Function at 0xae74cc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
push edi
test eax, eax
je 0xae8ea9
mov esi, dword [eax + 0x18]
test esi, esi
je 0xae8ea9
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
cmp eax, 0x3e8
jl 0xae8ea9
xor edi, edi
cmp eax, 0xa8c
jg 0xae814c
je 0xae80b7
cmp eax, 0x708
jg 0xae7a98
je 0xae79f5
cmp eax, 0x578
jg 0xae7859
je 0xae77bd
cmp eax, 0x4b0
jg 0xae770d
je 0xae767a
sub eax, 0x3e8
je 0xae75d5
sub eax, 0x64
jne 0xae8e9f
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push edi
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b0b19c
jmp 0xae8e65
mov eax, dword [esi + 0x64]
push dword [eax + 0x10]
mov eax, dword [esi + 0x60]
push dword [eax + 0x10]
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b5ac2c
jmp 0xae8e65
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b19bac
jmp 0xae8e65
cmp eax, 0x514
jne 0xae8e9f
mov eax, dword [esi + 0x64]
push dword [eax + 0x10]
mov eax, dword [esi + 0x60]
push dword [eax + 0x10]
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b3379c
jmp 0xae8e65
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x44]
cmp dword [eax + 0x10], edi
setne al
movzx eax, al
push eax
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b2647c
jmp 0xae8e65
sub eax, 0x5dc
je 0xae796e
sub eax, 0x64
je 0xae78ed
sub eax, 0x64
jne 0xae8e9f
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b10fec
jmp 0xae8e65
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00ad00dc
jmp 0xae8e65
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b1194c
jmp 0xae8e65
mov eax, dword [esi + 0x60]
push dword [eax + 0x10]
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b3d11c
jmp 0xae8e65
cmp eax, 0x8fc
jg 0xae7db4
je 0xae7d19
cmp eax, 0x834
jg 0xae7c87
je 0xae7bfe
sub eax, 0x76c
je 0xae7b57
sub eax, 0x64
jne 0xae8e9f
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b2adbc
jmp 0xae8e65
mov eax, dword [esi + 0x64]
push dword [eax + 0x10]
mov eax, dword [esi + 0x60]
push dword [eax + 0x10]
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b2442c
jmp 0xae8e65
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00ad814c
jmp 0xae8e65
cmp eax, 0x898
jne 0xae8e9f
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b298bc
jmp 0xae8e65
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b386ac
jmp 0xae8e65
sub eax, 0x960
je 0xae8014
sub eax, 0x64
je 0xae7f11
sub eax, 0x64
jne 0xae8e9f
mov eax, dword [esi + 0xb0]
push dword [eax + 0x10]
mov eax, dword [esi + 0xac]
push dword [eax + 0x10]
mov eax, dword [esi + 0xa8]
push dword [eax + 0x10]
mov eax, dword [esi + 0xa4]
push dword [eax + 0x10]
mov eax, dword [esi + 0xa0]
push dword [eax + 0x10]
mov eax, dword [esi + 0x9c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x98]
push dword [eax + 0x10]
mov eax, dword [esi + 0x94]
push dword [eax + 0x10]
mov eax, dword [esi + 0x90]
push dword [eax + 0x10]
mov eax, dword [esi + 0x8c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x88]
push dword [eax + 0x10]
mov eax, dword [esi + 0x84]
push dword [eax + 0x10]
mov eax, dword [esi + 0x80]
push dword [eax + 0x10]
mov eax, dword [esi + 0x7c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x78]
push dword [eax + 0x10]
mov eax, dword [esi + 0x74]
push dword [eax + 0x10]
mov eax, dword [esi + 0x70]
push dword [eax + 0x10]
mov eax, dword [esi + 0x6c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x68]
push dword [eax + 0x10]
mov eax, dword [esi + 0x64]
push dword [eax + 0x10]
mov eax, dword [esi + 0x60]
push dword [eax + 0x10]
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00adcf8c
jmp 0xae8e65
mov eax, dword [esi + 0x94]
push dword [eax + 0x10]
mov eax, dword [esi + 0x90]
push dword [eax + 0x10]
mov eax, dword [esi + 0x8c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x88]
push dword [eax + 0x10]
mov eax, dword [esi + 0x84]
push dword [eax + 0x10]
mov eax, dword [esi + 0x80]
push dword [eax + 0x10]
mov eax, dword [esi + 0x7c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x78]
push dword [eax + 0x10]
mov eax, dword [esi + 0x74]
push dword [eax + 0x10]
mov eax, dword [esi + 0x70]
push dword [eax + 0x10]
mov eax, dword [esi + 0x6c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x68]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x64]
push dword [eax + 0x10]
mov eax, dword [esi + 0x60]
push dword [eax + 0x10]
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00af37dc
jmp 0xae8e65
mov eax, dword [esi + 0x60]
push dword [eax + 0x10]
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x54]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b30a0c
jmp 0xae8e65
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b4729c
jmp 0xae8e65
cmp eax, 0xe10
jg 0xae8803
je 0xae879a
cmp eax, 0xc80
jg 0xae84eb
je 0xae843c
cmp eax, 0xbb8
jg 0xae8378
je 0xae82db
sub eax, 0xaf0
je 0xae8246
sub eax, 0x64
jne 0xae8e9f
mov eax, dword [esi + 0x6c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x68]
push dword [eax + 0x10]
mov eax, dword [esi + 0x64]
push dword [eax + 0x10]
mov eax, dword [esi + 0x60]
push dword [eax + 0x10]
mov eax, dword [esi + 0x5c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b0e78c
jmp 0xae8e65
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b12dec
jmp 0xae8e65
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x44]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b4000c
jmp 0xae8e65
cmp eax, 0xc1c
jne 0xae8e9f
mov eax, dword [esi + 0x70]
push dword [eax + 0x10]
mov eax, dword [esi + 0x6c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x68]
push dword [eax + 0x10]
mov eax, dword [esi + 0x64]
push dword [eax + 0x10]
mov eax, dword [esi + 0x60]
push dword [eax + 0x10]
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b4e10c
jmp 0xae8e65
mov eax, dword [esi + 0x64]
push dword [eax + 0x10]
mov eax, dword [esi + 0x60]
push dword [eax + 0x10]
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x48]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x44]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x40]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b570ac
jmp 0xae8e65
sub eax, 0xce4
je 0xae86a2
sub eax, 0x64
je 0xae85fb
sub eax, 0x64
jne 0xae8e9f
mov eax, dword [esi + 0x8c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x88]
push dword [eax + 0x10]
mov eax, dword [esi + 0x84]
push dword [eax + 0x10]
mov eax, dword [esi + 0x80]
push dword [eax + 0x10]
mov eax, dword [esi + 0x7c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x78]
push dword [eax + 0x10]
mov eax, dword [esi + 0x74]
push dword [eax + 0x10]
mov eax, dword [esi + 0x70]
push dword [eax + 0x10]
mov eax, dword [esi + 0x6c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x68]
push dword [eax + 0x10]
mov eax, dword [esi + 0x64]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x60]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b2c3cc
jmp 0xae8e65
mov eax, dword [esi + 0x64]
push dword [eax + 0x10]
mov eax, dword [esi + 0x60]
push dword [eax + 0x10]
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00ad906c
jmp 0xae8e65
mov eax, dword [esi + 0x90]
push dword [eax + 0x10]
mov eax, dword [esi + 0x8c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x88]
push dword [eax + 0x10]
mov eax, dword [esi + 0x84]
push dword [eax + 0x10]
mov eax, dword [esi + 0x80]
push dword [eax + 0x10]
mov eax, dword [esi + 0x7c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x78]
push dword [eax + 0x10]
mov eax, dword [esi + 0x74]
push dword [eax + 0x10]
mov eax, dword [esi + 0x70]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x6c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x68]
push dword [eax + 0x10]
mov eax, dword [esi + 0x64]
push dword [eax + 0x10]
mov eax, dword [esi + 0x60]
push dword [eax + 0x10]
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00ad0dac
jmp 0xae8e65
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b045fc
jmp 0xae8e65
cmp eax, 0x1004
jg 0xae8bb7
je 0xae8aad
cmp eax, 0xf3c
jg 0xae8a01
je 0xae898b
sub eax, 0xe74
je 0xae88ee
sub eax, 0x64
jne 0xae8e9f
mov eax, dword [esi + 0x6c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x68]
push dword [eax + 0x10]
mov eax, dword [esi + 0x64]
push dword [eax + 0x10]
mov eax, dword [esi + 0x60]
push dword [eax + 0x10]
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x54]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00ac477c
jmp 0xae8e65
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b5ed5c
jmp 0xae8e65
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
cmp dword [eax + 0x10], edi
setne al
movzx eax, al
push eax
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b5fe9c
jmp 0xae8e65
cmp eax, 0xfa0
jne 0xae8e9f
mov eax, dword [esi + 0x60]
push dword [eax + 0x10]
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
push dword [eax + 0x10]
mov eax, dword [esi + 0x54]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00b2776c
jmp 0xae8e65
mov eax, dword [esi + 0x98]
push dword [eax + 0x10]
mov eax, dword [esi + 0x94]
push dword [eax + 0x10]
mov eax, dword [esi + 0x90]
push dword [eax + 0x10]
mov eax, dword [esi + 0x8c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x88]
push dword [eax + 0x10]
mov eax, dword [esi + 0x84]
push dword [eax + 0x10]
mov eax, dword [esi + 0x80]
push dword [eax + 0x10]
mov eax, dword [esi + 0x7c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x78]
push dword [eax + 0x10]
mov eax, dword [esi + 0x74]
push dword [eax + 0x10]
mov eax, dword [esi + 0x70]
push dword [eax + 0x10]
mov eax, dword [esi + 0x6c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x68]
push dword [eax + 0x10]
mov eax, dword [esi + 0x64]
push dword [eax + 0x10]
mov eax, dword [esi + 0x60]
push dword [eax + 0x10]
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00accf7c
jmp 0xae8e65
sub eax, 0x1068
je 0xae8d72
sub eax, 0x64
je 0xae8c3f
sub eax, 0x64
jne 0xae8e9f
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00af185c
jmp 0xae8e65
mov eax, dword [esi + 0xa4]
push dword [eax + 0x10]
mov eax, dword [esi + 0xa0]
push dword [eax + 0x10]
mov eax, dword [esi + 0x9c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x98]
push dword [eax + 0x10]
mov eax, dword [esi + 0x94]
cmp dword [eax + 0x10], edi
setne al
movzx eax, al
push eax
mov eax, dword [esi + 0x90]
push dword [eax + 0x10]
mov eax, dword [esi + 0x8c]
cmp dword [eax + 0x10], edi
setne al
movzx eax, al
push eax
mov eax, dword [esi + 0x88]
push dword [eax + 0x10]
mov eax, dword [esi + 0x84]
push dword [eax + 0x10]
mov eax, dword [esi + 0x80]
push dword [eax + 0x10]
mov eax, dword [esi + 0x7c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x78]
push dword [eax + 0x10]
mov eax, dword [esi + 0x74]
push dword [eax + 0x10]
mov eax, dword [esi + 0x70]
push dword [eax + 0x10]
mov eax, dword [esi + 0x6c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x68]
push dword [eax + 0x10]
mov eax, dword [esi + 0x64]
push dword [eax + 0x10]
mov eax, dword [esi + 0x60]
push dword [eax + 0x10]
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00ad53cc
jmp 0xae8e65
mov eax, dword [esi + 0x90]
push dword [eax + 0x10]
mov eax, dword [esi + 0x8c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x88]
push dword [eax + 0x10]
mov eax, dword [esi + 0x84]
push dword [eax + 0x10]
mov eax, dword [esi + 0x80]
push dword [eax + 0x10]
mov eax, dword [esi + 0x7c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x78]
push dword [eax + 0x10]
mov eax, dword [esi + 0x74]
push dword [eax + 0x10]
mov eax, dword [esi + 0x70]
push dword [eax + 0x10]
mov eax, dword [esi + 0x6c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x68]
push dword [eax + 0x10]
mov eax, dword [esi + 0x64]
push dword [eax + 0x10]
mov eax, dword [esi + 0x60]
push dword [eax + 0x10]
mov eax, dword [esi + 0x5c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x58]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x54]
push dword [eax + 0x10]
mov eax, dword [esi + 0x50]
push dword [eax + 0x10]
mov eax, dword [esi + 0x4c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x10]
mov eax, dword [esi + 0x44]
push dword [eax + 0x10]
mov eax, dword [esi + 0x40]
push dword [eax + 0x10]
mov eax, dword [esi + 0x3c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x38]
push dword [eax + 0x10]
mov eax, dword [esi + 0x34]
push dword [eax + 0x10]
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
mov eax, dword [esi + 0x28]
push dword [eax + 0x10]
mov eax, dword [esi + 0x24]
push dword [eax + 0x10]
mov eax, dword [esi + 0x20]
push dword [eax + 0x10]
mov eax, dword [esi + 0x1c]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x18]
movzx eax, byte [eax + 0x10]
push eax
mov eax, dword [esi + 0x14]
push 0
push dword [ebp + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 0x10]
push dword [eax + 0x10]
mov eax, dword [esi + 0xc]
push dword [eax + 0x10]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
push edx
push ebx
call fcn.00aeb56c
mov edi, eax
test edi, edi
je 0xae8e9f
test ebx, ebx
je 0xae8e9f
cmp dword [ebx + 0x24], 0x514
jne 0xae8e9f
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x18]
mov eax, dword [ecx + 4]
mov edx, dword [eax + 0x10]
test edx, edx
je 0xae8e9f
mov eax, dword [ecx + 0xc]
push dword [eax + 0x10]
mov eax, dword [ecx + 8]
push dword [eax + 0x10]
lea eax, [edx - 1]
push edi
push eax
push ebx
call fcn.00b354dc
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
pop ebp
ret 8