Function at 0x514f60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x9396f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
mov ebx, ecx
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.00911f0c
lea ecx, [esp + 0x14]
mov dword [esp + 0x40], 0
call fcn.00911f0c
lea ecx, [esp + 0x30]
mov byte [esp + 0x40], 1
call fcn.00911f0c
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 2
call fcn.00911f0c
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 3
call fcn.00911f0c
movsx eax, word [ebx + 0x244a]
push eax
mov ecx, ebx
mov byte [esp + 0x44], 4
call fcn.004fb8c0
mov ecx, dword [0xa8e738]
lea edx, [esp + 0x14]
push ecx
push 0xa
push 0x25
push 0xa771b0
push edx
call fcn.00911f42
mov eax, dword [0xa8e73c]
lea ecx, [esp + 0x44]
push eax
push 0xa
push 0x25
push 0xa771b0
push ecx
call fcn.00911f42
add esp, 0x28
cmp word [ebx + 0x244e], 3
je 0x51538a
mov edx, dword [0xa8e738]
mov ecx, ebx
fld qword [ebx + 0x24b8]
fmul qword [ebx + 0x24c0]
push edx
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x2008]
mov ecx, ebx
fstp qword [ebx + 0x2008]
mov eax, dword [0xa8e738]
fld qword [ebx + 0x24c8]
fmul qword [ebx + 0x24b8]
push eax
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x2010]
fstp qword [ebx + 0x2010]
mov ecx, dword [0xa8e738]
fld qword [ebx + 0x24d0]
fmul qword [ebx + 0x24b8]
push ecx
mov ecx, ebx
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x2018]
mov ecx, ebx
fstp qword [ebx + 0x2018]
mov edx, dword [0xa8e738]
fld qword [ebx + 0x24d8]
fmul qword [ebx + 0x24b8]
push edx
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x2020]
mov ecx, ebx
fstp qword [ebx + 0x2020]
mov eax, dword [0xa8e738]
fld qword [ebx + 0x24e8]
fmul qword [ebx + 0x24b8]
push eax
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x2038]
fstp qword [ebx + 0x2038]
mov ecx, dword [0xa8e738]
fld qword [ebx + 0x24f8]
fmul qword [ebx + 0x24b8]
push ecx
mov ecx, ebx
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x2048]
mov ecx, ebx
fstp qword [ebx + 0x2048]
mov edx, dword [0xa8e738]
fld qword [ebx + 0x2500]
fmul qword [ebx + 0x24b8]
push edx
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x2050]
mov ecx, ebx
fstp qword [ebx + 0x2050]
mov eax, dword [0xa8e738]
fld qword [ebx + 0x2508]
fmul qword [ebx + 0x24b8]
push eax
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x2058]
fstp qword [ebx + 0x2058]
mov ecx, dword [0xa8e738]
fld qword [ebx + 0x2510]
fmul qword [ebx + 0x24b8]
push ecx
mov ecx, ebx
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x2060]
mov ecx, ebx
fstp qword [ebx + 0x2060]
mov edx, dword [0xa8e738]
fld qword [ebx + 0x2518]
fmul qword [ebx + 0x24b8]
push edx
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x2078]
mov ecx, ebx
fstp qword [ebx + 0x2078]
mov eax, dword [0xa8e738]
fld qword [ebx + 0x24b8]
fmul qword [ebx + 0x24c0]
push eax
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x20c0]
fstp qword [ebx + 0x20c0]
mov ecx, dword [0xa8e738]
fld qword [ebx + 0x24c8]
fmul qword [ebx + 0x24b8]
push ecx
mov ecx, ebx
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x20c8]
mov ecx, ebx
fstp qword [ebx + 0x20c8]
mov edx, dword [0xa8e738]
fld qword [ebx + 0x24d0]
fmul qword [ebx + 0x24b8]
push edx
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x20d0]
mov ecx, ebx
fstp qword [ebx + 0x20d0]
mov eax, dword [0xa8e738]
fld qword [ebx + 0x24d8]
fmul qword [ebx + 0x24b8]
push eax
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x20d8]
fstp qword [ebx + 0x20d8]
mov ecx, dword [0xa8e738]
fld qword [ebx + 0x24e8]
fmul qword [ebx + 0x24b8]
push ecx
mov ecx, ebx
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x20e8]
mov ecx, ebx
fstp qword [ebx + 0x20e8]
mov edx, dword [0xa8e738]
fld qword [ebx + 0x24f8]
fmul qword [ebx + 0x24b8]
push edx
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x20f0]
fstp qword [ebx + 0x20f0]
mov eax, dword [0xa8e738]
push eax
fld qword [ebx + 0x2500]
fmul qword [ebx + 0x24b8]
sub esp, 8
mov ecx, ebx
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x20f8]
fstp qword [ebx + 0x20f8]
mov ecx, dword [0xa8e738]
fld qword [ebx + 0x2508]
fmul qword [ebx + 0x24b8]
push ecx
mov ecx, ebx
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x2100]
mov ecx, ebx
fstp qword [ebx + 0x2100]
mov edx, dword [0xa8e738]
fld qword [ebx + 0x2510]
fmul qword [ebx + 0x24b8]
push edx
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x2108]
mov ecx, ebx
fstp qword [ebx + 0x2108]
mov eax, dword [0xa8e738]
fld qword [ebx + 0x2518]
fmul qword [ebx + 0x24b8]
push eax
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x2118]
fstp qword [ebx + 0x2118]
jmp 0x5153b6
mov ecx, dword [0xa8e738]
fld qword [ebx + 0x24c0]
fmul qword [ebx + 0x24b8]
push ecx
mov ecx, ebx
sub esp, 8
fstp qword [esp]
call fcn.004126e0
fadd qword [ebx + 0x2080]
fstp qword [ebx + 0x2080]
mov al, byte [ebx + 0x516]
test al, al
je 0x515424
mov eax, dword [ebx + 0x584]
test eax, eax
jle 0x5153e4
cmp eax, dword [ebx + 0x588]
jge 0x5153e4
mov edx, dword [ebp + 0x14]
add eax, edx
push eax
lea eax, [esp + 0x10]
push 0xa773a4
push eax
jmp 0x5153f2
mov ecx, dword [ebp + 0x14]
lea edx, [esp + 0xc]
push ecx
push 0xa773a4
push edx
call fcn.00911f42
mov esi, dword [ebp + 8]
mov ecx, dword [esp + 0x18]
mov eax, dword [0xa8e758]
add esp, 0xc
mov edi, dword [esi]
mov edx, dword [ecx - 8]
mov dword [esp + 0x34], edi
mov edi, dword [ebp + 0xc]
push edx
mov edx, dword [esp + 0x38]
add eax, 3
push ecx
push edi
push eax
mov ecx, esi
call dword [edx + 0x64]
jmp 0x51542a
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov al, byte [ebx + 0x517]
test al, al
je 0x5156ac
mov ax, word [ebx + 0x244e]
cmp ax, 1
jne 0x515458
push 0xa773a0
lea ecx, [esp + 0x10]
call fcn.00911f06
jmp 0x51566d
cmp ax, 2
je 0x515445
cmp ax, 3
jne 0x5154b3
fld qword [ebx + 0x2450]
fst qword [esp + 0x24]
fcomp qword [0x9cb978]
fnstsw ax
test ah, 1
je 0x515492
lea eax, [esp + 0xc]
push 0xa77394
push eax
call fcn.00911f42
add esp, 8
jmp 0x51566d
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push ecx
push edx
lea eax, [esp + 0x14]
push 0xa77388
push eax
call fcn.00911f42
add esp, 0x10
jmp 0x51566d
mov ax, word [ebx + 0x2448]
cmp ax, 0x65
jne 0x5154d3
push 0xa7ae20
lea ecx, [esp + 0x14]
call fcn.00911f06
jmp 0x515557
cmp ax, 0x66
jne 0x5154e9
push 0xa7ae1c
lea ecx, [esp + 0x14]
call fcn.00911f06
jmp 0x515557
cmp ax, 0x67
jne 0x51554e
mov ax, word [ebx + 0x244a]
cmp ax, 1
jne 0x51550c
push 0xa7ae18
lea ecx, [esp + 0x14]
call fcn.00911f06
jmp 0x515557
cmp ax, 2
jne 0x515522
push 0xa7ae14
lea ecx, [esp + 0x14]
call fcn.00911f06
jmp 0x515557
cmp ax, 3
jne 0x515538
push 0xa7ae10
lea ecx, [esp + 0x14]
call fcn.00911f06
jmp 0x515557
cmp ax, 4
jne 0x51554e
push 0xa7ae0c
lea ecx, [esp + 0x14]
call fcn.00911f06
jmp 0x515557
lea ecx, [esp + 0x10]
call fcn.0091204a
cmp byte [ebx + 0x24a0], 1
jne 0x5155e7
mov edx, dword [ebx + 0x2454]
mov ecx, dword [ebx + 0x2450]
mov eax, edx
mov dword [esp + 0x24], ecx
push eax
push ecx
mov ecx, ebx
mov dword [esp + 0x30], edx
call fcn.0068e470
mov dword [esp + 0x34], eax
fild dword [esp + 0x34]
fsubr qword [esp + 0x24]
fld dword [ebx + 0x9dc]
fcompp
fnstsw ax
test ah, 0x41
jne 0x5155c4
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
movsx ecx, word [ebx + 0x244a]
push edx
mov edx, dword [esp + 0x14]
push eax
push ecx
push edx
lea eax, [esp + 0x1c]
push str._s_1d__03.0f_H_
push eax
jmp 0x515665
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
movsx eax, word [ebx + 0x244a]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
lea edx, [esp + 0x1c]
push str._s_1d__03.2f_H_
push edx
jmp 0x515665
mov ecx, dword [ebx + 0x2454]
mov eax, dword [ebx + 0x2450]
mov edx, ecx
mov dword [esp + 0x28], ecx
push edx
push eax
mov ecx, ebx
mov dword [esp + 0x2c], eax
call fcn.0068e470
mov dword [esp + 0x34], eax
fild dword [esp + 0x34]
fsubr qword [esp + 0x24]
fld dword [ebx + 0x9dc]
fcompp
fnstsw ax
test ah, 0x41
jne 0x515644
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
movsx eax, word [ebx + 0x244a]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
lea edx, [esp + 0x1c]
push str._s_1d__03.0f
push edx
jmp 0x515665
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
movsx edx, word [ebx + 0x244a]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
lea ecx, [esp + 0x1c]
push str._s_1d__03.2f
push ecx
call fcn.00911f42
add esp, 0x18
mov eax, dword [ebx + 0x9c8]
mov ecx, dword [esp + 0xc]
imul eax, dword [ebx + 0x734]
cdq
sub eax, edx
mov edx, eax
mov eax, dword [ebx + 0x978]
sar edx, 1
mov eax, dword [ebx + eax*4 + 0x484]
sub eax, edx
mov edx, dword [ecx - 8]
mov dword [esp + 0x34], edx
push dword [esp + 0x34]
mov edx, dword [esi]
sub eax, 3
push ecx
push edi
push eax
mov ecx, esi
call dword [edx + 0x64]
mov al, byte [ebx + 0x518]
test al, al
je 0x5157fd
lea eax, [ebx + 0x2458]
lea ecx, [esp + 0x18]
push eax
call fcn.00911f06
cmp byte [0xa8e786], 1
jne 0x5156f7
mov ax, word [ebx + 0x244e]
cmp ax, 0xa
je 0x5156e6
cmp ax, 0xb
jne 0x5156f7
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
push ecx
push 0xa771e8
push edx
jmp 0x515745
mov al, byte [ebx + 0x24a4]
cmp al, 0x59
je 0x515716
cmp al, 0x79
je 0x515716
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xc]
push eax
push 0xa76fa0
push ecx
jmp 0x515745
mov edx, dword [ebp + 0x10]
mov ecx, ebx
push edx
call fcn.004fb710
test al, al
je 0x515736
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xc]
push eax
push 0xa771dc
push ecx
jmp 0x515745
mov edx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push edx
push 0xa76fa0
push eax
call fcn.00911f42
mov eax, dword [esp + 0x18]
mov edx, dword [ebx + 0x738]
add esp, 0xc
mov ecx, dword [eax - 8]
cmp ecx, edx
jle 0x5157b0
lea edi, [ebx + 0x2378]
lea esi, [ebx + 0x224c]
mov ecx, 0xf
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax - 8]
mov eax, dword [ebx + 0x237c]
imul eax, edx
cdq
idiv ecx
lea esi, [ebx + 0x215c]
mov dword [ebx + 0x237c], eax
lea eax, [ebx + 0x2378]
push eax
nop
call fcn.00b15b1a
push eax
mov ecx, esi
call fcn.00912338
mov ecx, dword [ebp + 8]
push esi
mov edx, dword [ecx]
call dword [edx + 0x30]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [ebx + 0x9c8]
mov ecx, dword [ebx + 0x97c]
imul eax, dword [ebx + 0x738]
cdq
sub eax, edx
mov edx, eax
mov eax, dword [ebx + ecx*4 + 0x484]
mov ecx, dword [esp + 0xc]
sar edx, 1
sub eax, edx
mov edx, dword [ecx - 8]
mov dword [esp + 0x34], edx
push dword [esp + 0x34]
mov edx, dword [esi]
sub eax, 3
push ecx
push edi
push eax
mov ecx, esi
call dword [edx + 0x64]
mov eax, dword [esi]
lea ecx, [ebx + 0x2144]
push ecx
mov ecx, esi
call dword [eax + 0x30]
mov al, byte [ebx + 0x519]
test al, al
je 0x515c76
mov al, byte [0xa8e784]
test al, al
je 0x515a85
lea ecx, [esp + 0x20]
call fcn.00911f0c
lea eax, [ebx + 0x2495]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x44], 5
call fcn.00911f06
mov edx, dword [esp + 0xc]
push 0xa76f28
lea ecx, [esp + 0x10]
mov eax, dword [edx - 8]
mov dword [esp + 0x20], eax
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x51592b
push 0xa77194
lea ecx, [esp + 0x10]
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x51592b
push 0xa77190
lea ecx, [esp + 0x10]
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x51592b
push 0xa76f34
lea ecx, [esp + 0x10]
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x51592b
lea eax, [ebx + 0x2495]
lea ecx, [esp + 0x24]
push eax
call fcn.00911edc
mov eax, dword [ebx + 0x73c]
mov edx, dword [esp + 0x1c]
mov ecx, dword [ebx + 0x9c8]
sub eax, edx
imul eax, ecx
cdq
sub eax, edx
mov byte [esp + 0x40], 8
sar eax, 1
cdq
sub eax, edx
mov edx, dword [ebx + 0x960]
mov ecx, eax
mov eax, dword [ebx + edx*4 + 0x574]
sar ecx, 1
add ecx, eax
mov eax, dword [ebx + 0x73c]
imul eax, dword [ebx + 0x9c8]
cdq
sub eax, edx
mov edx, dword [esi]
sar eax, 1
sub ecx, eax
mov eax, dword [esp + 0x24]
sub ecx, 3
mov eax, dword [eax - 8]
push eax
mov eax, dword [esp + 0x28]
push eax
push edi
push ecx
mov ecx, esi
call dword [edx + 0x64]
lea ecx, [esp + 0x24]
mov byte [esp + 0x40], 5
call fcn.00911ee2
mov byte [esp + 0x40], 4
lea ecx, [esp + 0x20]
jmp 0x515c71
lea ecx, [esp + 0x34]
push 1
push ecx
lea ecx, [esp + 0x14]
call fcn.0091218e
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 6
call fcn.00911f3c
lea ecx, [esp + 0x34]
mov byte [esp + 0x40], 5
call fcn.00911ee2
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
lea eax, [edx - 1]
mov dword [esp + 0x24], eax
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00912044
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x44], 7
call fcn.00911f3c
lea ecx, [esp + 0x34]
mov byte [esp + 0x40], 5
call fcn.00911ee2
mov eax, dword [ebx + 0x73c]
mov edx, dword [esp + 0x1c]
mov ecx, dword [ebx + 0x9c8]
sub eax, edx
imul eax, ecx
cdq
sub eax, edx
sar eax, 1
cdq
sub eax, edx
mov edx, dword [ebx + 0x960]
mov ecx, eax
mov eax, dword [ebx + edx*4 + 0x574]
sar ecx, 1
add ecx, eax
mov eax, dword [ebx + 0x73c]
imul eax, dword [ebx + 0x9c8]
cdq
sub eax, edx
mov edx, dword [esi]
sar eax, 1
sub ecx, eax
mov eax, dword [esp + 0xc]
sub ecx, 3
mov eax, dword [eax - 8]
push eax
mov eax, dword [esp + 0x10]
push eax
push edi
push ecx
mov ecx, esi
call dword [edx + 0x64]
mov edx, dword [esi]
lea eax, [ebx + 0x2154]
push eax
mov ecx, esi
call dword [edx + 0x30]
mov eax, dword [ebx + 0x73c]
mov edx, dword [esp + 0x1c]
mov ecx, dword [ebx + 0x9c8]
sub eax, edx
imul eax, ecx
cdq
sub eax, edx
sar eax, 1
cdq
sub eax, edx
mov edx, dword [ebx + 0x960]
mov ecx, eax
mov eax, dword [ebx + edx*4 + 0x574]
sar ecx, 1
add ecx, eax
mov eax, dword [esp + 0x24]
imul eax, dword [ebx + 0x9c8]
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov eax, dword [ebx + 0x73c]
imul eax, dword [ebx + 0x9c8]
cdq
sub eax, edx
mov edx, dword [esi]
sar eax, 1
sub ecx, eax
mov eax, dword [esp + 0x20]
sub ecx, 3
mov eax, dword [eax - 8]
push eax
mov eax, dword [esp + 0x24]
push eax
push edi
push ecx
mov ecx, esi
call dword [edx + 0x64]
mov edx, dword [esi]
lea eax, [ebx + 0x2144]
push eax
mov ecx, esi
call dword [edx + 0x30]
mov byte [esp + 0x40], 4
lea ecx, [esp + 0x20]
jmp 0x515c71
lea eax, [ebx + 0x2495]
lea ecx, [esp + 0xc]
push eax
call fcn.00911f06
push 0xa76f28
lea ecx, [esp + 0x10]
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x515b4b
push 0xa77194
lea ecx, [esp + 0x10]
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x515b4b
push 0xa77190
lea ecx, [esp + 0x10]
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x515b4b
push 0xa76f34
lea ecx, [esp + 0x10]
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x515b4b
lea eax, [ebx + 0x2495]
lea ecx, [esp + 0x34]
push eax
call fcn.00911edc
mov eax, dword [ebx + 0x9c8]
mov byte [esp + 0x40], 0xc
imul eax, dword [ebx + 0x73c]
cdq
sub eax, edx
mov edx, dword [ebx + 0x960]
mov ecx, eax
mov eax, dword [ebx + edx*4 + 0x574]
sar ecx, 1
sub eax, ecx
mov ecx, dword [esp + 0x34]
sub eax, 3
mov edx, dword [ecx - 8]
mov dword [esp + 0x24], edx
push dword [esp + 0x24]
mov edx, dword [esi]
push ecx
push edi
push eax
mov ecx, esi
call dword [edx + 0x64]
mov byte [esp + 0x40], 4
lea ecx, [esp + 0x34]
jmp 0x515c71
lea ecx, [esp + 0x20]
call fcn.00911f0c
lea eax, [esp + 0x34]
push 1
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x48], 9
call fcn.0091218e
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 0xa
call fcn.00911f3c
lea ecx, [esp + 0x34]
mov byte [esp + 0x40], 9
call fcn.00911ee2
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x34]
mov eax, dword [ecx - 8]
lea ecx, [esp + 0xc]
dec eax
push eax
push edx
call fcn.00912044
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x44], 0xb
call fcn.00911f3c
lea ecx, [esp + 0x34]
mov byte [esp + 0x40], 9
call fcn.00911ee2
mov eax, dword [ebx + 0x9c8]
mov ecx, dword [ebx + 0x960]
imul eax, dword [ebx + 0x73c]
cdq
sub eax, edx
mov edx, eax
mov eax, dword [ebx + ecx*4 + 0x574]
mov ecx, dword [esp + 0xc]
sar edx, 1
sub eax, edx
mov edx, dword [ecx - 8]
mov dword [esp + 0x34], edx
push dword [esp + 0x34]
mov edx, dword [esi]
sub eax, 3
push ecx
push edi
push eax
mov ecx, esi
call dword [edx + 0x64]
mov eax, dword [esi]
lea ecx, [ebx + 0x2154]
push ecx
mov ecx, esi
call dword [eax + 0x30]
mov edx, dword [esp + 0xc]
mov eax, dword [ebx + 0x9c8]
mov ecx, dword [edx - 8]
mov edx, dword [ebx + 0x960]
imul eax, ecx
mov ecx, edx
cdq
mov ecx, dword [ebx + ecx*4 + 0x574]
sub eax, edx
sar eax, 1
add ecx, eax
mov eax, dword [ebx + 0x9c8]
imul eax, dword [ebx + 0x73c]
cdq
sub eax, edx
mov edx, dword [esp + 0x20]
sar eax, 1
sub ecx, eax
mov eax, dword [edx - 8]
mov edx, dword [esi]
sub ecx, 3
push eax
mov eax, dword [esp + 0x24]
push eax
push edi
push ecx
mov ecx, esi
call dword [edx + 0x64]
mov edx, dword [esi]
lea eax, [ebx + 0x2144]
push eax
mov ecx, esi
call dword [edx + 0x30]
mov byte [esp + 0x40], 4
lea ecx, [esp + 0x20]
call fcn.00911ee2
mov al, byte [ebx + 0x51a]
test al, al
je 0x515d39
mov ecx, dword [0xa8e738]
mov edx, dword [ebx + 0x740]
push ecx
push edx
push 0x25
lea eax, [esp + 0x20]
push 0xa771b0
push eax
call fcn.00911f42
add esp, 0x14
cmp word [ebx + 0x244e], 9
jne 0x515cd2
mov ecx, dword [0xa8e73c]
mov edx, dword [ebx + 0x252c]
mov eax, dword [ebx + 0x2528]
push ecx
push edx
push eax
mov ecx, ebx
call fcn.004126e0
fstp qword [ebx + 0x24b8]
mov ecx, dword [ebx + 0x24bc]
mov edx, dword [ebx + 0x24b8]
mov eax, dword [esp + 0x30]
push ecx
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.00911f42
mov eax, dword [ebx + 0x9c8]
mov ecx, dword [ebx + 0x96c]
imul eax, dword [ebx + 0x740]
mov edx, dword [ebx + 0x968]
add esp, 0x10
sub ecx, edx
cdq
sub eax, edx
mov edx, eax
mov eax, dword [ebx + ecx*4 + 0x59c]
mov ecx, dword [esp + 0xc]
sar edx, 1
sub eax, edx
mov edx, dword [ecx - 8]
mov dword [esp + 0x24], edx
push dword [esp + 0x24]
mov edx, dword [esi]
sub eax, 3
push ecx
push edi
push eax
mov ecx, esi
call dword [edx + 0x64]
mov al, byte [ebx + 0x51b]
test al, al
je 0x515de9
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
push eax
push ecx
mov ecx, ebx
call fcn.008f5ce0
fld dword [ebx + 0x9e4]
fcompp
fnstsw ax
test ah, 0x41
je 0x515de9
mov edx, dword [0xa8e738]
mov eax, dword [ebx + 0x744]
push edx
push eax
push 0x25
lea ecx, [esp + 0x20]
push 0xa771b0
push ecx
call fcn.00911f42
mov edx, dword [ebp + 0x28]
mov eax, dword [ebp + 0x24]
mov ecx, dword [esp + 0x28]
push edx
push eax
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.00911f42
mov eax, dword [ebx + 0x9c8]
mov ecx, dword [ebx + 0x968]
imul eax, dword [ebx + 0x744]
mov edx, dword [ebx + 0x960]
add esp, 0x24
sub ecx, edx
cdq
sub eax, edx
mov edx, eax
mov eax, dword [ebx + ecx*4 + 0x59c]
mov ecx, dword [esp + 0xc]
sar edx, 1
sub eax, edx
mov edx, dword [ecx - 8]
mov dword [esp + 0x24], edx
push dword [esp + 0x24]
mov edx, dword [esi]
sub eax, 3
push ecx
push edi
push eax
mov ecx, esi
call dword [edx + 0x64]
mov al, byte [ebx + 0x51c]
test al, al
je 0x515eaf
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x2c]
push eax
push ecx
mov ecx, ebx
call fcn.008f5ce0
fld dword [ebx + 0x9e4]
fcompp
fnstsw ax
test ah, 0x41
je 0x515eaf
mov edx, dword [0xa8e738]
mov eax, dword [ebx + 0x748]
push edx
push eax
push 0x25
lea ecx, [esp + 0x20]
push 0xa771b0
push ecx
call fcn.00911f42
mov edx, dword [esp + 0x28]
mov eax, dword [0xa8e738]
mov ecx, dword [ebp + 0x30]
add esp, 0x14
mov dword [esp + 0x24], edx
mov edx, dword [ebp + 0x2c]
push eax
push ecx
push edx
mov ecx, ebx
call fcn.004126e0
mov eax, dword [esp + 0x24]
sub esp, 8
lea ecx, [esp + 0x14]
fstp qword [esp]
push eax
push ecx
call fcn.00911f42
mov eax, dword [ebx + 0x9c8]
mov ecx, dword [ebx + 0x968]
imul eax, dword [ebx + 0x748]
cdq
sub eax, edx
add esp, 0x10
mov edx, eax
mov eax, dword [ebx + ecx*4 + 0x568]
mov ecx, dword [esp + 0xc]
sar edx, 1
sub eax, edx
mov edx, dword [ecx - 8]
mov dword [esp + 0x24], edx
push dword [esp + 0x24]
mov edx, dword [esi]
sub eax, 3
push ecx
push edi
push eax
mov ecx, esi
call dword [edx + 0x64]
mov ecx, dword [0xa8e738]
mov eax, dword [ebp + 0x18]
fld qword [ebp + 0x24]
fmul qword [ebx + 0x24b8]
push ecx
add eax, 0x40
sub esp, 8
mov ecx, ebx
mov dword [esp + 0x2c], eax
fstp qword [esp]
call fcn.004126e0
mov edx, dword [esp + 0x20]
mov ecx, ebx
fstp qword [edx]
mov eax, dword [0xa8e738]
fld qword [ebp + 0x2c]
fmul qword [ebx + 0x24b8]
push eax
sub esp, 8
fstp qword [esp]
call fcn.004126e0
mov ecx, dword [ebp + 0x18]
mov eax, 8
mov dword [esp + 0x24], eax
fstp qword [ecx + 0x48]
cmp dword [ebx + 0x598], eax
jle 0x516003
mov edx, dword [esp + 0x20]
lea eax, [ebx + 0x74c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
push 0xa907a4
lea ecx, [esp + 0x10]
call fcn.00911f06
mov ecx, dword [esp + 0x24]
mov al, byte [ebx + ecx + 0x515]
test al, al
je 0x515fd6
mov eax, dword [esp + 0x1c]
mov ecx, ebx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
call fcn.008f5ce0
fcomp qword [0x9cb968]
fnstsw ax
test ah, 0x41
jne 0x515fd6
mov edx, dword [esp + 0x20]
mov ecx, dword [0xa8e738]
push ecx
lea ecx, [esp + 0x18]
mov eax, dword [edx]
push eax
push 0x25
push 0xa771b0
push ecx
call fcn.00911f42
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.00911f42
mov ecx, dword [esp + 0x44]
mov eax, dword [ebx + 0x9c8]
add esp, 0x24
imul eax, dword [ecx]
cdq
sub eax, edx
mov edx, eax
mov eax, dword [ecx - 0x190]
mov ecx, dword [esp + 0xc]
sar edx, 1
mov ecx, dword [ecx - 8]
sub eax, edx
mov edx, dword [esi]
push ecx
mov ecx, dword [esp + 0x10]
sub eax, 3
push ecx
push edi
push eax
mov ecx, esi
call dword [edx + 0x64]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
add ecx, 4
mov dword [esp + 0x20], ecx
mov ecx, dword [ebx + 0x598]
inc eax
add edx, 8
cmp eax, ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], edx
jl 0x515f25
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 3
call fcn.00911ee2
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 2
call fcn.00911ee2
lea ecx, [esp + 0x30]
mov byte [esp + 0x40], 1
call fcn.00911ee2
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], 0
call fcn.00911ee2
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], 0xffffffff
call fcn.00911ee2
mov ecx, dword [esp + 0x38]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x2c