Function at 0x51a530
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12ec
call fcn.005b0990
mov eax, dword [0x613ad0]
xor eax, ebp
mov dword [ebp - 0x1054], eax
push esi
push edi
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x1120], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x10d4], 0
mov byte [ebp - 0x15], 0x2e
mov word [ebp - 0x14], 0
mov dword [ebp - 0x10e8], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xa164]
and ecx, 1
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x1140], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xa168]
and eax, 4
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x10f4], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1138], 0xffffffff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xa15c]
and edx, 0x80000000
je 0x51a5d8
mov byte [ebp - 0x15], 0x2c
mov eax, dword [ebp + 8]
cmp dword [eax + 0x73c], 0
jle 0x51a608
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x73c]
imul edx, edx, 0x98
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x72c]
mov edx, dword [ecx + edx + 0x54]
mov dword [ebp - 0x12bc], edx
jmp 0x51a612
mov dword [ebp - 0x12bc], 0
mov eax, dword [ebp - 0x12bc]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jne 0x51a66b
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x58c0], 0
jle 0x51a66b
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x58c0]
imul eax, eax, 0x84
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x588c]
cmp dword [edx + eax + 0x6c], 0
je 0x51a66b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x58c0]
imul ecx, ecx, 0x84
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x588c]
mov ecx, dword [eax + ecx + 0x6c]
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x58c0]
imul eax, eax, 0x84
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x588c]
mov eax, dword [edx + eax + 4]
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5ac]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x39cc]
imul ecx, ecx, 0x98
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x39c0]
mov ecx, dword [eax + ecx + 0x80]
push ecx
mov edx, dword [ebp - 0x80]
imul edx, edx, 0x68
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5884]
mov edx, dword [ecx + edx + 0x60]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2b48]
imul ecx, ecx, 0x58
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x2b38]
mov ecx, dword [eax + ecx + 0x50]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004a9ad0
add esp, 0x14
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jne 0x51a779
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x5b4], 2
jne 0x51a779
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x2b48]
imul eax, eax, 0x58
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2b38]
cmp dword [edx + eax + 0x50], 0
jne 0x51a765
mov eax, dword [ebp + 8]
cmp dword [eax + 0xb88], 0
je 0x51a765
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb88]
movzx eax, word [edx]
and eax, 0x8000
je 0x51a765
push 2
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2b48]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004c3620
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x2b48], eax
mov dword [ebp - 0x64], 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x498], 4
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0
je 0x51a797
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x20], 0
jne 0x51a797
mov dword [ebp - 0x10bc], 1
jmp 0x51a7a1
mov dword [ebp - 0x10bc], 0
mov edx, dword [ebp + 8]
cmp dword [edx + 0x18], 0
jne 0x51a7c5
mov eax, dword [ebp + 8]
cmp dword [eax + 0xb74], 0
jle 0x51a7c5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb74]
mov dword [ebp - 0x10e8], edx
mov dword [ebp - 0x1118], 0
mov eax, dword [ebp + 0xc]
sub eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xb70], eax
cmp dword [ebp - 0x10bc], 0
je 0x51a809
push 0
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb6c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004f5eb0
add esp, 0x10
mov dword [ebp - 0x1114], eax
jmp 0x51a827
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb6c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004f8120
add esp, 0xc
mov dword [ebp - 0x1114], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x2b48]
mov dword [ebp - 0x11f8], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x11f8]
cmp edx, dword [ecx + 0x2b3c]
jl 0x51a859
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2b3c]
sub ecx, 1
mov dword [ebp - 0x11f8], ecx
cmp dword [ebp - 0x11f8], 0
jge 0x51a86c
mov dword [ebp - 0x11f8], 0
mov edx, dword [ebp - 0x11f8]
imul edx, edx, 0x58
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2b38]
mov edx, dword [ecx + edx + 0x2c]
and edx, 0x10
mov dword [ebp - 0x1144], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xa15c]
and ecx, 0x800
je 0x51a8af
mov edx, dword [ebp + 8]
cmp dword [edx + 0x1c], 0
jne 0x51a8af
mov dword [ebp - 0x1144], 1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1118]
cmp ecx, dword [eax + 0xb60]
jl 0x51a8ca
mov eax, 1
jmp 0x51f325
cmp dword [ebp - 0x1138], 0
jl 0x51a8df
mov edx, dword [ebp - 0x1138]
mov dword [ebp - 0x11f8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov dword [ebp - 0x1100], ecx
cmp dword [ebp - 0x1100], 0
jge 0x51a901
mov dword [ebp - 0x1100], 0
mov dword [ebp - 0x84], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
add eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004aa8b0
add esp, 8
test eax, eax
je 0x51a974
mov edx, dword [ebp - 0x10bc]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2b4c]
push ecx
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x113c]
push eax
lea ecx, [ebp - 0x84]
push ecx
lea edx, [ebp - 0x1088]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x11f8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004c4ef0
add esp, 0x28
mov ecx, dword [ebp - 0x11f8]
imul ecx, ecx, 0x58
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x2b38]
mov ecx, dword [eax + ecx + 4]
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], 0
jge 0x51a9ac
mov edx, dword [ebp + 8]
cmp dword [edx + 0x1c], 0
je 0x51a9a5
mov eax, dword [ebp + 8]
cmp dword [eax + 0x20], 0
je 0x51a9ac
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0x11f8]
imul ecx, ecx, 0x58
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x2b38]
mov ecx, dword [eax + ecx + 0xc]
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x11f8]
imul edx, edx, 0x58
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2b38]
mov edx, dword [ecx + edx + 0x14]
mov dword [ebp - 0x10b8], edx
cmp dword [ebp - 0x84], 0
jle 0x51aa4d
cmp dword [ebp - 0x10bc], 0
je 0x51aa17
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x510]
push ecx
push 0x5a0
mov edx, dword [ebp - 0x84]
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x12c0], eax
jmp 0x51aa39
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x500]
push ecx
push 0x5a0
mov edx, dword [ebp - 0x84]
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x12c0], eax
mov eax, dword [ebp - 0x10b8]
add eax, dword [ebp - 0x12c0]
mov dword [ebp - 0x10b8], eax
jmp 0x51aab2
mov ecx, dword [ebp - 0x11f8]
imul ecx, ecx, 0x58
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x2b38]
mov ecx, dword [eax + ecx + 0x18]
and ecx, 8
je 0x51aab2
cmp dword [ebp - 0x10b8], 0
jge 0x51aab2
mov edx, dword [ebp - 0x11f8]
imul edx, edx, 0x58
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2b38]
mov edx, dword [ecx + edx + 0x20]
mov dword [ebp - 0x11fc], edx
mov eax, dword [ebp - 0x11fc]
imul eax, eax, 0x3c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2b50]
mov eax, dword [edx + eax + 4]
and eax, 1
jne 0x51aab2
mov dword [ebp - 0x10b8], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
add edx, 1
jne 0x51aace
mov eax, dword [ebp - 0x68]
add eax, dword [ebp - 0x10b8]
mov dword [ebp - 0x68], eax
jmp 0x51aaf4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [ebp - 0x1100]
mov ecx, dword [edx + eax*4]
mov edx, dword [ecx + 0x38]
and edx, 3
je 0x51aaf4
mov eax, dword [ebp - 0x68]
add eax, dword [ebp - 0x10b8]
mov dword [ebp - 0x68], eax
push 0x5a0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x500]
push edx
mov eax, dword [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x10bc], 0
je 0x51ab56
push 0x5a0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x510]
push edx
mov eax, dword [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x500]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x510]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x11f8]
imul eax, eax, 0x58
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2b38]
mov eax, dword [edx + eax + 0x1c]
imul eax, eax, 0xb8
mov ecx, dword [ebp + 8]
add eax, dword [ecx + 0x387c]
mov dword [ebp - 0x10ec], eax
push 0xa8
push 0
lea edx, [ebp - 0x11f0]
push edx
call fcn.004e28a0
add esp, 0xc
mov dword [ebp - 0x11f0], 1
mov dword [ebp - 0x1184], 0xffffffff
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x11f8]
imul eax, eax, 0x58
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2b38]
mov eax, dword [edx + eax + 0x1c]
mov dword [ebp - 0x1050], eax
cmp dword [ebp - 0x1050], 0
je 0x51ac95
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x1c], 0
je 0x51ac95
mov edx, dword [ebp + 8]
cmp dword [edx + 0x20], 0
je 0x51ac01
mov eax, dword [ebp + 8]
cmp dword [eax + 0x58c0], 0
jle 0x51ac95
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x73c], 0
jne 0x51ac95
mov dword [ebp - 0x1200], 0
jmp 0x51ac2c
mov edx, dword [ebp - 0x1200]
add edx, 1
mov dword [ebp - 0x1200], edx
mov eax, dword [ebp - 0x10ec]
mov ecx, dword [ebp - 0x1200]
cmp ecx, dword [eax]
jge 0x51ac95
push 0x5a0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x510]
push eax
mov ecx, dword [ebp - 0x1200]
mov edx, dword [ebp - 0x10ec]
mov eax, dword [edx + ecx*4 + 4]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
mov edi, dword [ebp - 0x1114]
sub edi, dword [ebp - 0x30]
push 0x5a0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x510]
push edx
push 0x3c
call dword [sym.imp.KERNEL32.dll_MulDiv]
add edi, eax
cmp esi, edi
jl 0x51ac93
mov dword [ebp - 0x28], 1
jmp 0x51ac95
jmp 0x51ac1d
mov eax, dword [ebp - 0x1118]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x10d0], 0
mov dword [ebp - 0x94], 0
mov word [ebp - 0x1c], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x110c], 0
mov dword [ebp - 0x10a4], 0xffffffff
mov dword [ebp - 0x10dc], 0xffffffff
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x1108], ecx
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x10cc], 0
mov word [ebp - 0x20], 0
mov dx, word [ebp - 0x20]
mov word [ebp - 0x1098], dx
mov dword [ebp - 0x1104], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x1090], 0
mov dword [ebp - 0x10a0], 0
mov eax, dword [ebp - 0x10a0]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x108c], ecx
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x109c], 0
mov dword [ebp - 0x10d8], 0
mov dword [ebp - 0x1134], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
add eax, 1
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx + 0x5e4]
jge 0x51adc6
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4 + 4]
mov ecx, dword [eax + 0x40]
mov dword [ebp - 0x3c], ecx
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
add eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004badf0
add esp, 0xc
mov dword [ebp - 0x10fc], eax
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 0x10e0], edx
mov eax, dword [ebp - 0x10e0]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
add edx, 1
mov eax, dword [ebp + 8]
cmp edx, dword [eax + 0x5e4]
jge 0x51ae82
cmp dword [ebp - 0x64], 0
je 0x51ae4d
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4 + 4]
mov eax, dword [edx + 0x3c]
or eax, 0x20
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x138]
mov edx, dword [ecx + edx*4 + 4]
mov dword [edx + 0x3c], eax
jmp 0x51ae82
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4 + 4]
mov edx, dword [ecx + 0x3c]
and edx, 0xffffffdf
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x138]
mov ecx, dword [eax + ecx*4 + 4]
mov dword [ecx + 0x3c], edx
mov edx, dword [ebp + 8]
cmp dword [edx + 0x73c], 0
jne 0x51aec0
lea eax, [ebp - 0x10e4]
push eax
lea ecx, [ebp - 0x1128]
push ecx
lea edx, [ebp - 0x112c]
push edx
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
add ecx, 1
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004bf700
add esp, 0x18
jmp 0x51aee2
mov dword [ebp - 0x10e4], 0
mov eax, dword [ebp - 0x10e4]
mov dword [ebp - 0x1128], eax
mov ecx, dword [ebp - 0x1128]
mov dword [ebp - 0x112c], ecx
cmp dword [ebp - 0x10bc], 0
je 0x51af41
mov edx, dword [ebp - 0x112c]
mov dword [ebp - 0x1130], edx
mov eax, dword [ebp - 0x1128]
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x1130]
mov dword [ebp - 0x1180], ecx
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x117c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x510]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x500]
push eax
mov ecx, dword [ebp - 0x1130]
add ecx, dword [ebp - 0x74]
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x1174], eax
jmp 0x51afb3
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x510]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x500]
push edx
mov eax, dword [ebp - 0x112c]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x1130], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x510]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x500]
push ecx
mov edx, dword [ebp - 0x1128]
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x112c]
mov dword [ebp - 0x1180], eax
mov ecx, dword [ebp - 0x1128]
mov dword [ebp - 0x117c], ecx
mov edx, dword [ebp - 0x1130]
add edx, dword [ebp - 0x74]
mov dword [ebp - 0x1174], edx
cmp dword [ebp - 0x1050], 0
je 0x51b0e5
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1c], 0
je 0x51b0e5
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x58c0], 0
jle 0x51b0e5
mov edx, dword [ebp - 0x10ec]
cmp dword [edx], 1
jne 0x51b0e5
mov eax, dword [ebp - 0x10ec]
cmp dword [eax + 0x54], 3
jne 0x51b0e5
mov dword [ebp - 0x109c], 1
xor ecx, ecx
cmp dword [ebp - 0x10bc], 0
sete cl
push ecx
push 0
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0x10f0]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x10ec]
push edx
mov eax, dword [ebp - 0x11f8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004f7330
add esp, 0x20
mov edx, dword [ebp - 0x10f0]
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x11ec]
mov ecx, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x11e8], ecx
mov edx, dword [ebp - 0x11ec]
add edx, 1
mov dword [ebp - 0x11ec], edx
mov eax, dword [ebp - 0x10f0]
mov dword [ebp - 0x1120], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x10d4], 0
mov dword [ebp - 0x110c], 0
mov edx, dword [ebp - 0x10f0]
cmp edx, dword [ebp - 0x1114]
jle 0x51b0ab
mov dword [ebp - 0x58], 1
cmp dword [ebp - 0x28], 0
je 0x51b0e5
mov esi, dword [ebp - 0x1114]
sub esi, dword [ebp - 0x30]
push 0x5a0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x510]
push ecx
push 0x3c
call dword [sym.imp.KERNEL32.dll_MulDiv]
add esi, eax
cmp dword [ebp - 0x10f0], esi
jl 0x51b0e5
mov dword [ebp - 0x1144], 1
mov dword [ebp - 0x60], 1
mov edx, 1
test edx, edx
je 0x51caab
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1134], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xbd8]
mov eax, dword [ebp - 0x1118]
movzx ecx, word [edx + eax*2]
movzx edx, word [ebp - 0x14]
cmp ecx, edx
jne 0x51b127
cmp dword [ebp - 0x60], 0
je 0x51b1ee
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xbd8]
mov edx, dword [ebp - 0x1118]
mov ax, word [ecx + edx*2]
mov word [ebp - 0x14], ax
movzx ecx, word [ebp - 0x14]
imul ecx, ecx, 0x170
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3434]
mov edx, dword [ebp - 0x11f8]
imul edx, edx, 0x58
mov esi, dword [ebp + 8]
mov esi, dword [esi + 0x2b38]
mov eax, dword [eax + ecx + 0x40]
cmp eax, dword [esi + edx + 0x24]
jne 0x51b17a
mov cx, word [ebp - 0x14]
mov word [ebp - 0x1094], cx
jmp 0x51b1a9
mov edx, dword [ebp - 0x11f8]
imul edx, edx, 0x58
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2b38]
mov edx, dword [ecx + edx + 0x24]
push edx
movzx eax, word [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004c9570
add esp, 0xc
mov word [ebp - 0x1094], ax
movzx edx, word [ebp - 0x1094]
imul edx, edx, 0x170
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3434]
mov edx, dword [ecx + edx + 0x58]
cmp edx, dword [ebp - 0x6c]
je 0x51b1e7
mov eax, dword [ebp - 0x6c]
push eax
movzx ecx, word [ebp - 0x1094]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004ac040
add esp, 0xc
mov word [ebp - 0x1094], ax
mov dword [ebp - 0x60], 0
movzx eax, word [ebp - 0x1094]
imul eax, eax, 0x170
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3434]
mov eax, dword [edx + eax + 0x134]
mov dword [ebp - 0x104c], eax
mov ecx, dword [ebp - 0x104c]
and ecx, 0x20000
je 0x51b329
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb58]
mov ecx, dword [ebp - 0x1118]
movzx edx, byte [eax + ecx]
cmp edx, 0x61
jl 0x51b295
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb58]
mov edx, dword [ebp - 0x1118]
movzx eax, byte [ecx + edx]
cmp eax, 0x7a
jg 0x51b295
movzx ecx, word [ebp - 0x1094]
imul ecx, ecx, 0x170
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3434]
mov ecx, dword [eax + ecx + 0x150]
and ecx, 0x200
jne 0x51b295
push 1
movzx edx, word [ebp - 0x1094]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004ab850
add esp, 0xc
mov word [ebp - 0x1094], ax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb58]
mov eax, dword [ebp - 0x1118]
movzx ecx, byte [edx + eax]
cmp ecx, 0x61
jl 0x51b2c5
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb58]
mov ecx, dword [ebp - 0x1118]
movzx edx, byte [eax + ecx]
cmp edx, 0x7a
jle 0x51b306
movzx eax, word [ebp - 0x1094]
imul eax, eax, 0x170
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3434]
mov eax, dword [edx + eax + 0x150]
and eax, 0x200
je 0x51b306
push 0
movzx ecx, word [ebp - 0x1094]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004ab850
add esp, 0xc
mov word [ebp - 0x1094], ax
movzx eax, word [ebp - 0x1094]
imul eax, eax, 0x170
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3434]
mov eax, dword [edx + eax + 0x134]
mov dword [ebp - 0x104c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xbd8]
mov eax, dword [ebp - 0x1118]
mov cx, word [ebp - 0x1094]
mov word [edx + eax*2], cx
movzx edx, word [ebp - 0x1094]
imul edx, edx, 0x170
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3434]
cmp dword [ecx + edx + 0x118], 0
je 0x51b375
mov edx, dword [ebp - 0x90]
or edx, 0x80
mov dword [ebp - 0x90], edx
movzx eax, word [ebp - 0x1094]
imul eax, eax, 0x170
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3434]
cmp dword [edx + eax + 0x120], 0
je 0x51b3a4
mov eax, dword [ebp - 0x90]
or eax, 0x40
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0xbb4], 0
je 0x51b3eb
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb88]
mov ecx, dword [ebp - 0x1118]
movzx edx, word [eax + ecx*2]
and edx, 0x4000
je 0x51b3eb
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb88]
mov edx, dword [ebp - 0x1118]
movzx eax, word [ecx + edx*2]
and eax, 0x3fff
mov dword [ebp - 0x12c4], eax
jmp 0x51b3f5
mov dword [ebp - 0x12c4], 0xffffffff
mov ecx, dword [ebp - 0x12c4]
mov dword [ebp - 0x10b4], ecx
cmp dword [ebp - 0x10b4], 0xffffffff
je 0x51b4b2
mov dword [ebp - 0x10d8], 1
movzx edx, word [ebp - 0x1094]
imul edx, edx, 0x170
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3434]
mov edx, dword [ecx + edx + 0x150]
and edx, 0x80
jne 0x51b4b2
mov eax, dword [ebp + 8]
cmp dword [eax + 0x5818], 0
jne 0x51b478
movzx ecx, word [ebp - 0x1094]
imul ecx, ecx, 0x170
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3434]
mov ecx, dword [eax + ecx + 0x134]
and ecx, 0x800
je 0x51b478
mov dword [ebp - 0x10b4], 0
mov edx, dword [ebp + 8]
cmp dword [edx + 0x581c], 0
jne 0x51b4b2
movzx eax, word [ebp - 0x1094]
imul eax, eax, 0x170
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3434]
mov eax, dword [edx + eax + 0x134]
and eax, 0x8000
je 0x51b4b2
mov dword [ebp - 0x10b4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10a0], ecx
mov dword [ebp - 0x10], 0
mov dx, word [ebp - 0x1098]
mov word [ebp - 0x20], dx
mov eax, dword [ebp + 8]
cmp dword [eax + 0xbb0], 0
je 0x51b50c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb9c]
mov eax, dword [ebp - 0x1118]
movzx ecx, byte [edx + eax]
shl ecx, 8
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb58]
mov edx, dword [ebp - 0x1118]
movzx eax, byte [eax + edx]
or ecx, eax
mov dword [ebp - 0x12c8], ecx
jmp 0x51b525
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb58]
mov eax, dword [ebp - 0x1118]
movzx ecx, byte [edx + eax]
mov dword [ebp - 0x12c8], ecx
mov dx, word [ebp - 0x12c8]
mov word [ebp - 0x10c0], dx
mov ax, word [ebp - 0x10c0]
mov word [ebp - 0x1098], ax
mov ecx, dword [ebp - 0x104c]
and ecx, 0x30000
je 0x51b578
movzx edx, word [ebp - 0x10c0]
cmp edx, 0x61
jl 0x51b578
movzx eax, word [ebp - 0x10c0]
cmp eax, 0x7a
jg 0x51b578
movzx ecx, word [ebp - 0x10c0]
sub ecx, 0x20
mov word [ebp - 0x10c0], cx
movzx edx, word [ebp - 0x1098]
cmp edx, 5
jne 0x51b80e
cmp dword [ebp - 0x10f4], 0
je 0x51b5cb
mov eax, dword [ebp + 8]
cmp dword [eax + 0x5810], 0
je 0x51b5cb
movzx ecx, word [ebp - 0x1094]
imul ecx, ecx, 0x170
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3434]
mov ecx, dword [eax + ecx + 0x134]
and ecx, 0x40
je 0x51b5cb
mov dword [ebp - 0x12cc], 1
jmp 0x51b5d5
mov dword [ebp - 0x12cc], 0
mov edx, dword [ebp - 0x12cc]
mov dword [ebp - 0x120c], edx
movzx eax, word [ebp - 0x1094]
imul eax, eax, 0x170
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3434]
cmp dword [edx + eax + 0x144], 7
jne 0x51b63a
movzx eax, word [ebp - 0x1094]
imul eax, eax, 0x170
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3434]
mov ecx, dword [ebp + 8]
movzx ecx, byte [ecx + 0xb50]
mov edx, dword [edx + eax + 0x140]
cmp dword [edx + ecx*4], 0
je 0x51b63a
mov dword [ebp - 0x12d0], 1
jmp 0x51b644
mov dword [ebp - 0x12d0], 0
mov eax, dword [ebp - 0x12d0]
mov dword [ebp - 0x1210], eax
movzx ecx, word [ebp - 0x1094]
imul ecx, ecx, 0x170
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3434]
mov ecx, dword [eax + ecx + 0x134]
and ecx, 0x800
je 0x51b6ae
movzx edx, word [ebp - 0x1094]
imul edx, edx, 0x170
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3434]
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 0xb50]
mov ecx, dword [ecx + edx + 0x140]
cmp dword [ecx + eax*4], 0
je 0x51b6ae
mov dword [ebp - 0x12d4], 1
jmp 0x51b6b8
mov dword [ebp - 0x12d4], 0
mov edx, dword [ebp - 0x12d4]
mov dword [ebp - 0x1208], edx
mov dword [ebp - 0x1214], 0xffffffff
mov eax, dword [ebp + 8]
cmp dword [eax + 0xbac], 0
je 0x51b80e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb84]
mov eax, dword [ebp - 0x1118]
movzx ecx, word [edx + eax*2]
test ecx, ecx
jle 0x51b80e
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb84]
mov ecx, dword [ebp - 0x1118]
movzx edx, word [eax + ecx*2]
mov dword [ebp - 0x1218], edx
cmp dword [ebp - 0x120c], 0
je 0x51b74d
lea eax, [ebp - 0x1204]
push eax
push 0
push 0
push 5
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x1218]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004ae210
add esp, 0x1c
test eax, eax
jle 0x51b74d
mov eax, dword [ebp - 0x1204]
mov dword [ebp - 0x1214], eax
cmp dword [ebp - 0x1210], 0
je 0x51b788
lea ecx, [ebp - 0x1204]
push ecx
push 0
push 0
push 6
push 0xffffffffffffffff
mov edx, dword [ebp - 0x1218]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004ae210
add esp, 0x1c
test eax, eax
jle 0x51b788
mov ecx, dword [ebp - 0x1204]
mov dword [ebp - 0x1214], ecx
cmp dword [ebp - 0x1208], 0
je 0x51b7c3
lea edx, [ebp - 0x1204]
push edx
push 0
push 0
push 6
push 0xffffffffffffffff
mov eax, dword [ebp - 0x1218]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ae210
add esp, 0x1c
test eax, eax
jle 0x51b7c3
mov edx, dword [ebp - 0x1204]
mov dword [ebp - 0x1214], edx
cmp dword [ebp - 0x1214], 0
jl 0x51b80e
mov eax, dword [ebp + 8]
movzx cx, byte [eax + 0xb50]
mov word [ebp - 0x1098], cx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb58]
mov ecx, dword [ebp - 0x1118]
mov dl, byte [ebp - 0x1098]
mov byte [eax + ecx], dl
mov eax, dword [ebp - 0x11f8]
mov dword [ebp - 0x1138], eax
mov ecx, dword [ebp - 0x1214]
mov dword [ebp - 0x11f8], ecx
movzx edx, word [ebp - 0x20]
cmp edx, 0x20
je 0x51b836
cmp dword [ebp - 0x10a0], 0
jne 0x51b836
movzx eax, word [ebp - 0x1098]
cmp eax, 0x20
jne 0x51b836
mov dword [ebp - 0x1090], 0
mov ecx, dword [ebp - 0x1118]
add ecx, 1
mov edx, dword [ebp + 8]
cmp ecx, dword [edx + 0xb60]
jge 0x51b8ba
mov eax, dword [ebp + 8]
cmp dword [eax + 0xbb0], 0
je 0x51b88b
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb9c]
mov eax, dword [ebp - 0x1118]
movzx ecx, byte [edx + eax + 1]
shl ecx, 8
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb58]
mov edx, dword [ebp - 0x1118]
movzx eax, byte [eax + edx + 1]
or ecx, eax
mov dword [ebp - 0x12d8], ecx
jmp 0x51b8a5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb58]
mov eax, dword [ebp - 0x1118]
movzx ecx, byte [edx + eax + 1]
mov dword [ebp - 0x12d8], ecx
cmp dword [ebp - 0x12d8], 0x14
jne 0x51b8ba
mov dword [ebp - 0x8c], 1
jmp 0x51b8c4
mov dword [ebp - 0x8c], 0
movzx edx, word [ebp - 0x1094]
imul edx, edx, 0x170
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3434]
mov edx, dword [ecx + edx + 0x144]
mov dword [ebp - 0x10f8], edx
cmp dword [ebp - 0x10a4], 0
jge 0x51b91c
cmp dword [ebp - 0x10f8], 0
jle 0x51b91c
mov eax, dword [ebp - 0x10f8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004aa340
add esp, 8
test eax, eax
je 0x51b91c
mov edx, dword [ebp - 0x1118]
mov dword [ebp - 0x10a4], edx
cmp dword [ebp - 0x10f8], 9
jne 0x51b931
mov dword [ebp - 0x108c], 1
jmp 0x51b96d
cmp dword [ebp - 0x10f8], 0xb
jne 0x51b943
mov dword [ebp - 0xc], 1
jmp 0x51b96d
cmp dword [ebp - 0x10f8], 0xc
jne 0x51b955
mov dword [ebp - 0x54], 1
jmp 0x51b96d
cmp dword [ebp - 0x10f8], 0xd
jne 0x51b96d
mov eax, dword [ebp - 0x90]
or eax, 4
mov dword [ebp - 0x90], eax
movzx ecx, word [ebp - 0x1094]
imul ecx, ecx, 0x170
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3434]
mov ecx, dword [eax + ecx + 0x134]
and ecx, 0x80
je 0x51b9fb
movzx edx, word [ebp - 0x1094]
imul edx, edx, 0x170
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3434]
cmp dword [ecx + edx + 0x88], 2
je 0x51b9ef
movzx edx, word [ebp - 0x1094]
imul edx, edx, 0x170
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3434]
cmp dword [ecx + edx + 0x88], 6
je 0x51b9ef
movzx edx, word [ebp - 0x1094]
imul edx, edx, 0x170
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3434]
cmp dword [ecx + edx + 0x64], 5
jne 0x51b9fb
mov edx, dword [ebp - 0x1118]
mov dword [ebp - 0x10dc], edx
movzx eax, word [ebp - 0x1094]
imul eax, eax, 0x170
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3434]
mov eax, dword [edx + eax + 0x134]
and eax, 0x80
je 0x51ba4b
movzx ecx, word [ebp - 0x1094]
imul ecx, ecx, 0x170
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3434]
cmp dword [eax + ecx + 0xc4], 0
jle 0x51ba4b
mov dword [ebp - 0x12dc], 1
jmp 0x51ba55
mov dword [ebp - 0x12dc], 0
mov ecx, dword [ebp - 0x12dc]
mov dword [ebp - 0x88], ecx
cmp dword [ebp - 0x88], 0
je 0x51ba76
mov edx, dword [ebp - 0x70]
or edx, 0x4000
mov dword [ebp - 0x70], edx
movzx eax, word [ebp - 0x1094]
imul eax, eax, 0x170
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3434]
mov eax, dword [edx + eax + 0x134]
and eax, 0x1c00
je 0x51baa3
mov ecx, dword [ebp - 0x70]
or ecx, 0x10
mov dword [ebp - 0x70], ecx
movzx edx, word [ebp - 0x1094]
imul edx, edx, 0x170
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3434]
mov edx, dword [ecx + edx + 0x134]
and edx, 0x8000
je 0x51bad9
mov eax, dword [ebp - 0x90]
or eax, 2
mov dword [ebp - 0x90], eax
jmp 0x51bb0a
movzx ecx, word [ebp - 0x1094]
imul ecx, ecx, 0x170
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3434]
mov ecx, dword [eax + ecx + 0x134]
and ecx, 0x800
je 0x51bb0a
mov edx, dword [ebp - 0x70]
or edx, 0x10000
mov dword [ebp - 0x70], edx
movzx eax, word [ebp - 0x1098]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0xb50]
cmp eax, edx
jne 0x51bb50
mov eax, dword [ebp - 0x1118]
add eax, 1
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx + 0xb60]
jge 0x51bb50
cmp dword [ebp - 0x8c], 0
jne 0x51bb50
mov edx, dword [ebp - 0x1118]
add edx, 1
mov dword [ebp - 0x1118], edx
jmp 0x51caab
movzx eax, word [ebp - 0x1098]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0x58b4]
cmp eax, edx
je 0x51bb71
movzx eax, word [ebp - 0x1098]
cmp eax, 0xf
jne 0x51bbb4
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x1104], ecx
cmp dword [ebp - 0x1104], 0
je 0x51bb95
mov edx, dword [ebp - 0x1118]
add edx, 1
mov dword [ebp - 0x1118], edx
mov eax, dword [ebp - 0x1118]
add eax, 1
mov dword [ebp - 0x1118], eax
mov cx, word [ebp - 0x1098]
mov word [ebp - 0x1c], cx
jmp 0x51caab
movzx edx, word [ebp - 0x1098]
cmp edx, 0x14
jne 0x51bbdf
mov eax, dword [ebp - 0x1118]
add eax, 1
mov dword [ebp - 0x1118], eax
mov cx, word [ebp - 0x1098]
mov word [ebp - 0x1c], cx
jmp 0x51caab
movzx edx, word [ebp - 0x1098]
cmp edx, 0x1c
jg 0x51bc70
movzx eax, word [ebp - 0x1098]
cmp eax, 0x12
je 0x51bc43
movzx ecx, word [ebp - 0x1098]
cmp ecx, 0x11
je 0x51bc43
movzx edx, word [ebp - 0x1098]
cmp edx, 0x19
je 0x51bc43
movzx eax, word [ebp - 0x1098]
cmp eax, 0x10
je 0x51bc43
movzx ecx, word [ebp - 0x1098]
cmp ecx, 0x1a
je 0x51bc43
movzx edx, word [ebp - 0x1098]
cmp edx, 0xc
je 0x51bc43
movzx eax, word [ebp - 0x1098]
cmp eax, 0x16
jne 0x51bc70
mov ecx, dword [ebp - 0x9c]
cmp ecx, dword [ebp - 0x1118]
jne 0x51bc6b
mov edx, dword [ebp - 0x1118]
add edx, 1
mov dword [ebp - 0x1118], edx
mov ax, word [ebp - 0x1098]
mov word [ebp - 0x1c], ax
jmp 0x51caab
movzx ecx, word [ebp - 0x1098]
cmp ecx, 9
jne 0x51be19
movzx edx, word [ebp - 0x1094]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004ef310
add esp, 8
test eax, eax
jne 0x51be19
cmp dword [ebp - 0x11ec], 0
jle 0x51bd1d
cmp dword [ebp - 0x40], 0
je 0x51bd1d
mov ecx, dword [ebp - 0x1120]
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x10ac], ecx
cmp dword [ebp - 0x40], 2
jne 0x51bcd6
mov eax, dword [ebp - 0x44]
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x10ac]
mov dword [ebp - 0x10ac], eax
jmp 0x51bceb
cmp dword [ebp - 0x40], 3
jne 0x51bceb
mov edx, dword [ebp - 0x10ac]
add edx, dword [ebp - 0x44]
mov dword [ebp - 0x10ac], edx
cmp dword [ebp - 0x10ac], 0
jge 0x51bcfe
mov dword [ebp - 0x10ac], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x10ac]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x11ec]
mov edx, dword [ebp - 0x10ac]
mov dword [ebp + ecx*4 - 0x11ec], edx
xor eax, eax
cmp dword [ebp - 0x10bc], 0
sete al
push eax
push 0
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x10f0]
push edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x10ec]
push ecx
mov edx, dword [ebp - 0x11f8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004f7330
add esp, 0x20
mov ecx, dword [ebp - 0x10f0]
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x11ec]
mov eax, dword [ebp - 0x24]
mov dword [ebp + edx*4 - 0x11e8], eax
cmp dword [ebp - 0x11ec], 0x14
jge 0x51bd89
mov ecx, dword [ebp - 0x11ec]
add ecx, 1
mov dword [ebp - 0x11ec], ecx
cmp dword [ebp - 0x48], 0
jne 0x51bd98
mov edx, dword [ebp - 0x10f0]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x10f0]
mov dword [ebp - 0x1120], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x10d4], 0
mov dword [ebp - 0x110c], 0
mov edx, dword [ebp - 0x10f0]
cmp edx, dword [ebp - 0x1114]
jle 0x51bdda
mov dword [ebp - 0x58], 1
cmp dword [ebp - 0x28], 0
je 0x51be14
mov esi, dword [ebp - 0x1114]
sub esi, dword [ebp - 0x30]
push 0x5a0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x510]
push ecx
push 0x3c
call dword [sym.imp.KERNEL32.dll_MulDiv]
add esi, eax
cmp dword [ebp - 0x10f0], esi
jl 0x51be14
mov dword [ebp - 0x1144], 1
jmp 0x51c296
movzx edx, word [ebp - 0x1098]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb50]
cmp edx, ecx
je 0x51bee4
cmp dword [ebp - 0x88], 0
jne 0x51bee4
mov edx, dword [ebp - 0x10b4]
mov dword [ebp - 0x121c], edx
cmp dword [ebp - 0x121c], 0xffffffff
jne 0x51be94
movzx eax, word [ebp - 0x10c0]
sar eax, 8
push eax
movzx ecx, word [ebp - 0x10c0]
and ecx, 0xff
push ecx
xor edx, edx
cmp dword [ebp - 0x10bc], 0
sete dl
push edx
movzx eax, word [ebp - 0x1094]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ab070
add esp, 0x14
mov dword [ebp - 0x121c], eax
movzx edx, word [ebp - 0x10c0]
cmp edx, 6
jne 0x51beaa
mov dword [ebp - 0x121c], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x121c]
mov dword [ebp - 0x2c], eax
movzx ecx, word [ebp - 0x1098]
cmp ecx, 0x20
jne 0x51bed4
mov edx, dword [ebp - 0x1090]
add edx, dword [ebp - 0x121c]
mov dword [ebp - 0x1090], edx
cmp dword [ebp - 0x121c], 0
jne 0x51bee4
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x10cc], 0
jne 0x51bf11
movzx eax, word [ebp - 0x1094]
imul eax, eax, 0x170
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3434]
mov eax, dword [edx + eax + 0x134]
and eax, 0x2000
jne 0x51bf3f
cmp dword [ebp - 0x10cc], 0
je 0x51bf8a
movzx ecx, word [ebp - 0x1094]
imul ecx, ecx, 0x170
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3434]
mov ecx, dword [eax + ecx + 0x134]
and ecx, 0x2000
jne 0x51bf8a
xor edx, edx
cmp dword [ebp - 0x10cc], 0
sete dl
mov dword [ebp - 0x10cc], edx
cmp dword [ebp - 0x10cc], 0
je 0x51bf61
mov dword [ebp - 0x5c], 1
cmp dword [ebp - 0x10bc], 0
je 0x51bf7b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x2c]
add ecx, dword [eax + 0xa130]
mov dword [ebp - 0x2c], ecx
jmp 0x51bf8a
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
add eax, dword [edx + 0xa134]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x10e0]
add ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x1130]
add edx, dword [ebp - 0x74]
cmp ecx, edx
jge 0x51c1a5
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x1130]
jl 0x51c1a5
cmp dword [ebp - 0x74], 0
jle 0x51c1a5
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x73c], 0
jne 0x51c1a5
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x10e0]
mov dword [ebp - 0x1224], edx
mov dword [ebp - 0x1220], 0
mov eax, dword [ebp - 0x1108]
sub eax, dword [ebp - 0x9c]
mov dword [ebp - 0x1184], eax
cmp dword [ebp - 0x1180], 0
jne 0x51c033
mov ecx, dword [ebp - 0x1180]
add ecx, dword [ebp - 0x117c]
add ecx, dword [ebp - 0x1220]
mov dword [ebp - 0x1220], ecx
mov edx, dword [ebp - 0x10e0]
add edx, dword [ebp - 0x1220]
mov dword [ebp - 0x10e0], edx
jmp 0x51c16e
mov eax, dword [ebp - 0x10e0]
add eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x1130]
jle 0x51c059
mov ecx, dword [ebp - 0x10e0]
add ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x1130]
mov dword [ebp - 0x1220], ecx
cmp dword [ebp - 0x10bc], 0
je 0x51c0d3
mov edx, dword [ebp - 0x1130]
add edx, dword [ebp - 0x1220]
mov dword [ebp - 0x1180], edx
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x1220]
mov dword [ebp - 0x117c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x510]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x500]
push ecx
mov edx, dword [ebp - 0x1130]
add edx, dword [ebp - 0x74]
sub edx, dword [ebp - 0x10e0]
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x1174], eax
mov eax, dword [ebp - 0x1130]
add eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x10e0]
sub eax, dword [ebp - 0x1220]
mov dword [ebp - 0x1178], eax
jmp 0x51c15f
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x500]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x510]
push ecx
mov edx, dword [ebp - 0x1220]
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
add eax, dword [ebp - 0x112c]
mov dword [ebp - 0x1180], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x500]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x510]
push eax
mov ecx, dword [ebp - 0x1220]
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [ebp - 0x1128]
sub edx, eax
mov dword [ebp - 0x117c], edx
mov eax, dword [ebp - 0x1130]
add eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x10e0]
mov dword [ebp - 0x1174], eax
mov ecx, dword [ebp - 0x1130]
add ecx, dword [ebp - 0x74]
sub ecx, dword [ebp - 0x10e0]
sub ecx, dword [ebp - 0x1220]
mov dword [ebp - 0x1178], ecx
mov edx, dword [ebp - 0x1130]
add edx, dword [ebp - 0x74]
mov dword [ebp - 0x10e0], edx
mov eax, dword [ebp - 0x10e0]
add eax, dword [ebp - 0x1224]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x1114]
sub ecx, dword [ebp - 0x30]
cmp dword [ebp - 0x2c], ecx
jle 0x51c1a5
mov edx, dword [ebp - 0x1108]
mov dword [ebp - 0x1118], edx
mov eax, dword [ebp - 0x10e0]
mov dword [ebp - 0x2c], eax
jmp 0x51b0ec
movzx ecx, word [ebp - 0x1098]
movzx edx, byte [ebp - 0x15]
cmp ecx, edx
jne 0x51c1c4
cmp dword [ebp - 0x10], 0
jne 0x51c1c4
mov dword [ebp - 0x110c], 1
cmp dword [ebp - 0x40], 2
je 0x51c1e1
cmp dword [ebp - 0x40], 3
jne 0x51c296
cmp dword [ebp - 0x110c], 0
je 0x51c296
movzx eax, word [ebp - 0x1098]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0xb50]
cmp eax, edx
je 0x51c296
mov eax, dword [ebp - 0x10b4]
mov dword [ebp - 0x1228], eax
cmp dword [ebp - 0x1228], 0xffffffff
jne 0x51c24f
movzx ecx, word [ebp - 0x10c0]
sar ecx, 8
push ecx
movzx edx, word [ebp - 0x10c0]
and edx, 0xff
push edx
xor eax, eax
cmp dword [ebp - 0x10bc], 0
sete al
push eax
movzx ecx, word [ebp - 0x1094]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004ab070
add esp, 0x14
mov dword [ebp - 0x1228], eax
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x1228]
mov dword [ebp - 0x44], eax
movzx ecx, word [ebp - 0x1098]
sar ecx, 8
push ecx
movzx edx, word [ebp - 0x1098]
and edx, 0xff
push edx
push 1
movzx eax, word [ebp - 0x1094]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ab070
add esp, 0x14
add eax, dword [ebp - 0x10d4]
mov dword [ebp - 0x10d4], eax
movzx edx, word [ebp - 0x1098]
cmp edx, 0xe
jne 0x51c2ab
mov eax, dword [ebp - 0x70]
or eax, 0x40
mov dword [ebp - 0x70], eax
movzx ecx, word [ebp - 0x1098]
cmp ecx, 0x17
jne 0x51c2c3
mov edx, dword [ebp - 0x70]
or edx, 0x2000
mov dword [ebp - 0x70], edx
movzx eax, word [ebp - 0x1098]
cmp eax, 6
jne 0x51c2db
mov ecx, dword [ebp - 0x70]
or ecx, 0x200000
mov dword [ebp - 0x70], ecx
movzx edx, word [ebp - 0x1098]
cmp edx, 5
jne 0x51c2f2
mov eax, dword [ebp - 0x70]
or eax, 0x4000000
mov dword [ebp - 0x70], eax
movzx ecx, word [ebp - 0x1098]
cmp ecx, 0x1c
jne 0x51c30d
mov edx, dword [ebp - 0x90]
or edx, 8
mov dword [ebp - 0x90], edx
mov eax, dword [ebp - 0x1140]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x64], 0
je 0x51c343
movzx ecx, word [ebp - 0x1094]
imul ecx, ecx, 0x170
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3434]
cmp dword [eax + ecx + 0x168], 0
jne 0x51c343
mov dword [ebp - 0x4c], 1
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x73c], 0
jle 0x51c3a2
cmp dword [ebp - 0x10bc], 0
je 0x51c3a2
mov edx, dword [ebp - 0x1118]
add edx, 2
mov eax, dword [ebp + 8]
cmp edx, dword [eax + 0xb60]
jne 0x51c3a2
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb58]
mov eax, dword [ebp - 0x1118]
movzx ecx, byte [edx + eax + 1]
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0xb50]
cmp ecx, eax
jne 0x51c3a2
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x510]
cdq
mov ecx, 0x1e
idiv ecx
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x1118]
cmp edx, dword [ebp - 0x98]
jl 0x51c3df
mov eax, dword [ebp - 0x1118]
sub eax, dword [ebp - 0x98]
cmp eax, 0x3e8
jge 0x51c3df
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x1134]
mov edx, dword [ebp - 0x1118]
sub edx, dword [ebp - 0x98]
mov dword [ebp + edx*4 - 0x1048], ecx
cmp dword [ebp - 0x1144], 0
jne 0x51c489
cmp dword [ebp - 0x10], 0
jne 0x51c489
mov eax, dword [ebp - 0x1114]
sub eax, dword [ebp - 0x30]
add eax, dword [ebp - 4]
cmp dword [ebp - 0x2c], eax
jg 0x51c410
cmp dword [ebp - 0x10e8], 0
je 0x51c489
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 0
je 0x51c42b
movzx edx, word [ebp - 0x1098]
cmp edx, 0x20
jne 0x51c42b
cmp dword [ebp - 0x4c], 0
je 0x51c489
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0
je 0x51c464
movzx ecx, word [ebp - 0x1098]
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0xb50]
cmp ecx, eax
jne 0x51c464
movzx ecx, word [ebp - 0x20]
cmp ecx, 0x20
je 0x51c489
movzx edx, word [ebp - 0x20]
cmp edx, 9
je 0x51c489
cmp dword [ebp - 0x10a0], 0
jne 0x51c489
cmp dword [ebp - 0x10e8], 0
je 0x51c88e
mov eax, dword [ebp - 0x1118]
sub eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x10e8]
jge 0x51c88e
mov ecx, dword [ebp - 0x1118]
sub ecx, dword [ebp - 0x9c]
cmp ecx, 0x3e6
jge 0x51c88e
mov edx, dword [ebp - 0x1118]
add edx, 1
mov dword [ebp - 0x1118], edx
movzx eax, word [ebp - 0x1098]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0xb50]
cmp eax, edx
jne 0x51c4ee
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x1104], eax
cmp dword [ebp - 0x1104], 0
je 0x51c4e9
mov ecx, dword [ebp - 0x1118]
add ecx, 1
mov dword [ebp - 0x1118], ecx
jmp 0x51caab
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1118]
cmp eax, dword [edx + 0xb60]
jl 0x51c504
jmp 0x51caab
movzx ecx, word [ebp - 0x1098]
cmp ecx, 0x2d
jne 0x51c53c
movzx edx, word [ebp - 0x1094]
imul edx, edx, 0x170
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3434]
movzx edx, byte [ecx + edx + 0x29]
cmp edx, 2
je 0x51c53c
mov dword [ebp - 0x12e0], 1
jmp 0x51c546
mov dword [ebp - 0x12e0], 0
mov eax, dword [ebp - 0x12e0]
mov dword [ebp - 0x1124], eax
mov dword [ebp - 0x50], 0
movzx ecx, word [ebp - 0x1094]
imul ecx, ecx, 0x170
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3434]
movzx ecx, word [eax + ecx + 0x160]
test ecx, ecx
jle 0x51c685
movzx edx, word [ebp - 0x1094]
imul edx, edx, 0x170
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3434]
movzx edx, word [ecx + edx + 0x160]
movzx eax, word [ebp - 0x1098]
add edx, eax
mov word [ebp - 0x122c], dx
movzx ecx, word [ebp - 0x122c]
cmp ecx, 0x2e00
jl 0x51c5cb
movzx edx, word [ebp - 0x122c]
cmp edx, 0x9faf
jle 0x51c62f
movzx eax, word [ebp - 0x122c]
cmp eax, 0xf900
jl 0x51c5e8
movzx ecx, word [ebp - 0x122c]
cmp ecx, 0xfaff
jl 0x51c62f
movzx edx, word [ebp - 0x122c]
cmp edx, 0xfe30
jl 0x51c605
movzx eax, word [ebp - 0x122c]
cmp eax, 0xfe4f
jl 0x51c62f
movzx ecx, word [ebp - 0x122c]
cmp ecx, 0xff00
jl 0x51c623
movzx edx, word [ebp - 0x122c]
cmp edx, 0xffef
jl 0x51c62f
mov dword [ebp - 0x12e4], 0
jmp 0x51c639
mov dword [ebp - 0x12e4], 1
mov eax, dword [ebp - 0x12e4]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x51c685
movzx ecx, word [ebp - 0x122c]
cmp ecx, 0x4e00
jl 0x51c672
movzx edx, word [ebp - 0x122c]
cmp edx, 0xa7ff
jg 0x51c672
mov dword [ebp - 0x12e8], 1
jmp 0x51c67c
mov dword [ebp - 0x12e8], 0
mov eax, dword [ebp - 0x12e8]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x51c6c4
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0xbb0], 0
je 0x51c6c4
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb9c]
mov ecx, dword [ebp - 0x1118]
movzx edx, byte [eax + ecx]
test edx, edx
jle 0x51c6c4
mov eax, dword [ebp + 8]
cmp dword [eax + 0xa9d4], 0x411
jne 0x51c6c4
mov dword [ebp - 0x50], 1
movzx ecx, word [ebp - 0x1098]
cmp ecx, 0x20
je 0x51c707
movzx edx, word [ebp - 0x1098]
cmp edx, 9
je 0x51c707
cmp dword [ebp - 0x1124], 0
jne 0x51c707
movzx eax, word [ebp - 0x1098]
cmp eax, 6
je 0x51c707
movzx ecx, word [ebp - 0x1098]
cmp ecx, 0x1c
je 0x51c707
cmp dword [ebp - 0x50], 0
je 0x51c889
mov edx, dword [ebp + 8]
cmp dword [edx + 0x5810], 0
jne 0x51c735
movzx eax, word [ebp - 0x1094]
imul eax, eax, 0x170
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3434]
mov eax, dword [edx + eax + 0x134]
and eax, 0x40
jne 0x51c799
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x5814], 0
jne 0x51c761
movzx edx, word [ebp - 0x1094]
imul edx, edx, 0x170
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3434]
cmp dword [ecx + edx + 0x144], 6
je 0x51c799
mov edx, dword [ebp + 8]
cmp dword [edx + 0x5814], 0
je 0x51c78d
movzx eax, word [ebp - 0x1094]
imul eax, eax, 0x170
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3434]
cmp dword [edx + eax + 0x144], 7
je 0x51c799
mov dword [ebp - 0x12ec], 1
jmp 0x51c7a3
mov dword [ebp - 0x12ec], 0
mov eax, dword [ebp - 0x12ec]
mov dword [ebp - 0x1230], eax
cmp dword [ebp - 0x1230], 0
je 0x51c889
mov ecx, dword [ebp - 0x1118]
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x94], edx
movzx eax, word [ebp - 0x1098]
cmp eax, 9
jne 0x51c81c
mov ecx, dword [ebp - 0x11f8]
imul ecx, ecx, 0x58
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x2b38]
mov ecx, dword [eax + ecx + 0x18]
and ecx, 0x800
je 0x51c81c
movzx edx, word [ebp - 0x1094]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004ef310
add esp, 8
test eax, eax
jne 0x51c81c
mov ecx, dword [ebp - 0x78]
mov dword [ebp - 0x10d0], ecx
movzx edx, word [ebp - 0x1098]
cmp edx, 0x20
jne 0x51c866
mov eax, dword [ebp - 0x11f8]
imul eax, eax, 0x58
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2b38]
mov eax, dword [edx + eax + 0x18]
and eax, 0x800
je 0x51c866
movzx ecx, word [ebp - 0x1094]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004ef310
add esp, 8
test eax, eax
jne 0x51c866
mov eax, dword [ebp - 0x78]
add eax, 1
mov dword [ebp - 0x78], eax
mov cx, word [ebp - 0x1098]
mov word [ebp - 0x111c], cx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x10e0], edx
mov eax, dword [ebp - 0x1118]
mov dword [ebp - 0x1108], eax
jmp 0x51caa6
cmp dword [ebp - 0x98], 0
jne 0x51c8a5
mov ecx, dword [ebp - 0x1118]
cmp ecx, dword [ebp - 0x9c]
je 0x51c8f3
cmp dword [ebp - 0x98], 0
jne 0x51c91d
movzx edx, word [ebp - 0x1098]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb50]
cmp edx, ecx
jne 0x51c91d
mov edx, dword [ebp - 0x1118]
cmp edx, dword [ebp - 0x9c]
jle 0x51c91d
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb58]
mov edx, dword [ebp - 0x1118]
movzx eax, byte [ecx + edx - 1]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0xb50]
cmp eax, edx
je 0x51c91d
mov eax, dword [ebp - 0x1118]
add eax, 1
mov dword [ebp - 0x1118], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1118]
cmp edx, dword [ecx + 0xb60]
jl 0x51c918
jmp 0x51caab
jmp 0x51caa6
cmp dword [ebp - 0x98], 0
je 0x51ca5c
mov eax, dword [ebp + 8]
cmp dword [eax + 0x9980], 0
je 0x51ca24
mov ecx, dword [ebp - 0x10bc]
push ecx
lea edx, [ebp - 0x1234]
push edx
mov eax, dword [ebp - 0x1114]
sub eax, dword [ebp - 0x30]
add eax, dword [ebp - 4]
sub eax, dword [ebp - 0x1134]
push eax
lea ecx, [ebp - 0x1048]
push ecx
mov edx, dword [ebp - 0x1118]
sub edx, dword [ebp - 0x98]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb60]
sub ecx, dword [ebp - 0x98]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xbd8]
mov ecx, dword [ebp - 0x98]
lea edx, [eax + ecx*2]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb58]
add ecx, dword [ebp - 0x98]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00573400
add esp, 0x24
mov dword [ebp - 0x1238], eax
cmp dword [ebp - 0x1238], 0
jle 0x51ca24
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0x1238]
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x94]
add ecx, dword [ebp - 0x1234]
mov dword [ebp - 0x94], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb58]
mov ecx, dword [ebp - 0x98]
movzx dx, byte [eax + ecx - 1]
mov word [ebp - 0x111c], dx
mov dword [ebp - 0x1090], 0
mov eax, dword [ebp - 0x90]
or eax, 0x200
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x70]
or ecx, 0x200000
mov dword [ebp - 0x70], ecx
mov edx, dword [ebp - 0x98]
mov dword [ebp - 0x1118], edx
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x2c], eax
movzx ecx, word [ebp - 0x111c]
cmp ecx, 0x20
jne 0x51ca4e
mov edx, dword [ebp - 0x78]
sub edx, 1
mov dword [ebp - 0x78], edx
mov ax, word [ebp - 0x111c]
mov word [ebp - 0x1098], ax
mov ecx, dword [ebp - 0x1118]
cmp ecx, dword [ebp - 0x9c]
jne 0x51ca79
mov edx, dword [ebp - 0x9c]
add edx, 1
mov dword [ebp - 0x1118], edx
cmp dword [ebp - 0x98], 0
jne 0x51caa4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1118]
cmp ecx, dword [eax + 0xb60]
jge 0x51caa4
mov edx, dword [ebp - 0x1118]
add edx, 1
mov dword [ebp - 0x1118], edx
jmp 0x51caa6
jmp 0x51caab
jmp 0x51b0ec
mov eax, 1
test eax, eax
je 0x51cb60
cmp dword [ebp - 0x11ec], 0
jle 0x51cb60
cmp dword [ebp - 0x40], 0
je 0x51cb60
mov ecx, dword [ebp - 0x1120]
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x10ac], ecx
cmp dword [ebp - 0x44], 0
jge 0x51caeb
mov dword [ebp - 0x44], 0
cmp dword [ebp - 0x40], 2
jne 0x51cb07
mov eax, dword [ebp - 0x44]
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x10ac]
mov dword [ebp - 0x10ac], eax
jmp 0x51cb1c
cmp dword [ebp - 0x40], 3
jne 0x51cb1c
mov edx, dword [ebp - 0x10ac]
add edx, dword [ebp - 0x44]
mov dword [ebp - 0x10ac], edx
cmp dword [ebp - 0x10ac], 0
jge 0x51cb2f
mov dword [ebp - 0x10ac], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x10ac]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x1114]
jle 0x51cb4d
mov dword [ebp - 0x58], 1
mov edx, dword [ebp - 0x11ec]
mov eax, dword [ebp - 0x10ac]
mov dword [ebp + edx*4 - 0x11ec], eax
movzx ecx, word [ebp - 0x1098]
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0xb50]
cmp ecx, eax
je 0x51cb7d
movzx ecx, word [ebp - 0x1c]
test ecx, ecx
je 0x51cbf0
movzx edx, word [ebp - 0x1098]
sar edx, 8
push edx
movzx eax, word [ebp - 0x1098]
and eax, 0xff
push eax
xor ecx, ecx
cmp dword [ebp - 0x10bc], 0
sete cl
push ecx
movzx edx, word [ebp - 0x1094]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004ab070
add esp, 0x14
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x1104], 0
je 0x51cbf0
push 0
push 0x14
xor ecx, ecx
cmp dword [ebp - 0x10bc], 0
sete cl
push ecx
movzx edx, word [ebp - 0x1094]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004ab070
add esp, 0x14
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
movzx ecx, word [ebp - 0x1098]
cmp ecx, 6
jne 0x51cc3f
mov edx, dword [ebp + 8]
cmp dword [edx + 0x9998], 0
je 0x51cc14
mov eax, dword [ebp + 8]
cmp dword [eax + 0x3a58], 0
je 0x51cc3f
push 0
push 0x2d
xor ecx, ecx
cmp dword [ebp - 0x10bc], 0
sete cl
push ecx
movzx edx, word [ebp - 0x1094]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004ab070
add esp, 0x14
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 0xb70], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0xb70]
cmp eax, dword [edx + 0xb6c]
jle 0x51ccae
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb48]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb6c]
add ecx, 1
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00519930
add esp, 0xc
test eax, eax
jne 0x51ccae
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
sub ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 0xb70], ecx
mov eax, 1
jmp 0x51f325
mov eax, dword [ebp - 0x90]
push eax
mov cx, word [ebp - 0x1098]
push ecx
mov edx, dword [ebp - 0x1118]
push edx
mov eax, dword [ebp - 0x9c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00519af0
add esp, 0x14
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [ebp - 0x11f8]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x58c0]
mov dword [eax + 0x2c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x73c]
mov dword [ecx + 0x30], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5e4]
sub edx, 1
mov eax, dword [ebp + 8]
cmp dword [eax + 0xb70], edx
jne 0x51cd7b
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1118]
cmp edx, dword [ecx + 0xb60]
jne 0x51cd7b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov dword [ecx + 0x2c], 0
mov edx, dword [ebp + 8]
cmp dword [edx + 0x58c0], 0
jle 0x51cf06
movzx eax, word [ebp - 0x1c]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0x58b4]
cmp eax, edx
jne 0x51cf06
movzx eax, word [ebp - 0x1094]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ef310
add esp, 8
mov dword [ebp - 0x123c], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov dword [ebp - 0x1240], eax
jmp 0x51cddb
mov ecx, dword [ebp - 0x1240]
sub ecx, 1
mov dword [ebp - 0x1240], ecx
cmp dword [ebp - 0x1240], 0
jl 0x51ce91
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [ebp - 0x1240]
mov edx, dword [eax + ecx*4]
cmp dword [edx + 0x2c], 0
je 0x51ce66
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ebp - 0x1240]
mov eax, dword [ecx + edx*4]
mov ecx, dword [eax + 0x2c]
imul ecx, ecx, 0x84
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x588c]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x58c0]
imul edx, edx, 0x84
mov esi, dword [ebp + 8]
mov esi, dword [esi + 0x588c]
mov eax, dword [eax + ecx + 0x54]
cmp eax, dword [esi + edx + 0x54]
jne 0x51ce68
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [ebp - 0x1240]
mov ecx, dword [edx + eax*4]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x2c]
cmp eax, dword [edx + 0x58c0]
je 0x51ce68
jmp 0x51ce91
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [ebp - 0x1240]
mov ecx, dword [edx + eax*4]
cmp dword [ecx + 0x18], 0
jle 0x51ce8c
mov dword [ebp - 0x123c], 0
jmp 0x51ce91
jmp 0x51cdcc
cmp dword [ebp - 0x123c], 0
je 0x51ced1
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x58c0]
imul eax, eax, 0x34
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5890]
mov eax, dword [edx + eax + 0x10]
or eax, 0x10
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x58c0]
imul edx, edx, 0x34
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x5890]
mov dword [ecx + edx + 0x10], eax
jmp 0x51cf06
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x58c0]
imul eax, eax, 0x34
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5890]
mov eax, dword [edx + eax + 0x10]
and eax, 0xffffffef
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x58c0]
imul edx, edx, 0x34
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x5890]
mov dword [ecx + edx + 0x10], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
sub eax, 1
mov dword [ebp - 0x1100], eax
jns 0x51cf24
mov dword [ebp - 0x1100], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x38]
and eax, 0x1020
or eax, dword [ebp - 0x70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x138]
mov edx, dword [ecx + edx*4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ebp - 0x90]
mov dword [ecx + 0x3c], edx
movzx eax, word [ebp - 0x1098]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0xb50]
cmp eax, edx
je 0x51cfa4
movzx eax, word [ebp - 0x1098]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0x58b4]
cmp eax, edx
jne 0x51cfd7
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x38]
or edx, 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x138]
mov ecx, dword [eax + ecx*4]
mov dword [ecx + 0x38], edx
movzx edx, word [ebp - 0x1c]
cmp edx, 0xf
jne 0x51d018
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x38]
or edx, 0x80
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x138]
mov ecx, dword [eax + ecx*4]
mov dword [ecx + 0x38], edx
jmp 0x51d053
movzx edx, word [ebp - 0x1c]
test edx, edx
je 0x51d053
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x38]
or edx, 2
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x138]
mov ecx, dword [eax + ecx*4]
mov dword [ecx + 0x38], edx
movzx edx, word [ebp - 0x1c]
test edx, edx
je 0x51d075
mov al, byte [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004e0c90
add esp, 0xc
cmp dword [ebp - 0x1104], 0
jne 0x51d087
movzx ecx, word [ebp - 0x1c]
cmp ecx, 0x14
jne 0x51d0bd
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x38]
or ecx, 0x800
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x138]
mov eax, dword [edx + eax*4]
mov dword [eax + 0x38], ecx
cmp dword [ebp - 0x108c], 0
je 0x51d0fb
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x38]
or eax, 0x1000000
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x138]
mov edx, dword [ecx + edx*4]
mov dword [edx + 0x38], eax
cmp dword [ebp - 0xc], 0
je 0x51d137
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x38]
or edx, 0x8000000
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x138]
mov ecx, dword [eax + ecx*4]
mov dword [ecx + 0x38], edx
cmp dword [ebp - 0x54], 0
je 0x51d173
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x38]
or ecx, 0x40000000
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x138]
mov eax, dword [edx + eax*4]
mov dword [eax + 0x38], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0051a3c0
add esp, 8
test eax, eax
je 0x51d1c0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x38]
or eax, 4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x138]
mov edx, dword [ecx + edx*4]
mov dword [edx + 0x38], eax
cmp dword [ebp - 0x84], 0
jle 0x51d1ff
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x38]
or edx, 0x2000000
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x138]
mov ecx, dword [eax + ecx*4]
mov dword [ecx + 0x38], edx
cmp dword [ebp - 0x10dc], 0
jl 0x51d249
mov edx, dword [ebp - 0x10dc]
cmp edx, dword [ebp - 0x1118]
jge 0x51d249
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x38]
or edx, 8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x138]
mov ecx, dword [eax + ecx*4]
mov dword [ecx + 0x38], edx
mov edx, dword [ebp + 8]
cmp dword [edx + 0x648], 0
je 0x51d2bb
mov eax, dword [ebp - 0x11f8]
imul eax, eax, 0x58
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2b38]
cmp dword [edx + eax + 0x3c], 0
jle 0x51d2bb
mov eax, dword [ebp - 0x11f8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004b1ac0
add esp, 8
test eax, eax
je 0x51d2bb
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x38]
or ecx, 0x100
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x138]
mov eax, dword [edx + eax*4]
mov dword [eax + 0x38], ecx
cmp dword [ebp - 0x109c], 0
je 0x51d2f9
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x38]
or eax, 0x20000000
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x138]
mov edx, dword [ecx + edx*4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 0x11f8]
imul eax, eax, 0x58
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2b38]
mov eax, dword [edx + eax + 0x18]
and eax, 0x10
je 0x51d3bd
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x38]
and eax, 4
je 0x51d3bd
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
cmp dword [edx + 0x30], 0
jne 0x51d3bd
mov eax, dword [ebp + 8]
cmp dword [eax + 0xb70], 0
je 0x51d387
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
sub ecx, 1
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004f76d0
add esp, 0xc
test eax, eax
jne 0x51d3bd
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x38]
or edx, 0x200
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x138]
mov ecx, dword [eax + ecx*4]
mov dword [ecx + 0x38], edx
mov edx, dword [ebp - 0x11f8]
imul edx, edx, 0x58
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2b38]
mov edx, dword [ecx + edx + 0x18]
and edx, 0x20
je 0x51d48b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x38]
and edx, 3
je 0x51d48b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
cmp dword [ecx + 0x30], 0
jne 0x51d48b
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5e4]
sub eax, 1
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0xb70], eax
jge 0x51d456
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
add edx, 1
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004f76d0
add esp, 0xc
test eax, eax
jne 0x51d48b
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x38]
or eax, 0x400
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x138]
mov edx, dword [ecx + edx*4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 0x11f8]
imul eax, eax, 0x58
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2b38]
mov eax, dword [edx + eax + 0x18]
and eax, 0x10000
je 0x51d57d
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x38]
and eax, 3
je 0x51d57d
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
cmp dword [edx + 0x30], 0
jne 0x51d57d
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5e4]
sub ecx, 1
mov edx, dword [ebp + 8]
cmp dword [edx + 0xb70], ecx
jge 0x51d57d
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
add eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004f76d0
add esp, 0xc
test eax, eax
je 0x51d57d
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x38]
and ecx, 0x400
jne 0x51d57d
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x3c]
or ecx, 0x10
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x138]
mov eax, dword [edx + eax*4]
mov dword [eax + 0x3c], ecx
mov ecx, dword [ebp - 0x11f8]
imul ecx, ecx, 0x58
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x2b38]
cmp dword [eax + ecx + 0x28], 0
jbe 0x51d61f
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x38]
and eax, 4
je 0x51d61f
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0xb70], 0
je 0x51d5ea
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
sub edx, 1
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004f7800
add esp, 0xc
test eax, eax
jne 0x51d61f
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x38]
or eax, 0x400000
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x138]
mov edx, dword [ecx + edx*4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 0x11f8]
imul eax, eax, 0x58
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2b38]
cmp dword [edx + eax + 0x28], 0
jbe 0x51d6cd
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x38]
and edx, 3
je 0x51d6cd
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5e4]
sub ecx, 1
mov edx, dword [ebp + 8]
cmp dword [edx + 0xb70], ecx
jge 0x51d697
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
add eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004f7800
add esp, 0xc
test eax, eax
jne 0x51d6cd
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x38]
or ecx, 0x800000
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x138]
mov eax, dword [edx + eax*4]
mov dword [eax + 0x38], ecx
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x598], 0
je 0x51d70c
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x3c]
or ecx, 1
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x138]
mov eax, dword [edx + eax*4]
mov dword [eax + 0x3c], ecx
cmp dword [ebp - 0x64], 0
je 0x51d745
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x3c]
or eax, 0x20
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x138]
mov edx, dword [ecx + edx*4]
mov dword [edx + 0x3c], eax
cmp dword [ebp - 8], 0
je 0x51d781
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x3c]
or edx, 0x100
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x138]
mov ecx, dword [eax + ecx*4]
mov dword [ecx + 0x3c], edx
mov edx, dword [ebp - 0x1114]
sub edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x10c8], edx
cmp dword [ebp - 0x64], 0
jne 0x51d7ab
mov eax, dword [ebp - 0x10c8]
add eax, dword [ebp - 0x1090]
mov dword [ebp - 0x10c8], eax
cmp dword [ebp - 0x11ec], 0
jg 0x51d825
cmp dword [ebp - 0x74], 0
jg 0x51d825
cmp dword [ebp - 0x5c], 0
jne 0x51d825
movzx ecx, word [ebp - 0x1c]
test ecx, ecx
jne 0x51d825
cmp dword [ebp - 0x1104], 0
jne 0x51d825
mov edx, dword [ebp - 0x11f8]
imul edx, edx, 0x58
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2b38]
mov edx, dword [ecx + edx + 0x18]
and edx, 0x808
jne 0x51d825
cmp dword [ebp - 0x10c8], 0
jg 0x51d825
cmp dword [ebp - 0x84], 0
jg 0x51d825
cmp dword [ebp - 0x10a4], 0
jl 0x51d818
mov eax, dword [ebp - 0x10a4]
cmp eax, dword [ebp - 0x1118]
jl 0x51d825
cmp dword [ebp - 0x10fc], 0
jle 0x51e1b8
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
cmp dword [edx + 0x10], 0
jne 0x51d86f
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004e4830
add esp, 8
test eax, eax
jne 0x51d86d
push 0x28
push str.RAN_OUT_OF_MEMORY__WrapParseBuffer_
mov eax, dword [ebp + 8]
push eax
call fcn.004e7a10
add esp, 0xc
jmp 0x51d894
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004e4890
add esp, 8
push 0xa8
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x10]
push ecx
lea edx, [ebp - 0x11f0]
push edx
call fcn.004e29c0
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx]
and eax, 0xffffe341
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x138]
mov edx, dword [ecx + edx*4]
mov ecx, dword [edx + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 4], 0
jne 0x51d983
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx]
and edx, 0xfffffffe
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x138]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ecx + 0x10]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x138]
mov edx, dword [ecx + edx*4]
mov ecx, dword [edx + 0x10]
mov edx, dword [eax]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x10]
mov dword [edx + 0x60], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x10]
mov dword [edx + 0x5c], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx]
mov dword [ebp - 0x1244], eax
movzx ecx, word [ebp - 0x1c]
test ecx, ecx
jne 0x51d9f6
cmp dword [ebp - 0x1104], 0
je 0x51db4b
movzx edx, word [ebp - 0x1c]
cmp edx, 0x14
je 0x51da08
cmp dword [ebp - 0x1104], 0
je 0x51da2b
mov eax, dword [ebp - 0x1244]
or eax, 2
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x138]
mov edx, dword [ecx + edx*4]
mov ecx, dword [edx + 0x10]
mov dword [ecx], eax
movzx edx, word [ebp - 0x1c]
cmp edx, 0xc
jne 0x51da57
mov eax, dword [ebp - 0x1244]
or eax, 4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x138]
mov edx, dword [ecx + edx*4]
mov ecx, dword [edx + 0x10]
mov dword [ecx], eax
movzx edx, word [ebp - 0x1c]
cmp edx, 0x16
jne 0x51da83
mov eax, dword [ebp - 0x1244]
or eax, 8
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x138]
mov edx, dword [ecx + edx*4]
mov ecx, dword [edx + 0x10]
mov dword [ecx], eax
movzx edx, word [ebp - 0x1c]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x58b4]
cmp edx, ecx
jne 0x51dab8
mov edx, dword [ebp - 0x1244]
or edx, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x138]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ecx + 0x10]
mov dword [eax], edx
movzx ecx, word [ebp - 0x1c]
cmp ecx, 0x12
jne 0x51dae4
mov edx, dword [ebp - 0x1244]
or edx, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x138]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ecx + 0x10]
mov dword [eax], edx
movzx ecx, word [ebp - 0x1c]
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0x58b4]
cmp ecx, eax
je 0x51db27
movzx ecx, word [ebp - 0x1c]
cmp ecx, 0xf
je 0x51db27
cmp dword [ebp - 0x1104], 0
jne 0x51db27
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x10]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x39cc]
mov dword [ecx + 0x58], eax
cmp dword [ebp - 0x74], 0
jle 0x51db94
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 0
je 0x51db94
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx]
or edx, 0x400
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x138]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ecx + 0x10]
mov dword [eax], edx
cmp dword [ebp - 0x10a4], 0
jl 0x51dbe5
mov ecx, dword [ebp - 0x10a4]
cmp ecx, dword [ebp - 0x1118]
jge 0x51dbe5
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx]
or edx, 0x1000
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x138]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ecx + 0x10]
mov dword [eax], edx
cmp dword [ebp - 0x10fc], 0
jle 0x51dc4c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax]
or ecx, 0x800
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x138]
mov eax, dword [edx + eax*4]
mov edx, dword [eax + 0x10]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 0x10fc]
mov dword [edx + 0x80], eax
cmp dword [ebp - 0x84], 0
jle 0x51dd25
lea ecx, [ebp - 0x1088]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
call fcn.004e2930
add esp, 4
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0xb70]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x138]
mov ecx, dword [edx + ecx*4]
mov edx, dword [ecx + 0x10]
mov dword [edx + 0x8c], eax
lea eax, [ebp - 0x1088]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0x8c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp - 0x84]
mov dword [ecx + 0x90], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 0x38]
mov dword [edx + 0x94], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp - 0x113c]
mov dword [eax + 0x98], ecx
mov edx, dword [ebp - 0x11f8]
imul edx, edx, 0x58
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2b38]
mov edx, dword [ecx + edx + 0x18]
and edx, 0x800
jne 0x51dd50
cmp dword [ebp - 0x10c8], 0
jge 0x51def4
mov eax, dword [ebp - 0x78]
sub eax, dword [ebp - 0x10d0]
mov dword [ebp - 0x1248], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax]
and ecx, 0x400
je 0x51ddc6
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 0x70], 0
je 0x51ddc6
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp - 0x10c8]
sub edx, dword [ecx + 0x74]
mov dword [ebp - 0x10c8], edx
cmp dword [ebp - 0x10c8], 0
jle 0x51def4
cmp dword [ebp - 0x1248], 0
jle 0x51def4
movzx eax, word [ebp - 0x1098]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0xb50]
cmp eax, edx
je 0x51def4
movzx eax, word [ebp - 0x1c]
test eax, eax
je 0x51de0e
movzx ecx, word [ebp - 0x1c]
cmp ecx, 0xf
jne 0x51def4
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx]
or edx, 0x80
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x138]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ecx + 0x10]
mov dword [eax], edx
mov eax, dword [ebp - 0x10c8]
cdq
idiv dword [ebp - 0x1248]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x138]
mov edx, dword [ecx + edx*4]
mov ecx, dword [edx + 0x10]
mov dword [ecx + 0x60], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 0x60]
imul edx, dword [ebp - 0x1248]
mov eax, dword [ebp - 0x10c8]
sub eax, edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x138]
mov edx, dword [ecx + edx*4]
mov ecx, dword [edx + 0x10]
mov dword [ecx + 0x5c], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp - 0x78]
mov dword [ecx + 0x64], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 0x10d0]
mov dword [edx + 0x68], eax
cmp dword [ebp - 0x5c], 0
je 0x51e1b6
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004e50f0
add esp, 8
mov dword [ebp - 0x10cc], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 8]
mov dword [ebp - 0x10c4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx]
mov dword [ebp - 0x1250], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x1254], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x38]
and eax, 3
je 0x51dfa3
mov ecx, dword [ebp - 0x1254]
sub ecx, 1
mov dword [ebp - 0x1254], ecx
mov edx, dword [ebp - 0x1254]
sub edx, 1
mov dword [ebp - 0x124c], edx
jmp 0x51dfc3
mov eax, dword [ebp - 0x124c]
sub eax, 1
mov dword [ebp - 0x124c], eax
cmp dword [ebp - 0x124c], 0
jl 0x51dfe4
mov ecx, dword [ebp - 0x1250]
add ecx, dword [ebp - 0x124c]
movzx edx, byte [ecx]
cmp edx, 0x20
je 0x51dfe2
jmp 0x51dfe4
jmp 0x51dfb4
mov eax, dword [ebp - 0x124c]
add eax, 1
mov dword [ebp - 0x1254], eax
mov dword [ebp - 0x124c], 0
jmp 0x51e00e
mov ecx, dword [ebp - 0x124c]
add ecx, 1
mov dword [ebp - 0x124c], ecx
mov edx, dword [ebp - 0x124c]
cmp edx, dword [ebp - 0x1254]
jge 0x51e159
cmp dword [ebp - 0x10cc], 0
jne 0x51e0bc
mov eax, dword [ebp - 0x124c]
mov ecx, dword [ebp - 0x10c4]
movzx edx, word [ecx + eax*2]
imul edx, edx, 0x170
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3434]
mov edx, dword [ecx + edx + 0x134]
and edx, 0x2000
je 0x51e0bc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x88]
mov ecx, dword [ebp - 0x124c]
movzx edx, byte [eax + ecx]
or edx, 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x138]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + 0x88]
mov eax, dword [ebp - 0x124c]
mov byte [ecx + eax], dl
mov dword [ebp - 0x10cc], 1
jmp 0x51e154
cmp dword [ebp - 0x10cc], 0
je 0x51e154
mov ecx, dword [ebp - 0x124c]
mov edx, dword [ebp - 0x10c4]
movzx eax, word [edx + ecx*2]
imul eax, eax, 0x170
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3434]
mov eax, dword [edx + eax + 0x134]
and eax, 0x2000
jne 0x51e154
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0x88]
mov edx, dword [ebp - 0x124c]
movzx eax, byte [ecx + edx - 1]
or eax, 2
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x138]
mov edx, dword [ecx + edx*4]
mov ecx, dword [edx + 0x10]
mov edx, dword [ecx + 0x88]
mov ecx, dword [ebp - 0x124c]
mov byte [ecx + edx - 1], al
mov dword [ebp - 0x10cc], 0
jmp 0x51dfff
cmp dword [ebp - 0x10cc], 0
je 0x51e1b6
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 0x88]
mov eax, dword [ebp - 0x124c]
movzx ecx, byte [edx + eax - 1]
or ecx, 2
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x138]
mov eax, dword [edx + eax*4]
mov edx, dword [eax + 0x10]
mov eax, dword [edx + 0x88]
mov edx, dword [ebp - 0x124c]
mov byte [edx + eax - 1], cl
jmp 0x51e1e9
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
cmp dword [ecx + 0x10], 0
je 0x51e1e9
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004e5190
add esp, 8
cmp dword [ebp - 0xc], 0
jne 0x51e20f
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x38]
and ecx, 0x4000000
je 0x51e22c
mov edx, dword [ebp - 0x10bc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004b8de0
add esp, 0xc
cmp dword [ebp - 0x54], 0
je 0x51e24f
mov eax, dword [ebp - 0x10bc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004b6b00
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
cmp dword [edx + 0x10], 0
je 0x51e2f5
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx]
and eax, 0x2c
je 0x51e2f5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x38]
and eax, 0xfffff9ff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x138]
mov edx, dword [ecx + edx*4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x3c]
and edx, 0xffffffef
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x138]
mov ecx, dword [eax + ecx*4]
mov dword [ecx + 0x3c], edx
mov edx, dword [ebp + 8]
cmp dword [edx + 0x73c], 0
jle 0x51e496
mov eax, dword [ebp + 8]
cmp dword [eax + 0x3a58], 0
jne 0x51e496
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x73c]
imul edx, edx, 0x98
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x72c]
mov edx, dword [ecx + edx + 0x28]
and edx, 0x300
jne 0x51e496
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x73c]
mov dword [ebp - 0x1258], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x125c], ecx
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004a0bf0
add esp, 0xc
mov dword [ebp - 0x1260], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x500]
push eax
push 0x5a0
mov ecx, dword [ebp - 0x1260]
imul ecx, ecx, 0x170
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3434]
mov ecx, dword [eax + ecx + 0x140]
mov edx, dword [ecx + 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x10b0], eax
cmp dword [ebp - 0x125c], 1
je 0x51e3fa
cmp dword [ebp - 0x125c], 2
jne 0x51e496
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x38]
and edx, 3
je 0x51e496
mov eax, dword [ebp - 0x1260]
imul eax, eax, 0x170
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3434]
mov eax, dword [edx + eax + 0x134]
and eax, 0x80
je 0x51e496
mov ecx, dword [ebp - 0x1258]
imul ecx, ecx, 0x98
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x72c]
mov edx, dword [ebp - 0x1258]
imul edx, edx, 0x98
mov esi, dword [ebp + 8]
mov esi, dword [esi + 0x72c]
mov edx, dword [esi + edx + 0x14]
shl edx, 1
mov eax, dword [eax + ecx + 0x10]
sub eax, edx
cmp dword [ebp - 0x10b0], eax
jle 0x51e496
mov ecx, dword [ebp - 0x1258]
imul ecx, ecx, 0x98
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x72c]
mov ecx, dword [eax + ecx + 0x14]
mov edx, dword [ebp - 0x10b0]
lea eax, [edx + ecx*2]
mov ecx, dword [ebp - 0x1258]
imul ecx, ecx, 0x98
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x72c]
mov dword [edx + ecx + 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004abca0
add esp, 8
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0
je 0x51f320
mov dword [ebp - 0x1278], 0x270f
mov dword [ebp - 0x1274], 0
mov ecx, dword [ebp - 0x1278]
mov dword [ebp - 0x1290], ecx
mov edx, dword [ebp - 0x1278]
mov dword [ebp - 0x1280], edx
mov dword [ebp - 0x1270], 0
mov dword [ebp - 0x126c], 0
mov dword [ebp - 0x1268], 0
mov dword [ebp - 0x1264], 0
mov eax, dword [ebp - 0x1264]
mov dword [ebp - 0x10a8], eax
mov ecx, dword [ebp - 0x10a8]
mov dword [ebp - 0x1110], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
cmp dword [eax + 0xc], 1
jne 0x51e622
movzx ecx, word [ebp - 0x1c]
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0x58b4]
cmp ecx, eax
jne 0x51e622
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xa164]
and edx, 0x8000000
je 0x51e57a
mov dword [ebp - 0x1268], 1
jmp 0x51e622
mov eax, dword [ebp + 8]
cmp dword [eax + 0xb70], 0
jle 0x51e622
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [edx + 0x2c]
mov dword [ebp - 0x12a4], eax
mov ecx, dword [ebp - 0x12a4]
imul ecx, ecx, 0x84
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x588c]
mov ecx, dword [eax + ecx + 0x54]
mov dword [ebp - 0x12a0], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4 - 4]
mov ecx, dword [eax + 0x2c]
mov dword [ebp - 0x12a8], ecx
mov edx, dword [ebp - 0x12a4]
cmp edx, dword [ebp - 0x12a8]
je 0x51e622
mov eax, dword [ebp - 0x12a8]
neg eax
push eax
mov ecx, dword [ebp - 0x12a0]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00513250
add esp, 0xc
cmp dword [ebp - 0x12a4], eax
jne 0x51e622
mov dword [ebp - 0x1268], 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
cmp dword [ecx + 0xc], 1
jne 0x51e6e6
movzx edx, word [ebp - 0x1c]
cmp edx, 0xf
jne 0x51e6e6
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
movzx edx, word [ecx + 8]
cmp edx, 0xffff
jne 0x51e690
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
movzx edx, word [ecx + 0xa]
mov dword [ebp - 0x128c], edx
jmp 0x51e6bd
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x10c4], edx
mov eax, dword [ebp - 0x10c4]
movzx ecx, word [eax]
mov dword [ebp - 0x128c], ecx
mov edx, dword [ebp - 0x128c]
imul edx, edx, 0x170
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3434]
cmp dword [ecx + edx + 0x16c], 0
jle 0x51e6e6
mov dword [ebp - 0x1268], 1
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
movzx ecx, word [eax + 8]
cmp ecx, 0xffff
jne 0x51e80b
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
movzx ecx, word [eax + 0xa]
mov dword [ebp - 0x128c], ecx
mov edx, dword [ebp - 0x128c]
shl edx, 5
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3438]
mov edx, dword [ecx + edx + 0xc]
mov dword [ebp - 0x1110], edx
mov eax, dword [ebp - 0x128c]
shl eax, 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3438]
mov ecx, dword [ebp - 0x128c]
shl ecx, 5
mov esi, dword [ebp + 8]
mov esi, dword [esi + 0x3438]
mov edx, dword [edx + eax + 8]
sub edx, dword [esi + ecx + 0xc]
mov eax, dword [ebp - 0x128c]
shl eax, 5
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x3438]
sub edx, dword [ecx + eax + 0x14]
mov dword [ebp - 0x10a8], edx
mov edx, dword [ebp - 0x128c]
shl edx, 5
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3438]
cmp dword [ecx + edx + 0x18], 0
jle 0x51e7c9
mov edx, dword [ebp - 0x128c]
shl edx, 5
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3438]
mov eax, dword [ebp - 0x10a8]
sub eax, dword [ecx + edx + 0x18]
mov dword [ebp - 0x10a8], eax
mov ecx, dword [ebp - 0x128c]
shl ecx, 5
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3438]
mov eax, dword [eax + ecx + 0x18]
cdq
xor eax, edx
sub eax, edx
mov dword [ebp - 0x1298], eax
mov ecx, dword [ebp - 0x128c]
shl ecx, 5
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3438]
mov ecx, dword [eax + ecx + 0x14]
mov dword [ebp - 0x1264], ecx
jmp 0x51ed35
mov dword [ebp - 0x12b0], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10c4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax]
mov dword [ebp - 0x12ac], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x10b0], ecx
cmp dword [ebp - 0x1268], 0
je 0x51e88b
mov dword [ebp - 0x10b0], 0
mov dword [ebp - 0x126c], 1
cmp dword [ebp - 0x10b0], 1
jle 0x51e9be
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x38]
and ecx, 0x81
je 0x51e9be
mov edx, dword [ebp - 0x10b0]
mov eax, dword [ebp - 0x10c4]
movzx ecx, word [eax + edx*2 - 2]
mov dword [ebp - 0x1274], ecx
mov edx, dword [ebp - 0x10b0]
sub edx, 1
mov dword [ebp - 0x10b0], edx
mov dword [ebp - 0x126c], 1
cmp dword [ebp - 0x10b0], 0
jle 0x51e9be
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x38]
and edx, 0x4000
je 0x51e9be
mov dword [ebp - 0x11f4], 0
jmp 0x51e938
mov eax, dword [ebp - 0x11f4]
add eax, 1
mov dword [ebp - 0x11f4], eax
mov ecx, dword [ebp - 0x11f4]
cmp ecx, dword [ebp - 0x10b0]
jge 0x51e9a1
mov edx, dword [ebp - 0x11f4]
mov eax, dword [ebp - 0x10c4]
movzx ecx, word [eax + edx*2]
imul ecx, ecx, 0x170
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3434]
mov ecx, dword [eax + ecx + 0x134]
and ecx, 0x80
je 0x51e99d
mov edx, dword [ebp - 0x11f4]
mov eax, dword [ebp - 0x10c4]
movzx ecx, word [eax + edx*2]
imul ecx, ecx, 0x170
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3434]
cmp dword [eax + ecx + 0xc4], 0
jne 0x51e99f
jmp 0x51e9a1
jmp 0x51e929
mov ecx, dword [ebp - 0x11f4]
cmp ecx, dword [ebp - 0x10b0]
jne 0x51e9be
mov edx, dword [ebp - 0x10b0]
add edx, 1
mov dword [ebp - 0x10b0], edx
mov dword [ebp - 0x11f4], 0
jmp 0x51e9d9
mov eax, dword [ebp - 0x11f4]
add eax, 1
mov dword [ebp - 0x11f4], eax
mov ecx, dword [ebp - 0x11f4]
cmp ecx, dword [ebp - 0x10b0]
jge 0x51eccb
mov edx, dword [ebp - 0x11f4]
mov eax, dword [ebp - 0x10c4]
movzx ecx, word [eax + edx*2]
mov dword [ebp - 0x128c], ecx
cmp dword [ebp - 0x1270], 0
jne 0x51ea74
mov edx, dword [ebp - 0x12ac]
add edx, dword [ebp - 0x11f4]
movzx eax, byte [edx]
cmp eax, 0x20
je 0x51ea32
mov ecx, dword [ebp - 0x12ac]
add ecx, dword [ebp - 0x11f4]
movzx edx, byte [ecx]
cmp edx, 9
jne 0x51ea74
mov eax, dword [ebp - 0x128c]
shl eax, 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3438]
cmp dword [edx + eax + 8], 0
jle 0x51ea74
mov eax, dword [ebp - 0x128c]
imul eax, eax, 0x170
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3434]
cmp dword [edx + eax + 0x144], 0
jne 0x51ea74
mov dword [ebp - 0x1270], 1
mov eax, dword [ebp - 0x12ac]
add eax, dword [ebp - 0x11f4]
movzx ecx, byte [eax]
cmp ecx, 0x20
je 0x51ea9c
mov edx, dword [ebp - 0x12ac]
add edx, dword [ebp - 0x11f4]
movzx eax, byte [edx]
cmp eax, 9
jne 0x51eada
mov ecx, dword [ebp - 0x10b0]
sub ecx, 1
cmp dword [ebp - 0x11f4], ecx
jl 0x51eab6
cmp dword [ebp - 0x12b0], 0
je 0x51eada
mov edx, dword [ebp - 0x128c]
imul edx, edx, 0x170
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3434]
cmp dword [ecx + edx + 0x144], 0
jne 0x51eada
jmp 0x51e9ca
mov edx, dword [ebp - 0x128c]
imul edx, edx, 0x170
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3434]
mov edx, dword [ecx + edx + 0x134]
and edx, 0x80
je 0x51eb22
mov eax, dword [ebp - 0x128c]
imul eax, eax, 0x170
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3434]
cmp dword [edx + eax + 0xc4], 0
jle 0x51eb22
jmp 0x51e9ca
mov eax, dword [ebp - 0x128c]
shl eax, 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3438]
mov eax, dword [edx + eax + 0xc]
cmp eax, dword [ebp - 0x1110]
jle 0x51eb5c
mov ecx, dword [ebp - 0x128c]
shl ecx, 5
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3438]
mov ecx, dword [eax + ecx + 0xc]
mov dword [ebp - 0x1110], ecx
mov edx, dword [ebp - 0x128c]
shl edx, 5
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3438]
mov eax, dword [ebp - 0x128c]
shl eax, 5
mov esi, dword [ebp + 8]
mov esi, dword [esi + 0x3438]
mov ecx, dword [ecx + edx + 8]
sub ecx, dword [esi + eax + 0xc]
mov edx, dword [ebp - 0x128c]
shl edx, 5
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3438]
sub ecx, dword [eax + edx + 0x14]
mov dword [ebp - 0x1294], ecx
mov ecx, dword [ebp - 0x128c]
shl ecx, 5
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3438]
cmp dword [eax + ecx + 0x18], 0
jle 0x51ebdf
mov ecx, dword [ebp - 0x128c]
shl ecx, 5
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3438]
mov edx, dword [ebp - 0x1294]
sub edx, dword [eax + ecx + 0x18]
mov dword [ebp - 0x1294], edx
mov eax, dword [ebp - 0x1294]
cmp eax, dword [ebp - 0x10a8]
jle 0x51ebf9
mov ecx, dword [ebp - 0x1294]
mov dword [ebp - 0x10a8], ecx
mov edx, dword [ebp - 0x128c]
shl edx, 5
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3438]
mov edx, dword [ecx + edx + 0x14]
cmp edx, dword [ebp - 0x1264]
jle 0x51ec33
mov eax, dword [ebp - 0x128c]
shl eax, 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3438]
mov eax, dword [edx + eax + 0x14]
mov dword [ebp - 0x1264], eax
mov ecx, dword [ebp - 0x128c]
shl ecx, 5
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3438]
mov ecx, dword [eax + ecx + 0x18]
mov dword [ebp - 0x1288], ecx
cmp dword [ebp - 0x1288], 0
jne 0x51ec70
mov dword [ebp - 0x1280], 0
mov edx, dword [ebp - 0x1280]
mov dword [ebp - 0x1290], edx
jmp 0x51ecbc
cmp dword [ebp - 0x1288], 0
jle 0x51ec95
mov eax, dword [ebp - 0x1288]
cmp eax, dword [ebp - 0x1280]
jge 0x51ec95
mov ecx, dword [ebp - 0x1288]
mov dword [ebp - 0x1280], ecx
jmp 0x51ecbc
cmp dword [ebp - 0x1288], 0
jge 0x51ecbc
mov edx, dword [ebp - 0x1288]
neg edx
cmp edx, dword [ebp - 0x1290]
jge 0x51ecbc
mov eax, dword [ebp - 0x1288]
neg eax
mov dword [ebp - 0x1290], eax
mov dword [ebp - 0x12b0], 1
jmp 0x51e9ca
mov ecx, dword [ebp - 0x1280]
cmp ecx, dword [ebp - 0x1278]
jne 0x51ece3
mov dword [ebp - 0x1280], 0
mov edx, dword [ebp - 0x1290]
cmp edx, dword [ebp - 0x1278]
jne 0x51ecfb
mov dword [ebp - 0x1290], 0
cmp dword [ebp - 0x1280], 0
je 0x51ed23
cmp dword [ebp - 0x1290], 0
je 0x51ed23
mov dword [ebp - 0x1290], 0
mov eax, dword [ebp - 0x1290]
mov dword [ebp - 0x1280], eax
mov ecx, dword [ebp - 0x1280]
add ecx, dword [ebp - 0x1290]
mov dword [ebp - 0x1298], ecx
cmp dword [ebp - 0x10a8], 0
jge 0x51ed48
mov dword [ebp - 0x10a8], 0
mov edx, dword [ebp - 0x1110]
add edx, dword [ebp - 0x10a8]
add edx, dword [ebp - 0x1264]
sub edx, dword [ebp - 0x1298]
mov dword [ebp - 0x129c], edx
jne 0x51edac
cmp dword [ebp - 0x1270], 0
jne 0x51ed7a
cmp dword [ebp - 0x126c], 0
je 0x51edac
mov eax, dword [ebp - 0x1274]
shl eax, 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3438]
mov ecx, dword [ebp - 0x1274]
shl ecx, 5
mov esi, dword [ebp + 8]
mov esi, dword [esi + 0x3438]
mov edx, dword [edx + eax + 8]
add edx, dword [esi + ecx + 0x14]
mov dword [ebp - 0x129c], edx
cmp dword [ebp - 0x1268], 0
je 0x51edd4
push 0x5a0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x514]
push ecx
push 0x14
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x129c], eax
jmp 0x51ee2b
push 0
lea edx, [ebp - 0x127c]
push edx
lea eax, [ebp - 0x1284]
push eax
mov ecx, dword [ebp - 0x129c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004fa620
add esp, 0x18
mov edx, dword [ebp - 0x1284]
add edx, dword [ebp - 0x127c]
add edx, dword [ebp - 0x129c]
mov dword [ebp - 0x129c], edx
mov eax, dword [ebp - 0x1110]
add eax, dword [ebp - 0x1284]
mov dword [ebp - 0x1110], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
cmp dword [edx + 0xc], 1
jne 0x51eee3
mov eax, dword [ebp - 0x11f8]
imul eax, eax, 0x58
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2b38]
mov eax, dword [edx + eax + 0x18]
and eax, 0x3000
je 0x51eee3
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x5b88], 0
jne 0x51eee3
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
add eax, 1
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx + 0x5e4]
jge 0x51eee3
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4 + 4]
mov ecx, dword [eax + 0x38]
and ecx, 0x1e0000
je 0x51eee3
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
sub eax, 1
js 0x51eee3
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4 - 4]
mov eax, dword [edx + 0x38]
and eax, 0x1e0000
je 0x51eee3
mov dword [ebp - 0x129c], 0
mov ecx, dword [ebp - 0x11f8]
imul ecx, ecx, 0x58
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x2b38]
mov ecx, dword [eax + ecx + 0x18]
and ecx, 0x3000
je 0x51ef77
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [ebp - 0x129c]
cmp ecx, dword [eax + 0x18]
je 0x51ef77
cmp dword [ebp - 0x129c], 0
jne 0x51ef77
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
cmp dword [eax + 0x18], 0
jne 0x51ef77
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x3a00]
cmp eax, dword [edx + 0xb70]
jle 0x51ef77
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x3a04], 0
jne 0x51ef77
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov dword [edx + 0x3a00], ecx
movzx edx, word [ebp - 0x1c]
test edx, edx
je 0x51efbf
movzx eax, word [ebp - 0x1c]
cmp eax, 0x16
je 0x51efbf
movzx ecx, word [ebp - 0x1c]
cmp ecx, 0xf
je 0x51efbf
movzx edx, word [ebp - 0x1c]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x58b4]
cmp edx, ecx
je 0x51efbf
movzx edx, word [ebp - 0x1c]
cmp edx, 0xc
je 0x51efbf
movzx eax, word [ebp - 0x1c]
cmp eax, 0x14
je 0x51efbf
mov dword [ebp - 0x129c], 0
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x1c], 0
je 0x51efff
movzx edx, word [ebp - 0x1c]
cmp edx, 0x12
je 0x51eff5
movzx eax, word [ebp - 0x1c]
cmp eax, 0x11
je 0x51eff5
movzx ecx, word [ebp - 0x1c]
cmp ecx, 0x19
je 0x51eff5
movzx edx, word [ebp - 0x1c]
cmp edx, 0x10
je 0x51eff5
movzx eax, word [ebp - 0x1c]
cmp eax, 0x1a
jne 0x51efff
mov dword [ebp - 0x129c], 0
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x1c], 0
je 0x51f044
movzx edx, word [ebp - 0x1c]
cmp edx, 0x16
je 0x51f01a
movzx eax, word [ebp - 0x1c]
cmp eax, 0xc
jne 0x51f044
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x504]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x514]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x129c], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x1c], 0
je 0x51f11c
movzx edx, word [ebp - 0x1c]
cmp edx, 0x14
jne 0x51f11c
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
cmp dword [ecx + 0xc], 1
jne 0x51f11c
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
add eax, 1
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx + 0x5e4]
jge 0x51f11c
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004aea30
add esp, 8
mov dword [ebp - 0x12b4], eax
mov edx, dword [ebp - 0x12b4]
imul edx, edx, 0x70
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x39c4]
mov edx, dword [ecx + edx + 4]
mov dword [ebp - 0x12b8], edx
cmp dword [ebp - 0x12b8], 0
jl 0x51f0ea
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x12b8]
cmp ecx, dword [eax + 0x39c8]
jl 0x51f0f4
mov dword [ebp - 0x12b8], 0
mov edx, dword [ebp - 0x12b8]
imul edx, edx, 0x98
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x39c0]
mov edx, dword [ecx + edx + 0x28]
and edx, 1
jne 0x51f11c
mov dword [ebp - 0x129c], 0
cmp dword [ebp - 0x129c], 0
jne 0x51f15b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx + 0x38]
and edx, 0xfffff9ff
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x138]
mov ecx, dword [eax + ecx*4]
mov dword [ecx + 0x38], edx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 0x129c]
je 0x51f194
mov edx, dword [ebp + 8]
cmp dword [edx + 0x498], 4
jge 0x51f194
mov eax, dword [ebp + 8]
mov dword [eax + 0x498], 4
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x129c]
imul edx, dword [ecx + 0x504]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x514]
lea eax, [edx + ecx - 1]
mov ecx, dword [ebp + 8]
cdq
idiv dword [ecx + 0x514]
mov dword [ebp - 0x34], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x34]
imul eax, dword [edx + 0x514]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x504]
lea eax, [eax + edx - 1]
mov ecx, dword [ebp + 8]
cdq
idiv dword [ecx + 0x504]
mov dword [ebp - 0x129c], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [ebp - 0x129c]
mov dword [eax + 0x18], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xa178]
and eax, 4
je 0x51f2a0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0xb70]
cmp eax, dword [edx + 0x5d8]
jne 0x51f2a0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x514]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x504]
push ecx
mov edx, dword [ebp - 0x129c]
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x138]
mov edx, dword [ecx + edx*4]
cmp eax, dword [edx + 0x20]
jle 0x51f2a0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x514]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x504]
push eax
mov ecx, dword [ebp - 0x129c]
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0xb70]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x138]
mov ecx, dword [edx + ecx*4]
mov dword [ecx + 0x20], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [ebp - 0x1110]
mov dword [eax + 0x1c], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xb70]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov eax, dword [edx + eax*4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [eax + 0x1c]
cmp eax, dword [edx + 0x18]
jle 0x51f320
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xb70]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x138]
mov edx, dword [ecx + edx*4]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb70]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x138]
mov ecx, dword [eax + ecx*4]
mov edx, dword [edx + 0x18]
mov dword [ecx + 0x1c], edx
jmp 0x51a8af
pop edi
pop esi
mov ecx, dword [ebp - 0x1054]
xor ecx, ebp
call fcn.005aac48
mov esp, ebp
pop ebp
ret