00433260
mov ecx, dword [esp + 0x9c]
test ecx, ecx
je 0x4e8c9a
mov dword [esp + 0x9c], 0
je 0x4e8c9a
push 1
call fcn.00433290
lea ecx, [esp + 0x5c]
lea eax, [esp + 0x74]
push eax
call fcn.006ea37c
lea eax, [esp + 0x5c]
push eax
call fcn.006e882c
pop ecx
mov ecx, dword [esp + 0x74]
test ecx, ecx
je 0x4e8ccc
mov dword [esp + 0x74], 0
je 0x4e8ccc
push 1
call fcn.00433260
mov ecx, dword [esp + 0x78]
test ecx, ecx
je 0x4e8ce5
mov dword [esp + 0x78], 0
je 0x4e8ce5
push 1
call fcn.00433290
lea ecx, [esp + 0x68]
call fcn.00701810
mov esi, dword [esp + 0x448]
mov edi, dword [ebp + esi*4 + 0x1f30]
xor eax, eax
test edi, edi
setne al
test eax, eax
mov dword [esp + 0x3a4], eax
je 0x4e8d15
mov ecx, ebp
call fcn.005344a8
call fcn.006f50c8
lea ecx, [ebp + 0x1f30]
lea edi, [ebp + 4]
movzx edx, byte [0x84f85c]
mov dword [esp + 0x3f4], ecx
push eax
push edx
push edi
mov eax, dword [esp + 0x454]
push eax
call fcn.00444430
mov ebx, eax
mov edx, dword [esp + 0x448]
mov ecx, ebp
push edx
call fcn.004dfb4c
mov edx, dword [esp + 0x3a4]
test edx, edx
je 0x4e8d64
mov ecx, ebp
call fcn.00534388
test ebx, ebx
je 0x4eb27c
lea ecx, [ebp + 0x328]
lea edx, [esp + 0x24]
mov dword [esp + 0x400], ecx
push edx
call fcn.0054200c
test eax, eax
je 0x4e8e6f
cmp eax, 2
je 0x4e8e6f
lea ecx, [esp + 0x64]
call fcn.00701810
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x4e8db6
mov dword [esp + 0x5c], 0
je 0x4e8db6
push 1
call fcn.00433260
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4e8dcf
mov dword [esp + 0x60], 0
je 0x4e8dcf
push 1
call fcn.00433290
mov ecx, dword [esp + 0x54]
test ecx, ecx
je 0x4e8de8
mov dword [esp + 0x54], 0
je 0x4e8de8
push 1
call fcn.00433260
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x4e8e01
mov dword [esp + 0x58], 0
je 0x4e8e01
push 1
call fcn.00433290
lea ecx, [esp + 0x48]
call fcn.00701810
lea ecx, [esp + 0x3c]
call fcn.00701810
lea ecx, [esp + 0x38]
call fcn.00701810
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4e8e35
mov dword [esp + 0x24], 0
je 0x4e8e35
push 1
call fcn.00433260
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4e8e4e
mov dword [esp + 0x28], 0
je 0x4e8e4e
push 1
call fcn.00433290
lea ecx, [esp + 0x20]
call fcn.00701810
lea ecx, [esp + 0x1c]
call fcn.00701810
xor eax, eax
add esp, 0x434
pop ebx
pop ebp
pop esi
pop edi
ret 8
lea ecx, [ebx + 0x8e20]
lea edx, [esp + 0x20]
push edx
call fcn.007017d0
lea ecx, [ebp + 0x760]
mov edx, dword [ebp + 0x760]
mov dword [esp + 0x404], ecx
call dword [edx + 0xc]
lea ecx, [eax + 0x6c]
mov edx, dword [eax + 0x6c]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push dword [esp + 0x2c]
call dword [edx + 0x34]
mov dword [esp + 0x408], eax
mov esi, eax
mov edx, dword [esi + 0x18]
lea ecx, [esp + 0xa0]
mov dword [esp + 0x40c], edx
xor edx, edx
mov dword [esp + 0x410], edx
xor dl, dl
mov byte [esp + 0x3dc], dl
mov edx, 1
mov dword [esp + 0x414], edx
call fcn.00736414
lea ecx, [esp + 0xa4]
call fcn.006ebda8
add esp, 0xfffffff4
mov ecx, esp
push 0x86d96c
call fcn.00701780
lea ecx, [esp + 8]
call fcn.00736414
lea ecx, [esp + 0xc0]
mov byte [esp + 4], 1
call fcn.0072c890
mov esi, dword [esp + 0x40c]
xor dl, dl
xor ecx, ecx
mov dword [esp + 0x388], esi
fild dword [esp + 0x388]
fld dword [0x86db7c]
fdiv st(1)
fstp dword [esp + 0xcc]
mov byte [esp + 0x3e4], dl
mov dword [esp + 0x430], edx
mov dword [esp + 0x3e0], edx
mov edx, dword [esp + 0x408]
lea esi, [edx + 0x24]
mov dword [esp + 0x418], eax
mov dword [esp + 0x3fc], ebx
mov dword [esp + 0x3f8], edi
mov ebx, ecx
mov dword [esp + 0x3f0], ebp
fstp qword [esp + 0x3d0]
jmp 0x4e8f8a
inc ebx
mov eax, dword [esp + 0x40c]
cmp ebx, eax
jge 0x4ea72c
mov edx, dword [esp + 0x408]
mov eax, dword [edx + 0x24]
mov ecx, esi
call dword [eax + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebx
call dword [edx + 0x34]
mov ebp, eax
lea ecx, [ebp + 0x78]
mov edx, dword [ebp + 0x78]
mov dword [esp + 0x3a8], ecx
call dword [edx + 0xc]
mov eax, dword [eax]
xor edx, edx
xor edi, edi
mov dword [esp + 0x3b8], edx
xor edx, edx
mov dword [esp + 0x3c4], edx
xor edx, edx
mov dword [esp + 0x3bc], edx
xor dl, dl
mov dword [esp + 0x3c0], edi
xor edi, edi
mov byte [esp + 0x3a4], dl
mov dword [esp + 0x3b4], eax
mov dword [esp + 0x3ac], esi
mov dword [esp + 0x3b0], ebx
mov ebx, dword [esp + 0x3a8]
mov edx, dword [ebp + 0x78]
mov ecx, ebx
call dword [edx + 0xc]
mov edx, dword [eax + edi + 0xac]
test edx, edx
jl 0x4e9146
mov edx, dword [ebp + 0x78]
mov ecx, ebx
call dword [edx + 0xc]
mov edx, dword [eax + edi + 0x24]
cmp edx, 0x84
je 0x4eb24c
mov edx, dword [ebp + 0x78]
mov ecx, ebx
call dword [edx + 0xc]
mov edx, dword [eax + edi + 0x24]
cmp edx, 0x85
jne 0x4e90ac
mov edx, dword [esp + 0x3c4]
test edx, edx
je 0x4e906c
mov dl, 1
mov byte [esp + 0x3dc], dl
jmp 0x4e912c
mov dl, 1
mov esi, dword [ebp + 0x78]
mov ecx, ebx
mov byte [esp + 0x3a4], dl
call dword [esi + 0xc]
mov edx, dword [eax + edi + 0x18]
mov esi, dword [ebp + 0x78]
mov ecx, ebx
mov dword [esp + 0x3c4], edx
call dword [esi + 0xc]
mov edx, 1
mov ecx, dword [eax + edi + 0x20]
shl edx, cl
mov dword [esp + 0x3bc], edx
jmp 0x4e9146
mov edx, dword [ebp + 0x78]
mov ecx, ebx
call dword [edx + 0xc]
mov edx, dword [eax + edi + 0x24]
cmp edx, 0x80
jge 0x4e912c
mov edx, dword [esp + 0x3c4]
test edx, edx
je 0x4e90dc
mov dl, 1
mov byte [esp + 0x3dc], dl
jmp 0x4e912c
mov edx, dword [ebp + 0x78]
mov ecx, ebx
call dword [edx + 0xc]
mov edx, dword [eax + edi + 0x24]
mov esi, dword [ebp + 0x78]
mov ecx, ebx
mov dword [esp + 0x3b8], edx
call dword [esi + 0xc]
mov edx, dword [eax + edi + 0x18]
mov esi, dword [ebp + 0x78]
mov ecx, ebx
mov dword [esp + 0x3c4], edx
call dword [esi + 0xc]
mov edx, 1
mov ecx, dword [eax + edi + 0x20]
shl edx, cl
mov dword [esp + 0x3bc], edx
jmp 0x4e9146
mov edx, dword [ebp + 0x78]
mov ecx, ebx
call dword [edx + 0xc]
mov edx, dword [esp + 0x410]
or edx, dword [eax + edi + 0x18]
mov dword [esp + 0x410], edx
add edi, 0x98
cmp edi, 0x2f8
jl 0x4e900f
mov eax, dword [esp + 0x3b4]
mov esi, dword [esp + 0x3ac]
mov ebx, dword [esp + 0x3b0]
mov dword [esp + 0x388], ebx
xor edx, edx
fild dword [esp + 0x388]
fdiv qword [esp + 0x3d0]
mov dword [esp + 0x394], ebp
mov dword [esp + 0x3ac], esi
mov dword [esp + 0x3b0], ebx
lea esi, [esi]
xor ecx, ecx
mov dword [esp + edx*4 + 0xe0], ecx
mov dword [esp + edx*4 + 0x160], ecx
inc edx
cmp edx, 0x20
jl 0x4e919c
mov ebp, dword [esp + 0x394]
mov esi, dword [esp + 0x3ac]
mov ebx, dword [esp + 0x3b0]
xor edx, edx
mov edi, dword [esp + 0x3c4]
mov dword [esp + 0x39c], edx
lea edx, [ebp + 0x98]
or edi, dword [esp + 0x3c0]
mov dword [esp + 0x3a0], edx
mov dl, byte [esp + 0x3a4]
mov byte [esp + 0x3a4], dl
mov edx, dword [esp + 0x408]
lea edx, [edx + 0x44]
mov dword [esp + 0x420], edx
mov dword [esp + 0x41c], edi
mov dword [esp + 0x3b4], eax
mov dword [esp + 0x3ac], esi
mov dword [esp + 0x3b0], ebx
fstp qword [esp + 0x3c8]
mov ecx, dword [esp + 0x3b4]
mov edx, dword [esp + 0x39c]
cmp edx, ecx
jge 0x4eb21c
mov edx, dword [ebp + 0x78]
mov ecx, dword [esp + 0x3a8]
call dword [edx + 0xc]
lea ecx, [eax + 4]
mov edx, dword [eax + 4]
call dword [edx + 0xc]
mov edx, dword [esp + 0x39c]
mov ecx, dword [eax + edx*4]
test ecx, ecx
mov dword [esp + 0x424], ecx
jl 0x4ea41b
mov edx, dword [esp + 0x3f0]
mov ebx, dword [edx + 0x760]
mov ecx, dword [esp + 0x404]
call dword [ebx + 0xc]
lea ecx, [eax + 0xcc]
mov edx, dword [eax + 0xcc]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x30]
mov edx, dword [esp + 0x424]
cmp edx, eax
jae 0x4ea41b
mov edx, dword [esp + 0x39c]
test edx, edx
jne 0x4e9301
mov edx, dword [esp + 0x3f0]
mov ebx, dword [edx + 0x760]
mov ecx, dword [esp + 0x404]
call dword [ebx + 0xc]
lea ecx, [eax + 0xcc]
mov edx, dword [eax + 0xcc]
call dword [edx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
movzx esi, word [eax + 2]
xor edx, edx
cmp esi, 2
sete dl
mov dword [esp + 0x3e0], edx
mov edx, dword [esp + 0x39c]
mov ebx, dword [ebp + 0x98]
and edx, dword [esp + 0x41c]
mov ecx, dword [esp + 0x3a0]
mov dword [esp + 0x3e8], edx
call dword [ebx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov edx, dword [eax + 0x68]
test edx, edx
jne 0x4e938c
mov ebx, dword [esp + 0x3e8]
lea edx, [esp + ebx*4 + 0xe0]
lea ecx, [esp + ebx*4 + 0x160]
mov dword [esp + 0x428], edx
xor edx, edx
mov dword [esp + ebx*4 + 0xe0], 0
mov dword [esp + 0x42c], ecx
mov ecx, 0x7f
mov dword [esp + ebx*4 + 0x160], 0x7f
jmp 0x4e947d
mov edx, dword [esp + 0x3e0]
movzx ecx, dl
test ecx, ecx
je 0x4e93ac
mov ecx, 2
jmp 0x4e93b1
mov ecx, 1
mov eax, dword [esp + 0x39c]
cdq
idiv ecx
test edx, edx
jne 0x4e944c
mov ebx, dword [esp + 0x3e8]
lea edx, [esp + ebx*4 + 0xe0]
lea ecx, [esp + ebx*4 + 0x160]
mov dword [esp + 0x428], edx
mov esi, dword [esp + ebx*4 + 0x160]
inc esi
mov dword [esp + 0x42c], ecx
cmp esi, 0x7f
mov dword [esp + ebx*4 + 0xe0], esi
jg 0x4ea41b
mov edx, dword [ebp + 0x98]
mov ecx, dword [esp + 0x3a0]
call dword [edx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov ecx, dword [eax + 0x68]
mov edx, dword [esp + 0x3e8]
mov dword [esp + edx*4 + 0x160], ecx
mov edx, dword [esp + edx*4 + 0xe0]
jmp 0x4e947d
mov ebx, dword [esp + 0x3e8]
lea edx, [esp + ebx*4 + 0xe0]
lea ecx, [esp + ebx*4 + 0x160]
mov dword [esp + 0x428], edx
mov edx, dword [esp + ebx*4 + 0xe0]
mov dword [esp + 0x42c], ecx
mov ecx, dword [esp + ebx*4 + 0x160]
cmp edx, ecx
jne 0x4e949c
dec ecx
mov edx, dword [esp + 0x42c]
mov dword [edx], ecx
jmp 0x4ea41b
jg 0x4ea41b
mov edx, dword [esp + 0x3f0]
push dword [edx + 0x1e68]
push dword [edx + 0x1ae4]
push 0xffffffffffffffff
mov ecx, dword [esp + 0x408]
call fcn.006b70b8
mov esi, eax
mov ebx, dword [esp + 0x410]
mov edx, dword [esp + 0x39c]
test ebx, edx
je 0x4e9509
mov edx, dword [esp + 0x3e0]
movzx ebx, dl
test ebx, ebx
je 0x4e94fc
mov edx, dword [esp + 0x39c]
and edx, 0xfffffffe
mov dword [esi + 0x9680], edx
jmp 0x4e9509
mov edx, dword [esp + 0x39c]
mov dword [esi + 0x9680], edx
xor dl, dl
mov ebx, dword [esp + 0x3c0]
mov byte [esp + 0x3e8], dl
and ebx, dword [esp + 0x39c]
mov dword [esp + 0x3ec], ebx
je 0x4e9641
mov dl, 1
mov ecx, dword [esp + 0x3a0]
mov byte [esp + 0x3e8], dl
mov byte [esi + 0x22], 1
mov ebx, dword [ebp + 0x98]
call dword [ebx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x28]
mov edx, dword [eax + 0x28]
call dword [edx + 0xc]
mov edx, dword [eax + 0x14]
cmp edx, 8
jne 0x4e958c
xor dl, dl
mov byte [esp + 0x3e8], dl
jmp 0x4e9641
mov edx, dword [ebp + 0x98]
mov ecx, dword [esp + 0x3a0]
call dword [edx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x28]
mov edx, dword [eax + 0x28]
call dword [edx + 0xc]
mov edx, dword [eax + 0x14]
shr edx, 0x1f
fild dword [eax + 0x14]
fadd dword [edx*4 + 0x86db88]
fmul dword [0x86db78]
fmul qword [0x86db40]
fadd qword [0x86db48]
fstp qword [esp]
call sub.MSVCRT.dll_exp
fadd st(0)
fstp qword [esp + 0x380]
mov edi, dword [esp + 0x380]
mov ebx, dword [esp + 0x384]
mov ecx, ebx
shr ecx, 0x14
and ecx, 0x7ff
cmp ecx, 0x3fe
jle 0x4e963c
mov edx, ebx
neg ecx
add ecx, 0x41e
shld edx, edi, 0xb
or edx, 0x80000000
shr edx, cl
test ebx, ebx
jge 0x4e963e
neg edx
jmp 0x4e963e
xor edx, edx
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x3c4]
test edx, edx
je 0x4e977e
xor ecx, ecx
and edx, dword [esp + 0x39c]
mov eax, dword [esp + 0x3c4]
mov dword [esp + 0x418], edx
mov dword [esp + 0x390], esi
mov dword [esp + 0x394], ebp
lea esi, [esi]
mov edx, eax
sar edx, cl
and edx, 1
cmp edx, 1
je 0x4eb1fc
inc ecx
cmp ecx, 0x20
jl 0x4e967c
mov esi, dword [esp + 0x390]
mov ebp, dword [esp + 0x394]
mov edi, dword [esp + 0x418]
mov dl, byte [esp + 0x3a4]
sar edi, cl
test dl, dl
mov dword [esp + 0x418], edi
jne 0x4e96fc
mov eax, 0x80
xor edx, edx
mov ebx, dword [esp + 0x3bc]
mov edi, dword [esp + 0x3b8]
idiv ebx
mov edx, eax
imul edx, dword [esp + 0x418]
mov dword [esi + 0x28], 2
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edx
lea edx, [edx + eax - 1]
mov dword [esi + 0x3c], edx
jmp 0x4e977e
mov edx, dword [esp + 0x408]
mov ebx, dword [edx + 0x44]
mov ecx, dword [esp + 0x420]
call dword [ebx + 0xc]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov edx, dword [eax + 4]
mov ebx, dword [esp + 0x408]
mov edi, dword [ebx + 0x44]
mov dword [esp + 0x3d8], edx
mov ecx, dword [esp + 0x420]
call dword [edi + 0xc]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov eax, dword [eax + 8]
mov ebx, dword [esp + 0x3bc]
sub eax, dword [esp + 0x3d8]
inc eax
cdq
idiv ebx
test eax, eax
jg 0x4e975a
mov eax, 1
mov dword [esi + 0x28], 1
mov edx, eax
mov ebx, dword [esp + 0x3d8]
imul edx, dword [esp + 0x418]
add ebx, edx
lea edi, [ebx + eax - 1]
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], edi
mov edx, dword [ebp + 0x98]
mov ecx, dword [esp + 0x3a0]
call dword [edx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
lea ecx, [eax + 0x20]
mov edx, dword [eax + 0x20]
call dword [edx + 0xc]
mov edi, dword [eax + 0x44]
xor edx, edx
test edi, edi
mov ecx, dword [esp + 0x3a0]
sete dl
mov byte [esi + 0x20], dl
mov ebx, dword [ebp + 0x98]
call dword [ebx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x48]
mov edx, dword [eax + 0x48]
call dword [edx + 0xc]
mov edx, dword [eax]
test edx, edx
je 0x4e98ef
mov edx, dword [ebp + 0x98]
mov ecx, dword [esp + 0x3a0]
call dword [edx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x48]
mov edx, dword [eax + 0x48]
call dword [edx + 0xc]
mov edx, dword [eax + 4]
test edx, edx
je 0x4eada7
cmp edx, 1
je 0x4e985c
cmp edx, 2
jne 0x4e983c
mov dword [esi + 0x95e8], 4
jmp 0x4e9866
cmp edx, 3
jne 0x4e9866
mov dword [esi + 0x95e8], 9
jmp 0x4e9866
mov dword [esi + 0x95e8], 5
mov edx, dword [ebp + 0x98]
mov ecx, dword [esp + 0x3a0]
call dword [edx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x48]
mov edx, dword [eax + 0x48]
call dword [edx + 0xc]
push dword [eax + 0xc]
call fcn.00543b60
pop ecx
fstp dword [esi + 0x95f8]
mov edx, dword [ebp + 0x98]
mov ecx, dword [esp + 0x3a0]
call dword [edx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x48]
mov edx, dword [eax + 0x48]
call dword [edx + 0xc]
mov edx, dword [eax + 0x14]
shr edx, 0x1f
fild dword [eax + 0x14]
fadd dword [edx*4 + 0x86db88]
fmul dword [0x86db74]
fstp dword [esi + 0x95fc]
xor ebx, ebx
lea esi, [esi]
lea edi, [edi]
imul edi, ebx, 0x3bc
lea edx, [esi + edi]
mov ecx, dword [esp + 0x3a0]
mov dword [esp + 0x398], edx
mov dword [edx + 0x5a8], 1
mov dword [edx + 0x8bc], 2
mov dword [edx + 0x5dc], 0
mov dword [edx + 0x52c], 0x3f800000
mov edx, dword [ebp + 0x98]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, dword [esp + 0x39c]
push ecx
mov ecx, eax
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x14]
mov edx, dword [eax + 0x14]
push ebx
call dword [edx + 0x34]
push dword [eax + 4]
call fcn.00543b30
pop ecx
fmul qword [0x86db38]
mov edx, dword [esp + 0x398]
cmp ebx, 1
fst dword [edx + 0x5e4]
je 0x4eb1dc
fstp st(0)
mov dword [edi + esi + 0x5e8], 0
mov edx, dword [ebp + 0x98]
mov ecx, dword [esp + 0x3a0]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, dword [esp + 0x39c]
push ecx
mov ecx, eax
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x14]
mov edx, dword [eax + 0x14]
push ebx
call dword [edx + 0x34]
push dword [eax + 8]
call fcn.00543b30
pop ecx
fmul qword [0x86db38]
mov ecx, dword [esp + 0x3a0]
fstp dword [edi + esi + 0x5ec]
mov edx, dword [ebp + 0x98]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, dword [esp + 0x39c]
push ecx
mov ecx, eax
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x14]
mov edx, dword [eax + 0x14]
push ebx
call dword [edx + 0x34]
push dword [eax + 0x14]
call fcn.00543b30
pop ecx
fmul qword [0x86db38]
mov ecx, dword [esp + 0x3a0]
fstp dword [edi + esi + 0x5f0]
mov edx, dword [ebp + 0x98]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, dword [esp + 0x39c]
push ecx
mov ecx, eax
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x14]
mov edx, dword [eax + 0x14]
push ebx
call dword [edx + 0x34]
mov edx, dword [eax + 0x10]
shr edx, 0x1f
inc ebx
fild dword [eax + 0x10]
cmp ebx, 2
fadd dword [edx*4 + 0x86db88]
fmul dword [0x86db68]
fstp dword [edi + esi + 0x5e0]
jge 0x4e9a8c
cmp ebx, 1
jne 0x4e98fc
jmp 0x4eadfc
mov ebx, 1
mov edx, 4
mov edi, dword [esi + 0x95f8]
mov word [esi + 0x528], bx
mov ecx, dword [esp + 0x3a0]
mov word [esi + 0x8e4], dx
mov dword [esi + 0x964], ebx
fld dword [esi + 0x95f8]
mov dword [esi + 0x8e8], edi
mov dword [esi + 0x95f8], 0
fsub dword [0x86db6c]
fstp dword [esi + 0x8e8]
mov edx, dword [ebp + 0x98]
call dword [edx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x14]
mov edx, dword [eax + 0x14]
push 2
call dword [edx + 0x34]
mov edx, dword [eax + 0x38]
test edx, edx
je 0x4e9bd1
mov dword [esi + 0xd20], 1
mov edx, 2
mov ebx, 3
mov dword [esi + 0x1034], edx
mov ecx, dword [esp + 0x3a0]
mov dword [esi + 0xd54], edx
mov word [esi + 0xca0], bx
mov edi, dword [ebp + 0x98]
call dword [edi + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x14]
mov edx, dword [eax + 0x14]
push 2
call dword [edx + 0x34]
fild dword [eax + 0x38]
mov ecx, dword [esp + 0x3a0]
fmul dword [0x86db64]
fstp dword [esi + 0xca4]
mov edx, dword [ebp + 0x98]
call dword [edx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x14]
mov edx, dword [eax + 0x14]
push 2
call dword [edx + 0x34]
push dword [eax + 4]
call fcn.00543b30
pop ecx
fld qword [0x86db38]
fmulp st(1)
fstp dword [esi + 0xf50]
mov dword [esi + 0xf54], 0
mov dword [esi + 0xf4c], 0
xor ebx, ebx
mov edi, dword [esp + 0x39c]
mov esi, esi
mov edx, dword [ebp + 0x98]
mov ecx, dword [esp + 0x3a0]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push edi
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebx
call dword [edx + 0x34]
mov edx, dword [eax + 4]
test edx, edx
je 0x4e9ce8
mov edx, 1
mov ecx, dword [esp + 0x3a0]
mov dword [esi + 0x10dc], edx
mov dword [esi + 0x13f0], edx
mov dword [esi + 0x10e4], 2
mov edx, dword [ebp + 0x98]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push edi
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebx
call dword [edx + 0x34]
push dword [eax]
call fcn.00543b30
pop ecx
fstp dword [esi + 0x13f8]
mov edx, dword [ebp + 0x98]
mov ecx, dword [esp + 0x3a0]
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push edi
call dword [edx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov edx, dword [eax]
mov ecx, eax
push ebx
call dword [edx + 0x34]
mov edx, dword [eax + 4]
shr edx, 0x1f
test ebx, ebx
fild dword [eax + 4]
fadd dword [edx*4 + 0x86db88]
fmul dword [0x86db60]
fstp dword [esi + 0x1060]
je 0x4e9cdc
cmp ebx, 1
jne 0x4e9cbc
mov edx, 4
mov word [esi + 0x105c], dx
jmp 0x4e9ce8
cmp ebx, 2
jne 0x4e9ce8
mov edx, 3
mov word [esi + 0x105c], dx
jmp 0x4e9ce8
mov edx, 1
mov word [esi + 0x105c], dx
inc ebx
cmp ebx, 3
jl 0x4e9bdc
mov edx, 1
mov ecx, dword [esp + 0x3a0]
mov dword [esi + 0x4168], edx
mov byte [esi + 0x4386], dl
mov byte [esi + 0x4387], 6
mov word [esi + 0x40e8], dx
mov ebx, dword [ebp + 0x98]
call dword [ebx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x28]
mov edx, dword [eax + 0x28]
call dword [edx + 0xc]
mov edx, dword [eax + 4]
neg edx
add edx, 6
mov dword [esp + 0x388], edx
shr edx, 0x1f
fild dword [esp + 0x388]
fadd dword [edx*4 + 0x86db88]
fmul qword [0x86db30]
mov edx, 0x3f800000
fst dword [esi + 0x40ec]
fcom dword [0x86db7c]
fnstsw ax
sahf
jbe 0x4e9d8a
fstp st(0)
fld dword [0x86db7c]
mov dword [esi + 0x40ec], edx
xor edx, edx
fcomp dword [0x86db6c]
fnstsw ax
sahf
jae 0x4e9d9d
mov dword [esi + 0x40ec], edx
mov edx, dword [ebp + 0x98]
mov ecx, dword [esp + 0x3a0]
call dword [edx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x48]
mov edx, dword [eax + 0x48]
call dword [edx + 0xc]
mov edx, dword [eax + 0x20]
cmp edx, 0x64
jae 0x4e9eab
mov edx, 1
mov ebx, 4
mov ecx, dword [esp + 0x3a0]
mov dword [esi + 0x4410], edx
mov byte [esi + 0x462e], dl
mov byte [esi + 0x462f], 6
mov word [esi + 0x4390], bx
mov edi, dword [ebp + 0x98]
call dword [edi + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x48]
mov edx, dword [eax + 0x48]
call dword [edx + 0xc]
mov edx, dword [eax + 0x20]
neg edx
add edx, 0x64
mov dword [esp + 0x388], edx
shr edx, 0x1f
fild dword [esp + 0x388]
fadd dword [edx*4 + 0x86db88]
fmul dword [0x86db68]
fmul st(0)
mov edx, 0x3f800000
fst dword [esi + 0x4394]
fcom dword [0x86db7c]
fnstsw ax
sahf
jbe 0x4e9e77
fstp st(0)
fld dword [0x86db7c]
mov dword [esi + 0x4394], edx
fld dword [0x86db5c]
fld st(1)
fadd dword [esi + 0x8e8]
fcomp st(1)
fnstsw ax
sahf
jbe 0x4eb357
fsubrp st(1)
xor edx, edx
fst dword [esi + 0x8e8]
fcomp dword [0x86db6c]
fnstsw ax
sahf
jae 0x4e9eab
mov dword [esi + 0x8e8], edx
mov edx, 1
mov edi, 3
mov bl, byte [esp + 0x3e8]
mov dword [esi + 0x46b8], edx
test bl, bl
mov byte [esi + 0x48d6], dl
mov byte [esi + 0x48d7], dl
mov word [esi + 0x4638], di
mov dword [esi + 0x463c], 0x3daaaaab
je 0x4e9f0c
mov edx, 1
mov dword [esi + 0x4960], edx
mov byte [esi + 0x4b7e], dl
mov byte [esi + 0x4b7f], 8
mov word [esi + 0x48e0], dx
mov dword [esi + 0x48e4], 0x3f800000
mov ebx, 0x866c6c
mov edx, dword [esp + 0x3ec]
test edx, edx
mov dword [esp + 0x3d8], ebx
mov ebx, 0x866c6c
je 0x4e9f39
mov edx, 0x86dec8
mov ebx, 0x86ded4
mov dword [esp + 0x3d8], edx
mov edx, dword [esp + 0x3c4]
test edx, edx
je 0x4ea0f8
lea ebx, [esp + 0x1e0]
mov dl, byte [esp + 0x3a4]
test dl, dl
jne 0x4e9fdc
mov edi, dword [esp + 0x3d8]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4e9f77
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x4e9f6f
test eax, eax
jbe 0x4e9f8c
mov edx, 0x86def0
jmp 0x4e9f91
mov edx, 0x866c6c
lea edi, [esp + 0x1e0]
mov eax, dword [esp + 0x418]
lea eax, [eax + 1]
mov dword [esp + 0x3ec], eax
mov eax, dword [esp + 0x3b8]
push eax
mov eax, dword [esp + 0x3c0]
push eax
mov eax, dword [esp + 0x3f4]
push eax
push edx
push 0x86def4
push edi
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
jmp 0x4ea0f8
mov edi, dword [esp + 0x3d8]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4e9ff5
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x4e9fed
mov dword [esp + 0x398], ebx
mov ebx, dword [esi + 0x2c]
mov edi, ebx
mov dword [esp + 0x3e8], eax
mov eax, 0x2aaaaaab
imul ebx
sar edx, 1
sar edi, 0x1f
sub edx, edi
lea edi, [edx*8]
lea edi, [edi + edx*4]
neg edi
add edi, ebx
mov eax, 0x2aaaaaab
imul ebx
sar edx, 1
sar ebx, 0x1f
sub edx, ebx
add edx, 0xfffffffe
push edx
push dword [edi*4 + 0x7b22f0]
push 0x86dec0
lea edx, [esp + 0x2ec]
push edx
mov ebx, dword [esp + 0x3a8]
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov dword [esp + 0x398], ebx
mov ebx, dword [esi + 0x30]
mov eax, 0x2aaaaaab
mov edi, ebx
sar edi, 0x1f
imul ebx
sar edx, 1
sub edx, edi
lea edi, [edx*8]
lea edi, [edi + edx*4]
neg edi
add edi, ebx
mov eax, 0x2aaaaaab
imul ebx
sar edx, 1
sar ebx, 0x1f
sub edx, ebx
add edx, 0xfffffffe
push edx
push dword [edi*4 + 0x7b22f0]
push 0x86dec0
lea edx, [esp + 0x2ec]
push edx
mov ebx, dword [esp + 0x3a8]
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov edx, dword [esp + 0x3e8]
test edx, edx
jbe 0x4ea0cc
mov eax, 0x86def0
jmp 0x4ea0d1
mov eax, 0x866c6c
lea edi, [esp + 0x2e0]
lea edx, [esp + 0x2e0]
push edx
push edi
push eax
push 0x86ded8
lea edx, [esp + 0x1f0]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
mov edx, dword [esi + 0x9680]
test edx, edx
jl 0x4ea113
mov ebx, 0x866c6c
mov edx, 0x86df0c
mov dword [esp + 0x3d8], edx
push esi
mov ecx, dword [esp + 0x400]
call fcn.006c2a68
lea edx, [esi + 4]
inc eax
push ebx
mov ebx, dword [esp + 0x3dc]
push ebx
push eax
push 0x86df24
push edx
call fcn.007020f0
add esp, 0x14
lea ecx, [esp + 0x54]
call fcn.006ea05c
movzx edx, al
test edx, edx
jne 0x4ea156
mov dword [esi + 0x9654], 3
push esi
mov ecx, dword [esp + 0x400]
call fcn.004e3efc
mov ebx, eax
test ebx, ebx
jl 0x4eb1cc
push esi
mov ecx, dword [esp + 0x400]
call fcn.006c2a68
push eax
mov ecx, dword [esp + 0x400]
call fcn.006c2bb8
mov edx, dword [esp + 0x3fc]
mov esi, dword [edx + ebx*4 + 0x4010]
push esi
mov ecx, dword [esp + 0x400]
call fcn.006c2a68
push eax
mov ecx, dword [esp + 0x400]
call fcn.006c2738
mov edi, eax
xor edx, edx
mov dword [esp + 0x390], esi
mov dword [esp + 0x394], ebp
lea esi, [esi]
lea edi, [edi]
xor ebx, ebx
mov dword [edx + edi + 0x58], ebx
mov dword [edx + edi + 0x5c], ebx
mov dword [edx + edi + 0x60], ebx
mov dword [edx + edi + 0x6c], ebx
mov byte [edx + edi + 0x64], bl
mov dword [edx + edi + 0x68], 0x3f800000
mov byte [edx + edi + 0x65], bl
mov byte [edx + edi + 0x66], bl
add edx, 0x18
cmp edx, 0xd8
jl 0x4ea1cc
mov esi, dword [esp + 0x390]
mov ebp, dword [esp + 0x394]
mov edx, dword [ebp + 0x98]
mov ecx, dword [esp + 0x3a0]
call dword [edx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
lea ecx, [eax + 0x20]
mov edx, dword [eax + 0x20]
call dword [edx + 0xc]
mov edx, dword [eax + 0x10]
test edx, edx
je 0x4ea2f1
and dword [esp + 0x430], 0xff000000
mov edx, dword [ebp + 0x98]
mov ecx, dword [esp + 0x3a0]
mov dword [esp + 0x2f8], 0x3f800000
call dword [edx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
lea ecx, [eax + 0x40]
mov edx, dword [eax + 0x40]
call dword [edx + 0xc]
mov edx, dword [eax + 8]
mov ebx, dword [ebp + 0x98]
mov ecx, dword [esp + 0x3a0]
mov dword [esp + 0x3e8], edx
call dword [ebx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
lea ecx, [eax + 0x40]
mov edx, dword [eax + 0x40]
call dword [edx + 0xc]
mov ebx, dword [eax + 0xc]
mov eax, dword [esp + 0x430]
or eax, 0x300
mov dword [esp + 0x430], eax
mov edx, dword [esp + 0x3e8]
xor ecx, ecx
mov dword [edi + 0x58], edx
test edx, edx
mov dword [edi + 0x5c], ebx
mov ebx, dword [esp + 0x2f8]
mov dword [edi + 0x60], ecx
mov dword [edi + 0x64], eax
mov dword [edi + 0x68], ebx
mov dword [edi + 0x6c], ecx
jge 0x4ea2ed
mov dword [edi + 0x6c], edx
mov byte [edi + 0x66], 1
mov edx, dword [esp + 0x3f0]
mov ebx, dword [edx + 0x760]
mov ecx, dword [esp + 0x404]
call dword [ebx + 0xc]
lea ecx, [eax + 0xcc]
mov edx, dword [eax + 0xcc]
call dword [edx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x424]
mov ecx, eax
push edx
call dword [ebx + 0x34]
lea ecx, [esp + 0xa0]
add eax, 0x10
push eax
call fcn.007017d0
lea ecx, [esp + 0x300]
call fcn.00736414
lea edx, [esp + 0xa4]
lea ecx, [esp + 0x24]
mov dword [esp + 0x3ec], edx
lea edx, [esp + 0xa0]
push 0xffffffffffffffff
mov ebx, dword [esp + 0x428]
push ebx
push eax
push edx
push ecx
mov ecx, dword [esp + 0x400]
call fcn.006ef994
lea ecx, [esp + 0x300]
call fcn.00701810
push 0
call fcn.006f4c6c
mov dword [esp + 0x39c], eax
add esp, 4
xor edx, edx
lea ecx, [esp + 0x54]
mov dword [esp + 0x3e8], edx
call fcn.006ea05c
mov dword [esp + 0x3ec], eax
mov edx, eax
movzx ebx, dl
test ebx, ebx
je 0x4eb1ac
lea edx, [esp + 0xa4]
lea eax, [esp + 0xb4]
mov ebx, dword [esp + 0x3e8]
push ebx
mov ebx, dword [esp + 0x418]
mov ecx, edi
push ebx
push 1
push eax
push 0
mov ebx, dword [esp + 0x3ac]
push ebx
mov ebx, dword [esp + 0x410]
push ebx
push edx
call fcn.006e002c
mov ebx, eax
test ebx, ebx
je 0x4ea42c
push edi
mov ecx, dword [esp + 0x400]
call fcn.006c29c8
push eax
mov ecx, dword [esp + 0x400]
call fcn.006c2b28
cmp ebx, 4
je 0x4eae1c
inc dword [esp + 0x39c]
jmp 0x4e922d
xor edx, edx
lea ecx, [esp + 0x304]
mov dword [esp + 0x414], edx
call fcn.00736414
lea ecx, [esp + 0xa4]
lea edx, [esp + 0x308]
push edx
call fcn.006ec268
lea ecx, [esp + 0x308]
lea edx, [esp + 0x310]
push 0
push edx
call fcn.006ecde8
lea edx, [esp + 0x304]
push dword [esp + 0x310]
push 0x86c510
push edx
call fcn.007020f0
add esp, 0xc
lea ecx, [esp + 0x310]
call fcn.00701810
mov ecx, dword [esp + 0x308]
test ecx, ecx
je 0x4ea4b2
mov dword [esp + 0x308], 0
je 0x4ea4b2
push 1
call fcn.00433260
mov ecx, dword [esp + 0x30c]
test ecx, ecx
je 0x4ea4d1
mov dword [esp + 0x30c], 0
je 0x4ea4d1
push 1
call fcn.00433290
mov edx, dword [esp + 0x304]
add esp, 0xffffffec
lea ecx, [esp + 0xc8]
mov dword [esp], edx
fld qword [esp + 0x3dc]
fstp dword [esp + 4]
mov dword [esp + 8], 0
mov byte [esp + 0xc], 1
mov dword [esp + 0x10], 0x86d9c8
call fcn.0072cbe8
movzx edx, al
test edx, edx
je 0x4ea51a
mov dl, 1
mov byte [esp + 0x3e4], dl
mov dl, byte [esp + 0x3e4]
test dl, dl
jne 0x4eb17c
mov dl, byte [ebp]
mov ecx, dword [esp + 0x3a0]
mov byte [edi + 0x13a], dl
mov bl, byte [ebp + 4]
mov edx, dword [esp + 0x428]
mov byte [edi + 0x13b], bl
mov dl, byte [edx]
mov byte [edi + 0x138], dl
mov edx, dword [esp + 0x42c]
mov dl, byte [edx]
mov byte [edi + 0x139], dl
mov edx, dword [ebp + 0x98]
call dword [edx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
lea ecx, [eax + 0x20]
mov edx, dword [eax + 0x20]
call dword [edx + 0xc]
mov dl, byte [eax + 4]
mov ecx, edi
mov byte [edi + 0x140], dl
call fcn.006df43c
mov edx, dword [ebp + 0x98]
mov ecx, dword [esp + 0x3a0]
call dword [edx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
lea ecx, [eax + 0x20]
mov edx, dword [eax + 0x20]
call dword [edx + 0xc]
fld qword [0x86db28]
movsx edx, word [eax + 8]
fstp qword [esp]
mov dword [esp + 0x388], edx
fild dword [esp + 0x388]
fmul qword [0x86db20]
fstp qword [esp + 8]
call sub.MSVCRT.dll_pow
mov ecx, dword [esp + 0x3a0]
fstp dword [edi + 0x14c]
mov edx, dword [ebp + 0x98]
call dword [edx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
lea ecx, [eax + 0x20]
mov edx, dword [eax + 0x20]
call dword [edx + 0xc]
mov edx, dword [eax + 0xc]
cmp edx, 0x80000000
jne 0x4ea62c
mov dword [edi + 0x144], 0
jmp 0x4ea681
mov edx, dword [ebp + 0x98]
mov ecx, dword [esp + 0x3a0]
call dword [edx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
lea ecx, [eax + 0x20]
mov edx, dword [eax + 0x20]
call dword [edx + 0xc]
fild dword [eax + 0xc]
fmul qword [0x86db18]
fld qword [0x86db28]
fxch st(1)
fchs
fxch st(1)
fstp qword [esp]
fmul qword [0x86db30]
fstp qword [esp + 8]
call sub.MSVCRT.dll_pow
fstp dword [edi + 0x144]
mov edx, dword [ebp + 0x98]
mov ecx, dword [esp + 0x3a0]
call dword [edx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
lea ecx, [eax + 0x20]
mov edx, dword [eax + 0x20]
call dword [edx + 0xc]
mov edx, dword [eax + 0x38]
cmp edx, 0x3f
jle 0x4ea6b6
neg edx
add edx, 0x3f
add edx, 0x40
mov eax, edi
xor bl, bl
mov dword [esp + 0x388], edx
fild dword [esp + 0x388]
fmul qword [0x86db10]
fstp dword [edi + 0x148]
mov dword [esp + 0x3d8], edi
mov edi, eax
mov dword [esp + 0x390], esi
mov dword [esp + 0x394], ebp
mov ebp, dword [esp + 0x3fc]
lea esi, [esi]
push 1
mov ecx, ebp
push edi
call fcn.006c2c68
mov esi, eax
test esi, esi
je 0x4eae5e
mov bl, 1
mov ecx, ebp
push edi
call fcn.006c29c8
push eax
mov ecx, ebp
call fcn.006c2b28
mov edi, esi
jmp 0x4ea6fc
mov ebx, dword [esp + 0x3fc]
mov ebp, dword [esp + 0x3f0]
mov dl, byte [esp + 0x3e4]
mov byte [esp + 0x398], dl
mov dl, byte [esp + 0x3dc]
test dl, dl
je 0x4ea7bd
lea ecx, [esp + 0x340]
call fcn.00736414
mov dword [esp + 0x33c], 0
lea ecx, [esp + 0x14]
push 0x86df34
call fcn.00701780
lea edx, [esp + 0x33c]
lea ecx, [esp + 0x33c]
lea edi, [esp + 0x14]
mov dword [esp + 0x10], edx
mov esi, 5
mov dword [esp + 0x18], 5
and esi, 0xf
or esi, 0x10
push esi
push edi
call fcn.006f2434
lea ecx, [esp + 0x14]
call fcn.00701810
lea ecx, [esp + 0x340]
call fcn.00701810
lea ecx, [esp + 0x54]
call fcn.006ea05c
movzx edx, al
test edx, edx
jne 0x4eaa5b
xor eax, eax
mov edi, dword [ebx + 0x8e18]
test edi, edi
jle 0x4ea7f6
mov edx, dword [ebx + eax*4 + 0x10]
mov esi, dword [edx + 0x28]
inc eax
mov byte [esi + 0x374], 0
mov edi, dword [ebx + 0x8e18]
cmp eax, edi
jl 0x4ea7dd
xor esi, esi
test edi, edi
jle 0x4eaa5b
lea esi, [esi]
lea edi, [edi]
mov edx, dword [ebx + esi*4 + 0x10]
mov eax, dword [edx + 0x28]
mov dl, byte [eax + 0x374]
test dl, dl
jne 0x4eaa52
mov byte [eax + 0x374], 1
lea ecx, [esp + 0x344]
call fcn.006ebda8
mov edi, dword [ebx + esi*4 + 0x10]
mov ecx, dword [edi + 0x28]
add ecx, 0x344
lea edx, [esp + 0x34c]
push edx
call fcn.006ec268
lea ecx, [esp + 0x34c]
lea edx, [esp + 0x354]
push 0
push edx
call fcn.006ecde8
lea edx, [esp + 0xa0]
push dword [esp + 0x354]
push 0x86d988
push edx
call fcn.007020f0
add esp, 0xc
lea ecx, [esp + 0x354]
call fcn.00701810
mov ecx, dword [esp + 0x34c]
test ecx, ecx
je 0x4ea8ab
mov dword [esp + 0x34c], 0
je 0x4ea8ab
push 1
call fcn.00433260
mov ecx, dword [esp + 0x350]
test ecx, ecx
je 0x4ea8ca
mov dword [esp + 0x350], 0
je 0x4ea8ca
push 1
call fcn.00433290
lea ecx, [esp + 0xa0]
push 1
call fcn.00701c60
lea ecx, [esp + 0x358]
call fcn.006ebda8
lea ecx, [esp + 0x358]
lea edx, [esp + 0x5c]
push edx
call fcn.006e9d34
lea ecx, [esp + 0x360]
lea edx, [esp + 0xa0]
push 0
push edx
call fcn.006ea08c
lea ecx, [esp + 0x358]
push eax
call fcn.006ea37c
mov ecx, dword [esp + 0x360]
test ecx, ecx
je 0x4ea937
mov dword [esp + 0x360], 0
je 0x4ea937
push 1
call fcn.00433260
mov ecx, dword [esp + 0x364]
test ecx, ecx
je 0x4ea956
mov dword [esp + 0x364], 0
je 0x4ea956
push 1
call fcn.00433290
add esp, 0xfffffff8
mov ecx, esp
push 0x86d9e4
call fcn.00701780
lea ecx, [esp + 0x360]
mov dword [esp + 4], 0xffffffff
call fcn.006eda14
call fcn.006f4c8c
mov edx, dword [ebx + esi*4 + 0x10]
mov edx, dword [edx + 0x28]
mov edi, dword [esp + 0x400]
mov dword [edx + 0x14], eax
mov edx, dword [ebx + esi*4 + 0x10]
mov edx, dword [edx + 0x28]
mov dword [edx + 0x10], edi
lea edi, [ebp + 0x1c]
mov edx, dword [ebx + esi*4 + 0x10]
mov edx, dword [edx + 0x28]
mov dword [edx + 0xc], edi
mov edi, dword [ebx + esi*4 + 0x10]
mov ecx, dword [edi + 0x28]
lea edx, [esp + 0x358]
push 0
push 1
push edx
call fcn.006c55f8
mov ecx, dword [esp + 0x358]
test ecx, ecx
je 0x4ea9dd
mov dword [esp + 0x358], 0
je 0x4ea9dd
push 1
call fcn.00433260
mov ecx, dword [esp + 0x35c]
test ecx, ecx
je 0x4ea9fc
mov dword [esp + 0x35c], 0
je 0x4ea9fc
push 1
call fcn.00433290
mov ecx, dword [esp + 0x344]
test ecx, ecx
je 0x4eaa1b
mov dword [esp + 0x344], 0
je 0x4eaa1b
push 1
call fcn.00433260
mov ecx, dword [esp + 0x348]
test ecx, ecx
je 0x4eb26c
mov dword [esp + 0x348], 0
je 0x4eaa4c
push 1
call fcn.00433290
mov edi, dword [ebx + 0x8e18]
jmp 0x4eaa52
mov edi, dword [ebx + 0x8e18]
inc esi
cmp esi, edi
jl 0x4ea80c
mov dl, byte [esp + 0x398]
test dl, dl
jne 0x4eac5f
mov edx, dword [ebx + 0x8e1c]
test edx, edx
jg 0x4eaab3
push dword [ebp + 0x1e68]
mov ecx, ebx
push dword [ebp + 0x1ae4]
push 0xffffffffffffffff
call fcn.006b70b8
mov esi, eax
lea ecx, [esp + 0x36c]
push 0x86df64
call fcn.00701780
add esi, 4
mov ecx, esi
push eax
call fcn.007017d0
lea ecx, [esp + 0x36c]
call fcn.00701810
lea ecx, [esp + 0x54]
call fcn.006ea05c
movzx edx, al
test edx, edx
jne 0x4eab24
add esp, 0xffffffd8
lea ecx, [esp + 4]
xor edx, edx
mov dword [esp + 4], edx
lea esi, [esp + 0x7c]
mov dword [esp + 8], edx
push esi
call fcn.006e9d34
lea ecx, [esp + 0xc]
xor edx, edx
lea esi, [esp + 0x84]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], edx
push esi
call fcn.006e9d34
mov esi, dword [esp + 0x470]
xor edx, edx
mov ecx, ebp
mov dword [esp], esi
mov byte [esp + 0x14], dl
mov dword [esp + 0x18], edx
mov byte [esp + 0x1c], dl
mov byte [esp + 0x20], dl
mov dword [esp + 0x24], 0xffffffff
call fcn.00523fb4
mov ecx, ebx
call fcn.006c26b8
lea ecx, [esp + 0xb4]
call fcn.0072ca64
mov ecx, dword [esp + 0xa4]
test ecx, ecx
je 0x4eab56
mov dword [esp + 0xa4], 0
je 0x4eab56
push 1
call fcn.00433260
mov ecx, dword [esp + 0xa8]
test ecx, ecx
je 0x4eab75
mov dword [esp + 0xa8], 0
je 0x4eab75
push 1
call fcn.00433290
lea ecx, [esp + 0xa0]
call fcn.00701810
lea ecx, [esp + 0x64]
call fcn.00701810
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x4eaba3
mov dword [esp + 0x5c], 0
je 0x4eaba3
push 1
call fcn.00433260
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4eabbc
mov dword [esp + 0x60], 0
je 0x4eabbc
push 1
call fcn.00433290
mov ecx, dword [esp + 0x54]
test ecx, ecx
je 0x4eabd5
mov dword [esp + 0x54], 0
je 0x4eabd5
push 1
call fcn.00433260
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x4eabee
mov dword [esp + 0x58], 0
je 0x4eabee
push 1
call fcn.00433290
lea ecx, [esp + 0x48]
call fcn.00701810
lea ecx, [esp + 0x3c]
call fcn.00701810
lea ecx, [esp + 0x38]
call fcn.00701810
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4eac22
mov dword [esp + 0x24], 0
je 0x4eac22
push 1
call fcn.00433260
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4eac3b
mov dword [esp + 0x28], 0
je 0x4eac3b
push 1
call fcn.00433290
lea ecx, [esp + 0x20]
call fcn.00701810
lea ecx, [esp + 0x1c]
call fcn.00701810
mov eax, 1
add esp, 0x434
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov eax, dword [esp + 0x448]
push eax
mov ecx, dword [esp + 0x3f8]
call fcn.00444400
lea ecx, [esp + 0xb4]
call fcn.0072ca64
mov ecx, dword [esp + 0xa4]
test ecx, ecx
je 0x4eac9e
mov dword [esp + 0xa4], 0
je 0x4eac9e
push 1
call fcn.00433260
mov ecx, dword [esp + 0xa8]
test ecx, ecx
je 0x4eacbd
mov dword [esp + 0xa8], 0
je 0x4eacbd
push 1
call fcn.00433290
lea ecx, [esp + 0xa0]
call fcn.00701810
lea ecx, [esp + 0x64]
call fcn.00701810
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x4eaceb
mov dword [esp + 0x5c], 0
je 0x4eaceb
push 1
call fcn.00433260
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4ead04
mov dword [esp + 0x60], 0
je 0x4ead04
push 1
call fcn.00433290
mov ecx, dword [esp + 0x54]
test ecx, ecx
je 0x4ead1d
mov dword [esp + 0x54], 0
je 0x4ead1d
push 1
call fcn.00433260
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x4ead36
mov dword [esp + 0x58], 0
je 0x4ead36
push 1
call fcn.00433290
lea ecx, [esp + 0x48]
call fcn.00701810
lea ecx, [esp + 0x3c]
call fcn.00701810
lea ecx, [esp + 0x38]
call fcn.00701810
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4ead6a
mov dword [esp + 0x24], 0
je 0x4ead6a
push 1
call fcn.00433260
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4ead83
mov dword [esp + 0x28], 0
je 0x4ead83
push 1
call fcn.00433290
lea ecx, [esp + 0x20]
call fcn.00701810
lea ecx, [esp + 0x1c]
call fcn.00701810
mov eax, 1
add esp, 0x434
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov edx, dword [ebp + 0x98]
mov ecx, dword [esp + 0x3a0]
call dword [edx + 0xc]
mov ebx, dword [eax]
mov edx, dword [esp + 0x39c]
mov ecx, eax
push edx
call dword [ebx + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [eax + 0x48]
mov edx, dword [eax + 0x48]
call dword [edx + 0xc]
mov edx, dword [eax + 8]
test edx, edx
je 0x4eadec
mov dword [esi + 0x95e8], 6
jmp 0x4e9866
mov dword [esi + 0x95e8], 3
jmp 0x4e9866
mov edx, dword [esi + 0x95e8]
test edx, edx
jne 0x4e98fc
jmp 0x4e9a8c
mov esi, dword [esp + 0x3ac]
mov ebx, dword [esp + 0x3b0]
mov dl, 1
mov byte [esp + 0x3e4], dl
mov al, 1
mov byte [esp + 0x398], al
mov al, byte [esp + 0x398]
test al, al
je 0x4e8f89
mov ebx, dword [esp + 0x3fc]
mov ebp, dword [esp + 0x3f0]
jmp 0x4ea748
mov edi, dword [esp + 0x3d8]
mov esi, dword [esp + 0x390]
mov ebp, dword [esp + 0x394]
test bl, bl
je 0x4eae8c
lea ecx, [esp + 0x304]
call fcn.00701810
jmp 0x4ea41b
lea ecx, [esp + 0x54]
call fcn.006ea05c
movzx edx, al
test edx, edx
jne 0x4eb16a
mov edx, dword [edi + 0x28]
mov ebx, dword [edx + 0x234]
test ebx, ebx
je 0x4eb16a
lea ecx, [esp + 0x314]
call fcn.006ebda8
mov ecx, dword [edi + 0x28]
add ecx, 0x344
lea edx, [esp + 0x31c]
push edx
call fcn.006ec268
lea ecx, [esp + 0x31c]
lea edx, [esp + 0x324]
push 0
push edx
call fcn.006ecde8
lea edx, [esp + 0xa0]
push dword [esp + 0x324]
push 0x86d988
push edx
call fcn.007020f0
add esp, 0xc
lea ecx, [esp + 0x324]
call fcn.00701810
mov ecx, dword [esp + 0x31c]
test ecx, ecx
je 0x4eaf30
mov dword [esp + 0x31c], 0
je 0x4eaf30
push 1
call fcn.00433260
mov ecx, dword [esp + 0x320]
test ecx, ecx
je 0x4eaf4f
mov dword [esp + 0x320], 0
je 0x4eaf4f
push 1
call fcn.00433290
lea ecx, [esp + 0xa0]
push 1
call fcn.00701c60
lea ecx, [esp + 0x328]
call fcn.006ebda8
lea ecx, [esp + 0x328]
lea edx, [esp + 0x5c]
push edx
call fcn.006e9d34
lea ecx, [esp + 0x330]
lea edx, [esp + 0xa0]
push 0
push edx
call fcn.006ea08c
lea ecx, [esp + 0x328]
push eax
call fcn.006ea37c
mov ecx, dword [esp + 0x330]
test ecx, ecx
je 0x4eafbc
mov dword [esp + 0x330], 0
je 0x4eafbc
push 1
call fcn.00433260
mov ecx, dword [esp + 0x334]
test ecx, ecx
je 0x4eafdb
mov dword [esp + 0x334], 0
je 0x4eafdb
push 1
call fcn.00433290
add esp, 0xfffffff8
mov ecx, esp
push 0x86d9e4
call fcn.00701780
lea ecx, [esp + 0x330]
mov dword [esp + 4], 0xffffffff
call fcn.006eda14
mov ecx, dword [edi + 0x28]
lea ebx, [esp + 0x328]
xor edx, edx
push edx
push edx
push edx
push ebx
call fcn.006c42c8
mov edx, dword [edi + 0x28]
lea ecx, [edx + 0x60]
mov ebx, dword [edx + 0x60]
mov dword [esp + 0x3e8], edx
call dword [ebx + 0x24]
mov edx, dword [esp + 0x3e8]
lea ecx, [edx + 0x98]
mov ebx, dword [edx + 0x98]
mov dword [edx + 0x5c], 0
call dword [ebx + 0x24]
mov edx, dword [esp + 0x3e8]
lea ecx, [edx + 0xd0]
mov ebx, dword [edx + 0xd0]
mov dword [edx + 0x94], 0
call dword [ebx + 0x24]
mov edx, dword [esp + 0x3e8]
lea ecx, [edx + 0x108]
mov ebx, dword [edx + 0x108]
mov dword [edx + 0xcc], 0
call dword [ebx + 0x24]
mov edx, dword [esp + 0x3e8]
lea ecx, [edx + 0x140]
mov ebx, dword [edx + 0x140]
mov dword [edx + 0x104], 0
call dword [ebx + 0x24]
mov edx, dword [esp + 0x3e8]
lea ecx, [edx + 0x178]
mov ebx, dword [edx + 0x178]
mov dword [edx + 0x13c], 0
call dword [ebx + 0x24]
xor edx, edx
mov ebx, dword [esp + 0x3e8]
mov dword [ebx + 0x174], edx
mov ecx, dword [esp + 0x328]
test ecx, ecx
mov dword [ebx + 0x234], edx
mov dword [ebx + 0x35c], edx
mov dword [ebx + 0x360], edx
mov dword [esi + 0x9654], 3
je 0x4eb10d
mov dword [esp + 0x328], 0
je 0x4eb10d
push 1
call fcn.00433260
mov ecx, dword [esp + 0x32c]
test ecx, ecx
je 0x4eb12c
mov dword [esp + 0x32c], 0
je 0x4eb12c
push 1
call fcn.00433290
mov ecx, dword [esp + 0x314]
test ecx, ecx
je 0x4eb14b
mov dword [esp + 0x314], 0
je 0x4eb14b
push 1
call fcn.00433260
mov ecx, dword [esp + 0x318]
test ecx, ecx
je 0x4eb16a
mov dword [esp + 0x318], 0
je 0x4eb16a
push 1
call fcn.00433290
lea ecx, [esp + 0x304]
call fcn.00701810
jmp 0x4ea41b
mov byte [esp + 0x398], dl
mov esi, dword [esp + 0x3ac]
mov ebx, dword [esp + 0x3b0]
lea ecx, [esp + 0x304]
call fcn.00701810
jmp 0x4eae3c
xor edx, edx
mov dword [esp + 0x398], edx
call fcn.006f4c8c
mov dword [esp + 0x3e8], eax
jmp 0x4ea3b7
mov ecx, esi
call fcn.004e548c
jmp 0x4ea195
fcomp dword [0x86db70]
fnstsw ax
sahf
jae 0x4e998b
mov dword [edx + 0x5e4], 0
jmp 0x4e998b
mov esi, dword [esp + 0x390]
mov ebp, dword [esp + 0x394]
jmp 0x4e96a0
mov esi, dword [esp + 0x3ac]
mov ebx, dword [esp + 0x3b0]
mov al, byte [esp + 0x3e4]
mov byte [esp + 0x398], al
jmp 0x4eae3c
mov edx, dword [ebp + 0x78]
mov ecx, ebx
call dword [edx + 0xc]
mov edx, dword [esp + 0x3c0]
or edx, dword [eax + edi + 0x18]
mov dword [esp + 0x3c0], edx
jmp 0x4e9146
mov edi, dword [ebx + 0x8e18]
jmp 0x4eaa52
lea ecx, [esp + 0x64]
call fcn.00701810
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x4eb29e
mov dword [esp + 0x5c], 0
je 0x4eb29e
push 1
call fcn.00433260
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4eb2b7
mov dword [esp + 0x60], 0
je 0x4eb2b7
push 1
call fcn.00433290
mov ecx, dword [esp + 0x54]
test ecx, ecx
je 0x4eb2d0
mov dword [esp + 0x54], 0
je 0x4eb2d0
push 1
call fcn.00433260
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x4eb2e9
mov dword [esp + 0x58], 0
je 0x4eb2e9
push 1
call fcn.00433290
lea ecx, [esp + 0x48]
call fcn.00701810
lea ecx, [esp + 0x3c]
call fcn.00701810
lea ecx, [esp + 0x38]
call fcn.00701810
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4eb31d
mov dword [esp + 0x24], 0
je 0x4eb31d
push 1
call fcn.00433260
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4eb336
mov dword [esp + 0x28], 0
je 0x4eb336
push 1
call fcn.00433290
lea ecx, [esp + 0x20]
call fcn.00701810
lea ecx, [esp + 0x1c]
call fcn.00701810
xor eax, eax
add esp, 0x434
pop ebx
pop ebp
pop esi
pop edi
ret 8
fstp st(0)
fstp st(0)
jmp 0x4e9eab