summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorIru Cai <mytbk920423@gmail.com>2020-11-02 13:13:32 +0800
committerIru Cai <mytbk920423@gmail.com>2021-05-21 20:30:32 +0800
commitd0683acb0ce411f13fc1a21fb911422de3e903bf (patch)
treef591219040b4bdefd4b0767efad0f230183abe91
parent35fd3331f471144d40358a85a43529fa5f172075 (diff)
downloadcoreboot-d0683acb0ce411f13fc1a21fb911422de3e903bf.tar.xz
add broadwell_refcode.asm
-rw-r--r--src/soc/intel/broadwell/Kconfig17
-rw-r--r--src/soc/intel/broadwell/Makefile.inc3
-rw-r--r--src/soc/intel/broadwell/include/soc/ramstage.h4
-rw-r--r--src/soc/intel/broadwell/refcode.c35
-rw-r--r--src/soc/intel/broadwell/refcode/Makefile.inc5
-rw-r--r--src/soc/intel/broadwell/refcode/broadwell_refcode.asm66464
6 files changed, 66473 insertions, 55 deletions
diff --git a/src/soc/intel/broadwell/Kconfig b/src/soc/intel/broadwell/Kconfig
index 5cdfb5488f..ddde4d357b 100644
--- a/src/soc/intel/broadwell/Kconfig
+++ b/src/soc/intel/broadwell/Kconfig
@@ -179,21 +179,4 @@ config SERIRQ_CONTINUOUS_MODE
If you set this option to y, the serial IRQ machine will be
operated in continuous mode.
-config HAVE_REFCODE_BLOB
- depends on ARCH_X86
- bool "An external reference code blob should be put into cbfs."
- default n
- help
- The reference code blob will be placed into cbfs.
-
-if HAVE_REFCODE_BLOB
-
-config REFCODE_BLOB_FILE
- string "Path and filename to reference code blob."
- default "refcode.elf"
- help
- The path and filename to the file to be added to cbfs.
-
-endif # HAVE_REFCODE_BLOB
-
endif
diff --git a/src/soc/intel/broadwell/Makefile.inc b/src/soc/intel/broadwell/Makefile.inc
index 55eddf18fd..971a5dc939 100644
--- a/src/soc/intel/broadwell/Makefile.inc
+++ b/src/soc/intel/broadwell/Makefile.inc
@@ -1,6 +1,7 @@
ifeq ($(CONFIG_SOC_INTEL_BROADWELL),y)
subdirs-y += pch
+subdirs-y += refcode
bootblock-y += bootblock.c
@@ -19,7 +20,7 @@ ramstage-y += minihd.c
ramstage-y += northbridge.c
ramstage-y += pei_data.c
romstage-y += pei_data.c
-ramstage-$(CONFIG_HAVE_REFCODE_BLOB) += refcode.c
+ramstage-y += refcode.c
CPPFLAGS_common += -Isrc/soc/intel/broadwell/include
diff --git a/src/soc/intel/broadwell/include/soc/ramstage.h b/src/soc/intel/broadwell/include/soc/ramstage.h
index 3900c7339e..13477555c6 100644
--- a/src/soc/intel/broadwell/include/soc/ramstage.h
+++ b/src/soc/intel/broadwell/include/soc/ramstage.h
@@ -6,10 +6,6 @@
#include <device/device.h>
#include <soc/intel/broadwell/chip.h>
-#if CONFIG(HAVE_REFCODE_BLOB)
void broadwell_run_reference_code(void);
-#else
-static inline void broadwell_run_reference_code(void) { }
-#endif
#endif
diff --git a/src/soc/intel/broadwell/refcode.c b/src/soc/intel/broadwell/refcode.c
index ae175b0f68..4edadfa7d2 100644
--- a/src/soc/intel/broadwell/refcode.c
+++ b/src/soc/intel/broadwell/refcode.c
@@ -13,37 +13,10 @@
#include <soc/pm.h>
#include <soc/ramstage.h>
-static pei_wrapper_entry_t load_reference_code(void)
-{
- if (resume_from_stage_cache()) {
- struct prog prog;
- stage_cache_load_stage(STAGE_REFCODE, &prog);
- return prog_entry(&prog);
- }
-
- struct prog prog =
- PROG_INIT(PROG_REFCODE, CONFIG_CBFS_PREFIX "/refcode");
- struct rmod_stage_load refcode = {
- .cbmem_id = CBMEM_ID_REFCODE,
- .prog = &prog,
- };
-
- if (rmodule_stage_load(&refcode)) {
- printk(BIOS_DEBUG, "Error loading reference code.\n");
- return NULL;
- }
-
- /* Cache loaded reference code. */
- stage_cache_add(STAGE_REFCODE, &prog);
-
- return (pei_wrapper_entry_t)prog_entry(&prog);
-}
-
void broadwell_run_reference_code(void)
{
int ret, dummy;
struct pei_data pei_data;
- pei_wrapper_entry_t entry;
memset(&pei_data, 0, sizeof(pei_data));
mainboard_fill_pei_data(&pei_data);
@@ -52,14 +25,10 @@ void broadwell_run_reference_code(void)
pei_data.boot_mode = acpi_is_wakeup_s3() ? ACPI_S3 : 0;
pei_data.saved_data = (void *) &dummy;
- entry = load_reference_code();
- if (entry == NULL) {
- printk(BIOS_ERR, "Reference code not found\n");
- return;
- }
+ extern int ABI_X86 refcode_entry(struct pei_data *pei_data);
/* Call into reference code. */
- ret = entry(&pei_data);
+ ret = refcode_entry(&pei_data);
if (ret != 0) {
printk(BIOS_ERR, "Reference code returned %d\n", ret);
return;
diff --git a/src/soc/intel/broadwell/refcode/Makefile.inc b/src/soc/intel/broadwell/refcode/Makefile.inc
new file mode 100644
index 0000000000..74bd08dfcd
--- /dev/null
+++ b/src/soc/intel/broadwell/refcode/Makefile.inc
@@ -0,0 +1,5 @@
+ramstage-libs += $(obj)/broadwell_refcode.o
+
+$(obj)/%.o: $(src)/soc/intel/broadwell/refcode/%.asm
+ echo "NASM $@"
+ nasm -f elf32 -o $@ $<
diff --git a/src/soc/intel/broadwell/refcode/broadwell_refcode.asm b/src/soc/intel/broadwell/refcode/broadwell_refcode.asm
new file mode 100644
index 0000000000..2ca802859d
--- /dev/null
+++ b/src/soc/intel/broadwell/refcode/broadwell_refcode.asm
@@ -0,0 +1,66464 @@
+;; Generated with r2dumpbin (https://github.com/mytbk/r2dumpbin)
+;; label comments removed
+
+bits 32
+
+global refcode_entry
+
+refcode_entry:
+pushad
+mov eax, dword [esp + 0x24]
+push eax
+call fcn_00000012 ; call 0x12
+pop ecx
+mov dword [esp + 0x1c], eax
+popad
+ret
+
+fcn_00000012:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x1c
+mov esi, dword [ebp + 8]
+push esi
+call fcn_00016434 ; call 0x16434
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+je near loc_000000c4 ; je 0xc4
+sub esp, 0xc
+push ref_00020688 ; push 0x20688
+call fcn_0001545e ; call 0x1545e
+pop eax
+pop edx
+push ebx
+push 0
+call fcn_0000e020 ; call 0xe020
+mov dword [esp], ref_0002069a ; mov dword [esp], 0x2069a
+call fcn_0001545e ; call 0x1545e
+pop ecx
+pop eax
+push ebx
+push 0
+call fcn_0000058b ; call 0x58b
+mov dword [esp], ref_000206b5 ; mov dword [esp], 0x206b5
+call fcn_0001545e ; call 0x1545e
+add esp, 0xc
+push 0
+push 0
+push ebx
+call fcn_0000d87f ; call 0xd87f
+lea eax, [ebp - 0xc]
+push eax
+push 0
+push 0
+push ref_000291dc ; push 0x291dc
+call fcn_0001975d ; call 0x1975d
+mov eax, dword [ebp - 0xc]
+add esp, 0x20
+movzx edx, byte [eax]
+add eax, 0x284
+push edx
+push dword [esi + 0x1a]
+push dword [esi + 0x1e]
+push eax
+call fcn_00011751 ; call 0x11751
+mov eax, dword [ebp - 0xc]
+pop edx
+pop ecx
+push dword [eax + 4]
+push eax
+call fcn_000150af ; call 0x150af
+mov dword [esp], ref_000206c7 ; mov dword [esp], 0x206c7
+call fcn_0001545e ; call 0x1545e
+add esp, 0x10
+xor eax, eax
+jmp short loc_000000c7 ; jmp 0xc7
+
+loc_000000c4:
+or eax, 0xffffffff
+
+loc_000000c7:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_000000ce:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x14
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017ed8 ; call 0x17ed8
+mov ebx, eax
+lea eax, [ebp - 0xc]
+and ebx, 0xfffffffe
+push eax
+push 0
+push 0
+push ref_0002930c ; push 0x2930c
+call fcn_0001975d ; call 0x1975d
+add esp, 0x20
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0000014a ; je 0x14a
+test esi, esi
+jns short loc_0000014a ; jns 0x14a
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00000132 ; je 0x132
+push eax
+push esi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00000132:
+push esi
+push ref_000206f4 ; push 0x206f4
+push 0x126
+push ref_00020708 ; push 0x20708
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000014a:
+push ecx
+push 0x600
+push 0xfffff9ff
+lea eax, [ebx + 0x5f00]
+push eax
+call fcn_00018b68 ; call 0x18b68
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_0000017e ; je 0x17e
+push edx
+push edx
+push ref_00020738 ; push 0x20738
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000017e:
+push eax
+add ebx, 0x5da8
+push eax
+push 3
+push ebx
+call fcn_00018730 ; call 0x18730
+lea esp, [ebp - 8]
+xor eax, eax
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00000197:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+call fcn_0001c678 ; call 0x1c678
+mov esi, eax
+call fcn_0001c651 ; call 0x1c651
+sub esp, 0xc
+push ref_0002955c ; push 0x2955c
+mov ebx, eax
+call fcn_000190fd ; call 0x190fd
+add esp, 0x10
+test eax, eax
+je short loc_000001c4 ; je 0x1c4
+cmp byte [eax + 0x4a], 0
+jne short loc_00000228 ; jne 0x228
+
+loc_000001c4:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000001de ; je 0x1de
+push eax
+push eax
+push ref_00020774 ; push 0x20774
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000001de:
+test esi, esi
+jne short loc_000001ea ; jne 0x1ea
+cmp ebx, 0x40670
+je short loc_000001fc ; je 0x1fc
+
+loc_000001ea:
+push esi
+push 0
+push 1
+push 0x2e7
+call fcn_0001790f ; call 0x1790f
+add esp, 0x10
+
+loc_000001fc:
+cmp ebx, 0x40670
+je short loc_0000020c ; je 0x20c
+cmp ebx, 0x306d0
+jne short loc_00000228 ; jne 0x228
+
+loc_0000020c:
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+push 1
+sub eax, 0xffffff80
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+
+loc_00000228:
+lea esp, [ebp - 8]
+xor eax, eax
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00000231:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 8]
+call fcn_0001c651 ; call 0x1c651
+push edx
+mov esi, eax
+push 0
+and esi, 0xffffffef
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+xor edx, edx
+mov edi, eax
+mov eax, dword [ebx + 1]
+mov eax, dword [eax + 4]
+push edx
+or eax, 1
+push eax
+lea eax, [edi + 0x48]
+push eax
+call fcn_00017f28 ; call 0x17f28
+mov eax, dword [ebx + 1]
+add esp, 0xc
+xor edx, edx
+mov eax, dword [eax + 8]
+push edx
+or eax, 1
+push eax
+lea eax, [edi + 0x68]
+add edi, 0x40
+push eax
+call fcn_00017f28 ; call 0x17f28
+mov eax, dword [ebx + 1]
+add esp, 0xc
+xor edx, edx
+mov eax, dword [eax + 0xc]
+push edx
+or eax, 1
+push eax
+push edi
+call fcn_00017f28 ; call 0x17f28
+mov ecx, dword [ebx + 1]
+add esp, 0xc
+xor edx, edx
+mov eax, dword [ecx + 0x18]
+push edx
+or eax, 1
+push eax
+mov eax, dword [ecx + 4]
+add eax, 0x5420
+push eax
+call fcn_00017f28 ; call 0x17f28
+add esp, 0x10
+cmp esi, 0x40660
+jne short loc_000002e8 ; jne 0x2e8
+mov ecx, dword [ebx + 1]
+xor edx, edx
+push eax
+mov eax, dword [ecx + 0x22]
+push edx
+or eax, 1
+push eax
+mov eax, dword [ecx + 4]
+add eax, 0x5408
+push eax
+call fcn_00017f28 ; call 0x17f28
+add esp, 0x10
+
+loc_000002e8:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000002f0:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+mov eax, dword [ebp + 8]
+push 1
+mov eax, dword [eax + 1]
+mov eax, dword [eax + 4]
+add eax, 0x5f00
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+leave
+ret
+
+fcn_00000311:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov ebx, dword [ebp + 0xc]
+lea eax, [ebp - 0x20]
+push eax
+push 0x73
+push 4
+call fcn_000197df ; call 0x197df
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00000371 ; je 0x371
+test esi, esi
+jns short loc_00000371 ; jns 0x371
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00000359 ; je 0x359
+push eax
+push esi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00000359:
+push edi
+push ref_000206f4 ; push 0x206f4
+push 0x18b
+push ref_00020708 ; push 0x20708
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00000371:
+mov eax, dword [ebp - 0x20]
+mov esi, ref_0002955c ; mov esi, 0x2955c
+mov ecx, 4
+lea edi, [eax + 8]
+add eax, 0x18
+rep movsd ; rep movsd dword es:[edi], dword ptr [esi]
+push edi
+push edi
+push 8
+push eax
+call fcn_00016fff ; call 0x16fff
+pop eax
+mov eax, dword [ebp - 0x20]
+pop edx
+add eax, 0x20
+push 8
+push eax
+call fcn_00016fff ; call 0x16fff
+mov eax, dword [ebp - 0x20]
+pop ecx
+pop esi
+add eax, 0x29
+push 0x21
+push eax
+call fcn_00016fff ; call 0x16fff
+mov eax, dword [ebp - 0x20]
+add esp, 0x10
+mov byte [eax + 0x28], 0
+mov byte [eax + 0x71], 0
+cmp byte [ebx], 1
+jbe short loc_000003ce ; jbe 0x3ce
+mov edx, dword [ebx + 0xd]
+mov dl, byte [edx + 0x49]
+mov byte [eax + 0x4a], dl
+jmp short loc_000003d2 ; jmp 0x3d2
+
+loc_000003ce:
+mov byte [eax + 0x4a], 0
+
+loc_000003d2:
+mov edx, dword [ebx + 5]
+mov dl, byte [edx + 7]
+mov byte [eax + 0x72], dl
+lea eax, [ebp - 0x1c]
+push eax
+push 0
+push 0
+push ref_0002928c ; push 0x2928c
+call fcn_0001975d ; call 0x1975d
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00000434 ; je 0x434
+test ebx, ebx
+jns short loc_00000434 ; jns 0x434
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000041c ; je 0x41c
+push esi
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000041c:
+push ecx
+push ref_000206f4 ; push 0x206f4
+push 0x1a6
+push ref_00020708 ; push 0x20708
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00000434:
+mov eax, dword [ebp - 0x1c]
+mov edx, dword [eax + 9]
+cmp dword [edx + 4], 0
+je short loc_00000469 ; je 0x469
+mov ebx, dword [ebp - 0x20]
+mov byte [ebx + 0x18], 1
+mov edx, dword [eax + 1]
+cmp byte [edx], 0
+jns short loc_00000469 ; jns 0x469
+push edx
+push 0x14
+mov eax, dword [eax + 9]
+mov eax, dword [eax + 4]
+push dword [eax + 0x1c]
+push dword [eax + 0x18]
+call fcn_0001724f ; call 0x1724f
+add esp, 0x10
+mov byte [ebx + 0x19], al
+
+loc_00000469:
+mov eax, dword [ebp - 0x20]
+mov edx, dword [ebp - 0x1c]
+mov byte [eax + 0x20], 2
+mov ecx, dword [edx + 1]
+test byte [ecx], 0x10
+je short loc_00000489 ; je 0x489
+mov edx, dword [edx + 9]
+mov edx, dword [edx]
+mov dl, byte [edx + 0x301]
+mov byte [eax + 0x21], dl
+
+loc_00000489:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000004a3 ; je 0x4a3
+push eax
+push eax
+push ref_0002078e ; push 0x2078e
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000004a3:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000004ad:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000004cf ; je 0x4cf
+push eax
+push eax
+push ref_000207a5 ; push 0x207a5
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000004cf:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000004ea ; je 0x4ea
+push eax
+push 2
+push ref_000207e9 ; push 0x207e9
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000004ea:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00000505 ; je 0x505
+push eax
+push 6
+push ref_0002082d ; push 0x2082d
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00000505:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00000520 ; je 0x520
+push eax
+push 0
+push ref_00020871 ; push 0x20871
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00000520:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000053b ; je 0x53b
+push eax
+push 0
+push ref_000208b5 ; push 0x208b5
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000053b:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00000555 ; je 0x555
+push eax
+push eax
+push ref_000208f9 ; push 0x208f9
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00000555:
+push eax
+push eax
+movzx eax, byte [ebx]
+push eax
+mov eax, dword [ebx + 1]
+mov eax, dword [eax + 8]
+add eax, 0x71c
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop edx
+pop ecx
+push 0x2060000
+mov eax, dword [ebx + 1]
+mov eax, dword [eax + 8]
+add eax, 0x720
+push eax
+call fcn_00017e8f ; call 0x17e8f
+xor eax, eax
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000058b:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov esi, dword [ebp + 0xc]
+call fcn_0001c651 ; call 0x1c651
+mov edi, eax
+lea eax, [ebp - 0x24]
+push eax
+push 0
+push 0
+push ref_0002930c ; push 0x2930c
+call fcn_0001975d ; call 0x1975d
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_000005f7 ; je 0x5f7
+test ebx, ebx
+jns short loc_000005f7 ; jns 0x5f7
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000005df ; je 0x5df
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000005df:
+push ebx
+push ref_000206f4 ; push 0x206f4
+push 0x8e
+push ref_00020708 ; push 0x20708
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000005f7:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00000611 ; je 0x611
+push ecx
+push ecx
+push ref_0002093d ; push 0x2093d
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00000611:
+sub esp, 0xc
+push dword [ebp - 0x24]
+call fcn_00000231 ; call 0x231
+pop eax
+pop edx
+push dword [ebp - 0x24]
+push esi
+call fcn_00000311 ; call 0x311
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00000644 ; je 0x644
+push eax
+push eax
+push ref_00020952 ; push 0x20952
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00000644:
+sub esp, 0xc
+push dword [ebp - 0x24]
+call fcn_000004ad ; call 0x4ad
+add esp, 0x10
+cmp edi, 0x40660
+sete bl
+cmp edi, 0x306c0
+sete al
+or bl, al
+je short loc_00000684 ; je 0x684
+
+loc_00000668:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000006b0 ; je 0x6b0
+push ecx
+push ecx
+push ref_00020972 ; push 0x20972
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp short loc_000006b0 ; jmp 0x6b0
+
+loc_00000684:
+cmp edi, 0x40670
+jne near loc_00000714 ; jne 0x714
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+jne short loc_00000668 ; jne 0x668
+jmp short loc_000006e6 ; jmp 0x6e6
+
+loc_000006b0:
+push edx
+push edx
+push dword [ebp - 0x24]
+push esi
+call fcn_0000211b ; call 0x211b
+add esp, 0x10
+test bl, bl
+je short loc_000006de ; je 0x6de
+
+loc_000006c2:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00000706 ; je 0x706
+push eax
+push eax
+push ref_00020984 ; push 0x20984
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp short loc_00000706 ; jmp 0x706
+
+loc_000006de:
+cmp edi, 0x40670
+jne short loc_00000714 ; jne 0x714
+
+loc_000006e6:
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+jne short loc_000006c2 ; jne 0x6c2
+jmp short loc_00000714 ; jmp 0x714
+
+loc_00000706:
+push eax
+push eax
+push dword [ebp - 0x24]
+push esi
+call fcn_00004b08 ; call 0x4b08
+add esp, 0x10
+
+loc_00000714:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000072e ; je 0x72e
+push eax
+push eax
+push ref_0002099a ; push 0x2099a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000072e:
+push eax
+push eax
+push dword [ebp - 0x24]
+push esi
+call fcn_00001663 ; call 0x1663
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00000756 ; je 0x756
+push eax
+push eax
+push ref_000209b1 ; push 0x209b1
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00000756:
+push edi
+push edi
+push dword [ebp - 0x24]
+push esi
+call fcn_000009ac ; call 0x9ac
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_0000077e ; je 0x77e
+push ebx
+push ebx
+push ref_000209d9 ; push 0x209d9
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000077e:
+push ecx
+push ecx
+push dword [ebp - 0x24]
+push esi
+call fcn_00001e49 ; call 0x1e49
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_000007a6 ; je 0x7a6
+push edx
+push edx
+push ref_000209f9 ; push 0x209f9
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000007a6:
+sub esp, 0xc
+push dword [ebp - 0x24]
+call fcn_000002f0 ; call 0x2f0
+mov dword [esp], ref_00026ee4 ; mov dword [esp], 0x26ee4
+call fcn_0001977f ; call 0x1977f
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00000804 ; je 0x804
+test ebx, ebx
+jns short loc_00000804 ; jns 0x804
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000007ec ; je 0x7ec
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000007ec:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0xde
+push ref_00020708 ; push 0x20708
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00000804:
+sub esp, 0xc
+lea eax, [ebp - 0x20]
+push eax
+call fcn_00019797 ; call 0x19797
+mov ebx, eax
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00000831 ; je 0x831
+push eax
+push dword [ebp - 0x20]
+push ref_00020a16 ; push 0x20a16
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00000831:
+test ebx, ebx
+jne short loc_000008a9 ; jne 0x8a9
+cmp dword [ebp - 0x20], 0x11
+jne short loc_000008a9 ; jne 0x8a9
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00000855 ; je 0x855
+push eax
+push eax
+push ref_00020a2a ; push 0x20a2a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00000855:
+sub esp, 0xc
+push ref_00026ed8 ; push 0x26ed8
+call fcn_0001977f ; call 0x1977f
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je near loc_00000949 ; je 0x949
+test ebx, ebx
+jns near loc_00000949 ; jns 0x949
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00000899 ; je 0x899
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00000899:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0xe8
+jmp near loc_0000093c ; jmp 0x93c
+
+loc_000008a9:
+lea eax, [ebp - 0x1c]
+push eax
+push 0
+push 0
+push ref_0002932c ; push 0x2932c
+mov dword [ebp - 0x1c], 0
+call fcn_0001975d ; call 0x1975d
+mov eax, dword [ebp - 0x1c]
+add esp, 0x10
+test eax, eax
+je short loc_00000949 ; je 0x949
+test byte [eax + 1], 1
+je short loc_00000949 ; je 0x949
+call fcn_00016627 ; call 0x16627
+dec al
+jne short loc_00000949 ; jne 0x949
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000008f5 ; je 0x8f5
+push edi
+push edi
+push ref_00020a4e ; push 0x20a4e
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000008f5:
+sub esp, 0xc
+push ref_00026ed8 ; push 0x26ed8
+call fcn_0001977f ; call 0x1977f
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00000949 ; je 0x949
+test ebx, ebx
+jns short loc_00000949 ; jns 0x949
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00000931 ; je 0x931
+push esi
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00000931:
+push ecx
+push ref_000206f4 ; push 0x206f4
+push 0xf8
+
+loc_0000093c:
+push ref_00020708 ; push 0x20708
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00000949:
+sub esp, 0xc
+push ref_00026ef0 ; push 0x26ef0
+call fcn_0001972b ; call 0x1972b
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000099d ; je 0x99d
+test ebx, ebx
+jns short loc_0000099d ; jns 0x99d
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00000985 ; je 0x985
+push edx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00000985:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x102
+push ref_00020708 ; push 0x20708
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000099d:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000009a7:
+push ebp
+mov ebp, esp
+pop ebp
+ret
+
+fcn_000009ac:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x3c
+mov ebx, dword [ebp + 0xc]
+call fcn_0001c651 ; call 0x1c651
+mov dword [ebp - 0x34], 0
+mov edi, eax
+mov eax, dword [ebx + 0x11]
+cmp byte [eax + 0xb], 0
+jne short loc_000009f7 ; jne 0x9f7
+call fcn_00015479 ; call 0x15479
+xor ebx, ebx
+test al, al
+je near loc_00000d16 ; je 0xd16
+push ecx
+push ecx
+push ref_00020a83 ; push 0x20a83
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp near loc_00000d16 ; jmp 0xd16
+
+loc_000009f7:
+push eax
+push eax
+push 7
+lea eax, [ebp - 0x26]
+push eax
+call fcn_00016fff ; call 0x16fff
+pop eax
+pop edx
+lea eax, [ebp - 0x1f]
+push 7
+push eax
+call fcn_00016fff ; call 0x16fff
+lea eax, [ebp - 0x30]
+push eax
+push 0
+push 0
+push ref_0002919c ; push 0x2919c
+call fcn_0001975d ; call 0x1975d
+add esp, 0x20
+mov dword [ebp - 0x3c], eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00000a6c ; je 0xa6c
+cmp dword [ebp - 0x3c], 0
+jns short loc_00000a6c ; jns 0xa6c
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00000a57 ; je 0xa57
+push eax
+push dword [ebp - 0x3c]
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00000a57:
+push esi
+push ref_000206f4 ; push 0x206f4
+push 0x54
+push ref_00020ac3 ; push 0x20ac3
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00000a6c:
+push ecx
+and edi, 0xfff0ff0
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017ed8 ; call 0x17ed8
+add esp, 0x10
+cmp edi, 0x40670
+jne near loc_00000b4a ; jne 0xb4a
+mov edx, dword [ebx + 0x11]
+cmp byte [edx + 0x10], 0
+je near loc_00000b4a ; je 0xb4a
+and eax, 0xfffffffe
+mov esi, eax
+mov eax, dword [ebx + 9]
+mov eax, dword [eax + 0x64]
+cmp eax, 0x7735940
+je short loc_00000ada ; je 0xada
+ja short loc_00000ac6 ; ja 0xac6
+cmp eax, 0x5f5e100
+jne short loc_00000af3 ; jne 0xaf3
+push edx
+push edx
+push 1
+jmp short loc_00000ae4 ; jmp 0xae4
+
+loc_00000ac6:
+cmp eax, 0x9f437c0
+je short loc_00000ae0 ; je 0xae0
+cmp eax, 0xee6b280
+jne short loc_00000af3 ; jne 0xaf3
+push eax
+push eax
+push 0xe
+jmp short loc_00000ae4 ; jmp 0xae4
+
+loc_00000ada:
+push eax
+push eax
+push 6
+jmp short loc_00000ae4 ; jmp 0xae4
+
+loc_00000ae0:
+push eax
+push eax
+push 0xa
+
+loc_00000ae4:
+lea eax, [esi + 0x5da0]
+push eax
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+
+loc_00000af3:
+push eax
+push eax
+push 0x80000014
+lea eax, [esi + 0x5da4]
+push eax
+call fcn_00017e8f ; call 0x17e8f
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00000b2a ; je 0xb2a
+push eax
+mov eax, dword [ebx + 0x11]
+movzx eax, byte [eax + 0x10]
+push eax
+push ref_00020af1 ; push 0x20af1
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00000b2a:
+push eax
+add esi, 0x5e08
+push eax
+mov eax, dword [ebx + 0x11]
+mov al, byte [eax + 0x10]
+and eax, 0x7f
+or eax, 0x80000000
+push eax
+push esi
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+
+loc_00000b4a:
+mov dword [ebp - 0x40], 1
+
+loc_00000b51:
+mov ecx, dword [ebp - 0x40]
+cmp cl, 1
+mov eax, ecx
+mov byte [ebp - 0x41], cl
+sete cl
+sub eax, 3
+cmp al, 2
+mov byte [ebp - 0x43], cl
+setbe byte [ebp - 0x42]
+jbe short loc_00000b75 ; jbe 0xb75
+test cl, cl
+je near loc_00000d06 ; je 0xd06
+
+loc_00000b75:
+push ecx
+push ecx
+push 5
+lea eax, [ebp - 0x2b]
+push eax
+call fcn_00016fff ; call 0x16fff
+mov al, byte [ebp - 0x41]
+pop esi
+pop edi
+mov byte [ebp - 0x27], al
+lea eax, [ebp - 0x34]
+push eax
+lea eax, [ebp - 0x2b]
+push eax
+call fcn_0001d3a2 ; call 0x1d3a2
+add esp, 0x10
+cmp dword [ebp - 0x34], 0
+mov dword [ebp - 0x3c], eax
+jne near loc_00000ce5 ; jne 0xce5
+cmp byte [ebp - 0x2a], 0
+jne short loc_00000bbd ; jne 0xbbd
+cmp byte [ebp - 0x29], 0
+jne short loc_00000bbd ; jne 0xbbd
+cmp byte [ebp - 0x28], 0
+je near loc_00000ccf ; je 0xccf
+
+loc_00000bbd:
+push edi
+push edi
+push 7
+lea edi, [ebp - 0x26]
+push edi
+call fcn_00016fff ; call 0x16fff
+mov al, byte [ebp - 0x41]
+mov byte [ebp - 0x20], al
+pop eax
+pop edx
+lea eax, [ebp - 0x34]
+push eax
+push edi
+call fcn_0001d1f5 ; call 0x1d1f5
+add esp, 0x10
+mov dword [ebp - 0x3c], eax
+test eax, eax
+jne near loc_00000d06 ; jne 0xd06
+cmp dword [ebp - 0x34], 0
+jne near loc_00000d06 ; jne 0xd06
+push esi
+push esi
+push 7
+lea esi, [ebp - 0x1f]
+push esi
+call fcn_00016fff ; call 0x16fff
+mov al, byte [ebp - 0x41]
+add esp, 0x10
+cmp byte [ebp - 0x43], 0
+mov byte [ebp - 0x19], al
+je short loc_00000c7a ; je 0xc7a
+mov eax, dword [ebx + 0x11]
+mov dx, word [eax + 6]
+mov byte [ebp - 0x1f], dl
+mov dl, byte [eax + 0xa]
+mov byte [ebp - 0x1e], dl
+test dl, dl
+jne short loc_00000c2a ; jne 0xc2a
+mov dx, word [eax + 4]
+jmp short loc_00000c2e ; jmp 0xc2e
+
+loc_00000c2a:
+mov dx, word [eax + 2]
+
+loc_00000c2e:
+mov word [ebp - 0x1d], dx
+mov ax, word [eax]
+push ecx
+push 7
+push edi
+push esi
+mov word [ebp - 0x1b], ax
+call fcn_00017067 ; call 0x17067
+add esp, 0x10
+test al, al
+
+loc_00000c48:
+je near loc_00000d06 ; je 0xd06
+mov eax, dword [ebp - 0x30]
+sub esp, 0xc
+push 0x3c
+call dword [eax] ; ucall
+add esp, 0xc
+mov ecx, 7
+lea eax, [ebp - 0x34]
+push eax
+push edx
+push edx
+mov edi, esp
+rep movsb ; rep movsb byte es:[edi], byte ptr [esi]
+call fcn_0001d27c ; call 0x1d27c
+add esp, 0x10
+mov esi, eax
+test eax, eax
+je short loc_00000cb2 ; je 0xcb2
+jmp short loc_00000cb8 ; jmp 0xcb8
+
+loc_00000c7a:
+cmp byte [ebp - 0x42], 0
+je near loc_00000d06 ; je 0xd06
+mov cl, byte [ebp - 0x41]
+mov eax, dword [ebx + 0x11]
+cmp cl, 4
+je short loc_00000c9a ; je 0xc9a
+cmp cl, 5
+je short loc_00000ca0 ; je 0xca0
+mov ax, word [eax + 8]
+jmp short loc_00000ca4 ; jmp 0xca4
+
+loc_00000c9a:
+mov ax, word [eax + 0xc]
+jmp short loc_00000ca4 ; jmp 0xca4
+
+loc_00000ca0:
+mov ax, word [eax + 0xe]
+
+loc_00000ca4:
+mov word [ebp - 0x1b], ax
+mov ax, word [ebp - 0x22]
+cmp word [ebp - 0x1b], ax
+jmp short loc_00000c48 ; jmp 0xc48
+
+loc_00000cb2:
+cmp dword [ebp - 0x34], 0
+je short loc_00000d06 ; je 0xd06
+
+loc_00000cb8:
+call fcn_00015479 ; call 0x15479
+mov dword [ebp - 0x3c], esi
+test al, al
+je short loc_00000d06 ; je 0xd06
+push dword [ebp - 0x34]
+push esi
+push ref_00020b17 ; push 0x20b17
+jmp short loc_00000cf9 ; jmp 0xcf9
+
+loc_00000ccf:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00000d06 ; je 0xd06
+push eax
+push dword [ebp - 0x40]
+push ref_00020b60 ; push 0x20b60
+push 0x40
+jmp short loc_00000cfe ; jmp 0xcfe
+
+loc_00000ce5:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00000d06 ; je 0xd06
+push dword [ebp - 0x40]
+push dword [ebp - 0x34]
+push ref_00020b89 ; push 0x20b89
+
+loc_00000cf9:
+push 0x80000000
+
+loc_00000cfe:
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00000d06:
+inc dword [ebp - 0x40]
+cmp dword [ebp - 0x40], 6
+jne near loc_00000b51 ; jne 0xb51
+mov ebx, dword [ebp - 0x3c]
+
+loc_00000d16:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00000d20:
+push ebp
+mov ebp, esp
+push edi
+push esi
+mov esi, 0x10
+push ebx
+sub esp, 0x20
+mov eax, dword [ebp + 0x14]
+mov dword [eax], 0
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00016c9a ; call 0x16c9a
+mov dword [ebp - 0x1c], eax
+add eax, 0xb
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+cmp al, 6
+je short loc_00000dd5 ; je 0xdd5
+
+loc_00000d5a:
+mov eax, dword [ebp - 0x1c]
+sub esp, 0xc
+lea ebx, [esi + eax]
+push ebx
+call fcn_00017e4e ; call 0x17e4e
+mov edi, eax
+pop eax
+pop edx
+push 0
+push ebx
+call fcn_00018b3e ; call 0x18b3e
+pop ecx
+pop eax
+push 0xffffffffffffffff
+push ebx
+call fcn_00018b14 ; call 0x18b14
+mov dword [esp], ebx
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+cmp edi, eax
+je short loc_00000d96 ; je 0xd96
+test edi, 1
+je short loc_00000da4 ; je 0xda4
+
+loc_00000d96:
+push ecx
+push ecx
+push edi
+push ebx
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+jmp short loc_00000dcd ; jmp 0xdcd
+
+loc_00000da4:
+sub esp, 0xc
+push ebx
+call fcn_00017e4e ; call 0x17e4e
+mov edx, dword [ebp + 0x14]
+and eax, 0xfffffff0
+sub dword [edx], eax
+pop eax
+pop edx
+push edi
+and edi, 6
+push ebx
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+cmp edi, 4
+lea eax, [esi + 4]
+cmove esi, eax
+
+loc_00000dcd:
+add esi, 4
+cmp esi, 0x24
+jbe short loc_00000d5a ; jbe 0xd5a
+
+loc_00000dd5:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00000ddd:
+push ebp
+mov ebp, esp
+push edi
+xor edi, edi
+push esi
+xor esi, esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov dword [ebp - 0x24], eax
+mov byte [ebp - 0x19], al
+movzx eax, al
+mov dword [ebp - 0x20], eax
+
+loc_00000df9:
+push eax
+push 0
+push esi
+push dword [ebp - 0x20]
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+mov ebx, eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+je near loc_00000e9b ; je 0xe9b
+sub esp, 0xc
+lea eax, [ebx + 0xa]
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+cmp ax, 0x604
+jne short loc_00000e9b ; jne 0xe9b
+mov al, byte [ebp - 0x19]
+inc eax
+mov byte [ebp - 0x19], al
+push eax
+push eax
+push dword [ebp - 0x20]
+lea eax, [ebx + 0x18]
+push eax
+call fcn_00017da5 ; call 0x17da5
+movzx edi, byte [ebp - 0x19]
+lea eax, [ebx + 0x19]
+pop edx
+add ebx, 0x1a
+pop ecx
+push edi
+push eax
+call fcn_00017da5 ; call 0x17da5
+pop eax
+pop edx
+push 0xff
+push ebx
+call fcn_00017da5 ; call 0x17da5
+add esp, 0xc
+push 0
+push 0
+push edi
+call fcn_00016c9a ; call 0x16c9a
+pop ecx
+pop edx
+push 0
+push eax
+call fcn_00017e04 ; call 0x17e04
+mov dword [esp], edi
+call fcn_00000ddd ; call 0xddd
+pop ecx
+mov edi, eax
+pop eax
+mov eax, edi
+movzx eax, al
+push eax
+push ebx
+call fcn_00017da5 ; call 0x17da5
+mov eax, edi
+add esp, 0x10
+mov byte [ebp - 0x19], al
+
+loc_00000e9b:
+inc esi
+cmp esi, 0x20
+jne near loc_00000df9 ; jne 0xdf9
+mov eax, edi
+test al, al
+mov al, byte [ebp - 0x24]
+cmovne eax, edi
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00000eb7:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x2c
+lea eax, [ebp - 0x1c]
+push eax
+push 0
+push 0
+push ref_000290cc ; push 0x290cc
+mov dword [ebp - 0x20], 0
+call fcn_0001975d ; call 0x1975d
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00000f20 ; je 0xf20
+test ebx, ebx
+jns short loc_00000f20 ; jns 0xf20
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00000f08 ; je 0xf08
+push esi
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00000f08:
+push ebx
+push ref_000206f4 ; push 0x206f4
+push 0x2d0
+push ref_00020bd2 ; push 0x20bd2
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00000f20:
+mov byte [ebp - 0x29], 0
+mov esi, 0x10100
+xor ebx, ebx
+
+loc_00000f2b:
+call fcn_0001c1bf ; call 0x1c1bf
+cmp bl, al
+jae near loc_00000fc0 ; jae 0xfc0
+movzx eax, bl
+push ecx
+push eax
+push 0x1c
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+mov edi, eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_00000fba ; je 0xfba
+push eax
+push eax
+push esi
+lea eax, [edi + 0x18]
+push eax
+call fcn_00017e8f ; call 0x17e8f
+lea eax, [edi + 0x19]
+add edi, 0x1a
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+pop edx
+pop ecx
+push 0xff
+push edi
+mov esi, eax
+call fcn_00017da5 ; call 0x17da5
+add esp, 0xc
+mov eax, esi
+push 0
+movzx esi, al
+push 0
+push esi
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+push 0
+push eax
+call fcn_00017e04 ; call 0x17e04
+mov dword [esp], esi
+call fcn_00000ddd ; call 0xddd
+movzx esi, al
+mov byte [ebp - 0x29], al
+pop eax
+pop edx
+push esi
+inc esi
+push edi
+call fcn_00017da5 ; call 0x17da5
+shl esi, 8
+add esp, 0x10
+
+loc_00000fba:
+inc ebx
+jmp near loc_00000f2b ; jmp 0xf2b
+
+loc_00000fc0:
+mov byte [ebp - 0x2b], 0
+mov byte [ebp - 0x2d], 1
+
+loc_00000fc8:
+mov al, byte [ebp - 0x29]
+mov dl, byte [ebp - 0x2d]
+cmp dl, al
+ja near loc_000010df ; ja 0x10df
+xor ebx, ebx
+movzx esi, dl
+
+loc_00000fdb:
+push eax
+push 0
+push ebx
+push esi
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+mov edi, eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+je near loc_000010a3 ; je 0x10a3
+sub esp, 0xc
+add edi, 0xe
+push edi
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x2c], 0
+mov byte [ebp - 0x2a], al
+sar byte [ebp - 0x2a], 7
+and byte [ebp - 0x2a], 7
+
+loc_00001018:
+movzx edi, byte [ebp - 0x2c]
+push eax
+push edi
+push ebx
+push esi
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_00001094 ; je 0x1094
+lea eax, [ebp - 0x20]
+push eax
+push edi
+push ebx
+push esi
+call fcn_00000d20 ; call 0xd20
+mov ecx, dword [ebp + 0xc]
+add esp, 0xc
+mov eax, dword [ebp - 0x20]
+add dword [ecx], eax
+push edi
+push ebx
+push esi
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xa
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+cmp ax, 0x300
+jne short loc_00001094 ; jne 0x1094
+cmp byte [ebp - 0x2b], 1
+je short loc_00001090 ; je 0x1090
+mov eax, dword [ebp + 0x10]
+mov dword [eax], 2
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00001090 ; je 0x1090
+push eax
+push eax
+push ref_00020c04 ; push 0x20c04
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00001090:
+mov byte [ebp - 0x2b], 1
+
+loc_00001094:
+inc byte [ebp - 0x2c]
+mov al, byte [ebp - 0x2a]
+cmp byte [ebp - 0x2c], al
+jbe near loc_00001018 ; jbe 0x1018
+
+loc_000010a3:
+inc ebx
+cmp ebx, 0x20
+jne near loc_00000fdb ; jne 0xfdb
+inc byte [ebp - 0x2d]
+jmp near loc_00000fc8 ; jmp 0xfc8
+
+loc_000010b5:
+movzx edi, byte [ebp - 0x29]
+xor ebx, ebx
+
+loc_000010bb:
+push eax
+push 0
+push ebx
+push edi
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+mov esi, eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_000010e9 ; jne 0x10e9
+
+loc_000010d6:
+inc ebx
+cmp ebx, 0x20
+jne short loc_000010bb ; jne 0x10bb
+dec byte [ebp - 0x29]
+
+loc_000010df:
+cmp byte [ebp - 0x29], 0
+jne short loc_000010b5 ; jne 0x10b5
+xor ebx, ebx
+jmp short loc_00001110 ; jmp 0x1110
+
+loc_000010e9:
+sub esp, 0xc
+lea eax, [esi + 0xa]
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+cmp ax, 0x604
+jne short loc_000010d6 ; jne 0x10d6
+push eax
+add esi, 0x18
+push eax
+push 0
+push esi
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+jmp short loc_000010d6 ; jmp 0x10d6
+
+loc_00001110:
+call fcn_0001c1bf ; call 0x1c1bf
+cmp bl, al
+jae short loc_0000113a ; jae 0x113a
+push eax
+movzx eax, bl
+push eax
+inc ebx
+push 0x1c
+push 0
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+push 0
+add eax, 0x18
+push eax
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+jmp short loc_00001110 ; jmp 0x1110
+
+loc_0000113a:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00001142:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x30
+movzx eax, byte [ebp + 0x10]
+movzx edx, byte [ebp + 0xc]
+movzx ecx, byte [ebp + 8]
+push eax
+push edx
+push ecx
+mov dword [ebp - 0x38], ecx
+mov dword [ebp - 0x34], edx
+mov dword [ebp - 0x30], eax
+call fcn_00016c9a ; call 0x16c9a
+mov ebx, eax
+pop eax
+pop edx
+lea eax, [ebx + 0x19]
+add ebx, 0x1a
+push 1
+push eax
+call fcn_00017da5 ; call 0x17da5
+pop ecx
+pop esi
+lea esi, [ebp - 0x1c]
+push 0xff
+push ebx
+call fcn_00017da5 ; call 0x17da5
+add esp, 0xc
+push 0
+push 0
+push 1
+call fcn_00016c9a ; call 0x16c9a
+pop edi
+pop edx
+push 0
+push eax
+call fcn_00017e04 ; call 0x17e04
+mov dword [esp], 1
+call fcn_00000ddd ; call 0xddd
+add esp, 0x10
+mov byte [ebp - 0x2b], 0
+mov byte [ebp - 0x2a], 1
+mov byte [ebp - 0x29], al
+
+loc_000011bc:
+mov al, byte [ebp - 0x29]
+mov dl, byte [ebp - 0x2a]
+cmp dl, al
+ja near loc_00001251 ; ja 0x1251
+xor ebx, ebx
+movzx edi, dl
+
+loc_000011cf:
+push eax
+push 0
+push ebx
+push edi
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_00001222 ; je 0x1222
+push esi
+push 0
+push ebx
+push edi
+call fcn_00000d20 ; call 0xd20
+mov ecx, dword [ebp + 0x14]
+add esp, 0xc
+mov eax, dword [ebp - 0x1c]
+add dword [ecx], eax
+push 0
+push ebx
+push edi
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xa
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+cmp ax, 0x300
+je short loc_0000121e ; je 0x121e
+dec ax
+jne short loc_00001222 ; jne 0x1222
+
+loc_0000121e:
+mov byte [ebp - 0x2b], 1
+
+loc_00001222:
+inc ebx
+cmp ebx, 0x20
+jne short loc_000011cf ; jne 0x11cf
+inc byte [ebp - 0x2a]
+jmp short loc_000011bc ; jmp 0x11bc
+
+loc_0000122d:
+push eax
+push 0
+push ebx
+push edi
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+mov esi, eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_0000125f ; jne 0x125f
+
+loc_00001248:
+inc ebx
+cmp ebx, 0x20
+jne short loc_0000122d ; jne 0x122d
+dec byte [ebp - 0x29]
+
+loc_00001251:
+mov al, byte [ebp - 0x29]
+test al, al
+je short loc_00001286 ; je 0x1286
+xor ebx, ebx
+movzx edi, al
+jmp short loc_0000122d ; jmp 0x122d
+
+loc_0000125f:
+sub esp, 0xc
+lea eax, [esi + 0xa]
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+cmp ax, 0x604
+jne short loc_00001248 ; jne 0x1248
+push eax
+add esi, 0x18
+push eax
+push 0
+push esi
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+jmp short loc_00001248 ; jmp 0x1248
+
+loc_00001286:
+push eax
+push dword [ebp - 0x30]
+push dword [ebp - 0x34]
+push dword [ebp - 0x38]
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+push 0
+add eax, 0x18
+push eax
+call fcn_00017e8f ; call 0x17e8f
+mov al, byte [ebp - 0x2b]
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000012ad:
+push ebp
+mov ecx, 0xf
+mov ebp, esp
+push edi
+push esi
+mov esi, ref_000203a0 ; mov esi, 0x203a0
+push ebx
+sub esp, 0x50
+mov al, byte [ebp + 0xc]
+lea edi, [ebp - 0x27]
+rep movsb ; rep movsb byte es:[edi], byte ptr [esi]
+lea edi, [ebp - 0x27]
+push 0
+push 0
+push 1
+mov byte [ebp - 0x4f], al
+mov al, byte [ebp + 0x14]
+mov dword [ebp - 0x2c], 0
+mov byte [ebp - 0x50], al
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0
+push 0
+mov esi, eax
+mov dword [ebp - 0x48], eax
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x54
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0xc
+push 0
+push 2
+push 0
+mov word [ebp - 0x3c], ax
+and word [ebp - 0x3c], 0xe
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+mov byte [ebp - 0x39], 0xff
+inc ax
+mov eax, esi
+setne byte [ebp - 0x4e]
+add eax, 0xe
+mov dword [ebp - 0x54], eax
+
+loc_00001338:
+mov al, byte [edi]
+mov bx, word [edi + 3]
+mov cl, al
+mov byte [ebp - 0x4c], al
+mov al, byte [edi + 1]
+mov dl, al
+mov byte [ebp - 0x4d], al
+movzx eax, byte [edi + 2]
+push esi
+push eax
+mov byte [ebp - 0x3a], al
+movzx eax, dl
+push eax
+movzx eax, cl
+push eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0x10
+mov esi, eax
+test word [ebp - 0x3c], bx
+je near loc_00001534 ; je 0x1534
+sub esp, 0xc
+lea eax, [eax + 0xba]
+push eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0x40
+je near loc_00001534 ; je 0x1534
+push edx
+push 0x10100
+push 0xff0000ff
+lea eax, [esi + 0x18]
+push eax
+mov dword [ebp - 0x40], eax
+call fcn_00018b68 ; call 0x18b68
+pop ecx
+pop ebx
+mov ebx, dword [ebp - 0x48]
+push 0
+push ebx
+call fcn_00017e04 ; call 0x17e04
+mov dword [esp], ebx
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+je near loc_00001534 ; je 0x1534
+sub esp, 0xc
+push dword [ebp - 0x54]
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x44], 0
+mov bl, al
+sar bl, 7
+and ebx, 7
+
+loc_000013db:
+movzx edx, byte [ebp - 0x44]
+push eax
+push edx
+push 0
+push 1
+mov dword [ebp - 0x58], edx
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_00001418 ; je 0x1418
+mov edx, dword [ebp - 0x58]
+lea eax, [ebp - 0x2c]
+push eax
+push edx
+push 0
+push 1
+call fcn_00000d20 ; call 0xd20
+mov ecx, dword [ebp + 0x18]
+add esp, 0x10
+mov eax, dword [ebp - 0x2c]
+add dword [ecx], eax
+
+loc_00001418:
+inc byte [ebp - 0x44]
+cmp byte [ebp - 0x44], bl
+jbe short loc_000013db ; jbe 0x13db
+mov eax, dword [ebp - 0x48]
+sub esp, 0xc
+add eax, 0xb
+push eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+cmp al, 3
+jne short loc_000014b0 ; jne 0x14b0
+cmp byte [ebp - 0x4f], 0
+jne short loc_00001458 ; jne 0x1458
+cmp byte [ebp - 0x4e], 0
+je short loc_0000144c ; je 0x144c
+cmp byte [ebp - 0x50], 0
+je near loc_00001522 ; je 0x1522
+
+loc_0000144c:
+mov eax, dword [ebp + 0x10]
+cmp dword [eax], 2
+je near loc_00001522 ; je 0x1522
+
+loc_00001458:
+mov eax, dword [ebp + 0x10]
+cmp dword [eax], 1
+je near loc_000015ad ; je 0x15ad
+push ebx
+add esi, 0x3e
+push ebx
+push 0x18
+push esi
+call fcn_00018927 ; call 0x18927
+mov eax, dword [ebp + 0x10]
+mov dword [eax], 1
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je near loc_000015b3 ; je 0x15b3
+movzx edx, byte [ebp - 0x3a]
+movzx eax, byte [ebp - 0x4d]
+movzx ebx, byte [ebp - 0x4c]
+push ecx
+push edx
+push eax
+push ebx
+push edx
+push eax
+push ref_00020c25 ; push 0x20c25
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+jmp near loc_000015b3 ; jmp 0x15b3
+
+loc_000014b0:
+cmp al, 6
+jne short loc_00001522 ; jne 0x1522
+push dword [ebp + 0x18]
+movzx edx, byte [ebp - 0x3a]
+movzx ebx, byte [ebp - 0x4d]
+movzx eax, byte [ebp - 0x4c]
+push edx
+push ebx
+push eax
+mov dword [ebp - 0x44], eax
+mov dword [ebp - 0x4c], edx
+call fcn_00001142 ; call 0x1142
+add esp, 0x10
+dec al
+jne short loc_00001522 ; jne 0x1522
+mov eax, dword [ebp + 0x10]
+cmp dword [eax], 1
+je short loc_00001522 ; je 0x1522
+push eax
+add esi, 0x3e
+push eax
+push 0x18
+push esi
+call fcn_00018927 ; call 0x18927
+mov eax, dword [ebp + 0x10]
+mov dword [eax], 1
+call fcn_00015479 ; call 0x15479
+mov cl, byte [ebp - 0x3a]
+add esp, 0x10
+mov edx, dword [ebp - 0x4c]
+mov byte [ebp - 0x39], cl
+test al, al
+je short loc_00001522 ; je 0x1522
+push esi
+push edx
+push ebx
+push dword [ebp - 0x44]
+push edx
+push ebx
+push ref_00020c25 ; push 0x20c25
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_00001522:
+push ecx
+push ecx
+push 0xff0000ff
+push dword [ebp - 0x40]
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+
+loc_00001534:
+add edi, 5
+lea eax, [ebp - 0x18]
+cmp edi, eax
+jne near loc_00001338 ; jne 0x1338
+cmp byte [ebp - 0x39], 0xff
+je short loc_000015be ; je 0x15be
+lea ebx, [ebp - 0x27]
+mov byte [ebp - 0x3a], 0
+
+loc_0000154f:
+mov al, byte [ebp - 0x3a]
+cmp byte [ebp - 0x39], al
+je short loc_0000159f ; je 0x159f
+push edx
+movzx esi, byte [ebx + 2]
+push esi
+movzx edi, byte [ebx + 1]
+push edi
+movzx ecx, byte [ebx]
+push ecx
+mov dword [ebp - 0x40], ecx
+call fcn_00016c9a ; call 0x16c9a
+pop ecx
+pop edx
+push 4
+add eax, 0x3e
+push eax
+call fcn_00018927 ; call 0x18927
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+mov ecx, dword [ebp - 0x40]
+test al, al
+je short loc_0000159f ; je 0x159f
+push eax
+push esi
+push edi
+push ecx
+push esi
+push edi
+push ref_00020c56 ; push 0x20c56
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_0000159f:
+inc byte [ebp - 0x3a]
+add ebx, 5
+cmp byte [ebp - 0x3a], 3
+jne short loc_0000154f ; jne 0x154f
+jmp short loc_000015be ; jmp 0x15be
+
+loc_000015ad:
+mov al, byte [ebp - 0x39]
+mov byte [ebp - 0x3a], al
+
+loc_000015b3:
+mov al, byte [ebp - 0x3a]
+mov byte [ebp - 0x39], al
+jmp near loc_00001522 ; jmp 0x1522
+
+loc_000015be:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000015c6:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+xor ebx, ebx
+sub esp, 0x28
+mov eax, dword [ebp + 8]
+mov edi, dword [ebp + 0x18]
+add edi, dword [ebp + 0x10]
+mov esi, dword [ebp + 0xc]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x1c]
+push edi
+mov dword [ebp - 0x20], eax
+mov eax, dword [ebp + 0x20]
+mov dword [ebp - 0x24], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov ecx, eax
+
+loc_000015f7:
+and ecx, dword [ebp - 0x20]
+cmp ecx, dword [ebp - 0x24]
+je short loc_0000162a ; je 0x162a
+cmp bx, 0xbb8
+je short loc_0000162a ; je 0x162a
+sub esp, 0xc
+inc ebx
+push edi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0xc
+push 0x3e8
+push esi
+push dword [ebp - 0x1c]
+mov dword [ebp - 0x28], eax
+call dword [esi + 4] ; ucall
+add esp, 0x10
+mov ecx, dword [ebp - 0x28]
+jmp short loc_000015f7 ; jmp 0x15f7
+
+loc_0000162a:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0000165b ; je 0x165b
+cmp bx, 0xbb8
+jne short loc_0000165b ; jne 0x165b
+mov dword [ebp + 0x10], ref_00020c7e ; mov dword [ebp + 0x10], 0x20c7e
+mov dword [ebp + 0xc], 0x41b
+mov dword [ebp + 8], ref_00020bd2 ; mov dword [ebp + 8], 0x20bd2
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001548c ; jmp 0x1548c
+
+loc_0000165b:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00001663:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x50
+mov edi, dword [ebp + 0xc]
+push 0
+push 0
+push 0
+mov dword [ebp - 0x30], 0
+mov dword [ebp - 0x2c], 0
+mov dword [ebp - 0x28], 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 0
+push 2
+push 0
+mov ebx, eax
+mov dword [ebp - 0x4c], eax
+call fcn_00016c9a ; call 0x16c9a
+mov dword [ebp - 0x44], eax
+mov eax, ebx
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov dword [ebp - 0x54], eax
+call fcn_0001c651 ; call 0x1c651
+mov dword [ebp - 0x3c], eax
+lea eax, [ebp - 0x1c]
+mov dword [esp], eax
+call fcn_00019797 ; call 0x19797
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000170c ; je 0x170c
+test ebx, ebx
+jns short loc_0000170c ; jns 0x170c
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000016f7 ; je 0x16f7
+push edx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000016f7:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x55
+push ref_00020bd2 ; push 0x20bd2
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000170c:
+lea eax, [ebp - 0x20]
+push eax
+push 0
+push 0
+push ref_000291dc ; push 0x291dc
+call fcn_0001975d ; call 0x1975d
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00001762 ; je 0x1762
+test ebx, ebx
+jns short loc_00001762 ; jns 0x1762
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000174d ; je 0x174d
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000174d:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x60
+push ref_00020bd2 ; push 0x20bd2
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00001762:
+mov eax, dword [ebp - 0x4c]
+lea ebx, [eax + 0x50]
+push eax
+push eax
+push 2
+push ebx
+call fcn_00018927 ; call 0x18927
+pop eax
+push dword [ebp - 0x44]
+mov dword [ebp - 0x34], 0
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+cmp byte [edi], 0x10
+mov word [ebp - 0x40], ax
+jbe short loc_00001797 ; jbe 0x1797
+mov eax, dword [edi + 1]
+cmp byte [eax + 0x33], 0
+jne short loc_000017ca ; jne 0x17ca
+
+loc_00001797:
+lea esi, [ebp - 0x34]
+push eax
+push esi
+lea edx, [ebp - 0x30]
+push edx
+push dword [ebp + 8]
+call fcn_00000eb7 ; call 0xeb7
+lea edx, [ebp - 0x2c]
+mov dword [esp], edx
+mov edx, dword [edi + 5]
+movzx edx, byte [edx + 6]
+push edx
+push esi
+mov eax, dword [edi + 0xd]
+movzx eax, byte [eax + 4]
+push eax
+push dword [ebp + 8]
+call fcn_000012ad ; call 0x12ad
+add esp, 0x20
+
+loc_000017ca:
+mov eax, dword [edi + 5]
+mov eax, dword [eax + 8]
+test eax, eax
+jne short loc_00001818 ; jne 0x1818
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000017ee ; je 0x17ee
+push esi
+push esi
+push ref_00020c93 ; push 0x20c93
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000017ee:
+call fcn_00015480 ; call 0x15480
+test al, al
+je near loc_00001d2e ; je 0x1d2e
+push ebx
+push ref_00020cde ; push 0x20cde
+push 0x83
+push ref_00020bd2 ; push 0x20bd2
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+jmp near loc_00001d2e ; jmp 0x1d2e
+
+loc_00001818:
+mov edx, dword [ebp - 0x3c]
+cmp edx, 0x40650
+sete cl
+cmp edx, 0x306c0
+sete dl
+or dl, cl
+mov byte [ebp - 0x47], cl
+mov byte [ebp - 0x45], dl
+jne short loc_00001848 ; jne 0x1848
+mov edx, eax
+and edx, 0xff000000
+cmp dword [ebp - 0x3c], 0x40660
+jne short loc_0000184f ; jne 0x184f
+
+loc_00001848:
+and eax, 0xffc00000
+mov edx, eax
+
+loc_0000184f:
+mov eax, dword [ebp - 0x44]
+cmp word [ebp - 0x40], 0xffff
+setne byte [ebp - 0x46]
+add eax, 0x10
+mov esi, eax
+mov dword [ebp - 0x58], eax
+push eax
+push eax
+push edx
+push esi
+call fcn_00017e8f ; call 0x17e8f
+mov dword [esp], esi
+call fcn_00017e4e ; call 0x17e4e
+pop edx
+pop ecx
+push 6
+mov dword [ebp - 0x40], eax
+mov eax, dword [ebp - 0x44]
+and dword [ebp - 0x40], 0xfffffff0
+add eax, 4
+push eax
+mov dword [ebp - 0x50], eax
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+cmp byte [ebp - 0x46], 0
+je near loc_00001afa ; je 0x1afa
+cmp dword [ebp - 0x34], 0
+mov eax, dword [edi + 5]
+je short loc_000018aa ; je 0x18aa
+cmp byte [eax + 6], 0
+jne short loc_000018b0 ; jne 0x18b0
+
+loc_000018aa:
+cmp byte [eax + 5], 0
+jne short loc_000018ba ; jne 0x18ba
+
+loc_000018b0:
+cmp byte [eax + 5], 1
+jne near loc_00001afa ; jne 0x1afa
+
+loc_000018ba:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000018d4 ; je 0x18d4
+push eax
+push eax
+push ref_00020cec ; push 0x20cec
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000018d4:
+push eax
+push eax
+mov eax, dword [ebp - 0x20]
+push 1
+push dword [eax + 4]
+call fcn_0001c5d1 ; call 0x1c5d1
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000192a ; je 0x192a
+test esi, esi
+jns short loc_0000192a ; jns 0x192a
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00001912 ; je 0x1912
+push eax
+push esi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00001912:
+push ecx
+push ref_000206f4 ; push 0x206f4
+push 0xae
+push ref_00020bd2 ; push 0x20bd2
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000192a:
+mov eax, dword [edi + 5]
+cmp byte [ebp - 0x45], 0
+movzx esi, byte [eax + 4]
+jne short loc_00001940 ; jne 0x1940
+cmp dword [ebp - 0x3c], 0x40660
+jne short loc_00001962 ; jne 0x1962
+
+loc_00001940:
+push eax
+push eax
+push 0xff07
+push ebx
+call fcn_00018954 ; call 0x18954
+pop eax
+pop edx
+lea eax, [esi*8]
+movzx esi, al
+push esi
+push ebx
+call fcn_00018730 ; call 0x18730
+jmp short loc_00001981 ; jmp 0x1981
+
+loc_00001962:
+push eax
+push eax
+push 0xff
+push ebx
+call fcn_00018954 ; call 0x18954
+shl esi, 8
+pop edx
+and esi, 0x3f00
+pop ecx
+push esi
+push ebx
+call fcn_00018927 ; call 0x18927
+
+loc_00001981:
+mov eax, dword [edi + 5]
+add esp, 0x10
+cmp word [eax + 2], 0
+mov eax, dword [ebp - 0x44]
+lea esi, [eax + 0x62]
+je short loc_00001a03 ; je 0x1a03
+cmp byte [ebp - 0x45], 0
+jne short loc_000019a3 ; jne 0x19a3
+cmp dword [ebp - 0x3c], 0x40660
+jne short loc_000019b9 ; jne 0x19b9
+
+loc_000019a3:
+push eax
+push 0x200
+push 0xfcff
+push ebx
+call fcn_00018981 ; call 0x18981
+add esp, 0x10
+jmp short loc_00001a03 ; jmp 0x1a03
+
+loc_000019b9:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000019e4 ; je 0x19e4
+mov eax, dword [edi + 5]
+cmp word [eax + 2], 3
+jbe short loc_000019e4 ; jbe 0x19e4
+push eax
+push ref_00020cfa ; push 0x20cfa
+push 0xd0
+push ref_00020bd2 ; push 0x20bd2
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000019e4:
+push eax
+mov eax, dword [edi + 5]
+movzx eax, word [eax + 2]
+shl eax, 6
+movzx eax, al
+push eax
+push 0xff3f
+push ebx
+call fcn_00018981 ; call 0x18981
+add esp, 0x10
+jmp short loc_00001a26 ; jmp 0x1a26
+
+loc_00001a03:
+cmp byte [ebp - 0x45], 0
+jne short loc_00001a12 ; jne 0x1a12
+cmp dword [ebp - 0x3c], 0x40660
+jne short loc_00001a26 ; jne 0x1a26
+
+loc_00001a12:
+push eax
+mov eax, dword [edi + 5]
+mov al, byte [eax + 7]
+add eax, eax
+movzx eax, al
+push eax
+push 0xf9
+jmp short loc_00001a34 ; jmp 0x1a34
+
+loc_00001a26:
+push eax
+mov eax, dword [edi + 5]
+movzx eax, byte [eax + 7]
+push eax
+push 0xe0
+
+loc_00001a34:
+push esi
+call fcn_0001878a ; call 0x1878a
+mov eax, dword [edi + 5]
+add esp, 0x10
+cmp byte [eax + 6], 0
+je short loc_00001a72 ; je 0x1a72
+cmp dword [ebp - 0x34], 0
+je short loc_00001a72 ; je 0x1a72
+push ecx
+push ecx
+push 2
+push ebx
+call fcn_00018927 ; call 0x18927
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00001a82 ; je 0x1a82
+push edx
+push edx
+push ref_00020d26 ; push 0x20d26
+push 0x40
+call fcn_00015487 ; call 0x15487
+jmp short loc_00001a7f ; jmp 0x1a7f
+
+loc_00001a72:
+push eax
+push eax
+push 0xfffd
+push ebx
+call fcn_00018954 ; call 0x18954
+
+loc_00001a7f:
+add esp, 0x10
+
+loc_00001a82:
+mov eax, dword [ebp - 0x3c]
+cmp eax, 0x40670
+je short loc_00001a93 ; je 0x1a93
+cmp eax, 0x306d0
+jne short loc_00001aab ; jne 0x1aab
+
+loc_00001a93:
+push eax
+push eax
+mov eax, dword [ebp - 0x40]
+push 0x4000
+add eax, 0x6c004
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+
+loc_00001aab:
+cmp byte [edi], 0xd
+jbe short loc_00001ad4 ; jbe 0x1ad4
+mov eax, dword [edi + 5]
+cmp byte [eax + 0xc], 1
+jne short loc_00001ad4 ; jne 0x1ad4
+cmp dword [ebp - 0x1c], 0x11
+je short loc_00001ad4 ; je 0x1ad4
+push eax
+push eax
+mov eax, dword [ebp - 0x40]
+push 8
+add eax, 0xc7204
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+
+loc_00001ad4:
+push eax
+push eax
+push 0xfff9
+push dword [ebp - 0x50]
+call fcn_00018954 ; call 0x18954
+lea eax, [ebp - 0x28]
+push eax
+push 0
+push 2
+push 0
+call fcn_00000d20 ; call 0xd20
+add esp, 0x20
+jmp near loc_00001cc4 ; jmp 0x1cc4
+
+loc_00001afa:
+push eax
+push eax
+mov eax, dword [ebp - 0x20]
+push 0
+push dword [eax + 4]
+call fcn_0001c5d1 ; call 0x1c5d1
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00001b50 ; je 0x1b50
+test esi, esi
+jns short loc_00001b50 ; jns 0x1b50
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00001b38 ; je 0x1b38
+push eax
+push esi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00001b38:
+push esi
+push ref_000206f4 ; push 0x206f4
+push 0x106
+push ref_00020bd2 ; push 0x20bd2
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00001b50:
+lea eax, [ebp - 0x24]
+push eax
+push 0
+push 0
+push ref_000290cc ; push 0x290cc
+call fcn_0001975d ; call 0x1975d
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00001ba9 ; je 0x1ba9
+test esi, esi
+jns short loc_00001ba9 ; jns 0x1ba9
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00001b91 ; je 0x1b91
+push ecx
+push esi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00001b91:
+push edx
+push ref_000206f4 ; push 0x206f4
+push 0x108
+push ref_00020bd2 ; push 0x20bd2
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00001ba9:
+cmp dword [ebp - 0x3c], 0x306d0
+je short loc_00001bbc ; je 0x1bbc
+cmp byte [ebp - 0x47], 0
+je near loc_00001c4b ; je 0x1c4b
+
+loc_00001bbc:
+push eax
+mov eax, dword [ebp - 0x40]
+push 0x80000000
+push 0xffffffffffffffff
+add eax, 0x130040
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp byte [ebp - 0x46], 0
+je short loc_00001bfd ; je 0x1bfd
+push eax
+mov eax, dword [ebp - 0x40]
+xor edx, edx
+push 0
+push 0x40000000
+push 0x130040
+push edx
+push eax
+push dword [ebp - 0x24]
+push dword [ebp + 8]
+call fcn_000015c6 ; call 0x15c6
+add esp, 0x20
+
+loc_00001bfd:
+mov esi, dword [ebp - 0x54]
+push eax
+push 1
+push 0xffffffffffffffff
+and esi, 0xfffffffe
+lea eax, [esi + 0x5f0c]
+push eax
+call fcn_00018b68 ; call 0x18b68
+mov eax, dword [ebp - 0x24]
+add esp, 0xc
+push 1
+push eax
+push dword [ebp + 8]
+call dword [eax + 4] ; ucall
+add esp, 0x10
+cmp byte [ebp - 0x46], 0
+je short loc_00001c4b ; je 0x1c4b
+push eax
+xor edx, edx
+push 0
+push 0x200
+push 0x5f0c
+push edx
+push esi
+push dword [ebp - 0x24]
+push dword [ebp + 8]
+call fcn_000015c6 ; call 0x15c6
+add esp, 0x20
+
+loc_00001c4b:
+push eax
+push eax
+push 0xfff9
+push dword [ebp - 0x50]
+call fcn_00018954 ; call 0x18954
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00001c77 ; je 0x1c77
+push eax
+push eax
+push ref_00020d66 ; push 0x20d66
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00001c77:
+cmp byte [ebp - 0x45], 0
+jne short loc_00001c86 ; jne 0x1c86
+cmp dword [ebp - 0x3c], 0x40660
+jne short loc_00001c90 ; jne 0x1c90
+
+loc_00001c86:
+push esi
+push 2
+push 0xfc07
+jmp short loc_00001c95 ; jmp 0x1c95
+
+loc_00001c90:
+push ecx
+push 2
+push 0x3f
+
+loc_00001c95:
+push ebx
+call fcn_00018981 ; call 0x18981
+mov eax, dword [edi + 5]
+add esp, 0x10
+mov word [eax + 2], 0
+mov eax, dword [edi + 5]
+mov byte [eax + 4], 0
+mov eax, dword [ebp - 0x4c]
+push edx
+push edx
+push 0xef
+add eax, 0x54
+push eax
+call fcn_0001875d ; call 0x1875d
+add esp, 0x10
+
+loc_00001cc4:
+mov eax, dword [ebp - 0x2c]
+mov esi, dword [ebp - 0x30]
+mov ebx, dword [ebp - 0x28]
+mov dword [ebp - 0x3c], eax
+push eax
+push eax
+push 0
+push dword [ebp - 0x58]
+call fcn_00018b3e ; call 0x18b3e
+mov eax, dword [edi + 9]
+add esp, 0x10
+cmp byte [eax + 3], 0
+jne short loc_00001d2e ; jne 0x1d2e
+add esi, dword [ebp - 0x3c]
+mov edx, dword [edi + 5]
+add ebx, esi
+cmp ebx, 0x3fffffff
+jbe short loc_00001cff ; jbe 0x1cff
+mov word [edx], 0x800
+jmp short loc_00001d2e ; jmp 0x1d2e
+
+loc_00001cff:
+cmp ebx, 0x2fffffff
+jbe short loc_00001d0e ; jbe 0x1d0e
+mov word [edx], 0x700
+jmp short loc_00001d2e ; jmp 0x1d2e
+
+loc_00001d0e:
+cmp ebx, 0x1fffffff
+jbe short loc_00001d1d ; jbe 0x1d1d
+mov word [edx], 0x600
+jmp short loc_00001d2e ; jmp 0x1d2e
+
+loc_00001d1d:
+cmp ebx, 0x10000000
+sbb eax, eax
+xor al, al
+add ax, 0x500
+mov word [edx], ax
+
+loc_00001d2e:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00001d36:
+push ebp
+xor ecx, ecx
+mov ebp, esp
+mov edx, 1
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov dword [ebp - 0x1c], 0
+
+loc_00001d53:
+mov eax, dword [esi + ecx*4]
+mov ebx, edx
+shl ebx, cl
+inc ecx
+or byte [ebp + eax - 0x1c], bl
+cmp ecx, 8
+jne short loc_00001d53 ; jne 0x1d53
+xor ebx, ebx
+
+loc_00001d66:
+cmp byte [esi + ebx*2 + 0x20], 1
+mov cl, bl
+jne short loc_00001dbd ; jne 0x1dbd
+movzx eax, byte [esi + ebx*2 + 0x21]
+movzx edx, byte [ebp + ebx - 0x1c]
+shl eax, 0x18
+or edx, 0x80000000
+or edx, eax
+cmp bl, 2
+je short loc_00001d9f ; je 0x1d9f
+cmp bl, 3
+je short loc_00001da6 ; je 0x1da6
+dec cl
+mov eax, 0x14
+mov ecx, 0x20
+cmove eax, ecx
+jmp short loc_00001dab ; jmp 0x1dab
+
+loc_00001d9f:
+mov eax, 0x2c
+jmp short loc_00001dab ; jmp 0x1dab
+
+loc_00001da6:
+mov eax, 0x38
+
+loc_00001dab:
+push ecx
+add eax, edi
+push edx
+push 0xf8ffff01
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_00001dbd:
+inc ebx
+cmp ebx, 4
+jne short loc_00001d66 ; jne 0x1d66
+push eax
+xor eax, eax
+cmp byte [esi + 0x22], 1
+sete al
+add edi, 4
+push eax
+push 0xf8
+push edi
+call fcn_0001878a ; call 0x1878a
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00001de6:
+push ebp
+mov ebp, esp
+push edi
+xor edi, edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 0xc]
+
+loc_00001df4:
+mov ecx, dword [ebp + 8]
+mov eax, edi
+cmp byte [ecx + edi*2 + 0x20], 1
+je short loc_00001e10 ; je 0x1e10
+
+loc_00001e00:
+inc edi
+cmp edi, 4
+jne short loc_00001df4 ; jne 0x1df4
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+loc_00001e10:
+cmp al, 2
+je short loc_00001e29 ; je 0x1e29
+cmp al, 3
+je short loc_00001e30 ; je 0x1e30
+dec al
+mov esi, 0x1a
+mov eax, 0x26
+cmove esi, eax
+jmp short loc_00001e35 ; jmp 0x1e35
+
+loc_00001e29:
+mov esi, 0x32
+jmp short loc_00001e35 ; jmp 0x1e35
+
+loc_00001e30:
+mov esi, 0x3e
+
+loc_00001e35:
+add esi, ebx
+
+loc_00001e37:
+sub esp, 0xc
+push esi
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test al, 2
+jne short loc_00001e37 ; jne 0x1e37
+jmp short loc_00001e00 ; jmp 0x1e00
+
+fcn_00001e49:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x30
+mov ebx, dword [ebp + 0xc]
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov esi, eax
+add esi, 0x68
+lea eax, [eax + 0x48]
+mov dword [esp], eax
+call fcn_00017ed8 ; call 0x17ed8
+mov dword [esp], esi
+call fcn_00017ed8 ; call 0x17ed8
+and eax, 0xfffffffe
+mov edi, edx
+mov esi, eax
+call fcn_0001c651 ; call 0x1c651
+mov dword [ebp - 0x30], eax
+lea eax, [ebp - 0x20]
+push eax
+push 0
+push 0
+push ref_000291ac ; push 0x291ac
+call fcn_0001975d ; call 0x1975d
+add esp, 0x20
+mov dword [ebp - 0x2c], eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00001ee2 ; je 0x1ee2
+cmp dword [ebp - 0x2c], 0
+jns short loc_00001ee2 ; jns 0x1ee2
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00001ecd ; je 0x1ecd
+push eax
+push dword [ebp - 0x2c]
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00001ecd:
+push ecx
+push ref_000206f4 ; push 0x206f4
+push 0x3e
+push ref_00020d7b ; push 0x20d7b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00001ee2:
+lea eax, [ebp - 0x1c]
+push eax
+push 0
+push 0
+push ref_0002917c ; push 0x2917c
+call fcn_0001975d ; call 0x1975d
+mov dword [ebp - 0x2c], eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00001f3d ; je 0x1f3d
+cmp dword [ebp - 0x2c], 0
+jns short loc_00001f3d ; jns 0x1f3d
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00001f28 ; je 0x1f28
+push edx
+push dword [ebp - 0x2c]
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00001f28:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x41
+push ref_00020d7b ; push 0x20d7b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00001f3d:
+mov eax, dword [ebp - 0x30]
+cmp eax, 0x40660
+je short loc_00001f88 ; je 0x1f88
+cmp eax, 0x306c0
+je short loc_00001f88 ; je 0x1f88
+cmp eax, 0x40670
+je short loc_00001f6a ; je 0x1f6a
+
+loc_00001f55:
+push eax
+push eax
+push 2
+lea eax, [esi + 0xa78]
+push eax
+call fcn_00018730 ; call 0x18730
+add esp, 0x10
+jmp short loc_00001f88 ; jmp 0x1f88
+
+loc_00001f6a:
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+je short loc_00001f55 ; je 0x1f55
+
+loc_00001f88:
+mov edx, dword [ebx + 0xd]
+mov eax, dword [ebp - 0x1c]
+mov dl, byte [edx]
+mov byte [eax + 0x22], dl
+mov edx, dword [ebx + 0xd]
+mov dl, byte [edx + 1]
+mov byte [eax + 0x24], dl
+mov edx, dword [ebx + 0xd]
+mov dl, byte [edx + 2]
+mov byte [eax + 0x26], dl
+xor eax, eax
+
+loc_00001fa7:
+mov edx, dword [ebp - 0x1c]
+lea ebx, [edx + eax*4]
+mov ecx, dword [ebx]
+cmp ecx, 1
+jne short loc_00001fba ; jne 0x1fba
+cmp byte [edx + 0x22], 0
+jmp short loc_00001fce ; jmp 0x1fce
+
+loc_00001fba:
+cmp ecx, 2
+jne short loc_00001fc5 ; jne 0x1fc5
+cmp byte [edx + 0x24], 0
+jmp short loc_00001fce ; jmp 0x1fce
+
+loc_00001fc5:
+cmp ecx, 3
+jne short loc_00001fd6 ; jne 0x1fd6
+cmp byte [edx + 0x26], 0
+
+loc_00001fce:
+jne short loc_00001fd6 ; jne 0x1fd6
+mov dword [ebx], 0
+
+loc_00001fd6:
+inc eax
+cmp eax, 8
+jne short loc_00001fa7 ; jne 0x1fa7
+push eax
+push edi
+push esi
+push dword [ebp - 0x1c]
+call fcn_00001d36 ; call 0x1d36
+mov eax, dword [ebp - 0x20]
+call dword [eax + 4] ; ucall
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00002031 ; je 0x2031
+test ebx, ebx
+jns short loc_00002031 ; jns 0x2031
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000201c ; je 0x201c
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000201c:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x62
+push ref_00020d7b ; push 0x20d7b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00002031:
+push ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+call fcn_00001de6 ; call 0x1de6
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000207e ; je 0x207e
+test ebx, ebx
+jns short loc_0000207e ; jns 0x207e
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00002069 ; je 0x2069
+push edx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00002069:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x68
+push ref_00020d7b ; push 0x20d7b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000207e:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00002088:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 8]
+push 0x20
+lea eax, [ebx + 0x88]
+add ebx, 0x8a
+push eax
+call fcn_00018730 ; call 0x18730
+add esp, 0x10
+
+loc_000020a9:
+sub esp, 0xc
+push ebx
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test ah, 8
+jne short loc_000020a9 ; jne 0x20a9
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000020bf:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 8
+mov ebx, dword [ebp + 0x10]
+push 0x20000000
+push 0xdfffffff
+lea eax, [ebx + 0x258]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0xc
+push 0x6b5
+push 0xfffff800
+lea eax, [ebx + 0x208]
+add ebx, 0x22c
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+mov dword [ebp + 8], ebx
+mov ebx, dword [ebp - 4]
+mov dword [ebp + 0x10], 0x2020
+mov dword [ebp + 0xc], 0xffff0000
+leave
+jmp near fcn_00018b68 ; jmp 0x18b68
+
+fcn_0000211b:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x30
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov ebx, eax
+lea eax, [eax + 0x48]
+add ebx, 0x68
+mov dword [esp], eax
+call fcn_00017ed8 ; call 0x17ed8
+mov dword [esp], ebx
+mov dword [ebp - 0x30], eax
+call fcn_00017ed8 ; call 0x17ed8
+mov ebx, eax
+lea eax, [ebp - 0x1c]
+push eax
+push 0
+push 0
+push ref_000291dc ; push 0x291dc
+mov dword [ebp - 0x2c], edx
+call fcn_0001975d ; call 0x1975d
+add esp, 0x20
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000021a8 ; je 0x21a8
+test esi, esi
+jns short loc_000021ca ; jns 0x21ca
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00002190 ; je 0x2190
+push eax
+push esi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00002190:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x13f
+push ref_00020d7b ; push 0x20d7b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000021a8:
+test esi, esi
+jns short loc_000021ca ; jns 0x21ca
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_00002411 ; je 0x2411
+push edi
+push edi
+push ref_00020daa ; push 0x20daa
+push 0x80000000
+jmp near loc_0000235c ; jmp 0x235c
+
+loc_000021ca:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000021e4 ; je 0x21e4
+push esi
+push esi
+push ref_00020dd9 ; push 0x20dd9
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000021e4:
+and ebx, 0xfffffffe
+mov edi, dword [ebp - 0x2c]
+sub esp, 0xc
+mov esi, ebx
+mov dword [ebp - 0x2c], ebx
+mov ebx, dword [ebp - 0x30]
+push 0
+push 0
+push esi
+and ebx, 0xfffffffe
+push ebx
+push dword [ebp + 0xc]
+call fcn_00004257 ; call 0x4257
+add esp, 0x20
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00002223 ; je 0x2223
+push ecx
+push ecx
+push ref_00020de8 ; push 0x20de8
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00002223:
+push edx
+push dword [ebp - 0x2c]
+push ebx
+push dword [ebp + 0xc]
+call fcn_000020bf ; call 0x20bf
+mov ecx, dword [ebp + 0xc]
+add esp, 0x10
+mov eax, dword [ecx + 0xd]
+cmp byte [eax + 3], 0
+mov eax, dword [ebp - 0x2c]
+lea eax, [eax + 0x84]
+mov dword [ebp - 0x30], eax
+jne short loc_0000226e ; jne 0x226e
+
+loc_0000224b:
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_0000240a ; je 0x240a
+push eax
+push eax
+push ref_00020e08 ; push 0x20e08
+push 2
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp near loc_0000240a ; jmp 0x240a
+
+loc_0000226e:
+mov eax, dword [ebp - 0x1c]
+sub esp, 0xc
+mov eax, dword [eax + 4]
+add eax, 0x21a4
+push eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+and eax, 0xf
+dec al
+je short loc_0000224b ; je 0x224b
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xe4
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test eax, 0x400000
+jne short loc_0000224b ; jne 0x224b
+lea eax, [ebp - 0x20]
+push eax
+push 0
+push 0
+push ref_000291ac ; push 0x291ac
+call fcn_0001975d ; call 0x1975d
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_000022d7 ; je 0x22d7
+test ebx, ebx
+js near loc_00002369 ; js 0x2369
+
+loc_000022d7:
+mov eax, dword [ebp - 0x20]
+mov bl, 1
+call dword [eax + 8] ; ucall
+push eax
+push 2
+push 0xfffffffffffffff0
+push dword [ebp - 0x30]
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_000022ef:
+sub esp, 0xc
+push dword [ebp - 0x30]
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0xc
+and eax, 0xf
+push eax
+mov eax, dword [ebp - 0x2c]
+push 0xfffffffffffffff0
+add eax, 0x98
+push eax
+call fcn_00018b68 ; call 0x18b68
+pop ecx
+pop eax
+push edi
+push esi
+call fcn_00002088 ; call 0x2088
+mov eax, dword [ebp - 0x2c]
+add esp, 0x10
+test bl, bl
+lea ebx, [eax + 0x8a]
+jne short loc_000023a3 ; jne 0x23a3
+
+loc_0000232a:
+sub esp, 0xc
+xor esi, esi
+push ebx
+call fcn_00017dc2 ; call 0x17dc2
+mov ebx, eax
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je near loc_00002411 ; je 0x2411
+mov eax, ebx
+and eax, 0xf
+shr bx, 4
+push eax
+and ebx, 0x3f
+push ebx
+push ref_00020e5f ; push 0x20e5f
+push 0x40
+
+loc_0000235c:
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp near loc_00002411 ; jmp 0x2411
+
+loc_00002369:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00002386 ; je 0x2386
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00002386:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x15f
+push ref_00020d7b ; push 0x20d7b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+jmp near loc_000022d7 ; jmp 0x22d7
+
+loc_000023a3:
+sub esp, 0xc
+push ebx
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+and eax, 0xf
+cmp ax, 2
+je short loc_000023d4 ; je 0x23d4
+
+loc_000023b8:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000023f9 ; je 0x23f9
+push edx
+push edx
+push ref_00020e40 ; push 0x20e40
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp short loc_000023f9 ; jmp 0x23f9
+
+loc_000023d4:
+mov eax, dword [ebp - 0x1c]
+sub esp, 0xc
+mov eax, dword [eax + 4]
+add eax, 0x21aa
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+and eax, 0xf
+cmp ax, 2
+jne short loc_000023b8 ; jne 0x23b8
+jmp near loc_0000232a ; jmp 0x232a
+
+loc_000023f9:
+push eax
+push eax
+push edi
+push esi
+call fcn_00002088 ; call 0x2088
+add esp, 0x10
+jmp near loc_0000232a ; jmp 0x232a
+
+loc_0000240a:
+xor ebx, ebx
+jmp near loc_000022ef ; jmp 0x22ef
+
+loc_00002411:
+lea esp, [ebp - 0xc]
+mov eax, esi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000241b:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov eax, dword [ebp + 8]
+push 0
+push 0
+push 0
+mov esi, eax
+mov eax, dword [ebp + 0xc]
+mov edi, eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp - 0x1c], eax
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x54
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov ebx, eax
+call fcn_00015479 ; call 0x15479
+shr ebx, 1
+add esp, 0x10
+and ebx, 7
+test al, al
+je short loc_00002480 ; je 0x2480
+movzx edx, byte [ebp - 0x1c]
+mov eax, edi
+push ecx
+movzx eax, al
+mov ecx, esi
+movzx ecx, cl
+push edx
+push eax
+push ecx
+push edx
+push eax
+push ref_00020e7c ; push 0x20e7c
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_00002480:
+movzx edx, byte [ebp - 0x1c]
+mov eax, 2
+sub eax, edx
+bt ebx, eax
+jae near loc_00002524 ; jae 0x2524
+mov eax, edi
+push ecx
+movzx eax, al
+push edx
+push eax
+mov eax, esi
+movzx eax, al
+push eax
+call fcn_00016c9a ; call 0x16c9a
+mov esi, eax
+lea eax, [eax + 0xb2]
+add esi, 0x11a
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+mov dword [esp], esi
+mov ebx, eax
+call fcn_00017dc2 ; call 0x17dc2
+mov esi, eax
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_000024f2 ; je 0x24f2
+mov eax, ebx
+and eax, 0xf
+shr bx, 4
+push eax
+and ebx, 0x3f
+push ebx
+push ref_00020e92 ; push 0x20e92
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000024f2:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00002512 ; je 0x2512
+shr si, 1
+and esi, 1
+push eax
+push esi
+push ref_00020eab ; push 0x20eab
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00002512:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00002547 ; je 0x2547
+mov dword [ebp + 0xc], ref_00021f21 ; mov dword [ebp + 0xc], 0x21f21
+jmp short loc_00002534 ; jmp 0x2534
+
+loc_00002524:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00002547 ; je 0x2547
+mov dword [ebp + 0xc], ref_00021751 ; mov dword [ebp + 0xc], 0x21751
+
+loc_00002534:
+mov dword [ebp + 8], 0x40
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00015487 ; jmp 0x15487
+
+loc_00002547:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000254f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov eax, dword [ebp + 0x10]
+movzx ebx, byte [ebp + 0x18]
+mov ecx, eax
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x14]
+push ebx
+mov dword [ebp - 0x20], eax
+movzx eax, al
+push eax
+movzx eax, cl
+push eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0
+push 0
+mov edi, eax
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x54
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov edx, 2
+add esp, 0x10
+sub edx, ebx
+shr eax, 1
+and eax, 7
+bt eax, edx
+jae near loc_0000262c ; jae 0x262c
+sub esp, 0xc
+add edi, 0x11a
+push edi
+xor esi, esi
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+mov edx, eax
+shr dx, 1
+and edx, 1
+
+loc_000025c7:
+cmp esi, 0x63
+ja short loc_000025f9 ; ja 0x25f9
+test dx, dx
+je short loc_000025f9 ; je 0x25f9
+push eax
+mov eax, dword [ebp + 0xc]
+inc esi
+push 0x3e8
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call dword [eax + 4] ; ucall
+mov dword [esp], edi
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+mov edx, eax
+shr dx, 1
+and edx, 1
+jmp short loc_000025c7 ; jmp 0x25c7
+
+loc_000025f9:
+mov dword [ebp - 0x24], edx
+call fcn_00015479 ; call 0x15479
+mov edx, dword [ebp - 0x24]
+test al, al
+je short loc_0000262c ; je 0x262c
+sub esp, 0xc
+movzx eax, byte [ebp - 0x20]
+movzx edx, dx
+push esi
+push edx
+movzx edx, byte [ebp - 0x1c]
+push ebx
+push eax
+push edx
+push ebx
+push eax
+push ref_00020eca ; push 0x20eca
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x30
+
+loc_0000262c:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00002634:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x38
+mov esi, dword [ebp + 0x14]
+lea eax, [ebp - 0x1c]
+mov ebx, dword [ebp + 0x18]
+push eax
+call fcn_00019797 ; call 0x19797
+mov edi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00002693 ; je 0x2693
+test edi, edi
+jns short loc_00002693 ; jns 0x2693
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000267b ; je 0x267b
+push ecx
+push edi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000267b:
+push edx
+push ref_000206f4 ; push 0x206f4
+push 0xa0
+push ref_00020f0c ; push 0x20f0c
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00002693:
+cmp dword [ebp - 0x1c], 0x11
+jne short loc_0000269f ; jne 0x269f
+
+loc_00002699:
+test esi, esi
+jne short loc_000026b6 ; jne 0x26b6
+jmp short loc_000026b0 ; jmp 0x26b0
+
+loc_0000269f:
+sub esp, 0xc
+push 1
+call fcn_0001c321 ; call 0x1c321
+add esp, 0x10
+dec al
+je short loc_00002699 ; je 0x2699
+
+loc_000026b0:
+mov byte [ebp - 0x2a], 0xf8
+jmp short loc_000026e4 ; jmp 0x26e4
+
+loc_000026b6:
+cmp byte [esi + 0x28], 0
+je short loc_000026b0 ; je 0x26b0
+mov al, byte [esi + 0x46]
+mov byte [ebp - 0x2a], al
+test al, al
+je short loc_000026b0 ; je 0x26b0
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000026e4 ; je 0x26e4
+push eax
+movzx eax, byte [esi + 0x46]
+push eax
+push ref_00020f40 ; push 0x20f40
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000026e4:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00002702 ; je 0x2702
+push eax
+movzx eax, byte [ebp - 0x2a]
+push eax
+push ref_00020f6a ; push 0x20f6a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00002702:
+cmp bl, 2
+je short loc_00002713 ; je 0x2713
+xor edi, edi
+mov al, 6
+cmp bl, 3
+cmove edi, eax
+jmp short loc_00002718 ; jmp 0x2718
+
+loc_00002713:
+mov edi, 4
+
+loc_00002718:
+mov al, byte [ebp - 0x2a]
+mov byte [ebp - 0x2b], 0
+mov byte [ebp - 0x29], 0
+or eax, edi
+mov byte [ebp - 0x2d], al
+
+loc_00002728:
+xor ebx, ebx
+mov byte [ebp - 0x2c], 1
+
+loc_0000272e:
+mov dl, byte [ebp - 0x2c]
+mov al, dl
+and eax, edi
+cmp dl, al
+jne short loc_0000276a ; jne 0x276a
+cmp byte [ebp - 0x2b], 0
+jne near loc_000027d9 ; jne 0x27d9
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_000027d9 ; je 0x27d9
+push eax
+push ebx
+push 1
+push 0
+push ebx
+push 1
+push ref_00020f8f ; push 0x20f8f
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+jmp short loc_000027d9 ; jmp 0x27d9
+
+loc_0000276a:
+mov al, byte [ebp - 0x29]
+mov cl, byte [ebp - 0x2c]
+or al, byte [ebp - 0x2a]
+and eax, ecx
+cmp cl, al
+je short loc_000027d9 ; je 0x27d9
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000279a ; je 0x279a
+push eax
+push ebx
+push 1
+push 0
+push ebx
+push 1
+push ref_00020fc0 ; push 0x20fc0
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_0000279a:
+push eax
+push ebx
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x11a
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test al, 2
+jne short loc_000027d9 ; jne 0x27d9
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000027d3 ; je 0x27d3
+push eax
+push eax
+push ref_00020fe0 ; push 0x20fe0
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000027d3:
+mov al, byte [ebp - 0x2c]
+or byte [ebp - 0x29], al
+
+loc_000027d9:
+inc ebx
+shl byte [ebp - 0x2c], 1
+cmp ebx, 3
+jne near loc_0000272e ; jne 0x272e
+mov al, byte [ebp - 0x2d]
+or al, byte [ebp - 0x29]
+inc al
+je short loc_00002812 ; je 0x2812
+push ecx
+mov eax, dword [ebp + 0xc]
+push 0x3e8
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call dword [eax + 4] ; ucall
+inc byte [ebp - 0x2b]
+add esp, 0x10
+cmp byte [ebp - 0x2b], 0x64
+jne near loc_00002728 ; jne 0x2728
+
+loc_00002812:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00002830 ; je 0x2830
+movzx eax, byte [ebp - 0x2b]
+push edx
+push eax
+push ref_00020ffe ; push 0x20ffe
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00002830:
+test esi, esi
+je short loc_0000285a ; je 0x285a
+mov al, byte [ebp - 0x29]
+not eax
+mov byte [esi + 0x46], al
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000285a ; je 0x285a
+push eax
+movzx eax, byte [esi + 0x46]
+push eax
+push ref_00021014 ; push 0x21014
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000285a:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00002862:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov al, byte [ebp + 0x14]
+mov byte [ebp - 0x19], al
+movzx eax, byte [ebp + 0x10]
+push eax
+movzx eax, byte [ebp + 0xc]
+push eax
+movzx eax, byte [ebp + 8]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+mov esi, eax
+lea eax, [eax + 0x34]
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+cmp al, 0xff
+jne short loc_000028c8 ; jne 0x28c8
+
+loc_00002899:
+xor eax, eax
+jmp short loc_000028d0 ; jmp 0x28d0
+
+loc_0000289d:
+mov edi, eax
+sub esp, 0xc
+and edi, 0xfc
+lea ebx, [edi + esi]
+push ebx
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+cmp al, byte [ebp - 0x19]
+je short loc_000028ce ; je 0x28ce
+sub esp, 0xc
+lea edx, [ebx + 1]
+push edx
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+
+loc_000028c8:
+test al, al
+jne short loc_0000289d ; jne 0x289d
+jmp short loc_00002899 ; jmp 0x2899
+
+loc_000028ce:
+mov eax, edi
+
+loc_000028d0:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000028d8:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x30
+mov eax, dword [ebp + 0xc]
+mov edi, dword [ebp + 8]
+mov dword [ebp - 0x2c], eax
+mov ebx, eax
+movzx eax, byte [ebp + 0x14]
+push eax
+movzx eax, byte [ebp + 0x10]
+push eax
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0x10
+test bl, bl
+je near loc_000029da ; je 0x29da
+mov esi, eax
+lea eax, [ebp - 0x1c]
+push eax
+push 0
+push 0
+push ref_000290cc ; push 0x290cc
+call fcn_0001975d ; call 0x1975d
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00002963 ; je 0x2963
+test ebx, ebx
+jns short loc_00002963 ; jns 0x2963
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000294b ; je 0x294b
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000294b:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x146
+push ref_00020f0c ; push 0x20f0c
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00002963:
+push eax
+push eax
+push 0x10
+lea ebx, [esi + 0xb0]
+push ebx
+call fcn_00018927 ; call 0x18927
+mov eax, dword [ebp - 0x1c]
+add esp, 0xc
+push 0x3e8
+push eax
+push edi
+call dword [eax + 4] ; ucall
+mov al, byte [ebp - 0x2c]
+add esp, 0x10
+xor edx, edx
+dec eax
+cmp al, 7
+ja short loc_0000299a ; ja 0x299a
+movzx eax, al
+movzx edx, byte [eax + ref_000203c8] ; movzx edx, byte [eax + 0x203c8]
+
+loc_0000299a:
+push eax
+add esi, 0x224
+push edx
+push 0xffffffffffffffe0
+push esi
+call fcn_00018b68 ; call 0x18b68
+mov eax, dword [ebp - 0x1c]
+add esp, 0xc
+push 0x3e8
+push eax
+push edi
+call dword [eax + 4] ; ucall
+pop edx
+pop ecx
+push 0xffef
+push ebx
+call fcn_00018954 ; call 0x18954
+mov eax, dword [ebp - 0x1c]
+add esp, 0xc
+push 0x186a0
+push eax
+push edi
+call dword [eax + 4] ; ucall
+add esp, 0x10
+
+loc_000029da:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000029e2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov edx, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0x18]
+mov eax, dword [ebp + 0x14]
+mov ecx, dword [ebp + 0xc]
+mov esi, edx
+and edx, 1
+mov edi, dword [ebp + 8]
+shr esi, 1
+shl esi, 5
+add esi, 0x914
+cmp edx, 1
+sbb edx, edx
+add ebx, ebx
+and ebx, 0x7fff
+and eax, 0x3f
+and edx, 0xfff80000
+or ebx, 0x70000000
+shl eax, 0x15
+add edx, 0x100000
+or ebx, eax
+or ebx, edx
+test ecx, ecx
+jne short loc_00002a3e ; jne 0x2a3e
+mov dword [ebp + 0xc], ebx
+add esi, edi
+jmp short loc_00002a51 ; jmp 0x2a51
+
+loc_00002a3e:
+push eax
+push 0
+push ecx
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0x10
+mov dword [ebp + 0xc], ebx
+add esi, eax
+
+loc_00002a51:
+mov dword [ebp + 8], esi
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f ; jmp 0x17e8f
+
+fcn_00002a60:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0xc]
+shr ebx, 1
+shl ebx, 5
+add ebx, 0x914
+test esi, esi
+jne short loc_00002a89 ; jne 0x2a89
+mov eax, dword [ebp + 8]
+sub esp, 0xc
+add eax, ebx
+push eax
+jmp short loc_00002a99 ; jmp 0x2a99
+
+loc_00002a89:
+push edi
+push 0
+push esi
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, ebx
+mov dword [esp], eax
+
+loc_00002a99:
+call fcn_00017e4e ; call 0x17e4e
+mov edx, dword [ebp + 0x10]
+add esp, 0x10
+mov edi, dword [ebp + 0x14]
+and edx, 1
+and eax, 0x7ffe
+cmp edx, 1
+sbb ecx, ecx
+and edi, 0x3f
+shl edi, 0x15
+and ecx, 0xfff80000
+or edi, 0x68008000
+add ecx, 0x100000
+or edi, eax
+or edi, ecx
+test esi, esi
+jne short loc_00002adb ; jne 0x2adb
+push esi
+add ebx, dword [ebp + 8]
+push esi
+jmp short loc_00002aea ; jmp 0x2aea
+
+loc_00002adb:
+push eax
+push 0
+push esi
+push 0
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+add ebx, eax
+
+loc_00002aea:
+push edi
+push ebx
+call fcn_00017e8f ; call 0x17e8f
+mov dword [esp], ebx
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+shr eax, 1
+and eax, 0x3fff
+ret
+
+fcn_00002b0b:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov edx, dword [ebp + 0x10]
+mov eax, dword [ebp + 0xc]
+mov esi, dword [ebp + 8]
+mov ebx, dword [ebp + 0x14]
+mov dword [ebp - 0x24], edx
+mov dword [ebp - 0x20], eax
+call fcn_0001c651 ; call 0x1c651
+mov dword [ebp - 0x1c], eax
+call fcn_0001c678 ; call 0x1c678
+mov edx, dword [ebp - 0x24]
+cmp dl, 1
+je short loc_00002b42 ; je 0x2b42
+cmp dl, 2
+je short loc_00002b66 ; je 0x2b66
+jmp short loc_00002ba2 ; jmp 0x2ba2
+
+loc_00002b42:
+lea edi, [ebx - 8]
+cmp bl, 7
+ja short loc_00002ba4 ; ja 0x2ba4
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_00002c2f ; je 0x2c2f
+movzx ebx, bl
+mov dword [ebp + 0x14], ebx
+mov dword [ebp + 0x10], 1
+jmp short loc_00002b88 ; jmp 0x2b88
+
+loc_00002b66:
+lea edi, [ebx - 0xc]
+cmp bl, 0xb
+ja short loc_00002ba4 ; ja 0x2ba4
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_00002c2f ; je 0x2c2f
+movzx ebx, bl
+mov dword [ebp + 0x14], ebx
+mov dword [ebp + 0x10], 2
+
+loc_00002b88:
+mov dword [ebp + 0xc], ref_00021036 ; mov dword [ebp + 0xc], 0x21036
+mov dword [ebp + 8], 2
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00015487 ; jmp 0x15487
+
+loc_00002ba2:
+mov edi, ebx
+
+loc_00002ba4:
+mov ecx, esi
+movzx esi, byte [ebp - 0x20]
+test cl, cl
+je short loc_00002bca ; je 0x2bca
+test edi, 1
+jne short loc_00002bc0 ; jne 0x2bc0
+shl esi, 8
+mov ebx, 0xfffff0ff
+jmp short loc_00002bfb ; jmp 0x2bfb
+
+loc_00002bc0:
+shl esi, 0x18
+mov ebx, 0xf0ffffff
+jmp short loc_00002bfb ; jmp 0x2bfb
+
+loc_00002bca:
+test eax, eax
+je short loc_00002be6 ; je 0x2be6
+cmp dword [ebp - 0x1c], 0x40670
+jne short loc_00002be6 ; jne 0x2be6
+
+loc_00002bd7:
+test edi, 1
+jne short loc_00002bf3 ; jne 0x2bf3
+
+loc_00002bdf:
+mov ebx, 0xfffffff0
+jmp short loc_00002bfb ; jmp 0x2bfb
+
+loc_00002be6:
+cmp bl, 7
+jbe short loc_00002bd7 ; jbe 0x2bd7
+test edi, 1
+jne short loc_00002bdf ; jne 0x2bdf
+
+loc_00002bf3:
+shl esi, 0x10
+mov ebx, 0xfff0ffff
+
+loc_00002bfb:
+movzx edx, dl
+push eax
+push edx
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov edx, edi
+add esp, 0x10
+shr dl, 1
+movzx edx, dl
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], ebx
+lea eax, [eax + edx*4 + 0xda0]
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018b68 ; jmp 0x18b68
+
+loc_00002c2f:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00002c37:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0x14]
+call fcn_0001c651 ; call 0x1c651
+mov dword [ebp - 0x1c], eax
+call fcn_0001c678 ; call 0x1c678
+mov dword [ebp - 0x20], eax
+xor eax, eax
+
+loc_00002c58:
+cmp byte [ebx + eax], 9
+jbe short loc_00002c62 ; jbe 0x2c62
+mov byte [ebx + eax], 8
+
+loc_00002c62:
+mov edi, dword [ebp + 0xc]
+cmp byte [edi + eax], 9
+jbe short loc_00002c6f ; jbe 0x2c6f
+mov byte [edi + eax], 7
+
+loc_00002c6f:
+mov edi, dword [ebp + 0x10]
+cmp byte [edi + eax], 6
+jbe short loc_00002c7c ; jbe 0x2c7c
+mov byte [edi + eax], 2
+
+loc_00002c7c:
+inc eax
+cmp eax, 0x10
+jne short loc_00002c58 ; jne 0x2c58
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 1
+push 1
+push 0
+mov edi, eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 2
+push 1
+push 0
+mov dword [ebp - 0x28], eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0x10
+cmp esi, 2
+mov ecx, dword [ebp - 0x28]
+mov dword [ebp - 0x24], eax
+je near loc_00002e17 ; je 0x2e17
+cmp esi, 3
+je short loc_00002cdb ; je 0x2cdb
+test esi, esi
+jne near loc_000031b8 ; jne 0x31b8
+add edi, 0xda0
+xor esi, esi
+jmp near loc_00002fba ; jmp 0x2fba
+
+loc_00002cdb:
+cmp dword [ebp - 0x20], 0
+lea ecx, [edi + 0xda0]
+je short loc_00002d52 ; je 0x2d52
+cmp dword [ebp - 0x1c], 0x40670
+jne short loc_00002d52 ; jne 0x2d52
+mov edi, ecx
+xor esi, esi
+
+loc_00002cf4:
+mov ecx, dword [ebp + 0x10]
+push eax
+mov eax, dword [ebp + 0xc]
+movzx edx, byte [ecx + esi*2]
+movzx eax, byte [eax + esi*2]
+mov ecx, dword [ebp + 0xc]
+shl edx, 0xc
+shl eax, 8
+or eax, edx
+movzx edx, byte [ebx + esi*2]
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 1]
+shl edx, 0x10
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 1]
+mov ecx, dword [ebp + 0x10]
+shl edx, 0x18
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 1]
+inc esi
+shl edx, 0x1c
+or eax, edx
+push eax
+push 0x80f080f0
+push edi
+add edi, 4
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp esi, 8
+jne short loc_00002cf4 ; jne 0x2cf4
+jmp near loc_000031b8 ; jmp 0x31b8
+
+loc_00002d52:
+xor esi, esi
+
+loc_00002d54:
+push eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x1c], ecx
+movzx edx, byte [eax + esi*2]
+mov eax, dword [ebp + 0x10]
+shl edx, 8
+movzx eax, byte [eax + esi*2]
+shl eax, 0xc
+or edx, eax
+movzx eax, byte [ebx + esi*2]
+or edx, eax
+movzx eax, byte [ebx + esi*2 + 1]
+shl eax, 0x10
+or edx, eax
+mov eax, dword [ebp + 0xc]
+movzx eax, byte [eax + esi*2 + 1]
+shl eax, 0x18
+or edx, eax
+mov eax, dword [ebp + 0x10]
+movzx eax, byte [eax + esi*2 + 1]
+inc esi
+shl eax, 0x1c
+or edx, eax
+push edx
+push 0x80f080f0
+push ecx
+call fcn_00018b68 ; call 0x18b68
+mov ecx, dword [ebp - 0x1c]
+add esp, 0x10
+add ecx, 4
+cmp esi, 4
+jne short loc_00002d54 ; jne 0x2d54
+add edi, 0xdb0
+
+loc_00002db9:
+mov ecx, dword [ebp + 0x10]
+push eax
+mov eax, dword [ebp + 0xc]
+movzx edx, byte [ecx + esi*2]
+movzx eax, byte [eax + esi*2]
+mov ecx, dword [ebp + 0xc]
+shl edx, 0xc
+shl eax, 8
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 1]
+or eax, edx
+movzx edx, byte [ebx + esi*2]
+shl edx, 0x10
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 1]
+mov ecx, dword [ebp + 0x10]
+shl edx, 0x18
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 1]
+inc esi
+shl edx, 0x1c
+or eax, edx
+push eax
+push 0x80f080f0
+push edi
+add edi, 4
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp esi, 8
+jne short loc_00002db9 ; jne 0x2db9
+jmp near loc_000031b8 ; jmp 0x31b8
+
+loc_00002e17:
+sub ecx, edi
+xor esi, esi
+cmp dword [ebp - 0x20], 0
+lea edx, [edi + 0xda0]
+mov edi, ecx
+je near loc_00002efa ; je 0x2efa
+cmp dword [ebp - 0x1c], 0x40670
+jne near loc_00002efa ; jne 0x2efa
+
+loc_00002e3a:
+mov ecx, dword [ebp + 0x10]
+push eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x1c], edx
+movzx ecx, byte [ecx + esi*2]
+movzx eax, byte [eax + esi*2]
+shl ecx, 0xc
+shl eax, 8
+or eax, ecx
+movzx ecx, byte [ebx + esi*2]
+or eax, ecx
+movzx ecx, byte [ebx + esi*2 + 1]
+shl ecx, 0x10
+or eax, ecx
+mov ecx, dword [ebp + 0xc]
+movzx ecx, byte [ecx + esi*2 + 1]
+shl ecx, 0x18
+or eax, ecx
+mov ecx, dword [ebp + 0x10]
+movzx ecx, byte [ecx + esi*2 + 1]
+shl ecx, 0x1c
+or eax, ecx
+push eax
+push 0x80f080f0
+push edx
+call fcn_00018b68 ; call 0x18b68
+mov eax, dword [ebp + 0xc]
+add esp, 0xc
+mov ecx, dword [ebp + 0x10]
+mov edx, dword [ebp - 0x1c]
+movzx eax, byte [eax + esi*2 + 8]
+movzx ecx, byte [ecx + esi*2 + 8]
+shl eax, 8
+shl ecx, 0xc
+or eax, ecx
+movzx ecx, byte [ebx + esi*2 + 8]
+or eax, ecx
+movzx ecx, byte [ebx + esi*2 + 9]
+shl ecx, 0x10
+or eax, ecx
+mov ecx, dword [ebp + 0xc]
+movzx ecx, byte [ecx + esi*2 + 9]
+shl ecx, 0x18
+or eax, ecx
+mov ecx, dword [ebp + 0x10]
+movzx ecx, byte [ecx + esi*2 + 9]
+inc esi
+shl ecx, 0x1c
+or eax, ecx
+push eax
+push 0x80f080f0
+lea eax, [edi + edx]
+push eax
+call fcn_00018b68 ; call 0x18b68
+mov edx, dword [ebp - 0x1c]
+add esp, 0x10
+add edx, 4
+cmp esi, 4
+jne near loc_00002e3a ; jne 0x2e3a
+jmp near loc_000031b8 ; jmp 0x31b8
+
+loc_00002efa:
+mov ecx, dword [ebp + 0x10]
+push eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x1c], edx
+movzx ecx, byte [ecx + esi*2]
+movzx eax, byte [eax + esi*2]
+shl ecx, 0xc
+shl eax, 8
+or eax, ecx
+movzx ecx, byte [ebx + esi*2]
+or eax, ecx
+movzx ecx, byte [ebx + esi*2 + 1]
+shl ecx, 0x10
+or eax, ecx
+mov ecx, dword [ebp + 0xc]
+movzx ecx, byte [ecx + esi*2 + 1]
+shl ecx, 0x18
+or eax, ecx
+mov ecx, dword [ebp + 0x10]
+movzx ecx, byte [ecx + esi*2 + 1]
+shl ecx, 0x1c
+or eax, ecx
+push eax
+push 0x80f080f0
+push edx
+call fcn_00018b68 ; call 0x18b68
+mov eax, dword [ebp + 0xc]
+add esp, 0xc
+mov ecx, dword [ebp + 0x10]
+mov edx, dword [ebp - 0x1c]
+movzx eax, byte [eax + esi*2 + 8]
+movzx ecx, byte [ecx + esi*2 + 8]
+shl eax, 8
+shl ecx, 0xc
+or eax, ecx
+movzx ecx, byte [ebx + esi*2 + 9]
+or eax, ecx
+movzx ecx, byte [ebx + esi*2 + 8]
+shl ecx, 0x10
+or eax, ecx
+mov ecx, dword [ebp + 0xc]
+movzx ecx, byte [ecx + esi*2 + 9]
+shl ecx, 0x18
+or eax, ecx
+mov ecx, dword [ebp + 0x10]
+movzx ecx, byte [ecx + esi*2 + 9]
+inc esi
+shl ecx, 0x1c
+or eax, ecx
+push eax
+push 0x80f080f0
+lea eax, [edi + edx]
+push eax
+call fcn_00018b68 ; call 0x18b68
+mov edx, dword [ebp - 0x1c]
+add esp, 0x10
+add edx, 4
+cmp esi, 4
+jne near loc_00002efa ; jne 0x2efa
+jmp near loc_000031b8 ; jmp 0x31b8
+
+loc_00002fba:
+mov dword [ebp - 0x28], ecx
+mov eax, dword [ebp + 0xc]
+push ecx
+mov ecx, dword [ebp + 0x10]
+movzx eax, byte [eax + esi*2]
+movzx edx, byte [ecx + esi*2]
+mov ecx, dword [ebp + 0xc]
+shl eax, 8
+shl edx, 0xc
+or eax, edx
+movzx edx, byte [ebx + esi*2]
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 1]
+shl edx, 0x10
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 1]
+mov ecx, dword [ebp + 0x10]
+shl edx, 0x18
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 1]
+inc esi
+shl edx, 0x1c
+or eax, edx
+push eax
+push 0x80f080f0
+push edi
+add edi, 4
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp esi, 4
+mov ecx, dword [ebp - 0x28]
+jne short loc_00002fba ; jne 0x2fba
+cmp dword [ebp - 0x20], 0
+lea edi, [ecx + 0xda0]
+je near loc_000030fa ; je 0x30fa
+cmp dword [ebp - 0x1c], 0x40670
+jne near loc_000030fa ; jne 0x30fa
+mov eax, dword [ebp - 0x24]
+xor si, si
+sub eax, ecx
+mov dword [ebp - 0x1c], eax
+
+loc_00003041:
+mov eax, dword [ebp + 0xc]
+push edx
+mov edx, dword [ebp + 0x10]
+mov ecx, dword [ebp + 0xc]
+movzx eax, byte [eax + esi*2 + 8]
+movzx edx, byte [edx + esi*2 + 8]
+shl eax, 8
+shl edx, 0xc
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 8]
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 9]
+shl edx, 0x10
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 9]
+shl edx, 0x18
+or eax, edx
+mov edx, dword [ebp + 0x10]
+movzx edx, byte [edx + esi*2 + 9]
+shl edx, 0x1c
+or eax, edx
+push eax
+push 0x80f080f0
+push edi
+call fcn_00018b68 ; call 0x18b68
+mov ecx, dword [ebp + 0x10]
+add esp, 0xc
+mov eax, dword [ebp + 0xc]
+movzx edx, byte [ecx + esi*2 + 0xc]
+movzx eax, byte [eax + esi*2 + 0xc]
+shl edx, 0xc
+shl eax, 8
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 0xc]
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 0xd]
+shl edx, 0x10
+or eax, edx
+mov edx, dword [ebp + 0xc]
+movzx edx, byte [edx + esi*2 + 0xd]
+shl edx, 0x18
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 0xd]
+inc esi
+shl edx, 0x1c
+or eax, edx
+push eax
+mov eax, dword [ebp - 0x1c]
+push 0x80f080f0
+add eax, edi
+add edi, 4
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp esi, 2
+je near loc_000031b8 ; je 0x31b8
+jmp near loc_00003041 ; jmp 0x3041
+
+loc_000030fa:
+mov eax, dword [ebp - 0x24]
+xor esi, esi
+sub eax, ecx
+mov dword [ebp - 0x1c], eax
+
+loc_00003104:
+mov edx, dword [ebp + 0x10]
+push eax
+mov eax, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0xc]
+movzx edx, byte [edx + esi*2 + 8]
+movzx eax, byte [eax + esi*2 + 8]
+shl edx, 0xc
+shl eax, 8
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 9]
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 8]
+shl edx, 0x10
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 9]
+shl edx, 0x18
+or eax, edx
+mov edx, dword [ebp + 0x10]
+movzx edx, byte [edx + esi*2 + 9]
+shl edx, 0x1c
+or eax, edx
+push eax
+push 0x80f080f0
+push edi
+call fcn_00018b68 ; call 0x18b68
+mov ecx, dword [ebp + 0x10]
+add esp, 0xc
+mov eax, dword [ebp + 0xc]
+movzx edx, byte [ecx + esi*2 + 0xc]
+movzx eax, byte [eax + esi*2 + 0xc]
+shl edx, 0xc
+shl eax, 8
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 0xd]
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 0xc]
+shl edx, 0x10
+or eax, edx
+mov edx, dword [ebp + 0xc]
+movzx edx, byte [edx + esi*2 + 0xd]
+shl edx, 0x18
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 0xd]
+inc esi
+shl edx, 0x1c
+or eax, edx
+push eax
+mov eax, dword [ebp - 0x1c]
+push 0x80f080f0
+add eax, edi
+add edi, 4
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp esi, 2
+jne near loc_00003104 ; jne 0x3104
+
+loc_000031b8:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000031c0:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov eax, dword [eax + 0xd]
+push dword [ebp + 0x10]
+lea edx, [eax + 0x29]
+push edx
+lea edx, [eax + 0x19]
+add eax, 9
+push edx
+push eax
+call fcn_00002c37 ; call 0x2c37
+add esp, 0x10
+leave
+ret
+
+fcn_000031e5:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov dword [ebp - 0x10], 1
+movzx edx, word [eax + 1]
+lea ecx, [eax + 3]
+lea edi, [edx + edx*2]
+mov dword [ebp - 0x14], edx
+add edi, eax
+
+loc_00003207:
+mov eax, dword [ebp - 0x14]
+cmp dword [ebp - 0x10], eax
+ja short loc_00003240 ; ja 0x3240
+mov eax, edi
+
+loc_00003211:
+cmp eax, ecx
+je short loc_00003238 ; je 0x3238
+mov bl, byte [eax - 3]
+cmp bl, byte [eax]
+jbe short loc_00003233 ; jbe 0x3233
+mov dx, word [eax]
+mov si, word [eax - 2]
+mov byte [eax], bl
+mov word [eax - 3], dx
+mov dl, byte [eax + 2]
+mov word [eax + 1], si
+mov byte [eax - 1], dl
+
+loc_00003233:
+sub eax, 3
+jmp short loc_00003211 ; jmp 0x3211
+
+loc_00003238:
+inc dword [ebp - 0x10]
+add ecx, 3
+jmp short loc_00003207 ; jmp 0x3207
+
+loc_00003240:
+pop eax
+pop edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00003247:
+push ebp
+mov ebp, esp
+mov edx, dword [ebp + 8]
+pop ebp
+movzx eax, word [edx + 1]
+shr eax, 1
+inc eax
+lea eax, [eax + eax*2]
+movzx eax, byte [edx + eax]
+ret
+
+fcn_0000325d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xca0
+mov ebx, dword [ebp + 0x1c]
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 1
+push dword [ebp + 0x14]
+push 0
+mov esi, eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 2
+push dword [ebp + 0x14]
+push 0
+mov dword [ebp - 0xc88], eax
+call fcn_00016c9a ; call 0x16c9a
+mov ecx, 0xa
+cmp dword [ebp + 0x18], 0x10
+pop edi
+mov dword [ebp - 0xc8c], eax
+pop eax
+mov eax, 0x14
+cmove eax, ecx
+mov dword [ebp - 0xc98], eax
+lea eax, [ebp - 0xc78]
+push 0xc60
+push eax
+call fcn_00016fff ; call 0x16fff
+add esp, 0x10
+cmp ebx, 2
+je short loc_000032e9 ; je 0x32e9
+cmp ebx, 1
+setb byte [ebp - 0xc7a]
+setb byte [ebp - 0xc79]
+jmp short loc_000032f7 ; jmp 0x32f7
+
+loc_000032e9:
+mov byte [ebp - 0xc7a], 0
+mov byte [ebp - 0xc79], 1
+
+loc_000032f7:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00003311 ; je 0x3311
+push ecx
+push ecx
+push ref_00021077 ; push 0x21077
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00003311:
+push edx
+push edx
+lea eax, [esi + 0xb0]
+push 0x10
+push eax
+mov dword [ebp - 0xc9c], eax
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+cmp byte [ebp - 0xc79], 0
+je short loc_0000334b ; je 0x334b
+push eax
+push eax
+mov eax, dword [ebp - 0xc88]
+push 0x10
+add eax, 0xb0
+push eax
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+
+loc_0000334b:
+cmp byte [ebp - 0xc7a], 0
+je short loc_0000336c ; je 0x336c
+mov eax, dword [ebp - 0xc8c]
+push edi
+push edi
+push 0x10
+add eax, 0xb0
+push eax
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+
+loc_0000336c:
+mov eax, dword [ebp + 0xc]
+push ecx
+push 0x2710
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call dword [eax + 4] ; ucall
+lea eax, [esi + 0xc20]
+pop ebx
+pop esi
+mov dword [ebp - 0xca0], eax
+push 0xa800
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+cmp byte [ebp - 0xc79], 0
+je short loc_000033be ; je 0x33be
+mov eax, dword [ebp - 0xc88]
+push edx
+push edx
+push 0xa800
+add eax, 0xc20
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+
+loc_000033be:
+cmp byte [ebp - 0xc7a], 0
+je short loc_000033e2 ; je 0x33e2
+push eax
+push eax
+mov eax, dword [ebp - 0xc8c]
+push 0xa800
+add eax, 0xc20
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+
+loc_000033e2:
+mov dword [ebp - 0xc80], 0
+
+loc_000033ec:
+mov eax, dword [ebp - 0xc80]
+mov ecx, 0x64
+xor edx, edx
+sub esp, 0xc
+xor ebx, ebx
+div ecx
+push eax
+call fcn_0001a831 ; call 0x1a831
+add esp, 0x10
+
+loc_00003409:
+cmp ebx, dword [ebp + 0x18]
+je short loc_00003438 ; je 0x3438
+sub esp, 0xc
+push 1
+push 0x39
+push ebx
+push dword [ebp + 0x14]
+push 0
+call fcn_000029e2 ; call 0x29e2
+add esp, 0x14
+push 0xc
+push 0x3a
+push ebx
+inc ebx
+push dword [ebp + 0x14]
+push 0
+call fcn_000029e2 ; call 0x29e2
+add esp, 0x20
+jmp short loc_00003409 ; jmp 0x3409
+
+loc_00003438:
+push eax
+mov eax, dword [ebp + 0xc]
+push dword [ebp - 0xc98]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call dword [eax + 4] ; ucall
+lea eax, [ebp - 0xc78]
+mov dword [ebp - 0xc90], eax
+mov dword [ebp - 0xc84], 0
+add esp, 0x10
+
+loc_00003464:
+mov eax, dword [ebp - 0xc84]
+cmp eax, dword [ebp + 0x18]
+je near loc_00003577 ; je 0x3577
+imul eax, eax, 0xc6
+mov edi, dword [ebp - 0xc90]
+xor ebx, ebx
+mov dword [ebp - 0xc94], eax
+
+loc_00003487:
+lea eax, [ebx + 0x31]
+mov esi, 1
+push eax
+push dword [ebp - 0xc84]
+push dword [ebp + 0x14]
+push 0
+call fcn_00002a60 ; call 0x2a60
+movzx edx, word [edi + 1]
+add esp, 0x10
+and eax, 0x3f
+mov byte [ebp - 0xc7b], al
+
+loc_000034b0:
+cmp esi, edx
+ja short loc_000034da ; ja 0x34da
+lea eax, [esi + esi*2]
+mov cl, byte [ebp - 0xc7b]
+cmp byte [edi + eax], cl
+jne short loc_000034d7 ; jne 0x34d7
+imul edx, ebx, 0x21
+add eax, dword [ebp - 0xc94]
+add eax, edx
+inc word [ebp + eax - 0xc77]
+jmp short loc_00003555 ; jmp 0x3555
+
+loc_000034d7:
+inc esi
+jmp short loc_000034b0 ; jmp 0x34b0
+
+loc_000034da:
+cmp esi, 0xb
+jne short loc_0000352c ; jne 0x352c
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000350d ; je 0x350d
+push eax
+push 0xa
+push dword [ebp - 0xc80]
+push ebx
+push dword [ebp - 0xc84]
+push dword [ebp + 0x14]
+push ref_000210a2 ; push 0x210a2
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_0000350d:
+cmp dword [ebp + 0x18], 0x10
+jne near loc_000036ff ; jne 0x36ff
+sub esp, 0xc
+push 0xee
+
+loc_0000351f:
+call fcn_0001a831 ; call 0x1a831
+add esp, 0x10
+call fcn_00017239 ; call 0x17239
+
+loc_0000352c:
+imul eax, ebx, 0x21
+lea esi, [esi + esi*2]
+add esi, dword [ebp - 0xc94]
+inc word [edi + 1]
+add esi, eax
+mov al, byte [ebp - 0xc7b]
+mov word [ebp + esi - 0xc77], 1
+mov byte [ebp + esi - 0xc78], al
+
+loc_00003555:
+inc ebx
+add edi, 0x21
+cmp ebx, 6
+jne near loc_00003487 ; jne 0x3487
+inc dword [ebp - 0xc84]
+add dword [ebp - 0xc90], 0xc6
+jmp near loc_00003464 ; jmp 0x3464
+
+loc_00003577:
+cmp dword [ebp - 0xc80], 0x64
+jbe short loc_000035b4 ; jbe 0x35b4
+lea ecx, [ebp - 0xc78]
+xor edx, edx
+
+loc_00003588:
+cmp edx, dword [ebp + 0x18]
+jne short loc_00003591 ; jne 0x3591
+
+loc_0000358d:
+xor edi, edi
+jmp short loc_0000360b ; jmp 0x360b
+
+loc_00003591:
+xor eax, eax
+
+loc_00003593:
+mov di, word [ecx + eax + 1]
+lea ebx, [edi - 2]
+cmp bx, 2
+jbe short loc_000035b4 ; jbe 0x35b4
+add eax, 0x21
+cmp eax, 0xc6
+jne short loc_00003593 ; jne 0x3593
+inc edx
+add ecx, 0xc6
+jmp short loc_00003588 ; jmp 0x3588
+
+loc_000035b4:
+inc dword [ebp - 0xc80]
+cmp dword [ebp - 0xc80], 0x1f4
+jne near loc_000033ec ; jne 0x33ec
+jmp short loc_0000358d ; jmp 0x358d
+
+loc_000035cc:
+imul eax, esi, 0x21
+sub esp, 0xc
+add eax, dword [ebp - 0xc80]
+lea edx, [ebp - 0xc78]
+lea ebx, [edx + eax]
+push ebx
+call fcn_000031e5 ; call 0x31e5
+mov dword [esp], ebx
+call fcn_00003247 ; call 0x3247
+mov dword [esp], eax
+lea eax, [esi + 0x31]
+inc esi
+push eax
+push edi
+push dword [ebp + 0x14]
+push 0
+call fcn_000029e2 ; call 0x29e2
+add esp, 0x20
+cmp esi, 6
+jne short loc_000035cc ; jne 0x35cc
+inc edi
+
+loc_0000360b:
+cmp edi, dword [ebp + 0x18]
+je short loc_00003620 ; je 0x3620
+imul eax, edi, 0xc6
+xor esi, esi
+mov dword [ebp - 0xc80], eax
+jmp short loc_000035cc ; jmp 0x35cc
+
+loc_00003620:
+push eax
+push eax
+push 0
+push dword [ebp - 0xca0]
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+cmp byte [ebp - 0xc79], 0
+je short loc_00003653 ; je 0x3653
+push eax
+push eax
+mov eax, dword [ebp - 0xc88]
+push 0
+add eax, 0xc20
+push eax
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+
+loc_00003653:
+cmp byte [ebp - 0xc7a], 0
+je short loc_00003674 ; je 0x3674
+push eax
+push eax
+mov eax, dword [ebp - 0xc8c]
+push 0
+add eax, 0xc20
+push eax
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+
+loc_00003674:
+mov eax, dword [ebp + 0xc]
+push ebx
+push 0x3e8
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call dword [eax + 4] ; ucall
+pop esi
+pop edi
+push 0xffef
+push dword [ebp - 0xc9c]
+call fcn_00018954 ; call 0x18954
+add esp, 0x10
+cmp byte [ebp - 0xc79], 0
+je short loc_000036bf ; je 0x36bf
+mov eax, dword [ebp - 0xc88]
+push ecx
+push ecx
+push 0xffef
+add eax, 0xb0
+push eax
+call fcn_00018954 ; call 0x18954
+add esp, 0x10
+
+loc_000036bf:
+cmp byte [ebp - 0xc7a], 0
+je short loc_000036e3 ; je 0x36e3
+mov eax, dword [ebp - 0xc8c]
+push edx
+push edx
+push 0xffef
+add eax, 0xb0
+push eax
+call fcn_00018954 ; call 0x18954
+add esp, 0x10
+
+loc_000036e3:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000370c ; je 0x370c
+push eax
+push eax
+push ref_000210fe ; push 0x210fe
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp short loc_0000370c ; jmp 0x370c
+
+loc_000036ff:
+sub esp, 0xc
+push 0xed
+jmp near loc_0000351f ; jmp 0x351f
+
+loc_0000370c:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00003714:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 0x14]
+push 0
+mov esi, dword [ebp + 0x18]
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+mov edi, eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_0000377f ; je 0x377f
+sub esp, 0xc
+add edi, 0x214
+push edi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test ax, ax
+je short loc_0000377f ; je 0x377f
+shr eax, 0x10
+and eax, 0xf
+cmp eax, 6
+jbe short loc_0000377f ; jbe 0x377f
+push eax
+movzx ebx, bl
+push eax
+mov eax, esi
+movzx esi, al
+push esi
+push 0x10
+push 1
+push ebx
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+call fcn_0000325d ; call 0x325d
+add esp, 0x20
+
+loc_0000377f:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00003787:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x38
+mov eax, dword [ebp + 0x20]
+mov edi, dword [ebp + 0x14]
+mov dword [ebp - 0x38], eax
+lea eax, [ebp - 0x1c]
+push eax
+call fcn_00019797 ; call 0x19797
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_000037e9 ; je 0x37e9
+test ebx, ebx
+jns short loc_000037e9 ; jns 0x37e9
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000037d1 ; je 0x37d1
+push esi
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000037d1:
+push ecx
+push ref_000206f4 ; push 0x206f4
+push 0x5bc
+push ref_00020f0c ; push 0x20f0c
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000037e9:
+imul eax, dword [ebp + 0x1c], 7
+add eax, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0x18]
+mov byte [ebp - 0x29], 0
+mov dword [ebp - 0x30], eax
+
+loc_000037fa:
+cmp ebx, dword [ebp - 0x30]
+je near loc_000038a5 ; je 0x38a5
+movzx eax, byte [ebx + 2]
+push edx
+push eax
+mov byte [ebp - 0x34], al
+movzx eax, byte [ebx + 1]
+push eax
+movzx eax, byte [ebx]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+mov esi, eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_0000389d ; je 0x389d
+sub esp, 0xc
+lea eax, [esi + 0x11a]
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test al, 2
+je short loc_0000389d ; je 0x389d
+sub esp, 0xc
+lea eax, [esi + 0xba]
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test al, 0x40
+je short loc_0000389d ; je 0x389d
+mov cl, byte [ebp - 0x34]
+mov eax, 1
+lea edx, [esi + 0xb0]
+add esi, 0x25c
+mov dword [ebp - 0x34], edx
+shl eax, cl
+or byte [ebp - 0x29], al
+push eax
+push eax
+push 0x10
+push edx
+call fcn_00018927 ; call 0x18927
+pop eax
+pop edx
+push 0x200
+push esi
+call fcn_00018b14 ; call 0x18b14
+mov edx, dword [ebp - 0x34]
+pop ecx
+pop esi
+push 0xffef
+push edx
+call fcn_00018954 ; call 0x18954
+add esp, 0x10
+
+loc_0000389d:
+add ebx, 7
+jmp near loc_000037fa ; jmp 0x37fa
+
+loc_000038a5:
+cmp byte [ebp - 0x29], 0
+je near loc_000039cb ; je 0x39cb
+cmp dword [ebp - 0x1c], 0x11
+jne short loc_000038bb ; jne 0x38bb
+
+loc_000038b5:
+test edi, edi
+jne short loc_000038ce ; jne 0x38ce
+jmp short loc_000038de ; jmp 0x38de
+
+loc_000038bb:
+sub esp, 0xc
+push 1
+call fcn_0001c321 ; call 0x1c321
+add esp, 0x10
+dec al
+jne short loc_000038de ; jne 0x38de
+jmp short loc_000038b5 ; jmp 0x38b5
+
+loc_000038ce:
+cmp byte [edi + 0x28], 0
+je short loc_000038de ; je 0x38de
+cmp byte [edi + 0x46], 0
+je short loc_000038de ; je 0x38de
+mov byte [edi + 0x46], 0
+
+loc_000038de:
+movzx esi, byte [ebp - 0x38]
+sub esp, 0xc
+push esi
+push edi
+push dword [ebp + 0xc]
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+call fcn_00002634 ; call 0x2634
+movzx eax, byte [ebp - 0x29]
+add esp, 0x20
+mov ebx, dword [ebp + 0x18]
+mov dword [ebp - 0x38], eax
+
+loc_00003902:
+cmp ebx, dword [ebp - 0x30]
+je short loc_00003947 ; je 0x3947
+mov al, byte [ebx]
+movzx ecx, byte [ebx + 1]
+mov byte [ebp - 0x29], al
+mov al, byte [ebx + 2]
+movzx edx, al
+mov dword [ebp - 0x34], edx
+mov edx, dword [ebp - 0x38]
+bt edx, eax
+jae short loc_00003942 ; jae 0x3942
+push eax
+movzx edx, byte [ebp - 0x29]
+push dword [ebp - 0x34]
+push ecx
+push edx
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+push 0x20
+add eax, 0xb0
+push eax
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+
+loc_00003942:
+add ebx, 7
+jmp short loc_00003902 ; jmp 0x3902
+
+loc_00003947:
+cmp dword [ebp - 0x1c], 0x11
+jne short loc_00003953 ; jne 0x3953
+
+loc_0000394d:
+test edi, edi
+jne short loc_00003966 ; jne 0x3966
+jmp short loc_00003976 ; jmp 0x3976
+
+loc_00003953:
+sub esp, 0xc
+push 1
+call fcn_0001c321 ; call 0x1c321
+add esp, 0x10
+dec al
+jne short loc_00003976 ; jne 0x3976
+jmp short loc_0000394d ; jmp 0x394d
+
+loc_00003966:
+cmp byte [edi + 0x28], 0
+je short loc_00003976 ; je 0x3976
+cmp byte [edi + 0x46], 0
+je short loc_00003976 ; je 0x3976
+mov byte [edi + 0x46], 0
+
+loc_00003976:
+sub esp, 0xc
+push esi
+push edi
+push dword [ebp + 0xc]
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+call fcn_00002634 ; call 0x2634
+add esp, 0x20
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000039a6 ; je 0x39a6
+push edx
+push edx
+push ref_00021128 ; push 0x21128
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000039a6:
+mov ebx, dword [ebp + 0x18]
+
+loc_000039a9:
+cmp ebx, dword [ebp - 0x30]
+je short loc_000039cb ; je 0x39cb
+push eax
+movzx eax, byte [ebx + 2]
+add ebx, 7
+push eax
+movzx eax, byte [ebx - 6]
+push eax
+movzx eax, byte [ebx - 7]
+push eax
+call fcn_0000241b ; call 0x241b
+add esp, 0x10
+jmp short loc_000039a9 ; jmp 0x39a9
+
+loc_000039cb:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000039d3:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov eax, dword [ebp + 0x20]
+mov ebx, dword [ebp + 0x10]
+mov dword [ebp - 0x24], eax
+imul eax, dword [ebp + 0x18], 7
+add eax, dword [ebp + 0x14]
+mov dl, byte [eax + 3]
+movzx edi, byte [eax + 2]
+mov cl, byte [eax]
+mov byte [ebp - 0x20], dl
+mov dl, byte [eax + 5]
+mov dword [ebp - 0x28], edi
+push edi
+movzx edi, byte [eax + 1]
+movzx eax, cl
+mov byte [ebp - 0x19], cl
+mov byte [ebp - 0x1a], dl
+push edi
+push eax
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+mov esi, eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+je near loc_00003b0b ; je 0x3b0b
+mov eax, dword [ebx + 0xd]
+movzx ebx, byte [ebp - 0x20]
+mov dl, byte [eax + ebx + 5]
+test dl, dl
+jne short loc_00003a6a ; jne 0x3a6a
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00003a54 ; je 0x3a54
+push ebx
+push ebx
+push ref_00021153 ; push 0x21153
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00003a54:
+sub esp, 0xc
+lea eax, [esi + 0xac]
+push eax
+call fcn_00017e4e ; call 0x17e4e
+mov ebx, eax
+and ebx, 0xf
+jmp short loc_00003a90 ; jmp 0x3a90
+
+loc_00003a6a:
+movzx ebx, dl
+mov dword [ebp - 0x20], edx
+call fcn_00015479 ; call 0x15479
+mov edx, dword [ebp - 0x20]
+test al, al
+je short loc_00003a93 ; je 0x3a93
+movzx edx, dl
+push ecx
+push edx
+push ref_00021159 ; push 0x21159
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+
+loc_00003a90:
+add esp, 0x10
+
+loc_00003a93:
+cmp byte [ebp - 0x24], 0
+jne short loc_00003aa5 ; jne 0x3aa5
+cmp bx, 2
+mov eax, 2
+cmova ebx, eax
+
+loc_00003aa5:
+call fcn_00015479 ; call 0x15479
+movzx ebx, bx
+test al, al
+je short loc_00003acd ; je 0x3acd
+mov ecx, dword [ebp - 0x28]
+movzx eax, byte [ebp - 0x19]
+push ebx
+push ecx
+push edi
+push eax
+push ecx
+push edi
+push ref_0002116e ; push 0x2116e
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_00003acd:
+push eax
+movzx eax, byte [ebp - 0x1a]
+shl eax, 4
+or eax, ebx
+push eax
+push 0xfffffc00
+lea eax, [esi + 0xac]
+add esi, 0xd0
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 8], esi
+mov dword [ebp + 0xc], 0xfff0
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018981 ; jmp 0x18981
+
+loc_00003b0b:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00003b13:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 8
+movzx eax, byte [ebp + 0x14]
+push eax
+movzx eax, byte [ebp + 0x10]
+push eax
+movzx eax, byte [ebp + 0xc]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 0x2020
+push 0xffff0000
+mov ebx, eax
+lea eax, [eax + 0x22c]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0xc
+push 0x20000000
+push 0xdfffffff
+lea eax, [ebx + 0x258]
+push eax
+call fcn_00018b68 ; call 0x18b68
+lea eax, [ebx + 0x11a]
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test al, 2
+jne short loc_00003ba1 ; jne 0x3ba1
+push eax
+push eax
+push 0x20
+lea eax, [ebx + 0xb0]
+add ebx, 0xb2
+push eax
+call fcn_00018730 ; call 0x18730
+add esp, 0x10
+
+loc_00003b90:
+sub esp, 0xc
+push ebx
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test ah, 8
+jne short loc_00003b90 ; jne 0x3b90
+
+loc_00003ba1:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00003ba6:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017ed8 ; call 0x17ed8
+mov ebx, eax
+and ebx, 0xfffffffe
+lea eax, [ebx + 0x7400]
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov dword [ebp - 0x1c], eax
+lea eax, [ebx + 0x7404]
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov edi, eax
+lea eax, [ebx + 0x7408]
+add ebx, 0x740c
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov dword [esp], ebx
+xor ebx, ebx
+mov esi, eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+xor ecx, ecx
+
+loc_00003c10:
+mov eax, dword [ebp - 0x1c]
+mov edx, edi
+shr edx, cl
+and edx, 7
+shr eax, cl
+add ecx, 3
+and eax, 7
+add eax, edx
+add ebx, eax
+cmp ecx, 0x18
+jne short loc_00003c10 ; jne 0x3c10
+cmp bl, 0x28
+jbe short loc_00003c53 ; jbe 0x3c53
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00003c7e ; je 0x3c7e
+movzx ebx, bl
+push ebx
+push 0x28
+push ref_0002119b ; push 0x2119b
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp short loc_00003c7e ; jmp 0x3c7e
+
+loc_00003c53:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00003c7e ; je 0x3c7e
+mov al, 0x28
+movzx edx, bl
+sub eax, ebx
+sub esp, 0xc
+movzx eax, al
+lea ecx, [edx + eax]
+push ecx
+push eax
+push edx
+push ref_000211e9 ; push 0x211e9
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_00003c7e:
+xor ecx, ecx
+xor eax, eax
+
+loc_00003c82:
+mov edx, esi
+shr edx, cl
+add ecx, 3
+and edx, 7
+add eax, edx
+cmp ecx, 0x18
+jne short loc_00003c82 ; jne 0x3c82
+shr esi, 0x18
+and esi, 0x3f
+lea ebx, [eax + esi]
+cmp bl, 0x47
+jbe short loc_00003cc4 ; jbe 0x3cc4
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00003cef ; je 0x3cef
+movzx ebx, bl
+push ebx
+push 0x47
+push ref_00021219 ; push 0x21219
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp short loc_00003cef ; jmp 0x3cef
+
+loc_00003cc4:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00003cef ; je 0x3cef
+mov al, 0x47
+movzx edx, bl
+sub eax, ebx
+sub esp, 0xc
+movzx eax, al
+lea ecx, [edx + eax]
+push ecx
+push eax
+push edx
+push ref_00021267 ; push 0x21267
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_00003cef:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00003cf7:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x60
+mov eax, dword [ebp + 8]
+push 0
+push 0
+push 0
+mov dword [ebp - 0x3c], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x40], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp - 0x44], eax
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017ed8 ; call 0x17ed8
+mov ebx, eax
+and ebx, 0xfffffffe
+lea eax, [ebx + 0x7410]
+mov dword [esp], eax
+mov dword [ebp - 0x48], eax
+call fcn_00017e4e ; call 0x17e4e
+mov edi, eax
+lea eax, [ebx + 0x7418]
+mov dword [esp], eax
+mov dword [ebp - 0x5c], eax
+call fcn_00017e4e ; call 0x17e4e
+mov esi, eax
+lea eax, [ebx + 0x7454]
+mov dword [esp], eax
+mov dword [ebp - 0x60], eax
+call fcn_00017e4e ; call 0x17e4e
+mov ebx, eax
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00003d87 ; je 0x3d87
+sub esp, 0xc
+push ebx
+push esi
+push edi
+push ref_00021297 ; push 0x21297
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_00003d87:
+cmp byte [ebp - 0x3c], 0
+mov word [ebp - 0x28], 0
+jne short loc_00003dba ; jne 0x3dba
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xb2
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+and eax, 0x3f0
+shr eax, 4
+mov dword [ebp - 0x28], eax
+
+loc_00003dba:
+cmp byte [ebp - 0x40], 0
+mov word [ebp - 0x38], 0
+jne short loc_00003ded ; jne 0x3ded
+push ecx
+push 1
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xb2
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+and eax, 0x3f0
+shr eax, 4
+mov dword [ebp - 0x38], eax
+
+loc_00003ded:
+cmp byte [ebp - 0x44], 0
+mov word [ebp - 0x58], 0
+jne short loc_00003e20 ; jne 0x3e20
+push edx
+push 2
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xb2
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+and eax, 0x3f0
+shr eax, 4
+mov dword [ebp - 0x58], eax
+
+loc_00003e20:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00003e42 ; je 0x3e42
+movzx eax, word [ebp - 0x28]
+push eax
+movzx eax, byte [ebp - 0x3c]
+push eax
+push ref_000212c5 ; push 0x212c5
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00003e42:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00003e64 ; je 0x3e64
+movzx eax, word [ebp - 0x38]
+push eax
+movzx eax, byte [ebp - 0x40]
+push eax
+push ref_000212eb ; push 0x212eb
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00003e64:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00003e86 ; je 0x3e86
+movzx eax, word [ebp - 0x58]
+push eax
+movzx eax, byte [ebp - 0x44]
+push eax
+push ref_00021311 ; push 0x21311
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00003e86:
+mov al, byte [ebp - 0x40]
+or al, byte [ebp - 0x3c]
+jne short loc_00003ed2 ; jne 0x3ed2
+cmp word [ebp - 0x28], 8
+jne short loc_00003ed2 ; jne 0x3ed2
+cmp word [ebp - 0x38], 8
+jne short loc_00003ed2 ; jne 0x3ed2
+mov eax, edi
+and edi, 0x7c00
+and eax, 0xfffffc1f
+shr edi, 5
+or edi, eax
+mov eax, esi
+and esi, 0x7c00
+and eax, 0xfffffc1f
+shr esi, 5
+or esi, eax
+mov eax, ebx
+and ebx, 0x3f000
+and eax, 0xfffff03f
+shr ebx, 6
+or ebx, eax
+
+loc_00003ed2:
+cmp word [ebp - 0x58], 4
+jne near loc_00003f69 ; jne 0x3f69
+cmp byte [ebp - 0x44], 0
+jne near loc_00003f69 ; jne 0x3f69
+cmp word [ebp - 0x28], 4
+jne short loc_00003f2a ; jne 0x3f2a
+cmp byte [ebp - 0x3c], 0
+jne short loc_00003f2a ; jne 0x3f2a
+mov eax, edi
+and edi, 0xf8000
+and eax, 0xfffffc1f
+shr edi, 0xa
+or edi, eax
+mov eax, esi
+and esi, 0xf8000
+and eax, 0xfffffc1f
+shr esi, 0xa
+or esi, eax
+mov eax, ebx
+and ebx, 0xfc0000
+and eax, 0xfffff03f
+shr ebx, 0xc
+or ebx, eax
+
+loc_00003f2a:
+cmp word [ebp - 0x38], 4
+jne short loc_00003f69 ; jne 0x3f69
+cmp byte [ebp - 0x40], 0
+jne short loc_00003f69 ; jne 0x3f69
+mov eax, edi
+and edi, 0xf8000
+and ah, 0x83
+shr edi, 5
+or edi, eax
+mov eax, esi
+and esi, 0xf8000
+and ah, 0x83
+shr esi, 5
+or esi, eax
+mov eax, ebx
+and ebx, 0xfc0000
+and eax, 0xfffc0fff
+shr ebx, 6
+or ebx, eax
+
+loc_00003f69:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00003f87 ; je 0x3f87
+sub esp, 0xc
+push ebx
+push esi
+push edi
+push ref_00021337 ; push 0x21337
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_00003f87:
+push eax
+push edi
+push 0xfe000000
+push dword [ebp - 0x48]
+call fcn_00018b68 ; call 0x18b68
+add esp, 0xc
+push esi
+push 0xfe000000
+push dword [ebp - 0x5c]
+call fcn_00018b68 ; call 0x18b68
+mov eax, dword [ebp - 0x60]
+add esp, 0x10
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 0xc], 0xc0000000
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018b68 ; jmp 0x18b68
+
+fcn_00003fc6:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0xc]
+mov esi, dword [ebp + 0x10]
+mov ebx, dword [ebp + 8]
+mov dword [ebp - 0x1c], eax
+call fcn_0001c651 ; call 0x1c651
+movzx ebx, bl
+mov edi, eax
+push eax
+mov eax, esi
+movzx eax, al
+push eax
+movzx eax, byte [ebp - 0x1c]
+push eax
+push ebx
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 0x1f
+push 0xfffffeff
+mov ebx, eax
+lea eax, [eax + 0x224]
+push eax
+call fcn_00018b68 ; call 0x18b68
+mov eax, esi
+add esp, 0x10
+test al, al
+jne short loc_0000401e ; jne 0x401e
+cmp byte [ebp - 0x1c], 1
+je short loc_00004030 ; je 0x4030
+
+loc_0000401e:
+cmp edi, 0x40660
+je short loc_0000406e ; je 0x406e
+cmp edi, 0x306c0
+jne short loc_00004082 ; jne 0x4082
+jmp short loc_0000406e ; jmp 0x406e
+
+loc_00004030:
+push eax
+push 0
+push 0xefffffff
+lea eax, [ebx + 0x490]
+push eax
+call fcn_00018b68 ; call 0x18b68
+lea eax, [ebx + 0xa18]
+add esp, 0x10
+lea esi, [ebx + 0x918]
+mov dword [ebp - 0x1c], eax
+
+loc_00004056:
+push eax
+push 0
+push 0xfffffffffffffff3
+push esi
+add esi, 0x20
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jne short loc_00004056 ; jne 0x4056
+jmp short loc_0000401e ; jmp 0x401e
+
+loc_0000406e:
+push eax
+push 0x10
+push 0xffffffffffffffef
+lea eax, [ebx + 0xd14]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_00004082:
+sub esp, 0xc
+lea esi, [ebx + 0x308]
+push esi
+call fcn_00017e4e ; call 0x17e4e
+pop edx
+pop ecx
+push eax
+push esi
+lea esi, [ebx + 0x314]
+call fcn_00017e8f ; call 0x17e8f
+mov dword [esp], esi
+call fcn_00017e4e ; call 0x17e4e
+pop edi
+pop edx
+push eax
+push esi
+lea esi, [ebx + 0x32c]
+add ebx, 0x330
+call fcn_00017e8f ; call 0x17e8f
+mov dword [esp], esi
+call fcn_00017e4e ; call 0x17e4e
+pop ecx
+pop edi
+push eax
+push esi
+call fcn_00017e8f ; call 0x17e8f
+mov dword [esp], ebx
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f ; jmp 0x17e8f
+
+fcn_000040eb:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+movzx eax, byte [ebp + 0x10]
+mov esi, dword [ebp + 8]
+movzx ebx, word [ebp + 0xc]
+mov dword [ebp - 0x1c], 0xa
+shl eax, 0x10
+lea edi, [esi + 0x6c00]
+or ebx, eax
+lea eax, [esi + 0x6c04]
+or ebx, 0x80000000
+mov dword [ebp - 0x20], eax
+
+loc_00004120:
+push ecx
+push ecx
+push dword [ebp + 0x14]
+push dword [ebp - 0x20]
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+pop edx
+push ebx
+push edi
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+mov edx, 0x64
+
+loc_0000413e:
+sub esp, 0xc
+push edi
+mov dword [ebp - 0x24], edx
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test eax, eax
+jns short loc_0000417a ; jns 0x417a
+mov edx, dword [ebp - 0x24]
+dec edx
+jne short loc_0000413e ; jne 0x413e
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000417a ; je 0x417a
+push edx
+push edx
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push esi
+push 0x64
+push ref_00021364 ; push 0x21364
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_0000417a:
+sub esp, 0xc
+push edi
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+mov edx, eax
+cmp ax, 0x40
+je short loc_000041c2 ; je 0x41c2
+dec dword [ebp - 0x1c]
+jne short loc_00004120 ; jne 0x4120
+mov dword [ebp - 0x1c], edx
+call fcn_00015479 ; call 0x15479
+mov edx, dword [ebp - 0x1c]
+test al, al
+je short loc_000041c2 ; je 0x41c2
+movzx edx, dx
+push eax
+push edx
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push esi
+push 0xa
+push ref_000213b1 ; push 0x213b1
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_000041c2:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000041ca:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov edx, dword [ebp + 0x10]
+mov edi, dword [ebp + 8]
+mov eax, edx
+and eax, 0xfffffffd
+cmp ax, 0x14
+sete al
+cmp al, 1
+lea ecx, [edx - 0x13]
+sbb ebx, ebx
+cmp cx, 1
+jbe short loc_000041f7 ; jbe 0x41f7
+add ebx, 4
+jmp short loc_000041fa ; jmp 0x41fa
+
+loc_000041f7:
+add ebx, 2
+
+loc_000041fa:
+push ebx
+cmp al, 1
+push 0
+sbb esi, esi
+push 2
+add esi, 8
+push edi
+mov dword [ebp - 0x1c], edx
+call fcn_000040eb ; call 0x40eb
+mov edx, dword [ebp - 0x1c]
+push dword [ebp + 0xc]
+movzx edx, dx
+push 0
+push edx
+push edi
+call fcn_000040eb ; call 0x40eb
+add esp, 0x20
+push dword [ebp + 0x14]
+push 0
+push esi
+push edi
+call fcn_000040eb ; call 0x40eb
+lea eax, [edi + 0x6c04]
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+push ebx
+push 0
+push 3
+push edi
+mov dword [ebp - 0x1c], eax
+call fcn_000040eb ; call 0x40eb
+mov eax, dword [ebp - 0x1c]
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00004257:
+push ebp
+mov ebp, esp
+push edi
+mov edi, 0x10
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0x10]
+mov dword [ebp - 0x28], eax
+call fcn_0001c651 ; call 0x1c651
+cmp dword [ebp + 0x14], 1
+mov dword [ebp - 0x20], eax
+mov eax, 4
+cmovne edi, eax
+xor esi, esi
+mov eax, edi
+shr eax, 1
+mov dword [ebp - 0x1c], eax
+lea eax, [ebx + 0xa00]
+mov dword [ebp - 0x24], eax
+
+loc_00004294:
+test ebx, ebx
+je short loc_000042a8 ; je 0x42a8
+push eax
+mov eax, esi
+shl eax, 4
+add eax, dword [ebp - 0x24]
+push 0xc
+push 0xffffffffffffffe0
+push eax
+jmp short loc_000042c8 ; jmp 0x42c8
+
+loc_000042a8:
+push eax
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+lea edx, [esi + 0xa0]
+push 0xc
+shl edx, 4
+push 0xffffffffffffffe0
+add edx, eax
+push edx
+
+loc_000042c8:
+inc esi
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp esi, edi
+jb short loc_00004294 ; jb 0x4294
+test ebx, ebx
+jne near loc_00004365 ; jne 0x4365
+cmp byte [ebp - 0x28], 1
+mov edi, 2
+mov eax, 0xc
+cmove edi, eax
+xor esi, esi
+
+loc_000042f0:
+push eax
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+mov edx, esi
+push edi
+inc esi
+shl edx, 5
+push 0xffffffffffffffe0
+lea eax, [eax + edx + 0x904]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jb short loc_000042f0 ; jb 0x42f0
+cmp byte [ebp - 0x28], 1
+mov edi, 3
+mov eax, 0xe
+cmove edi, eax
+xor esi, esi
+shl edi, 5
+
+loc_00004334:
+push eax
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+mov edx, esi
+push edi
+inc esi
+shl edx, 5
+push 0xfffffc1f
+lea eax, [eax + edx + 0x904]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jb short loc_00004334 ; jb 0x4334
+
+loc_00004365:
+xor esi, esi
+lea edi, [ebx + 0x90c]
+
+loc_0000436d:
+test ebx, ebx
+je short loc_00004385 ; je 0x4385
+mov eax, esi
+push ecx
+push 0x120
+shl eax, 5
+push 0xfffff81f
+add eax, edi
+jmp short loc_000043ab ; jmp 0x43ab
+
+loc_00004385:
+push edx
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+mov edx, esi
+push 0x120
+shl edx, 5
+push 0xfffff81f
+lea eax, [eax + edx + 0x90c]
+
+loc_000043ab:
+push eax
+inc esi
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jb short loc_0000436d ; jb 0x436d
+test ebx, ebx
+jne near loc_00004444 ; jne 0x4444
+xor esi, esi
+
+loc_000043c4:
+push eax
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+mov edx, esi
+push 0xa00000
+inc esi
+shl edx, 5
+push 0xfe1fffff
+lea eax, [eax + edx + 0x90c]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jb short loc_000043c4 ; jb 0x43c4
+xor esi, esi
+
+loc_000043fb:
+mov eax, dword [ebp + 8]
+mov edi, 0x200
+cmp byte [eax], 2
+jbe short loc_00004413 ; jbe 0x4413
+mov eax, dword [eax + 0xd]
+movzx edi, byte [eax + esi + 0x54]
+shl edi, 6
+
+loc_00004413:
+push eax
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+mov edx, esi
+push edi
+inc esi
+shl edx, 5
+push 0xfffffc3f
+lea eax, [eax + edx + 0x910]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jb short loc_000043fb ; jb 0x43fb
+
+loc_00004444:
+xor esi, esi
+lea edi, [ebx + 0x910]
+jmp short loc_00004480 ; jmp 0x4480
+
+loc_0000444e:
+push eax
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+mov edx, esi
+push 0
+shl edx, 5
+push 0xffffc3ff
+lea eax, [eax + edx + 0x910]
+
+loc_00004471:
+push eax
+inc esi
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jae short loc_00004495 ; jae 0x4495
+
+loc_00004480:
+test ebx, ebx
+je short loc_0000444e ; je 0x444e
+push eax
+mov eax, esi
+push 0
+shl eax, 5
+push 0xffffc3ff
+add eax, edi
+jmp short loc_00004471 ; jmp 0x4471
+
+loc_00004495:
+mov eax, dword [ebp - 0x20]
+cmp eax, 0x40660
+sete dl
+cmp eax, 0x306c0
+sete al
+or dl, al
+mov byte [ebp - 0x24], dl
+je short loc_00004503 ; je 0x4503
+xor esi, esi
+lea edi, [ebx + 0x80c]
+
+loc_000044b7:
+test ebx, ebx
+je short loc_000044cc ; je 0x44cc
+push eax
+mov eax, esi
+push 0
+shl eax, 5
+push 0xffe3ffff
+add eax, edi
+jmp short loc_000044ef ; jmp 0x44ef
+
+loc_000044cc:
+push eax
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+mov edx, esi
+push 0
+shl edx, 5
+push 0xffe3ffff
+lea eax, [eax + edx + 0x80c]
+
+loc_000044ef:
+push eax
+inc esi
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jb short loc_000044b7 ; jb 0x44b7
+jmp near loc_000045df ; jmp 0x45df
+
+loc_00004503:
+cmp dword [ebp - 0x20], 0x40670
+jne near loc_000045ec ; jne 0x45ec
+push ecx
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+je short loc_00004565 ; je 0x4565
+
+loc_0000452e:
+test ebx, ebx
+je near loc_0000461d ; je 0x461d
+cmp byte [ebp - 0x28], 1
+mov edx, 0x1c000000
+mov eax, 0x6000000
+cmove eax, edx
+push edx
+push eax
+push 0xc1ffffff
+lea eax, [ebx + 0xc00]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp byte [ebp - 0x24], 0
+je short loc_0000456d ; je 0x456d
+jmp short loc_0000458b ; jmp 0x458b
+
+loc_00004565:
+test ebx, ebx
+je near loc_000048c0 ; je 0x48c0
+
+loc_0000456d:
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+je short loc_000045a8 ; je 0x45a8
+
+loc_0000458b:
+push eax
+push 0x40
+push 0xfffffc0f
+lea eax, [ebx + 0xc08]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp byte [ebp - 0x24], 0
+jne short loc_000045c6 ; jne 0x45c6
+
+loc_000045a8:
+push edi
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+je short loc_000045f4 ; je 0x45f4
+
+loc_000045c6:
+push esi
+push 0
+push 0xe07fffff
+lea eax, [ebx + 0xc0c]
+push eax
+call fcn_00018b68 ; call 0x18b68
+
+loc_000045da:
+add esp, 0x10
+jmp short loc_0000461d ; jmp 0x461d
+
+loc_000045df:
+cmp dword [ebp - 0x20], 0x40670
+je near loc_0000452e ; je 0x452e
+
+loc_000045ec:
+test ebx, ebx
+je near loc_000048c0 ; je 0x48c0
+
+loc_000045f4:
+push 0
+push 0x15
+push 0xc0c8001
+push dword [ebp + 0xc]
+call fcn_000041ca ; call 0x41ca
+and eax, 0xe07fffff
+push eax
+push 0x16
+push 0xc0c8001
+push dword [ebp + 0xc]
+call fcn_000041ca ; call 0x41ca
+add esp, 0x20
+
+loc_0000461d:
+cmp byte [ebp - 0x24], 0
+je short loc_00004664 ; je 0x4664
+test ebx, ebx
+je short loc_00004640 ; je 0x4640
+push ecx
+push 0x13
+push 0xffffffffffffffe0
+lea eax, [ebx + 0xc28]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+jmp near loc_0000473e ; jmp 0x473e
+
+loc_00004640:
+push edx
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 0x13
+push 0xffffffffffffffe0
+add eax, 0xc28
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+jmp short loc_0000466c ; jmp 0x466c
+
+loc_00004664:
+test ebx, ebx
+jne near loc_0000473e ; jne 0x473e
+
+loc_0000466c:
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0xffbf
+add eax, 0xc38
+push eax
+call fcn_00018981 ; call 0x18981
+add esp, 0xc
+push 1
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0xffbf
+add eax, 0xc38
+push eax
+call fcn_00018981 ; call 0x18981
+add esp, 0xc
+push 2
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0xffbf
+add eax, 0xc38
+push eax
+call fcn_00018981 ; call 0x18981
+add esp, 0xc
+push 0
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 2
+push 0xfffc
+add eax, 0x260
+push eax
+call fcn_00018981 ; call 0x18981
+add esp, 0xc
+push 1
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 2
+push 0xfffc
+add eax, 0x260
+push eax
+call fcn_00018981 ; call 0x18981
+add esp, 0xc
+push 2
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 2
+push 0xfffc
+add eax, 0x260
+push eax
+call fcn_00018981 ; call 0x18981
+jmp short loc_00004762 ; jmp 0x4762
+
+loc_0000473e:
+push eax
+push 0
+push 0xffffffffffffffbf
+lea eax, [ebx + 0xc38]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0xc
+push 2
+push 0xfffffffffffffffc
+lea eax, [ebx + 0x260]
+push eax
+call fcn_00018b68 ; call 0x18b68
+
+loc_00004762:
+add esp, 0x10
+xor esi, esi
+lea edi, [ebx + 0x900]
+
+loc_0000476d:
+test ebx, ebx
+je short loc_00004783 ; je 0x4783
+push eax
+mov eax, esi
+push 0
+shl eax, 5
+push 0xf3ffffff
+add eax, edi
+push eax
+jmp short loc_000047a3 ; jmp 0x47a3
+
+loc_00004783:
+push eax
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+lea edx, [esi + 0x48]
+push 0
+shl edx, 5
+push 0xf3ffffff
+add edx, eax
+push edx
+
+loc_000047a3:
+call fcn_00018b68 ; call 0x18b68
+inc esi
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jb short loc_0000476d ; jb 0x476d
+xor esi, esi
+lea edi, [ebx + 0x904]
+
+loc_000047b9:
+test ebx, ebx
+je short loc_000047d1 ; je 0x47d1
+push eax
+mov eax, esi
+push 0xc00
+shl eax, 5
+push 0xfffff3ff
+add eax, edi
+jmp short loc_000047f7 ; jmp 0x47f7
+
+loc_000047d1:
+push eax
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+mov edx, esi
+push 0xc00
+shl edx, 5
+push 0xfffff3ff
+lea eax, [eax + edx + 0x904]
+
+loc_000047f7:
+push eax
+inc esi
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jb short loc_000047b9 ; jb 0x47b9
+test ebx, ebx
+jne near loc_00004902 ; jne 0x4902
+
+loc_0000480e:
+push esi
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+mov edx, ebx
+push 0xe000000
+inc ebx
+shl edx, 5
+push 0xc1ffffff
+lea eax, [eax + edx + 0x90c]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp ebx, dword [ebp - 0x1c]
+jb short loc_0000480e ; jb 0x480e
+cmp dword [ebp - 0x20], 0x40670
+jne short loc_00004870 ; jne 0x4870
+cmp byte [ebp - 0x24], 0
+jne short loc_00004877 ; jne 0x4877
+push ecx
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+jne short loc_00004877 ; jne 0x4877
+
+loc_00004870:
+xor esi, esi
+or ebx, 0xffffffff
+jmp short loc_00004881 ; jmp 0x4881
+
+loc_00004877:
+mov esi, 0x124
+mov ebx, 0xfffffedb
+
+loc_00004881:
+push edx
+and ebx, 0xc7ffffff
+push 0
+or esi, 0x28000000
+push 1
+xor edi, edi
+push 0
+mov dword [ebp - 0x20], ebx
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0x10
+lea ebx, [eax + 0x91c]
+
+loc_000048a7:
+push eax
+inc edi
+push esi
+push dword [ebp - 0x20]
+push ebx
+add ebx, 0x20
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp edi, dword [ebp - 0x1c]
+jb short loc_000048a7 ; jb 0x48a7
+jmp short loc_00004902 ; jmp 0x4902
+
+loc_000048c0:
+push 0
+push 0x15
+push 0xc008001
+push dword [ebp + 0xc]
+call fcn_000041ca ; call 0x41ca
+add esp, 0x10
+and eax, 0xc1ffffff
+mov edx, eax
+or eax, 0x1c000000
+or edx, 0x6000000
+cmp byte [ebp - 0x28], 1
+cmove edx, eax
+push edx
+push 0x16
+push 0xc008001
+push dword [ebp + 0xc]
+call fcn_000041ca ; call 0x41ca
+jmp near loc_000045da ; jmp 0x45da
+
+loc_00004902:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000490a:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x10
+mov eax, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0xc]
+mov dword [ebp - 0xc], eax
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00004935 ; je 0x4935
+push edx
+push edx
+push ref_0002141a ; push 0x2141a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00004935:
+test bl, bl
+jne short loc_00004949 ; jne 0x4949
+cmp byte [ebp - 0xc], 3
+sete al
+lea esi, [eax*4 + 4]
+jmp short loc_0000496b ; jmp 0x496b
+
+loc_00004949:
+cmp bl, 1
+jne short loc_00004964 ; jne 0x4964
+cmp byte [ebp - 0xc], 2
+mov esi, 4
+je short loc_0000496b ; je 0x496b
+
+loc_00004959:
+cmp byte [ebp - 0xc], 1
+sbb esi, esi
+and esi, 2
+jmp short loc_0000496b ; jmp 0x496b
+
+loc_00004964:
+cmp bl, 2
+je short loc_00004959 ; je 0x4959
+xor esi, esi
+
+loc_0000496b:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000498a ; je 0x498a
+push eax
+mov eax, esi
+movzx eax, al
+push eax
+push ref_00021436 ; push 0x21436
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000498a:
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00004993:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov eax, dword [ebp + 0xc]
+push 0
+mov ebx, dword [ebp + 0x14]
+push 1
+push 0
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x10]
+mov edi, ebx
+mov dword [ebp - 0x20], eax
+call fcn_00016c9a ; call 0x16c9a
+mov esi, eax
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_000049d7 ; je 0x49d7
+push eax
+push eax
+push ref_0002144e ; push 0x2144e
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000049d7:
+test bl, bl
+jne short loc_00004a02 ; jne 0x4a02
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_00004b00 ; je 0x4b00
+mov dword [ebp + 0xc], ref_00021472 ; mov dword [ebp + 0xc], 0x21472
+mov dword [ebp + 8], 0x40
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00015487 ; jmp 0x15487
+
+loc_00004a02:
+sub esp, 0xc
+lea eax, [esi + 0xd0c]
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+xor ecx, ecx
+test eax, 0x100000
+je short loc_00004a3f ; je 0x4a3f
+call fcn_00015479 ; call 0x15479
+mov cl, 1
+test al, al
+je short loc_00004a3f ; je 0x4a3f
+push eax
+push eax
+push ref_00021493 ; push 0x21493
+push 0x40
+mov dword [ebp - 0x24], ecx
+call fcn_00015487 ; call 0x15487
+mov ecx, dword [ebp - 0x24]
+add esp, 0x10
+
+loc_00004a3f:
+cmp byte [ebp - 0x1c], 0
+jne short loc_00004a62 ; jne 0x4a62
+cmp byte [ebp - 0x20], 3
+jne short loc_00004a55 ; jne 0x4a55
+xor edx, edx
+
+loc_00004a4d:
+test cl, cl
+jne short loc_00004a98 ; jne 0x4a98
+
+loc_00004a51:
+mov dl, 8
+jmp short loc_00004a86 ; jmp 0x4a86
+
+loc_00004a55:
+mov dl, 4
+mov al, dl
+sub eax, ebx
+test cl, cl
+cmove edx, eax
+jmp short loc_00004a98 ; jmp 0x4a98
+
+loc_00004a62:
+cmp byte [ebp - 0x1c], 1
+jne short loc_00004a8a ; jne 0x4a8a
+cmp byte [ebp - 0x20], 2
+jne short loc_00004a76 ; jne 0x4a76
+xor edx, edx
+test cl, cl
+jne short loc_00004a98 ; jne 0x4a98
+jmp short loc_00004a51 ; jmp 0x4a51
+
+loc_00004a76:
+xor edx, edx
+cmp byte [ebp - 0x20], 0
+jne short loc_00004a98 ; jne 0x4a98
+mov dl, 2
+test cl, cl
+jne short loc_00004a98 ; jne 0x4a98
+mov dl, 6
+
+loc_00004a86:
+sub edx, ebx
+jmp short loc_00004a98 ; jmp 0x4a98
+
+loc_00004a8a:
+xor edx, edx
+cmp byte [ebp - 0x1c], 2
+jne short loc_00004a98 ; jne 0x4a98
+cmp byte [ebp - 0x20], 0
+je short loc_00004a4d ; je 0x4a4d
+
+loc_00004a98:
+mov dword [ebp - 0x20], edx
+call fcn_00015479 ; call 0x15479
+mov edx, dword [ebp - 0x20]
+test al, al
+je short loc_00004ace ; je 0x4ace
+movzx eax, dl
+movzx ebx, bl
+push ecx
+push ecx
+lea ecx, [eax + ebx - 1]
+push ecx
+push eax
+movzx eax, byte [ebp - 0x1c]
+push eax
+push 0
+push ref_000214ac ; push 0x214ac
+push 0x40
+call fcn_00015487 ; call 0x15487
+mov edx, dword [ebp - 0x20]
+add esp, 0x20
+
+loc_00004ace:
+xor ebx, ebx
+add esi, 0x91c
+
+loc_00004ad6:
+lea eax, [edx + ebx]
+mov ecx, edi
+inc ebx
+cmp cl, bl
+jb short loc_00004b00 ; jb 0x4b00
+mov dword [ebp - 0x1c], edx
+movzx eax, al
+push edx
+push edx
+shl eax, 5
+push 0x80000000
+add eax, esi
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+mov edx, dword [ebp - 0x1c]
+jmp short loc_00004ad6 ; jmp 0x4ad6
+
+loc_00004b00:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00004b08:
+push ebp
+mov ecx, 0x15
+mov ebp, esp
+push edi
+push esi
+mov esi, ref_000203b0 ; mov esi, 0x203b0
+push ebx
+add esp, 0xffffff80
+lea edi, [ebp - 0x2d]
+rep movsb ; rep movsb byte es:[edi], byte ptr [esi]
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 0
+push 1
+push 0
+mov edi, eax
+mov dword [ebp - 0x78], eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 1
+push 1
+push 0
+mov ebx, eax
+mov dword [ebp - 0x40], eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 2
+push 1
+push 0
+mov dword [ebp - 0x50], eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0
+push 1
+mov dword [ebp - 0x54], eax
+call fcn_00016c9a ; call 0x16c9a
+mov dword [ebp - 0x64], eax
+lea eax, [edi + 0x48]
+mov dword [esp], eax
+call fcn_00017ed8 ; call 0x17ed8
+mov esi, eax
+lea eax, [edi + 0x68]
+mov dword [esp], eax
+call fcn_00017ed8 ; call 0x17ed8
+mov eax, dword [ebp + 0xc]
+mov byte [ebp - 0x38], 0
+mov eax, dword [eax + 0xd]
+mov cl, byte [eax + 0x40]
+mov dword [esp], ebx
+mov byte [ebp - 0x4a], cl
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_00004bcd ; jne 0x4bcd
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_00005d48 ; je 0x5d48
+push eax
+push eax
+push ref_000214c7 ; push 0x214c7
+push 0x40
+call fcn_00015487 ; call 0x15487
+jmp near loc_00005d01 ; jmp 0x5d01
+
+loc_00004bcd:
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x504
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+shr eax, 0x10
+and eax, 3
+mov byte [ebp - 0x48], al
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00004c10 ; je 0x4c10
+push eax
+movzx eax, byte [ebp - 0x48]
+push eax
+push ref_000214e4 ; push 0x214e4
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00004c10:
+lea eax, [ebp - 0x34]
+push eax
+push 0
+push 0
+push ref_000290cc ; push 0x290cc
+call fcn_0001975d ; call 0x1975d
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00004c69 ; je 0x4c69
+test ebx, ebx
+jns short loc_00004c69 ; jns 0x4c69
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00004c51 ; je 0x4c51
+push edi
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00004c51:
+push ebx
+push ref_000206f4 ; push 0x206f4
+push 0x67c
+push ref_00020f0c ; push 0x20f0c
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00004c69:
+mov al, byte [ebp - 0x48]
+test al, al
+je short loc_00004c7a ; je 0x4c7a
+cmp al, 2
+jne short loc_00004c82 ; jne 0x4c82
+mov byte [ebp - 0x28], 8
+jmp short loc_00004c82 ; jmp 0x4c82
+
+loc_00004c7a:
+mov byte [ebp - 0x28], 8
+mov byte [ebp - 0x21], 4
+
+loc_00004c82:
+call fcn_0001c651 ; call 0x1c651
+mov ebx, 1
+mov dword [ebp - 0x58], eax
+call fcn_0001c678 ; call 0x1c678
+push ecx
+push 0
+push 0
+push 0
+mov dword [ebp - 0x44], eax
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xe8
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test eax, 0x100000
+je short loc_00004cd6 ; je 0x4cd6
+call fcn_00015479 ; call 0x15479
+xor ebx, ebx
+test al, al
+je short loc_00004cd6 ; je 0x4cd6
+push edx
+push edx
+push ref_000214fb ; push 0x214fb
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00004cd6:
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 0x3b], 2
+jne short loc_00004ce6 ; jne 0x4ce6
+mov byte [eax + 0x3b], 1
+
+loc_00004ce6:
+mov eax, dword [ebp + 0xc]
+cmp byte [eax], 1
+ja short loc_00004cfa ; ja 0x4cfa
+
+loc_00004cee:
+mov dword [ebp - 0x3c], 0
+jmp near loc_00004dc3 ; jmp 0x4dc3
+
+loc_00004cfa:
+sub esp, 0xc
+push ref_0002955c ; push 0x2955c
+call fcn_000190fd ; call 0x190fd
+add esp, 0x10
+mov dword [ebp - 0x3c], eax
+test eax, eax
+je short loc_00004cee ; je 0x4cee
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp dword [eax + 0x44], 0
+jne short loc_00004d31 ; jne 0x4d31
+
+loc_00004d1d:
+mov eax, dword [ebp + 0xc]
+mov ecx, dword [ebp - 0x3c]
+mov eax, dword [eax + 0xd]
+mov al, byte [eax + 0x3b]
+mov byte [ecx + 0x45], al
+jmp near loc_00004dc3 ; jmp 0x4dc3
+
+loc_00004d31:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00004d4c ; je 0x4d4c
+push eax
+push 0x21
+push ref_0002150f ; push 0x2150f
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00004d4c:
+push eax
+mov eax, dword [ebp + 0xc]
+push 0x21
+mov edi, dword [ebp - 0x3c]
+mov eax, dword [eax + 0xd]
+push dword [eax + 0x44]
+mov eax, edi
+add eax, 0x29
+push eax
+call fcn_0001713e ; call 0x1713e
+mov eax, dword [ebp + 0xc]
+add esp, 0x10
+mov byte [edi + 0x28], 1
+mov eax, dword [eax + 0xd]
+mov al, byte [eax + 0x3b]
+cmp byte [edi + 0x45], al
+je short loc_00004d1d ; je 0x4d1d
+dec al
+je short loc_00004d1d ; je 0x4d1d
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00004d99 ; je 0x4d99
+push eax
+push eax
+push ref_00021541 ; push 0x21541
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00004d99:
+xor eax, eax
+
+loc_00004d9b:
+mov ecx, dword [ebp - 0x3c]
+xor edx, edx
+mov dword [ecx + eax + 0x29], 0
+
+loc_00004da8:
+mov ecx, dword [ebp - 0x3c]
+mov byte [ecx + edx + 0x35], 0
+inc edx
+cmp edx, 0x10
+jne short loc_00004da8 ; jne 0x4da8
+add eax, 4
+cmp eax, 0xc
+jne short loc_00004d9b ; jne 0x4d9b
+jmp near loc_00004d1d ; jmp 0x4d1d
+
+loc_00004dc3:
+lea edi, [ebp - 0x2d]
+
+loc_00004dc6:
+push dword [ebp + 0xc]
+add edi, 7
+movzx eax, byte [edi - 5]
+push eax
+movzx eax, byte [edi - 6]
+push eax
+movzx eax, byte [edi - 7]
+push eax
+call fcn_00003fc6 ; call 0x3fc6
+lea eax, [ebp - 0x18]
+add esp, 0x10
+cmp edi, eax
+jne short loc_00004dc6 ; jne 0x4dc6
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00004e04 ; je 0x4e04
+push eax
+push eax
+push ref_0002157a ; push 0x2157a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00004e04:
+movzx eax, byte [ebp - 0x4a]
+sub esp, 0xc
+and esi, 0xfffffffe
+push eax
+push 1
+push 0
+push esi
+push dword [ebp + 0xc]
+call fcn_00004257 ; call 0x4257
+add esp, 0x20
+cmp bl, 1
+jne short loc_00004e60 ; jne 0x4e60
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 8], 0
+je short loc_00004e60 ; je 0x4e60
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00004e4a ; je 0x4e4a
+push eax
+push eax
+push ref_00021589 ; push 0x21589
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00004e4a:
+push eax
+movzx eax, byte [ebp - 0x48]
+push eax
+movzx eax, byte [ebp - 0x44]
+push eax
+push dword [ebp + 0xc]
+call fcn_000031c0 ; call 0x31c0
+add esp, 0x10
+
+loc_00004e60:
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 0x39], 2
+jne short loc_00004e70 ; jne 0x4e70
+mov byte [eax + 0x39], 0
+
+loc_00004e70:
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 0x39], 1
+jne near loc_00004f0a ; jne 0x4f0a
+mov eax, dword [ebp - 0x40]
+sub esp, 0xc
+lea edx, [eax + 0xd0]
+push edx
+mov dword [ebp - 0x60], edx
+call fcn_00017dc2 ; call 0x17dc2
+mov word [ebp - 0x4a], ax
+mov eax, dword [ebp - 0x50]
+and word [ebp - 0x4a], 0xf
+lea edi, [eax + 0xd0]
+mov dword [esp], edi
+call fcn_00017dc2 ; call 0x17dc2
+mov word [ebp - 0x4c], ax
+mov eax, dword [ebp - 0x54]
+and word [ebp - 0x4c], 0xf
+lea esi, [eax + 0xd0]
+mov dword [esp], esi
+call fcn_00017dc2 ; call 0x17dc2
+mov edx, dword [ebp - 0x60]
+add esp, 0xc
+push 1
+push 0xfff0
+push edx
+mov word [ebp - 0x5a], ax
+and word [ebp - 0x5a], 0xf
+call fcn_00018981 ; call 0x18981
+add esp, 0xc
+push 1
+push 0xfff0
+push edi
+call fcn_00018981 ; call 0x18981
+add esp, 0xc
+push 1
+push 0xfff0
+push esi
+call fcn_00018981 ; call 0x18981
+add esp, 0x10
+jmp short loc_00004f1c ; jmp 0x4f1c
+
+loc_00004f0a:
+mov word [ebp - 0x5a], 0
+mov word [ebp - 0x4c], 0
+mov word [ebp - 0x4a], 0
+
+loc_00004f1c:
+movzx eax, byte [ebp - 0x44]
+xor esi, esi
+mov dword [ebp - 0x6c], eax
+
+loc_00004f25:
+push edi
+push ebx
+push dword [ebp - 0x6c]
+lea eax, [ebp - 0x2d]
+push esi
+inc esi
+push eax
+push dword [ebp + 0xc]
+push dword [ebp - 0x34]
+push dword [ebp + 8]
+call fcn_000039d3 ; call 0x39d3
+add esp, 0x20
+cmp esi, 3
+jne short loc_00004f25 ; jne 0x4f25
+mov eax, dword [ebp + 0xc]
+cmp byte [eax], 2
+ja near loc_00005003 ; ja 0x5003
+
+loc_00004f52:
+mov esi, dword [ebp - 0x40]
+sub esp, 0xc
+mov eax, esi
+add eax, 0xdd8
+push eax
+mov edi, eax
+mov dword [ebp - 0x60], eax
+call fcn_00017e4e ; call 0x17e4e
+pop ecx
+pop ebx
+or eax, 0x8002
+push eax
+push edi
+call fcn_00017e8f ; call 0x17e8f
+pop edi
+pop eax
+mov eax, esi
+add eax, 0xc24
+push 0xfffeffff
+push eax
+call fcn_00018b3e ; call 0x18b3e
+pop eax
+mov eax, dword [ebp - 0x50]
+pop edx
+add eax, 0xc24
+push 0xfffeffff
+push eax
+call fcn_00018b3e ; call 0x18b3e
+mov eax, dword [ebp - 0x54]
+pop ecx
+pop ebx
+lea ebx, [ebp - 0x2d]
+add eax, 0xc24
+push 0xfffeffff
+push eax
+call fcn_00018b3e ; call 0x18b3e
+movzx eax, byte [ebp - 0x48]
+mov esi, dword [ebp - 0x3c]
+mov dword [esp], eax
+mov edi, eax
+push esi
+push dword [ebp + 0xc]
+push dword [ebp - 0x34]
+push dword [ebp + 8]
+mov dword [ebp - 0x68], eax
+call fcn_00002634 ; call 0x2634
+add esp, 0x1c
+push edi
+push 3
+lea eax, [ebp - 0x2d]
+push eax
+push esi
+xor esi, esi
+push dword [ebp - 0x34]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00003787 ; call 0x3787
+mov eax, dword [ebp - 0x64]
+add esp, 0x20
+add eax, 0xc
+mov dword [ebp - 0x70], eax
+jmp near loc_0000509a ; jmp 0x509a
+
+loc_00005003:
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 0x52], 1
+jne near loc_00004f52 ; jne 0x4f52
+push edx
+mov al, byte [eax + 0x53]
+xor ebx, ebx
+mov edi, dword [ebp - 0x40]
+and eax, 0xf
+shl eax, 0x10
+push eax
+mov eax, edi
+push 0xfff0ffff
+add eax, 0xd0c
+push eax
+call fcn_00018b68 ; call 0x18b68
+lea esi, [edi + 0xa00]
+add esp, 0x10
+
+loc_0000503e:
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp bl, byte [eax + 0x53]
+jne short loc_00005058 ; jne 0x5058
+push eax
+push eax
+push 0xfffffdff
+push esi
+call fcn_00018b3e ; call 0x18b3e
+jmp short loc_00005065 ; jmp 0x5065
+
+loc_00005058:
+push edi
+push edi
+push 0x200
+push esi
+call fcn_00018b14 ; call 0x18b14
+
+loc_00005065:
+inc ebx
+add esp, 0x10
+add esi, 0x10
+cmp bl, 0x10
+jne short loc_0000503e ; jne 0x503e
+jmp near loc_00004f52 ; jmp 0x4f52
+
+loc_00005076:
+sub esp, 0xc
+lea eax, [edi + 0xba]
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test al, 0x40
+jne short loc_000050c1 ; jne 0x50c1
+
+loc_0000508c:
+add ebx, 7
+lea eax, [ebp - 0x18]
+cmp ebx, eax
+je near loc_0000512a ; je 0x512a
+
+loc_0000509a:
+push ecx
+movzx eax, byte [ebx + 2]
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+movzx eax, byte [ebx]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+mov edi, eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_00005076 ; jne 0x5076
+jmp short loc_0000508c ; jmp 0x508c
+
+loc_000050c1:
+mov byte [ebx + 4], 1
+add edi, 0x18
+push ecx
+push 0x10100
+push 0xff0000ff
+push edi
+call fcn_00018b68 ; call 0x18b68
+pop eax
+pop edx
+push 0
+push dword [ebp - 0x64]
+call fcn_00017e04 ; call 0x17e04
+push 0x10
+push 0
+push 0
+push 1
+call fcn_00002862 ; call 0x2862
+add esp, 0x20
+test eax, eax
+je short loc_00005115 ; je 0x5115
+add eax, dword [ebp - 0x70]
+sub esp, 0xc
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+and eax, 0xf
+cmp al, 3
+mov byte [ebx + 6], al
+mov al, 1
+cmovae esi, eax
+
+loc_00005115:
+push edx
+push edx
+push 0xff0000ff
+push edi
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+jmp near loc_0000508c ; jmp 0x508c
+
+loc_0000512a:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00005144 ; je 0x5144
+push eax
+push eax
+push ref_000215a3 ; push 0x215a3
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00005144:
+lea ebx, [ebp - 0x2d]
+
+loc_00005147:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00005175 ; je 0x5175
+push eax
+push eax
+movzx eax, byte [ebx + 6]
+push eax
+movzx eax, byte [ebx + 4]
+push eax
+movzx eax, byte [ebx + 2]
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+push ref_000215bd ; push 0x215bd
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_00005175:
+add ebx, 7
+lea eax, [ebp - 0x18]
+cmp ebx, eax
+jne short loc_00005147 ; jne 0x5147
+mov eax, esi
+test al, al
+jne short loc_0000519a ; jne 0x519a
+
+loc_00005185:
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 0x39], 1
+jne near loc_0000538f ; jne 0x538f
+jmp near loc_000052f8 ; jmp 0x52f8
+
+loc_0000519a:
+mov eax, dword [ebp - 0x58]
+cmp eax, 0x40660
+je short loc_000051ab ; je 0x51ab
+cmp eax, 0x306c0
+jne short loc_000051b8 ; jne 0x51b8
+
+loc_000051ab:
+xor ebx, ebx
+lea esi, [ebp - 0x38]
+lea edi, [ebp - 0x35]
+jmp near loc_0000523a ; jmp 0x523a
+
+loc_000051b8:
+cmp dword [ebp - 0x58], 0x40670
+jne short loc_00005185 ; jne 0x5185
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+jne short loc_000051ab ; jne 0x51ab
+jmp short loc_00005185 ; jmp 0x5185
+
+loc_000051e1:
+cmp bl, 0xc
+je short loc_0000524c ; je 0x524c
+test bl, bl
+jne short loc_000051f7 ; jne 0x51f7
+push eax
+push eax
+push esi
+push 0
+
+loc_000051ef:
+call fcn_0000937d ; call 0x937d
+add esp, 0x10
+
+loc_000051f7:
+sub esp, 0xc
+movzx ecx, byte [ebp - 0x38]
+push edi
+lea edx, [ebp - 0x36]
+push edx
+lea eax, [ebp - 0x37]
+push eax
+push ecx
+mov dword [ebp - 0x70], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x74], edx
+mov ecx, dword [eax + 0xd]
+movzx ecx, byte [ecx + ebx + 0x19]
+push ecx
+call fcn_000093d9 ; call 0x93d9
+mov edx, dword [ebp - 0x74]
+add esp, 0x20
+mov eax, dword [ebp - 0x70]
+push edi
+push edx
+push eax
+push ebx
+inc ebx
+call fcn_000094be ; call 0x94be
+add esp, 0x10
+cmp ebx, 0x10
+je short loc_00005259 ; je 0x5259
+
+loc_0000523a:
+cmp bl, 8
+jne short loc_000051e1 ; jne 0x51e1
+cmp byte [ebp - 0x22], 0
+je short loc_000051f7 ; je 0x51f7
+push eax
+push eax
+push esi
+push 8
+jmp short loc_000051ef ; jmp 0x51ef
+
+loc_0000524c:
+cmp byte [ebp - 0x1b], 0
+je short loc_000051f7 ; je 0x51f7
+push eax
+push eax
+push esi
+push 0xc
+jmp short loc_000051ef ; jmp 0x51ef
+
+loc_00005259:
+cmp dword [ebp - 0x44], 0
+je short loc_00005283 ; je 0x5283
+cmp dword [ebp - 0x58], 0x40670
+jne short loc_00005283 ; jne 0x5283
+mov edi, dword [ebp - 0x60]
+sub esp, 0xc
+push edi
+call fcn_00017e4e ; call 0x17e4e
+pop edx
+pop ecx
+and ah, 0x7f
+push eax
+push edi
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+
+loc_00005283:
+lea ebx, [ebp - 0x2d]
+
+loc_00005286:
+cmp byte [ebx + 4], 0
+je short loc_000052c5 ; je 0x52c5
+push eax
+movzx eax, byte [ebx + 2]
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+movzx eax, byte [ebx]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+mov esi, eax
+pop eax
+pop edx
+lea eax, [esi + 0xd98]
+add esi, 0xb0
+push 1
+push eax
+call fcn_00018b14 ; call 0x18b14
+pop ecx
+pop edi
+push 0x20
+push esi
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+
+loc_000052c5:
+add ebx, 7
+lea eax, [ebp - 0x18]
+cmp ebx, eax
+jne short loc_00005286 ; jne 0x5286
+lea ebx, [ebp - 0x2d]
+
+loc_000052d2:
+cmp byte [ebx + 4], 0
+je short loc_000052e9 ; je 0x52e9
+push 0
+push ebx
+push dword [ebp - 0x34]
+push dword [ebp + 8]
+call fcn_00005d50 ; call 0x5d50
+add esp, 0x10
+
+loc_000052e9:
+add ebx, 7
+lea eax, [ebp - 0x18]
+cmp ebx, eax
+jne short loc_000052d2 ; jne 0x52d2
+jmp near loc_00005185 ; jmp 0x5185
+
+loc_000052f8:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00005312 ; je 0x5312
+push eax
+push eax
+push ref_000215f5 ; push 0x215f5
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00005312:
+sub esp, 0xc
+push dword [ebp - 0x68]
+push dword [ebp - 0x6c]
+push dword [ebp - 0x34]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00003714 ; call 0x3714
+movzx eax, word [ebp - 0x4a]
+add esp, 0x1c
+push eax
+mov eax, dword [ebp - 0x40]
+push 0xfff0
+add eax, 0xd0
+push eax
+call fcn_00018981 ; call 0x18981
+movzx eax, word [ebp - 0x4c]
+add esp, 0xc
+push eax
+mov eax, dword [ebp - 0x50]
+push 0xfff0
+add eax, 0xd0
+push eax
+call fcn_00018981 ; call 0x18981
+movzx eax, word [ebp - 0x5a]
+add esp, 0xc
+push eax
+mov eax, dword [ebp - 0x54]
+push 0xfff0
+add eax, 0xd0
+push eax
+call fcn_00018981 ; call 0x18981
+mov eax, dword [ebp - 0x34]
+add esp, 0xc
+push 0x186a0
+push eax
+push dword [ebp + 8]
+call dword [eax + 4] ; ucall
+add esp, 0x10
+
+loc_0000538f:
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 0x3b], 2
+jne short loc_0000539f ; jne 0x539f
+mov byte [eax + 0x3b], 1
+
+loc_0000539f:
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 0x3b], 1
+jne short loc_000053bf ; jne 0x53bf
+push dword [ebp - 0x3c]
+push dword [ebp - 0x34]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_000082e3 ; call 0x82e3
+add esp, 0x10
+
+loc_000053bf:
+cmp dword [ebp - 0x58], 0x40670
+sete al
+cmp dword [ebp - 0x44], 0
+mov byte [ebp - 0x74], al
+je short loc_000053df ; je 0x53df
+test al, al
+je short loc_000053df ; je 0x53df
+push edi
+push edi
+push 0x4000
+jmp short loc_000053e6 ; jmp 0x53e6
+
+loc_000053df:
+push esi
+push esi
+push 0xc000
+
+loc_000053e6:
+push dword [ebp - 0x60]
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000540b ; je 0x540b
+push ebx
+push ebx
+push ref_00021610 ; push 0x21610
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000540b:
+mov eax, dword [ebp - 0x64]
+lea edi, [ebp - 0x2d]
+mov byte [ebp - 0x60], 0
+mov byte [ebp - 0x70], 0
+mov byte [ebp - 0x44], 0
+add eax, 0xc
+mov byte [ebp - 0x5a], 0
+mov byte [ebp - 0x4a], 0
+mov dword [ebp - 0x80], eax
+
+loc_0000542b:
+mov al, byte [edi]
+mov ecx, dword [ebp - 0x3c]
+mov byte [ebp - 0x5c], al
+mov al, byte [edi + 1]
+mov byte [ebp - 0x5b], al
+mov al, byte [edi + 2]
+mov byte [ebp - 0x6c], al
+movzx eax, byte [edi + 3]
+mov byte [ebp - 0x4c], al
+test ecx, ecx
+je short loc_00005458 ; je 0x5458
+mov edx, dword [ebp + 0xc]
+mov edx, dword [edx + 0xd]
+mov dl, byte [edx + eax + 0x5c]
+mov byte [ecx + eax + 0x47], dl
+
+loc_00005458:
+movzx eax, byte [ebp - 0x6c]
+push ecx
+push eax
+movzx eax, byte [ebp - 0x5b]
+push eax
+movzx eax, byte [ebp - 0x5c]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+mov esi, eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+je short loc_0000548a ; je 0x548a
+cmp byte [edi + 4], 0
+jne short loc_00005499 ; jne 0x5499
+
+loc_0000548a:
+cmp byte [eax + 4], 0
+je near loc_0000578e ; je 0x578e
+jmp near loc_00005768 ; jmp 0x5768
+
+loc_00005499:
+cmp byte [eax + 4], 0
+jne short loc_000054e8 ; jne 0x54e8
+push eax
+push 0x10100
+push 0xff0000ff
+lea ebx, [esi + 0x18]
+push ebx
+call fcn_00018b68 ; call 0x18b68
+pop eax
+pop edx
+push 0
+push dword [ebp - 0x64]
+call fcn_00017e04 ; call 0x17e04
+lea eax, [esi + 0x11a]
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test al, 2
+jne near loc_0000578e ; jne 0x578e
+push eax
+push eax
+push 0xff0000ff
+push ebx
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+
+loc_000054e8:
+mov eax, dword [ebp + 0xc]
+cmp byte [eax], 0xf
+jbe short loc_0000553d ; jbe 0x553d
+movzx ebx, byte [ebp - 0x4c]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + ebx + 0x61], 0
+je short loc_0000553d ; je 0x553d
+sub esp, 0xc
+lea eax, [esi + 0xb2]
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+mov ecx, dword [ebp + 0xc]
+add esp, 0x10
+mov edx, dword [ecx + 0xd]
+and eax, 0x3f0
+sar eax, 4
+movzx edx, byte [edx + ebx + 0x61]
+cmp dl, al
+je short loc_0000553d ; je 0x553d
+movzx eax, byte [ebp - 0x6c]
+push eax
+movzx eax, byte [ebp - 0x5b]
+push eax
+push edx
+push dword [ebp + 8]
+call fcn_000028d8 ; call 0x28d8
+add esp, 0x10
+
+loc_0000553d:
+mov eax, dword [ebp + 0xc]
+cmp byte [eax], 7
+jbe short loc_00005559 ; jbe 0x5559
+mov edx, dword [eax + 0xd]
+movzx eax, byte [ebp - 0x4c]
+mov bl, byte [edx + eax + 0x5c]
+cmp bl, 0xff
+jne near loc_0000567d ; jne 0x567d
+
+loc_00005559:
+sub esp, 0xc
+lea eax, [esi + 0xac]
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0xc
+push 0x10100
+push 0xff0000ff
+lea ebx, [esi + 0x18]
+push ebx
+shr eax, 4
+and eax, 0x3f
+mov byte [ebp - 0x79], al
+call fcn_00018b68 ; call 0x18b68
+pop edx
+pop ecx
+push 0
+push dword [ebp - 0x64]
+call fcn_00017e04 ; call 0x17e04
+pop eax
+push dword [ebp - 0x64]
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+inc eax
+jne short loc_000055ec ; jne 0x55ec
+sub esp, 0xc
+add esi, 0xb2
+push esi
+call fcn_00017dc2 ; call 0x17dc2
+mov esi, eax
+and esi, 0x3f0
+sar esi, 4
+mov eax, esi
+mov byte [ebp - 0x70], al
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00005618 ; je 0x5618
+movzx eax, byte [ebp - 0x6c]
+sub esp, 0xc
+push esi
+push eax
+movzx eax, byte [ebp - 0x5b]
+push eax
+push ref_0002162c ; push 0x2162c
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+jmp short loc_00005618 ; jmp 0x5618
+
+loc_000055ec:
+push 0x10
+push 0
+push 0
+push 1
+call fcn_00002862 ; call 0x2862
+add esp, 0x10
+test eax, eax
+je short loc_00005618 ; je 0x5618
+add eax, dword [ebp - 0x80]
+sub esp, 0xc
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+shr eax, 4
+and eax, 0x3f
+mov byte [ebp - 0x70], al
+
+loc_00005618:
+push eax
+push eax
+push 0xff0000ff
+push ebx
+call fcn_00018b3e ; call 0x18b3e
+mov cl, byte [ebp - 0x79]
+add esp, 0x10
+mov bl, byte [ebp - 0x70]
+xor edx, edx
+mov al, cl
+sub eax, ebx
+cmp cl, bl
+cmova edx, eax
+mov bl, 0xff
+mov al, dl
+shr al, 1
+mov dword [ebp - 0x84], edx
+mov byte [ebp - 0x60], al
+call fcn_00015479 ; call 0x15479
+mov edx, dword [ebp - 0x84]
+test al, al
+je short loc_000056a1 ; je 0x56a1
+push eax
+movzx edx, dl
+push eax
+movzx eax, byte [ebp - 0x60]
+push eax
+movzx eax, byte [ebp - 0x70]
+push edx
+push eax
+movzx eax, byte [ebp - 0x79]
+push eax
+push ref_00021698 ; push 0x21698
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+jmp short loc_000056a1 ; jmp 0x56a1
+
+loc_0000567d:
+test bl, bl
+je short loc_000056a1 ; je 0x56a1
+call fcn_00015479 ; call 0x15479
+mov byte [ebp - 0x60], bl
+test al, al
+je short loc_000056a1 ; je 0x56a1
+push eax
+movzx eax, bl
+push eax
+push ref_0002170b ; push 0x2170b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000056a1:
+mov eax, dword [ebp - 0x58]
+cmp eax, 0x40660
+je short loc_000056b2 ; je 0x56b2
+cmp eax, 0x306c0
+jne short loc_000056b8 ; jne 0x56b8
+
+loc_000056b2:
+test bl, bl
+je short loc_00005734 ; je 0x5734
+jmp short loc_000056de ; jmp 0x56de
+
+loc_000056b8:
+cmp byte [ebp - 0x74], 0
+je short loc_00005734 ; je 0x5734
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+jne short loc_000056b2 ; jne 0x56b2
+jmp short loc_00005734 ; jmp 0x5734
+
+loc_000056de:
+movzx esi, byte [ebp - 0x6c]
+push eax
+push dword [ebp - 0x68]
+push esi
+push dword [ebp + 8]
+call fcn_0000490a ; call 0x490a
+add esp, 0x10
+mov bl, al
+cmp byte [ebp - 0x60], al
+jbe short loc_0000571b ; jbe 0x571b
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000571e ; je 0x571e
+push eax
+movzx eax, bl
+push eax
+push ref_000216d6 ; push 0x216d6
+push 0x80000040
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp short loc_0000571e ; jmp 0x571e
+
+loc_0000571b:
+mov bl, byte [ebp - 0x60]
+
+loc_0000571e:
+movzx eax, bl
+push eax
+push dword [ebp - 0x68]
+push esi
+push dword [ebp + 8]
+call fcn_00004993 ; call 0x4993
+add esp, 0x10
+mov byte [ebp - 0x60], bl
+
+loc_00005734:
+call fcn_00015479 ; call 0x15479
+movzx esi, byte [ebp - 0x6c]
+movzx ebx, byte [ebp - 0x5b]
+test al, al
+je short loc_00005756 ; je 0x5756
+push esi
+push ebx
+push ref_00021720 ; push 0x21720
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00005756:
+movzx eax, byte [ebp - 0x5c]
+push esi
+push ebx
+push eax
+push dword [ebp + 0xc]
+call fcn_00003b13 ; call 0x3b13
+add esp, 0x10
+
+loc_00005768:
+cmp byte [ebp - 0x4c], 0
+jne short loc_00005774 ; jne 0x5774
+cmp byte [ebp - 0x48], 3
+je short loc_000057d1 ; je 0x57d1
+
+loc_00005774:
+cmp byte [ebp - 0x4c], 1
+jne short loc_00005780 ; jne 0x5780
+cmp byte [ebp - 0x48], 2
+je short loc_000057e9 ; je 0x57e9
+
+loc_00005780:
+cmp byte [ebp - 0x4c], 2
+jne short loc_000057c1 ; jne 0x57c1
+cmp byte [ebp - 0x48], 0
+je short loc_000057ed ; je 0x57ed
+jmp short loc_000057c1 ; jmp 0x57c1
+
+loc_0000578e:
+mov al, byte [ebp - 0x48]
+cmp al, 3
+je short loc_000057db ; je 0x57db
+cmp al, 2
+jne short loc_000057a5 ; jne 0x57a5
+cmp byte [ebp - 0x4c], 0
+mov byte [ebp - 0x44], 1
+je short loc_000057bd ; je 0x57bd
+jmp short loc_000057d5 ; jmp 0x57d5
+
+loc_000057a5:
+cmp byte [ebp - 0x48], 0
+jne short loc_000057c1 ; jne 0x57c1
+cmp byte [ebp - 0x4c], 0
+je short loc_000057bd ; je 0x57bd
+cmp byte [ebp - 0x4c], 1
+jne short loc_000057e9 ; jne 0x57e9
+mov byte [ebp - 0x5a], 1
+jmp short loc_000057c1 ; jmp 0x57c1
+
+loc_000057bd:
+mov byte [ebp - 0x4a], 1
+
+loc_000057c1:
+add edi, 7
+lea eax, [ebp - 0x18]
+cmp edi, eax
+jne near loc_0000542b ; jne 0x542b
+jmp short loc_000057ed ; jmp 0x57ed
+
+loc_000057d1:
+mov byte [ebp - 0x44], 1
+
+loc_000057d5:
+mov byte [ebp - 0x5a], 1
+jmp short loc_000057ed ; jmp 0x57ed
+
+loc_000057db:
+mov byte [ebp - 0x44], 1
+mov byte [ebp - 0x5a], 1
+mov byte [ebp - 0x4a], 1
+jmp short loc_000057ed ; jmp 0x57ed
+
+loc_000057e9:
+mov byte [ebp - 0x44], 1
+
+loc_000057ed:
+mov dl, byte [ebp - 0x44]
+xor ebx, ebx
+mov al, byte [ebp - 0x5a]
+xor edx, 1
+xor eax, 1
+or dl, al
+je short loc_00005806 ; je 0x5806
+mov bl, byte [ebp - 0x4a]
+mov byte [ebp - 0x4a], 0
+
+loc_00005806:
+sub esp, 0xc
+mov esi, 1
+push dword [ebp - 0x40]
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_00005839 ; jne 0x5839
+call fcn_00015479 ; call 0x15479
+xor esi, esi
+test al, al
+je short loc_00005839 ; je 0x5839
+push ecx
+push ecx
+push ref_0002174b ; push 0x2174b
+push 2
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00005839:
+or bl, byte [ebp - 0x4a]
+je near loc_00005968 ; je 0x5968
+mov eax, esi
+test al, al
+je near loc_00005968 ; je 0x5968
+mov edi, dword [ebp - 0x40]
+mov ebx, 0x3e9
+push eax
+push eax
+push 0x100
+mov eax, edi
+add eax, 0x224
+push eax
+call fcn_00018b14 ; call 0x18b14
+lea esi, [edi + 0x464]
+pop eax
+mov eax, edi
+pop edx
+add eax, 0xb0
+push 0x10
+push eax
+call fcn_00018730 ; call 0x18730
+add esp, 0x10
+
+loc_00005882:
+sub esp, 0xc
+push esi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+and eax, 0x3f
+cmp eax, 2
+je short loc_000058ac ; je 0x58ac
+dec bx
+je short loc_000058ac ; je 0x58ac
+mov eax, dword [ebp - 0x34]
+push edi
+push 0x64
+push eax
+push dword [ebp + 8]
+call dword [eax + 4] ; ucall
+add esp, 0x10
+jmp short loc_00005882 ; jmp 0x5882
+
+loc_000058ac:
+mov eax, dword [ebp - 0x40]
+push esi
+push 0x20
+push 0xcf
+add eax, 0xc20
+push eax
+call fcn_0001878a ; call 0x1878a
+mov eax, dword [ebp - 0x58]
+add esp, 0x10
+cmp eax, 0x40660
+je short loc_000058d6 ; je 0x58d6
+cmp eax, 0x306c0
+jne short loc_000058f9 ; jne 0x58f9
+
+loc_000058d6:
+mov edi, dword [ebp - 0x68]
+push ebx
+push edi
+push 0
+push dword [ebp + 8]
+call fcn_0000490a ; call 0x490a
+movzx eax, al
+push eax
+push edi
+push 0
+push dword [ebp + 8]
+call fcn_00004993 ; call 0x4993
+add esp, 0x20
+jmp short loc_0000591d ; jmp 0x591d
+
+loc_000058f9:
+cmp byte [ebp - 0x74], 0
+je short loc_0000591d ; je 0x591d
+push ecx
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+jne short loc_000058d6 ; jne 0x58d6
+
+loc_0000591d:
+cmp byte [ebp - 0x4a], 0
+je short loc_00005968 ; je 0x5968
+push eax
+push eax
+mov eax, dword [ebp - 0x40]
+push 0x40000000
+add eax, 0xd20
+push eax
+call fcn_00018b14 ; call 0x18b14
+pop eax
+mov eax, dword [ebp - 0x78]
+pop edx
+add eax, 0x54
+push 0xf7
+push eax
+call fcn_0001875d ; call 0x1875d
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00005968 ; je 0x5968
+push eax
+push eax
+push ref_0002174b ; push 0x2174b
+push 2
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00005968:
+sub esp, 0xc
+mov bl, 1
+push dword [ebp - 0x50]
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_00005998 ; jne 0x5998
+call fcn_00015479 ; call 0x15479
+xor ebx, ebx
+test al, al
+je short loc_00005998 ; je 0x5998
+push edi
+push edi
+push ref_0002175c ; push 0x2175c
+push 2
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00005998:
+test byte [ebp - 0x5a], bl
+je near loc_00005abd ; je 0x5abd
+mov edi, dword [ebp - 0x50]
+push ecx
+push ecx
+push 0x100
+mov eax, edi
+add eax, 0x224
+push eax
+call fcn_00018b14 ; call 0x18b14
+mov eax, edi
+pop ebx
+add eax, 0xb0
+pop esi
+mov ebx, 0x3e9
+push 0x10
+push eax
+call fcn_00018730 ; call 0x18730
+mov eax, dword [ebp - 0x40]
+add esp, 0x10
+lea esi, [eax + 0x464]
+
+loc_000059da:
+sub esp, 0xc
+push esi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+shr eax, 8
+and eax, 0x3f
+cmp eax, 2
+je short loc_00005a07 ; je 0x5a07
+dec bx
+je short loc_00005a07 ; je 0x5a07
+mov eax, dword [ebp - 0x34]
+push edx
+push 0x64
+push eax
+push dword [ebp + 8]
+call dword [eax + 4] ; ucall
+add esp, 0x10
+jmp short loc_000059da ; jmp 0x59da
+
+loc_00005a07:
+push eax
+mov eax, dword [ebp - 0x50]
+push 0x20
+push 0xcf
+add eax, 0xc20
+push eax
+call fcn_0001878a ; call 0x1878a
+mov eax, dword [ebp - 0x58]
+add esp, 0x10
+cmp eax, 0x40660
+je short loc_00005a31 ; je 0x5a31
+cmp eax, 0x306c0
+jne short loc_00005a54 ; jne 0x5a54
+
+loc_00005a31:
+mov esi, dword [ebp - 0x68]
+push eax
+push esi
+push 1
+push dword [ebp + 8]
+call fcn_0000490a ; call 0x490a
+movzx eax, al
+push eax
+push esi
+push 1
+push dword [ebp + 8]
+call fcn_00004993 ; call 0x4993
+add esp, 0x20
+jmp short loc_00005a78 ; jmp 0x5a78
+
+loc_00005a54:
+cmp byte [ebp - 0x74], 0
+je short loc_00005a78 ; je 0x5a78
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+jne short loc_00005a31 ; jne 0x5a31
+
+loc_00005a78:
+mov eax, dword [ebp - 0x50]
+push esi
+push esi
+push 0x40000000
+add eax, 0xd20
+push eax
+call fcn_00018b14 ; call 0x18b14
+pop edi
+pop eax
+mov eax, dword [ebp - 0x78]
+push 0xfb
+add eax, 0x54
+push eax
+call fcn_0001875d ; call 0x1875d
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00005abd ; je 0x5abd
+push ebx
+push ebx
+push ref_0002175c ; push 0x2175c
+push 2
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00005abd:
+sub esp, 0xc
+mov bl, 1
+push dword [ebp - 0x54]
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_00005aed ; jne 0x5aed
+call fcn_00015479 ; call 0x15479
+xor ebx, ebx
+test al, al
+je short loc_00005aed ; je 0x5aed
+push ecx
+push ecx
+push ref_0002176d ; push 0x2176d
+push 2
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00005aed:
+test byte [ebp - 0x44], bl
+je near loc_00005c12 ; je 0x5c12
+mov edi, dword [ebp - 0x54]
+mov ebx, 0x3e9
+push eax
+push eax
+push 0x100
+mov eax, edi
+add eax, 0x224
+push eax
+call fcn_00018b14 ; call 0x18b14
+pop eax
+mov eax, edi
+pop edx
+add eax, 0xb0
+push 0x10
+push eax
+call fcn_00018730 ; call 0x18730
+mov eax, dword [ebp - 0x40]
+add esp, 0x10
+lea esi, [eax + 0x464]
+
+loc_00005b2f:
+sub esp, 0xc
+push esi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+shr eax, 0x10
+and eax, 0x3f
+cmp eax, 2
+je short loc_00005b5c ; je 0x5b5c
+dec bx
+je short loc_00005b5c ; je 0x5b5c
+mov eax, dword [ebp - 0x34]
+push edi
+push 0x64
+push eax
+push dword [ebp + 8]
+call dword [eax + 4] ; ucall
+add esp, 0x10
+jmp short loc_00005b2f ; jmp 0x5b2f
+
+loc_00005b5c:
+mov eax, dword [ebp - 0x54]
+push esi
+push 0x20
+push 0xcf
+add eax, 0xc20
+push eax
+call fcn_0001878a ; call 0x1878a
+mov eax, dword [ebp - 0x58]
+add esp, 0x10
+cmp eax, 0x40660
+je short loc_00005b86 ; je 0x5b86
+cmp eax, 0x306c0
+jne short loc_00005ba9 ; jne 0x5ba9
+
+loc_00005b86:
+mov edi, dword [ebp - 0x68]
+push ebx
+push edi
+push 2
+push dword [ebp + 8]
+call fcn_0000490a ; call 0x490a
+movzx eax, al
+push eax
+push edi
+push 2
+push dword [ebp + 8]
+call fcn_00004993 ; call 0x4993
+add esp, 0x20
+jmp short loc_00005bcd ; jmp 0x5bcd
+
+loc_00005ba9:
+cmp byte [ebp - 0x74], 0
+je short loc_00005bcd ; je 0x5bcd
+push ecx
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+jne short loc_00005b86 ; jne 0x5b86
+
+loc_00005bcd:
+mov eax, dword [ebp - 0x54]
+push edi
+push edi
+push 0x40000000
+add eax, 0xd20
+push eax
+call fcn_00018b14 ; call 0x18b14
+pop eax
+mov eax, dword [ebp - 0x78]
+pop edx
+add eax, 0x54
+push 0xfd
+push eax
+call fcn_0001875d ; call 0x1875d
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00005c12 ; je 0x5c12
+push esi
+push esi
+push ref_0002176d ; push 0x2176d
+push 2
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00005c12:
+lea ebx, [ebp - 0x2d]
+
+loc_00005c15:
+movzx eax, byte [ebx + 2]
+sub esp, 0xc
+add ebx, 7
+movzx edi, byte [ebx - 6]
+movzx esi, byte [ebx - 7]
+push eax
+push edi
+push esi
+push dword [ebp - 0x34]
+push dword [ebp + 8]
+mov dword [ebp - 0x48], eax
+call fcn_0000254f ; call 0x254f
+mov eax, dword [ebp - 0x48]
+add esp, 0x1c
+push eax
+push edi
+push esi
+call fcn_0000241b ; call 0x241b
+lea eax, [ebp - 0x18]
+add esp, 0x10
+cmp ebx, eax
+jne short loc_00005c15 ; jne 0x5c15
+mov edi, dword [ebp - 0x3c]
+test edi, edi
+je near loc_00005cdf ; je 0x5cdf
+mov eax, dword [ebp - 0x40]
+sub esp, 0xc
+add eax, 0x11a
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+shr ax, 1
+xor eax, 1
+mov bl, al
+mov eax, dword [ebp - 0x50]
+and ebx, 1
+add eax, 0x11a
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+mov dl, bl
+or edx, 2
+test al, 2
+mov eax, dword [ebp - 0x54]
+cmove ebx, edx
+add eax, 0x11a
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+mov dl, bl
+add esp, 0x10
+or edx, 4
+test al, 2
+cmove ebx, edx
+not ebx
+cmp byte [edi + 0x46], bl
+je short loc_00005cdf ; je 0x5cdf
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00005cd9 ; je 0x5cd9
+movzx eax, bl
+push eax
+mov eax, dword [ebp - 0x3c]
+movzx eax, byte [eax + 0x46]
+push eax
+push ref_0002177e ; push 0x2177e
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00005cd9:
+mov eax, dword [ebp - 0x3c]
+mov byte [eax + 0x46], bl
+
+loc_00005cdf:
+mov eax, dword [ebp + 0xc]
+cmp byte [eax], 0xa
+ja short loc_00005d06 ; ja 0x5d06
+
+loc_00005ce7:
+call fcn_00003ba6 ; call 0x3ba6
+movzx eax, byte [ebp - 0x44]
+push ebx
+push eax
+movzx eax, byte [ebp - 0x5a]
+push eax
+movzx eax, byte [ebp - 0x4a]
+push eax
+call fcn_00003cf7 ; call 0x3cf7
+
+loc_00005d01:
+add esp, 0x10
+jmp short loc_00005d48 ; jmp 0x5d48
+
+loc_00005d06:
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 0x5f], 1
+jne short loc_00005ce7 ; jne 0x5ce7
+lea ebx, [ebp - 0x2d]
+
+loc_00005d15:
+push eax
+movzx eax, byte [ebx + 2]
+add ebx, 7
+push eax
+movzx eax, byte [ebx - 6]
+push eax
+movzx eax, byte [ebx - 7]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+push 1
+add eax, 0x25c
+push eax
+call fcn_00018b14 ; call 0x18b14
+lea eax, [ebp - 0x18]
+add esp, 0x10
+cmp ebx, eax
+jne short loc_00005d15 ; jne 0x5d15
+jmp short loc_00005ce7 ; jmp 0x5ce7
+
+loc_00005d48:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00005d50:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov esi, dword [ebp + 0x10]
+mov eax, dword [ebp + 0x14]
+cmp byte [esi + 6], 2
+push 0
+mov edi, eax
+push 0
+push 0
+seta bl
+mov dword [ebp - 0x20], eax
+mov byte [ebp - 0x19], al
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017ed8 ; call 0x17ed8
+add esp, 0x10
+mov dword [ebp - 0x24], eax
+mov eax, edi
+test al, al
+jne short loc_00005ddd ; jne 0x5ddd
+test bl, bl
+je short loc_00005ddd ; je 0x5ddd
+xor edi, edi
+
+loc_00005d96:
+push eax
+movzx eax, byte [esi + 2]
+push eax
+movzx eax, byte [esi + 1]
+push eax
+movzx eax, byte [esi]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xd2
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test al, 2
+jne short loc_00005de3 ; jne 0x5de3
+push ecx
+mov eax, dword [ebp + 0xc]
+inc edi
+push 0x3e8
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call dword [eax + 4] ; ucall
+add esp, 0x10
+cmp edi, 0x64
+jne short loc_00005d96 ; jne 0x5d96
+xor eax, eax
+jmp short loc_00005de5 ; jmp 0x5de5
+
+loc_00005ddd:
+xor eax, eax
+xor edi, edi
+jmp short loc_00005de5 ; jmp 0x5de5
+
+loc_00005de3:
+mov al, 1
+
+loc_00005de5:
+test al, al
+je short loc_00005df5 ; je 0x5df5
+test bl, bl
+je short loc_00005df5 ; je 0x5df5
+
+loc_00005ded:
+mov ebx, dword [ebp - 0x24]
+and ebx, 0xfffffffe
+jmp short loc_00005e1c ; jmp 0x5e1c
+
+loc_00005df5:
+test bl, bl
+je short loc_00005ded ; je 0x5ded
+cmp byte [ebp - 0x20], 0
+jne short loc_00005ded ; jne 0x5ded
+
+loc_00005dff:
+mov eax, 0x80000012
+jmp short loc_00005e7d ; jmp 0x5e7d
+
+loc_00005e06:
+push eax
+mov eax, dword [ebp + 0xc]
+inc edi
+push 0x3e8
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call dword [eax + 4] ; ucall
+add esp, 0x10
+
+loc_00005e1c:
+cmp edi, 0x63
+ja short loc_00005dff ; ja 0x5dff
+cmp byte [ebp - 0x19], 0
+je short loc_00005e4e ; je 0x5e4e
+push 0
+push 0x13
+push 0x4648080
+push ebx
+call fcn_000041ca ; call 0x41ca
+movzx ecx, byte [esi + 2]
+add esp, 0x10
+shl ecx, 3
+shr eax, cl
+and eax, 0x3f
+cmp eax, 0x10
+
+loc_00005e48:
+jne short loc_00005e06 ; jne 0x5e06
+xor eax, eax
+jmp short loc_00005e7d ; jmp 0x5e7d
+
+loc_00005e4e:
+push edx
+movzx eax, byte [esi + 2]
+push eax
+movzx eax, byte [esi + 1]
+push eax
+movzx eax, byte [esi]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x214
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+shr eax, 0x10
+and eax, 0xf
+cmp eax, 7
+jmp short loc_00005e48 ; jmp 0x5e48
+
+loc_00005e7d:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00005e85:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov ebx, dword [ebp + 8]
+push 0
+mov edi, dword [ebp + 0xc]
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov esi, eax
+lea eax, [eax + 2]
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+mov edx, eax
+and eax, 0xfffffffd
+cmp ax, 0x8c44
+je short loc_00005f1c ; je 0x5f1c
+lea eax, [edx + 0x73b2]
+cmp ax, 2
+jbe short loc_00005f1c ; jbe 0x5f1c
+lea eax, [edx + 0x73b7]
+cmp ax, 3
+jbe short loc_00005f1c ; jbe 0x5f1c
+lea eax, [edx + 0x73bf]
+cmp ax, 1
+jbe short loc_00005f1c ; jbe 0x5f1c
+cmp dx, 0x8c58
+je short loc_00005f1c ; je 0x5f1c
+mov eax, edx
+and eax, 0xfffffffb
+cmp ax, 0x8c52
+je short loc_00005f1c ; je 0x5f1c
+mov eax, edx
+and eax, 0xfffffff7
+cmp ax, 0x8c54
+je short loc_00005f1c ; je 0x5f1c
+lea eax, [edx + 0x63bf]
+cmp ax, 6
+jbe short loc_00005f1c ; jbe 0x5f1c
+add dx, 0x733f
+cmp dx, 5
+jbe short loc_00005f1c ; jbe 0x5f1c
+
+loc_00005f12:
+mov eax, 0x80000003
+jmp near loc_0000600e ; jmp 0x600e
+
+loc_00005f1c:
+sub esp, 0xc
+add esi, 0x48
+push esi
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+and ax, 0xfffc
+mov word [ebp - 0x20], ax
+je short loc_00005f12 ; je 0x5f12
+cmp bl, 0x1f
+jbe short loc_00005f79 ; jbe 0x5f79
+cmp bl, 0x3f
+ja short loc_00005f55 ; ja 0x5f55
+lea ecx, [ebx - 0x20]
+mov esi, 0x30
+mov word [ebp - 0x1c], 0x38
+mov word [ebp - 0x1a], 0x34
+jmp short loc_00005f89 ; jmp 0x5f89
+
+loc_00005f55:
+mov eax, 0x80000002
+cmp bl, 0x5f
+ja near loc_0000600e ; ja 0x600e
+lea ecx, [ebx - 0x40]
+mov esi, 0x40
+mov word [ebp - 0x1c], 0x48
+mov word [ebp - 0x1a], 0x44
+jmp short loc_00005f89 ; jmp 0x5f89
+
+loc_00005f79:
+mov cl, bl
+xor esi, esi
+mov word [ebp - 0x1c], 0xc
+mov word [ebp - 0x1a], 4
+
+loc_00005f89:
+mov dword [ebp - 0x24], ecx
+and edi, 1
+call fcn_00015479 ; call 0x15479
+mov ecx, dword [ebp - 0x24]
+test al, al
+mov eax, edi
+movzx edi, al
+je short loc_00005fb7 ; je 0x5fb7
+push edi
+movzx ebx, bl
+push ebx
+push ref_000217b5 ; push 0x217b5
+push 0x40
+call fcn_00015487 ; call 0x15487
+mov ecx, dword [ebp - 0x24]
+add esp, 0x10
+
+loc_00005fb7:
+movzx ebx, word [ebp - 0x20]
+mov edx, 1
+push eax
+push eax
+shl edx, cl
+push edx
+add esi, ebx
+push esi
+mov dword [ebp - 0x24], ecx
+mov dword [ebp - 0x20], edx
+call fcn_00018363 ; call 0x18363
+mov edx, dword [ebp - 0x20]
+movzx eax, word [ebp - 0x1a]
+mov esi, edx
+pop edx
+not esi
+pop ecx
+add eax, ebx
+push esi
+push eax
+call fcn_0001838d ; call 0x1838d
+movzx eax, word [ebp - 0x1c]
+add ebx, eax
+mov dword [esp], ebx
+call fcn_00018f64 ; call 0x18f64
+mov ecx, dword [ebp - 0x24]
+shl edi, cl
+and eax, esi
+pop esi
+or eax, edi
+pop edx
+push eax
+push ebx
+call fcn_00018f97 ; call 0x18f97
+add esp, 0x10
+xor eax, eax
+
+loc_0000600e:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00006016:
+push ebp
+mov ebp, esp
+push ebx
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00006038 ; je 0x6038
+push ecx
+push ecx
+push ref_000217cb ; push 0x217cb
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00006038:
+cmp byte [ebx], 2
+mov eax, 0x80000003
+jbe short loc_00006065 ; jbe 0x6065
+mov edx, dword [ebx + 0xd]
+mov edx, dword [edx + 0x4c]
+cmp byte [edx], 1
+jne short loc_00006065 ; jne 0x6065
+mov eax, dword [edx + 1]
+push edx
+push edx
+mov dl, byte [eax + 1]
+and edx, 1
+push edx
+movzx eax, byte [eax]
+push eax
+call fcn_00005e85 ; call 0x5e85
+add esp, 0x10
+
+loc_00006065:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000606a:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000608c ; je 0x608c
+push ecx
+push ecx
+push ref_000217e6 ; push 0x217e6
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000608c:
+cmp byte [ebx], 2
+mov esi, 0x80000003
+jbe short loc_000060bd ; jbe 0x60bd
+mov eax, dword [ebx + 0xd]
+mov eax, dword [eax + 0x4c]
+cmp byte [eax], 1
+jne short loc_000060bd ; jne 0x60bd
+mov eax, dword [eax + 1]
+xor esi, esi
+push edx
+push edx
+mov dl, byte [eax + 1]
+not edx
+and edx, 1
+push edx
+movzx eax, byte [eax]
+push eax
+call fcn_00005e85 ; call 0x5e85
+add esp, 0x10
+
+loc_000060bd:
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_000060c6:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov edi, dword [ebp + 8]
+mov ebx, dword [ebp + 0xc]
+mov esi, dword [ebp + 0x10]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000060f2 ; je 0x60f2
+push eax
+push eax
+push ref_00021803 ; push 0x21803
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000060f2:
+xor edx, edx
+
+loc_000060f4:
+push eax
+push edx
+push 1
+push 0
+mov dword [ebp - 0x1c], edx
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+push 0x10
+add eax, 0xb0
+push eax
+call fcn_00018927 ; call 0x18927
+mov edx, dword [ebp - 0x1c]
+add esp, 0x10
+inc edx
+cmp edx, 3
+jne short loc_000060f4 ; jne 0x60f4
+sub esp, 0xc
+push esi
+call fcn_00006016 ; call 0x6016
+add esp, 0x10
+mov edx, eax
+test eax, eax
+js short loc_00006171 ; js 0x6171
+push eax
+push 0x64
+push ebx
+push edi
+call dword [ebx + 4] ; ucall
+add esp, 0x10
+xor ebx, ebx
+
+loc_0000613c:
+push edi
+push ebx
+inc ebx
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+push 0xffef
+add eax, 0xb0
+push eax
+call fcn_00018954 ; call 0x18954
+add esp, 0x10
+cmp ebx, 3
+jne short loc_0000613c ; jne 0x613c
+mov dword [ebp + 8], esi
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0000606a ; jmp 0x606a
+
+loc_00006171:
+xor ebx, ebx
+
+loc_00006173:
+push eax
+push ebx
+inc ebx
+push 1
+push 0
+mov dword [ebp - 0x1c], edx
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+push 0xffef
+add eax, 0xb0
+push eax
+call fcn_00018954 ; call 0x18954
+add esp, 0x10
+cmp ebx, 3
+mov edx, dword [ebp - 0x1c]
+jne short loc_00006173 ; jne 0x6173
+lea esp, [ebp - 0xc]
+mov eax, edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000061a9:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+mov ebx, dword [ebp + 0x10]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000061cb ; je 0x61cb
+push ecx
+push ecx
+push ref_0002181d ; push 0x2181d
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000061cb:
+push edx
+movzx eax, byte [ebx + 2]
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+movzx eax, byte [ebx]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+pop ecx
+lea esi, [eax + 0x3e]
+pop eax
+push 0x40
+push esi
+call fcn_00018927 ; call 0x18927
+pop eax
+pop edx
+push 0xffbf
+push esi
+call fcn_00018954 ; call 0x18954
+push 0
+push ebx
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00005d50 ; call 0x5d50
+add esp, 0x20
+mov ebx, eax
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00006226 ; je 0x6226
+push eax
+push eax
+push ref_00021833 ; push 0x21833
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00006226:
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000622f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov esi, dword [ebp + 0x10]
+call fcn_0001c651 ; call 0x1c651
+mov edi, eax
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017ed8 ; call 0x17ed8
+add esp, 0x10
+cmp edi, 0x40660
+sete byte [ebp - 0x19]
+cmp edi, 0x306c0
+mov ebx, eax
+sete al
+or byte [ebp - 0x19], al
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000628e ; je 0x628e
+push eax
+push eax
+push ref_00021843 ; push 0x21843
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000628e:
+cmp edi, 0x40670
+jne short loc_000062bc ; jne 0x62bc
+push eax
+movzx eax, byte [esi + 2]
+push eax
+movzx eax, byte [esi + 1]
+push eax
+movzx eax, byte [esi]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+push 0x10
+add eax, 0xc24
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+
+loc_000062bc:
+cmp byte [ebp - 0x19], 0
+je near loc_00006357 ; je 0x6357
+push 0
+and ebx, 0xfffffffe
+push 0x13
+push 0x4448080
+push ebx
+call fcn_000041ca ; call 0x41ca
+and eax, 0xfffffffd
+push eax
+push 0x14
+push 0x4448080
+push ebx
+call fcn_000041ca ; call 0x41ca
+add esp, 0x20
+push 0
+push 0x13
+push 0x4448080
+push ebx
+call fcn_000041ca ; call 0x41ca
+or eax, 1
+push eax
+push 0x14
+push 0x4448080
+push ebx
+call fcn_000041ca ; call 0x41ca
+add esp, 0x20
+push 0
+push 0x13
+push 0x4448080
+push ebx
+call fcn_000041ca ; call 0x41ca
+or ah, 0x20
+push eax
+push 0x14
+push 0x4448080
+push ebx
+call fcn_000041ca ; call 0x41ca
+add esp, 0x20
+push 0
+push 0x13
+push 0x4448080
+push ebx
+call fcn_000041ca ; call 0x41ca
+and eax, 0xfffffffe
+push eax
+push 0x14
+push 0x4448080
+push ebx
+call fcn_000041ca ; call 0x41ca
+add esp, 0x20
+jmp short loc_000063cf ; jmp 0x63cf
+
+loc_00006357:
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+push 0xfffffffffffffffd
+add eax, 0x444
+push eax
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0xc
+push 0
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+pop ebx
+pop edx
+push 1
+add eax, 0x444
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0xc
+push 0
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+pop ecx
+pop ebx
+push 0x2000
+add eax, 0x444
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0xc
+push 0
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+push 0xfffffffffffffffe
+add eax, 0x444
+push eax
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+
+loc_000063cf:
+movzx eax, byte [ebp - 0x19]
+push eax
+push esi
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00005d50 ; call 0x5d50
+add esp, 0x10
+mov ebx, eax
+cmp edi, 0x40670
+jne short loc_00006413 ; jne 0x6413
+push edx
+movzx eax, byte [esi + 2]
+push eax
+movzx eax, byte [esi + 1]
+push eax
+movzx eax, byte [esi]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+pop ecx
+pop esi
+push 0xffffffffffffffef
+add eax, 0xc24
+push eax
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+
+loc_00006413:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000642d ; je 0x642d
+push eax
+push eax
+push ref_00021833 ; push 0x21833
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000642d:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00006437:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 8
+mov ebx, dword [ebp + 0x10]
+movzx eax, byte [ebx + 2]
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+movzx eax, byte [ebx]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+pop ecx
+pop edx
+push 0x20
+add eax, 0xb0
+push eax
+call fcn_00018927 ; call 0x18927
+push 0
+push ebx
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00005d50 ; call 0x5d50
+add esp, 0x20
+mov ebx, eax
+test eax, eax
+jns short loc_00006494 ; jns 0x6494
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00006494 ; je 0x6494
+push eax
+push eax
+push ref_00021855 ; push 0x21855
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00006494:
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000649b:
+push ebp
+mov ebp, esp
+sub esp, 0xc
+mov eax, dword [ebp + 8]
+movzx edx, byte [eax + 2]
+push edx
+movzx edx, byte [eax + 1]
+push edx
+movzx eax, byte [eax]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xb2
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+leave
+shr ax, 4
+and eax, 0x3f
+ret
+
+fcn_000064cd:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov esi, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0x14]
+movzx eax, byte [esi + 2]
+push eax
+movzx eax, byte [esi + 1]
+push eax
+movzx eax, byte [esi]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], esi
+mov edi, eax
+call fcn_0000649b ; call 0x649b
+add esp, 0x10
+mov dl, al
+cmp al, bl
+jae near loc_000065bf ; jae 0x65bf
+mov dword [ebp - 0x1c], edx
+call fcn_00015479 ; call 0x15479
+mov edx, dword [ebp - 0x1c]
+test al, al
+je short loc_0000652c ; je 0x652c
+movzx edx, dl
+movzx eax, bl
+push edx
+push eax
+push ref_0002186d ; push 0x2186d
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000652c:
+movzx eax, bl
+push ecx
+push eax
+push 0xffffffffffffffe0
+lea edx, [edi + 0x224]
+add edi, 0xb0
+push edx
+mov dword [ebp - 0x1c], edx
+call fcn_00018b68 ; call 0x18b68
+pop eax
+pop edx
+push 0x10
+push edi
+call fcn_00018927 ; call 0x18927
+mov eax, dword [ebp + 0xc]
+add esp, 0xc
+push 1
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call dword [eax + 4] ; ucall
+pop ecx
+pop eax
+push 0xffef
+push edi
+call fcn_00018954 ; call 0x18954
+push 0
+push esi
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00005d50 ; call 0x5d50
+mov edx, dword [ebp - 0x1c]
+add esp, 0x18
+push 0x1f
+push edx
+mov edi, eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+test edi, edi
+js short loc_000065e4 ; js 0x65e4
+sub esp, 0xc
+push esi
+call fcn_0000649b ; call 0x649b
+add esp, 0x10
+cmp al, bl
+jne short loc_000065c3 ; jne 0x65c3
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000065bf ; je 0x65bf
+push edx
+push edx
+push ref_00021891 ; push 0x21891
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000065bf:
+xor ebx, ebx
+jmp short loc_000065e6 ; jmp 0x65e6
+
+loc_000065c3:
+call fcn_00015479 ; call 0x15479
+mov ebx, 0x80000007
+test al, al
+je short loc_000065e6 ; je 0x65e6
+push eax
+push eax
+push ref_000218ac ; push 0x218ac
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp short loc_000065e6 ; jmp 0x65e6
+
+loc_000065e4:
+mov ebx, edi
+
+loc_000065e6:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000065f0:
+push ebp
+mov ebp, esp
+sub esp, 0xc
+mov eax, dword [ebp + 8]
+movzx edx, byte [eax + 2]
+push edx
+movzx edx, byte [eax + 1]
+push edx
+movzx eax, byte [eax]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xb2
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+leave
+and eax, 0xf
+ret
+
+fcn_0000661e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x2c
+mov eax, dword [ebp + 0x1c]
+mov ebx, dword [ebp + 0xc]
+mov esi, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov dword [ebp - 0x2c], eax
+mov eax, dword [ebp + 0x20]
+mov dword [ebp - 0x30], eax
+call fcn_0001c651 ; call 0x1c651
+mov dword [ebp - 0x1c], eax
+call fcn_0001c678 ; call 0x1c678
+mov dword [ebp - 0x20], eax
+test esi, esi
+je short loc_00006662 ; je 0x6662
+cmp byte [ebx], 1
+jbe short loc_0000665e ; jbe 0x665e
+mov eax, dword [ebx + 0xd]
+cmp byte [eax + 0x48], 0
+jne short loc_00006662 ; jne 0x6662
+
+loc_0000665e:
+mov byte [esi + 0x71], 1
+
+loc_00006662:
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+push 0x8000
+add eax, 0xdd8
+push eax
+mov dword [ebp - 0x24], eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0xc
+push ebx
+push dword [ebp + 0x14]
+push dword [ebp + 8]
+call fcn_000060c6 ; call 0x60c6
+add esp, 0x10
+mov esi, eax
+test eax, eax
+jns short loc_000066ad ; jns 0x66ad
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000066c7 ; je 0x66c7
+push eax
+push esi
+push ref_000218c4 ; push 0x218c4
+jmp short loc_000066bd ; jmp 0x66bd
+
+loc_000066ad:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000066c7 ; je 0x66c7
+push eax
+push eax
+push ref_000218d1 ; push 0x218d1
+
+loc_000066bd:
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000066c7:
+mov al, byte [edi]
+movzx ecx, byte [edi + 2]
+movzx edx, byte [edi + 1]
+mov byte [ebp - 0x25], al
+
+loc_000066d4:
+push ebx
+movzx ebx, byte [ebp - 0x25]
+push ecx
+push edx
+push ebx
+mov dword [ebp - 0x38], ecx
+mov dword [ebp - 0x34], edx
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xd2
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+mov edx, dword [ebp - 0x34]
+mov ecx, dword [ebp - 0x38]
+test al, 2
+je short loc_000066d4 ; je 0x66d4
+sub esp, 0xc
+push ecx
+push edx
+push ebx
+push dword [ebp + 0x14]
+push dword [ebp + 8]
+call fcn_0000254f ; call 0x254f
+add esp, 0x20
+cmp dword [ebp - 0x20], 0
+je short loc_00006736 ; je 0x6736
+cmp dword [ebp - 0x1c], 0x40670
+jne short loc_00006736 ; jne 0x6736
+push ecx
+push ecx
+push 0xffff7fff
+push dword [ebp - 0x24]
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+
+loc_00006736:
+sub esp, 0xc
+push edi
+call fcn_0000649b ; call 0x649b
+add esp, 0x10
+cmp al, byte [ebp - 0x30]
+jae short loc_00006769 ; jae 0x6769
+call fcn_00015479 ; call 0x15479
+mov esi, 0x80000012
+test al, al
+je short loc_00006769 ; je 0x6769
+push edx
+push edx
+push ref_000218db ; push 0x218db
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00006769:
+sub esp, 0xc
+push edi
+call fcn_000065f0 ; call 0x65f0
+add esp, 0x10
+cmp al, byte [ebp - 0x2c]
+jae short loc_0000679c ; jae 0x679c
+call fcn_00015479 ; call 0x15479
+mov esi, 0x80000012
+test al, al
+je short loc_0000679c ; je 0x679c
+push eax
+push eax
+push ref_000218f3 ; push 0x218f3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000679c:
+lea esp, [ebp - 0xc]
+mov eax, esi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000067a6:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+xor ebx, ebx
+sub esp, 0x28
+mov esi, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0xc]
+push esi
+mov dword [ebp - 0x1c], eax
+call fcn_000065f0 ; call 0x65f0
+mov edx, edi
+add esp, 0x10
+cmp dl, al
+je short loc_000067e8 ; je 0x67e8
+call fcn_00015479 ; call 0x15479
+mov bl, 1
+test al, al
+je short loc_000067e8 ; je 0x67e8
+push edx
+push edx
+push ref_0002190b ; push 0x2190b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000067e8:
+sub esp, 0xc
+push esi
+call fcn_0000649b ; call 0x649b
+add esp, 0x10
+cmp byte [ebp - 0x1c], al
+je short loc_00006815 ; je 0x6815
+call fcn_00015479 ; call 0x15479
+mov bl, 1
+test al, al
+je short loc_00006815 ; je 0x6815
+push eax
+push eax
+push ref_0002192a ; push 0x2192a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00006815:
+lea esp, [ebp - 0xc]
+mov al, bl
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000681f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+xor esi, esi
+push ebx
+sub esp, 0x28
+mov edi, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0x14]
+push edi
+call fcn_000065f0 ; call 0x65f0
+add esp, 0x10
+mov dl, al
+cmp al, bl
+jae near loc_000068c7 ; jae 0x68c7
+mov dword [ebp - 0x1c], edx
+call fcn_00015479 ; call 0x15479
+mov edx, dword [ebp - 0x1c]
+test al, al
+je short loc_00006869 ; je 0x6869
+movzx edx, dl
+movzx eax, bl
+push edx
+push eax
+push ref_00021949 ; push 0x21949
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00006869:
+push ecx
+push edi
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00006437 ; call 0x6437
+add esp, 0x10
+mov esi, eax
+test eax, eax
+jns short loc_00006886 ; jns 0x6886
+call fcn_00015479 ; call 0x15479
+jmp short loc_000068a0 ; jmp 0x68a0
+
+loc_00006886:
+sub esp, 0xc
+push edi
+call fcn_000065f0 ; call 0x65f0
+add esp, 0x10
+cmp al, bl
+jae short loc_000068ad ; jae 0x68ad
+call fcn_00015479 ; call 0x15479
+mov esi, 0x80000007
+
+loc_000068a0:
+test al, al
+je short loc_000068c7 ; je 0x68c7
+push edx
+push edx
+push ref_00021973 ; push 0x21973
+jmp short loc_000068bd ; jmp 0x68bd
+
+loc_000068ad:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000068c7 ; je 0x68c7
+push eax
+push eax
+push ref_00021990 ; push 0x21990
+
+loc_000068bd:
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000068c7:
+lea esp, [ebp - 0xc]
+mov eax, esi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000068d1:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0xc]
+mov esi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0x14]
+mov edi, dword [ebp + 8]
+mov dword [ebp - 0x24], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp - 0x28], eax
+mov eax, dword [ebp + 0x1c]
+mov dword [ebp - 0x1c], eax
+movzx eax, byte [ebp + 0x20]
+push eax
+push esi
+push ebx
+push edi
+mov dword [ebp - 0x20], eax
+call fcn_000064cd ; call 0x64cd
+add esp, 0x10
+test eax, eax
+movzx eax, byte [ebp - 0x1c]
+mov dword [ebp - 0x1c], eax
+js short loc_00006927 ; js 0x6927
+
+loc_00006913:
+push dword [ebp - 0x1c]
+push esi
+push ebx
+push edi
+call fcn_0000681f ; call 0x681f
+add esp, 0x10
+test eax, eax
+jns short loc_00006964 ; jns 0x6964
+jmp short loc_00006948 ; jmp 0x6948
+
+loc_00006927:
+push eax
+push dword [ebp - 0x20]
+push dword [ebp - 0x1c]
+push esi
+push ebx
+push dword [ebp - 0x28]
+push dword [ebp - 0x24]
+push edi
+call fcn_0000661e ; call 0x661e
+add esp, 0x20
+test eax, eax
+jns short loc_00006913 ; jns 0x6913
+jmp near loc_000069cc ; jmp 0x69cc
+
+loc_00006948:
+push ecx
+push dword [ebp - 0x20]
+push dword [ebp - 0x1c]
+push esi
+push ebx
+push dword [ebp - 0x28]
+push dword [ebp - 0x24]
+push edi
+call fcn_0000661e ; call 0x661e
+add esp, 0x20
+test eax, eax
+js short loc_000069cc ; js 0x69cc
+
+loc_00006964:
+push 0
+push esi
+push ebx
+push edi
+call fcn_00005d50 ; call 0x5d50
+add esp, 0x10
+test eax, eax
+jns short loc_000069cc ; jns 0x69cc
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000698f ; je 0x698f
+push edx
+push edx
+push ref_000219b0 ; push 0x219b0
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000698f:
+push eax
+push esi
+push ebx
+push edi
+call fcn_00006437 ; call 0x6437
+add esp, 0x10
+test eax, eax
+jns short loc_000069cc ; jns 0x69cc
+mov eax, dword [ebp - 0x20]
+mov dword [ebp + 0x18], esi
+mov dword [ebp + 0x14], ebx
+mov dword [ebp + 8], edi
+mov dword [ebp + 0x20], eax
+mov eax, dword [ebp - 0x1c]
+mov dword [ebp + 0x1c], eax
+mov eax, dword [ebp - 0x28]
+mov dword [ebp + 0x10], eax
+mov eax, dword [ebp - 0x24]
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0000661e ; jmp 0x661e
+
+loc_000069cc:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000069d4:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x14
+lea eax, [ebp - 0xc]
+push eax
+push 0
+push 0
+push ref_0002913c ; push 0x2913c
+call fcn_0001975d ; call 0x1975d
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00006a34 ; je 0x6a34
+test ebx, ebx
+jns short loc_00006a34 ; jns 0x6a34
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00006a1c ; je 0x6a1c
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00006a1c:
+push ecx
+push ref_000206f4 ; push 0x206f4
+push 0x2de
+push ref_000219ce ; push 0x219ce
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00006a34:
+mov eax, dword [ebp - 0xc]
+push edx
+push edx
+push 1
+push eax
+call dword [eax] ; ucall
+add esp, 0x10
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00006a46:
+push ebp
+mov eax, 1
+mov ebp, esp
+mov edx, dword [ebp + 8]
+cmp byte [edx], 2
+jbe short loc_00006a68 ; jbe 0x6a68
+mov eax, dword [edx + 0xd]
+mov edx, 1
+mov ax, word [eax + 0x50]
+test ax, ax
+cmove eax, edx
+
+loc_00006a68:
+pop ebp
+ret
+
+fcn_00006a6a:
+push ebp
+mov eax, 2
+mov ebp, esp
+mov edx, dword [ebp + 8]
+cmp byte [edx], 0x12
+jbe short loc_00006a8c ; jbe 0x6a8c
+mov eax, dword [edx + 0xd]
+mov edx, 2
+mov ax, word [eax + 0x67]
+test ax, ax
+cmove eax, edx
+
+loc_00006a8c:
+pop ebp
+ret
+
+fcn_00006a8e:
+push ebp
+mov eax, 0x2710
+mov ebp, esp
+mov edx, dword [ebp + 8]
+cmp byte [edx], 0x12
+jbe short loc_00006ab0 ; jbe 0x6ab0
+mov eax, dword [edx + 0xd]
+mov edx, 0x2710
+mov ax, word [eax + 0x65]
+test ax, ax
+cmove eax, edx
+
+loc_00006ab0:
+pop ebp
+ret
+
+fcn_00006ab2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x30
+push 0
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov esi, eax
+lea eax, [eax + 0x504]
+add esi, 0xd0c
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov dword [esp], esi
+mov ebx, eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0xc
+push 0
+push 0
+push 1
+shr ebx, 0x10
+shr eax, 0x14
+and eax, 1
+mov byte [ebp - 0x2b], al
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0x10
+mov dword [ebp - 0x34], eax
+and ebx, 3
+je short loc_00006b1f ; je 0x6b1f
+cmp ebx, 2
+jne short loc_00006b32 ; jne 0x6b32
+mov byte [ebp - 0x1e], 8
+mov esi, 2
+mov byte [ebp - 0x1d], 8
+jmp short loc_00006b3b ; jmp 0x6b3b
+
+loc_00006b1f:
+mov byte [ebp - 0x1e], 8
+mov esi, 3
+mov byte [ebp - 0x1d], 4
+mov byte [ebp - 0x1c], 4
+jmp short loc_00006b3b ; jmp 0x6b3b
+
+loc_00006b32:
+mov byte [ebp - 0x1e], 0x10
+mov esi, 1
+
+loc_00006b3b:
+mov eax, dword [ebp + 0xc]
+xor ebx, ebx
+mov byte [eax], 0
+
+loc_00006b43:
+cmp byte [ebp + ebx - 0x1e], 0
+je short loc_00006b76 ; je 0x6b76
+push eax
+push ebx
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_00006b76 ; je 0x6b76
+mov eax, dword [ebp + 0xc]
+mov dl, byte [eax]
+movzx eax, dl
+inc edx
+mov byte [ebp + eax - 0x1b], bl
+mov eax, dword [ebp + 0xc]
+mov byte [eax], dl
+
+loc_00006b76:
+inc ebx
+mov eax, esi
+cmp al, bl
+ja short loc_00006b43 ; ja 0x6b43
+mov eax, dword [ebp + 0xc]
+cmp byte [eax], 3
+jbe short loc_00006baa ; jbe 0x6baa
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00006ba4 ; je 0x6ba4
+push eax
+push dword [ebp + 0xc]
+push ref_00021a0c ; push 0x21a0c
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00006ba4:
+mov eax, dword [ebp + 0xc]
+mov byte [eax], 3
+
+loc_00006baa:
+mov eax, dword [ebp + 0x10]
+mov byte [ebp - 0x2a], 0
+mov byte [eax], 0
+mov al, byte [ebp - 0x2b]
+neg eax
+mov byte [ebp - 0x29], al
+mov eax, dword [ebp - 0x34]
+and byte [ebp - 0x29], 0xf
+add eax, 0xc
+mov dword [ebp - 0x38], eax
+
+loc_00006bc9:
+mov edi, dword [ebp + 0xc]
+mov al, byte [ebp - 0x2a]
+cmp al, byte [edi]
+jae near loc_00006e4c ; jae 0x6e4c
+movzx ebx, byte [ebp - 0x2a]
+movzx eax, byte [ebp + ebx - 0x1b]
+shl ebx, 5
+add ebx, dword [ebp + 8]
+mov edi, eax
+mov byte [ebx + 2], al
+mov byte [ebx + 3], al
+mov byte [ebx + 0x1d], 1
+mov byte [ebx + 0x1e], 0
+mov byte [ebx + 0x1f], 0
+mov byte [ebx], 0
+mov byte [ebx + 1], 1
+mov byte [ebx + 6], 0
+push eax
+push edi
+push 1
+push 0
+call fcn_0000241b ; call 0x241b
+mov dword [esp], ebx
+call fcn_0000649b ; call 0x649b
+add esp, 0x10
+xor edx, edx
+xor ecx, ecx
+mov byte [ebp - 0x2c], al
+mov byte [ebx + 0x1c], al
+
+loc_00006c25:
+mov byte [ebp - 0x30], dl
+cmp dl, byte [ebp - 0x2c]
+jae short loc_00006c64 ; jae 0x6c64
+mov eax, dword [ebp + 0x10]
+cmp byte [eax], 0
+je short loc_00006c40 ; je 0x6c40
+cmp byte [ebp - 0x30], 1
+ja short loc_00006c40 ; ja 0x6c40
+dec byte [ebx + 0x1c]
+jmp short loc_00006c61 ; jmp 0x6c61
+
+loc_00006c40:
+cmp cl, 0xf
+ja short loc_00006c60 ; ja 0x6c60
+cmp byte [ebp - 0x2b], 0
+movzx esi, cl
+jne short loc_00006c56 ; jne 0x6c56
+mov al, byte [ebp - 0x30]
+add al, byte [ebp - 0x29]
+jmp short loc_00006c5c ; jmp 0x6c5c
+
+loc_00006c56:
+mov al, byte [ebp - 0x29]
+sub eax, dword [ebp - 0x30]
+
+loc_00006c5c:
+mov byte [ebx + esi + 0xc], al
+
+loc_00006c60:
+inc ecx
+
+loc_00006c61:
+inc edx
+jmp short loc_00006c25 ; jmp 0x6c25
+
+loc_00006c64:
+cmp byte [ebx + 0x1c], 0x10
+jbe short loc_00006c8f ; jbe 0x6c8f
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00006c8b ; je 0x6c8b
+push eax
+movzx eax, byte [ebx + 0x1c]
+push eax
+push ref_00021a53 ; push 0x21a53
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00006c8b:
+mov byte [ebx + 0x1c], 0x10
+
+loc_00006c8f:
+push eax
+push edi
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov esi, eax
+lea eax, [eax + 0xac]
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov edx, eax
+and edx, 0xf
+cmp edx, 3
+mov dword [ebp - 0x30], edx
+je short loc_00006ce7 ; je 0x6ce7
+call fcn_00015479 ; call 0x15479
+mov edx, dword [ebp - 0x30]
+test al, al
+je short loc_00006cde ; je 0x6cde
+push edx
+push edi
+push 1
+push 0
+push edi
+push 1
+push ref_00021a89 ; push 0x21a89
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_00006cde:
+mov byte [ebx + 0xb], 0
+jmp near loc_00006e2c ; jmp 0x6e2c
+
+loc_00006ce7:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00006d08 ; je 0x6d08
+push eax
+push edi
+push 1
+push 0
+push edi
+push 1
+push ref_00021ad4 ; push 0x21ad4
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_00006d08:
+push ecx
+push 0x10100
+push 0xff0000ff
+lea eax, [esi + 0x18]
+add esi, 0x11a
+push eax
+mov dword [ebp - 0x30], eax
+call fcn_00018b68 ; call 0x18b68
+pop eax
+pop edx
+push 0
+push dword [ebp - 0x34]
+call fcn_00017e04 ; call 0x17e04
+pop ecx
+push dword [ebp - 0x34]
+call fcn_00017e4e ; call 0x17e4e
+mov dword [ebx + 7], eax
+mov dword [esp], esi
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test al, 2
+je short loc_00006d85 ; je 0x6d85
+mov byte [ebx + 0xb], 0
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00006d72 ; je 0x6d72
+push 3
+push edi
+push 1
+push 0
+push edi
+push 1
+push ref_00021b06 ; push 0x21b06
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_00006d72:
+push edx
+push edi
+push 1
+push 0
+call fcn_0000241b ; call 0x241b
+add esp, 0x10
+jmp near loc_00006e1a ; jmp 0x6e1a
+
+loc_00006d85:
+push 0x10
+push 0
+push 0
+push 1
+call fcn_00002862 ; call 0x2862
+add esp, 0x10
+test eax, eax
+jne short loc_00006db7 ; jne 0x6db7
+mov byte [ebx + 0xb], 0
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00006e1a ; je 0x6e1a
+push 3
+push edi
+push 1
+push 0
+push edi
+push 1
+push ref_00021b4c ; push 0x21b4c
+jmp short loc_00006e10 ; jmp 0x6e10
+
+loc_00006db7:
+add eax, dword [ebp - 0x38]
+sub esp, 0xc
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov dl, al
+and eax, 0xf
+and edx, 0xf
+mov esi, eax
+mov byte [ebx + 6], dl
+cmp eax, 2
+ja short loc_00006df5 ; ja 0x6df5
+mov byte [ebx + 0xb], 0
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00006e1a ; je 0x6e1a
+push esi
+push edi
+push 1
+push 0
+push edi
+push 1
+push ref_00021b9b ; push 0x21b9b
+jmp short loc_00006e10 ; jmp 0x6e10
+
+loc_00006df5:
+mov byte [ebx + 0xb], 1
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00006e1a ; je 0x6e1a
+push esi
+push edi
+push 1
+push 0
+push edi
+push 1
+push ref_00021be5 ; push 0x21be5
+
+loc_00006e10:
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_00006e1a:
+push eax
+push eax
+push 0xff0000ff
+push dword [ebp - 0x30]
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+
+loc_00006e2c:
+mov al, byte [ebp + edi - 0x1e]
+mov cl, byte [ebp - 0x29]
+lea edx, [ecx + eax]
+sub ecx, eax
+cmp byte [ebp - 0x2b], 0
+mov al, cl
+cmovne edx, eax
+mov byte [ebp - 0x29], dl
+inc byte [ebp - 0x2a]
+jmp near loc_00006bc9 ; jmp 0x6bc9
+
+loc_00006e4c:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00006e54:
+push ebp
+mov ebp, esp
+mov edx, dword [ebp + 8]
+cmp byte [ebp + 0xc], 0
+mov al, dl
+je short loc_00006e66 ; je 0x6e66
+mov al, 0xf
+sub eax, edx
+
+loc_00006e66:
+pop ebp
+ret
+
+fcn_00006e68:
+push ebp
+mov ebp, esp
+sub esp, 0xc
+push dword [ebp + 0x14]
+mov eax, dword [ebp + 0x10]
+push eax
+push dword [ebp + 8]
+call dword [eax + 4] ; ucall
+pop eax
+mov eax, dword [ebp + 0x1c]
+pop edx
+movzx eax, byte [eax + 2]
+push eax
+push dword [ebp + 0x18]
+call fcn_00007c07 ; call 0x7c07
+sub eax, dword [ebp + 0x20]
+leave
+ret
+
+fcn_00006e92:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x5c
+mov al, byte [ebp + 0x24]
+push dword [ebp + 0xc]
+mov edi, dword [ebp + 0x28]
+mov bl, byte [ebp + 0x30]
+mov byte [ebp - 0x53], al
+mov al, byte [ebp + 0x2c]
+mov byte [ebp - 0x52], al
+call fcn_00006a6a ; call 0x6a6a
+push esi
+push esi
+push 1
+mov esi, eax
+call fcn_0000968c ; call 0x968c
+add esp, 0x10
+test eax, eax
+js near loc_000070f3 ; js 0x70f3
+mov eax, dword [ebp + 0x20]
+mov dword [ebp - 0x4c], eax
+movzx eax, si
+mov dword [ebp - 0x58], eax
+movzx eax, bl
+mov dword [ebp - 0x50], eax
+
+loc_00006edd:
+mov al, byte [ebp - 0x4c]
+sub eax, dword [ebp + 0x20]
+cmp al, byte [ebp - 0x53]
+jae near loc_000070e6 ; jae 0x70e6
+push ecx
+push ecx
+lea eax, [ebp - 0x39]
+push eax
+mov eax, dword [ebp - 0x4c]
+movzx ebx, byte [eax]
+push ebx
+call fcn_0000996b ; call 0x996b
+mov eax, dword [ebp + 0x34]
+add esp, 0x10
+mov byte [ebp - 0x51], 0
+lea eax, [eax + ebx*4]
+xor ebx, ebx
+mov dword [ebp - 0x60], eax
+
+loc_00006f10:
+test bl, bl
+jne near loc_000070de ; jne 0x70de
+cmp byte [ebp - 0x51], 2
+ja near loc_000070de ; ja 0x70de
+push eax
+push eax
+movzx eax, byte [edi + 2]
+push eax
+push dword [ebp + 0x1c]
+call fcn_00007c07 ; call 0x7c07
+mov esi, eax
+pop eax
+pop edx
+lea eax, [ebp - 0x39]
+push eax
+push 5
+call fcn_00009a23 ; call 0x9a23
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00006f87 ; je 0x6f87
+test ebx, ebx
+jns short loc_00006f87 ; jns 0x6f87
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00006f6f ; je 0x6f6f
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00006f6f:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x350
+push ref_00021c15 ; push 0x21c15
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00006f87:
+push ebx
+push esi
+push edi
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00006e68 ; call 0x6e68
+add esp, 0x20
+cmp eax, dword [ebp - 0x58]
+jb short loc_00006fad ; jb 0x6fad
+
+loc_00006fa6:
+xor ebx, ebx
+jmp near loc_0000706f ; jmp 0x706f
+
+loc_00006fad:
+movzx ebx, byte [ebp - 0x52]
+push ecx
+push dword [ebp - 0x50]
+push ebx
+push edi
+call fcn_000067a6 ; call 0x67a6
+add esp, 0x10
+test al, al
+jne short loc_00006fa6 ; jne 0x6fa6
+push eax
+push eax
+movzx eax, byte [edi + 2]
+push eax
+push dword [ebp + 0x1c]
+call fcn_00007c07 ; call 0x7c07
+mov dword [ebp - 0x5c], eax
+pop eax
+pop edx
+lea eax, [ebp - 0x39]
+push eax
+push 0xfffffffffffffffa
+call fcn_00009a23 ; call 0x9a23
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00007029 ; je 0x7029
+test esi, esi
+jns short loc_00007029 ; jns 0x7029
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00007011 ; je 0x7011
+push eax
+push esi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00007011:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x35f
+push ref_00021c15 ; push 0x21c15
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00007029:
+push esi
+push dword [ebp - 0x5c]
+push edi
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00006e68 ; call 0x6e68
+add esp, 0x20
+cmp eax, dword [ebp - 0x58]
+jae near loc_00006fa6 ; jae 0x6fa6
+push ecx
+push dword [ebp - 0x50]
+push ebx
+push edi
+call fcn_000067a6 ; call 0x67a6
+add esp, 0x10
+test al, al
+jne near loc_00006fa6 ; jne 0x6fa6
+mov eax, dword [ebp - 0x60]
+mov bl, 1
+mov dword [eax], 0xbb8
+
+loc_0000706f:
+sub esp, 0xc
+lea eax, [ebp - 0x39]
+push eax
+call fcn_00009a00 ; call 0x9a00
+movzx eax, byte [ebp - 0x52]
+add esp, 0x10
+mov byte [ebp - 0x5c], 3
+mov dword [ebp - 0x64], eax
+
+loc_00007089:
+push edx
+push dword [ebp - 0x50]
+push dword [ebp - 0x64]
+push edi
+push dword [ebp + 0x14]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_000068d1 ; call 0x68d1
+add esp, 0x20
+mov esi, eax
+test eax, eax
+jns short loc_000070d6 ; jns 0x70d6
+push eax
+mov eax, dword [ebp + 0x14]
+push 0x2710
+push dword [ebp + 0x14]
+push dword [ebp + 8]
+call dword [eax + 4] ; ucall
+add esp, 0x10
+dec byte [ebp - 0x5c]
+jne short loc_00007089 ; jne 0x7089
+sub esp, 0xc
+push 0
+call fcn_0000968c ; call 0x968c
+add esp, 0x10
+mov eax, esi
+jmp short loc_000070f3 ; jmp 0x70f3
+
+loc_000070d6:
+inc byte [ebp - 0x51]
+jmp near loc_00006f10 ; jmp 0x6f10
+
+loc_000070de:
+inc dword [ebp - 0x4c]
+jmp near loc_00006edd ; jmp 0x6edd
+
+loc_000070e6:
+sub esp, 0xc
+push 0
+call fcn_0000968c ; call 0x968c
+add esp, 0x10
+
+loc_000070f3:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000070fb:
+push ebp
+mov ebp, esp
+mov ecx, dword [ebp + 8]
+mov edx, dword [ebp + 0xc]
+push ebx
+mov ebx, ecx
+mov eax, edx
+sub ebx, edx
+sub eax, ecx
+cmp ecx, edx
+cmovge eax, ebx
+pop ebx
+pop ebp
+ret
+
+fcn_00007115:
+push ebp
+xor eax, eax
+mov ebp, esp
+mov ecx, dword [ebp + 8]
+push esi
+push ebx
+test ecx, ecx
+je short loc_0000715e ; je 0x715e
+xor ebx, ebx
+mov esi, 0xa9e
+
+loc_0000712a:
+cmp ecx, 0x10f
+jbe short loc_00007143 ; jbe 0x7143
+imul eax, ecx, 0x3e8
+xor edx, edx
+add ebx, 0x64
+div esi
+mov ecx, eax
+jmp short loc_0000712a ; jmp 0x712a
+
+loc_00007143:
+imul eax, ecx, 0xfffffff0
+xor edx, edx
+add eax, 0x2d3a
+imul eax, ecx
+mov ecx, 0x2710
+sub eax, 0xeefac
+div ecx
+add eax, ebx
+
+loc_0000715e:
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00007162:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+mov ebx, 0x9c40
+push eax
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x14]
+cmp eax, 0x9c40
+cmova eax, ebx
+imul eax, eax, 0x64
+push eax
+call fcn_00007115 ; call 0x7115
+cmp esi, 0x9c40
+cmova esi, ebx
+imul esi, esi, 0x64
+mov dword [ebp - 0x10], eax
+mov dword [esp], esi
+call fcn_00007115 ; call 0x7115
+cmp dword [ebp + 0x10], 0x9c40
+cmovbe ebx, dword [ebp + 0x10]
+imul ebx, ebx, 0x64
+mov esi, eax
+mov dword [esp], ebx
+call fcn_00007115 ; call 0x7115
+test edi, edi
+pop edx
+mov edx, dword [ebp - 0x10]
+mov ebx, eax
+js short loc_000071e6 ; js 0x71e6
+cmp esi, eax
+lea ecx, [edi - 1]
+jne short loc_000071cd ; jne 0x71cd
+imul eax, ecx, 0x64
+jmp short loc_000071dd ; jmp 0x71dd
+
+loc_000071cd:
+sub edx, eax
+sub esi, ebx
+imul eax, edx, 0x64
+xor edx, edx
+imul ecx, ecx, 0x64
+div esi
+add eax, ecx
+
+loc_000071dd:
+xor ecx, ecx
+test eax, eax
+cmovns ecx, eax
+jmp short loc_0000720c ; jmp 0x720c
+
+loc_000071e6:
+cmp esi, eax
+lea ecx, [edi + 1]
+jne short loc_000071f2 ; jne 0x71f2
+imul ecx, ecx, 0x64
+jmp short loc_0000720c ; jmp 0x720c
+
+loc_000071f2:
+sub edx, eax
+sub esi, ebx
+imul eax, edx, 0x64
+xor edx, edx
+imul ecx, ecx, 0x64
+div esi
+sub ecx, eax
+mov eax, 0
+test ecx, ecx
+cmovg ecx, eax
+
+loc_0000720c:
+lea esp, [ebp - 0xc]
+mov eax, ecx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00007216:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x4c
+mov al, byte [ebp + 0x24]
+push dword [ebp + 0xc]
+movzx ebx, byte [ebp + 0x30]
+mov byte [ebp - 0x42], al
+mov al, byte [ebp + 0x2c]
+mov byte [ebp - 0x2c], al
+mov al, byte [ebp + 0x34]
+mov byte [ebp - 0x41], al
+call fcn_00006a46 ; call 0x6a46
+mov ecx, dword [ebp + 0x20]
+pop edi
+mov dword [ebp - 0x40], ebx
+mov dword [ebp - 0x38], ecx
+movzx eax, ax
+mov dword [ebp - 0x34], eax
+
+loc_0000724d:
+mov bl, byte [ebp - 0x38]
+sub ebx, dword [ebp + 0x20]
+cmp bl, byte [ebp - 0x42]
+jae near loc_00007694 ; jae 0x7694
+mov eax, dword [ebp - 0x38]
+mov ecx, dword [ebp + 0x38]
+cmp byte [ebp - 0x41], 0
+movzx eax, byte [eax]
+mov byte [ebp - 0x19], al
+mov dword [ecx + eax*4], 0
+je short loc_00007297 ; je 0x7297
+mov esi, dword [ebp + 0xc]
+push edx
+push edx
+mov edx, dword [esi + 1]
+push dword [edx + 4]
+push eax
+call fcn_00009584 ; call 0x9584
+movzx eax, byte [ebp - 0x19]
+pop ecx
+pop esi
+push 1
+push eax
+call fcn_00009521 ; call 0x9521
+add esp, 0x10
+
+loc_00007297:
+test bl, bl
+je short loc_000072b8 ; je 0x72b8
+mov eax, dword [ebp - 0x38]
+xor esi, esi
+mov ecx, dword [ebp + 0x38]
+movzx eax, byte [eax - 1]
+mov eax, dword [ecx + eax*4]
+mov ecx, 0x64
+cdq
+idiv ecx
+dec eax
+cmovns esi, eax
+jmp short loc_000072ba ; jmp 0x72ba
+
+loc_000072b8:
+xor esi, esi
+
+loc_000072ba:
+mov byte [ebp - 0x2b], 0
+mov byte [ebp - 0x29], 1
+mov dword [ebp - 0x3c], 0xffffffff
+mov byte [ebp - 0x2a], 0
+
+loc_000072cd:
+cmp byte [ebp - 0x2b], 0x1d
+ja near loc_00007620 ; ja 0x7620
+cmp byte [ebp - 0x2a], 1
+ja near loc_00007620 ; ja 0x7620
+push eax
+push eax
+mov eax, dword [ebp + 0x28]
+inc byte [ebp - 0x2b]
+movzx eax, byte [eax + 2]
+push eax
+push dword [ebp + 0x1c]
+call fcn_00007c07 ; call 0x7c07
+add esp, 0xc
+mov edi, eax
+mov eax, esi
+movzx eax, al
+push eax
+push 1
+lea eax, [ebp - 0x19]
+push eax
+call fcn_00009c03 ; call 0x9c03
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00007353 ; je 0x7353
+test ebx, ebx
+jns short loc_00007353 ; jns 0x7353
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000733b ; je 0x733b
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000733b:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x1f0
+push ref_00021c15 ; push 0x21c15
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00007353:
+push eax
+push edi
+push dword [ebp + 0x28]
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00006e68 ; call 0x6e68
+add esp, 0x20
+mov edi, eax
+cmp eax, dword [ebp - 0x34]
+jb short loc_0000738c ; jb 0x738c
+test esi, esi
+jne short loc_00007392 ; jne 0x7392
+movzx eax, byte [ebp - 0x19]
+mov bl, 1
+mov ecx, dword [ebp + 0x38]
+mov dword [ecx + eax*4], 0
+jmp short loc_00007398 ; jmp 0x7398
+
+loc_0000738c:
+mov byte [ebp - 0x29], 1
+jmp short loc_00007396 ; jmp 0x7396
+
+loc_00007392:
+mov byte [ebp - 0x29], 0xff
+
+loc_00007396:
+xor ebx, ebx
+
+loc_00007398:
+mov al, byte [ebp - 0x29]
+add eax, esi
+mov byte [ebp - 0x30], al
+movzx eax, byte [ebp - 0x2c]
+mov dword [ebp - 0x4c], eax
+
+loc_000073a7:
+test bl, 1
+jne near loc_000074fc ; jne 0x74fc
+cmp byte [ebp - 0x30], 0x18
+ja near loc_000074fc ; ja 0x74fc
+push ebx
+push dword [ebp - 0x40]
+push dword [ebp - 0x4c]
+push dword [ebp + 0x28]
+call fcn_000067a6 ; call 0x67a6
+add esp, 0x10
+mov bl, al
+test al, al
+je short loc_00007408 ; je 0x7408
+cmp byte [ebp - 0x29], 0xff
+je near loc_0000751b ; je 0x751b
+cmp byte [ebp - 0x30], 0
+movzx eax, byte [ebp - 0x19]
+jne short loc_000073f5 ; jne 0x73f5
+mov esi, dword [ebp + 0x38]
+mov dword [esi + eax*4], 0
+jmp near loc_0000752a ; jmp 0x752a
+
+loc_000073f5:
+movsx edx, byte [ebp - 0x30]
+mov esi, dword [ebp + 0x38]
+dec edx
+imul edx, edx, 0x64
+mov dword [esi + eax*4], edx
+jmp near loc_0000752a ; jmp 0x752a
+
+loc_00007408:
+mov eax, dword [ebp + 0x28]
+push ecx
+push ecx
+movzx eax, byte [eax + 2]
+push eax
+push dword [ebp + 0x1c]
+call fcn_00007c07 ; call 0x7c07
+add esp, 0xc
+mov dword [ebp - 0x48], eax
+movzx eax, byte [ebp - 0x30]
+push eax
+push 1
+lea eax, [ebp - 0x19]
+push eax
+call fcn_00009c03 ; call 0x9c03
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00007477 ; je 0x7477
+test esi, esi
+jns short loc_00007477 ; jns 0x7477
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000745f ; je 0x745f
+push edx
+push esi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000745f:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x21b
+push ref_00021c15 ; push 0x21c15
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00007477:
+push eax
+push dword [ebp - 0x48]
+push dword [ebp + 0x28]
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00006e68 ; call 0x6e68
+add esp, 0x20
+cmp byte [ebp - 0x29], 0xff
+mov esi, eax
+jne short loc_000074c2 ; jne 0x74c2
+cmp eax, dword [ebp - 0x34]
+jae short loc_000074ef ; jae 0x74ef
+movzx eax, byte [ebp - 0x19]
+mov ecx, dword [ebp + 0x38]
+lea ebx, [ecx + eax*4]
+movsx eax, byte [ebp - 0x30]
+push eax
+push esi
+push edi
+push dword [ebp - 0x34]
+call fcn_00007162 ; call 0x7162
+add esp, 0x10
+mov dword [ebx], eax
+jmp short loc_00007541 ; jmp 0x7541
+
+loc_000074c2:
+cmp eax, dword [ebp - 0x34]
+jb short loc_000074ef ; jb 0x74ef
+movzx eax, byte [ebp - 0x19]
+mov edx, dword [ebp + 0x38]
+lea edx, [edx + eax*4]
+movsx eax, byte [ebp - 0x30]
+mov dword [ebp - 0x48], edx
+push eax
+push edi
+mov edi, esi
+push esi
+push dword [ebp - 0x34]
+call fcn_00007162 ; call 0x7162
+mov edx, dword [ebp - 0x48]
+add esp, 0x10
+mov dword [edx], eax
+jmp short loc_0000752a ; jmp 0x752a
+
+loc_000074ef:
+mov al, byte [ebp - 0x29]
+mov edi, esi
+add byte [ebp - 0x30], al
+jmp near loc_000073a7 ; jmp 0x73a7
+
+loc_000074fc:
+cmp byte [ebp - 0x29], 0xff
+jne short loc_0000752a ; jne 0x752a
+cmp edi, dword [ebp - 0x34]
+jb short loc_00007541 ; jb 0x7541
+test bl, bl
+jne short loc_00007541 ; jne 0x7541
+movzx eax, byte [ebp - 0x19]
+mov esi, dword [ebp + 0x38]
+mov dword [esi + eax*4], 0
+jmp short loc_00007541 ; jmp 0x7541
+
+loc_0000751b:
+mov byte [ebp - 0x29], 1
+mov dword [ebp - 0x3c], 0xffffffff
+mov byte [ebp - 0x2a], 0
+
+loc_0000752a:
+cmp edi, dword [ebp - 0x34]
+jae short loc_00007541 ; jae 0x7541
+test bl, bl
+jne short loc_00007541 ; jne 0x7541
+movzx eax, byte [ebp - 0x19]
+mov ecx, dword [ebp + 0x38]
+mov dword [ecx + eax*4], 0x9c4
+
+loc_00007541:
+movzx eax, byte [ebp - 0x19]
+mov ecx, 0x64
+xor esi, esi
+mov edx, dword [ebp + 0x38]
+mov edi, dword [edx + eax*4]
+mov eax, edi
+cdq
+idiv ecx
+mov ecx, dword [ebp - 0x3c]
+mov dword [ebp - 0x30], edi
+dec eax
+cmovns esi, eax
+cmp ecx, 0xffffffff
+je short loc_00007584 ; je 0x7584
+mov edx, ecx
+mov eax, edi
+sub eax, ecx
+sub edx, edi
+cmp ecx, edi
+cmovge eax, edx
+mov dl, byte [ebp - 0x2a]
+xor ecx, ecx
+inc edx
+cmp eax, 0x64
+mov al, cl
+cmovle eax, edx
+mov byte [ebp - 0x2a], al
+
+loc_00007584:
+movzx ebx, byte [ebp - 0x2c]
+push eax
+push dword [ebp - 0x40]
+push ebx
+push dword [ebp + 0x28]
+call fcn_000067a6 ; call 0x67a6
+add esp, 0x10
+test al, al
+je short loc_000075f1 ; je 0x75f1
+push eax
+push 0
+push 1
+lea eax, [ebp - 0x19]
+push eax
+call fcn_00009c03 ; call 0x9c03
+mov edi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_000075f1 ; je 0x75f1
+test edi, edi
+jns short loc_000075f1 ; jns 0x75f1
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000075d9 ; je 0x75d9
+push eax
+push edi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000075d9:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x252
+push ref_00021c15 ; push 0x21c15
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000075f1:
+push edi
+push dword [ebp - 0x40]
+push ebx
+push dword [ebp + 0x28]
+push dword [ebp + 0x14]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_000068d1 ; call 0x68d1
+add esp, 0x20
+test eax, eax
+js near loc_00007696 ; js 0x7696
+mov eax, dword [ebp - 0x30]
+mov dword [ebp - 0x3c], eax
+jmp near loc_000072cd ; jmp 0x72cd
+
+loc_00007620:
+push ebx
+push 0
+push 1
+lea eax, [ebp - 0x19]
+push eax
+call fcn_00009c03 ; call 0x9c03
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00007675 ; je 0x7675
+test ebx, ebx
+jns short loc_00007675 ; jns 0x7675
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000765d ; je 0x765d
+push ecx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000765d:
+push edx
+push ref_000206f4 ; push 0x206f4
+push 0x262
+push ref_00021c15 ; push 0x21c15
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00007675:
+cmp byte [ebp - 0x41], 0
+je short loc_0000768c ; je 0x768c
+push eax
+push eax
+movzx eax, byte [ebp - 0x19]
+push 0
+push eax
+call fcn_00009521 ; call 0x9521
+add esp, 0x10
+
+loc_0000768c:
+inc dword [ebp - 0x38]
+jmp near loc_0000724d ; jmp 0x724d
+
+loc_00007694:
+xor eax, eax
+
+loc_00007696:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000769e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x3c
+mov eax, dword [ebp + 0x24]
+push dword [ebp + 0xc]
+mov edi, dword [ebp + 0x28]
+mov dword [ebp - 0x3c], eax
+mov bl, al
+mov al, byte [ebp + 0x2c]
+mov byte [ebp - 0x1c], al
+mov al, byte [ebp + 0x30]
+mov byte [ebp - 0x31], al
+call fcn_00006a46 ; call 0x6a46
+movzx ecx, bl
+pop edx
+mov byte [ebp - 0x1b], 0
+mov byte [ebp - 0x19], 1
+mov dword [ebp - 0x2c], 0xffffffff
+mov dword [ebp - 0x20], 0
+movzx eax, ax
+mov byte [ebp - 0x1a], 0
+mov dword [ebp - 0x30], ecx
+mov dword [ebp - 0x24], eax
+
+loc_000076ed:
+cmp byte [ebp - 0x1b], 0x1d
+ja near loc_00007a4d ; ja 0x7a4d
+cmp byte [ebp - 0x1a], 1
+ja near loc_00007a4d ; ja 0x7a4d
+push eax
+push eax
+movzx eax, byte [edi + 2]
+inc byte [ebp - 0x1b]
+push eax
+push dword [ebp + 0x1c]
+call fcn_00007c07 ; call 0x7c07
+add esp, 0xc
+mov esi, eax
+movzx eax, byte [ebp - 0x20]
+push eax
+push dword [ebp - 0x30]
+push dword [ebp + 0x20]
+call fcn_00009c03 ; call 0x9c03
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000776f ; je 0x776f
+test ebx, ebx
+jns short loc_0000776f ; jns 0x776f
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00007757 ; je 0x7757
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00007757:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x29f
+push ref_00021c15 ; push 0x21c15
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000776f:
+push eax
+push esi
+push edi
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00006e68 ; call 0x6e68
+mov ecx, dword [ebp - 0x24]
+add esp, 0x20
+mov dword [ebp - 0x28], eax
+cmp eax, ecx
+jb short loc_000077ab ; jb 0x77ab
+cmp dword [ebp - 0x20], 0
+jne short loc_000077b1 ; jne 0x77b1
+movzx eax, byte [edi + 2]
+mov bl, 1
+mov ecx, dword [ebp + 0x34]
+mov dword [ecx + eax*4], 0
+jmp short loc_000077b7 ; jmp 0x77b7
+
+loc_000077ab:
+mov byte [ebp - 0x19], 1
+jmp short loc_000077b5 ; jmp 0x77b5
+
+loc_000077b1:
+mov byte [ebp - 0x19], 0xff
+
+loc_000077b5:
+xor ebx, ebx
+
+loc_000077b7:
+mov al, byte [ebp - 0x20]
+add al, byte [ebp - 0x19]
+mov byte [ebp - 0x20], al
+movzx eax, byte [ebp - 0x31]
+mov dword [ebp - 0x40], eax
+movzx eax, byte [ebp - 0x1c]
+mov dword [ebp - 0x44], eax
+
+loc_000077ce:
+test bl, 1
+jne near loc_00007921 ; jne 0x7921
+cmp byte [ebp - 0x20], 0x18
+ja near loc_00007921 ; ja 0x7921
+push eax
+push dword [ebp - 0x40]
+push dword [ebp - 0x44]
+push edi
+call fcn_000067a6 ; call 0x67a6
+add esp, 0x10
+test al, al
+mov bl, al
+movzx eax, byte [edi + 2]
+je short loc_0000782d ; je 0x782d
+cmp byte [ebp - 0x19], 0
+js near loc_00007943 ; js 0x7943
+cmp byte [ebp - 0x20], 0
+jne short loc_0000781a ; jne 0x781a
+mov ecx, dword [ebp + 0x34]
+mov dword [ecx + eax*4], 0
+jmp near loc_00007952 ; jmp 0x7952
+
+loc_0000781a:
+movsx edx, byte [ebp - 0x20]
+mov ecx, dword [ebp + 0x34]
+dec edx
+imul edx, edx, 0x64
+mov dword [ecx + eax*4], edx
+jmp near loc_00007952 ; jmp 0x7952
+
+loc_0000782d:
+push esi
+push esi
+push eax
+push dword [ebp + 0x1c]
+call fcn_00007c07 ; call 0x7c07
+add esp, 0xc
+mov dword [ebp - 0x38], eax
+movzx eax, byte [ebp - 0x20]
+push eax
+push dword [ebp - 0x30]
+push dword [ebp + 0x20]
+call fcn_00009c03 ; call 0x9c03
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00007895 ; je 0x7895
+test esi, esi
+jns short loc_00007895 ; jns 0x7895
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000787d ; je 0x787d
+push ecx
+push esi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000787d:
+push edx
+push ref_000206f4 ; push 0x206f4
+push 0x2ca
+push ref_00021c15 ; push 0x21c15
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00007895:
+push eax
+push dword [ebp - 0x38]
+push edi
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00006e68 ; call 0x6e68
+add esp, 0x20
+cmp byte [ebp - 0x19], 0
+mov esi, eax
+jns short loc_000078e3 ; jns 0x78e3
+cmp eax, dword [ebp - 0x24]
+jae short loc_00007913 ; jae 0x7913
+movzx eax, byte [edi + 2]
+mov ebx, dword [ebp + 0x34]
+lea ebx, [ebx + eax*4]
+movsx eax, byte [ebp - 0x20]
+push eax
+push esi
+push dword [ebp - 0x28]
+push dword [ebp - 0x24]
+call fcn_00007162 ; call 0x7162
+add esp, 0x10
+mov dword [ebx], eax
+jmp near loc_0000796c ; jmp 0x796c
+
+loc_000078e3:
+cmp eax, dword [ebp - 0x24]
+jb short loc_00007913 ; jb 0x7913
+movzx eax, byte [edi + 2]
+mov edx, dword [ebp + 0x34]
+lea edx, [edx + eax*4]
+movsx eax, byte [ebp - 0x20]
+mov dword [ebp - 0x38], edx
+push eax
+push dword [ebp - 0x28]
+push esi
+push dword [ebp - 0x24]
+call fcn_00007162 ; call 0x7162
+mov edx, dword [ebp - 0x38]
+add esp, 0x10
+mov dword [ebp - 0x28], esi
+mov dword [edx], eax
+jmp short loc_00007952 ; jmp 0x7952
+
+loc_00007913:
+mov al, byte [ebp - 0x19]
+add byte [ebp - 0x20], al
+mov dword [ebp - 0x28], esi
+jmp near loc_000077ce ; jmp 0x77ce
+
+loc_00007921:
+cmp byte [ebp - 0x19], 0
+jns short loc_00007952 ; jns 0x7952
+mov eax, dword [ebp - 0x24]
+cmp dword [ebp - 0x28], eax
+jb short loc_0000796c ; jb 0x796c
+test bl, bl
+jne short loc_0000796c ; jne 0x796c
+movzx eax, byte [edi + 2]
+mov ebx, dword [ebp + 0x34]
+mov dword [ebx + eax*4], 0
+jmp short loc_0000796c ; jmp 0x796c
+
+loc_00007943:
+mov byte [ebp - 0x19], 1
+mov dword [ebp - 0x2c], 0xffffffff
+mov byte [ebp - 0x1a], 0
+
+loc_00007952:
+mov eax, dword [ebp - 0x24]
+cmp dword [ebp - 0x28], eax
+jae short loc_0000796c ; jae 0x796c
+test bl, bl
+jne short loc_0000796c ; jne 0x796c
+movzx eax, byte [edi + 2]
+mov ebx, dword [ebp + 0x34]
+mov dword [ebx + eax*4], 0x9c4
+
+loc_0000796c:
+movzx eax, byte [edi + 2]
+mov ecx, dword [ebp + 0x34]
+mov esi, dword [ecx + eax*4]
+mov ecx, 0x64
+mov eax, esi
+cdq
+idiv ecx
+xor edx, edx
+mov dword [ebp - 0x28], esi
+dec eax
+mov ecx, eax
+cmovs ecx, edx
+mov dword [ebp - 0x20], ecx
+mov ecx, dword [ebp - 0x2c]
+cmp ecx, 0xffffffff
+je short loc_000079b4 ; je 0x79b4
+mov edx, ecx
+mov eax, esi
+sub eax, ecx
+sub edx, esi
+cmp ecx, esi
+cmovge eax, edx
+mov dl, byte [ebp - 0x1a]
+xor ecx, ecx
+inc edx
+cmp eax, 0x64
+mov al, cl
+cmovle eax, edx
+mov byte [ebp - 0x1a], al
+
+loc_000079b4:
+movzx esi, byte [ebp - 0x31]
+movzx ebx, byte [ebp - 0x1c]
+push eax
+push esi
+push ebx
+push edi
+call fcn_000067a6 ; call 0x67a6
+add esp, 0x10
+test al, al
+je short loc_00007a26 ; je 0x7a26
+push eax
+push 0
+push dword [ebp - 0x30]
+push dword [ebp + 0x20]
+call fcn_00009c03 ; call 0x9c03
+mov dword [ebp - 0x2c], eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00007a26 ; je 0x7a26
+cmp dword [ebp - 0x2c], 0
+jns short loc_00007a26 ; jns 0x7a26
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00007a0e ; je 0x7a0e
+push eax
+push dword [ebp - 0x2c]
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00007a0e:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x301
+push ref_00021c15 ; push 0x21c15
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00007a26:
+push eax
+push esi
+push ebx
+push edi
+push dword [ebp + 0x14]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_000068d1 ; call 0x68d1
+add esp, 0x20
+test eax, eax
+js short loc_00007aaa ; js 0x7aaa
+mov eax, dword [ebp - 0x28]
+mov dword [ebp - 0x2c], eax
+jmp near loc_000076ed ; jmp 0x76ed
+
+loc_00007a4d:
+movzx eax, byte [ebp - 0x3c]
+push ecx
+push 0
+push eax
+push dword [ebp + 0x20]
+call fcn_00009c03 ; call 0x9c03
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+xor edx, edx
+test al, al
+je short loc_00007aac ; je 0x7aac
+test ebx, ebx
+jns short loc_00007aac ; jns 0x7aac
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00007a8e ; je 0x7a8e
+push edx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00007a8e:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x311
+push ref_00021c15 ; push 0x21c15
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+xor edx, edx
+jmp short loc_00007aac ; jmp 0x7aac
+
+loc_00007aaa:
+mov edx, eax
+
+loc_00007aac:
+lea esp, [ebp - 0xc]
+mov eax, edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00007ab6:
+push ebp
+xor eax, eax
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov edx, dword [ebp + 0x20]
+mov ecx, dword [ebp + 0x24]
+
+loc_00007ac7:
+mov edi, dword [ebp + 0x2c]
+mov dword [edi + eax], 0xffffffff
+add eax, 4
+cmp eax, 0x40
+jne short loc_00007ac7 ; jne 0x7ac7
+movzx eax, cl
+xor edi, edi
+shl eax, 5
+lea eax, [edx + eax + 0xc]
+lea esi, [edx + 0xc]
+mov dword [ebp - 0x20], eax
+
+loc_00007aeb:
+cmp esi, dword [ebp - 0x20]
+je near loc_00007bfd ; je 0x7bfd
+mov al, byte [esi + 0x10]
+cmp byte [esi + 0x11], 0
+mov byte [ebp - 0x19], al
+je near loc_00007bf5 ; je 0x7bf5
+cmp byte [esi + 0x12], 1
+je near loc_00007bf5 ; je 0x7bf5
+cmp byte [esi - 1], 0
+mov cl, 3
+lea ebx, [esi - 0xc]
+jne short loc_00007b27 ; jne 0x7b27
+sub esp, 0xc
+push ebx
+call fcn_000065f0 ; call 0x65f0
+add esp, 0x10
+mov cl, al
+
+loc_00007b27:
+sub esp, 0xc
+push ebx
+mov dword [ebp - 0x24], ecx
+call fcn_0000649b ; call 0x649b
+add esp, 0x10
+mov ecx, dword [ebp - 0x24]
+cmp dword [ebp + 0x28], 1
+je short loc_00007bab ; je 0x7bab
+jb short loc_00007b76 ; jb 0x7b76
+cmp dword [ebp + 0x28], 2
+jne near loc_00007bdb ; jne 0x7bdb
+push dword [ebp + 0x2c]
+movzx eax, al
+movzx ecx, cl
+push eax
+push ecx
+push ebx
+movzx ebx, byte [ebp - 0x19]
+push ebx
+push esi
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00006e92 ; call 0x6e92
+jmp short loc_00007bd4 ; jmp 0x7bd4
+
+loc_00007b76:
+sub esp, 0xc
+movzx eax, al
+push dword [ebp + 0x2c]
+movzx ecx, cl
+push 0
+push eax
+push ecx
+push ebx
+movzx ebx, byte [ebp - 0x19]
+push ebx
+push esi
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00007216 ; call 0x7216
+add esp, 0x40
+mov edi, eax
+jmp short loc_00007bf5 ; jmp 0x7bf5
+
+loc_00007bab:
+push dword [ebp + 0x2c]
+movzx eax, al
+movzx ecx, cl
+push eax
+push ecx
+push ebx
+movzx ebx, byte [ebp - 0x19]
+push ebx
+push esi
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_0000769e ; call 0x769e
+
+loc_00007bd4:
+mov edi, eax
+add esp, 0x30
+jmp short loc_00007bf5 ; jmp 0x7bf5
+
+loc_00007bdb:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00007bf5 ; je 0x7bf5
+push eax
+push eax
+push ref_00021c47 ; push 0x21c47
+push 2
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00007bf5:
+add esi, 0x20
+jmp near loc_00007aeb ; jmp 0x7aeb
+
+loc_00007bfd:
+lea esp, [ebp - 0xc]
+mov eax, edi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00007c07:
+push ebp
+mov ebp, esp
+movzx eax, byte [ebp + 0xc]
+mov edx, dword [ebp + 8]
+shl eax, 4
+lea eax, [edx + eax + 0xc]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00017e4e ; jmp 0x17e4e
+
+fcn_00007c21:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov eax, dword [ebp + 0xc]
+push 0
+mov ebx, dword [ebp + 8]
+push 1
+push 0
+mov dword [ebp - 0x20], eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 1
+push 1
+push 0
+mov esi, eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 2
+push 1
+push 0
+mov edi, eax
+call fcn_00016c9a ; call 0x16c9a
+mov dword [ebp - 0x1c], eax
+pop eax
+pop edx
+lea eax, [ebx + 0x6430]
+push 3
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [ebx + 0x6434]
+add ebx, 0x6438
+push 0x76543210
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+pop edx
+lea eax, [esi + 0x630]
+push 0xb
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [esi + 0x600]
+add esi, 0x604
+push 0x60b
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+pop edx
+push 0x76543980
+push esi
+call fcn_00017e8f ; call 0x17e8f
+lea eax, [edi + 0x600]
+add edi, 0x604
+pop ecx
+pop esi
+push 0x60b
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+pop edx
+push 0x76543280
+push edi
+call fcn_00017e8f ; call 0x17e8f
+mov edi, dword [ebp - 0x1c]
+pop ecx
+pop esi
+mov eax, edi
+push 0xb
+add eax, 0x600
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+mov eax, edi
+pop edx
+add eax, 0x604
+push 0x76543210
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop ecx
+pop esi
+push 0x680000
+push ebx
+call fcn_00017e8f ; call 0x17e8f
+mov eax, dword [ebp - 0x20]
+add esp, 0x10
+mov dword [ebp + 0xc], 0xa
+add eax, 0xa04
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f ; jmp 0x17e8f
+
+fcn_00007d3c:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov eax, dword [ebp + 0xc]
+push 0
+mov ebx, dword [ebp + 8]
+push 1
+push 0
+mov dword [ebp - 0x20], eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 1
+push 1
+push 0
+mov esi, eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 2
+push 1
+push 0
+mov edi, eax
+call fcn_00016c9a ; call 0x16c9a
+mov dword [ebp - 0x1c], eax
+pop eax
+pop edx
+lea eax, [ebx + 0x6430]
+push 0
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [ebx + 0x6434]
+add ebx, 0x6438
+push 0
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+pop edx
+lea eax, [esi + 0x630]
+push 0
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [esi + 0x600]
+add esi, 0x604
+push 0
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+pop edx
+push 0
+push esi
+call fcn_00017e8f ; call 0x17e8f
+lea eax, [edi + 0x600]
+add edi, 0x604
+pop ecx
+pop esi
+push 0
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+pop edx
+push 0
+push edi
+call fcn_00017e8f ; call 0x17e8f
+mov edi, dword [ebp - 0x1c]
+pop ecx
+pop esi
+mov eax, edi
+push 0
+add eax, 0x600
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+mov eax, edi
+pop edx
+add eax, 0x604
+push 0
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop ecx
+pop esi
+push 0
+push ebx
+call fcn_00017e8f ; call 0x17e8f
+mov eax, dword [ebp - 0x20]
+add esp, 0x10
+mov dword [ebp + 0xc], 0
+add eax, 0xa04
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f ; jmp 0x17e8f
+
+fcn_00007e42:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 8
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x60
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+pop edx
+pop ecx
+push 0x4000
+mov ebx, eax
+and ebx, 0xfffffff8
+lea eax, [ebx + 0x54]
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0xc
+push 0
+push 0xfed85000
+lea eax, [ebx + 0x38010]
+add ebx, 0x38004
+push eax
+call fcn_00017f28 ; call 0x17f28
+pop eax
+pop edx
+push 2
+push ebx
+call fcn_00018927 ; call 0x18927
+mov eax, 0xfed85000
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00007ea4:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 8
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x60
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+pop edx
+pop ecx
+push 0xfffd
+mov ebx, eax
+and ebx, 0xfffffff8
+lea eax, [ebx + 0x38004]
+push eax
+call fcn_00018954 ; call 0x18954
+add esp, 0xc
+push 0
+push 0xfff
+lea eax, [ebx + 0x38010]
+add ebx, 0x54
+push eax
+call fcn_00018d02 ; call 0x18d02
+pop eax
+pop edx
+push 0xffffbfff
+push ebx
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00007f07:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 8]
+push 0x40000
+push ebx
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+pop edx
+lea eax, [ebx + 4]
+push 0
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [ebx + 0x10]
+push 0x40000
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+pop edx
+lea eax, [ebx + 0x14]
+push 0
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [ebx + 0x20]
+push 0x40000
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+pop edx
+lea eax, [ebx + 0x24]
+push 0
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [ebx + 8]
+push 0xff000000
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+pop edx
+lea eax, [ebx + 0x18]
+push 0xff000000
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [ebx + 0x28]
+push 0xff000000
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+pop edx
+lea eax, [ebx + 0xc]
+push 0
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [ebx + 0x1c]
+add ebx, 0x2c
+push 0
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+pop edx
+push 0
+push ebx
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00007fc2:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 8]
+push dword [ebp + 0xc]
+call fcn_00007f07 ; call 0x7f07
+call fcn_00007ea4 ; call 0x7ea4
+mov eax, dword [ebx + 1]
+add esp, 0x10
+mov ebx, dword [ebp - 4]
+mov edx, dword [eax + 0x18]
+mov dword [ebp + 0xc], edx
+mov eax, dword [eax + 4]
+mov dword [ebp + 8], eax
+leave
+jmp near fcn_00007d3c ; jmp 0x7d3c
+
+fcn_00007ff4:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x14
+mov ebx, dword [ebp + 8]
+push 0xa100
+mov esi, dword [ebp + 0x10]
+mov edi, dword [ebp + 0xc]
+lea eax, [ebx + 4]
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+pop edx
+lea eax, [ebx + 0x14]
+push 0xa101
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [ebx + 0x24]
+push 0xa102
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+pop edx
+push 0x110000
+push ebx
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0xc
+push 0x3e8
+push esi
+push edi
+call dword [esi + 4] ; ucall
+pop ecx
+pop esi
+push 0x22100
+push ebx
+call fcn_00017e8f ; call 0x17e8f
+pop edi
+pop eax
+lea eax, [ebx + 0x10]
+add ebx, 0x20
+push 0x22101
+push eax
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], 0x22102
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f ; jmp 0x17e8f
+
+fcn_00008087:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 1]
+push dword [eax + 0x18]
+push dword [eax + 4]
+call fcn_00007c21 ; call 0x7c21
+call fcn_00007e42 ; call 0x7e42
+mov ebx, eax
+mov dword [esp], eax
+call fcn_00007f07 ; call 0x7f07
+add esp, 0xc
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+push ebx
+call fcn_00007ff4 ; call 0x7ff4
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000080c4:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+push ebx
+call fcn_00007f07 ; call 0x7f07
+add esp, 0x10
+mov dword [ebp + 0x10], edi
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], ebx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00007ff4 ; jmp 0x7ff4
+
+fcn_000080f4:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x14]
+mov dword [ebp - 0x1c], eax
+cmp bl, 0xf
+ja near loc_00008247 ; ja 0x8247
+mov esi, eax
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00008131 ; je 0x8131
+push eax
+movzx eax, bl
+push eax
+push ref_00021c67 ; push 0x21c67
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00008131:
+mov eax, dword [ebp + 8]
+mov al, byte [eax + 0x1d]
+test al, al
+je near loc_000081c9 ; je 0x81c9
+mov edx, dword [ebp + 8]
+cmp byte [edx + 0x1f], 0
+je short loc_00008190 ; je 0x8190
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00008166 ; je 0x8166
+push eax
+movzx eax, byte [ebp - 0x1c]
+push eax
+push ref_00021c7d ; push 0x21c7d
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00008166:
+test edi, edi
+je near loc_00008233 ; je 0x8233
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00008188 ; je 0x8188
+push eax
+push eax
+push ref_00021caa ; push 0x21caa
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00008188:
+movzx ebx, bl
+mov al, byte [ebp - 0x1c]
+jmp short loc_000081c3 ; jmp 0x81c3
+
+loc_00008190:
+test edi, edi
+je short loc_000081c9 ; je 0x81c9
+mov eax, dword [ebp + 0x10]
+movzx ebx, bl
+mov eax, dword [eax + 0xd]
+movzx esi, byte [eax + ebx + 0x19]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000081c1 ; je 0x81c1
+push eax
+mov eax, esi
+movzx eax, al
+push eax
+push ref_00021c90 ; push 0x21c90
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000081c1:
+mov eax, esi
+
+loc_000081c3:
+mov byte [edi + ebx + 0x35], al
+jmp short loc_00008233 ; jmp 0x8233
+
+loc_000081c9:
+mov ecx, dword [ebp + 8]
+cmp byte [ecx + 0x1f], 0
+jne short loc_000081ff ; jne 0x81ff
+test edi, edi
+jne near loc_0000826e ; jne 0x826e
+mov eax, dword [ebp + 0x10]
+movzx ebx, bl
+mov eax, dword [eax + 0xd]
+movzx esi, byte [eax + ebx + 0x19]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00008233 ; je 0x8233
+mov eax, esi
+movzx eax, al
+push ebx
+push eax
+push ref_00021cc8 ; push 0x21cc8
+jmp short loc_00008229 ; jmp 0x8229
+
+loc_000081ff:
+mov esi, 7
+test al, al
+jne short loc_00008233 ; jne 0x8233
+test edi, edi
+je short loc_00008233 ; je 0x8233
+
+loc_0000820c:
+movzx ebx, bl
+movzx esi, byte [edi + ebx + 0x35]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00008233 ; je 0x8233
+mov eax, esi
+movzx eax, al
+push ecx
+push eax
+push ref_00021ce3 ; push 0x21ce3
+
+loc_00008229:
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00008233:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00008279 ; je 0x8279
+push edx
+push edx
+push ref_00021f21 ; push 0x21f21
+push 0x40
+jmp short loc_00008264 ; jmp 0x8264
+
+loc_00008247:
+call fcn_00015479 ; call 0x15479
+mov esi, 7
+test al, al
+je short loc_00008279 ; je 0x8279
+movzx ebx, bl
+push eax
+push ebx
+push ref_00021d01 ; push 0x21d01
+push 0x80000000
+
+loc_00008264:
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp short loc_00008279 ; jmp 0x8279
+
+loc_0000826e:
+mov esi, 7
+test al, al
+jne short loc_00008233 ; jne 0x8233
+jmp short loc_0000820c ; jmp 0x820c
+
+loc_00008279:
+lea esp, [ebp - 0xc]
+mov eax, esi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00008283:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov ecx, dword [eax + 0xd]
+xor eax, eax
+
+loc_0000828e:
+movzx edx, byte [ecx + eax + 5]
+cmp edx, 3
+je short loc_000082a6 ; je 0x82a6
+test edx, edx
+je short loc_000082a6 ; je 0x82a6
+inc eax
+cmp eax, 3
+jne short loc_0000828e ; jne 0x828e
+xor eax, eax
+jmp short loc_000082a8 ; jmp 0x82a8
+
+loc_000082a6:
+mov al, 1
+
+loc_000082a8:
+pop ebp
+ret
+
+fcn_000082aa:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+cmp byte [eax], 0x12
+jbe short loc_000082c2 ; jbe 0x82c2
+mov eax, dword [eax + 0xd]
+mov al, byte [eax + 0x64]
+cmp al, 1
+jbe short loc_000082dd ; jbe 0x82dd
+
+loc_000082c2:
+call fcn_0001c651 ; call 0x1c651
+cmp eax, 0x40660
+je short loc_000082d9 ; je 0x82d9
+cmp eax, 0x306c0
+
+loc_000082d3:
+je short loc_000082d9 ; je 0x82d9
+mov al, 1
+jmp short loc_000082e1 ; jmp 0x82e1
+
+loc_000082d9:
+xor eax, eax
+jmp short loc_000082e1 ; jmp 0x82e1
+
+loc_000082dd:
+test al, al
+jmp short loc_000082d3 ; jmp 0x82d3
+
+loc_000082e1:
+leave
+ret
+
+fcn_000082e3:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x41c
+call fcn_0001c651 ; call 0x1c651
+mov dword [ebp - 0x3ec], eax
+call fcn_0001c678 ; call 0x1c678
+push ebx
+push 0
+push 1
+push 0
+mov dword [ebp - 0x3f4], eax
+call fcn_00016c9a ; call 0x16c9a
+mov dword [ebp - 0x3f8], eax
+add eax, 0xd0c
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov byte [ebp - 0x3ee], 3
+mov ebx, eax
+mov eax, dword [ebp + 0xc]
+cmp byte [eax], 0x12
+jbe short loc_00008351 ; jbe 0x8351
+mov eax, dword [eax + 0xd]
+mov edi, 3
+cmp byte [eax + 0x69], 1
+mov al, 0xa
+cmove edi, eax
+mov eax, edi
+mov byte [ebp - 0x3ee], al
+
+loc_00008351:
+mov byte [ebp - 0x2a2], 7
+xor eax, eax
+mov byte [ebp - 0x261], 3
+mov byte [ebp - 0x220], 5
+mov byte [ebp - 0x1df], 8
+mov byte [ebp - 0x19e], 0
+mov byte [ebp - 0x15d], 1
+mov byte [ebp - 0x11c], 2
+mov byte [ebp - 0xdb], 6
+mov byte [ebp - 0x9a], 9
+mov byte [ebp - 0x59], 4
+
+loc_00008396:
+mov dword [ebp + eax*4 - 0x3c4], 0xffffffff
+mov dword [ebp + eax*4 - 0x384], 0xffffffff
+mov byte [ebp + eax - 0x3d4], 7
+inc eax
+cmp eax, 0x10
+jne short loc_00008396 ; jne 0x8396
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000083d4 ; je 0x83d4
+push ecx
+push ecx
+push ref_00021d12 ; push 0x21d12
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000083d4:
+sub esp, 0xc
+push dword [ebp + 0xc]
+call fcn_00008283 ; call 0x8283
+add esp, 0x10
+test al, al
+jne short loc_000083ff ; jne 0x83ff
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_00009375 ; je 0x9375
+push edx
+push edx
+push ref_00021d2a ; push 0x21d2a
+jmp near loc_00008e4c ; jmp 0x8e4c
+
+loc_000083ff:
+shr ebx, 0x14
+sub esp, 0xc
+mov al, bl
+and eax, 1
+mov byte [ebp - 0x3ed], al
+mov bl, al
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+mov ax, word [eax + 0x3c]
+push dword [ebp + 0xc]
+mov word [ebp - 0x404], ax
+call fcn_00006a8e ; call 0x6a8e
+add esp, 0x10
+mov word [ebp - 0x40c], ax
+test bl, bl
+jne short loc_0000844b ; jne 0x844b
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00008465 ; je 0x8465
+push eax
+push eax
+push ref_00021d47 ; push 0x21d47
+jmp short loc_0000845b ; jmp 0x845b
+
+loc_0000844b:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00008465 ; je 0x8465
+push eax
+push eax
+push ref_00021d62 ; push 0x21d62
+
+loc_0000845b:
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00008465:
+cmp dword [ebp + 0x14], 0
+mov byte [ebp - 0x3d9], 0
+je near loc_00008577 ; je 0x8577
+mov eax, dword [ebp + 0x14]
+cmp byte [eax + 0x28], 0
+je near loc_00008577 ; je 0x8577
+lea eax, [ebp - 0x3d8]
+push eax
+push 0
+push 0
+push ref_000291fc ; push 0x291fc
+call fcn_0001975d ; call 0x1975d
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_000084df ; je 0x84df
+test ebx, ebx
+jns short loc_000084df ; jns 0x84df
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000084c7 ; je 0x84c7
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000084c7:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0xd6
+push ref_00021d7c ; push 0x21d7c
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000084df:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000084f9 ; je 0x84f9
+push eax
+push eax
+push ref_00021db4 ; push 0x21db4
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000084f9:
+push eax
+lea eax, [ebp - 0x3d9]
+push eax
+mov eax, dword [ebp - 0x3d8]
+push 0
+push dword [ebp + 8]
+call dword [eax + 5] ; ucall
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00008556 ; je 0x8556
+test ebx, ebx
+jns short loc_00008556 ; jns 0x8556
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000853e ; je 0x853e
+push edi
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000853e:
+push esi
+push ref_000206f4 ; push 0x206f4
+push 0xd9
+push ref_00021d7c ; push 0x21d7c
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00008556:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00008577 ; je 0x8577
+movzx eax, byte [ebp - 0x3d9]
+push ebx
+push eax
+push ref_00021dd1 ; push 0x21dd1
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00008577:
+lea eax, [ebp - 0x3df]
+xor ebx, ebx
+push ecx
+push eax
+lea eax, [ebp - 0x3de]
+push eax
+lea eax, [ebp - 0x302]
+push eax
+call fcn_00006ab2 ; call 0x6ab2
+add esp, 0x10
+
+loc_00008597:
+cmp bl, byte [ebp - 0x3de]
+jae near loc_0000862d ; jae 0x862d
+movzx eax, bl
+shl eax, 5
+lea esi, [ebp + eax - 0x302]
+movzx eax, byte [ebp + eax - 0x302]
+push edx
+movzx edx, byte [esi + 2]
+push edx
+movzx edx, byte [esi + 1]
+push edx
+push eax
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xb2
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+and eax, 0xf
+cmp ax, 3
+je short loc_000085e8 ; je 0x85e8
+cmp byte [esi + 0xb], 0
+jne short loc_000085eb ; jne 0x85eb
+
+loc_000085e8:
+inc ebx
+jmp short loc_00008597 ; jmp 0x8597
+
+loc_000085eb:
+mov eax, dword [ebp - 0x3f8]
+push ebx
+push ebx
+push 0x8000
+lea esi, [eax + 0xdd8]
+push esi
+call fcn_00018b14 ; call 0x18b14
+add esp, 0xc
+push dword [ebp + 0xc]
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+call fcn_000060c6 ; call 0x60c6
+add esp, 0x10
+test eax, eax
+jns near loc_00008e80 ; jns 0x8e80
+
+loc_00008620:
+cmp dword [ebp - 0x3f4], 0
+jne near loc_00008e5b ; jne 0x8e5b
+
+loc_0000862d:
+mov byte [ebp - 0x3f4], 0
+mov byte [ebp - 0x3ec], 0
+
+loc_0000863b:
+mov cl, byte [ebp - 0x3de]
+cmp byte [ebp - 0x3ec], cl
+jae near loc_00008786 ; jae 0x8786
+movzx ebx, byte [ebp - 0x3ec]
+mov edx, ebx
+shl edx, 5
+mov cl, byte [ebp + edx - 0x302]
+lea eax, [ebp + edx - 0x302]
+cmp dword [ebp + 0x14], 0
+mov byte [ebp - 0x3fc], cl
+mov cl, byte [eax + 1]
+mov byte [ebp - 0x400], cl
+mov cl, byte [eax + 2]
+mov byte [ebp - 0x408], cl
+movzx edx, cl
+je short loc_000086ab ; je 0x86ab
+mov esi, dword [ebp + 0x14]
+cmp byte [esi + 0x28], 0
+je near loc_00008f06 ; je 0x8f06
+mov eax, dword [eax + 7]
+mov edi, 1
+cmp dword [esi + edx*4 + 0x29], eax
+jne near loc_00008f08 ; jne 0x8f08
+xor esi, esi
+jmp short loc_000086b2 ; jmp 0x86b2
+
+loc_000086ab:
+mov esi, 1
+xor edi, edi
+
+loc_000086b2:
+mov dword [ebp - 0x410], edx
+call fcn_00015479 ; call 0x15479
+mov edx, dword [ebp - 0x410]
+test al, al
+je short loc_000086f8 ; je 0x86f8
+mov ecx, esi
+sub esp, 0xc
+movzx eax, byte [ebp - 0x400]
+movzx ecx, cl
+push ecx
+mov ecx, edi
+movzx ecx, cl
+push ecx
+movzx ecx, byte [ebp - 0x3fc]
+push edx
+push eax
+push ecx
+push edx
+push eax
+push ref_00021df9 ; push 0x21df9
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x30
+
+loc_000086f8:
+push eax
+movzx eax, byte [ebp - 0x408]
+push eax
+movzx eax, byte [ebp - 0x400]
+push eax
+movzx eax, byte [ebp - 0x3fc]
+push eax
+call fcn_0000241b ; call 0x241b
+mov eax, edi
+mov ecx, esi
+xor eax, 1
+add esp, 0x10
+or cl, al
+jne short loc_0000873e ; jne 0x873e
+cmp byte [ebp - 0x3d9], 0
+jne short loc_0000873e ; jne 0x873e
+mov eax, dword [ebp + 0xc]
+cmp byte [eax], 1
+jbe short loc_0000874d ; jbe 0x874d
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 0x48], 1
+jne short loc_0000874d ; jne 0x874d
+
+loc_0000873e:
+mov eax, ebx
+shl eax, 5
+mov byte [ebp + eax - 0x2e5], 1
+jmp short loc_0000875a ; jmp 0x875a
+
+loc_0000874d:
+mov eax, ebx
+shl eax, 5
+mov byte [ebp + eax - 0x2e5], 0
+
+loc_0000875a:
+shl ebx, 5
+lea eax, [ebp - 0x18]
+add ebx, eax
+cmp byte [ebx - 0x2df], 0
+jne short loc_00008774 ; jne 0x8774
+mov byte [ebx - 0x2cd], 0
+jmp short loc_0000877b ; jmp 0x877b
+
+loc_00008774:
+mov byte [ebp - 0x3f4], 1
+
+loc_0000877b:
+inc byte [ebp - 0x3ec]
+jmp near loc_0000863b ; jmp 0x863b
+
+loc_00008786:
+cmp byte [ebp - 0x3f4], 0
+je short loc_00008799 ; je 0x8799
+lea edx, [ebp - 0x302]
+xor eax, eax
+jmp short loc_000087bc ; jmp 0x87bc
+
+loc_00008799:
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_00009375 ; je 0x9375
+push ecx
+push ecx
+push ref_00021e44 ; push 0x21e44
+jmp near loc_00008e4c ; jmp 0x8e4c
+
+loc_000087b2:
+add edx, 0x20
+cmp byte [edx - 3], 1
+je short loc_000087cc ; je 0x87cc
+inc eax
+
+loc_000087bc:
+cmp al, cl
+jne short loc_000087b2 ; jne 0x87b2
+mov byte [ebp - 0x3ee], 0
+jmp near loc_0000896c ; jmp 0x896c
+
+loc_000087cc:
+push eax
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00008087 ; call 0x8087
+pop edx
+pop ecx
+push 0x2000
+mov dword [ebp - 0x3f4], eax
+mov eax, dword [ebp - 0x3f8]
+add eax, 0x444
+push eax
+mov dword [ebp - 0x410], eax
+call fcn_00018b14 ; call 0x18b14
+lea eax, [ebp - 0x2a2]
+add esp, 0x10
+mov dword [ebp - 0x3ec], eax
+movzx eax, byte [ebp - 0x3ed]
+mov byte [ebp - 0x408], 0
+mov dword [ebp - 0x414], eax
+movzx eax, word [ebp - 0x404]
+mov dword [ebp - 0x418], eax
+
+loc_0000882f:
+xor eax, eax
+
+loc_00008831:
+mov edi, dword [ebp - 0x3ec]
+mov dword [edi + eax + 1], 0
+add eax, 4
+cmp eax, 0x40
+jne short loc_00008831 ; jne 0x8831
+mov byte [ebp - 0x3fc], 0
+
+loc_0000884e:
+movzx eax, byte [ebp - 0x3de]
+cmp byte [ebp - 0x3fc], al
+jb near loc_00008f25 ; jb 0x8f25
+mov esi, dword [ebp - 0x3ec]
+push ebx
+push ebx
+lea edx, [esi + 1]
+push edx
+push 0
+push eax
+lea eax, [ebp - 0x302]
+push eax
+push dword [ebp - 0x3f4]
+push dword [ebp - 0x418]
+push dword [ebp + 0x10]
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00007ab6 ; call 0x7ab6
+add esp, 0x30
+test eax, eax
+js near loc_000091e4 ; js 0x91e4
+
+loc_0000889f:
+sub esp, 0xc
+push dword [ebp + 0xc]
+call fcn_000082aa ; call 0x82aa
+add esp, 0x10
+test al, al
+jne near loc_00009201 ; jne 0x9201
+
+loc_000088b5:
+inc byte [ebp - 0x408]
+mov al, byte [ebp - 0x3ee]
+add dword [ebp - 0x3ec], 0x41
+cmp byte [ebp - 0x408], al
+jb near loc_0000882f ; jb 0x882f
+push eax
+xor edi, edi
+push eax
+push 0xffffdfff
+push dword [ebp - 0x410]
+lea ebx, [ebp - 0x384]
+call fcn_00018b3e ; call 0x18b3e
+pop eax
+pop edx
+push dword [ebp - 0x3f4]
+push dword [ebp + 0xc]
+call fcn_00007fc2 ; call 0x7fc2
+add esp, 0x10
+lea edx, [ebp - 0x2a2]
+
+loc_00008907:
+lea eax, [ebp - 0x3c4]
+
+loc_0000890d:
+mov dword [eax], 0xffffffff
+add eax, 4
+cmp eax, ebx
+jne short loc_0000890d ; jne 0x890d
+xor eax, eax
+
+loc_0000891c:
+mov esi, dword [edx + eax*4 + 1]
+cmp esi, 0xffffffff
+je short loc_0000892c ; je 0x892c
+mov dword [ebp + eax*4 - 0x3c4], esi
+
+loc_0000892c:
+mov esi, dword [ebp + eax*4 - 0x3c4]
+cmp esi, dword [ebx + eax*4]
+jle short loc_00008944 ; jle 0x8944
+mov cl, byte [edx]
+mov dword [ebx + eax*4], esi
+mov byte [ebp + eax - 0x3d4], cl
+
+loc_00008944:
+inc eax
+cmp eax, 0x10
+jne short loc_0000891c ; jne 0x891c
+inc edi
+add edx, 0x41
+mov eax, edi
+cmp al, byte [ebp - 0x3ee]
+jb short loc_00008907 ; jb 0x8907
+cmp byte [ebp - 0x3df], 0
+jne near loc_00009278 ; jne 0x9278
+
+loc_00008965:
+mov byte [ebp - 0x3ee], 1
+
+loc_0000896c:
+mov byte [ebp - 0x3ec], 0
+
+loc_00008973:
+mov al, byte [ebp - 0x3ec]
+cmp al, byte [ebp - 0x3de]
+jae near loc_00008ac0 ; jae 0x8ac0
+movzx edi, byte [ebp - 0x3ec]
+mov eax, edi
+shl eax, 5
+lea ecx, [ebp + eax - 0x302]
+cmp byte [ecx + 0xb], 0
+mov al, byte [ecx + 2]
+je near loc_00008ab5 ; je 0x8ab5
+cmp byte [ebp - 0x3df], 0
+jne short loc_000089c0 ; jne 0x89c0
+
+loc_000089ae:
+shl edi, 5
+xor ebx, ebx
+lea eax, [ebp - 0x18]
+mov edx, edi
+lea edi, [eax + edi]
+jmp near loc_00008a68 ; jmp 0x8a68
+
+loc_000089c0:
+cmp al, 1
+je short loc_000089e0 ; je 0x89e0
+cmp al, 2
+je short loc_000089fc ; je 0x89fc
+mov bl, byte [ebp - 0x3ed]
+cmp bl, 1
+sbb esi, esi
+neg ebx
+and esi, 0xfffffff2
+and ebx, 0xe
+add esi, 0xf
+jmp short loc_00008a16 ; jmp 0x8a16
+
+loc_000089e0:
+mov al, byte [ebp - 0x3ed]
+cmp al, 1
+sbb esi, esi
+and esi, 2
+add esi, 7
+cmp al, 1
+sbb ebx, ebx
+and ebx, 2
+add ebx, 6
+jmp short loc_00008a16 ; jmp 0x8a16
+
+loc_000089fc:
+mov al, byte [ebp - 0x3ed]
+cmp al, 1
+sbb esi, esi
+and esi, 0xa
+add esi, 3
+cmp al, 1
+sbb ebx, ebx
+and ebx, 0xa
+add ebx, 2
+
+loc_00008a16:
+mov eax, edi
+shl eax, 5
+mov dword [ebp - 0x3f4], eax
+
+loc_00008a21:
+mov eax, esi
+cmp bl, al
+ja short loc_000089ae ; ja 0x89ae
+movzx ecx, bl
+sub esp, 0xc
+movzx eax, byte [ebp + ecx - 0x3d4]
+inc ebx
+mov dword [ebp - 0x3f8], ecx
+push eax
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+lea eax, [ebp - 0x302]
+add eax, dword [ebp - 0x3f4]
+push ecx
+push eax
+call fcn_000080f4 ; call 0x80f4
+mov ecx, dword [ebp - 0x3f8]
+add esp, 0x20
+mov byte [ebp + ecx - 0x3d4], al
+jmp short loc_00008a21 ; jmp 0x8a21
+
+loc_00008a68:
+cmp bl, byte [edi - 0x2ce]
+jae short loc_00008ab5 ; jae 0x8ab5
+movzx eax, bl
+sub esp, 0xc
+movzx esi, byte [eax + edi - 0x2de]
+inc ebx
+mov dword [ebp - 0x3f4], edx
+movzx eax, byte [ebp + esi - 0x3d4]
+push eax
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+lea eax, [ebp - 0x302]
+add eax, edx
+push esi
+push eax
+call fcn_000080f4 ; call 0x80f4
+add esp, 0x20
+mov edx, dword [ebp - 0x3f4]
+mov byte [ebp + esi - 0x3d4], al
+jmp short loc_00008a68 ; jmp 0x8a68
+
+loc_00008ab5:
+inc byte [ebp - 0x3ec]
+jmp near loc_00008973 ; jmp 0x8973
+
+loc_00008ac0:
+cmp byte [ebp - 0x3ee], 0
+je short loc_00008afc ; je 0x8afc
+xor ebx, ebx
+
+loc_00008acb:
+push ecx
+push ebx
+inc ebx
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+pop esi
+pop edi
+push 0x10
+add eax, 0xb0
+push eax
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+cmp ebx, 3
+jne short loc_00008acb ; jne 0x8acb
+sub esp, 0xc
+push dword [ebp + 0xc]
+call fcn_00006016 ; call 0x6016
+add esp, 0x10
+
+loc_00008afc:
+movzx eax, byte [ebp - 0x3ed]
+mov byte [ebp - 0x3ec], 0
+mov dword [ebp - 0x3f8], eax
+
+loc_00008b10:
+mov al, byte [ebp - 0x3ec]
+cmp al, byte [ebp - 0x3de]
+jae near loc_00008d8d ; jae 0x8d8d
+movzx eax, byte [ebp - 0x3ec]
+mov dword [ebp - 0x3fc], eax
+shl eax, 5
+lea edi, [ebp + eax - 0x302]
+movzx eax, byte [ebp + eax - 0x302]
+mov cl, byte [edi + 2]
+push edx
+movzx esi, cl
+push esi
+movzx ebx, byte [edi + 1]
+mov byte [ebp - 0x3ed], cl
+push ebx
+push eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0x10
+cmp byte [edi + 0xb], 0
+mov dword [ebp - 0x400], eax
+jne short loc_00008b89 ; jne 0x8b89
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_00008d82 ; je 0x8d82
+push esi
+push ebx
+push ref_00021eca ; push 0x21eca
+push 0x40
+call fcn_00015487 ; call 0x15487
+jmp near loc_00008d7f ; jmp 0x8d7f
+
+loc_00008b89:
+mov cl, byte [ebp - 0x3ed]
+cmp cl, 1
+je short loc_00008ba7 ; je 0x8ba7
+cmp cl, 2
+mov al, 0xd
+mov bl, 1
+mov dl, 0
+cmove ebx, eax
+mov al, 0xc
+cmove edx, eax
+jmp short loc_00008bab ; jmp 0x8bab
+
+loc_00008ba7:
+mov bl, 9
+mov dl, 8
+
+loc_00008bab:
+push eax
+push eax
+lea eax, [ebp - 0x3da]
+push eax
+movzx eax, dl
+push eax
+mov dword [ebp - 0x3f4], edx
+call fcn_0000937d ; call 0x937d
+add esp, 0x10
+mov edx, dword [ebp - 0x3f4]
+cmp byte [ebp - 0x3df], 0
+je short loc_00008be4 ; je 0x8be4
+movzx eax, byte [ebp - 0x3ed]
+mov dword [ebp - 0x404], eax
+jmp short loc_00008bff ; jmp 0x8bff
+
+loc_00008be4:
+mov eax, dword [ebp - 0x3fc]
+lea esi, [ebp - 0x18]
+xor edx, edx
+shl eax, 5
+add eax, esi
+mov dword [ebp - 0x3f4], eax
+jmp near loc_00008c93 ; jmp 0x8c93
+
+loc_00008bff:
+cmp dl, bl
+ja short loc_00008be4 ; ja 0x8be4
+push edi
+movzx esi, dl
+push edi
+push dword [ebp - 0x3f8]
+lea edi, [ebp - 0x3dd]
+mov dword [ebp - 0x40c], edx
+push esi
+call fcn_00006e54 ; call 0x6e54
+movzx ecx, byte [ebp - 0x3da]
+movzx eax, al
+movzx eax, byte [ebp + eax - 0x3d4]
+mov edx, eax
+lea eax, [ebp - 0x3db]
+mov dword [esp], eax
+lea eax, [ebp - 0x3dc]
+push eax
+push edi
+push ecx
+push edx
+mov dword [ebp - 0x3f4], edx
+mov dword [ebp - 0x408], eax
+call fcn_000093d9 ; call 0x93d9
+mov eax, dword [ebp - 0x408]
+add esp, 0x20
+lea ecx, [ebp - 0x3db]
+push ecx
+push eax
+push edi
+push esi
+call fcn_000094be ; call 0x94be
+push esi
+push dword [ebp - 0x404]
+push dword [ebp - 0x3f4]
+push 1
+call fcn_00002b0b ; call 0x2b0b
+mov edx, dword [ebp - 0x40c]
+add esp, 0x20
+inc edx
+jmp near loc_00008bff ; jmp 0x8bff
+
+loc_00008c93:
+mov eax, dword [ebp - 0x3f4]
+cmp dl, byte [eax - 0x2ce]
+jae near loc_00008d57 ; jae 0x8d57
+mov edi, dword [ebp - 0x3f4]
+movzx eax, dl
+push ecx
+push ecx
+push dword [ebp - 0x3f8]
+lea ebx, [eax + edi - 0x2ea]
+movzx eax, byte [ebx + 0xc]
+lea edi, [ebp - 0x3dc]
+mov dword [ebp - 0x404], edx
+lea esi, [ebp - 0x3dd]
+push eax
+call fcn_00006e54 ; call 0x6e54
+movzx ecx, byte [ebp - 0x3da]
+mov dword [ebp - 0x3fc], eax
+lea eax, [ebp - 0x3db]
+mov dword [esp], eax
+push edi
+push esi
+push ecx
+movzx ecx, byte [ebx + 0xc]
+movzx ecx, byte [ebp + ecx - 0x3d4]
+push ecx
+call fcn_000093d9 ; call 0x93d9
+mov eax, dword [ebp - 0x3fc]
+add esp, 0x20
+lea ecx, [ebp - 0x3db]
+push ecx
+push edi
+push esi
+movzx eax, al
+push eax
+mov dword [ebp - 0x3fc], eax
+call fcn_000094be ; call 0x94be
+mov eax, dword [ebp - 0x3fc]
+push eax
+movzx eax, byte [ebp - 0x3ed]
+push eax
+movzx eax, byte [ebx + 0xc]
+movzx eax, byte [ebp + eax - 0x3d4]
+push eax
+push 1
+call fcn_00002b0b ; call 0x2b0b
+mov edx, dword [ebp - 0x404]
+add esp, 0x20
+inc edx
+jmp near loc_00008c93 ; jmp 0x8c93
+
+loc_00008d57:
+mov edi, dword [ebp - 0x400]
+push esi
+push esi
+push 1
+mov eax, edi
+add eax, 0xd98
+push eax
+call fcn_00018b14 ; call 0x18b14
+pop eax
+mov eax, edi
+pop edx
+add eax, 0xb0
+push 0x20
+push eax
+call fcn_00018927 ; call 0x18927
+
+loc_00008d7f:
+add esp, 0x10
+
+loc_00008d82:
+inc byte [ebp - 0x3ec]
+jmp near loc_00008b10 ; jmp 0x8b10
+
+loc_00008d8d:
+cmp byte [ebp - 0x3ee], 0
+je short loc_00008dde ; je 0x8dde
+push ebx
+mov eax, dword [ebp + 0x10]
+xor ebx, ebx
+push 0x64
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+call dword [eax + 4] ; ucall
+add esp, 0x10
+
+loc_00008daa:
+push edi
+push ebx
+inc ebx
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+push 0xffef
+add eax, 0xb0
+push eax
+call fcn_00018954 ; call 0x18954
+add esp, 0x10
+cmp ebx, 3
+jne short loc_00008daa ; jne 0x8daa
+sub esp, 0xc
+push dword [ebp + 0xc]
+call fcn_0000606a ; call 0x606a
+add esp, 0x10
+
+loc_00008dde:
+xor edx, edx
+
+loc_00008de0:
+cmp dl, byte [ebp - 0x3de]
+jae short loc_00008e38 ; jae 0x8e38
+movzx eax, dl
+shl eax, 5
+lea ecx, [ebp + eax - 0x302]
+movzx ebx, byte [ebp + eax - 0x302]
+movzx esi, byte [ecx + 1]
+movzx edi, byte [ecx + 2]
+lea ecx, [ebp - 0x302]
+push 0
+add eax, ecx
+push eax
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+mov dword [ebp - 0x3ec], edx
+call fcn_00005d50 ; call 0x5d50
+add esp, 0xc
+push edi
+push esi
+push ebx
+call fcn_0000241b ; call 0x241b
+mov edx, dword [ebp - 0x3ec]
+add esp, 0x10
+inc edx
+jmp short loc_00008de0 ; jmp 0x8de0
+
+loc_00008e38:
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_00009375 ; je 0x9375
+push esi
+push esi
+push ref_00021f05 ; push 0x21f05
+
+loc_00008e4c:
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp near loc_00009375 ; jmp 0x9375
+
+loc_00008e5b:
+cmp dword [ebp - 0x3ec], 0x40670
+jne near loc_0000862d ; jne 0x862d
+push eax
+push eax
+push 0xffff7fff
+push esi
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+jmp near loc_0000862d ; jmp 0x862d
+
+loc_00008e80:
+xor ebx, ebx
+
+loc_00008e82:
+cmp bl, byte [ebp - 0x3de]
+jae near loc_00008620 ; jae 0x8620
+movzx eax, bl
+shl eax, 5
+lea edx, [ebp + eax - 0x302]
+mov al, byte [ebp + eax - 0x302]
+movzx ecx, byte [edx + 2]
+movzx edx, byte [edx + 1]
+mov byte [ebp - 0x3fc], al
+
+loc_00008eb0:
+movzx edi, byte [ebp - 0x3fc]
+push eax
+push ecx
+push edx
+push edi
+mov dword [ebp - 0x408], ecx
+mov dword [ebp - 0x400], edx
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xd2
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+mov edx, dword [ebp - 0x400]
+mov ecx, dword [ebp - 0x408]
+test al, 2
+je short loc_00008eb0 ; je 0x8eb0
+sub esp, 0xc
+inc ebx
+push ecx
+push edx
+push edi
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+call fcn_0000254f ; call 0x254f
+add esp, 0x20
+jmp near loc_00008e82 ; jmp 0x8e82
+
+loc_00008f06:
+xor edi, edi
+
+loc_00008f08:
+mov eax, ebx
+mov esi, dword [ebp + 0x14]
+shl eax, 5
+mov eax, dword [ebp + eax - 0x2fb]
+mov dword [esi + edx*4 + 0x29], eax
+mov esi, 1
+jmp near loc_000086b2 ; jmp 0x86b2
+
+loc_00008f25:
+movzx eax, byte [ebp - 0x3fc]
+lea edi, [ebp - 0x18]
+mov dword [ebp - 0x400], eax
+shl eax, 5
+add edi, eax
+mov cl, byte [edi - 0x2e8]
+sub edi, 0x2ea
+mov byte [edi + 0x1e], 0
+movzx eax, byte [ebp + eax - 0x302]
+push edx
+movzx esi, cl
+push esi
+movzx ebx, byte [edi + 1]
+mov byte [ebp - 0x3f8], cl
+push ebx
+push eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0x10
+cmp byte [edi + 0xb], 0
+mov dword [ebp - 0x404], eax
+jne short loc_00008f9a ; jne 0x8f9a
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_000091d9 ; je 0x91d9
+push esi
+push ebx
+push ref_00021e74 ; push 0x21e74
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp near loc_000091d9 ; jmp 0x91d9
+
+loc_00008f9a:
+mov cl, byte [ebp - 0x3f8]
+cmp cl, 1
+je short loc_00008fbb ; je 0x8fbb
+cmp cl, 2
+mov al, 0xd
+mov esi, 1
+mov bl, 0
+cmove esi, eax
+mov al, 0xc
+cmove ebx, eax
+jmp short loc_00008fc2 ; jmp 0x8fc2
+
+loc_00008fbb:
+mov esi, 9
+mov bl, 8
+
+loc_00008fc2:
+push edi
+push edi
+lea eax, [ebp - 0x3da]
+push eax
+movzx eax, bl
+push eax
+call fcn_0000937d ; call 0x937d
+lea edi, [ebp - 0x3db]
+lea eax, [ebp - 0x3dc]
+mov dword [esp], edi
+push eax
+lea eax, [ebp - 0x3dd]
+push eax
+movzx eax, byte [ebp - 0x3da]
+push eax
+mov eax, dword [ebp - 0x3ec]
+movzx eax, byte [eax]
+push eax
+call fcn_000093d9 ; call 0x93d9
+add esp, 0x20
+cmp byte [ebp - 0x3df], 0
+je short loc_00009019 ; je 0x9019
+mov edx, edi
+movzx edi, byte [ebp - 0x3f8]
+jmp short loc_0000902c ; jmp 0x902c
+
+loc_00009019:
+mov esi, dword [ebp - 0x400]
+lea eax, [ebp - 0x18]
+xor edx, edx
+shl esi, 5
+lea edi, [eax + esi]
+jmp short loc_0000907b ; jmp 0x907b
+
+loc_0000902c:
+mov eax, esi
+cmp bl, al
+ja short loc_00009019 ; ja 0x9019
+push edx
+movzx eax, bl
+lea ecx, [ebp - 0x3dc]
+inc ebx
+push ecx
+lea ecx, [ebp - 0x3dd]
+push ecx
+push eax
+mov dword [ebp - 0x420], edx
+mov dword [ebp - 0x41c], eax
+call fcn_000094be ; call 0x94be
+mov eax, dword [ebp - 0x41c]
+push eax
+mov eax, dword [ebp - 0x3ec]
+push edi
+movzx eax, byte [eax]
+push eax
+push 1
+call fcn_00002b0b ; call 0x2b0b
+add esp, 0x20
+mov edx, dword [ebp - 0x420]
+jmp short loc_0000902c ; jmp 0x902c
+
+loc_0000907b:
+lea ebx, [edi - 0x2da]
+cmp dl, byte [edi - 0x2ce]
+jae short loc_000090ef ; jae 0x90ef
+push ebx
+movzx eax, dl
+push ebx
+push dword [ebp - 0x414]
+movzx eax, byte [eax + edi - 0x2de]
+mov dword [ebp - 0x41c], edx
+push eax
+call fcn_00006e54 ; call 0x6e54
+movzx ebx, al
+lea eax, [ebp - 0x3db]
+push eax
+lea eax, [ebp - 0x3dc]
+push eax
+lea eax, [ebp - 0x3dd]
+push eax
+push ebx
+call fcn_000094be ; call 0x94be
+movzx eax, byte [ebp - 0x3f8]
+add esp, 0x20
+push ebx
+push eax
+mov eax, dword [ebp - 0x3ec]
+movzx eax, byte [eax]
+push eax
+push 1
+call fcn_00002b0b ; call 0x2b0b
+mov edx, dword [ebp - 0x41c]
+add esp, 0x10
+inc edx
+jmp short loc_0000907b ; jmp 0x907b
+
+loc_000090ef:
+mov eax, dword [ebp - 0x404]
+lea edi, [ebp + esi - 0x302]
+push ecx
+push ecx
+push 1
+add eax, 0xd98
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0xc
+push edi
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+call fcn_00006437 ; call 0x6437
+mov eax, dword [ebp - 0x404]
+lea esi, [eax + 0xb2]
+mov dword [esp], esi
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+and eax, 0xf
+cmp ax, 3
+je short loc_00009179 ; je 0x9179
+sub esp, 0xc
+push edi
+call fcn_0000649b ; call 0x649b
+add esp, 0xc
+movzx eax, al
+push eax
+push 3
+push edi
+push dword [ebp + 0x10]
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_0000661e ; call 0x661e
+add esp, 0x14
+push esi
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+and eax, 0xf
+cmp ax, 3
+je short loc_00009179 ; je 0x9179
+mov byte [ebx + 0xe], 1
+jmp short loc_000091d9 ; jmp 0x91d9
+
+loc_00009179:
+movzx esi, byte [ebp - 0x3f8]
+push edi
+push edi
+mov edi, dword [ebp - 0x3f4]
+push esi
+push edi
+call fcn_00007c07 ; call 0x7c07
+add esp, 0xc
+mov ebx, eax
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+movzx eax, word [eax + 0x3c]
+push eax
+mov eax, dword [ebp + 0x10]
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+call dword [eax + 4] ; ucall
+pop eax
+pop edx
+push esi
+push edi
+call fcn_00007c07 ; call 0x7c07
+add esp, 0x10
+cmp eax, ebx
+mov eax, dword [ebp - 0x400]
+je short loc_000091ce ; je 0x91ce
+shl eax, 5
+mov byte [ebp + eax - 0x2e4], 1
+jmp short loc_000091d9 ; jmp 0x91d9
+
+loc_000091ce:
+shl eax, 5
+mov byte [ebp + eax - 0x2e3], 1
+
+loc_000091d9:
+inc byte [ebp - 0x3fc]
+jmp near loc_0000884e ; jmp 0x884e
+
+loc_000091e4:
+xor eax, eax
+
+loc_000091e6:
+mov edi, dword [ebp - 0x3ec]
+mov dword [edi + eax + 1], 0
+add eax, 4
+cmp eax, 0x40
+jne short loc_000091e6 ; jne 0x91e6
+jmp near loc_0000889f ; jmp 0x889f
+
+loc_00009201:
+push ecx
+push ecx
+lea eax, [ebp - 0x344]
+push eax
+movzx eax, byte [ebp - 0x3de]
+push 2
+push eax
+lea eax, [ebp - 0x302]
+push eax
+movzx eax, word [ebp - 0x40c]
+push dword [ebp - 0x3f4]
+push eax
+push dword [ebp + 0x10]
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00007ab6 ; call 0x7ab6
+add esp, 0x30
+test eax, eax
+js near loc_000088b5 ; js 0x88b5
+xor eax, eax
+
+loc_00009247:
+mov edx, dword [ebp + eax - 0x344]
+cmp edx, 0xffffffff
+je short loc_0000926b ; je 0x926b
+mov esi, dword [ebp - 0x3ec]
+mov ecx, dword [esi + eax + 1]
+cmp ecx, 0x18f
+jle short loc_0000926b ; jle 0x926b
+add edx, ecx
+mov dword [esi + eax + 1], edx
+
+loc_0000926b:
+add eax, 4
+cmp eax, 0x40
+jne short loc_00009247 ; jne 0x9247
+jmp near loc_000088b5 ; jmp 0x88b5
+
+loc_00009278:
+mov byte [ebp - 0x3ec], 0
+
+loc_0000927f:
+mov al, byte [ebp - 0x3ec]
+cmp al, byte [ebp - 0x3de]
+jae near loc_00008965 ; jae 0x8965
+movzx eax, byte [ebp - 0x3ec]
+shl eax, 5
+mov al, byte [ebp + eax - 0x300]
+cmp al, 1
+je short loc_000092cd ; je 0x92cd
+cmp al, 2
+mov al, byte [ebp - 0x3ed]
+je short loc_000092f3 ; je 0x92f3
+cmp al, 1
+mov bl, al
+sbb edi, edi
+neg ebx
+and edi, 0xfffffff2
+and ebx, 0xe
+add edi, 0xf
+cmp al, 1
+sbb edx, edx
+and edx, 0xfffffff5
+add edx, 0xd
+jmp short loc_0000930f ; jmp 0x930f
+
+loc_000092cd:
+mov al, byte [ebp - 0x3ed]
+cmp al, 1
+sbb edi, edi
+and edi, 2
+add edi, 7
+cmp al, 1
+sbb ebx, ebx
+and ebx, 2
+add ebx, 6
+cmp al, 1
+sbb edx, edx
+and edx, 5
+add edx, 5
+jmp short loc_0000930f ; jmp 0x930f
+
+loc_000092f3:
+cmp al, 1
+sbb edi, edi
+and edi, 0xa
+add edi, 3
+cmp al, 1
+sbb ebx, ebx
+and ebx, 0xa
+add ebx, 2
+cmp al, 1
+sbb edx, edx
+and edx, 0xd
+inc edx
+
+loc_0000930f:
+movzx esi, dl
+cmp dword [ebp + esi*4 - 0x384], 0xffffffff
+je short loc_0000936a ; je 0x936a
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00009342 ; je 0x9342
+mov eax, edi
+sub esp, 0xc
+movzx eax, al
+push eax
+movzx eax, bl
+push eax
+push esi
+push ref_00021e99 ; push 0x21e99
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_00009342:
+mov eax, edi
+cmp bl, al
+ja short loc_0000936a ; ja 0x936a
+mov ecx, dword [ebp + esi*4 - 0x384]
+movzx eax, bl
+inc ebx
+mov dword [ebp + eax*4 - 0x384], ecx
+mov cl, byte [ebp + esi - 0x3d4]
+mov byte [ebp + eax - 0x3d4], cl
+jmp short loc_00009342 ; jmp 0x9342
+
+loc_0000936a:
+inc byte [ebp - 0x3ec]
+jmp near loc_0000927f ; jmp 0x927f
+
+loc_00009375:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000937d:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+lea ebx, [eax + 0x814]
+mov eax, esi
+movzx edx, al
+shl edx, 0x13
+or edx, 0x2840000
+push edx
+push ebx
+call fcn_00017e8f ; call 0x17e8f
+mov dword [esp], ebx
+call fcn_00017e4e ; call 0x17e4e
+mov esi, eax
+pop eax
+pop edx
+shr esi, 6
+push 0
+push ebx
+call fcn_00017e8f ; call 0x17e8f
+mov eax, dword [ebp + 0xc]
+mov edx, esi
+and edx, 0x3f
+add esp, 0x10
+mov byte [eax], dl
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_000093d9:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+cmp bl, 9
+ja short loc_00009425 ; ja 0x9425
+movzx ebx, bl
+jmp dword [ebx*4 + ref_000203d0] ; ujmp: jmp dword [ebx*4 + 0x203d0]
+
+loc_000093fa:
+mov ecx, 0xffffff38
+jmp near loc_000094ba ; jmp 0x94ba
+
+loc_00009404:
+mov ecx, 0xffffff83
+jmp near loc_000094ba ; jmp 0x94ba
+
+loc_0000940e:
+xor ecx, ecx
+jmp near loc_000094ba ; jmp 0x94ba
+
+loc_00009415:
+mov ecx, 0xffffff83
+jmp short loc_0000944a ; jmp 0x944a
+
+loc_0000941c:
+xor ecx, ecx
+mov eax, 0xffffff5a
+jmp short loc_0000945b ; jmp 0x945b
+
+loc_00009425:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00009451 ; je 0x9451
+movzx ebx, bl
+push eax
+push ebx
+push ref_00021f23 ; push 0x21f23
+push 2
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp short loc_00009451 ; jmp 0x9451
+
+loc_00009444:
+xor ecx, ecx
+jmp short loc_00009456 ; jmp 0x9456
+
+loc_00009448:
+xor ecx, ecx
+
+loc_0000944a:
+mov eax, 0xffffff83
+jmp short loc_0000945b ; jmp 0x945b
+
+loc_00009451:
+mov ecx, 0xffffff38
+
+loc_00009456:
+mov eax, 0xffffff9c
+
+loc_0000945b:
+neg eax
+
+loc_0000945d:
+mov ebx, ecx
+mov edx, esi
+movzx edx, dl
+neg ebx
+test ecx, ecx
+cmove ebx, ecx
+mov ecx, 0x3e8
+imul eax, edx
+imul ebx, edx
+cdq
+idiv ecx
+cmp edx, 0x1f4
+setge dl
+add eax, edx
+mov byte [edi], al
+mov eax, ebx
+cdq
+idiv ecx
+cmp edx, 0x1f4
+mov edx, esi
+setge bl
+add ebx, eax
+mov eax, dword [ebp + 0x18]
+mov byte [eax], bl
+mov eax, dword [ebp + 0x14]
+sub dl, byte [edi]
+sub edx, ebx
+mov byte [eax], dl
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+loc_000094ae:
+mov ecx, 0xffffff06
+jmp short loc_000094ba ; jmp 0x94ba
+
+loc_000094b5:
+mov ecx, 0xffffff59
+
+loc_000094ba:
+xor eax, eax
+jmp short loc_0000945d ; jmp 0x945d
+
+fcn_000094be:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x14]
+push esi
+push ebx
+movzx ebx, byte [eax]
+mov eax, dword [ebp + 0xc]
+or ebx, 0x40000
+movzx eax, byte [eax]
+shl eax, 6
+or ebx, eax
+mov eax, dword [ebp + 0x10]
+movzx eax, byte [eax]
+shl eax, 0xc
+or ebx, eax
+movzx eax, byte [ebp + 8]
+shl eax, 0x13
+or ebx, eax
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+push ebx
+lea esi, [eax + 0x814]
+push esi
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+mov dword [ebp + 8], esi
+mov dword [ebp + 0xc], 0
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00017e8f ; jmp 0x17e8f
+
+fcn_00009521:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov bl, byte [ebp + 8]
+push ecx
+push 0
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov edx, esi
+add esp, 0x10
+shr bl, 1
+test dl, dl
+movzx ebx, bl
+je short loc_00009565 ; je 0x9565
+push edx
+push 6
+shl ebx, 5
+push 0xfffffffffffffff9
+lea eax, [eax + ebx + 0x900]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+loc_00009565:
+shl ebx, 5
+lea eax, [eax + ebx + 0x900]
+mov dword [ebp + 0xc], 0xfffffff9
+mov dword [ebp + 8], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00018b3e ; jmp 0x18b3e
+
+fcn_00009584:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_0001c651 ; call 0x1c651
+cmp eax, 0x40660
+je short loc_0000961a ; je 0x961a
+cmp eax, 0x306c0
+je short loc_0000961a ; je 0x961a
+cmp eax, 0x40670
+je short loc_000095c2 ; je 0x95c2
+
+loc_000095a9:
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_00009685 ; je 0x9685
+mov dword [ebp + 0xc], ref_00021f6e ; mov dword [ebp + 0xc], 0x21f6e
+jmp near loc_00009673 ; jmp 0x9673
+
+loc_000095c2:
+push edx
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+je short loc_000095a9 ; je 0x95a9
+
+loc_000095e0:
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov edx, ebx
+add esp, 0xc
+and edx, 1
+shl edx, 0x1e
+shr bl, 1
+or edx, 0x80000000
+movzx ebx, bl
+push edx
+shl ebx, 5
+push 0x3fffffff
+lea eax, [eax + ebx + 0x80c]
+push eax
+call fcn_00018b68 ; call 0x18b68
+jmp short loc_0000965e ; jmp 0x965e
+
+loc_0000961a:
+cmp eax, 0x40670
+je short loc_000095e0 ; je 0x95e0
+cmp eax, 0x40660
+je short loc_0000962f ; je 0x962f
+cmp eax, 0x306c0
+jne short loc_00009663 ; jne 0x9663
+
+loc_0000962f:
+push 0x1000c
+movzx ebx, bl
+push 0
+push 2
+push esi
+call fcn_000040eb ; call 0x40eb
+push 0
+push ebx
+push 0x1011
+push esi
+call fcn_000040eb ; call 0x40eb
+add esp, 0x20
+push 0
+push 0
+push 3
+push esi
+call fcn_000040eb ; call 0x40eb
+
+loc_0000965e:
+add esp, 0x10
+jmp short loc_00009685 ; jmp 0x9685
+
+loc_00009663:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00009685 ; je 0x9685
+mov dword [ebp + 0xc], ref_00021fa1 ; mov dword [ebp + 0xc], 0x21fa1
+
+loc_00009673:
+mov dword [ebp + 8], 2
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00015487 ; jmp 0x15487
+
+loc_00009685:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000968c:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+call fcn_0001c651 ; call 0x1c651
+mov ebx, eax
+call fcn_0001c678 ; call 0x1c678
+cmp ebx, 0x40670
+je short loc_000096ac ; je 0x96ac
+
+loc_000096a8:
+xor edx, edx
+jmp short loc_00009717 ; jmp 0x9717
+
+loc_000096ac:
+mov edx, 0x80000003
+test eax, eax
+je short loc_00009717 ; je 0x9717
+mov eax, esi
+xor ebx, ebx
+test al, al
+je short loc_000096ea ; je 0x96ea
+
+loc_000096bd:
+push esi
+push 0
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+push 0x10
+lea eax, [eax + ebx + 0x90c]
+add ebx, 0x20
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+cmp ebx, 0x100
+jne short loc_000096bd ; jne 0x96bd
+jmp short loc_000096a8 ; jmp 0x96a8
+
+loc_000096ea:
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+push 0xffffffffffffffef
+lea eax, [eax + ebx + 0x90c]
+add ebx, 0x20
+push eax
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+cmp ebx, 0x100
+jne short loc_000096ea ; jne 0x96ea
+jmp short loc_000096a8 ; jmp 0x96a8
+
+loc_00009717:
+lea esp, [ebp - 8]
+mov eax, edx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00009720:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0xc]
+push esi
+movzx esi, byte [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0x14]
+sub esp, 0xc
+shl eax, 6
+or eax, dword [ebp + 0x10]
+shl ebx, 6
+or ebx, dword [ebp + 0x18]
+push eax
+push 0x31
+push esi
+push 1
+push 0
+call fcn_000029e2 ; call 0x29e2
+add esp, 0x20
+mov dword [ebp + 0x18], ebx
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0x14], 0x32
+mov dword [ebp + 0xc], 1
+mov dword [ebp + 8], 0
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_000029e2 ; jmp 0x29e2
+
+fcn_00009774:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+movzx ebx, byte [ebp + 8]
+push 0x31
+push ebx
+push 1
+push 0
+call fcn_00002a60 ; call 0x2a60
+mov edx, dword [ebp + 0x10]
+mov ecx, eax
+and ecx, 0x3f
+mov dword [edx], ecx
+mov edx, dword [ebp + 0xc]
+shr eax, 6
+and eax, 3
+mov dword [edx], eax
+push 0x32
+push ebx
+push 1
+push 0
+call fcn_00002a60 ; call 0x2a60
+mov edx, dword [ebp + 0x18]
+add esp, 0x20
+mov ecx, eax
+and ecx, 0x3f
+mov dword [edx], ecx
+mov edx, dword [ebp + 0x14]
+shr eax, 6
+and eax, 3
+mov dword [edx], eax
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000097c7:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 8
+mov ecx, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov edx, dword [ebp + 0x14]
+cmp ecx, 0x20
+jne short loc_000097ec ; jne 0x97ec
+mov dword [ebx], 0
+mov dword [edx], 0x20
+jmp short loc_0000983f ; jmp 0x983f
+
+loc_000097ec:
+mov eax, 0
+jbe short loc_00009810 ; jbe 0x9810
+lea esi, [ecx - 0x20]
+
+loc_000097f6:
+mov ecx, dword [ebp + 8]
+mov edi, esi
+sub ecx, eax
+shl edi, cl
+mov ecx, edi
+add ecx, 0x20
+lea edi, [eax + 1]
+cmp ecx, 0x3f
+jle short loc_0000983b ; jle 0x983b
+mov eax, edi
+jmp short loc_000097f6 ; jmp 0x97f6
+
+loc_00009810:
+mov esi, 0x20
+mov edi, esi
+sub edi, ecx
+mov dword [ebp - 0x14], edi
+
+loc_0000981c:
+mov ecx, dword [ebp + 8]
+mov edi, dword [ebp - 0x14]
+sub ecx, eax
+shl edi, cl
+mov ecx, edi
+lea edi, [eax + 1]
+mov dword [ebp - 0x10], edi
+mov edi, esi
+sub edi, ecx
+mov ecx, edi
+jns short loc_0000983b ; jns 0x983b
+mov eax, dword [ebp - 0x10]
+jmp short loc_0000981c ; jmp 0x981c
+
+loc_0000983b:
+mov dword [ebx], eax
+mov dword [edx], ecx
+
+loc_0000983f:
+pop eax
+pop edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00009846:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 0xc]
+lea eax, [ebp - 8]
+push eax
+lea eax, [ebp - 0xc]
+push eax
+push ebx
+push dword [ebp + 8]
+call fcn_000097c7 ; call 0x97c7
+add esp, 0x10
+cmp ebx, 0x20
+jbe short loc_00009889 ; jbe 0x9889
+mov eax, dword [ebp - 0xc]
+test eax, eax
+jne short loc_00009878 ; jne 0x9878
+
+loc_00009870:
+mov eax, dword [ebp - 8]
+sub eax, 0x20
+jmp short loc_000098a0 ; jmp 0x98a0
+
+loc_00009878:
+mov edx, dword [ebp - 8]
+add eax, 0xfffffff
+shl eax, 4
+lea eax, [edx + eax - 0x10]
+jmp short loc_000098a0 ; jmp 0x98a0
+
+loc_00009889:
+je short loc_0000989e ; je 0x989e
+mov eax, dword [ebp - 0xc]
+test eax, eax
+je short loc_00009870 ; je 0x9870
+imul eax, eax, 0xffffffef
+mov edx, dword [ebp - 8]
+lea eax, [edx + eax - 0x20]
+jmp short loc_000098a0 ; jmp 0x98a0
+
+loc_0000989e:
+xor eax, eax
+
+loc_000098a0:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000098a5:
+push ebp
+mov eax, 0x80000002
+mov ebp, esp
+mov edx, dword [ebp + 8]
+push esi
+push ebx
+lea ecx, [edx + 0x53]
+cmp ecx, 0xa2
+ja near loc_00009964 ; ja 0x9964
+cmp edx, 0
+je near loc_00009951 ; je 0x9951
+lea eax, [edx + 0x20]
+mov ebx, 0
+mov edx, eax
+jle short loc_0000991f ; jle 0x991f
+
+loc_000098d6:
+test ebx, ebx
+jne short loc_000098e3 ; jne 0x98e3
+mov esi, edx
+cmp edx, 0x3f
+jg short loc_00009905 ; jg 0x9905
+jmp short loc_00009958 ; jmp 0x9958
+
+loc_000098e3:
+mov esi, eax
+cmp eax, 0x3f
+jg short loc_00009905 ; jg 0x9905
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00009958 ; je 0x9958
+cmp esi, 0x2e
+jg short loc_00009958 ; jg 0x9958
+push edx
+push ref_00021fbc ; push 0x21fbc
+push 0x1ad
+jmp short loc_00009942 ; jmp 0x9942
+
+loc_00009905:
+inc ebx
+sub eax, 0x10
+cmp ebx, 4
+jne short loc_000098d6 ; jne 0x98d6
+jmp short loc_00009958 ; jmp 0x9958
+
+loc_00009910:
+mov esi, edx
+test edx, edx
+jns short loc_00009958 ; jns 0x9958
+
+loc_00009916:
+inc ebx
+add eax, 0x11
+cmp ebx, 4
+je short loc_00009958 ; je 0x9958
+
+loc_0000991f:
+test ebx, ebx
+je short loc_00009910 ; je 0x9910
+mov esi, eax
+test eax, eax
+js short loc_00009916 ; js 0x9916
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00009958 ; je 0x9958
+cmp esi, 0x11
+jle short loc_00009958 ; jle 0x9958
+push eax
+push ref_00022007 ; push 0x22007
+push 0x1bc
+
+loc_00009942:
+push ref_00021fcc ; push 0x21fcc
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+jmp short loc_00009958 ; jmp 0x9958
+
+loc_00009951:
+mov esi, 0x20
+xor ebx, ebx
+
+loc_00009958:
+mov eax, dword [ebp + 0xc]
+mov dword [eax], ebx
+mov eax, dword [ebp + 0x10]
+mov dword [eax], esi
+xor eax, eax
+
+loc_00009964:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000996b:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x2c
+mov eax, dword [ebp + 8]
+lea edx, [ebp - 0xc]
+mov ebx, dword [ebp + 0xc]
+push edx
+lea edx, [ebp - 0x10]
+push edx
+lea edx, [ebp - 0x14]
+push edx
+lea edx, [ebp - 0x18]
+push edx
+movzx edx, al
+push edx
+mov dword [ebp - 0x1c], eax
+call fcn_00009774 ; call 0x9774
+mov eax, dword [ebp - 0x1c]
+add esp, 0x18
+mov edx, dword [ebp - 0x14]
+mov byte [ebx], al
+mov eax, dword [ebp - 0x18]
+mov dword [ebx + 5], edx
+mov dword [ebx + 1], eax
+push edx
+push eax
+call fcn_00009846 ; call 0x9846
+mov edx, dword [ebp - 0xc]
+mov dword [ebx + 0x11], edx
+mov dword [ebx + 9], eax
+mov eax, dword [ebp - 0x10]
+mov dword [ebx + 0xd], eax
+pop ecx
+pop esi
+push edx
+push eax
+call fcn_00009846 ; call 0x9846
+mov edx, dword [ebx + 9]
+mov ecx, 0x4f
+mov esi, ecx
+add esp, 0x10
+sub esi, edx
+sub ecx, eax
+cmp esi, ecx
+cmovle ecx, esi
+mov dword [ebx + 0x19], ecx
+mov ecx, 0xffffffad
+mov esi, ecx
+sub ecx, eax
+sub esi, edx
+mov dword [ebx + 0x15], eax
+cmp esi, ecx
+mov eax, ecx
+cmovge eax, esi
+mov dword [ebx + 0x1d], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00009a00:
+push ebp
+mov ebp, esp
+sub esp, 0x14
+mov eax, dword [ebp + 8]
+push dword [eax + 0x11]
+push dword [eax + 0xd]
+push dword [eax + 5]
+push dword [eax + 1]
+movzx eax, byte [eax]
+push eax
+call fcn_00009720 ; call 0x9720
+add esp, 0x20
+leave
+ret
+
+fcn_00009a23:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x14
+mov ebx, dword [ebp + 0xc]
+lea eax, [ebp - 0x14]
+mov esi, dword [ebp + 8]
+push eax
+lea eax, [ebp - 0x18]
+push eax
+mov eax, dword [ebx + 9]
+add eax, esi
+push eax
+call fcn_000098a5 ; call 0x98a5
+add esp, 0x10
+test eax, eax
+js short loc_00009a81 ; js 0x9a81
+push eax
+lea eax, [ebp - 0xc]
+push eax
+lea eax, [ebp - 0x10]
+push eax
+add esi, dword [ebx + 0x15]
+push esi
+call fcn_000098a5 ; call 0x98a5
+add esp, 0x10
+test eax, eax
+js short loc_00009a81 ; js 0x9a81
+sub esp, 0xc
+push dword [ebp - 0xc]
+push dword [ebp - 0x10]
+push dword [ebp - 0x14]
+push dword [ebp - 0x18]
+movzx eax, byte [ebx]
+push eax
+call fcn_00009720 ; call 0x9720
+add esp, 0x20
+xor eax, eax
+
+loc_00009a81:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00009a88:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 1
+mov edx, dword [ebp + 0x14]
+mov al, byte [ebp + 0xc]
+mov esi, dword [ebp + 8]
+mov byte [edx], 0
+mov byte [ebp - 0xd], al
+
+loc_00009aa0:
+mov eax, esi
+sub eax, dword [ebp + 8]
+cmp al, byte [ebp - 0xd]
+jae short loc_00009ad0 ; jae 0x9ad0
+mov al, byte [esi]
+xor edi, edi
+movzx ecx, byte [edx]
+shr al, 1
+
+loc_00009ab3:
+mov ebx, edi
+cmp cl, bl
+jbe short loc_00009ac5 ; jbe 0x9ac5
+mov ebx, dword [ebp + 0x10]
+inc edi
+cmp byte [ebx + edi - 1], al
+jne short loc_00009ab3 ; jne 0x9ab3
+jmp short loc_00009acd ; jmp 0x9acd
+
+loc_00009ac5:
+mov ebx, dword [ebp + 0x10]
+mov byte [ebx + ecx], al
+inc byte [edx]
+
+loc_00009acd:
+inc esi
+jmp short loc_00009aa0 ; jmp 0x9aa0
+
+loc_00009ad0:
+add esp, 1
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00009ada:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x3c
+mov eax, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+lea edx, [ebp - 0x21]
+push edx
+mov ebx, dword [ebp + 0x14]
+lea edx, [ebp - 0x20]
+mov esi, dword [ebp + 0x18]
+push edx
+mov byte [ebp - 0x29], al
+movzx eax, al
+push eax
+push dword [ebp + 8]
+mov dword [ebp - 0x34], edi
+mov edi, dword [ebp + 0x1c]
+mov dword [ebp - 0x38], ebx
+mov byte [ebp - 0x21], 0
+mov dword [ebp - 0x3c], edi
+call fcn_00009a88 ; call 0x9a88
+add esp, 0xc
+push 0
+push 1
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov edx, dword [ebp + 8]
+add esp, 0x10
+mov ebx, eax
+lea edi, [eax + 0xa00]
+
+loc_00009b32:
+mov al, byte [ebp + 8]
+mov byte [ebp - 0x30], al
+mov al, dl
+sub eax, dword [ebp + 8]
+cmp al, byte [ebp - 0x29]
+jae short loc_00009b63 ; jae 0x9b63
+push ecx
+push ecx
+push 0xfffffbff
+movzx eax, byte [edx]
+mov dword [ebp - 0x30], edx
+shl eax, 4
+add eax, edi
+push eax
+call fcn_00018b3e ; call 0x18b3e
+mov edx, dword [ebp - 0x30]
+add esp, 0x10
+inc edx
+jmp short loc_00009b32 ; jmp 0x9b32
+
+loc_00009b63:
+movzx eax, byte [ebp - 0x34]
+shl esi, 0x1c
+xor edx, edx
+movzx edi, byte [ebp - 0x38]
+shl eax, 0xa
+or esi, eax
+shl edi, 0xb
+
+loc_00009b78:
+cmp dl, byte [ebp - 0x21]
+jae short loc_00009bc4 ; jae 0x9bc4
+movzx eax, dl
+movzx ecx, byte [ebp + eax - 0x20]
+mov dword [ebp - 0x38], edx
+push edx
+push esi
+shl ecx, 5
+add ecx, ebx
+push 0xeffc03ff
+lea eax, [ecx + 0x900]
+push eax
+mov dword [ebp - 0x34], ecx
+call fcn_00018b68 ; call 0x18b68
+mov ecx, dword [ebp - 0x34]
+add esp, 0xc
+push edi
+push 0xfffe07ff
+add ecx, 0x90c
+push ecx
+call fcn_00018b68 ; call 0x18b68
+mov edx, dword [ebp - 0x38]
+add esp, 0x10
+inc edx
+jmp short loc_00009b78 ; jmp 0x9b78
+
+loc_00009bc4:
+add ebx, 0xa00
+mov esi, dword [ebp + 8]
+cmp byte [ebp - 0x3c], 0
+je short loc_00009bf9 ; je 0x9bf9
+
+loc_00009bd3:
+mov eax, esi
+sub eax, dword [ebp - 0x30]
+cmp al, byte [ebp - 0x29]
+jae short loc_00009bf9 ; jae 0x9bf9
+push eax
+inc esi
+push eax
+push 0x400
+movzx eax, byte [esi - 1]
+shl eax, 4
+add eax, ebx
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+jmp short loc_00009bd3 ; jmp 0x9bd3
+
+loc_00009bf9:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00009c03:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0xc]
+mov edi, dword [ebp + 8]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x10]
+test al, al
+je short loc_00009c48 ; je 0x9c48
+mov esi, eax
+mov eax, ref_00026efc ; mov eax, 0x26efc
+
+loc_00009c23:
+mov dl, byte [eax + 1]
+movzx ecx, byte [eax]
+movzx ebx, byte [eax + 3]
+mov byte [ebp - 0x1d], dl
+mov edx, esi
+cmp byte [eax + 2], dl
+je short loc_00009c54 ; je 0x9c54
+add eax, 4
+cmp eax, ref_00026f5c ; cmp eax, 0x26f5c
+jne short loc_00009c23 ; jne 0x9c23
+mov eax, 0x80000002
+jmp short loc_00009c6d ; jmp 0x9c6d
+
+loc_00009c48:
+push edx
+push edx
+push 0
+push 0
+push 0
+push 0
+jmp short loc_00009c5f ; jmp 0x9c5f
+
+loc_00009c54:
+push eax
+movzx edx, byte [ebp - 0x1d]
+push eax
+push 1
+push ebx
+push ecx
+push edx
+
+loc_00009c5f:
+movzx eax, byte [ebp - 0x1c]
+push eax
+push edi
+call fcn_00009ada ; call 0x9ada
+add esp, 0x20
+
+loc_00009c6d:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00009c75:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+lea ebx, [esi + 0x2338]
+
+loc_00009c83:
+sub esp, 0xc
+push ebx
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 1
+jne short loc_00009c83 ; jne 0x9c83
+push eax
+push eax
+push dword [ebp + 0xc]
+lea eax, [esi + 0x2330]
+push eax
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0xc
+push 0x700
+push 0xff
+push ebx
+call fcn_00018981 ; call 0x18981
+lea eax, [esi + 0x2334]
+add esi, 0x233a
+pop edx
+pop ecx
+push dword [ebp + 0x10]
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+pop edx
+push 0xf000
+push esi
+call fcn_00017e04 ; call 0x17e04
+pop ecx
+pop esi
+push 1
+push ebx
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+
+loc_00009ce8:
+sub esp, 0xc
+push ebx
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 1
+jne short loc_00009ce8 ; jne 0x9ce8
+sub esp, 0xc
+push ebx
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+and eax, 6
+cmp al, 1
+sbb eax, eax
+not eax
+lea esp, [ebp - 8]
+and eax, 0x80000007
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00009d19:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+lea ebx, [esi + 0x2338]
+
+loc_00009d27:
+sub esp, 0xc
+push ebx
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 1
+jne short loc_00009d27 ; jne 0x9d27
+push eax
+push eax
+push dword [ebp + 0xc]
+lea eax, [esi + 0x2330]
+push eax
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0xc
+push 0x600
+push 0xff
+push ebx
+call fcn_00018981 ; call 0x18981
+lea eax, [esi + 0x233a]
+pop edx
+pop ecx
+push 0xf000
+push eax
+call fcn_00017e04 ; call 0x17e04
+pop eax
+pop edx
+push 1
+push ebx
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+
+loc_00009d7b:
+sub esp, 0xc
+push ebx
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 1
+jne short loc_00009d7b ; jne 0x9d7b
+sub esp, 0xc
+push ebx
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov edx, 0x80000007
+test al, 6
+jne short loc_00009db9 ; jne 0x9db9
+sub esp, 0xc
+add esi, 0x2334
+push esi
+call fcn_00017e4e ; call 0x17e4e
+mov edx, dword [ebp + 0x10]
+add esp, 0x10
+mov dword [edx], eax
+xor edx, edx
+
+loc_00009db9:
+lea esp, [ebp - 8]
+mov eax, edx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00009dc2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov esi, dword [ebp + 0xc]
+lea eax, [ebp - 0x1c]
+mov edi, dword [ebp + 0x14]
+push eax
+push esi
+push dword [ebp + 8]
+call fcn_00009d19 ; call 0x9d19
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+jns short loc_00009e40 ; jns 0x9e40
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00009e0a ; je 0x9e0a
+sub esp, 0xc
+push edi
+push dword [ebp + 0x10]
+push esi
+push ref_00022017 ; push 0x22017
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_00009e0a:
+call fcn_00015480 ; call 0x15480
+mov edx, ebx
+test al, al
+je near loc_00009ec3 ; je 0x9ec3
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00009e36 ; je 0x9e36
+push edi
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00009e36:
+push esi
+push ref_000206f4 ; push 0x206f4
+push 0x34
+jmp short loc_00009eb4 ; jmp 0x9eb4
+
+loc_00009e40:
+mov eax, dword [ebp + 0x10]
+and eax, dword [ebp - 0x1c]
+push ecx
+or eax, edi
+push eax
+push esi
+push dword [ebp + 8]
+mov dword [ebp - 0x1c], eax
+call fcn_00009c75 ; call 0x9c75
+add esp, 0x10
+mov ebx, eax
+mov edx, eax
+test eax, eax
+jns short loc_00009ec3 ; jns 0x9ec3
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00009e84 ; je 0x9e84
+sub esp, 0xc
+push edi
+push dword [ebp + 0x10]
+push esi
+push ref_00022084 ; push 0x22084
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_00009e84:
+call fcn_00015480 ; call 0x15480
+mov edx, ebx
+test al, al
+je short loc_00009ec3 ; je 0x9ec3
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00009eac ; je 0x9eac
+push edx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00009eac:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x40
+
+loc_00009eb4:
+push ref_00022050 ; push 0x22050
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+mov edx, ebx
+
+loc_00009ec3:
+lea esp, [ebp - 0xc]
+mov eax, edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00009ecd:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 8]
+mov edi, dword [ebp + 0x14]
+lea esi, [ebx + 0x2338]
+
+loc_00009ee2:
+sub esp, 0xc
+push esi
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 1
+jne short loc_00009ee2 ; jne 0x9ee2
+push ecx
+push ecx
+push dword [ebp + 0xc]
+lea eax, [ebx + 0x2330]
+push eax
+call fcn_00017e8f ; call 0x17e8f
+mov eax, dword [ebp + 0x10]
+add esp, 0xc
+shl eax, 8
+movzx eax, ax
+push eax
+push 0xff
+push esi
+call fcn_00018981 ; call 0x18981
+pop eax
+mov eax, edi
+pop edx
+movzx edi, al
+or edi, 0xf000
+lea eax, [ebx + 0x233a]
+push edi
+push eax
+call fcn_00017e04 ; call 0x17e04
+mov eax, dword [ebp + 0x10]
+add esp, 0x10
+lea ecx, [eax - 1]
+cmp ecx, 6
+ja short loc_00009f64 ; ja 0x9f64
+mov eax, 1
+shl eax, cl
+test al, 0x55
+je short loc_00009f64 ; je 0x9f64
+mov eax, dword [ebp + 0x18]
+push edx
+push edx
+push dword [eax]
+lea eax, [ebx + 0x2334]
+push eax
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+
+loc_00009f64:
+push eax
+push eax
+push 1
+push esi
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+
+loc_00009f71:
+sub esp, 0xc
+push esi
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 1
+jne short loc_00009f71 ; jne 0x9f71
+sub esp, 0xc
+push esi
+mov esi, 0x80000007
+call fcn_00017d8b ; call 0x17d8b
+mov edx, dword [ebp + 0x1c]
+add esp, 0x10
+and eax, 6
+mov byte [edx], al
+test al, al
+jne short loc_00009fcb ; jne 0x9fcb
+xor esi, esi
+cmp dword [ebp + 0x10], 6
+ja short loc_00009fcb ; ja 0x9fcb
+mov cl, byte [ebp + 0x10]
+mov eax, 1
+shl eax, cl
+test al, 0x55
+je short loc_00009fcb ; je 0x9fcb
+sub esp, 0xc
+add ebx, 0x2334
+push ebx
+call fcn_00017e4e ; call 0x17e4e
+mov edx, dword [ebp + 0x18]
+add esp, 0x10
+mov dword [edx], eax
+
+loc_00009fcb:
+lea esp, [ebp - 0xc]
+mov eax, esi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00009fd5:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov al, byte [ebp + 0x14]
+mov byte [ebp - 0x19], al
+movzx eax, byte [ebp + 0x10]
+push eax
+movzx eax, byte [ebp + 0xc]
+push eax
+movzx eax, byte [ebp + 8]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+mov esi, eax
+lea eax, [eax + 0xe]
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+mov edx, 0x14
+and eax, 0x7f
+cmp al, 2
+mov eax, 0x34
+cmovne edx, eax
+add edx, esi
+mov dword [esp], edx
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+xor ecx, ecx
+mov bl, al
+and ebx, 0xfffffffc
+
+loc_0000a02b:
+test bl, bl
+je short loc_0000a065 ; je 0xa065
+inc cl
+je short loc_0000a065 ; je 0xa065
+movzx edi, bl
+sub esp, 0xc
+add edi, esi
+push edi
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+cmp al, byte [ebp - 0x19]
+mov cl, al
+mov dword [ebp - 0x20], ecx
+je short loc_0000a069 ; je 0xa069
+sub esp, 0xc
+inc edi
+push edi
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov ecx, dword [ebp - 0x20]
+mov bl, al
+and ebx, 0xfffffffc
+jmp short loc_0000a02b ; jmp 0xa02b
+
+loc_0000a065:
+xor eax, eax
+jmp short loc_0000a06b ; jmp 0xa06b
+
+loc_0000a069:
+mov al, bl
+
+loc_0000a06b:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000a073:
+push ebp
+mov ebp, esp
+push edi
+push esi
+xor esi, esi
+push ebx
+mov ebx, 0x100
+sub esp, 0x20
+mov eax, dword [ebp + 0x14]
+mov word [ebp - 0x1e], ax
+movzx eax, byte [ebp + 0x10]
+push eax
+movzx eax, byte [ebp + 0xc]
+push eax
+movzx eax, byte [ebp + 8]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0x10
+mov dword [ebp - 0x1c], eax
+
+loc_0000a0a4:
+test bx, bx
+je short loc_0000a0e4 ; je 0xa0e4
+inc si
+je short loc_0000a0e4 ; je 0xa0e4
+mov eax, dword [ebp - 0x1c]
+movzx ecx, bx
+sub esp, 0xc
+lea edi, [ecx + eax]
+push edi
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+mov esi, eax
+cmp ax, word [ebp - 0x1e]
+je short loc_0000a0e8 ; je 0xa0e8
+sub esp, 0xc
+lea ecx, [edi + 2]
+push ecx
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+mov ebx, eax
+shr bx, 4
+and ebx, 0xfffffffc
+jmp short loc_0000a0a4 ; jmp 0xa0a4
+
+loc_0000a0e4:
+xor eax, eax
+jmp short loc_0000a0ea ; jmp 0xa0ea
+
+loc_0000a0e8:
+mov eax, ebx
+
+loc_0000a0ea:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000a0f2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x30
+mov edi, dword [ebp + 0x1c]
+movzx edx, byte [ebp + 0x10]
+movzx esi, byte [ebp + 8]
+mov eax, dword [ebp + 0x14]
+mov dword [ebp - 0x20], edi
+movzx edi, byte [ebp + 0xc]
+mov ebx, dword [ebp + 0x18]
+push edx
+push edi
+push esi
+mov dword [ebp - 0x30], edx
+mov dword [ebp - 0x1c], eax
+mov byte [ebp - 0x24], al
+mov byte [ebp - 0x28], bl
+call fcn_00016c9a ; call 0x16c9a
+mov edx, dword [ebp - 0x30]
+push 2
+push edx
+push edi
+push esi
+mov dword [ebp - 0x2c], eax
+call fcn_0000a073 ; call 0xa073
+add esp, 0x20
+mov edx, 0x80000003
+mov ecx, dword [ebp - 0x2c]
+test ax, ax
+je near loc_0000a216 ; je 0xa216
+movzx eax, ax
+lea esi, [ecx + eax + 0x14]
+push eax
+push 1
+push 0xf0
+push esi
+call fcn_0001878a ; call 0x1878a
+mov cl, byte [ebp - 0x20]
+mov eax, 1
+pop edx
+shl eax, cl
+pop ecx
+movzx eax, al
+mov dword [ebp - 0x20], eax
+push eax
+push esi
+movzx esi, bl
+call fcn_00017da5 ; call 0x17da5
+movzx edi, byte [ebp - 0x1c]
+add esp, 0xc
+push 0
+push esi
+push edi
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xe
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x1c], 0
+mov bl, al
+movzx eax, byte [ebp - 0x28]
+sar bl, 7
+and ebx, 7
+mov dword [ebp - 0x28], eax
+movzx eax, byte [ebp - 0x24]
+mov dword [ebp - 0x24], eax
+
+loc_0000a1b4:
+movzx edx, byte [ebp - 0x1c]
+push eax
+push edx
+push esi
+push edi
+mov dword [ebp - 0x30], edx
+call fcn_00016c9a ; call 0x16c9a
+mov edx, dword [ebp - 0x30]
+push 2
+push edx
+push dword [ebp - 0x28]
+push dword [ebp - 0x24]
+mov dword [ebp - 0x2c], eax
+call fcn_0000a073 ; call 0xa073
+add esp, 0x20
+mov ecx, dword [ebp - 0x2c]
+test ax, ax
+je short loc_0000a20c ; je 0xa20c
+movzx eax, ax
+lea edx, [ecx + eax + 0x14]
+push eax
+push 1
+push 0xf0
+push edx
+mov dword [ebp - 0x2c], edx
+call fcn_0001878a ; call 0x1878a
+pop edx
+mov edx, dword [ebp - 0x2c]
+pop ecx
+push dword [ebp - 0x20]
+push edx
+call fcn_00017da5 ; call 0x17da5
+add esp, 0x10
+
+loc_0000a20c:
+inc byte [ebp - 0x1c]
+cmp byte [ebp - 0x1c], bl
+jbe short loc_0000a1b4 ; jbe 0xa1b4
+xor edx, edx
+
+loc_0000a216:
+lea esp, [ebp - 0xc]
+mov eax, edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000a220:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x40
+mov eax, dword [ebp + 8]
+movzx ecx, byte [ebp + 0x10]
+movzx esi, byte [ebp + 0xc]
+mov ebx, dword [ebp + 0x14]
+mov edx, eax
+mov dword [ebp - 0x2c], eax
+mov eax, dword [ebp + 0x18]
+movzx edi, dl
+push ecx
+push esi
+push edi
+mov dword [ebp - 0x24], ecx
+mov dword [ebp - 0x1c], eax
+mov byte [ebp - 0x38], bl
+mov byte [ebp - 0x3c], al
+call fcn_00016c9a ; call 0x16c9a
+mov ecx, dword [ebp - 0x24]
+push 0x10
+push ecx
+push esi
+push edi
+mov dword [ebp - 0x20], eax
+call fcn_00009fd5 ; call 0x9fd5
+add esp, 0x20
+test al, al
+jne short loc_0000a277 ; jne 0xa277
+
+loc_0000a26d:
+mov eax, 0x80000003
+jmp near loc_0000a3e2 ; jmp 0xa3e2
+
+loc_0000a277:
+movzx eax, al
+sub esp, 0xc
+add eax, dword [ebp - 0x20]
+lea esi, [eax + 0x12]
+push esi
+mov dword [ebp - 0x28], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test ah, 0x10
+je short loc_0000a26d ; je 0xa26d
+movzx eax, byte [ebp - 0x1c]
+movzx edx, bl
+push ecx
+push 0
+push eax
+push edx
+mov dword [ebp - 0x34], edx
+mov dword [ebp - 0x30], eax
+call fcn_00016c9a ; call 0x16c9a
+mov ebx, eax
+lea eax, [eax + 0xe]
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x1c], al
+sar byte [ebp - 0x1c], 7
+and byte [ebp - 0x1c], 7
+cmp byte [ebp - 0x2c], 0
+jne short loc_0000a306 ; jne 0xa306
+sub esp, 0xc
+push ebx
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+cmp ax, 0x8086
+jne short loc_0000a306 ; jne 0xa306
+sub esp, 0xc
+add ebx, 2
+push ebx
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+cmp ax, 0x93c
+jne short loc_0000a306 ; jne 0xa306
+push eax
+push eax
+mov eax, dword [ebp - 0x20]
+push 0x40
+add eax, 0x70
+push eax
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+
+loc_0000a306:
+movzx eax, byte [ebp - 0x3c]
+xor ebx, ebx
+mov byte [ebp - 0x24], 0
+mov dword [ebp - 0x3c], eax
+movzx eax, byte [ebp - 0x38]
+mov dword [ebp - 0x40], eax
+
+loc_0000a31a:
+push edi
+movzx edi, byte [ebp - 0x24]
+push edi
+push dword [ebp - 0x30]
+push dword [ebp - 0x34]
+call fcn_00016c9a ; call 0x16c9a
+push 0x10
+push edi
+push dword [ebp - 0x3c]
+push dword [ebp - 0x40]
+mov dword [ebp - 0x38], eax
+call fcn_00009fd5 ; call 0x9fd5
+add esp, 0x20
+test al, al
+je short loc_0000a388 ; je 0xa388
+mov edi, dword [ebp - 0x38]
+movzx eax, al
+sub esp, 0xc
+add edi, eax
+lea eax, [edi + 0x12]
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test ah, 0x10
+je short loc_0000a388 ; je 0xa388
+test bl, bl
+jne short loc_0000a376 ; jne 0xa376
+mov eax, dword [ebp - 0x28]
+push ebx
+push ebx
+push 0x40
+add eax, 0x10
+push eax
+call fcn_00018730 ; call 0x18730
+add esp, 0x10
+
+loc_0000a376:
+push ecx
+add edi, 0x10
+push ecx
+mov bl, 1
+push 0x40
+push edi
+call fcn_00018730 ; call 0x18730
+add esp, 0x10
+
+loc_0000a388:
+inc byte [ebp - 0x24]
+mov al, byte [ebp - 0x1c]
+cmp byte [ebp - 0x24], al
+jbe short loc_0000a31a ; jbe 0xa31a
+cmp bl, 1
+sbb ebx, ebx
+and ebx, 0x80000003
+cmp byte [ebp - 0x2c], 0
+jne short loc_0000a3bc ; jne 0xa3bc
+mov eax, dword [ebp - 0x20]
+push edx
+push edx
+push 0x1040
+add eax, 0xd4
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+
+loc_0000a3bc:
+push eax
+push eax
+mov eax, dword [ebp - 0x28]
+push 0x20
+add eax, 0x10
+push eax
+call fcn_00018730 ; call 0x18730
+add esp, 0x10
+
+loc_0000a3cf:
+sub esp, 0xc
+push esi
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test ah, 8
+jne short loc_0000a3cf ; jne 0xa3cf
+mov eax, ebx
+
+loc_0000a3e2:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000a3ea:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0xc]
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0x10]
+mov dword [ebp - 0x1c], eax
+mov byte [ebp - 0x24], bl
+mov dword [ebp - 0x28], esi
+mov byte [ebp - 0x20], al
+call fcn_0001bfbb ; call 0x1bfbb
+cmp eax, 2
+je short loc_0000a44e ; je 0xa44e
+
+loc_0000a412:
+movzx edi, byte [ebp - 0x1c]
+movzx esi, bl
+xor ebx, ebx
+push ecx
+push 0
+push edi
+push esi
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xe
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x1c], al
+movzx eax, byte [ebp - 0x20]
+sar byte [ebp - 0x1c], 7
+and byte [ebp - 0x1c], 7
+mov dword [ebp - 0x20], eax
+movzx eax, byte [ebp - 0x24]
+mov dword [ebp - 0x24], eax
+jmp short loc_0000a4b5 ; jmp 0xa4b5
+
+loc_0000a44e:
+push eax
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov edi, eax
+lea eax, [eax + 0xf0]
+add edi, 0x48
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov dword [esp], edi
+mov esi, eax
+call fcn_00017dc2 ; call 0x17dc2
+mov edi, eax
+pop eax
+and edi, 0xfffc
+movzx eax, byte [ebp - 0x28]
+pop edx
+push eax
+mov eax, esi
+and eax, 0xffffc000
+push eax
+call fcn_0001c3cb ; call 0x1c3cb
+movzx eax, al
+lea eax, [edi + eax*8 + 0x190]
+mov dword [esp], eax
+call fcn_00018f64 ; call 0x18f64
+add esp, 0x10
+test al, 1
+je near loc_0000a412 ; je 0xa412
+jmp near loc_0000a557 ; jmp 0xa557
+
+loc_0000a4b5:
+push 0x10
+movzx ecx, bl
+push ecx
+push dword [ebp - 0x20]
+push dword [ebp - 0x24]
+mov dword [ebp - 0x28], ecx
+call fcn_00009fd5 ; call 0x9fd5
+add esp, 0x10
+mov ecx, dword [ebp - 0x28]
+test al, al
+mov dl, al
+jne short loc_0000a4df ; jne 0xa4df
+
+loc_0000a4d5:
+inc ebx
+cmp bl, byte [ebp - 0x1c]
+jbe short loc_0000a4b5 ; jbe 0xa4b5
+xor ebx, ebx
+jmp short loc_0000a50f ; jmp 0xa50f
+
+loc_0000a4df:
+push eax
+push ecx
+push edi
+push esi
+mov dword [ebp - 0x28], edx
+call fcn_00016c9a ; call 0x16c9a
+mov edx, dword [ebp - 0x28]
+movzx edx, dl
+lea eax, [eax + edx + 0xc]
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test eax, 0x40000
+jne short loc_0000a4d5 ; jne 0xa4d5
+jmp short loc_0000a557 ; jmp 0xa557
+
+loc_0000a509:
+inc ebx
+cmp bl, byte [ebp - 0x1c]
+ja short loc_0000a557 ; ja 0xa557
+
+loc_0000a50f:
+push 0x10
+movzx ecx, bl
+push ecx
+push dword [ebp - 0x20]
+push dword [ebp - 0x24]
+mov dword [ebp - 0x28], ecx
+call fcn_00009fd5 ; call 0x9fd5
+add esp, 0x10
+mov ecx, dword [ebp - 0x28]
+test al, al
+mov dl, al
+je short loc_0000a509 ; je 0xa509
+push eax
+push ecx
+push edi
+push esi
+mov dword [ebp - 0x28], edx
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+mov edx, dword [ebp - 0x28]
+pop ecx
+movzx edx, dl
+push 0x100
+lea eax, [eax + edx + 0x10]
+push eax
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+jmp short loc_0000a509 ; jmp 0xa509
+
+loc_0000a557:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000a55f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x30
+mov edx, dword [ebp + 0xc]
+mov eax, dword [ebp + 8]
+mov bl, byte [ebp + 0x14]
+push 0
+mov byte [ebp - 0x24], dl
+movzx edx, dl
+movzx edi, al
+push edx
+push edi
+mov byte [ebp - 0x1a], bl
+mov dword [ebp - 0x20], edx
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xe
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x19], 0
+mov dword [ebp - 0x28], edi
+mov bl, al
+movzx eax, byte [ebp - 0x24]
+sar bl, 7
+and ebx, 7
+mov dword [ebp - 0x24], eax
+
+loc_0000a5ad:
+push ecx
+movzx ecx, byte [ebp - 0x19]
+push ecx
+push dword [ebp - 0x20]
+mov dword [ebp - 0x2c], ecx
+push edi
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+mov esi, eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_0000a631 ; je 0xa631
+mov ecx, dword [ebp - 0x2c]
+push 0x10
+push ecx
+push dword [ebp - 0x24]
+push dword [ebp - 0x28]
+call fcn_00009fd5 ; call 0x9fd5
+add esp, 0x10
+test al, al
+je short loc_0000a631 ; je 0xa631
+cmp byte [ebp - 0x1a], 1
+movzx eax, al
+jne short loc_0000a613 ; jne 0xa613
+push edx
+mov edx, dword [ebp + 0x10]
+lea eax, [esi + eax + 8]
+mov cx, word [edx]
+shl ecx, 5
+movzx ecx, cx
+push ecx
+push 0xff1f
+push eax
+call fcn_00018981 ; call 0x18981
+add esp, 0x10
+jmp short loc_0000a631 ; jmp 0xa631
+
+loc_0000a613:
+sub esp, 0xc
+lea eax, [esi + eax + 4]
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+mov esi, dword [ebp + 0x10]
+add esp, 0x10
+and eax, 7
+cmp word [esi], ax
+jbe short loc_0000a631 ; jbe 0xa631
+mov word [esi], ax
+
+loc_0000a631:
+inc byte [ebp - 0x19]
+cmp byte [ebp - 0x19], bl
+jbe near loc_0000a5ad ; jbe 0xa5ad
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000a647:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+movzx eax, byte [ebp + 0x10]
+mov esi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0x14]
+push eax
+movzx eax, byte [ebp + 0xc]
+movzx edi, bl
+push eax
+movzx eax, byte [ebp + 8]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 0
+mov dword [ebp - 0x20], eax
+mov eax, esi
+movzx esi, al
+push esi
+push edi
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xe
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+xor ecx, ecx
+mov byte [ebp - 0x19], 0
+mov dl, al
+sar dl, 7
+and edx, 7
+
+loc_0000a69d:
+movzx eax, byte [ebp - 0x19]
+mov dword [ebp - 0x28], edx
+push edx
+push eax
+push esi
+push edi
+mov dword [ebp - 0x24], ecx
+call fcn_00016c9a ; call 0x16c9a
+mov ebx, eax
+lea eax, [eax + 0xb]
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+mov byte [ebp - 0x1a], al
+lea eax, [ebx + 0xa]
+add ebx, 9
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+mov dword [esp], ebx
+mov byte [ebp - 0x1b], al
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov ecx, dword [ebp - 0x24]
+cmp byte [ebp - 0x1b], 0
+mov edx, dword [ebp - 0x28]
+jne short loc_0000a6f8 ; jne 0xa6f8
+cmp byte [ebp - 0x1a], 8
+jne short loc_0000a6f8 ; jne 0xa6f8
+cmp al, 0x20
+je short loc_0000a6f6 ; je 0xa6f6
+cmp al, 0x10
+jne short loc_0000a6f8 ; jne 0xa6f8
+
+loc_0000a6f6:
+mov cl, 1
+
+loc_0000a6f8:
+inc byte [ebp - 0x19]
+cmp byte [ebp - 0x19], dl
+jbe short loc_0000a69d ; jbe 0xa69d
+test cl, cl
+jne short loc_0000a719 ; jne 0xa719
+push eax
+push eax
+mov eax, dword [ebp - 0x20]
+push 2
+add eax, 0xd4
+push eax
+call fcn_00018730 ; call 0x18730
+add esp, 0x10
+
+loc_0000a719:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000a723:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0000a75e ; je 0xa75e
+mov ax, word [esi]
+and eax, 0x1c00
+cmp eax, 0x1400
+jbe short loc_0000a75e ; jbe 0xa75e
+push edx
+push ref_000220be ; push 0x220be
+push 0x275
+push ref_00022106 ; push 0x22106
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000a75e:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0000a78d ; je 0xa78d
+mov eax, ebx
+and eax, 0x1c00
+cmp eax, 0x1400
+jbe short loc_0000a78d ; jbe 0xa78d
+push eax
+push ref_00022154 ; push 0x22154
+push 0x276
+push ref_00022106 ; push 0x22106
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000a78d:
+mov cx, word [esi]
+mov eax, ecx
+and ecx, 0x1c00
+sar ecx, 0xa
+and eax, 0x3ff
+lea ecx, [ecx + ecx*4]
+shl eax, cl
+test eax, eax
+je short loc_0000a7c5 ; je 0xa7c5
+mov ecx, ebx
+mov edx, ebx
+and ecx, 0x1c00
+and edx, 0x3ff
+sar ecx, 0xa
+lea ecx, [ecx + ecx*4]
+shl edx, cl
+cmp eax, edx
+jle short loc_0000a7c8 ; jle 0xa7c8
+
+loc_0000a7c5:
+mov word [esi], bx
+
+loc_0000a7c8:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000a7cf:
+push ebp
+mov ecx, 4
+mov ebp, esp
+push edi
+push esi
+mov esi, ref_000203f8 ; mov esi, 0x203f8
+push ebx
+sub esp, 0x6c
+mov eax, dword [ebp + 0x28]
+mov ebx, dword [ebp + 0x10]
+lea edi, [ebp - 0x28]
+rep movsd ; rep movsd dword es:[edi], dword ptr [esi]
+mov word [ebp - 0x6a], ax
+mov al, byte [ebp + 0x4c]
+mov byte [ebp - 0x58], bl
+mov byte [ebp - 0x6c], al
+call fcn_0001bfbb ; call 0x1bfbb
+mov dword [ebp - 0x3c], 0
+mov dword [ebp - 0x5c], eax
+movzx eax, bl
+lea edi, [eax + 1]
+mov dword [ebp - 0x64], edi
+shl dword [ebp - 0x64], 8
+or dword [ebp - 0x64], eax
+mov dword [ebp - 0x54], eax
+movzx eax, word [ebp - 0x6a]
+mov dword [ebp - 0x70], eax
+add eax, 4
+mov dword [ebp - 0x74], eax
+
+loc_0000a829:
+push eax
+push 0
+push dword [ebp - 0x3c]
+push dword [ebp - 0x54]
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+mov ebx, eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_0000a858 ; jne 0xa858
+
+loc_0000a848:
+inc dword [ebp - 0x3c]
+cmp dword [ebp - 0x3c], 0x20
+jne short loc_0000a829 ; jne 0xa829
+xor eax, eax
+jmp near loc_0000b012 ; jmp 0xb012
+
+loc_0000a858:
+sub esp, 0xc
+add ebx, 0xe
+push ebx
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x57], 0
+mov byte [ebp - 0x55], al
+sar byte [ebp - 0x55], 7
+and byte [ebp - 0x55], 7
+
+loc_0000a876:
+movzx ebx, byte [ebp - 0x57]
+push edi
+mov esi, dword [ebp - 0x54]
+push ebx
+push dword [ebp - 0x3c]
+push esi
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+mov edi, eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+je near loc_0000aff2 ; je 0xaff2
+push 0x10
+push ebx
+push dword [ebp - 0x3c]
+push esi
+call fcn_00009fd5 ; call 0x9fd5
+add esp, 0x10
+mov byte [ebp - 0x60], al
+test al, al
+je near loc_0000b006 ; je 0xb006
+sub esp, 0xc
+push edi
+call fcn_00017dc2 ; call 0x17dc2
+mov word [ebp - 0x46], ax
+lea eax, [edi + 2]
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+mov word [ebp - 0x48], ax
+lea eax, [edi + 8]
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+cmp dword [ebp - 0x5c], 2
+mov byte [ebp - 0x56], al
+jne near loc_0000aa0c ; jne 0xaa0c
+call fcn_0001c0bd ; call 0x1c0bd
+cmp eax, 2
+jne short loc_0000a92d ; jne 0xa92d
+cmp word [ebp - 0x46], 0x8086
+jne short loc_0000a92d ; jne 0xa92d
+sub esp, 0xc
+lea eax, [edi + 0xa]
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+cmp ax, 0x280
+jne short loc_0000a92d ; jne 0xa92d
+mov eax, dword [ebp + 8]
+push esi
+push esi
+push 0xfc
+add eax, 0x418
+push eax
+call fcn_0001875d ; call 0x1875d
+add esp, 0x10
+
+loc_0000a92d:
+mov eax, dword [ebp - 0x48]
+xor ecx, ecx
+sub ax, 0x8b1
+mov word [ebp - 0x40], ax
+
+loc_0000a93a:
+movzx edx, cl
+cmp edx, dword [ebp + 0x14]
+jae short loc_0000a9b3 ; jae 0xa9b3
+imul edx, edx, 0x18
+add edx, dword [ebp + 0x18]
+mov esi, edx
+test byte [edx + 8], 2
+je short loc_0000a9b0 ; je 0xa9b0
+mov ax, word [ebp - 0x46]
+cmp ax, word [edx]
+jne short loc_0000a9b0 ; jne 0xa9b0
+mov eax, dword [ebp - 0x48]
+cmp ax, word [edx + 2]
+jne short loc_0000a9b0 ; jne 0xa9b0
+mov al, byte [edx + 4]
+cmp byte [ebp - 0x56], al
+je short loc_0000a96e ; je 0xa96e
+inc al
+jne short loc_0000a9b0 ; jne 0xa9b0
+
+loc_0000a96e:
+cmp word [ebp - 0x46], 0x8086
+je short loc_0000a98b ; je 0xa98b
+
+loc_0000a976:
+mov ax, word [esi + 0xa]
+mov ecx, dword [esi + 0xc]
+mov word [ebp - 0x40], ax
+mov dword [ebp - 0x50], ecx
+test ax, ax
+jne short loc_0000a9e2 ; jne 0xa9e2
+jmp short loc_0000a9ba ; jmp 0xa9ba
+
+loc_0000a98b:
+cmp word [ebp - 0x40], 3
+mov dword [ebp - 0x44], ecx
+ja short loc_0000a976 ; ja 0xa976
+movzx eax, word [esi + 0xa]
+sub esp, 0xc
+add eax, edi
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov ecx, dword [ebp - 0x44]
+cmp ax, 0xcafe
+je short loc_0000a976 ; je 0xa976
+
+loc_0000a9b0:
+inc ecx
+jmp short loc_0000a93a ; jmp 0xa93a
+
+loc_0000a9b3:
+mov dword [ebp - 0x50], 0x1f
+
+loc_0000a9ba:
+push 0x1e
+push ebx
+push dword [ebp - 0x3c]
+push dword [ebp - 0x54]
+call fcn_0000a073 ; call 0xa073
+add esp, 0x10
+mov dword [ebp - 0x44], 0
+mov dword [ebp - 0x4c], 0
+mov word [ebp - 0x40], ax
+test ax, ax
+je short loc_0000aa27 ; je 0xaa27
+
+loc_0000a9e2:
+mov eax, dword [ebp - 0x74]
+sub esp, 0xc
+add eax, dword [ebp + 8]
+push eax
+call fcn_00017e4e ; call 0x17e4e
+mov dword [ebp - 0x4c], eax
+movzx eax, word [ebp - 0x40]
+lea eax, [edi + eax + 4]
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov dword [ebp - 0x44], eax
+jmp short loc_0000aa27 ; jmp 0xaa27
+
+loc_0000aa0c:
+mov dword [ebp - 0x50], 0x1f
+mov dword [ebp - 0x44], 0
+mov dword [ebp - 0x4c], 0
+mov word [ebp - 0x40], 0
+
+loc_0000aa27:
+movzx esi, byte [ebp - 0x60]
+sub esp, 0xc
+add esi, edi
+lea eax, [esi + 0x24]
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+and eax, 0x800
+mov dword [ebp - 0x60], eax
+je short loc_0000aa4f ; je 0xaa4f
+mov eax, dword [ebp + 0x3c]
+cmp byte [eax + 0x12], 1
+je short loc_0000aa55 ; je 0xaa55
+
+loc_0000aa4f:
+mov eax, dword [ebp + 0x48]
+mov byte [eax], 0
+
+loc_0000aa55:
+cmp dword [ebp + 0x20], 1
+ja near loc_0000ad5b ; ja 0xad5b
+lea eax, [esi + 0xc]
+sub esp, 0xc
+push eax
+mov dword [ebp - 0x60], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test eax, 0x40000
+jne short loc_0000aa7e ; jne 0xaa7e
+mov eax, dword [ebp + 0x44]
+mov byte [eax], 0
+
+loc_0000aa7e:
+sub esp, 0xc
+push dword [ebp - 0x60]
+call fcn_00017dc2 ; call 0x17dc2
+mov ebx, eax
+call fcn_00015479 ; call 0x15479
+shr bx, 0xa
+add esp, 0x10
+and ebx, 3
+test al, al
+je short loc_0000aab4 ; je 0xaab4
+movzx eax, bx
+push eax
+push dword [ebp - 0x3c]
+push ref_0002219b ; push 0x2219b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000aab4:
+cmp dword [ebp + 0x20], 0
+jne near loc_0000ac13 ; jne 0xac13
+lea eax, [esi + 4]
+sub esp, 0xc
+push eax
+mov dword [ebp - 0x68], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test ax, ax
+js short loc_0000aaf5 ; js 0xaaf5
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000aaef ; je 0xaaef
+push ecx
+push ecx
+push ref_000221c5 ; push 0x221c5
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000aaef:
+mov eax, dword [ebp + 0x40]
+mov byte [eax], 1
+
+loc_0000aaf5:
+sub esp, 0xc
+xor esi, esi
+lea eax, [edi + 0xb]
+push eax
+call fcn_00017d8b ; call 0x17d8b
+mov byte [ebp - 0x6b], al
+lea eax, [edi + 0xa]
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+
+loc_0000ab14:
+mov ecx, esi
+movzx edx, cl
+cmp edx, dword [ebp + 0x14]
+jae short loc_0000ab71 ; jae 0xab71
+imul edx, edx, 0x18
+add edx, dword [ebp + 0x18]
+test byte [edx + 8], 1
+je short loc_0000ab6e ; je 0xab6e
+mov cx, word [edx]
+cmp cx, word [ebp - 0x46]
+je short loc_0000ab37 ; je 0xab37
+inc cx
+jne short loc_0000ab6e ; jne 0xab6e
+
+loc_0000ab37:
+mov cx, word [edx + 2]
+cmp cx, word [ebp - 0x48]
+je short loc_0000ab45 ; je 0xab45
+inc cx
+jne short loc_0000ab6e ; jne 0xab6e
+
+loc_0000ab45:
+mov cl, byte [edx + 4]
+cmp cl, byte [ebp - 0x56]
+je short loc_0000ab51 ; je 0xab51
+inc cl
+jne short loc_0000ab6e ; jne 0xab6e
+
+loc_0000ab51:
+mov cl, byte [edx + 5]
+cmp cl, byte [ebp - 0x6b]
+je short loc_0000ab5d ; je 0xab5d
+inc cl
+jne short loc_0000ab6e ; jne 0xab6e
+
+loc_0000ab5d:
+mov cl, byte [edx + 6]
+cmp cl, al
+jne short loc_0000ab6a ; jne 0xab6a
+
+loc_0000ab64:
+movzx ebx, byte [edx + 7]
+jmp short loc_0000ab71 ; jmp 0xab71
+
+loc_0000ab6a:
+inc cl
+je short loc_0000ab64 ; je 0xab64
+
+loc_0000ab6e:
+inc esi
+jmp short loc_0000ab14 ; jmp 0xab14
+
+loc_0000ab71:
+test bl, 2
+je short loc_0000abc2 ; je 0xabc2
+mov ecx, dword [ebp + 0xc]
+sub esp, 0xc
+mov eax, dword [ebp + 8]
+lea eax, [eax + ecx + 0xc]
+push eax
+call fcn_00017e4e ; call 0x17e4e
+pop ecx
+push dword [ebp - 0x60]
+mov esi, eax
+call fcn_00017e4e ; call 0x17e4e
+and esi, 0x38000
+pop edx
+push dword [ebp - 0x68]
+and eax, 0x38000
+cmp eax, esi
+cmovae esi, eax
+call fcn_00017e4e ; call 0x17e4e
+shr esi, 6
+mov edx, ebx
+and edx, 0xfffffffd
+add esp, 0x10
+and eax, 0xe00
+cmp esi, eax
+cmova ebx, edx
+
+loc_0000abc2:
+test bl, 1
+je short loc_0000ac13 ; je 0xac13
+mov ecx, dword [ebp + 0xc]
+sub esp, 0xc
+mov eax, dword [ebp + 8]
+lea eax, [eax + ecx + 0xc]
+push eax
+call fcn_00017e4e ; call 0x17e4e
+mov esi, eax
+pop eax
+and esi, 0x7000
+push dword [ebp - 0x60]
+call fcn_00017e4e ; call 0x17e4e
+pop edx
+push dword [ebp - 0x68]
+and eax, 0x7000
+cmp eax, esi
+cmovae esi, eax
+call fcn_00017e4e ; call 0x17e4e
+shr esi, 6
+mov edx, ebx
+and edx, 0xfffffffe
+add esp, 0x10
+and eax, 0x1c0
+cmp esi, eax
+cmova ebx, edx
+
+loc_0000ac13:
+mov eax, dword [ebp + 0x1c]
+and word [eax], bx
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ac38 ; je 0xac38
+movzx ebx, bx
+push ebx
+push dword [ebp - 0x3c]
+push ref_000221f8 ; push 0x221f8
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ac38:
+cmp dword [ebp - 0x5c], 2
+jne short loc_0000acb8 ; jne 0xacb8
+cmp word [ebp - 0x40], 0
+je short loc_0000acb8 ; je 0xacb8
+cmp word [ebp - 0x6a], 0
+je short loc_0000acb8 ; je 0xacb8
+mov eax, dword [ebp - 0x4c]
+and eax, 0x1f
+cmp eax, 0x1f
+jne short loc_0000acb8 ; jne 0xacb8
+mov ecx, dword [ebp - 0x50]
+mov eax, dword [ebp - 0x44]
+and eax, ecx
+cmp eax, ecx
+jne short loc_0000acb8 ; jne 0xacb8
+mov eax, dword [ebp + 0x3c]
+cmp byte [eax + 0x11], 0
+je short loc_0000acb8 ; je 0xacb8
+mov eax, dword [ebp + 0x2c]
+mov ebx, dword [ebp + 0x30]
+mov byte [eax], 1
+mov eax, dword [ebp - 0x44]
+mov edx, eax
+mov ecx, eax
+shr edx, 0x10
+movzx eax, ah
+shr ecx, 0x13
+and edx, 3
+and ecx, 0x1f
+cmp eax, dword [ebx]
+jbe short loc_0000ac91 ; jbe 0xac91
+mov dword [ebx], eax
+
+loc_0000ac91:
+mov eax, dword [ebp + 0x38]
+movzx edx, dl
+movzx ecx, cl
+mov ebx, dword [ebp + edx*4 - 0x28]
+mov esi, dword [ebp + 0x34]
+mov eax, dword [eax]
+imul ebx, ecx
+mov eax, dword [ebp + eax*4 - 0x28]
+imul eax, dword [esi]
+cmp ebx, eax
+jbe short loc_0000acb8 ; jbe 0xacb8
+mov eax, dword [ebp + 0x38]
+mov dword [esi], ecx
+mov dword [eax], edx
+
+loc_0000acb8:
+mov eax, dword [ebp + 0x24]
+xor edx, edx
+mov ebx, dword [eax]
+
+loc_0000acbf:
+movzx esi, dl
+cmp esi, dword [ebp + 0x14]
+jae near loc_0000af08 ; jae 0xaf08
+imul esi, esi, 0x18
+add esi, dword [ebp + 0x18]
+test byte [esi + 8], 4
+je short loc_0000ad55 ; je 0xad55
+mov ax, word [ebp - 0x46]
+cmp word [esi], ax
+jne short loc_0000ad55 ; jne 0xad55
+mov ax, word [esi + 2]
+cmp ax, word [ebp - 0x48]
+je short loc_0000acee ; je 0xacee
+inc ax
+jne short loc_0000ad55 ; jne 0xad55
+
+loc_0000acee:
+mov al, byte [esi + 4]
+cmp al, byte [ebp - 0x56]
+jne short loc_0000ad25 ; jne 0xad25
+
+loc_0000acf6:
+movzx eax, word [esi + 0x12]
+test ax, ax
+jns short loc_0000ad2b ; jns 0xad2b
+push ecx
+mov edx, ebx
+push ecx
+movzx ebx, bx
+push eax
+lea eax, [ebp - 0x2a]
+push eax
+shr edx, 0x10
+mov word [ebp - 0x2a], dx
+call fcn_0000a723 ; call 0xa723
+movzx eax, word [ebp - 0x2a]
+add esp, 0x10
+shl eax, 0x10
+or ebx, eax
+jmp short loc_0000ad2b ; jmp 0xad2b
+
+loc_0000ad25:
+inc al
+jne short loc_0000ad55 ; jne 0xad55
+jmp short loc_0000acf6 ; jmp 0xacf6
+
+loc_0000ad2b:
+movzx eax, word [esi + 0x10]
+test ax, ax
+jns short loc_0000ad4b ; jns 0xad4b
+push edx
+push edx
+push eax
+lea eax, [ebp - 0x2a]
+push eax
+mov word [ebp - 0x2a], bx
+call fcn_0000a723 ; call 0xa723
+mov bx, word [ebp - 0x2a]
+add esp, 0x10
+
+loc_0000ad4b:
+mov eax, dword [ebp + 0x24]
+mov dword [eax], ebx
+jmp near loc_0000af08 ; jmp 0xaf08
+
+loc_0000ad55:
+inc edx
+jmp near loc_0000acbf ; jmp 0xacbf
+
+loc_0000ad5b:
+cmp dword [ebp + 0x20], 2
+jne near loc_0000af08 ; jne 0xaf08
+cmp dword [ebp - 0x5c], 2
+jne near loc_0000ae28 ; jne 0xae28
+cmp word [ebp - 0x40], 0
+je near loc_0000ae28 ; je 0xae28
+mov eax, dword [ebp + 0x2c]
+cmp byte [eax], 0
+je near loc_0000ae28 ; je 0xae28
+mov eax, dword [ebp - 0x4c]
+and eax, 0x1f
+cmp eax, 0x1f
+jne near loc_0000ae28 ; jne 0xae28
+mov eax, dword [ebp - 0x44]
+mov ecx, dword [ebp - 0x50]
+and eax, ecx
+cmp eax, ecx
+jne near loc_0000ae28 ; jne 0xae28
+push eax
+mov eax, dword [ebp + 0x34]
+movzx edx, word [ebp - 0x40]
+mov eax, dword [eax]
+add edx, edi
+lea ecx, [edx + 0xc]
+mov dword [ebp - 0x44], edx
+shl eax, 3
+push eax
+push 0xffffff07
+push ecx
+mov dword [ebp - 0x40], ecx
+call fcn_00018b68 ; call 0x18b68
+mov eax, dword [ebp + 0x38]
+add esp, 0xc
+mov ecx, dword [ebp - 0x40]
+push dword [eax]
+push 0xfffffffffffffffc
+push ecx
+call fcn_00018b68 ; call 0x18b68
+mov edx, dword [ebp - 0x44]
+add esp, 0xc
+push 0x40a00000
+push 0x1c00ffff
+add edx, 8
+push edx
+mov dword [ebp - 0x40], edx
+call fcn_00018b68 ; call 0x18b68
+mov eax, dword [ebp + 0x3c]
+add esp, 0x10
+mov edx, dword [ebp - 0x40]
+mov al, byte [eax + 0x11]
+cmp al, 1
+je short loc_0000ae16 ; je 0xae16
+cmp al, 2
+setne al
+movzx eax, al
+lea eax, [eax + eax + 0xd]
+jmp short loc_0000ae1b ; jmp 0xae1b
+
+loc_0000ae16:
+mov eax, 0xe
+
+loc_0000ae1b:
+push ecx
+push eax
+push 0xffffffffffffffe0
+push edx
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_0000ae28:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ae4a ; je 0xae4a
+mov eax, dword [ebp + 0x1c]
+movzx eax, word [eax]
+push eax
+push dword [ebp - 0x3c]
+push ref_00022227 ; push 0x22227
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ae4a:
+push eax
+mov eax, dword [ebp + 0x1c]
+movzx eax, word [eax]
+push eax
+push 0xfffc
+lea eax, [esi + 0x10]
+push eax
+call fcn_00018981 ; call 0x18981
+add esp, 0x10
+cmp dword [ebp - 0x60], 0
+je short loc_0000ae85 ; je 0xae85
+mov eax, dword [ebp + 0x3c]
+cmp byte [eax + 0x12], 1
+jne short loc_0000ae85 ; jne 0xae85
+push ecx
+add esi, 0x28
+push ecx
+push 0x400
+push esi
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+
+loc_0000ae85:
+push 0x18
+push ebx
+push dword [ebp - 0x3c]
+push dword [ebp - 0x54]
+call fcn_0000a073 ; call 0xa073
+add esp, 0x10
+movzx ebx, ax
+test bx, bx
+je short loc_0000af08 ; je 0xaf08
+mov eax, dword [ebp + 0x24]
+lea esi, [ebp - 0x2a]
+add ebx, edi
+mov edx, dword [eax]
+mov eax, dword [ebp + 0x3c]
+mov word [ebp - 0x2a], dx
+movzx eax, word [eax + 0x14]
+mov dword [ebp - 0x40], edx
+push edx
+push edx
+push eax
+push esi
+call fcn_0000a723 ; call 0xa723
+movzx eax, word [ebp - 0x2a]
+add esp, 0xc
+push eax
+push 0xe000
+lea eax, [ebx + 4]
+add ebx, 6
+push eax
+call fcn_00018981 ; call 0x18981
+mov eax, dword [ebp + 0x3c]
+mov edx, dword [ebp - 0x40]
+pop ecx
+movzx eax, word [eax + 0x16]
+shr edx, 0x10
+mov word [ebp - 0x2a], dx
+pop edx
+push eax
+push esi
+call fcn_0000a723 ; call 0xa723
+movzx eax, word [ebp - 0x2a]
+add esp, 0xc
+push eax
+push 0xe000
+push ebx
+call fcn_00018981 ; call 0x18981
+add esp, 0x10
+
+loc_0000af08:
+sub esp, 0xc
+lea eax, [edi + 0xb]
+push eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+cmp al, 6
+jne near loc_0000aff2 ; jne 0xaff2
+sub esp, 0xc
+mov bl, 1
+lea eax, [edi + 0x19]
+push eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, al
+jne short loc_0000af72 ; jne 0xaf72
+mov eax, dword [ebp + 8]
+sub esp, 0xc
+add eax, 0x1a
+push eax
+call fcn_00017d8b ; call 0x17d8b
+mov bl, byte [ebp - 0x58]
+add esp, 0x10
+cmp al, bl
+jbe near loc_0000b00d ; jbe 0xb00d
+movzx eax, al
+shl eax, 0x10
+or eax, dword [ebp - 0x64]
+push esi
+push eax
+push 0xff000000
+lea eax, [edi + 0x18]
+push eax
+call fcn_00018b68 ; call 0x18b68
+mov al, bl
+add esp, 0x10
+inc eax
+xor ebx, ebx
+
+loc_0000af72:
+cmp al, byte [ebp - 0x58]
+jbe short loc_0000aff2 ; jbe 0xaff2
+movzx esi, al
+movzx eax, byte [ebp - 0x6c]
+push ecx
+push ecx
+push eax
+push dword [ebp + 0x48]
+push dword [ebp + 0x44]
+push dword [ebp + 0x40]
+push dword [ebp + 0x3c]
+push dword [ebp + 0x38]
+push dword [ebp + 0x34]
+push dword [ebp + 0x30]
+push dword [ebp + 0x2c]
+push dword [ebp - 0x70]
+push dword [ebp + 0x24]
+push dword [ebp + 0x20]
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push esi
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_0000a7cf ; call 0xa7cf
+add esp, 0x50
+cmp eax, 0x8000000e
+jne short loc_0000afdb ; jne 0xafdb
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000afdb ; je 0xafdb
+push edx
+push esi
+push ref_00022254 ; push 0x22254
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000afdb:
+test bl, bl
+jne short loc_0000aff2 ; jne 0xaff2
+push eax
+push eax
+push 0xff000000
+lea eax, [edi + 0x18]
+push eax
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+
+loc_0000aff2:
+inc byte [ebp - 0x57]
+mov al, byte [ebp - 0x55]
+cmp byte [ebp - 0x57], al
+jbe near loc_0000a876 ; jbe 0xa876
+jmp near loc_0000a848 ; jmp 0xa848
+
+loc_0000b006:
+mov eax, 0x8000000e
+jmp short loc_0000b012 ; jmp 0xb012
+
+loc_0000b00d:
+mov eax, 0x80000009
+
+loc_0000b012:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000b01a:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x60
+mov edx, dword [ebp + 0x1c]
+mov ecx, dword [ebp + 0x20]
+mov eax, dword [ebp + 0xc]
+push 0
+mov ebx, dword [ebp + 8]
+push 0x1f
+mov edi, dword [ebp + 0x10]
+push 0
+mov dword [ebp - 0x58], edx
+mov edx, dword [ebp + 0x2c]
+mov dword [ebp - 0x5c], ecx
+mov dword [ebp - 0x40], eax
+mov dword [ebp - 0x60], edx
+call fcn_00016c9a ; call 0x16c9a
+mov esi, eax
+call fcn_0001bfbb ; call 0x1bfbb
+mov ecx, edi
+add esp, 0xc
+movzx ecx, cl
+movzx edi, bl
+push ecx
+mov ebx, 0x8000000e
+mov dword [ebp - 0x3c], ecx
+movzx ecx, byte [ebp - 0x40]
+mov dword [ebp - 0x54], edi
+mov dword [ebp - 0x48], eax
+push ecx
+push edi
+mov dword [ebp - 0x50], ecx
+call fcn_00016c9a ; call 0x16c9a
+mov edi, eax
+lea eax, [esi + 0xf0]
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov ecx, dword [ebp + 0x28]
+mov edx, dword [ebp + 0x34]
+mov dword [ebp - 0x24], 0
+mov dword [ebp - 0x20], 0
+mov byte [ecx], 0
+mov byte [edx], 0
+mov dword [ebp - 0x40], eax
+mov dword [esp], edi
+mov dword [ebp - 0x1c], 0
+mov byte [ebp - 0x29], 0
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+je near loc_0000b2d9 ; je 0xb2d9
+cmp dword [ebp - 0x48], 2
+jne short loc_0000b113 ; jne 0xb113
+sub esp, 0xc
+lea eax, [esi + 0x48]
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+mov esi, dword [ebp - 0x40]
+and esi, 0xffffc000
+mov ebx, eax
+pop eax
+and ebx, 0xfffc
+pop edx
+push dword [ebp - 0x3c]
+push esi
+call fcn_0001c3cb ; call 0x1c3cb
+movzx eax, al
+lea eax, [ebx + eax*8 + 0x190]
+mov dword [esp], eax
+call fcn_00018f64 ; call 0x18f64
+add esp, 0x10
+test al, 1
+jne short loc_0000b113 ; jne 0xb113
+mov eax, dword [ebp + 0x34]
+mov byte [eax], 1
+
+loc_0000b113:
+push 0x10
+push dword [ebp - 0x3c]
+push dword [ebp - 0x50]
+push dword [ebp - 0x54]
+call fcn_00009fd5 ; call 0x9fd5
+add esp, 0x10
+movzx eax, al
+mov dword [ebp - 0x4c], eax
+test eax, eax
+jne short loc_0000b15c ; jne 0xb15c
+call fcn_00015480 ; call 0x15480
+mov ebx, 0x80000003
+test al, al
+je near loc_0000b2d9 ; je 0xb2d9
+push esi
+push ref_00022281 ; push 0x22281
+push 0x4f7
+push ref_00022106 ; push 0x22106
+call fcn_0001548c ; call 0x1548c
+jmp near loc_0000b2d6 ; jmp 0xb2d6
+
+loc_0000b15c:
+mov eax, dword [ebp - 0x4c]
+sub esp, 0xc
+lea esi, [eax + edi]
+lea eax, [esi + 0x24]
+push eax
+call fcn_00017e4e ; call 0x17e4e
+lea eax, [esi + 0xc]
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+mov ecx, dword [ebp + 0x30]
+add esp, 0x10
+mov edx, dword [ebp + 0x24]
+shr ax, 0xa
+and eax, 3
+mov word [ecx], ax
+mov dl, byte [edx + 0x10]
+cmp dl, 4
+je short loc_0000b1a2 ; je 0xb1a2
+and eax, edx
+mov word [ecx], ax
+mov dword [ebp - 0x40], 1
+jmp short loc_0000b1a9 ; jmp 0xb1a9
+
+loc_0000b1a2:
+mov dword [ebp - 0x40], 0
+
+loc_0000b1a9:
+sub esp, 0xc
+lea eax, [edi + 0x19]
+push eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x41], 1
+mov bl, al
+test al, al
+jne short loc_0000b1eb ; jne 0xb1eb
+mov ebx, dword [ebp - 0x58]
+movzx edx, byte [ebp - 0x5c]
+push ecx
+movzx eax, bl
+shl edx, 0x10
+shl eax, 8
+or eax, edx
+push eax
+push 0xff0000ff
+lea eax, [edi + 0x18]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+mov byte [ebp - 0x41], 0
+
+loc_0000b1eb:
+sub esp, 0xc
+add esi, 0x1a
+push esi
+xor esi, esi
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+cmp dword [ebp - 0x48], 2
+mov dword [ebp - 0x28], 0
+mov word [ebp - 0x58], ax
+jne short loc_0000b26b ; jne 0xb26b
+push 0x1e
+push dword [ebp - 0x3c]
+push dword [ebp - 0x50]
+push dword [ebp - 0x54]
+call fcn_0000a073 ; call 0xa073
+add esp, 0x10
+mov esi, eax
+test ax, ax
+je short loc_0000b26b ; je 0xb26b
+movzx eax, ax
+sub esp, 0xc
+lea edx, [edi + eax + 4]
+push edx
+mov dword [ebp - 0x3c], edx
+call fcn_00017e4e ; call 0x17e4e
+mov edx, dword [ebp - 0x3c]
+mov dword [esp], edx
+movzx eax, ah
+mov dword [ebp - 0x24], eax
+call fcn_00017e4e ; call 0x17e4e
+mov edx, dword [ebp - 0x3c]
+mov dword [esp], edx
+shr eax, 0x10
+and eax, 3
+mov dword [ebp - 0x1c], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+shr eax, 0x13
+and eax, 0x1f
+mov dword [ebp - 0x20], eax
+
+loc_0000b26b:
+xor eax, eax
+test bl, bl
+je short loc_0000b2be ; je 0xb2be
+test byte [ebp - 0x58], 0x40
+je short loc_0000b2be ; je 0xb2be
+movzx eax, byte [ebp - 0x60]
+movzx ecx, si
+movzx ebx, bl
+push edx
+push edx
+push eax
+push dword [ebp + 0x38]
+push dword [ebp + 0x34]
+lea eax, [ebp - 0x29]
+push eax
+push dword [ebp + 0x24]
+lea eax, [ebp - 0x1c]
+push eax
+lea eax, [ebp - 0x20]
+push eax
+lea eax, [ebp - 0x24]
+push eax
+push dword [ebp + 0x28]
+lea eax, [ebp - 0x28]
+push ecx
+push eax
+push dword [ebp - 0x40]
+push dword [ebp + 0x30]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push ebx
+push dword [ebp - 0x4c]
+push edi
+call fcn_0000a7cf ; call 0xa7cf
+add esp, 0x50
+
+loc_0000b2be:
+cmp byte [ebp - 0x41], 0
+mov ebx, eax
+jne short loc_0000b2d9 ; jne 0xb2d9
+push eax
+add edi, 0x18
+push eax
+push 0xff0000ff
+push edi
+call fcn_00018b3e ; call 0x18b3e
+
+loc_0000b2d6:
+add esp, 0x10
+
+loc_0000b2d9:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000b2e3:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x70
+mov ecx, dword [ebp + 0x1c]
+mov eax, dword [ebp + 8]
+push 0
+mov esi, dword [ebp + 0xc]
+push 0x1f
+mov edi, dword [ebp + 0x10]
+push 0
+mov dword [ebp - 0x40], ecx
+mov ecx, dword [ebp + 0x20]
+mov dword [ebp - 0x3c], eax
+mov dword [ebp - 0x58], ecx
+mov ecx, dword [ebp + 0x2c]
+mov dword [ebp - 0x5c], ecx
+mov ecx, dword [ebp + 0x30]
+mov dword [ebp - 0x68], ecx
+mov ecx, dword [ebp + 0x34]
+mov dword [ebp - 0x6c], ecx
+mov ecx, dword [ebp + 0x3c]
+mov dword [ebp - 0x70], ecx
+call fcn_00016c9a ; call 0x16c9a
+mov ebx, eax
+call fcn_0001bfbb ; call 0x1bfbb
+add esp, 0xc
+mov dword [ebp - 0x44], eax
+mov eax, edi
+movzx edi, al
+mov eax, esi
+push edi
+movzx eax, al
+push eax
+mov dword [ebp - 0x60], eax
+movzx eax, byte [ebp - 0x3c]
+push eax
+mov dword [ebp - 0x64], eax
+call fcn_00016c9a ; call 0x16c9a
+mov esi, eax
+lea eax, [ebx + 0xf0]
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov dword [ebp - 0x28], 0
+mov dword [ebp - 0x24], 0
+mov dword [ebp - 0x20], 0
+mov byte [ebp - 0x30], 0
+mov byte [ebp - 0x31], 0
+mov dword [ebp - 0x48], eax
+mov eax, dword [ebp + 0x28]
+and dword [ebp - 0x48], 0xffffc000
+mov byte [eax], 0
+mov dword [esp], esi
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_0000b3bb ; jne 0xb3bb
+call fcn_00015480 ; call 0x15480
+mov ebx, 0x8000000e
+test al, al
+je near loc_0000b969 ; je 0xb969
+push ecx
+push ref_00022281 ; push 0x22281
+push 0x5ca
+jmp short loc_0000b435 ; jmp 0xb435
+
+loc_0000b3bb:
+cmp dword [ebp - 0x44], 2
+jne short loc_0000b3fd ; jne 0xb3fd
+sub esp, 0xc
+add ebx, 0x48
+push ebx
+call fcn_00017dc2 ; call 0x17dc2
+mov ebx, eax
+pop eax
+and ebx, 0xfffc
+pop edx
+push edi
+push dword [ebp - 0x48]
+call fcn_0001c3cb ; call 0x1c3cb
+movzx eax, al
+lea eax, [ebx + eax*8 + 0x190]
+mov dword [esp], eax
+call fcn_00018f64 ; call 0x18f64
+add esp, 0x10
+test al, 1
+jne short loc_0000b3fd ; jne 0xb3fd
+mov byte [ebp - 0x31], 1
+
+loc_0000b3fd:
+push 0x10
+push edi
+push dword [ebp - 0x60]
+push dword [ebp - 0x64]
+call fcn_00009fd5 ; call 0x9fd5
+add esp, 0x10
+movzx eax, al
+mov dword [ebp - 0x50], eax
+test eax, eax
+jne short loc_0000b447 ; jne 0xb447
+call fcn_00015480 ; call 0x15480
+mov ebx, 0x80000003
+test al, al
+je near loc_0000b969 ; je 0xb969
+push eax
+push ref_00022281 ; push 0x22281
+push 0x5dc
+
+loc_0000b435:
+push ref_00022106 ; push 0x22106
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+jmp near loc_0000b969 ; jmp 0xb969
+
+loc_0000b447:
+mov eax, dword [ebp - 0x50]
+sub esp, 0xc
+add eax, esi
+mov dword [ebp - 0x4c], eax
+add eax, 0x24
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test ah, 8
+je short loc_0000b482 ; je 0xb482
+mov eax, dword [ebp + 0x24]
+cmp byte [eax + 0x12], 1
+jne short loc_0000b482 ; jne 0xb482
+push eax
+push eax
+mov eax, dword [ebp - 0x4c]
+push 0x400
+add eax, 0x28
+push eax
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+
+loc_0000b482:
+mov eax, dword [ebp - 0x4c]
+sub esp, 0xc
+add eax, 0xc
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+mov ecx, dword [ebp + 0x24]
+add esp, 0x10
+mov dl, byte [ecx + 0x10]
+shr ax, 0xa
+and eax, 3
+mov word [ebp - 0x2e], ax
+cmp dl, 4
+je short loc_0000b4b7 ; je 0xb4b7
+and eax, edx
+mov ebx, 1
+mov word [ebp - 0x2e], ax
+jmp short loc_0000b4b9 ; jmp 0xb4b9
+
+loc_0000b4b7:
+xor ebx, ebx
+
+loc_0000b4b9:
+sub esp, 0xc
+lea eax, [esi + 0x19]
+push eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x51], 1
+mov byte [ebp - 0x3c], al
+test al, al
+jne short loc_0000b500 ; jne 0xb500
+movzx edx, byte [ebp - 0x58]
+push eax
+movzx eax, byte [ebp - 0x40]
+shl edx, 0x10
+shl eax, 8
+or eax, edx
+push eax
+push 0xff0000ff
+lea eax, [esi + 0x18]
+push eax
+call fcn_00018b68 ; call 0x18b68
+mov al, byte [ebp - 0x40]
+add esp, 0x10
+mov byte [ebp - 0x51], 0
+mov byte [ebp - 0x3c], al
+
+loc_0000b500:
+mov eax, dword [ebp - 0x4c]
+sub esp, 0xc
+add eax, 0x1a
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+cmp dword [ebp - 0x44], 2
+mov dword [ebp - 0x2c], 0
+mov word [ebp - 0x40], 0
+mov word [ebp - 0x58], ax
+jne short loc_0000b57e ; jne 0xb57e
+push 0x1e
+push edi
+push dword [ebp - 0x60]
+push dword [ebp - 0x64]
+call fcn_0000a073 ; call 0xa073
+add esp, 0x10
+mov word [ebp - 0x40], ax
+test ax, ax
+je short loc_0000b57e ; je 0xb57e
+movzx eax, ax
+sub esp, 0xc
+lea edi, [esi + eax + 4]
+push edi
+call fcn_00017e4e ; call 0x17e4e
+mov dword [esp], edi
+movzx eax, ah
+mov dword [ebp - 0x28], eax
+call fcn_00017e4e ; call 0x17e4e
+mov dword [esp], edi
+shr eax, 0x10
+and eax, 3
+mov dword [ebp - 0x20], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+shr eax, 0x13
+and eax, 0x1f
+mov dword [ebp - 0x24], eax
+
+loc_0000b57e:
+xor edi, edi
+cmp byte [ebp - 0x3c], 0
+je near loc_0000b689 ; je 0xb689
+test byte [ebp - 0x58], 0x40
+je near loc_0000b689 ; je 0xb689
+movzx eax, byte [ebp - 0x5c]
+push edi
+push edi
+push eax
+push dword [ebp + 0x38]
+lea eax, [ebp - 0x31]
+push eax
+lea eax, [ebp - 0x30]
+push eax
+push dword [ebp + 0x24]
+lea eax, [ebp - 0x20]
+push eax
+lea eax, [ebp - 0x24]
+push eax
+lea eax, [ebp - 0x28]
+push eax
+movzx eax, word [ebp - 0x40]
+push dword [ebp + 0x28]
+push eax
+lea eax, [ebp - 0x2c]
+push eax
+push ebx
+lea eax, [ebp - 0x2e]
+push eax
+movzx eax, byte [ebp - 0x3c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push eax
+push dword [ebp - 0x50]
+push esi
+call fcn_0000a7cf ; call 0xa7cf
+add esp, 0x50
+mov edi, eax
+mov eax, dword [ebp + 0x24]
+cmp byte [eax + 0x12], 1
+jne near loc_0000b689 ; jne 0xb689
+cmp byte [eax + 0x18], 1
+jne short loc_0000b610 ; jne 0xb610
+mov ecx, dword [ebp + 0x24]
+mov eax, dword [ebp - 0x2c]
+movzx edx, word [ecx + 0x1a]
+xor ax, ax
+or eax, edx
+movzx edx, byte [ecx + 0x19]
+or ah, 0x80
+shl edx, 0xa
+or eax, edx
+mov dword [ebp - 0x2c], eax
+
+loc_0000b610:
+mov eax, dword [ebp + 0x24]
+cmp byte [eax + 0x1c], 1
+jne short loc_0000b63a ; jne 0xb63a
+mov ecx, dword [ebp + 0x24]
+movzx eax, word [ebp - 0x2c]
+movzx edx, byte [ecx + 0x1d]
+or eax, 0x80000000
+shl edx, 0x1a
+or eax, edx
+movzx edx, word [ecx + 0x1e]
+shl edx, 0x10
+or eax, edx
+mov dword [ebp - 0x2c], eax
+
+loc_0000b63a:
+mov eax, dword [ebp - 0x2c]
+test eax, eax
+je short loc_0000b689 ; je 0xb689
+push edx
+push edx
+push eax
+lea eax, [esi + 0x400]
+push eax
+call fcn_00017e8f ; call 0x17e8f
+mov eax, dword [ebp + 0x24]
+pop ecx
+mov ecx, dword [ebp + 0x24]
+pop ebx
+cmp byte [eax + 0x18], 1
+sbb eax, eax
+add eax, 3
+mov edx, eax
+and edx, 0xfffffffd
+cmp byte [ecx + 0x1c], 0
+cmove eax, edx
+mov edx, eax
+or edx, 4
+cmp byte [ecx + 0x13], 1
+cmove eax, edx
+push eax
+lea eax, [esi + 0x404]
+push eax
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+
+loc_0000b689:
+cmp dword [ebp - 0x44], 2
+jne near loc_0000b882 ; jne 0xb882
+mov eax, dword [ebp + 0x28]
+cmp byte [eax], 0
+je near loc_0000b73b ; je 0xb73b
+push eax
+mov eax, dword [ebp - 0x28]
+movzx edx, word [ebp - 0x40]
+shl eax, 8
+add edx, esi
+push eax
+lea ebx, [edx + 8]
+push 0xffff00ff
+push ebx
+mov dword [ebp - 0x60], edx
+call fcn_00018b68 ; call 0x18b68
+mov eax, dword [ebp - 0x24]
+add esp, 0xc
+mov edx, dword [ebp - 0x60]
+shl eax, 3
+or eax, dword [ebp - 0x20]
+add edx, 0xc
+push eax
+push 0xffffff04
+push edx
+call fcn_00018b68 ; call 0x18b68
+add esp, 0xc
+push 0x40a00000
+push 0x1c00ffff
+push ebx
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+test byte [ebp - 0x2e], 2
+je short loc_0000b711 ; je 0xb711
+cmp byte [ebp - 0x31], 0
+je short loc_0000b711 ; je 0xb711
+push ecx
+push ecx
+push 1
+lea eax, [esi + 0x420]
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+
+loc_0000b711:
+mov eax, dword [ebp + 0x24]
+mov al, byte [eax + 0x11]
+cmp al, 1
+je short loc_0000b729 ; je 0xb729
+cmp al, 2
+setne al
+movzx eax, al
+lea eax, [eax + eax + 0xd]
+jmp short loc_0000b72e ; jmp 0xb72e
+
+loc_0000b729:
+mov eax, 0xe
+
+loc_0000b72e:
+push edx
+push eax
+push 0xffffffffffffffe0
+push ebx
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_0000b73b:
+test byte [ebp - 0x2e], 2
+je near loc_0000b882 ; je 0xb882
+cmp byte [ebp - 0x31], 0
+je near loc_0000b882 ; je 0xb882
+mov eax, dword [ebp + 0x28]
+cmp byte [eax], 0
+je short loc_0000b76d ; je 0xb76d
+push eax
+push eax
+push 0xfffdffff
+lea eax, [esi + 0x420]
+push eax
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+
+loc_0000b76d:
+push ebx
+push ebx
+push 0x20000000
+lea eax, [esi + 0x420]
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+cmp byte [ebp - 0x68], 0
+je near loc_0000b882 ; je 0xb882
+cmp byte [ebp - 0x6c], 0
+je near loc_0000b882 ; je 0xb882
+mov edi, dword [ebp - 0x48]
+push eax
+push eax
+push 0
+push edi
+call fcn_0001c39f ; call 0x1c39f
+pop edx
+pop ecx
+lea edx, [ebp - 0x2f]
+push edx
+sub eax, 0x20
+lea edx, [ebp - 0x1c]
+movzx eax, al
+push edx
+push eax
+push 4
+push 0xe00000e0
+push edi
+call fcn_00009ecd ; call 0x9ecd
+add esp, 0x20
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0000b809 ; je 0xb809
+test ebx, ebx
+jns short loc_0000b809 ; jns 0xb809
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000b7f1 ; je 0xb7f1
+push edi
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000b7f1:
+push ebx
+push ref_000206f4 ; push 0x206f4
+push 0x6b4
+push ref_00022106 ; push 0x22106
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000b809:
+mov edi, dword [ebp - 0x48]
+push eax
+push eax
+push 0
+push edi
+or dword [ebp - 0x1c], 0x4000
+call fcn_0001c39f ; call 0x1c39f
+pop edx
+pop ecx
+lea edx, [ebp - 0x2f]
+push edx
+sub eax, 0x20
+lea edx, [ebp - 0x1c]
+movzx eax, al
+push edx
+push eax
+push 5
+push 0xe00000e0
+push edi
+call fcn_00009ecd ; call 0x9ecd
+add esp, 0x20
+mov edi, eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0000b882 ; je 0xb882
+test edi, edi
+jns short loc_0000b882 ; jns 0xb882
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000b86a ; je 0xb86a
+push eax
+push edi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000b86a:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x6be
+push ref_00022106 ; push 0x22106
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000b882:
+cmp byte [ebp - 0x70], 1
+jne short loc_0000b8a2 ; jne 0xb8a2
+push eax
+movzx eax, word [ebp - 0x2e]
+push eax
+mov eax, dword [ebp - 0x4c]
+push 0xfffc
+add eax, 0x10
+push eax
+call fcn_00018981 ; call 0x18981
+add esp, 0x10
+
+loc_0000b8a2:
+cmp byte [ebp - 0x30], 0
+je short loc_0000b8bf ; je 0xb8bf
+push eax
+push 0x18
+push 0xe3
+lea eax, [esi + 0xd4]
+push eax
+call fcn_0001878a ; call 0x1878a
+add esp, 0x10
+
+loc_0000b8bf:
+cmp byte [ebp - 0x3c], 0
+je short loc_0000b917 ; je 0xb917
+test byte [ebp - 0x58], 0x40
+je short loc_0000b917 ; je 0xb917
+movzx eax, byte [ebp - 0x5c]
+push ebx
+push ebx
+push eax
+push dword [ebp + 0x38]
+lea eax, [ebp - 0x31]
+push eax
+lea eax, [ebp - 0x30]
+push eax
+push dword [ebp + 0x24]
+lea eax, [ebp - 0x20]
+push eax
+lea eax, [ebp - 0x24]
+push eax
+lea eax, [ebp - 0x28]
+push eax
+movzx eax, word [ebp - 0x40]
+push dword [ebp + 0x28]
+push eax
+lea eax, [ebp - 0x2c]
+push eax
+push 2
+lea eax, [ebp - 0x2e]
+push eax
+movzx eax, byte [ebp - 0x3c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push eax
+push dword [ebp - 0x50]
+push esi
+call fcn_0000a7cf ; call 0xa7cf
+add esp, 0x50
+mov edi, eax
+
+loc_0000b917:
+cmp byte [ebp - 0x51], 0
+jne short loc_0000b930 ; jne 0xb930
+push ecx
+push ecx
+push 0xff0000ff
+lea eax, [esi + 0x18]
+push eax
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+
+loc_0000b930:
+mov ebx, edi
+test edi, edi
+js short loc_0000b969 ; js 0xb969
+cmp word [ebp - 0x2e], 3
+jne short loc_0000b969 ; jne 0xb969
+cmp dword [ebp - 0x44], 2
+lea ebx, [esi + 0xe8]
+jne short loc_0000b95a ; jne 0xb95a
+push edx
+push 8
+push 0xf3
+push ebx
+call fcn_0001878a ; call 0x1878a
+add esp, 0x10
+
+loc_0000b95a:
+push eax
+push eax
+push 2
+push ebx
+mov ebx, edi
+call fcn_00018730 ; call 0x18730
+add esp, 0x10
+
+loc_0000b969:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000b973:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x50
+movzx edi, byte [ebp + 0x10]
+movzx edx, byte [ebp + 0xc]
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0x14]
+mov ebx, dword [ebp + 0x18]
+push edi
+push edx
+mov ecx, esi
+mov byte [ebp - 0x2d], al
+movzx eax, al
+push eax
+mov byte [ebp - 0x1d], cl
+mov dword [ebp - 0x24], edi
+mov dword [ebp - 0x28], edx
+mov byte [ebp - 0x1f], bl
+mov dword [ebp - 0x1c], eax
+call fcn_00016c9a ; call 0x16c9a
+mov edi, eax
+lea eax, [eax + 0x19]
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x1e], al
+test al, al
+jne short loc_0000b9eb ; jne 0xb9eb
+mov eax, esi
+movzx edx, bl
+movzx eax, al
+shl eax, 8
+or eax, dword [ebp - 0x1c]
+shl edx, 0x10
+push ecx
+or eax, edx
+push eax
+push 0xff000000
+lea eax, [edi + 0x18]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+jmp short loc_0000ba03 ; jmp 0xba03
+
+loc_0000b9eb:
+sub esp, 0xc
+lea eax, [edi + 0x1a]
+push eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x1f], al
+mov al, byte [ebp - 0x1e]
+mov byte [ebp - 0x1d], al
+
+loc_0000ba03:
+push 0x10
+push dword [ebp - 0x24]
+push dword [ebp - 0x28]
+push dword [ebp - 0x1c]
+call fcn_00009fd5 ; call 0x9fd5
+movzx eax, al
+lea eax, [edi + eax + 2]
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+and eax, 0xf0
+sar eax, 4
+cmp al, 5
+jne short loc_0000ba55 ; jne 0xba55
+sub esp, 0xc
+lea eax, [edi + 0xe]
+push eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0x7f
+je short loc_0000ba55 ; je 0xba55
+
+loc_0000ba44:
+mov al, byte [ebp - 0x1d]
+xor ebx, ebx
+inc eax
+movzx eax, al
+mov dword [ebp - 0x34], eax
+jmp near loc_0000bb58 ; jmp 0xbb58
+
+loc_0000ba55:
+push eax
+movzx eax, byte [ebp - 0x1d]
+mov ebx, 0x186a0
+push 0
+push 0
+push eax
+call fcn_00016c9a ; call 0x16c9a
+mov esi, eax
+pop eax
+pop edx
+push 0
+push esi
+call fcn_00017da5 ; call 0x17da5
+add esp, 0x10
+
+loc_0000ba78:
+sub esp, 0xc
+push esi
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_0000ba44 ; jne 0xba44
+sub esp, 0xc
+push 0xa
+call fcn_0001bb03 ; call 0x1bb03
+add esp, 0x10
+dec ebx
+jne short loc_0000ba78 ; jne 0xba78
+jmp near loc_0000bc26 ; jmp 0xbc26
+
+loc_0000ba9d:
+push 0
+push dword [ebp + 0x1c]
+push ebx
+push esi
+call fcn_0000a55f ; call 0xa55f
+add esp, 0x10
+cmp byte [ebp - 0x2d], 0
+jne short loc_0000bac8 ; jne 0xbac8
+sub esp, 0xc
+push ebx
+push esi
+push dword [ebp - 0x24]
+push dword [ebp - 0x28]
+push dword [ebp - 0x1c]
+call fcn_0000a647 ; call 0xa647
+add esp, 0x20
+
+loc_0000bac8:
+push 0x10
+push 0
+push ebx
+push esi
+call fcn_00009fd5 ; call 0x9fd5
+movzx edx, al
+mov cl, al
+add edx, dword [ebp - 0x2c]
+mov dword [ebp - 0x4c], ecx
+lea eax, [edx + 2]
+mov dword [ebp - 0x38], edx
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+mov word [ebp - 0x48], ax
+mov eax, dword [ebp - 0x2c]
+add eax, 0xb
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov edx, dword [ebp - 0x38]
+mov ecx, dword [ebp - 0x4c]
+cmp al, 6
+je short loc_0000bb7e ; je 0xbb7e
+
+loc_0000bb0b:
+push edx
+push edx
+push 0
+push ebx
+push esi
+push dword [ebp - 0x24]
+push dword [ebp - 0x28]
+push dword [ebp - 0x1c]
+call fcn_0000a0f2 ; call 0xa0f2
+add esp, 0x14
+push ebx
+push esi
+push dword [ebp - 0x24]
+push dword [ebp - 0x28]
+push dword [ebp - 0x1c]
+call fcn_0000a220 ; call 0xa220
+add esp, 0x1c
+push dword [ebp - 0x24]
+push ebx
+push esi
+call fcn_0000a3ea ; call 0xa3ea
+push 1
+push dword [ebp + 0x1c]
+push ebx
+push esi
+call fcn_0000a55f ; call 0xa55f
+add esp, 0x20
+
+loc_0000bb4e:
+inc ebx
+cmp ebx, 0x20
+je near loc_0000bc09 ; je 0xbc09
+
+loc_0000bb58:
+movzx esi, byte [ebp - 0x1d]
+push eax
+push 0
+push ebx
+push esi
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+mov dword [ebp - 0x2c], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne near loc_0000ba9d ; jne 0xba9d
+jmp short loc_0000bb4e ; jmp 0xbb4e
+
+loc_0000bb7e:
+test cl, cl
+je short loc_0000bb0b ; je 0xbb0b
+mov ecx, dword [ebp - 0x48]
+sub esp, 0xc
+add edx, 0x1a
+push edx
+and ecx, 0xf0
+sar ecx, 4
+mov dword [ebp - 0x2c], ecx
+call fcn_00017dc2 ; call 0x17dc2
+mov ecx, dword [ebp - 0x2c]
+add esp, 0x10
+cmp cl, 5
+je short loc_0000bbb9 ; je 0xbbb9
+cmp cl, 6
+jne near loc_0000bb0b ; jne 0xbb0b
+test al, 0x40
+je near loc_0000bb0b ; je 0xbb0b
+
+loc_0000bbb9:
+mov al, byte [ebp - 0x1d]
+cmp byte [ebp - 0x1f], al
+jbe short loc_0000bbdf ; jbe 0xbbdf
+push eax
+push eax
+movzx eax, byte [ebp - 0x1f]
+push dword [ebp + 0x1c]
+push eax
+push dword [ebp - 0x34]
+push 0
+push ebx
+push esi
+call fcn_0000b973 ; call 0xb973
+add esp, 0x20
+jmp near loc_0000bb0b ; jmp 0xbb0b
+
+loc_0000bbdf:
+call fcn_00015480 ; call 0x15480
+test al, al
+je near loc_0000bb0b ; je 0xbb0b
+push ecx
+push ref_00022281 ; push 0x22281
+push 0x7aa
+push ref_00022106 ; push 0x22106
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+jmp near loc_0000bb0b ; jmp 0xbb0b
+
+loc_0000bc09:
+xor bl, bl
+cmp byte [ebp - 0x1e], 0
+jne short loc_0000bc44 ; jne 0xbc44
+push eax
+push eax
+push 0xff000000
+lea eax, [edi + 0x18]
+push eax
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+jmp short loc_0000bc44 ; jmp 0xbc44
+
+loc_0000bc26:
+cmp byte [ebp - 0x1e], 0
+jne short loc_0000bc3f ; jne 0xbc3f
+push eax
+push eax
+push 0xff000000
+lea eax, [edi + 0x18]
+push eax
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+
+loc_0000bc3f:
+mov ebx, 0x8000000e
+
+loc_0000bc44:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000bc4e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x30
+mov eax, dword [ebp + 0x14]
+movzx edi, byte [ebp + 0x10]
+movzx esi, byte [ebp + 0xc]
+movzx ebx, byte [ebp + 8]
+mov dword [ebp - 0x30], eax
+mov eax, dword [ebp + 0x18]
+push edi
+push esi
+push ebx
+mov dword [ebp - 0x34], eax
+call fcn_00016c9a ; call 0x16c9a
+mov dword [ebp - 0x2c], eax
+add eax, 0x5a
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+mov edx, 0x8000000e
+test al, 0x40
+je near loc_0000bd2e ; je 0xbd2e
+push 0x10
+push edi
+push esi
+push ebx
+call fcn_00009fd5 ; call 0x9fd5
+add esp, 0x10
+test al, al
+jne short loc_0000bcd4 ; jne 0xbcd4
+call fcn_00015480 ; call 0x15480
+mov edx, 0x80000003
+test al, al
+je short loc_0000bd2e ; je 0xbd2e
+push ecx
+push ref_00022281 ; push 0x22281
+push 0x81d
+push ref_00022106 ; push 0x22106
+mov dword [ebp - 0x2c], edx
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+mov edx, dword [ebp - 0x2c]
+jmp short loc_0000bd2e ; jmp 0xbd2e
+
+loc_0000bcd4:
+movzx eax, al
+sub esp, 0xc
+add eax, dword [ebp - 0x2c]
+mov dword [ebp - 0x2c], eax
+add eax, 4
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+and eax, 7
+mov word [ebp - 0x1a], ax
+pop eax
+pop edx
+lea eax, [ebp - 0x1a]
+push eax
+movzx eax, byte [ebp - 0x34]
+push eax
+movzx eax, byte [ebp - 0x30]
+push eax
+push edi
+push esi
+push ebx
+call fcn_0000b973 ; call 0xb973
+mov cx, word [ebp - 0x1a]
+add esp, 0x1c
+shl ecx, 5
+movzx ecx, cx
+mov ebx, eax
+mov eax, dword [ebp - 0x2c]
+push ecx
+push 0xff1f
+add eax, 8
+push eax
+call fcn_00018981 ; call 0x18981
+add esp, 0x10
+mov edx, ebx
+
+loc_0000bd2e:
+lea esp, [ebp - 0xc]
+mov eax, edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000bd38:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000bd5a ; je 0xbd5a
+push ebx
+push ebx
+push ref_00022293 ; push 0x22293
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000bd5a:
+push ecx
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov ebx, eax
+and ebx, 0xffffc000
+cmp dword [ebp + 8], 1
+je short loc_0000bdc1 ; je 0xbdc1
+jb short loc_0000bd90 ; jb 0xbd90
+cmp dword [ebp + 8], 2
+jne short loc_0000bdf6 ; jne 0xbdf6
+push edx
+push edx
+jmp short loc_0000bde5 ; jmp 0xbde5
+
+loc_0000bd90:
+sub esp, 0xc
+lea eax, [ebx + 0x38f4]
+push eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 1
+jne short loc_0000bdad ; jne 0xbdad
+mov word [esi], 0
+jmp short loc_0000be10 ; jmp 0xbe10
+
+loc_0000bdad:
+sub esp, 0xc
+add ebx, 0x38f8
+push ebx
+call fcn_00017dc2 ; call 0x17dc2
+mov word [esi], ax
+jmp short loc_0000bdf3 ; jmp 0xbdf3
+
+loc_0000bdc1:
+push ecx
+push ecx
+movzx eax, word [esi]
+push eax
+lea eax, [ebx + 0x38f8]
+push eax
+call fcn_00017e04 ; call 0x17e04
+pop esi
+pop eax
+lea eax, [ebx + 0x38f4]
+push 1
+push eax
+call fcn_00018730 ; call 0x18730
+pop eax
+pop edx
+
+loc_0000bde5:
+push 1
+add ebx, 0x38f0
+push ebx
+call fcn_00018730 ; call 0x18730
+
+loc_0000bdf3:
+add esp, 0x10
+
+loc_0000bdf6:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000be10 ; je 0xbe10
+push eax
+push eax
+push ref_000222ad ; push 0x222ad
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000be10:
+lea esp, [ebp - 8]
+xor eax, eax
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000be19:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0xc
+mov eax, dword [ebp + 8]
+push dword [ebp + 0xc]
+lea ebx, [eax + 0x3418]
+push ebx
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+mov dword [ebp + 8], ebx
+mov ebx, dword [ebp - 4]
+leave
+jmp near fcn_00017e4e ; jmp 0x17e4e
+
+fcn_0000be41:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000be67 ; je 0xbe67
+push eax
+push eax
+push ref_000222c5 ; push 0x222c5
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000be67:
+lea eax, [ebp - 0x1c]
+push eax
+push 0
+push 0
+push ref_0002911c ; push 0x2911c
+call fcn_0001975d ; call 0x1975d
+add esp, 0x10
+test eax, eax
+jne short loc_0000beea ; jne 0xbeea
+mov edx, dword [ebp - 0x1c]
+xor ebx, ebx
+xor esi, esi
+
+loc_0000be87:
+lea eax, [ebx + 0x18]
+cmp word [edx + eax - 0x16], 0
+je short loc_0000be97 ; je 0xbe97
+inc esi
+mov ebx, eax
+jmp short loc_0000be87 ; jmp 0xbe87
+
+loc_0000be97:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000beb1 ; je 0xbeb1
+push eax
+push esi
+push ref_000222e3 ; push 0x222e3
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000beb1:
+push eax
+push ebx
+push dword [ebp - 0x1c]
+push ref_00028ff8 ; push 0x28ff8
+call fcn_0001936c ; call 0x1936c
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000beea ; je 0xbeea
+test ebx, ebx
+jne short loc_0000beea ; jne 0xbeea
+push eax
+push ref_00022314 ; push 0x22314
+push 0x8f5
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000beea:
+xor ebx, ebx
+
+loc_0000beec:
+lea eax, [ebp - 0x20]
+push eax
+push 0
+push ebx
+push ref_000291dc ; push 0x291dc
+call fcn_0001975d ; call 0x1975d
+add esp, 0x10
+test eax, eax
+je short loc_0000bf36 ; je 0xbf36
+call fcn_00015480 ; call 0x15480
+test al, al
+je near loc_0000c0a1 ; je 0xc0a1
+test ebx, ebx
+jne near loc_0000c0a1 ; jne 0xc0a1
+push eax
+push ref_0002234a ; push 0x2234a
+push 0x908
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+jmp near loc_0000c0a1 ; jmp 0xc0a1
+
+loc_0000bf36:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000bf57 ; je 0xbf57
+mov eax, dword [ebp - 0x20]
+push edi
+movzx eax, byte [eax + 1]
+push eax
+push ref_00022355 ; push 0x22355
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000bf57:
+push esi
+push 0x5ac
+push dword [ebp - 0x20]
+push ref_00029008 ; push 0x29008
+call fcn_0001936c ; call 0x1936c
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000bf94 ; je 0xbf94
+test esi, esi
+jne short loc_0000bf94 ; jne 0xbf94
+push ecx
+push ref_00022314 ; push 0x22314
+push 0x90e
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000bf94:
+push eax
+mov eax, dword [ebp - 0x20]
+push 0
+push 0x1f
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov esi, eax
+and esi, 0xffffc000
+lea eax, [esi + 0x3418]
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov dword [ebp - 0x24], eax
+pop eax
+pop edx
+lea eax, [ebp - 0x24]
+push eax
+push dword [ebp - 0x20]
+call fcn_0001227f ; call 0x1227f
+mov edi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000c021 ; je 0xc021
+test edi, edi
+jns short loc_0000c021 ; jns 0xc021
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000c009 ; je 0xc009
+push eax
+push edi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000c009:
+push edi
+push ref_000206f4 ; push 0x206f4
+push 0x91d
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000c021:
+mov eax, dword [ebp - 0x20]
+cmp byte [eax + 0x370], 0
+je short loc_0000c079 ; je 0xc079
+push edx
+push edx
+push 0
+push eax
+call fcn_00012e28 ; call 0x12e28
+pop ecx
+push dword [ebp - 0x20]
+call fcn_00012eb2 ; call 0x12eb2
+add esp, 0x10
+test eax, eax
+jns short loc_0000c08d ; jns 0xc08d
+mov eax, dword [ebp - 0x20]
+cmp byte [eax + 0x370], 2
+jne short loc_0000c08d ; jne 0xc08d
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000c06d ; je 0xc06d
+push eax
+push eax
+push ref_0002238a ; push 0x2238a
+push 2
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000c06d:
+push edi
+push edi
+push 0xc0
+push dword [ebp - 0x20]
+jmp short loc_0000c081 ; jmp 0xc081
+
+loc_0000c079:
+push ecx
+push ecx
+push 0xc0
+push eax
+
+loc_0000c081:
+call fcn_00012e28 ; call 0x12e28
+add esp, 0x10
+or dword [ebp - 0x24], 0x10
+
+loc_0000c08d:
+push edx
+inc ebx
+push edx
+push dword [ebp - 0x24]
+push esi
+call fcn_0000be19 ; call 0xbe19
+add esp, 0x10
+jmp near loc_0000beec ; jmp 0xbeec
+
+loc_0000c0a1:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000c0be ; je 0xc0be
+push eax
+push eax
+push ref_000223be ; push 0x223be
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000c0be:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000c0c8:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x2c
+mov eax, dword [ebp + 0x18]
+mov dword [ebp - 0x28], eax
+call fcn_0001bbfd ; call 0x1bbfd
+sub esp, 0xc
+mov edi, eax
+mov dword [ebp - 0x20], eax
+mov eax, dword [ebp + 0x10]
+add eax, 0x410
+push eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x19], al
+mov eax, edi
+dec eax
+mov dword [ebp - 0x24], eax
+cmp eax, 0xf
+ja short loc_0000c128 ; ja 0xc128
+mov cl, byte [ebp - 0x24]
+mov eax, 1
+xor esi, esi
+mov edx, ref_0002793c ; mov edx, 0x2793c
+shl eax, cl
+and eax, 0x8007
+cmovne esi, edx
+cmp eax, 1
+sbb ebx, ebx
+not ebx
+and ebx, 0x49
+jmp short loc_0000c12c ; jmp 0xc12c
+
+loc_0000c128:
+xor esi, esi
+xor ebx, ebx
+
+loc_0000c12c:
+add esi, 8
+mov word [ebp - 0x2c], 0
+
+loc_0000c135:
+cmp word [ebp - 0x2c], bx
+je short loc_0000c19b ; je 0xc19b
+push dword [esi]
+push dword [esi - 4]
+push dword [esi - 8]
+push dword [ebp + 0x14]
+call fcn_00009dc2 ; call 0x9dc2
+mov edi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000c192 ; je 0xc192
+test edi, edi
+jns short loc_0000c192 ; jns 0xc192
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000c17a ; je 0xc17a
+push eax
+push edi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000c17a:
+push ecx
+push ref_000206f4 ; push 0x206f4
+push 0x147
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000c192:
+inc word [ebp - 0x2c]
+add esi, 0xc
+jmp short loc_0000c135 ; jmp 0xc135
+
+loc_0000c19b:
+mov eax, dword [ebp - 0x20]
+cmp eax, 0x22
+ja short loc_0000c1b9 ; ja 0xc1b9
+cmp eax, 0x20
+jae short loc_0000c1c6 ; jae 0xc1c6
+cmp eax, 1
+jb short loc_0000c1de ; jb 0xc1de
+cmp eax, 3
+jbe short loc_0000c1d2 ; jbe 0xc1d2
+cmp eax, 0x10
+je short loc_0000c1d2 ; je 0xc1d2
+jmp short loc_0000c1de ; jmp 0xc1de
+
+loc_0000c1b9:
+mov eax, dword [ebp - 0x20]
+sub eax, 0x41
+cmp eax, 2
+jbe short loc_0000c1e4 ; jbe 0xc1e4
+jmp short loc_0000c1de ; jmp 0xc1de
+
+loc_0000c1c6:
+mov edx, ref_00028114 ; mov edx, 0x28114
+mov eax, 0x49
+jmp short loc_0000c1ee ; jmp 0xc1ee
+
+loc_0000c1d2:
+mov edx, ref_00027ca8 ; mov edx, 0x27ca8
+mov eax, 0x24
+jmp short loc_0000c1ee ; jmp 0xc1ee
+
+loc_0000c1de:
+xor edx, edx
+xor eax, eax
+jmp short loc_0000c1ee ; jmp 0xc1ee
+
+loc_0000c1e4:
+mov edx, ref_00028898 ; mov edx, 0x28898
+mov eax, 0x4d
+
+loc_0000c1ee:
+imul eax, eax, 0xc
+mov esi, edx
+add eax, edx
+mov dword [ebp - 0x30], eax
+mov al, byte [ebp - 0x19]
+mov bl, al
+and eax, 0x10
+and ebx, 0x20
+mov byte [ebp - 0x2c], al
+
+loc_0000c206:
+cmp esi, dword [ebp - 0x30]
+je near loc_0000c2ca ; je 0xc2ca
+cmp dword [ebp + 0xc], 2
+jne short loc_0000c246 ; jne 0xc246
+mov eax, dword [esi]
+and eax, 0xfe00
+cmp eax, 0x2000
+je short loc_0000c25a ; je 0xc25a
+cmp eax, 0x2200
+je short loc_0000c267 ; je 0xc267
+cmp eax, 0x2400
+jne short loc_0000c237 ; jne 0xc237
+test byte [ebp - 0x19], 0x40
+jmp short loc_0000c269 ; jmp 0xc269
+
+loc_0000c237:
+cmp eax, 0x2600
+jne short loc_0000c26b ; jne 0xc26b
+cmp byte [ebp - 0x19], 0
+jns short loc_0000c26b ; jns 0xc26b
+jmp short loc_0000c2c2 ; jmp 0xc2c2
+
+loc_0000c246:
+cmp dword [ebp + 0xc], 1
+jne short loc_0000c26b ; jne 0xc26b
+mov eax, dword [esi]
+and eax, 0xfe00
+cmp eax, 0x2000
+jne short loc_0000c260 ; jne 0xc260
+
+loc_0000c25a:
+cmp byte [ebp - 0x2c], 0
+jmp short loc_0000c269 ; jmp 0xc269
+
+loc_0000c260:
+cmp eax, 0x2200
+jne short loc_0000c26b ; jne 0xc26b
+
+loc_0000c267:
+test bl, bl
+
+loc_0000c269:
+jne short loc_0000c2c2 ; jne 0xc2c2
+
+loc_0000c26b:
+push dword [esi + 8]
+push dword [esi + 4]
+push dword [esi]
+push dword [ebp + 0x14]
+call fcn_00009dc2 ; call 0x9dc2
+mov edi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000c2c2 ; je 0xc2c2
+test edi, edi
+jns short loc_0000c2c2 ; jns 0xc2c2
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000c2aa ; je 0xc2aa
+push edx
+push edi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000c2aa:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x178
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000c2c2:
+add esi, 0xc
+jmp near loc_0000c206 ; jmp 0xc206
+
+loc_0000c2ca:
+mov ecx, dword [ebp - 0x28]
+mov eax, ecx
+and eax, 0xfffffffb
+cmp ax, 0x8c4b
+je short loc_0000c312 ; je 0xc312
+mov eax, ecx
+and eax, 0xfffffff7
+cmp ax, 0x8c41
+je short loc_0000c312 ; je 0xc312
+mov eax, ecx
+add ax, 0x63bf
+cmp ax, 6
+jbe short loc_0000c312 ; jbe 0xc312
+cmp word [ebp - 0x28], 0x8cc5
+je short loc_0000c312 ; je 0xc312
+mov eax, ecx
+and eax, 0xfffffffd
+cmp ax, 0x8cc1
+je short loc_0000c312 ; je 0xc312
+mov eax, ecx
+add ax, 0x633f
+cmp ax, 0xa
+ja near loc_0000c4df ; ja 0xc4df
+
+loc_0000c312:
+cmp dword [ebp - 0x24], 0xf
+ja short loc_0000c33d ; ja 0xc33d
+mov cl, byte [ebp - 0x24]
+mov eax, 1
+xor esi, esi
+mov edx, ref_000275f4 ; mov edx, 0x275f4
+shl eax, cl
+and eax, 0x8007
+cmovne esi, edx
+cmp eax, 1
+sbb ebx, ebx
+not ebx
+and ebx, 4
+jmp short loc_0000c341 ; jmp 0xc341
+
+loc_0000c33d:
+xor esi, esi
+xor ebx, ebx
+
+loc_0000c341:
+add esi, 8
+mov word [ebp - 0x28], 0
+
+loc_0000c34a:
+cmp word [ebp - 0x28], bx
+je short loc_0000c3b0 ; je 0xc3b0
+push dword [esi]
+push dword [esi - 4]
+push dword [esi - 8]
+push dword [ebp + 0x14]
+call fcn_00009dc2 ; call 0x9dc2
+mov edi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000c3a7 ; je 0xc3a7
+test edi, edi
+jns short loc_0000c3a7 ; jns 0xc3a7
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000c38f ; je 0xc38f
+push eax
+push edi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000c38f:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x19b
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000c3a7:
+inc word [ebp - 0x28]
+add esi, 0xc
+jmp short loc_0000c34a ; jmp 0xc34a
+
+loc_0000c3b0:
+mov eax, dword [ebp - 0x20]
+cmp eax, 0x22
+ja short loc_0000c3ce ; ja 0xc3ce
+cmp eax, 0x20
+jae short loc_0000c3db ; jae 0xc3db
+cmp eax, 1
+jb short loc_0000c3f3 ; jb 0xc3f3
+cmp eax, 3
+jbe short loc_0000c3e7 ; jbe 0xc3e7
+cmp eax, 0x10
+je short loc_0000c3e7 ; je 0xc3e7
+jmp short loc_0000c3f3 ; jmp 0xc3f3
+
+loc_0000c3ce:
+mov eax, dword [ebp - 0x20]
+sub eax, 0x41
+cmp eax, 2
+jbe short loc_0000c3f9 ; jbe 0xc3f9
+jmp short loc_0000c3f3 ; jmp 0xc3f3
+
+loc_0000c3db:
+mov edx, ref_0002809c ; mov edx, 0x2809c
+mov eax, 4
+jmp short loc_0000c403 ; jmp 0xc403
+
+loc_0000c3e7:
+mov edx, ref_00027624 ; mov edx, 0x27624
+mov eax, 2
+jmp short loc_0000c403 ; jmp 0xc403
+
+loc_0000c3f3:
+xor edx, edx
+xor eax, eax
+jmp short loc_0000c403 ; jmp 0xc403
+
+loc_0000c3f9:
+mov edx, ref_00028898 ; mov edx, 0x28898
+mov eax, 0x4d
+
+loc_0000c403:
+imul eax, eax, 0xc
+mov esi, edx
+add eax, edx
+mov dword [ebp - 0x2c], eax
+mov al, byte [ebp - 0x19]
+mov bl, al
+and eax, 0x10
+and ebx, 0x20
+mov byte [ebp - 0x28], al
+
+loc_0000c41b:
+cmp esi, dword [ebp - 0x2c]
+je near loc_0000c569 ; je 0xc569
+cmp dword [ebp + 0xc], 2
+jne short loc_0000c45b ; jne 0xc45b
+mov eax, dword [esi]
+and eax, 0xfe00
+cmp eax, 0x2000
+je short loc_0000c46f ; je 0xc46f
+cmp eax, 0x2200
+je short loc_0000c47c ; je 0xc47c
+cmp eax, 0x2400
+jne short loc_0000c44c ; jne 0xc44c
+test byte [ebp - 0x19], 0x40
+jmp short loc_0000c47e ; jmp 0xc47e
+
+loc_0000c44c:
+cmp eax, 0x2600
+jne short loc_0000c480 ; jne 0xc480
+cmp byte [ebp - 0x19], 0
+jns short loc_0000c480 ; jns 0xc480
+jmp short loc_0000c4d7 ; jmp 0xc4d7
+
+loc_0000c45b:
+cmp dword [ebp + 0xc], 1
+jne short loc_0000c480 ; jne 0xc480
+mov eax, dword [esi]
+and eax, 0xfe00
+cmp eax, 0x2000
+jne short loc_0000c475 ; jne 0xc475
+
+loc_0000c46f:
+cmp byte [ebp - 0x28], 0
+jmp short loc_0000c47e ; jmp 0xc47e
+
+loc_0000c475:
+cmp eax, 0x2200
+jne short loc_0000c480 ; jne 0xc480
+
+loc_0000c47c:
+test bl, bl
+
+loc_0000c47e:
+jne short loc_0000c4d7 ; jne 0xc4d7
+
+loc_0000c480:
+push dword [esi + 8]
+push dword [esi + 4]
+push dword [esi]
+push dword [ebp + 0x14]
+call fcn_00009dc2 ; call 0x9dc2
+mov edi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000c4d7 ; je 0xc4d7
+test edi, edi
+jns short loc_0000c4d7 ; jns 0xc4d7
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000c4bf ; je 0xc4bf
+push eax
+push edi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000c4bf:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x1cc
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000c4d7:
+add esi, 0xc
+jmp near loc_0000c41b ; jmp 0xc41b
+
+loc_0000c4df:
+cmp dword [ebp - 0x24], 0xf
+ja near loc_0000c59b ; ja 0xc59b
+mov cl, byte [ebp - 0x24]
+mov eax, 1
+xor esi, esi
+mov edx, ref_000275ac ; mov edx, 0x275ac
+shl eax, cl
+and eax, 0x8007
+cmovne esi, edx
+cmp eax, 1
+sbb ebx, ebx
+not ebx
+and ebx, 4
+
+loc_0000c50c:
+add esi, 8
+mov word [ebp - 0x28], 0
+
+loc_0000c515:
+cmp word [ebp - 0x28], bx
+jne near loc_0000c5a4 ; jne 0xc5a4
+cmp dword [ebp - 0x20], 0x10
+je near loc_0000c616 ; je 0xc616
+mov eax, dword [ebp - 0x20]
+jbe near loc_0000c607 ; jbe 0xc607
+sub eax, 0x20
+cmp eax, 2
+ja near loc_0000c60d ; ja 0xc60d
+mov edx, ref_0002806c ; mov edx, 0x2806c
+mov eax, 4
+
+loc_0000c548:
+imul eax, eax, 0xc
+mov esi, edx
+add eax, edx
+mov dword [ebp - 0x2c], eax
+mov al, byte [ebp - 0x19]
+mov bl, al
+and eax, 0x10
+and ebx, 0x20
+mov byte [ebp - 0x28], al
+
+loc_0000c560:
+cmp esi, dword [ebp - 0x2c]
+jne near loc_0000c625 ; jne 0xc625
+
+loc_0000c569:
+cmp dword [ebp - 0x24], 0xf
+ja near loc_0000c6e0 ; ja 0xc6e0
+mov cl, byte [ebp - 0x24]
+mov eax, 1
+xor edi, edi
+mov edx, ref_00027444 ; mov edx, 0x27444
+shl eax, cl
+and eax, 0x8007
+cmovne edi, edx
+cmp eax, 1
+sbb eax, eax
+not eax
+and eax, 0x14
+jmp near loc_0000c6e4 ; jmp 0xc6e4
+
+loc_0000c59b:
+xor esi, esi
+xor ebx, ebx
+jmp near loc_0000c50c ; jmp 0xc50c
+
+loc_0000c5a4:
+push dword [esi]
+push dword [esi - 4]
+push dword [esi - 8]
+push dword [ebp + 0x14]
+call fcn_00009dc2 ; call 0x9dc2
+mov edi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000c5fb ; je 0xc5fb
+test edi, edi
+jns short loc_0000c5fb ; jns 0xc5fb
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000c5e3 ; je 0xc5e3
+push eax
+push edi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000c5e3:
+push edi
+push ref_000206f4 ; push 0x206f4
+push 0x1e8
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000c5fb:
+inc word [ebp - 0x28]
+add esi, 0xc
+jmp near loc_0000c515 ; jmp 0xc515
+
+loc_0000c607:
+dec eax
+cmp eax, 2
+jbe short loc_0000c616 ; jbe 0xc616
+
+loc_0000c60d:
+xor edx, edx
+xor eax, eax
+jmp near loc_0000c548 ; jmp 0xc548
+
+loc_0000c616:
+mov edx, ref_000275dc ; mov edx, 0x275dc
+mov eax, 2
+jmp near loc_0000c548 ; jmp 0xc548
+
+loc_0000c625:
+cmp dword [ebp + 0xc], 2
+jne short loc_0000c65c ; jne 0xc65c
+mov eax, dword [esi]
+and eax, 0xfe00
+cmp eax, 0x2000
+je short loc_0000c670 ; je 0xc670
+cmp eax, 0x2200
+je short loc_0000c67d ; je 0xc67d
+cmp eax, 0x2400
+jne short loc_0000c64d ; jne 0xc64d
+test byte [ebp - 0x19], 0x40
+jmp short loc_0000c67f ; jmp 0xc67f
+
+loc_0000c64d:
+cmp eax, 0x2600
+jne short loc_0000c681 ; jne 0xc681
+cmp byte [ebp - 0x19], 0
+jns short loc_0000c681 ; jns 0xc681
+jmp short loc_0000c6d8 ; jmp 0xc6d8
+
+loc_0000c65c:
+cmp dword [ebp + 0xc], 1
+jne short loc_0000c681 ; jne 0xc681
+mov eax, dword [esi]
+and eax, 0xfe00
+cmp eax, 0x2000
+jne short loc_0000c676 ; jne 0xc676
+
+loc_0000c670:
+cmp byte [ebp - 0x28], 0
+jmp short loc_0000c67f ; jmp 0xc67f
+
+loc_0000c676:
+cmp eax, 0x2200
+jne short loc_0000c681 ; jne 0xc681
+
+loc_0000c67d:
+test bl, bl
+
+loc_0000c67f:
+jne short loc_0000c6d8 ; jne 0xc6d8
+
+loc_0000c681:
+push dword [esi + 8]
+push dword [esi + 4]
+push dword [esi]
+push dword [ebp + 0x14]
+call fcn_00009dc2 ; call 0x9dc2
+mov edi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000c6d8 ; je 0xc6d8
+test edi, edi
+jns short loc_0000c6d8 ; jns 0xc6d8
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000c6c0 ; je 0xc6c0
+push ecx
+push edi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000c6c0:
+push edx
+push ref_000206f4 ; push 0x206f4
+push 0x213
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000c6d8:
+add esi, 0xc
+jmp near loc_0000c560 ; jmp 0xc560
+
+loc_0000c6e0:
+xor edi, edi
+xor eax, eax
+
+loc_0000c6e4:
+movzx eax, ax
+imul eax, eax, 0xc
+mov word [ebp - 0x24], 0
+lea eax, [edi + eax + 8]
+mov dword [ebp - 0x30], eax
+
+loc_0000c6f7:
+call fcn_0001c1e1 ; call 0x1c1e1
+mov edx, dword [ebp - 0x24]
+movzx eax, al
+cmp dx, ax
+jae near loc_0000c7ca ; jae 0xc7ca
+movzx eax, dx
+xor esi, esi
+imul eax, eax, 0x12
+add eax, dword [ebp + 8]
+mov dword [ebp - 0x28], eax
+
+loc_0000c719:
+mov eax, dword [ebp - 0x28]
+mov word [ebp - 0x34], si
+cmp byte [eax + esi*2 + 0x1e4], 1
+je short loc_0000c736 ; je 0xc736
+
+loc_0000c72a:
+inc esi
+cmp esi, 3
+jne short loc_0000c719 ; jne 0xc719
+inc word [ebp - 0x24]
+jmp short loc_0000c6f7 ; jmp 0xc6f7
+
+loc_0000c736:
+lea ebx, [edi + 8]
+
+loc_0000c739:
+cmp ebx, dword [ebp - 0x30]
+je short loc_0000c72a ; je 0xc72a
+mov eax, dword [ebp - 0x24]
+cmp word [ebx - 8], ax
+jne short loc_0000c7c2 ; jne 0xc7c2
+mov eax, dword [ebp - 0x34]
+cmp word [ebx - 6], ax
+jne short loc_0000c7c2 ; jne 0xc7c2
+mov eax, dword [ebp - 0x28]
+mov edx, dword [ebx]
+movzx ecx, byte [eax + esi*2 + 0x1e3]
+mov eax, edx
+not eax
+imul ecx, ecx, 0x1010101
+and eax, ecx
+push eax
+push edx
+push dword [ebx - 4]
+push dword [ebp + 0x14]
+call fcn_00009dc2 ; call 0x9dc2
+mov dword [ebp - 0x2c], eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000c7c2 ; je 0xc7c2
+cmp dword [ebp - 0x2c], 0
+jns short loc_0000c7c2 ; jns 0xc7c2
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000c7aa ; je 0xc7aa
+push eax
+push dword [ebp - 0x2c]
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000c7aa:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x234
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000c7c2:
+add ebx, 0xc
+jmp near loc_0000c739 ; jmp 0xc739
+
+loc_0000c7ca:
+mov eax, dword [ebp - 0x20]
+cmp eax, 0x22
+ja short loc_0000c7e8 ; ja 0xc7e8
+cmp eax, 0x20
+jae short loc_0000c7fa ; jae 0xc7fa
+cmp eax, 1
+jb short loc_0000c80d ; jb 0xc80d
+cmp eax, 3
+jbe short loc_0000c801 ; jbe 0xc801
+cmp eax, 0x10
+je short loc_0000c801 ; je 0xc801
+jmp short loc_0000c80d ; jmp 0xc80d
+
+loc_0000c7e8:
+mov eax, dword [ebp - 0x20]
+mov esi, ref_00028760 ; mov esi, 0x28760
+sub eax, 0x41
+cmp eax, 2
+jbe short loc_0000c813 ; jbe 0xc813
+jmp short loc_0000c80d ; jmp 0xc80d
+
+loc_0000c7fa:
+mov esi, ref_00027f7c ; mov esi, 0x27f7c
+jmp short loc_0000c813 ; jmp 0xc813
+
+loc_0000c801:
+mov esi, ref_00027534 ; mov esi, 0x27534
+mov eax, 0xa
+jmp short loc_0000c818 ; jmp 0xc818
+
+loc_0000c80d:
+xor esi, esi
+xor eax, eax
+jmp short loc_0000c818 ; jmp 0xc818
+
+loc_0000c813:
+mov eax, 0x14
+
+loc_0000c818:
+imul eax, eax, 0xc
+mov cl, byte [ebp - 0x19]
+mov word [ebp - 0x24], 0
+lea eax, [esi + eax + 4]
+mov dword [ebp - 0x34], eax
+mov al, cl
+and eax, 0x20
+mov byte [ebp - 0x2c], al
+mov al, cl
+and eax, 0x10
+mov byte [ebp - 0x30], al
+
+loc_0000c83b:
+call fcn_0001c1e1 ; call 0x1c1e1
+mov ecx, dword [ebp - 0x24]
+movzx eax, al
+cmp cx, ax
+jae near loc_0000c980 ; jae 0xc980
+movzx eax, cx
+imul eax, eax, 0x12
+add eax, dword [ebp + 8]
+mov dword [ebp - 0x20], 0
+mov dword [ebp - 0x28], eax
+
+loc_0000c862:
+mov eax, dword [ebp - 0x20]
+mov edx, dword [ebp - 0x28]
+mov word [ebp - 0x1c], ax
+cmp byte [edx + eax*2 + 0x1e4], 1
+je short loc_0000c885 ; je 0xc885
+
+loc_0000c876:
+inc dword [ebp - 0x20]
+cmp dword [ebp - 0x20], 3
+jne short loc_0000c862 ; jne 0xc862
+inc word [ebp - 0x24]
+jmp short loc_0000c83b ; jmp 0xc83b
+
+loc_0000c885:
+lea ebx, [esi + 4]
+
+loc_0000c888:
+cmp ebx, dword [ebp - 0x34]
+je short loc_0000c876 ; je 0xc876
+mov eax, dword [ebp - 0x24]
+cmp word [ebx - 4], ax
+jne near loc_0000c978 ; jne 0xc978
+mov eax, dword [ebp - 0x1c]
+cmp word [ebx - 2], ax
+jne near loc_0000c978 ; jne 0xc978
+cmp dword [ebp + 0xc], 2
+jne short loc_0000c8e1 ; jne 0xc8e1
+mov eax, dword [ebx]
+and eax, 0xfe00
+cmp eax, 0x2000
+je short loc_0000c8f5 ; je 0xc8f5
+cmp eax, 0x2200
+je short loc_0000c902 ; je 0xc902
+cmp eax, 0x2400
+jne short loc_0000c8cf ; jne 0xc8cf
+test byte [ebp - 0x19], 0x40
+jmp short loc_0000c906 ; jmp 0xc906
+
+loc_0000c8cf:
+cmp eax, 0x2600
+jne short loc_0000c908 ; jne 0xc908
+cmp byte [ebp - 0x19], 0
+jns short loc_0000c908 ; jns 0xc908
+jmp near loc_0000c978 ; jmp 0xc978
+
+loc_0000c8e1:
+cmp dword [ebp + 0xc], 1
+jne short loc_0000c908 ; jne 0xc908
+mov eax, dword [ebx]
+and eax, 0xfe00
+cmp eax, 0x2000
+jne short loc_0000c8fb ; jne 0xc8fb
+
+loc_0000c8f5:
+cmp byte [ebp - 0x30], 0
+jmp short loc_0000c906 ; jmp 0xc906
+
+loc_0000c8fb:
+cmp eax, 0x2200
+jne short loc_0000c908 ; jne 0xc908
+
+loc_0000c902:
+cmp byte [ebp - 0x2c], 0
+
+loc_0000c906:
+jne short loc_0000c978 ; jne 0xc978
+
+loc_0000c908:
+mov eax, dword [ebp - 0x28]
+mov ecx, dword [ebp - 0x20]
+movzx edi, byte [eax + ecx*2 + 0x1e3]
+mov ecx, dword [ebx + 4]
+imul edi, edi, 0x1010101
+mov eax, ecx
+not eax
+and eax, edi
+push eax
+push ecx
+push dword [ebx]
+push dword [ebp + 0x14]
+call fcn_00009dc2 ; call 0x9dc2
+mov edi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000c978 ; je 0xc978
+test edi, edi
+jns short loc_0000c978 ; jns 0xc978
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000c960 ; je 0xc960
+push eax
+push edi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000c960:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x271
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000c978:
+add ebx, 0xc
+jmp near loc_0000c888 ; jmp 0xc888
+
+loc_0000c980:
+mov eax, dword [ebp + 8]
+xor ebx, ebx
+cmp byte [eax], 8
+ja short loc_0000c991 ; ja 0xc991
+
+loc_0000c98a:
+xor eax, eax
+jmp near loc_0000cbf4 ; jmp 0xcbf4
+
+loc_0000c991:
+mov cl, byte [ebp - 0x19]
+mov al, cl
+and eax, 0x10
+mov byte [ebp - 0x20], al
+mov al, cl
+shr al, 7
+mov byte [ebp - 0x28], al
+
+loc_0000c9a4:
+call fcn_0001c1e1 ; call 0x1c1e1
+movzx eax, al
+cmp bx, ax
+jae short loc_0000c98a ; jae 0xc98a
+cmp dword [ebp + 0xc], 1
+jne short loc_0000c9df ; jne 0xc9df
+cmp bx, 4
+jne short loc_0000c9c3 ; jne 0xc9c3
+cmp byte [ebp - 0x20], 0
+jmp short loc_0000c9cd ; jmp 0xc9cd
+
+loc_0000c9c3:
+cmp bx, 5
+jne short loc_0000c9d3 ; jne 0xc9d3
+test byte [ebp - 0x19], 0x20
+
+loc_0000c9cd:
+jne near loc_0000cbee ; jne 0xcbee
+
+loc_0000c9d3:
+movzx eax, bx
+mov edi, dword [eax*4 + ref_00020420] ; mov edi, dword [eax*4 + 0x20420]
+jmp short loc_0000ca20 ; jmp 0xca20
+
+loc_0000c9df:
+test bx, bx
+jne short loc_0000c9ee ; jne 0xc9ee
+cmp byte [ebp - 0x28], 0
+jne near loc_0000cbee ; jne 0xcbee
+
+loc_0000c9ee:
+cmp bx, 1
+jne short loc_0000c9fa ; jne 0xc9fa
+test byte [ebp - 0x19], 0x40
+jmp short loc_0000ca10 ; jmp 0xca10
+
+loc_0000c9fa:
+cmp bx, 2
+jne short loc_0000ca06 ; jne 0xca06
+test byte [ebp - 0x19], 0x20
+jmp short loc_0000ca10 ; jmp 0xca10
+
+loc_0000ca06:
+cmp bx, 3
+jne short loc_0000ca16 ; jne 0xca16
+cmp byte [ebp - 0x20], 0
+
+loc_0000ca10:
+jne near loc_0000cbee ; jne 0xcbee
+
+loc_0000ca16:
+movzx eax, bx
+mov edi, dword [eax*4 + ref_00020408] ; mov edi, dword [eax*4 + 0x20408]
+
+loc_0000ca20:
+movzx esi, bx
+imul eax, esi, 0x12
+add eax, dword [ebp + 8]
+test byte [eax + 0x1ed], 1
+je short loc_0000caa0 ; je 0xcaa0
+movzx eax, byte [eax + 0x1e9]
+cmp al, 0x80
+jbe short loc_0000ca85 ; jbe 0xca85
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ca5a ; je 0xca5a
+push eax
+push eax
+push ref_000223da ; push 0x223da
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ca5a:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0000ca7b ; je 0xca7b
+push eax
+push ref_00022281 ; push 0x22281
+push 0x295
+
+loc_0000ca6e:
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000ca7b:
+mov eax, 0x80000002
+jmp near loc_0000cbf4 ; jmp 0xcbf4
+
+loc_0000ca85:
+shl eax, 0x10
+push eax
+push 0xff00ffff
+lea eax, [edi + 0x88]
+push eax
+push dword [ebp + 0x14]
+call fcn_00009dc2 ; call 0x9dc2
+add esp, 0x10
+
+loc_0000caa0:
+imul eax, esi, 0x12
+add eax, dword [ebp + 8]
+test byte [eax + 0x1ed], 2
+je short loc_0000cb08 ; je 0xcb08
+movzx eax, byte [eax + 0x1ea]
+cmp al, 0x80
+jbe short loc_0000caed ; jbe 0xcaed
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000cad7 ; je 0xcad7
+push edi
+push edi
+push ref_00022408 ; push 0x22408
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000cad7:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0000ca7b ; je 0xca7b
+push esi
+push ref_00022281 ; push 0x22281
+push 0x2a5
+jmp short loc_0000ca6e ; jmp 0xca6e
+
+loc_0000caed:
+shl eax, 0x10
+push eax
+push 0xff00ffff
+lea eax, [edi + 0x8c]
+push eax
+push dword [ebp + 0x14]
+call fcn_00009dc2 ; call 0x9dc2
+add esp, 0x10
+
+loc_0000cb08:
+imul eax, esi, 0x12
+add eax, dword [ebp + 8]
+test byte [eax + 0x1ed], 4
+je short loc_0000cb6a ; je 0xcb6a
+movzx eax, byte [eax + 0x1eb]
+lea edx, [eax - 0x39]
+cmp dl, 0x47
+jbe short loc_0000cb60 ; jbe 0xcb60
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000cb43 ; je 0xcb43
+push ebx
+push ebx
+push ref_00022437 ; push 0x22437
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000cb43:
+call fcn_00015480 ; call 0x15480
+test al, al
+je near loc_0000ca7b ; je 0xca7b
+push ecx
+push ref_00022281 ; push 0x22281
+push 0x2b9
+jmp near loc_0000ca6e ; jmp 0xca6e
+
+loc_0000cb60:
+shl eax, 8
+mov edx, 0xffff00ff
+jmp short loc_0000cb6f ; jmp 0xcb6f
+
+loc_0000cb6a:
+xor eax, eax
+or edx, 0xffffffff
+
+loc_0000cb6f:
+imul esi, esi, 0x12
+add esi, dword [ebp + 8]
+test byte [esi + 0x1ed], 8
+je short loc_0000cbd5 ; je 0xcbd5
+mov cl, byte [esi + 0x1ec]
+lea esi, [ecx - 0x45]
+mov byte [ebp - 0x24], cl
+mov ecx, esi
+cmp cl, 0x3b
+jbe short loc_0000cbcb ; jbe 0xcbcb
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000cbae ; je 0xcbae
+push edx
+push edx
+push ref_00022460 ; push 0x22460
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000cbae:
+call fcn_00015480 ; call 0x15480
+test al, al
+je near loc_0000ca7b ; je 0xca7b
+push eax
+push ref_00022281 ; push 0x22281
+push 0x2c6
+jmp near loc_0000ca6e ; jmp 0xca6e
+
+loc_0000cbcb:
+movzx ecx, byte [ebp - 0x24]
+xor dl, dl
+or eax, ecx
+jmp short loc_0000cbda ; jmp 0xcbda
+
+loc_0000cbd5:
+cmp edx, 0xffffffff
+je short loc_0000cbee ; je 0xcbee
+
+loc_0000cbda:
+push eax
+add edi, 0x90
+push edx
+push edi
+push dword [ebp + 0x14]
+call fcn_00009dc2 ; call 0x9dc2
+add esp, 0x10
+
+loc_0000cbee:
+inc ebx
+jmp near loc_0000c9a4 ; jmp 0xc9a4
+
+loc_0000cbf4:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000cbfc:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x2c
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000cc1f ; je 0xcc1f
+push eax
+push eax
+push ref_0002248a ; push 0x2248a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000cc1f:
+call fcn_0001bfbb ; call 0x1bfbb
+mov dword [ebp - 0x2c], eax
+push eax
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov ebx, eax
+lea eax, [eax + 0xf0]
+add ebx, 2
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov dword [esp], ebx
+mov dword [ebp - 0x30], eax
+and dword [ebp - 0x30], 0xffffc000
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0xc
+push 2
+push 0x1f
+push 0
+mov ebx, eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0x1c
+push 0
+mov esi, eax
+call fcn_00016c9a ; call 0x16c9a
+lea edi, [esi + 0x92]
+mov dword [esp], edi
+mov dword [ebp - 0x34], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0xf
+setne byte [ebp - 0x35]
+cmp dword [ebp - 0x2c], 1
+jne near loc_0000cedf ; jne 0xcedf
+sub esp, 0xc
+push edi
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0x30
+je short loc_0000cd14 ; je 0xcd14
+
+loc_0000ccac:
+push eax
+lea eax, [ebp - 0x1c]
+push eax
+push 0xea000aac
+push dword [ebp - 0x30]
+call fcn_00009d19 ; call 0x9d19
+mov eax, dword [ebp - 0x1c]
+add esp, 0x10
+and eax, 0x30
+cmp eax, 0x20
+je near loc_0000ce82 ; je 0xce82
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000cced ; je 0xcced
+push eax
+push eax
+push ref_000224a1 ; push 0x224a1
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000cced:
+call fcn_00015480 ; call 0x15480
+test al, al
+je near loc_0000ce82 ; je 0xce82
+push eax
+push ref_00024be5 ; push 0x24be5
+push 0x32e
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+jmp near loc_0000ce7f ; jmp 0xce7f
+
+loc_0000cd14:
+cmp byte [ebp - 0x35], 1
+je short loc_0000ccac ; je 0xccac
+push eax
+push 0x60
+
+loc_0000cd1d:
+push 0x3f
+lea eax, [esi + 0x90]
+push eax
+call fcn_0001878a ; call 0x1878a
+add esp, 0x10
+
+loc_0000cd2e:
+push eax
+push 0x183
+push 0xfffffe00
+lea eax, [esi + 0x94]
+push eax
+lea esi, [esi + 0x98]
+mov dword [ebp - 0x1c], 0xfffffe00
+call fcn_00018b68 ; call 0x18b68
+pop eax
+pop edx
+push 0x8000
+push edi
+call fcn_00018927 ; call 0x18927
+movzx eax, bx
+mov dword [esp], eax
+push dword [ebp - 0x30]
+push dword [ebp - 0x34]
+push dword [ebp - 0x2c]
+push dword [ebp + 8]
+call fcn_0000c0c8 ; call 0xc0c8
+mov eax, ebx
+add esp, 0x20
+and eax, 0xfffffffd
+cmp ax, 0x8c44
+je near loc_0000ce9e ; je 0xce9e
+lea eax, [ebx + 0x73b2]
+cmp ax, 2
+jbe near loc_0000ce9e ; jbe 0xce9e
+cmp bx, 0x8c5c
+je near loc_0000ce9e ; je 0xce9e
+lea eax, [ebx + 0x73b7]
+cmp ax, 3
+jbe near loc_0000ce9e ; jbe 0xce9e
+lea eax, [ebx + 0x73bf]
+cmp ax, 1
+jbe near loc_0000ce9e ; jbe 0xce9e
+lea eax, [ebx + 0x63bf]
+cmp ax, 6
+jbe near loc_0000ce9e ; jbe 0xce9e
+lea eax, [ebx + 0x733f]
+cmp ax, 5
+jbe near loc_0000ce9e ; jbe 0xce9e
+add bx, 0x633f
+cmp bx, 0xa
+jbe near loc_0000ce9e ; jbe 0xce9e
+
+loc_0000cdf2:
+push ebx
+push ebx
+push 0x80000
+push esi
+call fcn_00018b14 ; call 0x18b14
+add esp, 0xc
+push 0x200
+push 0xffffe27f
+push esi
+mov dword [ebp - 0x1c], 0xffffe27f
+call fcn_00018b68 ; call 0x18b68
+pop eax
+pop edx
+push 0x100000
+push esi
+call fcn_00018b14 ; call 0x18b14
+add esp, 0xc
+push 0x20
+push 0xffffffffffffff9f
+push esi
+call fcn_00018b68 ; call 0x18b68
+pop ecx
+pop ebx
+push 0x40000
+push esi
+call fcn_00018b14 ; call 0x18b14
+mov eax, dword [ebp - 0x34]
+add eax, 0x410
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+cmp dword [ebp - 0x2c], 1
+jne short loc_0000ceb3 ; jne 0xceb3
+mov dl, al
+and edx, 0x10
+cmp dl, 1
+sbb edx, edx
+and edx, 0x10
+add edx, 0xf
+mov cl, dl
+or ecx, 0x20
+test al, 0x20
+
+loc_0000ce70:
+cmove edx, ecx
+
+loc_0000ce73:
+push ecx
+movzx edx, dl
+push ecx
+push edx
+push edi
+call fcn_00018730 ; call 0x18730
+
+loc_0000ce7f:
+add esp, 0x10
+
+loc_0000ce82:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000cef7 ; je 0xcef7
+push eax
+push eax
+push ref_000224ef ; push 0x224ef
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp short loc_0000cef7 ; jmp 0xcef7
+
+loc_0000ce9e:
+push eax
+push eax
+push 0x400000
+push esi
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+jmp near loc_0000cdf2 ; jmp 0xcdf2
+
+loc_0000ceb3:
+xor edx, edx
+cmp dword [ebp - 0x2c], 2
+jne short loc_0000ce73 ; jne 0xce73
+mov dl, al
+not edx
+shr dl, 7
+mov cl, dl
+or ecx, 2
+test al, 0x40
+cmove edx, ecx
+mov cl, dl
+or ecx, 4
+test al, 0x20
+cmove edx, ecx
+mov cl, dl
+or ecx, 8
+test al, 0x10
+jmp short loc_0000ce70 ; jmp 0xce70
+
+loc_0000cedf:
+cmp byte [ebp - 0x35], 1
+je short loc_0000ce82 ; je 0xce82
+cmp dword [ebp - 0x2c], 2
+jne near loc_0000cd2e ; jne 0xcd2e
+push ecx
+push 0x40
+jmp near loc_0000cd1d ; jmp 0xcd1d
+
+loc_0000cef7:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000cf01:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x38
+mov ebx, dword [ebp + 8]
+mov eax, dword [ebx + 4]
+add eax, 0x3414
+push eax
+call fcn_00017d8b ; call 0x17d8b
+mov esi, eax
+pop eax
+push dword [ebx + 4]
+call fcn_0001be90 ; call 0x1be90
+movzx edx, byte [ebx + 0x37e]
+add esp, 0x10
+mov edi, eax
+mov eax, esi
+shr al, 5
+xor eax, 1
+and eax, 1
+cmp edx, eax
+je near loc_0000d125 ; je 0xd125
+lea eax, [ebp - 0x1c]
+push eax
+push 0
+push 0
+push ref_0002913c ; push 0x2913c
+call fcn_0001975d ; call 0x1975d
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000cf9e ; je 0xcf9e
+test esi, esi
+jns short loc_0000cf9e ; jns 0xcf9e
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000cf86 ; je 0xcf86
+push eax
+push esi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000cf86:
+push esi
+push ref_000206f4 ; push 0x206f4
+push 0x467
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000cf9e:
+mov eax, dword [ebx + 4]
+sub esp, 0xc
+add eax, 0x3420
+push eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, al
+jns short loc_0000cfdf ; jns 0xcfdf
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000cfd3 ; je 0xcfd3
+push ecx
+push ecx
+push ref_00022504 ; push 0x22504
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000cfd3:
+push edx
+mov eax, dword [ebp - 0x1c]
+push edx
+push 4
+jmp near loc_0000d11f ; jmp 0xd11f
+
+loc_0000cfdf:
+xor esi, esi
+mov eax, edi
+cmp byte [ebx + 0x37e], 0
+je short loc_0000d016 ; je 0xd016
+dec al
+jne near loc_0000d0bc ; jne 0xd0bc
+push eax
+mov esi, 1
+push eax
+push 0xdf
+mov eax, dword [ebx + 4]
+add eax, 0x3414
+push eax
+call fcn_0001875d ; call 0x1875d
+add esp, 0x10
+jmp near loc_0000d0bc ; jmp 0xd0bc
+
+loc_0000d016:
+dec al
+jne near loc_0000d0a7 ; jne 0xd0a7
+push eax
+push 0
+push 0x19
+movzx eax, byte [ebx + 1]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+lea edi, [eax + 0x10]
+mov esi, eax
+mov dword [esp], edi
+call fcn_00017e4e ; call 0x17e4e
+mov dword [ebp - 0x34], eax
+pop eax
+pop edx
+push dword [ebx + 0x1a]
+push edi
+call fcn_00017e8f ; call 0x17e8f
+lea eax, [esi + 4]
+mov dword [esp], eax
+mov esi, eax
+call fcn_00017dc2 ; call 0x17dc2
+pop ecx
+mov dword [ebp - 0x2c], esi
+mov word [ebp - 0x2e], ax
+pop eax
+push 2
+push esi
+call fcn_00018927 ; call 0x18927
+mov dword [esp], edi
+call fcn_00017e4e ; call 0x17e4e
+and eax, 0xffff8000
+lea edx, [eax + 0x5b54]
+mov dword [esp], edx
+call fcn_00017dc2 ; call 0x17dc2
+mov ecx, eax
+pop eax
+movzx eax, word [ebp - 0x2e]
+shr cx, 0xf
+pop edx
+mov esi, ecx
+push eax
+push dword [ebp - 0x2c]
+call fcn_00017e04 ; call 0x17e04
+pop ecx
+mov ecx, dword [ebp - 0x34]
+pop eax
+push ecx
+push edi
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+
+loc_0000d0a7:
+push edi
+push edi
+push 0x20
+mov eax, dword [ebx + 4]
+add eax, 0x3414
+push eax
+call fcn_00018730 ; call 0x18730
+add esp, 0x10
+
+loc_0000d0bc:
+mov eax, dword [ebx + 4]
+sub esp, 0xc
+add eax, 0x3414
+push eax
+call fcn_00017d8b ; call 0x17d8b
+mov eax, esi
+add esp, 0x10
+test al, al
+je short loc_0000d125 ; je 0xd125
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000d0f3 ; je 0xd0f3
+push esi
+push esi
+push ref_00022558 ; push 0x22558
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000d0f3:
+mov eax, dword [ebx + 4]
+sub esp, 0xc
+add eax, 0x3428
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov edx, 3
+test al, 2
+jne short loc_0000d119 ; jne 0xd119
+cmp byte [ebx + 0x11], 1
+sbb edx, edx
+add edx, 5
+
+loc_0000d119:
+mov eax, dword [ebp - 0x1c]
+push ecx
+push ecx
+push edx
+
+loc_0000d11f:
+push eax
+call dword [eax] ; ucall
+add esp, 0x10
+
+loc_0000d125:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000d12f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x3c
+mov ebx, dword [ebp + 8]
+mov byte [ebp - 0x1c], 0x1d
+mov byte [ebp - 0x1b], 0
+mov byte [ebp - 0x1a], 0x1a
+mov byte [ebp - 0x19], 0
+call fcn_0001bfbb ; call 0x1bfbb
+push edi
+push 0
+push 0x1f
+push 0
+mov esi, eax
+mov dword [ebp - 0x34], eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 2
+push 0x1f
+mov dword [ebp - 0x38], eax
+movzx eax, byte [ebx + 1]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0x10
+dec esi
+mov dword [ebp - 0x30], 0
+mov edi, eax
+jne short loc_0000d196 ; jne 0xd196
+push ecx
+push 5
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0x10
+mov dword [ebp - 0x30], eax
+
+loc_0000d196:
+push eax
+push 0
+push 0x1c
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov esi, eax
+mov eax, dword [ebp - 0x38]
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov dword [ebp - 0x40], eax
+pop eax
+mov eax, dword [ebp - 0x38]
+pop edx
+add eax, 0xac
+push 0xffefffff
+push eax
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+mov byte [ebp - 0x3c], 0
+mov byte [ebp - 0x29], 0
+
+loc_0000d1d7:
+call fcn_0001c1bf ; call 0x1c1bf
+cmp byte [ebp - 0x29], al
+jae short loc_0000d25e ; jae 0xd25e
+movzx edx, byte [ebp - 0x29]
+push eax
+push edx
+push 0x1c
+movzx eax, byte [ebx + 1]
+mov dword [ebp - 0x48], edx
+push eax
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+mov dword [ebp - 0x44], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_0000d256 ; je 0xd256
+mov edx, dword [ebp - 0x48]
+mov ecx, dword [ebp - 0x44]
+imul edx, edx, 0x2c
+cmp byte [ebx + edx + 0x4e], 1
+setne dl
+add ecx, 0x70
+sub esp, 0xc
+movzx edx, dl
+inc edx
+push ecx
+mov dword [ebp - 0x48], edx
+mov dword [ebp - 0x44], ecx
+call fcn_00017dc2 ; call 0x17dc2
+mov edx, dword [ebp - 0x48]
+add esp, 0x10
+movzx edx, dx
+and eax, 0xf
+cmp eax, edx
+je short loc_0000d256 ; je 0xd256
+mov ecx, dword [ebp - 0x44]
+push eax
+push edx
+push 0xfff0
+push ecx
+call fcn_00018981 ; call 0x18981
+add esp, 0x10
+mov byte [ebp - 0x3c], 1
+
+loc_0000d256:
+inc byte [ebp - 0x29]
+jmp near loc_0000d1d7 ; jmp 0xd1d7
+
+loc_0000d25e:
+cmp byte [ebp - 0x3c], 0
+je short loc_0000d274 ; je 0xd274
+sub esp, 0xc
+push 0x186a0
+call fcn_0001bb03 ; call 0x1bb03
+add esp, 0x10
+
+loc_0000d274:
+push eax
+push 0x80
+push 0x9f
+lea eax, [esi + 0xf4]
+push eax
+call fcn_0001878a ; call 0x1878a
+add esp, 0x10
+mov byte [ebp - 0x29], 0
+
+loc_0000d292:
+call fcn_0001c245 ; call 0x1c245
+cmp byte [ebp - 0x29], al
+jae short loc_0000d2e2 ; jae 0xd2e2
+movzx eax, byte [ebp - 0x29]
+push ecx
+movzx edx, byte [ebp + eax*2 - 0x1b]
+movzx eax, byte [ebp + eax*2 - 0x1c]
+push edx
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+lea edx, [eax + 0x88]
+mov dword [esp], edx
+mov dword [ebp - 0x3c], edx
+call fcn_00017e4e ; call 0x17e4e
+pop edx
+mov edx, dword [ebp - 0x3c]
+pop ecx
+and eax, 0xfffffffb
+push eax
+push edx
+mov dword [ebp - 0x20], eax
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+inc byte [ebp - 0x29]
+jmp short loc_0000d292 ; jmp 0xd292
+
+loc_0000d2e2:
+cmp byte [ebx + 0x364], 1
+jne short loc_0000d331 ; jne 0xd331
+push eax
+mov eax, dword [ebx + 0x368]
+shr eax, 0xc
+and eax, 3
+or al, 0x80
+push eax
+push 0xfffffffffffffffc
+mov eax, dword [ebx + 4]
+add eax, 0x3404
+push eax
+call fcn_00018b68 ; call 0x18b68
+mov eax, dword [ebx + 4]
+add eax, 0x3404
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+pop eax
+pop edx
+push 1
+mov eax, dword [ebx + 0x368]
+add eax, 0x10
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+
+loc_0000d331:
+cmp byte [ebx + 0xc], 0
+mov eax, dword [ebx + 4]
+jne short loc_0000d34b ; jne 0xd34b
+push ecx
+add eax, 0x3410
+push ecx
+push 0xfffffffffffffffb
+push eax
+call fcn_00018b3e ; call 0x18b3e
+jmp short loc_0000d35a ; jmp 0xd35a
+
+loc_0000d34b:
+push edx
+add eax, 0x3410
+push edx
+push 4
+push eax
+call fcn_00018b14 ; call 0x18b14
+
+loc_0000d35a:
+mov eax, dword [ebx + 4]
+add esp, 0x10
+sub esp, 0xc
+add eax, 0x3410
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+cmp dword [ebp - 0x34], 1
+jne near loc_0000d445 ; jne 0xd445
+cmp dword [ebx + 0x1db], 0
+jne near loc_0000d41e ; jne 0xd41e
+push eax
+add esi, 0x410
+push 0x70
+push 0xffffff00
+lea eax, [edi + 0x34]
+push eax
+call fcn_00018b68 ; call 0x18b68
+pop eax
+pop edx
+lea eax, [edi + 0x70]
+push 0xffff00ff
+push eax
+call fcn_00018b3e ; call 0x18b3e
+pop ecx
+pop eax
+lea eax, [edi + 0x90]
+push 0x1f
+push eax
+call fcn_0001875d ; call 0x1875d
+mov dword [esp], esi
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+and eax, 0x30
+cmp al, 0x30
+je short loc_0000d41e ; je 0xd41e
+sub esp, 0xc
+push esi
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+jne short loc_0000d3f6 ; jne 0xd3f6
+push eax
+push eax
+mov eax, dword [ebp - 0x30]
+push 1
+add eax, 0x92
+push eax
+call fcn_00018730 ; call 0x18730
+add esp, 0x10
+
+loc_0000d3f6:
+sub esp, 0xc
+push esi
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0x20
+jne near loc_0000d490 ; jne 0xd490
+mov eax, dword [ebp - 0x30]
+push esi
+push esi
+push 2
+add eax, 0x92
+push eax
+call fcn_00018730 ; call 0x18730
+jmp short loc_0000d48d ; jmp 0xd48d
+
+loc_0000d41e:
+push ecx
+push ecx
+push 0x2000000
+mov eax, dword [ebx + 4]
+add eax, 0x3418
+push eax
+call fcn_00018b14 ; call 0x18b14
+mov eax, dword [ebx + 4]
+add eax, 0x3418
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+jmp short loc_0000d48d ; jmp 0xd48d
+
+loc_0000d445:
+cmp dword [ebp - 0x34], 2
+jne short loc_0000d490 ; jne 0xd490
+cmp dword [ebx + 0x1db], 3
+jne short loc_0000d490 ; jne 0xd490
+push eax
+push eax
+push 0x3f
+lea eax, [edi + 0x90]
+push eax
+call fcn_0001875d ; call 0x1875d
+pop eax
+pop edx
+lea eax, [edi + 0xa0]
+push 0
+push eax
+call fcn_00017da5 ; call 0x17da5
+add esp, 0xc
+push 0x8000
+push 0xffff7fff
+lea eax, [edi + 0xa4]
+push eax
+call fcn_00018b68 ; call 0x18b68
+
+loc_0000d48d:
+add esp, 0x10
+
+loc_0000d490:
+cmp dword [ebx + 0x1db], 2
+jne short loc_0000d4c1 ; jne 0xd4c1
+mov eax, dword [ebp - 0x38]
+sub esp, 0xc
+add eax, 2
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0xc
+push 0x80
+push 0x3f
+lea eax, [edi + 0x90]
+push eax
+call fcn_0001878a ; call 0x1878a
+add esp, 0x10
+
+loc_0000d4c1:
+cmp dword [ebp - 0x34], 2
+jne near loc_0000d5bf ; jne 0xd5bf
+mov ebx, dword [ebp - 0x40]
+push esi
+lea esi, [ebp - 0x20]
+push esi
+push 0xed00015c
+and ebx, 0xffffc000
+push ebx
+call fcn_00009d19 ; call 0x9d19
+add esp, 0x10
+mov edi, eax
+test eax, eax
+jns short loc_0000d509 ; jns 0xd509
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000d525 ; je 0xd525
+push ecx
+push edi
+push ref_0002258d ; push 0x2258d
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+jmp short loc_0000d522 ; jmp 0xd522
+
+loc_0000d509:
+mov eax, dword [ebp - 0x20]
+push edx
+and ah, 0xf7
+or ah, 0x37
+push eax
+push 0xed00015c
+push ebx
+mov dword [ebp - 0x20], eax
+call fcn_00009c75 ; call 0x9c75
+
+loc_0000d522:
+add esp, 0x10
+
+loc_0000d525:
+push edi
+push esi
+push 0xed000118
+push ebx
+call fcn_00009d19 ; call 0x9d19
+add esp, 0x10
+mov edi, eax
+test eax, eax
+jns short loc_0000d557 ; jns 0xd557
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000d572 ; je 0xd572
+push ecx
+push edi
+push ref_000225b0 ; push 0x225b0
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+jmp short loc_0000d56f ; jmp 0xd56f
+
+loc_0000d557:
+mov eax, dword [ebp - 0x20]
+push edx
+or eax, 0xc00000
+push eax
+push 0xed000118
+push ebx
+mov dword [ebp - 0x20], eax
+call fcn_00009c75 ; call 0x9c75
+
+loc_0000d56f:
+add esp, 0x10
+
+loc_0000d572:
+push edi
+push esi
+push 0xed000120
+push ebx
+call fcn_00009d19 ; call 0x9d19
+add esp, 0x10
+mov esi, eax
+test eax, eax
+jns short loc_0000d5a4 ; jns 0xd5a4
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000d5bf ; je 0xd5bf
+push ecx
+push esi
+push ref_000225d3 ; push 0x225d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+jmp short loc_0000d5bc ; jmp 0xd5bc
+
+loc_0000d5a4:
+mov eax, dword [ebp - 0x20]
+push edx
+or eax, 0x240000
+push eax
+push 0xed000120
+push ebx
+mov dword [ebp - 0x20], eax
+call fcn_00009c75 ; call 0x9c75
+
+loc_0000d5bc:
+add esp, 0x10
+
+loc_0000d5bf:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000d5c9:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov ebx, dword [ebp + 8]
+push 6
+push 0x1f
+movzx eax, byte [ebx + 1]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0
+push 0
+mov edi, eax
+call fcn_00016c9a ; call 0x16c9a
+mov esi, dword [ebx + 0x1a]
+pop ecx
+pop eax
+mov dword [ebp - 0x1c], edi
+lea edi, [edi + 0x40]
+push esi
+push edi
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+mov eax, dword [ebp - 0x1c]
+pop edx
+add eax, 0x44
+push 0
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop ecx
+pop eax
+push 1
+push edi
+call fcn_00018b14 ; call 0x18b14
+call fcn_0001bfbb ; call 0x1bfbb
+add esp, 0x10
+cmp eax, 2
+lea eax, [esi + 0x10]
+jne short loc_0000d638 ; jne 0xd638
+push edx
+push edx
+push 0x14a
+jmp short loc_0000d63f ; jmp 0xd63f
+
+loc_0000d638:
+push ecx
+push ecx
+push 0x154
+
+loc_0000d63f:
+push eax
+call fcn_00017e04 ; call 0x17e04
+add esp, 0x10
+push eax
+push eax
+push 0xff
+lea eax, [esi + 6]
+push eax
+call fcn_00017da5 ; call 0x17da5
+pop eax
+pop edx
+lea eax, [esi + 0x80]
+push 0xff
+push eax
+call fcn_00017da5 ; call 0x17da5
+pop ecx
+pop eax
+lea eax, [esi + 0x84]
+push 0
+push eax
+call fcn_00017da5 ; call 0x17da5
+pop eax
+pop edx
+lea eax, [esi + 0x82]
+push 0
+push eax
+call fcn_00017da5 ; call 0x17da5
+add esp, 0xc
+push 0x403c
+push 0xffff8003
+mov eax, dword [ebx + 4]
+add eax, 0x38b0
+push eax
+call fcn_00018b68 ; call 0x18b68
+mov eax, dword [ebx + 4]
+add eax, 0x38b4
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test ah, 0x40
+je short loc_0000d6ce ; je 0xd6ce
+push eax
+add esi, 0xa
+push eax
+push 1
+push esi
+call fcn_00017da5 ; call 0x17da5
+add esp, 0x10
+
+loc_0000d6ce:
+push ecx
+push ecx
+push 0xfffffffffffffffe
+push edi
+call fcn_00018b3e ; call 0x18b3e
+pop esi
+pop eax
+push 0
+push edi
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+test byte [ebx + 0x426], 1
+je near loc_0000d77b ; je 0xd77b
+mov cl, byte [ebx + 0x432]
+mov dl, byte [ebx + 0x436]
+mov eax, ecx
+shl eax, 0x1e
+and eax, 0x40000000
+mov esi, eax
+or esi, 0x80000000
+test dl, 1
+cmovne eax, esi
+mov esi, eax
+or esi, 0x4000
+and cl, 2
+cmovne eax, esi
+mov ecx, eax
+or ch, 0x80
+and dl, 2
+cmovne eax, ecx
+push edx
+push eax
+push 0xfff0fff
+mov eax, dword [ebx + 4]
+add eax, 0x33d4
+push eax
+call fcn_00018b68 ; call 0x18b68
+mov al, byte [ebx + 0x432]
+add esp, 0xc
+shl eax, 8
+and eax, 0x400
+mov edx, eax
+or dh, 8
+test byte [ebx + 0x436], 4
+cmovne eax, edx
+push eax
+push 0xfffff0ff
+mov eax, dword [ebx + 4]
+add eax, 0x33c8
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_0000d77b:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000d785:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov edi, dword [ebp + 8]
+mov eax, dword [edi + 4]
+mov bl, byte [edi + 0x361]
+lea esi, [eax + 0x31fe]
+push esi
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+cmp bl, al
+je short loc_0000d7d3 ; je 0xd7d3
+push ebx
+push ebx
+push 0xfeff
+push esi
+call fcn_00018954 ; call 0x18954
+movzx eax, byte [edi + 0x361]
+add esp, 0xc
+push eax
+push 0xff00
+push esi
+call fcn_00018981 ; call 0x18981
+add esp, 0x10
+
+loc_0000d7d3:
+push eax
+push eax
+push 0x100
+push esi
+call fcn_00018927 ; call 0x18927
+mov dword [esp], esi
+call fcn_00017dc2 ; call 0x17dc2
+mov dword [esp], esi
+call fcn_00017d8b ; call 0x17d8b
+pop edx
+pop ecx
+push 0
+movzx ebx, al
+shl ebx, 0xc
+mov eax, ebx
+or ebx, 0xfec00010
+or eax, 0xfec00000
+push eax
+mov dword [ebp - 0x1c], eax
+call fcn_00017da5 ; call 0x17da5
+mov dword [esp], ebx
+call fcn_00017e4e ; call 0x17e4e
+mov dl, byte [edi + 0x360]
+add esp, 0x10
+movzx ecx, dl
+shr eax, 0x18
+cmp ecx, eax
+je short loc_0000d852 ; je 0xd852
+cmp dl, 0xf
+ja short loc_0000d852 ; ja 0xd852
+push edx
+push edx
+push 0
+push dword [ebp - 0x1c]
+call fcn_00017da5 ; call 0x17da5
+pop ecx
+pop eax
+movzx eax, byte [edi + 0x360]
+shl eax, 0x18
+push eax
+push ebx
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+
+loc_0000d852:
+call fcn_0001bfbb ; call 0x1bfbb
+cmp eax, 2
+jne short loc_0000d875 ; jne 0xd875
+cmp byte [edi + 0x362], 0
+jne short loc_0000d875 ; jne 0xd875
+push eax
+push eax
+push 0x800
+push esi
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+
+loc_0000d875:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000d87f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000d8a2 ; je 0xd8a2
+push eax
+push eax
+push ref_000225f6 ; push 0x225f6
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000d8a2:
+push eax
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+lea esi, [eax + 0xf0]
+mov ebx, eax
+mov dword [esp], esi
+call fcn_00017e4e ; call 0x17e4e
+lea eax, [ebp - 0x20]
+push eax
+push 0
+push 0
+push ref_000291dc ; push 0x291dc
+call fcn_0001975d ; call 0x1975d
+add esp, 0x20
+mov edi, eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0000d917 ; je 0xd917
+test edi, edi
+jns short loc_0000d917 ; jns 0xd917
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000d8ff ; je 0xd8ff
+push eax
+push edi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000d8ff:
+push edi
+push ref_000206f4 ; push 0x206f4
+push 0x7c4
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000d917:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0000d943 ; je 0xd943
+mov eax, dword [ebp - 0x20]
+test word [eax + 4], 0x3fff
+je short loc_0000d943 ; je 0xd943
+push ecx
+push ref_0002260f ; push 0x2260f
+push 0x7d5
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000d943:
+push eax
+mov eax, dword [ebp - 0x20]
+mov eax, dword [eax + 4]
+or eax, 1
+push eax
+push 0x3fff
+push esi
+call fcn_00018b68 ; call 0x18b68
+lea esi, [ebx + 0x40]
+pop eax
+mov eax, dword [ebp - 0x20]
+pop edx
+movzx eax, word [eax + 8]
+push eax
+push esi
+call fcn_00017e8f ; call 0x17e8f
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000d9ac ; je 0xd9ac
+sub esp, 0xc
+push esi
+call fcn_00017e4e ; call 0x17e4e
+mov edx, dword [ebp - 0x20]
+add esp, 0x10
+movzx edx, word [edx + 8]
+and eax, 0xfffc
+cmp eax, edx
+je short loc_0000d9ac ; je 0xd9ac
+push edi
+push ref_0002264a ; push 0x2264a
+push 0x7e1
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000d9ac:
+mov eax, dword [ebp - 0x20]
+cmp word [eax + 8], 0
+lea eax, [ebx + 0x44]
+je short loc_0000d9c8 ; je 0xd9c8
+push esi
+push esi
+push 0x80
+push eax
+call fcn_00018730 ; call 0x18730
+jmp short loc_0000d9d2 ; jmp 0xd9d2
+
+loc_0000d9c8:
+push ecx
+push ecx
+push 0x7f
+push eax
+call fcn_0001875d ; call 0x1875d
+
+loc_0000d9d2:
+add esp, 0x10
+push eax
+push eax
+push 2
+lea eax, [ebx + 0xa6]
+push eax
+call fcn_00018730 ; call 0x18730
+lea esi, [ebx + 0x48]
+pop eax
+mov eax, dword [ebp - 0x20]
+pop edx
+movzx eax, word [eax + 0xa]
+push eax
+push esi
+call fcn_00017e8f ; call 0x17e8f
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000da38 ; je 0xda38
+sub esp, 0xc
+push esi
+call fcn_00017e4e ; call 0x17e4e
+mov edx, dword [ebp - 0x20]
+add esp, 0x10
+movzx edx, word [edx + 0xa]
+and eax, 0xfffc
+cmp eax, edx
+je short loc_0000da38 ; je 0xda38
+push eax
+push ref_00022691 ; push 0x22691
+push 0x800
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000da38:
+mov eax, dword [ebp - 0x20]
+cmp word [eax + 0xa], 0
+lea eax, [ebx + 0x4c]
+je short loc_0000da51 ; je 0xda51
+push edi
+push edi
+push 0x10
+push eax
+call fcn_00018730 ; call 0x18730
+jmp short loc_0000da5e ; jmp 0xda5e
+
+loc_0000da51:
+push esi
+push esi
+push 0xef
+push eax
+call fcn_0001875d ; call 0x1875d
+
+loc_0000da5e:
+mov eax, dword [ebp - 0x20]
+add esp, 0x10
+mov dl, byte [eax + 0x40e]
+push ecx
+and edx, 0x20
+cmp dl, 1
+sbb eax, eax
+and eax, 0xffffffe0
+dec eax
+cmp dl, 1
+sbb edx, edx
+movzx eax, al
+not edx
+add ebx, 0xdc
+and edx, 0x22
+push edx
+push eax
+push ebx
+call fcn_0001878a ; call 0x1878a
+pop ebx
+push dword [ebp - 0x20]
+call fcn_0000cbfc ; call 0xcbfc
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000dae2 ; je 0xdae2
+test ebx, ebx
+jns short loc_0000dae2 ; jns 0xdae2
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000daca ; je 0xdaca
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000daca:
+push edi
+push ref_000206f4 ; push 0x206f4
+push 0x828
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000dae2:
+sub esp, 0xc
+push dword [ebp - 0x20]
+call fcn_0001146f ; call 0x1146f
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000db34 ; je 0xdb34
+test ebx, ebx
+jns short loc_0000db34 ; jns 0xdb34
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000db1c ; je 0xdb1c
+push esi
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000db1c:
+push ecx
+push ref_000206f4 ; push 0x206f4
+push 0x82a
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000db34:
+sub esp, 0xc
+push dword [ebp - 0x20]
+call fcn_0000cf01 ; call 0xcf01
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000db86 ; je 0xdb86
+test ebx, ebx
+jns short loc_0000db86 ; jns 0xdb86
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000db6e ; je 0xdb6e
+push edx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000db6e:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x82d
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000db86:
+sub esp, 0xc
+push dword [ebp - 0x20]
+call fcn_0000d12f ; call 0xd12f
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000dbd8 ; je 0xdbd8
+test ebx, ebx
+jns short loc_0000dbd8 ; jns 0xdbd8
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000dbc0 ; je 0xdbc0
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000dbc0:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x830
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000dbd8:
+sub esp, 0xc
+push dword [ebp - 0x20]
+call fcn_0000d5c9 ; call 0xd5c9
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000dc2a ; je 0xdc2a
+test ebx, ebx
+jns short loc_0000dc2a ; jns 0xdc2a
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000dc12 ; je 0xdc12
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000dc12:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x832
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000dc2a:
+sub esp, 0xc
+push dword [ebp - 0x20]
+call fcn_0000d785 ; call 0xd785
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000dc7c ; je 0xdc7c
+test ebx, ebx
+jns short loc_0000dc7c ; jns 0xdc7c
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000dc64 ; je 0xdc64
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000dc64:
+push edi
+push ref_000206f4 ; push 0x206f4
+push 0x834
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000dc7c:
+sub esp, 0xc
+lea eax, [ebp - 0x1c]
+push eax
+call fcn_00019797 ; call 0x19797
+add esp, 0x10
+test eax, eax
+js short loc_0000dd06 ; js 0xdd06
+mov eax, dword [ebp - 0x1c]
+cmp eax, 0x11
+je short loc_0000dd06 ; je 0xdd06
+cmp eax, 0x20
+je short loc_0000dd06 ; je 0xdd06
+mov eax, dword [ebp - 0x20]
+cmp byte [eax + 0x339], 0
+je short loc_0000dd06 ; je 0xdd06
+movzx ecx, byte [eax]
+add eax, 0x284
+mov edx, dword [eax - 0x26a]
+push ecx
+push edx
+push edx
+push eax
+call fcn_00011751 ; call 0x11751
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000dd06 ; je 0xdd06
+test ebx, ebx
+jns short loc_0000dd06 ; jns 0xdd06
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000dcee ; je 0xdcee
+push esi
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000dcee:
+push ebx
+push ref_000206f4 ; push 0x206f4
+push 0x848
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000dd06:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000dd20 ; je 0xdd20
+push ecx
+push ecx
+push ref_000226da ; push 0x226da
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000dd20:
+sub esp, 0xc
+push ref_00026f74 ; push 0x26f74
+call fcn_0001972b ; call 0x1972b
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000dd74 ; je 0xdd74
+test ebx, ebx
+jns short loc_0000dd74 ; jns 0xdd74
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000dd5c ; je 0xdd5c
+push edx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000dd5c:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x853
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000dd74:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000dd7e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov ebx, dword [ebp + 0xc]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000dda4 ; je 0xdda4
+push eax
+push eax
+push ref_000226f1 ; push 0x226f1
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000dda4:
+cmp byte [ebx], 5
+jbe near loc_0000de39 ; jbe 0xde39
+xor edx, edx
+
+loc_0000ddaf:
+cmp dl, byte [ebx + 0x526]
+jae short loc_0000dde0 ; jae 0xdde0
+movzx eax, dl
+mov esi, dword [ebp + 8]
+push edi
+lea eax, [ebx + eax*8]
+push edi
+push dword [eax + 0x4e2]
+add esi, dword [eax + 0x4de]
+mov dword [ebp - 0x1c], edx
+push esi
+call fcn_00017e8f ; call 0x17e8f
+mov edx, dword [ebp - 0x1c]
+add esp, 0x10
+inc edx
+jmp short loc_0000ddaf ; jmp 0xddaf
+
+loc_0000dde0:
+xor edx, edx
+
+loc_0000dde2:
+cmp dl, byte [ebx + 0x553]
+jae short loc_0000de16 ; jae 0xde16
+movzx eax, dl
+lea eax, [ebx + eax*4]
+push esi
+push esi
+movzx ecx, word [eax + 0x529]
+mov dword [ebp - 0x1c], edx
+push ecx
+movzx eax, word [eax + 0x527]
+add eax, dword [ebp + 8]
+push eax
+call fcn_00017e04 ; call 0x17e04
+mov edx, dword [ebp - 0x1c]
+add esp, 0x10
+inc edx
+jmp short loc_0000dde2 ; jmp 0xdde2
+
+loc_0000de16:
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_0000dec7 ; je 0xdec7
+push eax
+push eax
+push ref_00022718 ; push 0x22718
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp near loc_0000dec7 ; jmp 0xdec7
+
+loc_0000de39:
+call fcn_0001bfbb ; call 0x1bfbb
+mov esi, ref_00026f9c ; mov esi, 0x26f9c
+mov edx, ref_00026fc0 ; mov edx, 0x26fc0
+mov edi, ref_00026fd8 ; mov edi, 0x26fd8
+cmp eax, 2
+sete bl
+setne cl
+cmovne esi, edx
+movzx ebx, bl
+mov edx, ref_00027000 ; mov edx, 0x27000
+movzx ecx, cl
+cmovne edi, edx
+add ecx, 5
+lea ebx, [ebx + ebx*2 + 6]
+xor edx, edx
+
+loc_0000de70:
+movzx eax, dl
+cmp eax, ecx
+jae short loc_0000de9c ; jae 0xde9c
+mov dword [ebp - 0x20], ecx
+lea eax, [edi + eax*8]
+push ecx
+push ecx
+mov ecx, dword [ebp + 8]
+push dword [eax + 4]
+add ecx, dword [eax]
+mov dword [ebp - 0x1c], edx
+push ecx
+call fcn_00017e8f ; call 0x17e8f
+mov edx, dword [ebp - 0x1c]
+add esp, 0x10
+mov ecx, dword [ebp - 0x20]
+inc edx
+jmp short loc_0000de70 ; jmp 0xde70
+
+loc_0000de9c:
+xor edi, edi
+
+loc_0000de9e:
+mov eax, edi
+movzx eax, al
+cmp eax, ebx
+jae near loc_0000de16 ; jae 0xde16
+lea eax, [esi + eax*4]
+inc edi
+push edx
+push edx
+movzx edx, word [eax + 2]
+push edx
+movzx eax, word [eax]
+add eax, dword [ebp + 8]
+push eax
+call fcn_00017e04 ; call 0x17e04
+add esp, 0x10
+jmp short loc_0000de9e ; jmp 0xde9e
+
+loc_0000dec7:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000ded1:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000def4 ; je 0xdef4
+push ebx
+push ebx
+push ref_0002273d ; push 0x2273d
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000def4:
+push ecx
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov edi, eax
+lea eax, [eax + 0xa4]
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test al, 4
+je near loc_0000dfd2 ; je 0xdfd2
+push ecx
+push ecx
+push 1
+push dword [ebp + 8]
+call fcn_0001be4f ; call 0x1be4f
+mov dword [esp], 0x70
+call fcn_00018ee1 ; call 0x18ee1
+pop esi
+mov bl, al
+pop eax
+and ebx, 0xffffff80
+push 0
+push dword [ebp + 8]
+call fcn_0001be4f ; call 0x1be4f
+mov dl, bl
+or ebx, 0xb
+or edx, 0xa
+movzx ebx, bl
+pop eax
+movzx esi, dl
+pop edx
+push esi
+push 0x70
+call fcn_00018eea ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1 ; call 0x18ee1
+pop ecx
+pop edx
+and eax, 0x8f
+or eax, 0x60
+push eax
+push 0x71
+call fcn_00018eea ; call 0x18eea
+pop ecx
+pop eax
+push ebx
+push 0x70
+call fcn_00018eea ; call 0x18eea
+pop eax
+pop edx
+push 0x80
+push 0x71
+call fcn_00017f7f ; call 0x17f7f
+pop ecx
+pop eax
+push esi
+push 0x70
+call fcn_00018eea ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1 ; call 0x18ee1
+pop edx
+pop ecx
+and eax, 0x8f
+or eax, 0x20
+push eax
+push 0x71
+call fcn_00018eea ; call 0x18eea
+pop esi
+pop eax
+push ebx
+push 0x70
+call fcn_00018eea ; call 0x18eea
+pop eax
+pop edx
+push 0x7f
+push 0x71
+call fcn_00017fac ; call 0x17fac
+add esp, 0x10
+
+loc_0000dfd2:
+mov eax, dword [ebp + 8]
+add edi, 0xdc
+push edx
+push edx
+push 0x10
+lea esi, [eax + 0x3310]
+push esi
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0xc
+push 8
+push 0xf3
+push edi
+call fcn_0001878a ; call 0x1878a
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_0000e018 ; je 0xe018
+push eax
+push eax
+push ref_00022755 ; push 0x22755
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e018:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000e020:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e03f ; je 0xe03f
+push esi
+push esi
+push ref_0002276b ; push 0x2276b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e03f:
+call fcn_0001bd75 ; call 0x1bd75
+test al, al
+jne short loc_0000e086 ; jne 0xe086
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e065 ; je 0xe065
+push ebx
+push ebx
+push ref_00022788 ; push 0x22788
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e065:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0000e086 ; je 0xe086
+push ecx
+push ref_00022281 ; push 0x22281
+push 0x974
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000e086:
+push edx
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov ebx, eax
+call fcn_00015479 ; call 0x15479
+and ebx, 0xffffc000
+add esp, 0x10
+test al, al
+je short loc_0000e0c4 ; je 0xe0c4
+push eax
+push eax
+push ref_000227c2 ; push 0x227c2
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e0c4:
+call fcn_00015480 ; call 0x15480
+sub esp, 0xc
+push ebx
+call fcn_0000ded1 ; call 0xded1
+mov dword [esp], 0xc
+call fcn_00019db6 ; call 0x19db6
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+jne short loc_0000e10e ; jne 0xe10e
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e104 ; je 0xe104
+push eax
+push eax
+push ref_000227eb ; push 0x227eb
+
+loc_0000e0f7:
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e104:
+mov ebx, 0x80000009
+jmp near loc_0000e262 ; jmp 0xe262
+
+loc_0000e10e:
+sub esp, 0xc
+push 0x28
+call fcn_00019db6 ; call 0x19db6
+add esp, 0x10
+mov esi, eax
+test eax, eax
+jne short loc_0000e133 ; jne 0xe133
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e104 ; je 0xe104
+push eax
+push eax
+push ref_00022821 ; push 0x22821
+jmp short loc_0000e0f7 ; jmp 0xe0f7
+
+loc_0000e133:
+push eax
+push 0x28
+push ref_00027030 ; push 0x27030
+push esi
+call fcn_0001713e ; call 0x1713e
+mov dword [ebx], 0x80000010
+mov dword [ebx + 4], ref_0002917c ; mov dword [ebx + 4], 0x2917c
+mov dword [ebx + 8], esi
+mov dword [esp], ebx
+call fcn_0001972b ; call 0x1972b
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000e1a0 ; je 0xe1a0
+test ebx, ebx
+jns short loc_0000e1a0 ; jns 0xe1a0
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e188 ; je 0xe188
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e188:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x99d
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000e1a0:
+sub esp, 0xc
+push ref_00026f80 ; push 0x26f80
+call fcn_0001972b ; call 0x1972b
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000e1f4 ; je 0xe1f4
+test ebx, ebx
+jns short loc_0000e1f4 ; jns 0xe1f4
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e1dc ; je 0xe1dc
+push esi
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e1dc:
+push ebx
+push ref_000206f4 ; push 0x206f4
+push 0x9a3
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000e1f4:
+sub esp, 0xc
+push ref_00026f5c ; push 0x26f5c
+call fcn_0001977f ; call 0x1977f
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000e248 ; je 0xe248
+test ebx, ebx
+jns short loc_0000e248 ; jns 0xe248
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e230 ; je 0xe230
+push ecx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e230:
+push edx
+push ref_000206f4 ; push 0x206f4
+push 0x9a9
+push ref_00022320 ; push 0x22320
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0000e248:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e262 ; je 0xe262
+push eax
+push eax
+push ref_00022853 ; push 0x22853
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e262:
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000e26b:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e28d ; je 0xe28d
+push edx
+push edx
+push ref_0002286e ; push 0x2286e
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e28d:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e2ae ; je 0xe2ae
+push eax
+movzx eax, byte [ebx + 0xb4]
+push eax
+push ref_000228a4 ; push 0x228a4
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e2ae:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e2cf ; je 0xe2cf
+push eax
+movzx eax, byte [ebx + 0xb5]
+push eax
+push ref_000228a4 ; push 0x228a4
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e2cf:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e2ed ; je 0xe2ed
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+push ref_000228b8 ; push 0x228b8
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e2ed:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e30b ; je 0xe30b
+push eax
+movzx eax, byte [ebx + 9]
+push eax
+push ref_000228c8 ; push 0x228c8
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e30b:
+xor esi, esi
+
+loc_0000e30d:
+call fcn_0001c261 ; call 0x1c261
+movzx eax, al
+cmp esi, eax
+jae short loc_0000e35a ; jae 0xe35a
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e338 ; je 0xe338
+movzx eax, byte [ebx + esi*8 + 0x2c]
+push eax
+push esi
+push ref_000228d8 ; push 0x228d8
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e338:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e357 ; je 0xe357
+movzx eax, byte [ebx + esi*8 + 0x32]
+push eax
+push esi
+push ref_000228f7 ; push 0x228f7
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e357:
+inc esi
+jmp short loc_0000e30d ; jmp 0xe30d
+
+loc_0000e35a:
+xor esi, esi
+
+loc_0000e35c:
+call fcn_0001c2f8 ; call 0x1c2f8
+movzx eax, al
+cmp esi, eax
+jae short loc_0000e38d ; jae 0xe38d
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e38a ; je 0xe38a
+movzx eax, byte [ebx + esi*4 + 0x9c]
+push eax
+push esi
+push ref_00022918 ; push 0x22918
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e38a:
+inc esi
+jmp short loc_0000e35c ; jmp 0xe35c
+
+loc_0000e38d:
+xor esi, esi
+
+loc_0000e38f:
+call fcn_0001c245 ; call 0x1c245
+movzx eax, al
+cmp esi, eax
+jae short loc_0000e3bc ; jae 0xe3bc
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e3b9 ; je 0xe3b9
+movzx eax, byte [ebx + esi*8]
+push eax
+push esi
+push ref_00022939 ; push 0x22939
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e3b9:
+inc esi
+jmp short loc_0000e38f ; jmp 0xe38f
+
+loc_0000e3bc:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e3da ; je 0xe3da
+push eax
+movzx eax, byte [ebx + 0x10]
+push eax
+push ref_00022959 ; push 0x22959
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e3da:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e3f8 ; je 0xe3f8
+push eax
+movzx eax, byte [ebx + 0x11]
+push eax
+push ref_00022972 ; push 0x22972
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e3f8:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e416 ; je 0xe416
+push esi
+movzx eax, byte [ebx + 0x12]
+push eax
+push ref_00022995 ; push 0x22995
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e416:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e434 ; je 0xe434
+push ecx
+movzx eax, byte [ebx + 0x13]
+push eax
+push ref_000229ae ; push 0x229ae
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e434:
+xor esi, esi
+
+loc_0000e436:
+call fcn_0001c298 ; call 0x1c298
+movzx eax, al
+cmp esi, eax
+jae short loc_0000e478 ; jae 0xe478
+cmp byte [ebx + esi + 0x14], 0
+jne short loc_0000e45b ; jne 0xe45b
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e475 ; je 0xe475
+push edx
+push esi
+push ref_000229cd ; push 0x229cd
+jmp short loc_0000e46b ; jmp 0xe46b
+
+loc_0000e45b:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e475 ; je 0xe475
+push eax
+push esi
+push ref_00022a02 ; push 0x22a02
+
+loc_0000e46b:
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e475:
+inc esi
+jmp short loc_0000e436 ; jmp 0xe436
+
+loc_0000e478:
+xor esi, esi
+
+loc_0000e47a:
+call fcn_0001c2f8 ; call 0x1c2f8
+movzx eax, al
+cmp esi, eax
+jae short loc_0000e4a8 ; jae 0xe4a8
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e4a5 ; je 0xe4a5
+movzx eax, byte [ebx + esi + 0x22]
+push eax
+push esi
+push ref_00022a37 ; push 0x22a37
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e4a5:
+inc esi
+jmp short loc_0000e47a ; jmp 0xe47a
+
+loc_0000e4a8:
+xor esi, esi
+
+loc_0000e4aa:
+call fcn_0001c261 ; call 0x1c261
+movzx eax, al
+cmp esi, eax
+jae short loc_0000e516 ; jae 0xe516
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e4d5 ; je 0xe4d5
+movzx eax, byte [ebx + esi*8 + 0x2d]
+push eax
+push esi
+push ref_00022a6b ; push 0x22a6b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e4d5:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e4f4 ; je 0xe4f4
+movzx eax, byte [ebx + esi*8 + 0x2e]
+push eax
+push esi
+push ref_00022a90 ; push 0x22a90
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e4f4:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e513 ; je 0xe513
+movzx eax, byte [ebx + esi*8 + 0x2f]
+push eax
+push esi
+push ref_00022ac0 ; push 0x22ac0
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e513:
+inc esi
+jmp short loc_0000e4aa ; jmp 0xe4aa
+
+loc_0000e516:
+xor esi, esi
+
+loc_0000e518:
+call fcn_0001c2f8 ; call 0x1c2f8
+movzx eax, al
+cmp esi, eax
+jae short loc_0000e56b ; jae 0xe56b
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e546 ; je 0xe546
+movzx eax, byte [ebx + esi*4 + 0x9d]
+push eax
+push esi
+push ref_00022af0 ; push 0x22af0
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e546:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e568 ; je 0xe568
+movzx eax, byte [ebx + esi*4 + 0x9e]
+push eax
+push esi
+push ref_00022b15 ; push 0x22b15
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e568:
+inc esi
+jmp short loc_0000e518 ; jmp 0xe518
+
+loc_0000e56b:
+xor esi, esi
+
+loc_0000e56d:
+call fcn_0001c21c ; call 0x1c21c
+movzx eax, al
+cmp esi, eax
+jae short loc_0000e5ab ; jae 0xe5ab
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e5a8 ; je 0xe5a8
+mov ax, word [ebx + esi*8 + 0x30]
+sub esp, 0xc
+mov edx, eax
+and edx, 0xf
+shr ax, 4
+push edx
+movzx eax, ax
+push eax
+push esi
+push ref_00022b3c ; push 0x22b3c
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_0000e5a8:
+inc esi
+jmp short loc_0000e56d ; jmp 0xe56d
+
+loc_0000e5ab:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000e5b2:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e5d4 ; je 0xe5d4
+push eax
+push eax
+push ref_00022b5a ; push 0x22b5a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e5d4:
+xor ebx, ebx
+
+loc_0000e5d6:
+call fcn_0001c2f8 ; call 0x1c2f8
+movzx eax, al
+cmp ebx, eax
+jae near loc_0000e718 ; jae 0xe718
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e604 ; je 0xe604
+movzx eax, byte [esi + ebx*8]
+push eax
+push ebx
+push ref_00022b99 ; push 0x22b99
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e604:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e623 ; je 0xe623
+movzx eax, byte [esi + ebx*8 + 1]
+push eax
+push ebx
+push ref_00022bca ; push 0x22bca
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e623:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e642 ; je 0xe642
+movzx eax, byte [esi + ebx*8 + 2]
+push eax
+push ebx
+push ref_00022bfe ; push 0x22bfe
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e642:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e663 ; je 0xe663
+mov al, byte [esi + ebx*8 + 3]
+and eax, 1
+push eax
+push ebx
+push ref_00022c2b ; push 0x22c2b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e663:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e686 ; je 0xe686
+mov al, byte [esi + ebx*8 + 3]
+shr al, 1
+movzx eax, al
+push eax
+push ebx
+push ref_00022c55 ; push 0x22c55
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e686:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e6a7 ; je 0xe6a7
+mov al, byte [esi + ebx*8 + 4]
+and eax, 1
+push eax
+push ebx
+push ref_00022c87 ; push 0x22c87
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e6a7:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e6ca ; je 0xe6ca
+mov al, byte [esi + ebx*8 + 4]
+shr al, 1
+and eax, 1
+push eax
+push ebx
+push ref_00022cbe ; push 0x22cbe
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e6ca:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e6ee ; je 0xe6ee
+mov al, byte [esi + ebx*8 + 4]
+shr al, 2
+and eax, 1
+push eax
+push ebx
+push ref_00022cf8 ; push 0x22cf8
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e6ee:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e712 ; je 0xe712
+mov al, byte [esi + ebx*8 + 4]
+shr al, 3
+and eax, 1
+push eax
+push ebx
+push ref_00022d2b ; push 0x22d2b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e712:
+inc ebx
+jmp near loc_0000e5d6 ; jmp 0xe5d6
+
+loc_0000e718:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000e71f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e745 ; je 0xe745
+push eax
+push eax
+push ref_00022d57 ; push 0x22d57
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e745:
+lea edi, [esi + 0x1e]
+xor ebx, ebx
+
+loc_0000e74a:
+call fcn_0001c1bf ; call 0x1c1bf
+movzx eax, al
+cmp ebx, eax
+jae near loc_0000eba0 ; jae 0xeba0
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e77d ; je 0xe77d
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax]
+and eax, 1
+push eax
+push ebx
+push ref_00022d8e ; push 0x22d8e
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e77d:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e7a2 ; je 0xe7a2
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax]
+shr al, 1
+and eax, 1
+push eax
+push ebx
+push ref_00022da9 ; push 0x22da9
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e7a2:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e7c8 ; je 0xe7c8
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax]
+shr al, 2
+and eax, 1
+push eax
+push ebx
+push ref_00022dc1 ; push 0x22dc1
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e7c8:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e7ee ; je 0xe7ee
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax]
+shr al, 3
+and eax, 1
+push eax
+push ebx
+push ref_00022de4 ; push 0x22de4
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e7ee:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e814 ; je 0xe814
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax]
+shr al, 4
+and eax, 1
+push eax
+push ebx
+push ref_00022dff ; push 0x22dff
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e814:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e83a ; je 0xe83a
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax]
+shr al, 5
+and eax, 1
+push eax
+push ebx
+push ref_00022e18 ; push 0x22e18
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e83a:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e860 ; je 0xe860
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax + 4]
+shr al, 1
+and eax, 1
+push eax
+push ebx
+push ref_00022e33 ; push 0x22e33
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e860:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e887 ; je 0xe887
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax + 4]
+shr al, 2
+and eax, 1
+push eax
+push ebx
+push ref_00022e5f ; push 0x22e5f
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e887:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e8ae ; je 0xe8ae
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax + 4]
+shr al, 3
+and eax, 1
+push eax
+push ebx
+push ref_00022e83 ; push 0x22e83
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e8ae:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e8d5 ; je 0xe8d5
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax + 4]
+shr al, 4
+and eax, 1
+push eax
+push ebx
+push ref_00022ea9 ; push 0x22ea9
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e8d5:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e8fc ; je 0xe8fc
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax + 4]
+shr al, 5
+and eax, 1
+push eax
+push ebx
+push ref_00022ed3 ; push 0x22ed3
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e8fc:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e923 ; je 0xe923
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax + 4]
+shr al, 6
+and eax, 1
+push eax
+push ebx
+push ref_00022ef3 ; push 0x22ef3
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e923:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e94a ; je 0xe94a
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax + 4]
+shr al, 7
+movzx eax, al
+push eax
+push ebx
+push ref_00022f1e ; push 0x22f1e
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e94a:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e96e ; je 0xe96e
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax + 5]
+and eax, 1
+push eax
+push ebx
+push ref_00022f4c ; push 0x22f4c
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e96e:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e992 ; je 0xe992
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax + 4]
+and eax, 1
+push eax
+push ebx
+push ref_00022f7d ; push 0x22f7d
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e992:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e9b8 ; je 0xe9b8
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax]
+shr al, 6
+and eax, 1
+push eax
+push ebx
+push ref_00022fa7 ; push 0x22fa7
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e9b8:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e9d6 ; je 0xe9d6
+movzx eax, byte [edi - 0x16]
+push eax
+push ebx
+push ref_00022fcf ; push 0x22fcf
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e9d6:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000e9f4 ; je 0xe9f4
+movzx eax, byte [edi - 0x15]
+push eax
+push ebx
+push ref_00022fec ; push 0x22fec
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000e9f4:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ea12 ; je 0xea12
+movzx eax, byte [edi - 0x14]
+push eax
+push ebx
+push ref_0002300e ; push 0x2300e
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ea12:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ea30 ; je 0xea30
+movzx eax, byte [edi - 0x13]
+push eax
+push ebx
+push ref_00023034 ; push 0x23034
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ea30:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ea4e ; je 0xea4e
+movzx eax, byte [edi - 0xe]
+push eax
+push ebx
+push ref_00023059 ; push 0x23059
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ea4e:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ea6c ; je 0xea6c
+movzx eax, byte [edi - 0xd]
+push eax
+push ebx
+push ref_00023071 ; push 0x23071
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ea6c:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ea8a ; je 0xea8a
+movzx eax, byte [edi - 0xc]
+push eax
+push ebx
+push ref_00023090 ; push 0x23090
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ea8a:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000eaa8 ; je 0xeaa8
+movzx eax, byte [edi - 0xb]
+push eax
+push ebx
+push ref_000230ad ; push 0x230ad
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000eaa8:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000eac6 ; je 0xeac6
+movzx eax, word [edi - 0xa]
+push eax
+push ebx
+push ref_000230ce ; push 0x230ce
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000eac6:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000eae4 ; je 0xeae4
+movzx eax, word [edi - 8]
+push eax
+push ebx
+push ref_000230f4 ; push 0x230f4
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000eae4:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000eb02 ; je 0xeb02
+movzx eax, byte [edi - 6]
+push eax
+push ebx
+push ref_0002311c ; push 0x2311c
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000eb02:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000eb20 ; je 0xeb20
+movzx eax, byte [edi - 5]
+push eax
+push ebx
+push ref_00023148 ; push 0x23148
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000eb20:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000eb3e ; je 0xeb3e
+movzx eax, word [edi - 4]
+push eax
+push ebx
+push ref_0002317a ; push 0x2317a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000eb3e:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000eb5c ; je 0xeb5c
+movzx eax, byte [edi - 2]
+push eax
+push ebx
+push ref_000231a7 ; push 0x231a7
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000eb5c:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000eb7a ; je 0xeb7a
+movzx eax, byte [edi - 1]
+push eax
+push ebx
+push ref_000231d6 ; push 0x231d6
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000eb7a:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000eb97 ; je 0xeb97
+movzx eax, word [edi]
+push eax
+push ebx
+push ref_0002320b ; push 0x2320b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000eb97:
+inc ebx
+add edi, 0x2c
+jmp near loc_0000e74a ; jmp 0xe74a
+
+loc_0000eba0:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ebc1 ; je 0xebc1
+push edi
+movzx eax, byte [esi + 0x160]
+push eax
+push ref_0002323b ; push 0x2323b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ebc1:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ebe2 ; je 0xebe2
+push ebx
+movzx eax, byte [esi + 0x161]
+push eax
+push ref_00023251 ; push 0x23251
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ebe2:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ec03 ; je 0xec03
+push ecx
+movzx eax, byte [esi + 0x162]
+push eax
+push ref_00023267 ; push 0x23267
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ec03:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ec24 ; je 0xec24
+push edx
+movzx eax, byte [esi + 0x163]
+push eax
+push ref_00023281 ; push 0x23281
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ec24:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ec47 ; je 0xec47
+push eax
+mov al, byte [esi + 0x164]
+and eax, 1
+push eax
+push ref_000232a0 ; push 0x232a0
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ec47:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000ec4f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ec75 ; je 0xec75
+push edi
+push edi
+push ref_000232bf ; push 0x232bf
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ec75:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ec92 ; je 0xec92
+push ebx
+movzx eax, byte [esi]
+push eax
+push ref_00023454 ; push 0x23454
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ec92:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ecae ; je 0xecae
+push ecx
+push dword [esi + 1]
+push ref_000232f6 ; push 0x232f6
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ecae:
+lea edi, [esi + 0xd]
+xor ebx, ebx
+
+loc_0000ecb3:
+call fcn_0001c1e1 ; call 0x1c1e1
+movzx eax, al
+cmp ebx, eax
+jae near loc_0000f052 ; jae 0xf052
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ece7 ; je 0xece7
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 5]
+and eax, 1
+push eax
+push ebx
+push ref_000228d8 ; push 0x228d8
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ece7:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ed0d ; je 0xed0d
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 5]
+shr al, 1
+and eax, 1
+push eax
+push ebx
+push ref_00023305 ; push 0x23305
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ed0d:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ed34 ; je 0xed34
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 5]
+shr al, 2
+and eax, 1
+push eax
+push ebx
+push ref_00023324 ; push 0x23324
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ed34:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ed5b ; je 0xed5b
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 5]
+shr al, 3
+and eax, 1
+push eax
+push ebx
+push ref_00023347 ; push 0x23347
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ed5b:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ed82 ; je 0xed82
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 5]
+shr al, 4
+and eax, 1
+push eax
+push ebx
+push ref_00023367 ; push 0x23367
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ed82:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000eda9 ; je 0xeda9
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 5]
+shr al, 5
+and eax, 1
+push eax
+push ebx
+push ref_00023385 ; push 0x23385
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000eda9:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000edd0 ; je 0xedd0
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 5]
+shr al, 6
+and eax, 1
+push eax
+push ebx
+push ref_000233ac ; push 0x233ac
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000edd0:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000edf7 ; je 0xedf7
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 5]
+shr al, 7
+movzx eax, al
+push eax
+push ebx
+push ref_000233ca ; push 0x233ca
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000edf7:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ee1b ; je 0xee1b
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 6]
+and eax, 0xf
+push eax
+push ebx
+push ref_000233f2 ; push 0x233f2
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ee1b:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ee4f ; je 0xee4f
+imul edx, ebx, 0x12
+add edx, esi
+mov al, byte [edx + 6]
+shr al, 4
+movzx ecx, al
+movzx eax, byte [edx + 7]
+and eax, 0x3f
+shl eax, 4
+or eax, ecx
+push eax
+push ebx
+push ref_0002340f ; push 0x2340f
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ee4f:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ee6d ; je 0xee6d
+movzx eax, byte [edi - 3]
+push eax
+push ebx
+push ref_0002342e ; push 0x2342e
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ee6d:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ee8b ; je 0xee8b
+movzx eax, byte [edi - 4]
+push eax
+push ebx
+push ref_00023461 ; push 0x23461
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ee8b:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000eea9 ; je 0xeea9
+movzx eax, byte [edi - 1]
+push eax
+push ebx
+push ref_00023492 ; push 0x23492
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000eea9:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000eec7 ; je 0xeec7
+movzx eax, byte [edi - 2]
+push eax
+push ebx
+push ref_000234c5 ; push 0x234c5
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000eec7:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000eee5 ; je 0xeee5
+movzx eax, byte [edi + 1]
+push eax
+push ebx
+push ref_000234f6 ; push 0x234f6
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000eee5:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ef02 ; je 0xef02
+movzx eax, byte [edi]
+push eax
+push ebx
+push ref_00023529 ; push 0x23529
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ef02:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ef24 ; je 0xef24
+imul eax, ebx, 0x12
+movzx eax, byte [esi + eax + 0xf]
+push eax
+push ebx
+push ref_0002355a ; push 0x2355a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ef24:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ef46 ; je 0xef46
+imul eax, ebx, 0x12
+movzx eax, byte [esi + eax + 0x10]
+push eax
+push ebx
+push ref_00023590 ; push 0x23590
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ef46:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ef68 ; je 0xef68
+imul eax, ebx, 0x12
+movzx eax, byte [esi + eax + 0x11]
+push eax
+push ebx
+push ref_000235c7 ; push 0x235c7
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ef68:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ef8a ; je 0xef8a
+imul eax, ebx, 0x12
+movzx eax, byte [esi + eax + 0x12]
+push eax
+push ebx
+push ref_000235f8 ; push 0x235f8
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ef8a:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000efae ; je 0xefae
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 0x13]
+and eax, 1
+push eax
+push ebx
+push ref_0002362a ; push 0x2362a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000efae:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000efd4 ; je 0xefd4
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 0x13]
+shr al, 1
+and eax, 1
+push eax
+push ebx
+push ref_00023666 ; push 0x23666
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000efd4:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000effb ; je 0xeffb
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 0x13]
+shr al, 2
+and eax, 1
+push eax
+push ebx
+push ref_000236a3 ; push 0x236a3
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000effb:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f022 ; je 0xf022
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 0x13]
+shr al, 3
+and eax, 1
+push eax
+push ebx
+push ref_000236da ; push 0x236da
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f022:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f049 ; je 0xf049
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 7]
+shr al, 6
+and eax, 1
+push eax
+push ebx
+push ref_00023712 ; push 0x23712
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f049:
+inc ebx
+add edi, 0x12
+jmp near loc_0000ecb3 ; jmp 0xecb3
+
+loc_0000f052:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f072 ; je 0xf072
+push edx
+mov al, byte [esi + 0x71]
+and eax, 1
+push eax
+push ref_00023749 ; push 0x23749
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f072:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f094 ; je 0xf094
+push eax
+mov al, byte [esi + 0x71]
+shr al, 1
+and eax, 1
+push eax
+push ref_0002375f ; push 0x2375f
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f094:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f0b7 ; je 0xf0b7
+push eax
+mov al, byte [esi + 0x71]
+shr al, 2
+and eax, 1
+push eax
+push ref_0002376b ; push 0x2376b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f0b7:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f0da ; je 0xf0da
+push eax
+mov al, byte [esi + 0x71]
+shr al, 3
+and eax, 1
+push eax
+push ref_00023777 ; push 0x23777
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f0da:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f0fd ; je 0xf0fd
+push eax
+mov al, byte [esi + 0x71]
+shr al, 4
+and eax, 1
+push eax
+push ref_00023784 ; push 0x23784
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f0fd:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f120 ; je 0xf120
+push eax
+mov al, byte [esi + 0x71]
+shr al, 5
+and eax, 1
+push eax
+push ref_00023790 ; push 0x23790
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f120:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f143 ; je 0xf143
+push eax
+mov al, byte [esi + 0x71]
+shr al, 6
+and eax, 1
+push eax
+push ref_0002379b ; push 0x2379b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f143:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f171 ; je 0xf171
+push edi
+mov al, byte [esi + 0x71]
+shr al, 7
+movzx edx, al
+movzx eax, byte [esi + 0x72]
+and eax, 1
+add eax, eax
+or eax, edx
+push eax
+push ref_000237ae ; push 0x237ae
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f171:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f193 ; je 0xf193
+push ebx
+mov al, byte [esi + 0x72]
+shr al, 1
+and eax, 1
+push eax
+push ref_000237c0 ; push 0x237c0
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f193:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f1b6 ; je 0xf1b6
+push ecx
+mov al, byte [esi + 0x72]
+shr al, 2
+and eax, 1
+push eax
+push ref_000237d0 ; push 0x237d0
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f1b6:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f1d9 ; je 0xf1d9
+push edx
+mov al, byte [esi + 0x72]
+shr al, 3
+and eax, 1
+push eax
+push ref_000237e0 ; push 0x237e0
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f1d9:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f1fc ; je 0xf1fc
+push eax
+mov al, byte [esi + 0x72]
+shr al, 4
+and eax, 1
+push eax
+push ref_000237ef ; push 0x237ef
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f1fc:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f218 ; je 0xf218
+push eax
+push dword [esi + 0x75]
+push ref_00023802 ; push 0x23802
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f218:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f236 ; je 0xf236
+push eax
+movzx eax, byte [esi + 0x7d]
+push eax
+push ref_00023815 ; push 0x23815
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f236:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f254 ; je 0xf254
+push eax
+movzx eax, byte [esi + 0x79]
+push eax
+push ref_0002382b ; push 0x2382b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f254:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f272 ; je 0xf272
+push eax
+movzx eax, byte [esi + 0x7a]
+push eax
+push ref_0002383a ; push 0x2383a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f272:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f290 ; je 0xf290
+push eax
+movzx eax, byte [esi + 0x7b]
+push eax
+push ref_0002384b ; push 0x2384b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f290:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f2ae ; je 0xf2ae
+push edi
+movzx eax, byte [esi + 0x7c]
+push eax
+push ref_0002385d ; push 0x2385d
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f2ae:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f2cc ; je 0xf2cc
+push ebx
+movzx eax, byte [esi + 0x7e]
+push eax
+push ref_00023870 ; push 0x23870
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f2cc:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f2ea ; je 0xf2ea
+push ecx
+movzx eax, byte [esi + 0x7f]
+push eax
+push ref_0002388b ; push 0x2388b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f2ea:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f30b ; je 0xf30b
+push edx
+movzx eax, byte [esi + 0x80]
+push eax
+push ref_000238ac ; push 0x238ac
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f30b:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f32c ; je 0xf32c
+push eax
+movzx eax, byte [esi + 0x81]
+push eax
+push ref_000238d5 ; push 0x238d5
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f32c:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000f334:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f356 ; je 0xf356
+push eax
+push eax
+push ref_000238fa ; push 0x238fa
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f356:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f373 ; je 0xf373
+push eax
+movzx eax, byte [ebx]
+push eax
+push ref_00023933 ; push 0x23933
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f373:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f391 ; je 0xf391
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+push ref_00023942 ; push 0x23942
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f391:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f3af ; je 0xf3af
+push eax
+movzx eax, byte [ebx + 2]
+push eax
+push ref_00023952 ; push 0x23952
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f3af:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f3cd ; je 0xf3cd
+push eax
+movzx eax, byte [ebx + 3]
+push eax
+push ref_00022ff9 ; push 0x22ff9
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f3cd:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f3eb ; je 0xf3eb
+push ecx
+movzx eax, byte [ebx + 4]
+push eax
+push ref_00023965 ; push 0x23965
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f3eb:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f409 ; je 0xf409
+push edx
+movzx eax, byte [ebx + 5]
+push eax
+push ref_00023974 ; push 0x23974
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f409:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f427 ; je 0xf427
+push eax
+movzx eax, byte [ebx + 6]
+push eax
+push ref_0002398a ; push 0x2398a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f427:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000f42c:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f44e ; je 0xf44e
+push eax
+push eax
+push ref_000239a1 ; push 0x239a1
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f44e:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f46b ; je 0xf46b
+push eax
+movzx eax, byte [ebx]
+push eax
+push ref_000239d8 ; push 0x239d8
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f46b:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f489 ; je 0xf489
+push eax
+movzx eax, byte [ebx + 8]
+push eax
+push ref_000239e4 ; push 0x239e4
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f489:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f4a7 ; je 0xf4a7
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+push ref_000239f2 ; push 0x239f2
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f4a7:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f4c5 ; je 0xf4c5
+push ecx
+movzx eax, byte [ebx + 2]
+push eax
+push ref_00023a01 ; push 0x23a01
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f4c5:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f4e3 ; je 0xf4e3
+push edx
+movzx eax, byte [ebx + 3]
+push eax
+push ref_00023a13 ; push 0x23a13
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f4e3:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f4ff ; je 0xf4ff
+push eax
+push dword [ebx + 4]
+push ref_00023a27 ; push 0x23a27
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f4ff:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000f504:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f526 ; je 0xf526
+push eax
+push eax
+push ref_00023a31 ; push 0x23a31
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f526:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f545 ; je 0xf545
+push eax
+mov al, byte [ebx]
+and eax, 1
+push eax
+push ref_00023a6d ; push 0x23a6d
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f545:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f566 ; je 0xf566
+push eax
+mov al, byte [ebx]
+shr al, 1
+and eax, 1
+push eax
+push ref_00023a7d ; push 0x23a7d
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f566:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f588 ; je 0xf588
+push eax
+mov al, byte [ebx]
+shr al, 2
+and eax, 1
+push eax
+push ref_00023a91 ; push 0x23a91
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f588:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f5aa ; je 0xf5aa
+push ecx
+mov al, byte [ebx]
+shr al, 3
+and eax, 1
+push eax
+push ref_00023aa4 ; push 0x23aa4
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f5aa:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f5cc ; je 0xf5cc
+push edx
+mov al, byte [ebx]
+shr al, 4
+and eax, 1
+push eax
+push ref_00023ab2 ; push 0x23ab2
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f5cc:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f5ee ; je 0xf5ee
+push eax
+mov al, byte [ebx]
+shr al, 5
+and eax, 1
+push eax
+push ref_00023ac1 ; push 0x23ac1
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f5ee:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000f5f3:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f615 ; je 0xf615
+push eax
+push eax
+push ref_00023ace ; push 0x23ace
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f615:
+xor ebx, ebx
+
+loc_0000f617:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f637 ; je 0xf637
+mov al, byte [esi + ebx*8]
+and eax, 1
+push eax
+push ebx
+push ref_00023b11 ; push 0x23b11
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f637:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f659 ; je 0xf659
+mov al, byte [esi + ebx*8]
+shr al, 1
+and eax, 1
+push eax
+push ebx
+push ref_00023b31 ; push 0x23b31
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f659:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f678 ; je 0xf678
+movzx eax, word [esi + ebx*8 + 4]
+push eax
+push ebx
+push ref_00023b50 ; push 0x23b50
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f678:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f697 ; je 0xf697
+movzx eax, word [esi + ebx*8 + 6]
+push eax
+push ebx
+push ref_00023b6e ; push 0x23b6e
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f697:
+inc ebx
+cmp ebx, 5
+jne near loc_0000f617 ; jne 0xf617
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000f6a8:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f6ca ; je 0xf6ca
+push eax
+push eax
+push ref_00023b8b ; push 0x23b8b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f6ca:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f6e7 ; je 0xf6e7
+push eax
+movzx eax, byte [ebx]
+push eax
+push ref_00023454 ; push 0x23454
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f6e7:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f705 ; je 0xf705
+push eax
+movzx eax, word [ebx + 2]
+push eax
+push ref_00023bc3 ; push 0x23bc3
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f705:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f723 ; je 0xf723
+push esi
+movzx eax, byte [ebx + 7]
+push eax
+push ref_00023bd5 ; push 0x23bd5
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f723:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f73d ; je 0xf73d
+push ecx
+push ecx
+push ref_00023bf1 ; push 0x23bf1
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f73d:
+xor esi, esi
+
+loc_0000f73f:
+movzx eax, byte [ebx + 7]
+cmp esi, eax
+jae short loc_0000f769 ; jae 0xf769
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f766 ; je 0xf766
+push edx
+movzx eax, byte [ebx + esi + 8]
+push eax
+push ref_00023c0b ; push 0x23c0b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f766:
+inc esi
+jmp short loc_0000f73f ; jmp 0xf73f
+
+loc_0000f769:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f783 ; je 0xf783
+push eax
+push eax
+push ref_00023c12 ; push 0x23c12
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f783:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000f78a:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f7ac ; je 0xf7ac
+push eax
+push eax
+push ref_00023c16 ; push 0x23c16
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f7ac:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f7c9 ; je 0xf7c9
+push eax
+movzx eax, byte [ebx]
+push eax
+push ref_00023454 ; push 0x23454
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f7c9:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f7e7 ; je 0xf7e7
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+push ref_00023c4f ; push 0x23c4f
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f7e7:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f805 ; je 0xf805
+push ecx
+movzx eax, byte [ebx + 2]
+push eax
+push ref_00023c59 ; push 0x23c59
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f805:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f823 ; je 0xf823
+push edx
+movzx eax, byte [ebx + 2]
+push eax
+push ref_00023c59 ; push 0x23c59
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f823:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f841 ; je 0xf841
+push eax
+movzx eax, word [ebx + 4]
+push eax
+push ref_00023c6b ; push 0x23c6b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f841:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000f846:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f868 ; je 0xf868
+push eax
+push eax
+push ref_00023c80 ; push 0x23c80
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f868:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f887 ; je 0xf887
+push eax
+mov al, byte [ebx]
+and eax, 1
+push eax
+push ref_00023cb5 ; push 0x23cb5
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f887:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f8a8 ; je 0xf8a8
+push eax
+mov al, byte [ebx]
+shr al, 1
+and eax, 1
+push eax
+push ref_00023cdb ; push 0x23cdb
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f8a8:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f8ca ; je 0xf8ca
+push ecx
+mov al, byte [ebx]
+shr al, 2
+and eax, 1
+push eax
+push ref_00023d05 ; push 0x23d05
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f8ca:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f8ec ; je 0xf8ec
+push edx
+mov al, byte [ebx]
+shr al, 3
+and eax, 1
+push eax
+push ref_00023d2f ; push 0x23d2f
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f8ec:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f90e ; je 0xf90e
+push eax
+mov al, byte [ebx]
+shr al, 4
+and eax, 1
+push eax
+push ref_00023d59 ; push 0x23d59
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f90e:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f92e ; je 0xf92e
+push eax
+mov al, byte [ebx + 4]
+and eax, 1
+push eax
+push ref_00023d81 ; push 0x23d81
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f92e:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f950 ; je 0xf950
+push eax
+mov al, byte [ebx + 4]
+shr al, 1
+and eax, 1
+push eax
+push ref_00023d9d ; push 0x23d9d
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f950:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f973 ; je 0xf973
+push eax
+mov al, byte [ebx + 4]
+shr al, 2
+and eax, 1
+push eax
+push ref_00023dc0 ; push 0x23dc0
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f973:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f996 ; je 0xf996
+push eax
+mov al, byte [ebx + 4]
+shr al, 3
+and eax, 1
+push eax
+push ref_00023de4 ; push 0x23de4
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f996:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f9b9 ; je 0xf9b9
+push eax
+mov al, byte [ebx + 4]
+shr al, 4
+and eax, 1
+push eax
+push ref_00023e08 ; push 0x23e08
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f9b9:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f9dc ; je 0xf9dc
+push ecx
+mov al, byte [ebx + 4]
+shr al, 5
+and eax, 1
+push eax
+push ref_00023e26 ; push 0x23e26
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f9dc:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000f9f8 ; je 0xf9f8
+push edx
+push dword [ebx + 8]
+push ref_00023e4a ; push 0x23e4a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000f9f8:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fa14 ; je 0xfa14
+push eax
+push dword [ebx + 0xc]
+push ref_00023e5d ; push 0x23e5d
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fa14:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fa30 ; je 0xfa30
+push eax
+push dword [ebx + 0x10]
+push ref_00023e75 ; push 0x23e75
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fa30:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fa4c ; je 0xfa4c
+push eax
+push dword [ebx + 0x14]
+push ref_00023e8d ; push 0x23e8d
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fa4c:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fa68 ; je 0xfa68
+push eax
+push dword [ebx + 0x18]
+push ref_00023ea6 ; push 0x23ea6
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fa68:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fa88 ; je 0xfa88
+push eax
+mov al, byte [ebx + 0x1c]
+and eax, 1
+push eax
+push ref_00023ebd ; push 0x23ebd
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fa88:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000faaa ; je 0xfaaa
+push eax
+mov al, byte [ebx + 0x1c]
+shr al, 1
+and eax, 1
+push eax
+push ref_00023ecf ; push 0x23ecf
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000faaa:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000facd ; je 0xfacd
+push ecx
+mov al, byte [ebx + 0x1c]
+shr al, 2
+and eax, 1
+push eax
+push ref_00023ee3 ; push 0x23ee3
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000facd:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000faf0 ; je 0xfaf0
+push edx
+mov al, byte [ebx + 0x1c]
+shr al, 3
+and eax, 1
+push eax
+push ref_00023ef5 ; push 0x23ef5
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000faf0:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fb0e ; je 0xfb0e
+push eax
+movzx eax, byte [ebx + 0x20]
+push eax
+push ref_00023f0c ; push 0x23f0c
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fb0e:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000fb13:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fb35 ; je 0xfb35
+push eax
+push eax
+push ref_00023f1f ; push 0x23f1f
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fb35:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fb54 ; je 0xfb54
+push eax
+mov al, byte [ebx]
+and eax, 1
+push eax
+push ref_00023f55 ; push 0x23f55
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fb54:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fb75 ; je 0xfb75
+push eax
+mov al, byte [ebx]
+shr al, 1
+and eax, 1
+push eax
+push ref_00023f63 ; push 0x23f63
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fb75:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fb97 ; je 0xfb97
+push eax
+mov al, byte [ebx]
+shr al, 2
+and eax, 1
+push eax
+push ref_00023f74 ; push 0x23f74
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fb97:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fbb9 ; je 0xfbb9
+push ecx
+mov al, byte [ebx]
+shr al, 3
+and eax, 1
+push eax
+push ref_0002385d ; push 0x2385d
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fbb9:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fbdb ; je 0xfbdb
+push edx
+mov al, byte [ebx]
+shr al, 4
+and eax, 1
+push eax
+push ref_00023f81 ; push 0x23f81
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fbdb:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fbfd ; je 0xfbfd
+push eax
+mov al, byte [ebx]
+shr al, 5
+and eax, 1
+push eax
+push ref_00023f97 ; push 0x23f97
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fbfd:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000fc02:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fc24 ; je 0xfc24
+push eax
+push eax
+push ref_00023fac ; push 0x23fac
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fc24:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fc41 ; je 0xfc41
+push ecx
+movzx eax, byte [ebx]
+push eax
+push ref_00023fe7 ; push 0x23fe7
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fc41:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fc5d ; je 0xfc5d
+push edx
+push dword [ebx + 4]
+push ref_00023ff8 ; push 0x23ff8
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fc5d:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fc79 ; je 0xfc79
+push eax
+push dword [ebx + 8]
+push ref_00024007 ; push 0x24007
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fc79:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000fc7e:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fca0 ; je 0xfca0
+push ecx
+push ecx
+push ref_0002401d ; push 0x2401d
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fca0:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fcbf ; je 0xfcbf
+push edx
+mov al, byte [ebx]
+and eax, 1
+push eax
+push ref_00024057 ; push 0x24057
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fcbf:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fce0 ; je 0xfce0
+push eax
+mov al, byte [ebx]
+shr al, 1
+and eax, 1
+push eax
+push ref_00024078 ; push 0x24078
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fce0:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fd02 ; je 0xfd02
+push eax
+mov al, byte [ebx]
+shr al, 2
+and eax, 1
+push eax
+push ref_00024098 ; push 0x24098
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fd02:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fd24 ; je 0xfd24
+push eax
+mov al, byte [ebx]
+shr al, 3
+and eax, 1
+push eax
+push ref_000240bb ; push 0x240bb
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fd24:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fd4e ; je 0xfd4e
+push eax
+movzx eax, byte [ebx + 5]
+movzx edx, byte [ebx + 4]
+and eax, 1
+shl eax, 8
+or eax, edx
+push eax
+push ref_000240dd ; push 0x240dd
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fd4e:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fd7c ; je 0xfd7c
+push eax
+mov al, byte [ebx + 5]
+shr al, 1
+movzx edx, al
+movzx eax, byte [ebx + 6]
+and eax, 3
+shl eax, 7
+or eax, edx
+push eax
+push ref_00024117 ; push 0x24117
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fd7c:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fdab ; je 0xfdab
+push eax
+mov al, byte [ebx + 6]
+shr al, 2
+movzx edx, al
+movzx eax, byte [ebx + 7]
+and eax, 7
+shl eax, 6
+or eax, edx
+push eax
+push ref_00024151 ; push 0x24151
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fdab:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fdce ; je 0xfdce
+push esi
+mov al, byte [ebx + 7]
+shr al, 3
+and eax, 1
+push eax
+push ref_0002418b ; push 0x2418b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fdce:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fdf1 ; je 0xfdf1
+push ecx
+mov al, byte [ebx + 7]
+shr al, 4
+and eax, 1
+push eax
+push ref_000241b4 ; push 0x241b4
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fdf1:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fe14 ; je 0xfe14
+push edx
+mov al, byte [ebx + 7]
+shr al, 5
+and eax, 1
+push eax
+push ref_000241e4 ; push 0x241e4
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fe14:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fe37 ; je 0xfe37
+push eax
+mov al, byte [ebx + 7]
+shr al, 6
+and eax, 1
+push eax
+push ref_0002420b ; push 0x2420b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fe37:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fe5a ; je 0xfe5a
+push eax
+mov al, byte [ebx + 7]
+shr al, 7
+movzx eax, al
+push eax
+push ref_0002423c ; push 0x2423c
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fe5a:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fe7a ; je 0xfe7a
+push eax
+mov al, byte [ebx + 0xc]
+and eax, 1
+push eax
+push ref_0002426f ; push 0x2426f
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fe7a:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fe9a ; je 0xfe9a
+push eax
+mov al, byte [ebx + 0xd]
+and eax, 3
+push eax
+push ref_00024299 ; push 0x24299
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fe9a:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000febd ; je 0xfebd
+push eax
+mov al, byte [ebx + 0xd]
+shr al, 2
+and eax, 3
+push eax
+push ref_000242bf ; push 0x242bf
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000febd:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fee0 ; je 0xfee0
+push eax
+mov al, byte [ebx + 0xd]
+shr al, 4
+and eax, 3
+push eax
+push ref_000242e5 ; push 0x242e5
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fee0:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ff03 ; je 0xff03
+push esi
+mov al, byte [ebx + 0xd]
+shr al, 6
+movzx eax, al
+push eax
+push ref_0002430b ; push 0x2430b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ff03:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ff25 ; je 0xff25
+push ecx
+mov al, byte [ebx + 0xc]
+shr al, 1
+and eax, 1
+push eax
+push ref_00024331 ; push 0x24331
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ff25:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ff45 ; je 0xff45
+push edx
+mov al, byte [ebx + 0x10]
+and eax, 3
+push eax
+push ref_00024362 ; push 0x24362
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ff45:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ff68 ; je 0xff68
+push eax
+mov al, byte [ebx + 0x10]
+shr al, 2
+and eax, 3
+push eax
+push ref_00024386 ; push 0x24386
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ff68:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ff8b ; je 0xff8b
+push eax
+mov al, byte [ebx + 0x10]
+shr al, 4
+and eax, 3
+push eax
+push ref_000243aa ; push 0x243aa
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ff8b:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ffae ; je 0xffae
+push eax
+mov al, byte [ebx + 0x10]
+shr al, 6
+movzx eax, al
+push eax
+push ref_000243ce ; push 0x243ce
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ffae:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000ffce ; je 0xffce
+push eax
+mov al, byte [ebx + 0x12]
+and eax, 3
+push eax
+push ref_000243f4 ; push 0x243f4
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000ffce:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0000fff1 ; je 0xfff1
+push eax
+mov al, byte [ebx + 0x12]
+shr al, 2
+and eax, 1
+push eax
+push ref_0002441b ; push 0x2441b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0000fff1:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010011 ; je 0x10011
+push eax
+mov al, byte [ebx + 0x11]
+and eax, 3
+push eax
+push ref_00024446 ; push 0x24446
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010011:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010034 ; je 0x10034
+push esi
+mov al, byte [ebx + 0x11]
+shr al, 2
+and eax, 3
+push eax
+push ref_0002446a ; push 0x2446a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010034:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010057 ; je 0x10057
+push ecx
+mov al, byte [ebx + 0x11]
+shr al, 4
+and eax, 3
+push eax
+push ref_0002448e ; push 0x2448e
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010057:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001007a ; je 0x1007a
+push edx
+mov al, byte [ebx + 0x11]
+shr al, 6
+movzx eax, al
+push eax
+push ref_000244b2 ; push 0x244b2
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001007a:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001009d ; je 0x1009d
+push eax
+mov al, byte [ebx + 0x12]
+shr al, 3
+and eax, 3
+push eax
+push ref_000244d8 ; push 0x244d8
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001009d:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000100c0 ; je 0x100c0
+push eax
+mov al, byte [ebx + 0x12]
+shr al, 5
+and eax, 1
+push eax
+push ref_000244ff ; push 0x244ff
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000100c0:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000100e3 ; je 0x100e3
+push eax
+mov al, byte [ebx + 0x12]
+shr al, 6
+and eax, 1
+push eax
+push ref_0002452a ; push 0x2452a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000100e3:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010103 ; je 0x10103
+push eax
+mov al, byte [ebx + 0x14]
+and eax, 1
+push eax
+push ref_00024559 ; push 0x24559
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010103:
+mov esi, 2
+
+loc_00010108:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010129 ; je 0x10129
+push eax
+mov al, byte [ebx + esi*4 + 0x18]
+and eax, 1
+push eax
+push ref_00024577 ; push 0x24577
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010129:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001014c ; je 0x1014c
+push eax
+mov al, byte [ebx + esi*4 + 0x18]
+shr al, 1
+and eax, 1
+push eax
+push ref_000245ac ; push 0x245ac
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001014c:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010170 ; je 0x10170
+push ecx
+mov al, byte [ebx + esi*4 + 0x18]
+shr al, 2
+and eax, 1
+push eax
+push ref_000245e5 ; push 0x245e5
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010170:
+inc esi
+cmp esi, 4
+jne short loc_00010108 ; jne 0x10108
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010194 ; je 0x10194
+push edx
+movzx eax, word [ebx + 0x28]
+push eax
+push ref_0002461a ; push 0x2461a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010194:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000101b2 ; je 0x101b2
+push eax
+movzx eax, byte [ebx + 0x2a]
+push eax
+push ref_0002462d ; push 0x2462d
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000101b2:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_000101b9:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000101db ; je 0x101db
+push eax
+push eax
+push ref_0002464f ; push 0x2464f
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000101db:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000101f8 ; je 0x101f8
+push eax
+movzx eax, word [ebx]
+push eax
+push ref_00024689 ; push 0x24689
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000101f8:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010216 ; je 0x10216
+push ecx
+movzx eax, word [ebx + 2]
+push eax
+push ref_000246a1 ; push 0x246a1
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010216:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010234 ; je 0x10234
+push edx
+movzx eax, byte [ebx + 4]
+push eax
+push ref_000246b3 ; push 0x246b3
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010234:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010252 ; je 0x10252
+push eax
+movzx eax, byte [ebx + 5]
+push eax
+push ref_000246be ; push 0x246be
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010252:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00010257:
+push ebp
+mov ebp, esp
+push ebx
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010279 ; je 0x10279
+push ecx
+push ecx
+push ref_000246ca ; push 0x246ca
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010279:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010296 ; je 0x10296
+push edx
+movzx eax, byte [ebx]
+push eax
+push ref_00023454 ; push 0x23454
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010296:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000102b4 ; je 0x102b4
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+push ref_0002309d ; push 0x2309d
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000102b4:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000102b9:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000102db ; je 0x102db
+push eax
+push eax
+push ref_00024700 ; push 0x24700
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000102db:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000102fe ; je 0x102fe
+push eax
+mov al, byte [ebx + 8]
+shr al, 7
+movzx eax, al
+push eax
+push ref_0002473c ; push 0x2473c
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000102fe:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001031b ; je 0x1031b
+push eax
+movzx eax, byte [ebx]
+push eax
+push ref_0002474f ; push 0x2474f
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001031b:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010339 ; je 0x10339
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+push ref_00024761 ; push 0x24761
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010339:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010357 ; je 0x10357
+push eax
+movzx eax, byte [ebx + 2]
+push eax
+push ref_00024774 ; push 0x24774
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010357:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010375 ; je 0x10375
+push eax
+movzx eax, byte [ebx + 3]
+push eax
+push ref_00024787 ; push 0x24787
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010375:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010393 ; je 0x10393
+push ecx
+movzx eax, byte [ebx + 4]
+push eax
+push ref_0002479a ; push 0x2479a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010393:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000103b1 ; je 0x103b1
+push edx
+movzx eax, byte [ebx + 5]
+push eax
+push ref_000247ad ; push 0x247ad
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000103b1:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000103cf ; je 0x103cf
+push eax
+movzx eax, byte [ebx + 6]
+push eax
+push ref_000247c1 ; push 0x247c1
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000103cf:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000103ed ; je 0x103ed
+push eax
+movzx eax, byte [ebx + 7]
+push eax
+push ref_000247d5 ; push 0x247d5
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000103ed:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001040d ; je 0x1040d
+push eax
+mov al, byte [ebx + 8]
+and eax, 1
+push eax
+push ref_000247e8 ; push 0x247e8
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001040d:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001042f ; je 0x1042f
+push eax
+mov al, byte [ebx + 8]
+shr al, 1
+and eax, 1
+push eax
+push ref_00024800 ; push 0x24800
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001042f:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010452 ; je 0x10452
+push eax
+mov al, byte [ebx + 8]
+shr al, 2
+and eax, 1
+push eax
+push ref_00024818 ; push 0x24818
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010452:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010475 ; je 0x10475
+push eax
+mov al, byte [ebx + 8]
+shr al, 3
+and eax, 1
+push eax
+push ref_0002482b ; push 0x2482b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010475:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010498 ; je 0x10498
+push ecx
+mov al, byte [ebx + 8]
+shr al, 4
+and eax, 1
+push eax
+push ref_00024846 ; push 0x24846
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010498:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000104bb ; je 0x104bb
+push edx
+mov al, byte [ebx + 8]
+shr al, 5
+and eax, 1
+push eax
+push ref_0002485f ; push 0x2485f
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000104bb:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000104de ; je 0x104de
+push eax
+mov al, byte [ebx + 8]
+shr al, 6
+and eax, 1
+push eax
+push ref_00024879 ; push 0x24879
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000104de:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000104e3:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010505 ; je 0x10505
+push eax
+push eax
+push ref_0002488c ; push 0x2488c
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010505:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010524 ; je 0x10524
+push eax
+mov al, byte [ebx]
+and eax, 1
+push eax
+push ref_00023454 ; push 0x23454
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010524:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010545 ; je 0x10545
+push eax
+mov al, byte [ebx]
+shr al, 1
+and eax, 1
+push eax
+push ref_000248c8 ; push 0x248c8
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010545:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010567 ; je 0x10567
+push eax
+mov al, byte [ebx]
+shr al, 2
+and eax, 1
+push eax
+push ref_000248df ; push 0x248df
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010567:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010589 ; je 0x10589
+push eax
+mov al, byte [ebx]
+shr al, 5
+and eax, 1
+push eax
+push ref_000248fb ; push 0x248fb
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010589:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000105ab ; je 0x105ab
+push eax
+mov al, byte [ebx]
+shr al, 3
+and eax, 1
+push eax
+push ref_00024919 ; push 0x24919
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000105ab:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000105cd ; je 0x105cd
+push ecx
+mov al, byte [ebx]
+shr al, 4
+and eax, 1
+push eax
+push ref_00024938 ; push 0x24938
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000105cd:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000105ef ; je 0x105ef
+push edx
+mov al, byte [ebx]
+shr al, 6
+movzx eax, al
+push eax
+push ref_00024958 ; push 0x24958
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000105ef:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001060b ; je 0x1060b
+push eax
+push dword [ebx + 4]
+push ref_00024977 ; push 0x24977
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001060b:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00010610:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010632 ; je 0x10632
+push eax
+push eax
+push ref_00024991 ; push 0x24991
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010632:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001064f ; je 0x1064f
+push eax
+movzx eax, byte [ebx]
+push eax
+push ref_000249ca ; push 0x249ca
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001064f:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001066d ; je 0x1066d
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+push ref_000249de ; push 0x249de
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001066d:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001068b ; je 0x1068b
+push eax
+movzx eax, byte [ebx + 8]
+push eax
+push ref_000249ee ; push 0x249ee
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001068b:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000106a9 ; je 0x106a9
+push ecx
+movzx eax, byte [ebx + 9]
+push eax
+push ref_00024a02 ; push 0x24a02
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000106a9:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000106c5 ; je 0x106c5
+push edx
+push dword [ebx + 0xa]
+push ref_00024a16 ; push 0x24a16
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000106c5:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000106e1 ; je 0x106e1
+push eax
+push dword [ebx + 0xe]
+push ref_00024a2c ; push 0x24a2c
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000106e1:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000106e6:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010708 ; je 0x10708
+push eax
+push eax
+push ref_00024a3e ; push 0x24a3e
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010708:
+xor esi, esi
+
+loc_0001070a:
+mov eax, esi
+cmp al, byte [ebx + 0x48]
+jae short loc_00010757 ; jae 0x10757
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010732 ; je 0x10732
+mov eax, esi
+movzx eax, al
+push dword [ebx + eax*8]
+push eax
+push ref_00024a7a ; push 0x24a7a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010732:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010754 ; je 0x10754
+mov eax, esi
+movzx eax, al
+push dword [ebx + eax*8 + 4]
+push eax
+push ref_00024a92 ; push 0x24a92
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010754:
+inc esi
+jmp short loc_0001070a ; jmp 0x1070a
+
+loc_00010757:
+xor esi, esi
+
+loc_00010759:
+mov eax, esi
+cmp al, byte [ebx + 0x75]
+jae short loc_000107ab ; jae 0x107ab
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010784 ; je 0x10784
+mov eax, esi
+movzx eax, al
+movzx edx, word [ebx + eax*4 + 0x49]
+push edx
+push eax
+push ref_00024aac ; push 0x24aac
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010784:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000107a8 ; je 0x107a8
+mov eax, esi
+movzx eax, al
+movzx edx, word [ebx + eax*4 + 0x4b]
+push edx
+push eax
+push ref_00024ac4 ; push 0x24ac4
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000107a8:
+inc esi
+jmp short loc_00010759 ; jmp 0x10759
+
+loc_000107ab:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_000107b2:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000107d4 ; je 0x107d4
+push eax
+push eax
+push ref_00024ade ; push 0x24ade
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000107d4:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000107f1 ; je 0x107f1
+push eax
+movzx eax, byte [ebx]
+push eax
+push ref_00024b30 ; push 0x24b30
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000107f1:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001080f ; je 0x1080f
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+push ref_00023942 ; push 0x23942
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001080f:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001082b ; je 0x1082b
+push eax
+push dword [ebx + 4]
+push ref_00024b3f ; push 0x24b3f
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001082b:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010849 ; je 0x10849
+push eax
+movzx eax, word [ebx + 8]
+push eax
+push ref_00024b4a ; push 0x24b4a
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010849:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010867 ; je 0x10867
+push ecx
+movzx eax, word [ebx + 0xa]
+push eax
+push ref_00024b57 ; push 0x24b57
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010867:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010885 ; je 0x10885
+push edx
+movzx eax, byte [ebx + 0xc]
+push eax
+push ref_00024b66 ; push 0x24b66
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010885:
+sub esp, 0xc
+lea eax, [ebx + 0x10]
+push eax
+call fcn_00010610 ; call 0x10610
+lea eax, [ebx + 0x36]
+mov dword [esp], eax
+call fcn_000101b9 ; call 0x101b9
+lea eax, [ebx + 0x46]
+mov dword [esp], eax
+call fcn_0000e71f ; call 0xe71f
+lea eax, [ebx + 0x1da]
+mov dword [esp], eax
+call fcn_0000ec4f ; call 0xec4f
+lea eax, [ebx + 0x284]
+mov dword [esp], eax
+call fcn_0000e26b ; call 0xe26b
+lea eax, [ebx + 0x57c]
+mov dword [esp], eax
+call fcn_0000e5b2 ; call 0xe5b2
+lea eax, [ebx + 0x35c]
+mov dword [esp], eax
+call fcn_0000f334 ; call 0xf334
+lea eax, [ebx + 0x364]
+mov dword [esp], eax
+call fcn_0000f42c ; call 0xf42c
+lea eax, [ebx + 0x370]
+mov dword [esp], eax
+call fcn_0000f78a ; call 0xf78a
+lea eax, [ebx + 0x37e]
+mov dword [esp], eax
+call fcn_00010257 ; call 0x10257
+lea eax, [ebx + 0x386]
+mov dword [esp], eax
+call fcn_0000f6a8 ; call 0xf6a8
+lea eax, [ebx + 0x40e]
+mov dword [esp], eax
+call fcn_0000f504 ; call 0xf504
+lea eax, [ebx + 0x554]
+mov dword [esp], eax
+call fcn_0000f5f3 ; call 0xf5f3
+lea eax, [ebx + 0x412]
+mov dword [esp], eax
+call fcn_0000fc7e ; call 0xfc7e
+lea eax, [ebx + 0x442]
+mov dword [esp], eax
+call fcn_0000f846 ; call 0xf846
+lea eax, [ebx + 0x46a]
+mov dword [esp], eax
+call fcn_0000fb13 ; call 0xfb13
+lea eax, [ebx + 0x476]
+mov dword [esp], eax
+call fcn_0000fc02 ; call 0xfc02
+lea eax, [ebx + 0x486]
+mov dword [esp], eax
+call fcn_000104e3 ; call 0x104e3
+lea eax, [ebx + 0x496]
+add ebx, 0x4de
+mov dword [esp], eax
+call fcn_000102b9 ; call 0x102b9
+mov dword [esp], ebx
+call fcn_000106e6 ; call 0x106e6
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_000109b2 ; je 0x109b2
+push eax
+push eax
+push ref_00024b78 ; push 0x24b78
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000109b2:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000109b7:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000109e6 ; je 0x109e6
+cmp dword [ebx + 4], 0
+jne short loc_000109e6 ; jne 0x109e6
+push eax
+push ref_00024bca ; push 0x24bca
+push 0x2c0
+push ref_00024be7 ; push 0x24be7
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000109e6:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00010a0e ; je 0x10a0e
+cmp word [ebx + 8], 0
+jne short loc_00010a0e ; jne 0x10a0e
+push eax
+push ref_00024c12 ; push 0x24c12
+push 0x2c1
+push ref_00024be7 ; push 0x24be7
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00010a0e:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00010a36 ; je 0x10a36
+cmp word [ebx + 0xa], 0
+jne short loc_00010a36 ; jne 0x10a36
+push eax
+push ref_00024c31 ; push 0x24c31
+push 0x2c2
+push ref_00024be7 ; push 0x24be7
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00010a36:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00010a5d ; je 0x10a5d
+cmp dword [ebx + 0x1a], 0
+jne short loc_00010a5d ; jne 0x10a5d
+push eax
+push ref_00024c52 ; push 0x24c52
+push 0x2c3
+push ref_00024be7 ; push 0x24be7
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00010a5d:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00010a87 ; je 0x10a87
+cmp dword [ebx + 0x1e], 0xffff
+ja short loc_00010a87 ; ja 0x10a87
+push ecx
+push ref_00024c87 ; push 0x24c87
+push 0x2c4
+push ref_00024be7 ; push 0x24be7
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00010a87:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00010aaf ; je 0x10aaf
+cmp word [ebx + 0x22], 0
+jne short loc_00010aaf ; jne 0x10aaf
+push edx
+push ref_00024cbe ; push 0x24cbe
+push 0x2c5
+push ref_00024be7 ; push 0x24be7
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00010aaf:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00010ad7 ; je 0x10ad7
+cmp word [ebx + 0x24], 0xf
+ja short loc_00010ad7 ; ja 0x10ad7
+push eax
+push ref_00024cf2 ; push 0x24cf2
+push 0x2c6
+push ref_00024be7 ; push 0x24be7
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00010ad7:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00010adc:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x10
+movzx edx, byte [ebp + 0x10]
+movzx eax, byte [ebp + 0x14]
+mov ecx, dword [ebp + 0xc]
+mov ebx, dword [ebp + 8]
+shl edx, 0x18
+and edx, 0xf000000
+or eax, 0x80000000
+or eax, edx
+cmp cl, 1
+je short loc_00010b23 ; je 0x10b23
+jb short loc_00010b1b ; jb 0x10b1b
+cmp cl, 2
+je short loc_00010b2b ; je 0x10b2b
+cmp cl, 3
+jne short loc_00010b5d ; jne 0x10b5d
+add ebx, 0x2040
+jmp short loc_00010b31 ; jmp 0x10b31
+
+loc_00010b1b:
+add ebx, 0x2014
+jmp short loc_00010b31 ; jmp 0x10b31
+
+loc_00010b23:
+add ebx, 0x2020
+jmp short loc_00010b31 ; jmp 0x10b31
+
+loc_00010b2b:
+add ebx, 0x2030
+
+loc_00010b31:
+push edx
+xor esi, esi
+push eax
+push 0xf0ffff01
+push ebx
+mov dword [ebp - 0xc], ecx
+call fcn_00018b68 ; call 0x18b68
+mov ecx, dword [ebp - 0xc]
+add esp, 0x10
+dec ecx
+cmp cl, 1
+ja short loc_00010b62 ; ja 0x10b62
+sub esp, 0xc
+push ebx
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+jmp short loc_00010b62 ; jmp 0x10b62
+
+loc_00010b5d:
+mov esi, 0x80000002
+
+loc_00010b62:
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00010b6b:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov eax, dword [ebp + 0xc]
+mov ebx, dword [ebp + 8]
+cmp al, 1
+je short loc_00010b94 ; je 0x10b94
+jb short loc_00010b8c ; jb 0x10b8c
+cmp al, 2
+je short loc_00010b9c ; je 0x10b9c
+cmp al, 3
+jne short loc_00010bb4 ; jne 0x10bb4
+add ebx, 0x2046
+jmp short loc_00010ba2 ; jmp 0x10ba2
+
+loc_00010b8c:
+add ebx, 0x201a
+jmp short loc_00010ba2 ; jmp 0x10ba2
+
+loc_00010b94:
+add ebx, 0x2026
+jmp short loc_00010ba2 ; jmp 0x10ba2
+
+loc_00010b9c:
+add ebx, 0x2036
+
+loc_00010ba2:
+sub esp, 0xc
+push ebx
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test al, 2
+jne short loc_00010ba2 ; jne 0x10ba2
+jmp short loc_00010bbb ; jmp 0x10bbb
+
+loc_00010bb4:
+mov eax, 0x80000002
+jmp short loc_00010bbd ; jmp 0x10bbd
+
+loc_00010bbb:
+xor eax, eax
+
+loc_00010bbd:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00010bc2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x2c
+lea eax, [ebp - 0x20]
+push eax
+push 0
+push 0
+push ref_0002917c ; push 0x2917c
+mov dword [ebp - 0x1c], 0
+call fcn_0001975d ; call 0x1975d
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00010c2b ; je 0x10c2b
+test ebx, ebx
+jns short loc_00010c2b ; jns 0x10c2b
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010c13 ; je 0x10c13
+push edi
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010c13:
+push esi
+push ref_000206f4 ; push 0x206f4
+push 0xa7
+push ref_00024d25 ; push 0x24d25
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00010c2b:
+push ebx
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0xc
+push 0x200000
+push 0xff0fffff
+mov esi, eax
+and esi, 0xffffc000
+lea edi, [esi + 0x50]
+push edi
+call fcn_00018b68 ; call 0x18b68
+mov eax, dword [ebp - 0x20]
+add esp, 0x10
+cmp byte [eax + 0x24], 1
+jne short loc_00010c7e ; jne 0x10c7e
+push ecx
+push ecx
+push 0xa0000
+push edi
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+
+loc_00010c7e:
+sub esp, 0xc
+xor ebx, ebx
+push edi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+
+loc_00010c8c:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010cab ; je 0x10cab
+mov eax, dword [ebp - 0x20]
+push dword [eax + ebx*4]
+push ebx
+push ref_00024d4e ; push 0x24d4e
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010cab:
+mov eax, dword [ebp - 0x20]
+mov cl, bl
+mov edx, dword [eax + ebx*4]
+mov eax, 1
+inc ebx
+shl eax, cl
+or byte [ebp + edx - 0x1c], al
+cmp ebx, 8
+jne short loc_00010c8c ; jne 0x10c8c
+xor bl, bl
+
+loc_00010cc6:
+call fcn_00015479 ; call 0x15479
+test al, al
+lea eax, [ebx + ebx]
+je short loc_00010cfa ; je 0x10cfa
+mov edx, eax
+sub esp, 0xc
+add edx, dword [ebp - 0x20]
+mov dword [ebp - 0x2c], eax
+movzx ecx, byte [edx + 0x20]
+push ecx
+movzx edx, byte [edx + 0x21]
+push edx
+push ebx
+push ref_00024d5e ; push 0x24d5e
+push 0x40
+call fcn_00015487 ; call 0x15487
+mov eax, dword [ebp - 0x2c]
+add esp, 0x20
+
+loc_00010cfa:
+add eax, dword [ebp - 0x20]
+cmp byte [eax + 0x20], 1
+jne short loc_00010d18 ; jne 0x10d18
+movzx edx, byte [ebp + ebx - 0x1c]
+push edx
+movzx eax, byte [eax + 0x21]
+push eax
+push ebx
+push esi
+call fcn_00010adc ; call 0x10adc
+add esp, 0x10
+
+loc_00010d18:
+inc ebx
+cmp ebx, 4
+jne short loc_00010cc6 ; jne 0x10cc6
+push edx
+xor bl, bl
+push edx
+push 0x80000000
+push edi
+call fcn_00018b14 ; call 0x18b14
+mov dword [esp], edi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+
+loc_00010d38:
+mov eax, dword [ebp - 0x20]
+cmp byte [eax + ebx*2 + 0x20], 1
+jne short loc_00010d4e ; jne 0x10d4e
+push eax
+push eax
+push ebx
+push esi
+call fcn_00010b6b ; call 0x10b6b
+add esp, 0x10
+
+loc_00010d4e:
+inc ebx
+cmp ebx, 4
+jne short loc_00010d38 ; jne 0x10d38
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00010d5e:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+call fcn_0001bfbb ; call 0x1bfbb
+dec eax
+jne near loc_00010df4 ; jne 0x10df4
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010d89 ; je 0x10d89
+push ebx
+push ebx
+push ref_00024d7b ; push 0x24d7b
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010d89:
+push ecx
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov ebx, eax
+and ebx, 0xffffc000
+lea eax, [ebx + 0x21a4]
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+and eax, 0xf
+cmp eax, 2
+jne short loc_00010dda ; jne 0x10dda
+push edx
+add ebx, 0x21b0
+push 2
+push 0xf0
+push ebx
+call fcn_0001878a ; call 0x1878a
+add esp, 0x10
+
+loc_00010dda:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010df4 ; je 0x10df4
+push eax
+push eax
+push ref_00024d93 ; push 0x24d93
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010df4:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00010df9:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov eax, dword [ebp + 0x14]
+mov ebx, dword [ebp + 0x10]
+add eax, 0x410
+push eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x1b], al
+cmp ebx, 0x22
+ja short loc_00010e34 ; ja 0x10e34
+cmp ebx, 0x20
+jae short loc_00010e3e ; jae 0x10e3e
+cmp ebx, 1
+jb short loc_00010e56 ; jb 0x10e56
+cmp ebx, 3
+jbe short loc_00010e4a ; jbe 0x10e4a
+cmp ebx, 0x10
+je short loc_00010e4a ; je 0x10e4a
+jmp short loc_00010e56 ; jmp 0x10e56
+
+loc_00010e34:
+lea eax, [ebx - 0x41]
+cmp eax, 2
+jbe short loc_00010e5c ; jbe 0x10e5c
+jmp short loc_00010e56 ; jmp 0x10e56
+
+loc_00010e3e:
+mov esi, ref_00028588 ; mov esi, 0x28588
+mov edi, 0x14
+jmp short loc_00010e66 ; jmp 0x10e66
+
+loc_00010e4a:
+mov esi, ref_0002769c ; mov esi, 0x2769c
+mov edi, 0x24
+jmp short loc_00010e66 ; jmp 0x10e66
+
+loc_00010e56:
+xor esi, esi
+xor edi, edi
+jmp short loc_00010e66 ; jmp 0x10e66
+
+loc_00010e5c:
+mov esi, ref_00028d54 ; mov esi, 0x28d54
+mov edi, 0x16
+
+loc_00010e66:
+add esi, 8
+mov word [ebp - 0x1a], 0
+
+loc_00010e6f:
+cmp word [ebp - 0x1a], di
+je short loc_00010eda ; je 0x10eda
+push dword [esi]
+push dword [esi - 4]
+push dword [esi - 8]
+push dword [ebp + 0x18]
+call fcn_00009dc2 ; call 0x9dc2
+mov dword [ebp - 0x20], eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00010ed1 ; je 0x10ed1
+cmp dword [ebp - 0x20], 0
+jns short loc_00010ed1 ; jns 0x10ed1
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010eb9 ; je 0x10eb9
+push eax
+push dword [ebp - 0x20]
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010eb9:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x173
+push ref_00024d25 ; push 0x24d25
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00010ed1:
+inc word [ebp - 0x1a]
+add esi, 0xc
+jmp short loc_00010e6f ; jmp 0x10e6f
+
+loc_00010eda:
+cmp ebx, 0x22
+ja short loc_00010ef5 ; ja 0x10ef5
+cmp ebx, 0x20
+jae short loc_00010eff ; jae 0x10eff
+cmp ebx, 1
+jb short loc_00010f17 ; jb 0x10f17
+cmp ebx, 3
+jbe short loc_00010f0b ; jbe 0x10f0b
+cmp ebx, 0x10
+je short loc_00010f0b ; je 0x10f0b
+jmp short loc_00010f17 ; jmp 0x10f17
+
+loc_00010ef5:
+sub ebx, 0x41
+cmp ebx, 2
+jbe short loc_00010f1d ; jbe 0x10f1d
+jmp short loc_00010f17 ; jmp 0x10f17
+
+loc_00010eff:
+mov edi, ref_00028480 ; mov edi, 0x28480
+mov esi, 0x16
+jmp short loc_00010f27 ; jmp 0x10f27
+
+loc_00010f0b:
+mov edi, ref_0002784c ; mov edi, 0x2784c
+mov esi, 0x14
+jmp short loc_00010f27 ; jmp 0x10f27
+
+loc_00010f17:
+xor edi, edi
+xor esi, esi
+jmp short loc_00010f27 ; jmp 0x10f27
+
+loc_00010f1d:
+mov edi, ref_00028c34 ; mov edi, 0x28c34
+mov esi, 0x18
+
+loc_00010f27:
+mov dl, byte [ebp - 0x1b]
+imul esi, esi, 0xc
+mov al, dl
+add esi, edi
+and eax, 3
+mov byte [ebp - 0x1a], al
+mov al, dl
+and eax, 0xc
+mov byte [ebp - 0x20], al
+
+loc_00010f3f:
+cmp edi, esi
+je near loc_00010fea ; je 0x10fea
+cmp dword [ebp + 0xc], 2
+jne short loc_00010f64 ; jne 0x10f64
+mov eax, dword [edi]
+and eax, 0xfe00
+cmp eax, 0x2400
+je short loc_00010f85 ; je 0x10f85
+cmp eax, 0x2600
+jne short loc_00010f8b ; jne 0x10f8b
+jmp short loc_00010f78 ; jmp 0x10f78
+
+loc_00010f64:
+cmp dword [ebp + 0xc], 1
+jne short loc_00010f8b ; jne 0x10f8b
+mov eax, dword [edi]
+and eax, 0xfe00
+cmp eax, 0x2c00
+jne short loc_00010f7e ; jne 0x10f7e
+
+loc_00010f78:
+cmp byte [ebp - 0x20], 8
+jmp short loc_00010f89 ; jmp 0x10f89
+
+loc_00010f7e:
+cmp eax, 0x2e00
+jne short loc_00010f8b ; jne 0x10f8b
+
+loc_00010f85:
+cmp byte [ebp - 0x1a], 2
+
+loc_00010f89:
+jne short loc_00010fe2 ; jne 0x10fe2
+
+loc_00010f8b:
+push dword [edi + 8]
+push dword [edi + 4]
+push dword [edi]
+push dword [ebp + 0x18]
+call fcn_00009dc2 ; call 0x9dc2
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00010fe2 ; je 0x10fe2
+test ebx, ebx
+jns short loc_00010fe2 ; jns 0x10fe2
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00010fca ; je 0x10fca
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00010fca:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x1a4
+push ref_00024d25 ; push 0x24d25
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00010fe2:
+add edi, 0xc
+jmp near loc_00010f3f ; jmp 0x10f3f
+
+loc_00010fea:
+mov eax, dword [ebp + 8]
+xor ebx, ebx
+cmp byte [eax], 8
+ja short loc_00010ffb ; ja 0x10ffb
+
+loc_00010ff4:
+xor eax, eax
+jmp near loc_0001122f ; jmp 0x1122f
+
+loc_00010ffb:
+mov cl, byte [ebp - 0x1b]
+mov al, cl
+and eax, 0xc
+mov byte [ebp - 0x1b], al
+mov al, cl
+and eax, 3
+mov byte [ebp - 0x20], al
+
+loc_0001100e:
+call fcn_0001c2f8 ; call 0x1c2f8
+movzx eax, al
+cmp ebx, eax
+jae short loc_00010ff4 ; jae 0x10ff4
+cmp ebx, 2
+jne short loc_00011025 ; jne 0x11025
+cmp byte [ebp - 0x20], 2
+jmp short loc_0001102e ; jmp 0x1102e
+
+loc_00011025:
+cmp ebx, 3
+jne short loc_00011034 ; jne 0x11034
+cmp byte [ebp - 0x1b], 8
+
+loc_0001102e:
+jne near loc_00011229 ; jne 0x11229
+
+loc_00011034:
+cmp dword [ebp + 0xc], 1
+jne short loc_00011043 ; jne 0x11043
+mov esi, dword [ebx*4 + ref_00020450] ; mov esi, dword [ebx*4 + 0x20450]
+jmp short loc_0001104a ; jmp 0x1104a
+
+loc_00011043:
+mov esi, dword [ebx*4 + ref_00020438] ; mov esi, dword [ebx*4 + 0x20438]
+
+loc_0001104a:
+mov ecx, dword [ebp + 8]
+lea eax, [ebx + 0xae]
+test byte [ecx + eax*8 + 0x10], 1
+je short loc_000110b9 ; je 0x110b9
+movzx eax, byte [ecx + eax*8 + 0xc]
+lea edx, [eax - 0x69]
+cmp dl, 0x17
+jbe short loc_000110af ; jbe 0x110af
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00011084 ; je 0x11084
+push eax
+push eax
+push ref_00024da9 ; push 0x24da9
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00011084:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000110a5 ; je 0x110a5
+push eax
+push ref_00022281 ; push 0x22281
+push 0x1bd
+
+loc_00011098:
+push ref_00024d25 ; push 0x24d25
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000110a5:
+mov eax, 0x80000002
+jmp near loc_0001122f ; jmp 0x1122f
+
+loc_000110af:
+shl eax, 0x10
+mov edx, 0xff00ffff
+jmp short loc_000110be ; jmp 0x110be
+
+loc_000110b9:
+xor eax, eax
+or edx, 0xffffffff
+
+loc_000110be:
+mov edi, dword [ebp + 8]
+lea ecx, [ebx + 0xae]
+test byte [edi + ecx*8 + 0x10], 2
+je short loc_0001111f ; je 0x1111f
+mov cl, byte [edi + ecx*8 + 0xd]
+lea edi, [ecx - 0x80]
+mov byte [ebp - 0x1a], cl
+mov ecx, edi
+cmp cl, 0x1c
+jbe short loc_00011112 ; jbe 0x11112
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000110fc ; je 0x110fc
+push edi
+push edi
+push ref_00024dd8 ; push 0x24dd8
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000110fc:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000110a5 ; je 0x110a5
+push esi
+push ref_00022281 ; push 0x22281
+push 0x1ca
+jmp short loc_00011098 ; jmp 0x11098
+
+loc_00011112:
+movzx ecx, byte [ebp - 0x1a]
+xor dh, dh
+shl ecx, 8
+or eax, ecx
+jmp short loc_00011124 ; jmp 0x11124
+
+loc_0001111f:
+cmp edx, 0xffffffff
+je short loc_00011138 ; je 0x11138
+
+loc_00011124:
+push eax
+push edx
+lea eax, [esi + 0x88]
+push eax
+push dword [ebp + 0x18]
+call fcn_00009dc2 ; call 0x9dc2
+add esp, 0x10
+
+loc_00011138:
+mov ecx, dword [ebp + 8]
+lea eax, [ebx + 0xae]
+test byte [ecx + eax*8 + 0x10], 4
+je short loc_000111aa ; je 0x111aa
+movzx eax, byte [ecx + eax*8 + 0xe]
+lea edx, [eax - 0x39]
+cmp dl, 0x47
+jbe short loc_0001118f ; jbe 0x1118f
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00011172 ; je 0x11172
+push ebx
+push ebx
+push ref_00024e0a ; push 0x24e0a
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00011172:
+call fcn_00015480 ; call 0x15480
+test al, al
+je near loc_000110a5 ; je 0x110a5
+push ecx
+push ref_00022281 ; push 0x22281
+push 0x1e2
+jmp near loc_00011098 ; jmp 0x11098
+
+loc_0001118f:
+shl eax, 8
+push eax
+push 0xffff00ff
+lea eax, [esi + 0x90]
+push eax
+push dword [ebp + 0x18]
+call fcn_00009dc2 ; call 0x9dc2
+add esp, 0x10
+
+loc_000111aa:
+mov ecx, dword [ebp + 8]
+lea eax, [ebx + 0xae]
+test byte [ecx + eax*8 + 0x10], 8
+je short loc_00011229 ; je 0x11229
+mov cl, byte [ecx + eax*8 + 0xf]
+mov dl, cl
+shr dl, 1
+lea eax, [edx + 0x43]
+and eax, 0x7f
+cmp al, 0xd
+jbe short loc_00011206 ; jbe 0x11206
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000111e9 ; je 0x111e9
+push edx
+push edx
+push ref_00024e35 ; push 0x24e35
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000111e9:
+call fcn_00015480 ; call 0x15480
+test al, al
+je near loc_000110a5 ; je 0x110a5
+push eax
+push ref_00022281 ; push 0x22281
+push 0x1f3
+jmp near loc_00011098 ; jmp 0x11098
+
+loc_00011206:
+and ecx, 1
+movzx edx, dl
+shl ecx, 7
+add esi, 0x98
+or ecx, edx
+push ecx
+push 0xffffff00
+push esi
+push dword [ebp + 0x18]
+call fcn_00009dc2 ; call 0x9dc2
+add esp, 0x10
+
+loc_00011229:
+inc ebx
+jmp near loc_0001100e ; jmp 0x1100e
+
+loc_0001122f:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00011237:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov esi, dword [ebp + 0x14]
+mov ecx, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0x18]
+lea eax, [esi + 0x410]
+add esi, 0xfc
+push eax
+mov dword [ebp - 0x1c], ecx
+call fcn_00017d8b ; call 0x17d8b
+mov dword [esp], esi
+mov edi, eax
+call fcn_00017e4e ; call 0x17e4e
+mov ecx, dword [ebp - 0x1c]
+add esp, 0x10
+cmp ecx, 0x22
+ja short loc_00011290 ; ja 0x11290
+cmp ecx, 0x20
+jae short loc_000112aa ; jae 0x112aa
+cmp ecx, 1
+jb near loc_00011465 ; jb 0x11465
+cmp ecx, 3
+jbe short loc_000112a3 ; jbe 0x112a3
+cmp ecx, 0x10
+je short loc_000112a3 ; je 0x112a3
+jmp near loc_00011465 ; jmp 0x11465
+
+loc_00011290:
+sub ecx, 0x41
+cmp ecx, 2
+ja near loc_00011465 ; ja 0x11465
+mov ecx, ref_00028850 ; mov ecx, 0x28850
+jmp short loc_000112af ; jmp 0x112af
+
+loc_000112a3:
+mov ecx, ref_0002763c ; mov ecx, 0x2763c
+jmp short loc_000112af ; jmp 0x112af
+
+loc_000112aa:
+mov ecx, ref_000280cc ; mov ecx, 0x280cc
+
+loc_000112af:
+test eax, 0x80000
+je near loc_00011465 ; je 0x11465
+and eax, 0x70000
+mov edx, eax
+shr edx, 0x10
+cmp dword [ebp + 0xc], 2
+jne short loc_0001132d ; jne 0x1132d
+cmp dl, 5
+ja near loc_00011465 ; ja 0x11465
+imul edx, edx, 0xc
+add ecx, edx
+push dword [ecx + 8]
+push dword [ecx + 4]
+push dword [ecx]
+push ebx
+call fcn_00009dc2 ; call 0x9dc2
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je near loc_00011465 ; je 0x11465
+test ebx, ebx
+jns near loc_00011465 ; jns 0x11465
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001131d ; je 0x1131d
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001131d:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x241
+jmp near loc_00011458 ; jmp 0x11458
+
+loc_0001132d:
+cmp dword [ebp + 0xc], 1
+jne near loc_00011465 ; jne 0x11465
+test dl, dl
+jne short loc_000113a2 ; jne 0x113a2
+mov eax, edi
+and eax, 3
+dec al
+jne near loc_00011465 ; jne 0x11465
+imul edx, edx, 0xc
+add ecx, edx
+push dword [ecx + 8]
+push dword [ecx + 4]
+push dword [ecx]
+push ebx
+call fcn_00009dc2 ; call 0x9dc2
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je near loc_00011465 ; je 0x11465
+test ebx, ebx
+jns near loc_00011465 ; jns 0x11465
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00011392 ; je 0x11392
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00011392:
+push edi
+push ref_000206f4 ; push 0x206f4
+push 0x24d
+jmp near loc_00011458 ; jmp 0x11458
+
+loc_000113a2:
+cmp dl, 1
+jne short loc_0001140b ; jne 0x1140b
+mov eax, edi
+and eax, 0xc
+cmp al, 4
+jne near loc_00011465 ; jne 0x11465
+imul edx, edx, 0xc
+add ecx, edx
+push dword [ecx + 8]
+push dword [ecx + 4]
+push dword [ecx]
+push ebx
+call fcn_00009dc2 ; call 0x9dc2
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je near loc_00011465 ; je 0x11465
+test ebx, ebx
+jns near loc_00011465 ; jns 0x11465
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000113fe ; je 0x113fe
+push esi
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000113fe:
+push ecx
+push ref_000206f4 ; push 0x206f4
+push 0x257
+jmp short loc_00011458 ; jmp 0x11458
+
+loc_0001140b:
+imul edx, edx, 0xc
+add ecx, edx
+push dword [ecx + 8]
+push dword [ecx + 4]
+push dword [ecx]
+push ebx
+call fcn_00009dc2 ; call 0x9dc2
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00011465 ; je 0x11465
+test ebx, ebx
+jns short loc_00011465 ; jns 0x11465
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001144d ; je 0x1144d
+push edx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001144d:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x260
+
+loc_00011458:
+push ref_00024d25 ; push 0x24d25
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00011465:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001146f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+call fcn_0001bfbb ; call 0x1bfbb
+mov esi, eax
+mov eax, dword [ebp + 8]
+mov ebx, dword [eax + 4]
+push edi
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0x1c
+push 0
+mov edi, eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+add edi, 2
+push 0
+push 0x14
+push 0
+mov dword [ebp - 0x20], eax
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], edi
+mov dword [ebp - 0x24], eax
+call fcn_00017dc2 ; call 0x17dc2
+call fcn_0001bbfd ; call 0x1bbfd
+movzx eax, al
+mov dword [ebp - 0x1c], eax
+pop eax
+pop edx
+lea eax, [ebx + 0x2088]
+push 0x109000
+push eax
+call fcn_00017e8f ; call 0x17e8f
+lea eax, [ebx + 0x20ac]
+pop ecx
+pop edi
+push 0x40000000
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+cmp esi, 1
+jne short loc_00011532 ; jne 0x11532
+push eax
+push eax
+push 0x1b
+lea edi, [ebx + 0x2340]
+push edi
+call fcn_00017da5 ; call 0x17da5
+add esp, 0xc
+push 0x3a0000
+push 0xff00ffff
+push edi
+call fcn_00018b68 ; call 0x18b68
+lea eax, [ebx + 0x2324]
+pop edx
+pop ecx
+push 0x854c74
+push eax
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+
+loc_00011532:
+sub esp, 0xc
+push ebx
+push dword [ebp - 0x20]
+push dword [ebp - 0x1c]
+push esi
+push dword [ebp + 8]
+call fcn_00010df9 ; call 0x10df9
+add esp, 0x20
+mov edi, eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001158c ; je 0x1158c
+test edi, edi
+jns short loc_0001158c ; jns 0x1158c
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00011574 ; je 0x11574
+push eax
+push edi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00011574:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x34e
+push ref_00024d25 ; push 0x24d25
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001158c:
+sub esp, 0xc
+push ebx
+push dword [ebp - 0x20]
+push dword [ebp - 0x1c]
+push esi
+push dword [ebp + 8]
+call fcn_00011237 ; call 0x11237
+add esp, 0x20
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000115e6 ; je 0x115e6
+test esi, esi
+jns short loc_000115e6 ; jns 0x115e6
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000115ce ; je 0x115ce
+push eax
+push esi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000115ce:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x350
+push ref_00024d25 ; push 0x24d25
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000115e6:
+call fcn_0001bfbb ; call 0x1bfbb
+cmp eax, 2
+je short loc_000115fe ; je 0x115fe
+
+loc_000115f0:
+call fcn_0001bfbb ; call 0x1bfbb
+dec eax
+jne near loc_000116a3 ; jne 0x116a3
+jmp short loc_0001164b ; jmp 0x1164b
+
+loc_000115fe:
+mov byte [ebp - 0x1c], 0
+
+loc_00011602:
+call fcn_0001c1bf ; call 0x1c1bf
+cmp byte [ebp - 0x1c], al
+jae short loc_000115f0 ; jae 0x115f0
+push eax
+movzx eax, byte [ebp - 0x1c]
+push eax
+push 0x1c
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov edi, eax
+pop eax
+pop edx
+lea eax, [edi + 0x110]
+push 0x31c1
+push eax
+call fcn_00018b14 ; call 0x18b14
+lea edx, [edi + 0x104]
+pop ecx
+pop eax
+push 0x17d010
+push edx
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+inc byte [ebp - 0x1c]
+jmp short loc_00011602 ; jmp 0x11602
+
+loc_0001164b:
+sub esp, 0xc
+lea eax, [ebx + 0x2320]
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov edx, 0x20000
+test al, 2
+jne short loc_0001168a ; jne 0x1168a
+mov eax, dword [ebp - 0x20]
+sub esp, 0xc
+add eax, 0xf5
+push eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+and eax, 1
+cmp al, 1
+sbb edx, edx
+xor dx, dx
+add edx, 0x20000
+
+loc_0001168a:
+or dh, 0x30
+push eax
+push edx
+push 0xfffc0fff
+lea eax, [ebx + 0x21a4]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_000116a3:
+push edi
+push edi
+push 0xfffffffffffffff0
+lea eax, [ebx + 0x2348]
+push eax
+call fcn_00018b3e ; call 0x18b3e
+mov eax, dword [ebp - 0x24]
+add esp, 0xc
+push 0x10000
+push 0xffffff7f
+add eax, 0xb0
+push eax
+call fcn_00018b68 ; call 0x18b68
+call fcn_0001bfbb ; call 0x1bfbb
+add esp, 0x10
+cmp eax, 2
+jne short loc_00011747 ; jne 0x11747
+push ecx
+push ecx
+push 0x10
+lea eax, [ebx + 0x260c]
+push eax
+call fcn_00017e04 ; call 0x17e04
+push 0x3100
+push 0xffffceff
+push 0xec000106
+push ebx
+call fcn_00009dc2 ; call 0x9dc2
+add esp, 0x20
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00011747 ; je 0x11747
+test esi, esi
+jns short loc_00011747 ; jns 0x11747
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001172f ; je 0x1172f
+push edx
+push esi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001172f:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x3b8
+push ref_00024d25 ; push 0x24d25
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00011747:
+lea esp, [ebp - 0xc]
+mov eax, esi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00011751:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov esi, dword [ebp + 0x14]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00011777 ; je 0x11777
+push eax
+push eax
+push ref_00024e65 ; push 0x24e65
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00011777:
+cmp dword [ebp + 8], 0
+mov ebx, 0x80000002
+je near loc_0001189f ; je 0x1189f
+call fcn_00015479 ; call 0x15479
+test al, al
+mov eax, esi
+movzx ebx, al
+je short loc_000117a5 ; je 0x117a5
+push eax
+push ebx
+push ref_00024e80 ; push 0x24e80
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000117a5:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000117c1 ; je 0x117c1
+push eax
+push dword [ebp + 0xc]
+push ref_00024e91 ; push 0x24e91
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000117c1:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000117dd ; je 0x117dd
+push eax
+push dword [ebp + 0x10]
+push ref_00024ea9 ; push 0x24ea9
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000117dd:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000117f7 ; je 0x117f7
+push eax
+push eax
+push ref_00021f21 ; push 0x21f21
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000117f7:
+push eax
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov edi, eax
+and edi, 0xffffc000
+lea esi, [edi + 0x3418]
+mov dword [esp], esi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0xc
+push ebx
+mov dword [ebp - 0x1c], eax
+lea eax, [ebp - 0x1c]
+push eax
+push edi
+push 0
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_000151c7 ; call 0x151c7
+add esp, 0x20
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00011889 ; je 0x11889
+test ebx, ebx
+jns short loc_00011889 ; jns 0x11889
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00011871 ; je 0x11871
+push edi
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00011871:
+push ecx
+push ref_000206f4 ; push 0x206f4
+push 0x82
+push ref_00024ec1 ; push 0x24ec1
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00011889:
+push edx
+push edx
+push dword [ebp - 0x1c]
+push esi
+call fcn_00017e8f ; call 0x17e8f
+mov dword [esp], esi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+
+loc_0001189f:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000118b9 ; je 0x118b9
+push eax
+push eax
+push ref_00024eea ; push 0x24eea
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000118b9:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000118c3:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x14
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000118e4 ; je 0x118e4
+push edx
+push edx
+push ref_00024f03 ; push 0x24f03
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000118e4:
+lea eax, [ebp - 0xc]
+push eax
+push 0
+push 0
+push ref_000291bc ; push 0x291bc
+call fcn_0001975d ; call 0x1975d
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+jne short loc_00011919 ; jne 0x11919
+mov eax, dword [ebp - 0xc]
+movzx edx, byte [eax]
+push edx
+push dword [eax + 0xe]
+push dword [eax + 6]
+push dword [eax + 1]
+call fcn_00011751 ; call 0x11751
+add esp, 0x10
+mov ebx, eax
+
+loc_00011919:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00011933 ; je 0x11933
+push eax
+push eax
+push ref_00024f19 ; push 0x24f19
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00011933:
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001193a:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x3c
+mov eax, dword [ebp + 0x14]
+mov ebx, dword [ebp + 0xc]
+mov esi, dword [ebp + 8]
+mov dword [ebp - 0x28], eax
+call fcn_0001bfbb ; call 0x1bfbb
+mov dword [ebp - 0x1c], eax
+call fcn_0001c0bd ; call 0x1c0bd
+mov eax, dword [ebp + 0x10]
+movzx eax, byte [eax + 1]
+push ecx
+mov edi, eax
+mov dword [ebp - 0x34], eax
+movzx eax, bl
+push eax
+push 0x1c
+push edi
+mov dword [ebp - 0x2c], eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0x1f
+push edi
+mov ebx, eax
+call fcn_00016c9a ; call 0x16c9a
+mov dword [ebp - 0x38], eax
+pop eax
+pop edx
+push 0
+push dword [ebp + 0x18]
+call fcn_0001c39f ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+push 0x1c
+push edi
+call fcn_00016c9a ; call 0x16c9a
+push 0x10
+push dword [ebp - 0x2c]
+push 0x1c
+push edi
+mov dword [ebp - 0x20], eax
+call fcn_00009fd5 ; call 0x9fd5
+add esp, 0x20
+movzx eax, al
+mov ecx, eax
+mov dword [ebp - 0x3c], eax
+mov eax, 0x80000003
+test ecx, ecx
+je near loc_00011e6c ; je 0x11e6c
+sub esp, 0xc
+mov eax, esi
+lea edx, [ebx + 0x64]
+movzx esi, al
+push edx
+imul esi, esi, 0x2c
+mov dword [ebp - 0x24], edx
+call fcn_00017e4e ; call 0x17e4e
+mov edi, dword [ebp + 0x10]
+pop edx
+pop ecx
+mov edx, dword [ebp - 0x24]
+add edi, esi
+mov ecx, eax
+and ah, 0xf7
+or ch, 8
+cmp byte [edi + 0x58], 1
+cmovne ecx, eax
+and ecx, 0xfff3ffff
+push ecx
+push edx
+call fcn_00017e8f ; call 0x17e8f
+lea eax, [ebx + 0x68]
+mov dword [esp], eax
+mov dword [ebp - 0x24], eax
+call fcn_00017dc2 ; call 0x17dc2
+pop edx
+pop ecx
+mov edx, eax
+and ah, 0xfb
+or dh, 4
+cmp byte [edi + 0x58], 1
+cmovne edx, eax
+movzx edx, dx
+push edx
+push dword [ebp - 0x24]
+call fcn_00017e04 ; call 0x17e04
+add esp, 0xc
+push 0x14140000
+push 0xffff
+lea eax, [ebx + 0x318]
+push eax
+call fcn_00018b68 ; call 0x18b68
+mov eax, dword [ebp - 0x20]
+add eax, 0xf5
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0xc
+mov edi, dword [ebp + 0x10]
+lea ecx, [ebx + 0x4c]
+mov dword [ebp - 0x30], ecx
+lea edi, [edi + esi + 0x40]
+lea esi, [edi + 6]
+and eax, 1
+cmp al, 1
+sbb eax, eax
+xor ax, ax
+add eax, 0x20000
+push eax
+push 0xfffc7fff
+push ecx
+call fcn_00018b68 ; call 0x18b68
+add esp, 0xc
+push 0x743a361b
+push 0
+lea eax, [ebx + 0x314]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0xc
+push 0x18000
+lea eax, [ebx + 0xd8]
+push 0xfffc7fff
+push eax
+mov dword [ebp - 0x20], eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0xc
+push 0x854c74
+push 0xff000000
+lea eax, [ebx + 0x33c]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0xc
+push 0x2000000
+push 0xfdffffff
+push dword [ebp - 0x20]
+call fcn_00018b68 ; call 0x18b68
+add esp, 0xc
+push 0x8000008
+push 0xf7fffff7
+push dword [ebp - 0x20]
+call fcn_00018b68 ; call 0x18b68
+pop eax
+pop edx
+lea eax, [ebx + 0xf5]
+push 0xf
+push eax
+call fcn_0001875d ; call 0x1875d
+mov al, byte [esi + 4]
+pop ecx
+pop edx
+shl eax, 0x1f
+sar eax, 0x1f
+and eax, 0x10001
+mov edx, eax
+or edx, 0x20000000
+cmp dword [ebp - 0x1c], 2
+cmove eax, edx
+push eax
+lea eax, [ebx + 0x100]
+push eax
+call fcn_00017e8f ; call 0x17e8f
+mov dl, byte [edi + 6]
+add esp, 0xc
+and edx, 0x20
+cmp dl, 1
+sbb eax, eax
+and eax, 0xffffff80
+dec eax
+cmp dl, 1
+sbb edx, edx
+movzx eax, ax
+not edx
+and dx, 0x80
+movzx edx, dx
+push edx
+push eax
+lea eax, [ebx + 0x50]
+push eax
+call fcn_00018981 ; call 0x18981
+add esp, 0x10
+cmp dword [ebp - 0x1c], 2
+jne short loc_00011b8f ; jne 0x11b8f
+push ecx
+push 0x1000c0
+push 0xffcffe3f
+lea eax, [ebx + 0x320]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_00011b8f:
+mov dl, byte [esi + 0xb]
+cmp dl, 9
+je short loc_00011bad ; je 0x11bad
+sub edx, 3
+xor eax, eax
+cmp dl, 3
+ja short loc_00011bb2 ; ja 0x11bb2
+movzx edx, dl
+movzx eax, byte [edx + ref_00020468] ; movzx eax, byte [edx + 0x20468]
+jmp short loc_00011bb2 ; jmp 0x11bb2
+
+loc_00011bad:
+mov eax, 0x10
+
+loc_00011bb2:
+push edx
+push eax
+push 0xffe0
+push dword [ebp - 0x24]
+call fcn_00018981 ; call 0x18981
+mov dl, byte [edi + 6]
+add esp, 0x10
+test dl, 4
+je short loc_00011c38 ; je 0x11c38
+sub esp, 0xc
+push dword [ebp - 0x30]
+shl edx, 0x1c
+sar edx, 0x1f
+and edx, 0x60
+mov dword [ebp - 0x24], edx
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov edx, dword [ebp - 0x24]
+and eax, 0x3f0
+cmp eax, 0x10
+jne short loc_00011bf8 ; jne 0x11bf8
+or dh, 0xb2
+jmp short loc_00011c1c ; jmp 0x11c1c
+
+loc_00011bf8:
+sub esp, 0xc
+push dword [ebp - 0x30]
+mov dword [ebp - 0x24], edx
+call fcn_00017e4e ; call 0x17e4e
+mov edx, dword [ebp - 0x24]
+add esp, 0x10
+mov ecx, edx
+or ch, 0xfd
+and eax, 0x3f0
+cmp eax, 0x10
+cmova edx, ecx
+
+loc_00011c1c:
+push eax
+movzx eax, byte [esi + 0xa]
+shl eax, 0x13
+or eax, edx
+push eax
+push 0x6001f
+lea eax, [ebx + 0x54]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_00011c38:
+mov eax, dword [ebp + 0x10]
+sub esp, 0xc
+movzx eax, byte [eax + 0x19]
+push eax
+mov eax, dword [ebp + 0x10]
+movzx eax, byte [eax + 0x18]
+push eax
+push dword [ebp - 0x2c]
+push 0x1c
+push dword [ebp - 0x34]
+call fcn_0000bc4e ; call 0xbc4e
+add esp, 0x20
+mov byte [ebp - 0x24], 1
+test eax, eax
+je short loc_00011c7a ; je 0x11c7a
+push eax
+push eax
+push 2
+lea eax, [ebx + 0xd4]
+push eax
+call fcn_00018730 ; call 0x18730
+add esp, 0x10
+mov byte [ebp - 0x24], 0
+
+loc_00011c7a:
+test byte [edi + 6], 8
+jne short loc_00011c8e ; jne 0x11c8e
+mov cl, byte [ebp - 0x24]
+mov al, cl
+lea eax, [eax + eax - 3]
+lea edx, [ecx + ecx]
+jmp short loc_00011c92 ; jmp 0x11c92
+
+loc_00011c8e:
+mov al, 0xfd
+xor edx, edx
+
+loc_00011c92:
+movzx edx, dl
+movzx eax, al
+push ecx
+push edx
+push eax
+lea eax, [ebx + 0xe0]
+push eax
+call fcn_0001878a ; call 0x1878a
+mov dl, byte [esi + 4]
+add esp, 0xc
+mov al, dl
+and eax, 2
+cmp al, 1
+sbb eax, eax
+not eax
+and eax, 8
+mov ecx, eax
+or ecx, 4
+test dl, 4
+cmovne eax, ecx
+mov ecx, eax
+or ecx, 2
+test dl, 8
+cmovne eax, ecx
+mov ecx, eax
+or ecx, 1
+and dl, 0x10
+cmovne eax, ecx
+movzx eax, ax
+push eax
+push 0xfff0
+lea eax, [ebx + 0x48]
+push eax
+call fcn_00018981 ; call 0x18981
+mov dl, byte [esi + 4]
+add esp, 0xc
+mov al, dl
+and eax, 0x20
+cmp al, 1
+sbb eax, eax
+not eax
+and eax, 8
+mov ecx, eax
+or ecx, 4
+test dl, 0x40
+cmovne eax, ecx
+mov ecx, eax
+or ecx, 2
+test dl, dl
+cmovs eax, ecx
+mov edx, eax
+or edx, 1
+test byte [esi + 5], 1
+lea esi, [ebx + 0x5c]
+cmovne eax, edx
+movzx eax, ax
+push eax
+push 0xfff0
+push esi
+call fcn_00018981 ; call 0x18981
+add esp, 0x10
+test byte [edi + 6], 0x10
+je near loc_00011dce ; je 0x11dce
+push eax
+push eax
+push 0xfff7
+push esi
+call fcn_00018954 ; call 0x18954
+add esp, 0xc
+push 0x80000000
+push 0xfffffffffffffffe
+push dword [ebp - 0x20]
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp dword [ebp - 0x1c], 2
+jne short loc_00011d76 ; jne 0x11d76
+movzx esi, word [ebp - 0x28]
+add esi, 0x8c
+jmp short loc_00011d83 ; jmp 0x11d83
+
+loc_00011d76:
+cmp dword [ebp - 0x1c], 1
+jne short loc_00011da4 ; jne 0x11da4
+movzx esi, word [ebp - 0x28]
+add esi, 0x20
+
+loc_00011d83:
+sub esp, 0xc
+push esi
+call fcn_00018f64 ; call 0x18f64
+add esp, 0x10
+test ah, 2
+je short loc_00011da4 ; je 0x11da4
+push eax
+push eax
+push 0x200
+push esi
+call fcn_00018f97 ; call 0x18f97
+add esp, 0x10
+
+loc_00011da4:
+mov esi, dword [ebp - 0x38]
+sub esp, 0xc
+add esi, 0xa0
+push esi
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test ah, 4
+jne short loc_00011dce ; jne 0x11dce
+push eax
+push eax
+push 0x400
+push esi
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+
+loc_00011dce:
+test byte [edi + 6], 8
+je short loc_00011e53 ; je 0x11e53
+mov esi, dword [ebp - 0x3c]
+push eax
+push eax
+push 9
+add esi, ebx
+lea eax, [esi + 0x1a]
+add esi, 0x18
+push eax
+call fcn_00018927 ; call 0x18927
+add esp, 0xc
+push 9
+push 0xffdf
+push esi
+call fcn_00018981 ; call 0x18981
+add esp, 0xc
+push 0x40000000
+push 0xfffffffffffffffd
+push dword [ebp - 0x20]
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp dword [ebp - 0x1c], 2
+jne short loc_00011e23 ; jne 0x11e23
+movzx eax, word [ebp - 0x28]
+push ecx
+push ecx
+push 2
+add eax, 0x8c
+jmp short loc_00011e34 ; jmp 0x11e34
+
+loc_00011e23:
+cmp dword [ebp - 0x1c], 1
+jne short loc_00011e3d ; jne 0x11e3d
+movzx eax, word [ebp - 0x28]
+push edx
+push edx
+push 2
+add eax, 0x20
+
+loc_00011e34:
+push eax
+call fcn_00018f97 ; call 0x18f97
+add esp, 0x10
+
+loc_00011e3d:
+push eax
+add ebx, 0x108
+push eax
+push 0x4000
+push ebx
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+
+loc_00011e53:
+cmp byte [ebp - 0x24], 1
+je short loc_00011e6a ; je 0x11e6a
+mov al, byte [edi + 6]
+and eax, 8
+cmp al, 1
+sbb eax, eax
+and eax, 0x8000000e
+jmp short loc_00011e6c ; jmp 0x11e6c
+
+loc_00011e6a:
+xor eax, eax
+
+loc_00011e6c:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00011e74:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+xor ebx, ebx
+sub esp, 0x2c
+mov eax, dword [ebp + 8]
+mov dword [ebp - 0x2c], eax
+mov byte [ebp - 0x20], al
+call fcn_0001bfbb ; call 0x1bfbb
+mov dword [ebp - 0x1c], eax
+call fcn_0001c0bd ; call 0x1c0bd
+movzx edi, byte [ebp - 0x20]
+mov dword [ebp - 0x28], eax
+
+loc_00011e9c:
+call fcn_0001c1bf ; call 0x1c1bf
+movzx eax, al
+cmp ebx, eax
+jae near loc_00011fa1 ; jae 0x11fa1
+cmp dword [ebp - 0x1c], 2
+mov byte [ebp - 0x21], 0
+jne short loc_00011ef0 ; jne 0x11ef0
+push ecx
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+and eax, 0xfffc
+lea eax, [eax + ebx*8 + 0x190]
+mov dword [esp], eax
+call fcn_00018f64 ; call 0x18f64
+add esp, 0x10
+and eax, 1
+xor eax, 1
+and eax, 1
+mov byte [ebp - 0x21], al
+
+loc_00011ef0:
+mov eax, 1
+mov cl, bl
+shl eax, cl
+test dword [ebp + 0x10], eax
+je near loc_00012110 ; je 0x12110
+test dword [ebp + 0x14], eax
+jne near loc_00012193 ; jne 0x12193
+push esi
+push esi
+push ebx
+push dword [ebp + 0x18]
+call fcn_0001c39f ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+push 0x1c
+push edi
+call fcn_00016c9a ; call 0x16c9a
+mov esi, eax
+pop eax
+pop edx
+lea eax, [esi + 0xe1]
+push 3
+push eax
+call fcn_00018730 ; call 0x18730
+add esp, 0x10
+cmp dword [ebp - 0x1c], 2
+jne short loc_00011f69 ; jne 0x11f69
+push ecx
+push ecx
+push 0x40
+lea eax, [esi + 0xe2]
+push eax
+call fcn_00018730 ; call 0x18730
+add esp, 0xc
+push 8
+push 0xf3
+lea eax, [esi + 0xe8]
+push eax
+call fcn_0001878a ; call 0x1878a
+add esp, 0x10
+
+loc_00011f69:
+push eax
+push eax
+push 3
+lea eax, [esi + 0xe8]
+push eax
+call fcn_00018b14 ; call 0x18b14
+cmp dword [ebp - 0x28], 2
+pop eax
+mov eax, 0x20
+pop edx
+mov edx, 0x4020
+cmove eax, edx
+add esi, 0x324
+push eax
+push esi
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+jmp near loc_00012193 ; jmp 0x12193
+
+loc_00011fa1:
+xor ebx, ebx
+cmp dword [ebp - 0x1c], 2
+jne near loc_00012084 ; jne 0x12084
+mov eax, dword [ebp + 0x10]
+movzx edi, byte [ebp - 0x20]
+and eax, 0xf
+mov dword [ebp - 0x1c], eax
+
+loc_00011fba:
+call fcn_0001c1bf ; call 0x1c1bf
+movzx eax, al
+cmp ebx, eax
+jae short loc_00012044 ; jae 0x12044
+push esi
+push esi
+push ebx
+push dword [ebp + 0x18]
+call fcn_0001c39f ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+push 0x1c
+push edi
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0x10
+mov edx, eax
+lea eax, [ebx - 4]
+cmp eax, 1
+jbe short loc_00011ff1 ; jbe 0x11ff1
+test ebx, ebx
+jne short loc_0001203e ; jne 0x1203e
+
+loc_00011ff1:
+push ecx
+push ecx
+lea esi, [edx + 0xe1]
+push 0x3c
+push esi
+mov dword [ebp - 0x20], edx
+call fcn_00018730 ; call 0x18730
+mov eax, dword [ebp - 0x1c]
+add esp, 0x10
+mov edx, dword [ebp - 0x20]
+or eax, ebx
+je short loc_0001201e ; je 0x1201e
+mov eax, dword [ebp + 0x10]
+bt eax, ebx
+jb short loc_0001203e ; jb 0x1203e
+cmp ebx, 3
+jbe short loc_0001203e ; jbe 0x1203e
+
+loc_0001201e:
+push eax
+add edx, 0xe2
+push eax
+push 1
+push edx
+call fcn_00018730 ; call 0x18730
+pop eax
+pop edx
+push 0x80
+push esi
+call fcn_00018730 ; call 0x18730
+add esp, 0x10
+
+loc_0001203e:
+inc ebx
+jmp near loc_00011fba ; jmp 0x11fba
+
+loc_00012044:
+test byte [ebp + 0x10], 0x3f
+jne near loc_0001219b ; jne 0x1219b
+push ecx
+push ecx
+push 0
+push dword [ebp + 0x18]
+call fcn_0001c39f ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+movzx eax, byte [ebp - 0x2c]
+push 0x1c
+push eax
+call fcn_00016c9a ; call 0x16c9a
+pop ebx
+pop esi
+push 0x40
+add eax, 0xe1
+push eax
+call fcn_00018730 ; call 0x18730
+add esp, 0x10
+jmp near loc_0001219b ; jmp 0x1219b
+
+loc_00012084:
+cmp dword [ebp - 0x1c], 1
+jne near loc_0001219b ; jne 0x1219b
+movzx edi, byte [ebp - 0x20]
+
+loc_00012092:
+call fcn_0001c1bf ; call 0x1c1bf
+movzx eax, al
+cmp ebx, eax
+jae near loc_0001219b ; jae 0x1219b
+mov eax, dword [ebp + 0x14]
+bt eax, ebx
+jb short loc_0001210b ; jb 0x1210b
+push esi
+push esi
+push ebx
+push dword [ebp + 0x18]
+call fcn_0001c39f ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+push 0x1c
+push edi
+call fcn_00016c9a ; call 0x16c9a
+lea esi, [eax + 0xe1]
+mov dword [ebp - 0x1c], eax
+pop eax
+pop edx
+push 0x3c
+push esi
+call fcn_00018730 ; call 0x18730
+mov eax, 0xf
+mov cl, bl
+shl eax, cl
+add esp, 0x10
+mov edx, dword [ebp - 0x1c]
+test dword [ebp + 0x10], eax
+jne short loc_0001210b ; jne 0x1210b
+push eax
+add edx, 0xe2
+push eax
+push 1
+push edx
+call fcn_00018730 ; call 0x18730
+pop edx
+pop ecx
+push 0x80
+push esi
+call fcn_00018730 ; call 0x18730
+add esp, 0x10
+
+loc_0001210b:
+add ebx, 4
+jmp short loc_00012092 ; jmp 0x12092
+
+loc_00012110:
+cmp dword [ebp - 0x1c], 2
+jne short loc_0001218d ; jne 0x1218d
+push esi
+push esi
+push ebx
+push dword [ebp + 0x18]
+call fcn_0001c39f ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+push 0x1c
+push edi
+call fcn_00016c9a ; call 0x16c9a
+mov esi, eax
+pop eax
+pop edx
+lea eax, [esi + 0xe2]
+add esi, 0x420
+push 0x30
+push eax
+call fcn_00018730 ; call 0x18730
+pop ecx
+pop eax
+push 0x80000000
+push esi
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+
+loc_00012158:
+cmp byte [ebp - 0x21], 0
+je short loc_0001218d ; je 0x1218d
+push eax
+push eax
+push ebx
+push dword [ebp + 0x18]
+call fcn_0001c39f ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+push 0x1c
+push edi
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+push 0x60000000
+add eax, 0x420
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+
+loc_0001218d:
+inc ebx
+jmp near loc_00011e9c ; jmp 0x11e9c
+
+loc_00012193:
+cmp dword [ebp - 0x1c], 2
+jne short loc_0001218d ; jne 0x1218d
+jmp short loc_00012158 ; jmp 0x12158
+
+loc_0001219b:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000121a5:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov ebx, dword [ebp + 0xc]
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0x10]
+push ebx
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_000121e1 ; jne 0x121e1
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000121e1 ; je 0x121e1
+push edx
+push ebx
+push ref_00024f2d ; push 0x24f2d
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000121e1:
+sub esp, 0xc
+add ebx, 0xfc
+push ebx
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+and ax, 0xc000
+cmp ax, 0x8000
+je short loc_00012212 ; je 0x12212
+cmp ax, 0xc000
+je short loc_0001220b ; je 0x1220b
+xor ebx, ebx
+cmp ax, 0x4000
+jne short loc_00012217 ; jne 0x12217
+
+loc_0001220b:
+mov ebx, 2
+jmp short loc_00012217 ; jmp 0x12217
+
+loc_00012212:
+mov ebx, 0x22
+
+loc_00012217:
+call fcn_0001bfbb ; call 0x1bfbb
+dec eax
+jne short loc_00012264 ; jne 0x12264
+push eax
+push 4
+push 0x1c
+movzx eax, byte [edi + 1]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xfc
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+and ax, 0xc000
+cmp ax, 0x8000
+je short loc_0001225c ; je 0x1225c
+cmp ax, 0xc000
+je short loc_00012261 ; je 0x12261
+mov edx, ebx
+or dh, 2
+cmp ax, 0x4000
+cmove ebx, edx
+jmp short loc_00012264 ; jmp 0x12264
+
+loc_0001225c:
+or bh, 0x22
+jmp short loc_00012264 ; jmp 0x12264
+
+loc_00012261:
+or bh, 2
+
+loc_00012264:
+movzx ebx, bx
+add esi, 0x103c
+mov dword [ebp + 0xc], ebx
+mov dword [ebp + 8], esi
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e04 ; jmp 0x17e04
+
+fcn_0001227f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x4c
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000122a2 ; je 0x122a2
+push esi
+push esi
+push ref_00024f42 ; push 0x24f42
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000122a2:
+call fcn_0001bfbb ; call 0x1bfbb
+mov dword [ebp - 0x2c], eax
+push eax
+mov eax, dword [ebp + 8]
+push 0
+push 0x1f
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+mov ebx, eax
+lea eax, [eax + 0xf0]
+add ebx, 0x40
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov dword [esp], ebx
+mov dword [ebp - 0x30], eax
+and dword [ebp - 0x30], 0xffffc000
+call fcn_00017dc2 ; call 0x17dc2
+mov edi, dword [ebp - 0x30]
+mov word [ebp - 0x3e], ax
+pop eax
+pop edx
+and word [ebp - 0x3e], 0xfffc
+push 0
+push edi
+call fcn_0001c39f ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+mov eax, dword [ebp + 8]
+push 0x1c
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+pop ecx
+pop ebx
+push 4
+push edi
+mov esi, eax
+mov dword [ebp - 0x34], eax
+call fcn_0001c39f ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+mov eax, dword [ebp + 8]
+push 0x1c
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+mov ebx, eax
+call fcn_0001c1bf ; call 0x1c1bf
+add esp, 0xc
+push 5
+push 0xf5
+mov byte [ebp - 0x39], al
+mov eax, esi
+add eax, 0xf5
+push eax
+call fcn_0001878a ; call 0x1878a
+add esp, 0xc
+push dword [ebp + 8]
+push esi
+push edi
+call fcn_000121a5 ; call 0x121a5
+mov eax, esi
+add eax, 0xfc
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov esi, eax
+and eax, 0xc000
+cmp eax, 0x8000
+je short loc_00012398 ; je 0x12398
+cmp eax, 0xc000
+je short loc_0001239f ; je 0x1239f
+cmp eax, 0x4000
+sete al
+movzx eax, al
+mov edi, eax
+add edi, eax
+jmp short loc_000123a4 ; jmp 0x123a4
+
+loc_00012398:
+mov edi, 0xa
+jmp short loc_000123a4 ; jmp 0x123a4
+
+loc_0001239f:
+mov edi, 0xe
+
+loc_000123a4:
+cmp dword [ebp - 0x2c], 1
+jne short loc_000123ec ; jne 0x123ec
+sub esp, 0xc
+add ebx, 0xfc
+push ebx
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+and eax, 0xc000
+cmp eax, 0x8000
+je short loc_000123de ; je 0x123de
+cmp eax, 0xc000
+je short loc_000123e6 ; je 0x123e6
+mov edx, edi
+or edx, 0x20
+cmp eax, 0x4000
+cmove edi, edx
+jmp short loc_000123ec ; jmp 0x123ec
+
+loc_000123de:
+or edi, 0xa0
+jmp short loc_000123ec ; jmp 0x123ec
+
+loc_000123e6:
+or edi, 0xe0
+
+loc_000123ec:
+mov eax, dword [ebp - 0x30]
+sub esp, 0xc
+mov bl, 0xff
+add eax, 0x3414
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test esi, 0x80000
+je short loc_00012419 ; je 0x12419
+test al, 0x20
+jne short loc_00012419 ; jne 0x12419
+and esi, 0x70000
+mov ebx, esi
+shr ebx, 0x10
+
+loc_00012419:
+cmp dword [ebp - 0x2c], 1
+jne short loc_00012444 ; jne 0x12444
+mov eax, dword [ebp - 0x34]
+sub esp, 0xc
+add eax, 0x410
+push eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 0x11
+je short loc_0001243f ; je 0x1243f
+test bl, bl
+jne short loc_00012485 ; jne 0x12485
+test al, 0x10
+jne short loc_00012485 ; jne 0x12485
+
+loc_0001243f:
+or edi, 1
+jmp short loc_00012485 ; jmp 0x12485
+
+loc_00012444:
+cmp dword [ebp - 0x2c], 2
+jne short loc_00012495 ; jne 0x12495
+mov eax, dword [ebp - 0x34]
+sub esp, 0xc
+lea esi, [eax + 0x410]
+push esi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test al, 3
+jne short loc_0001246b ; jne 0x1246b
+
+loc_00012463:
+or edi, 1
+jmp near loc_00012c21 ; jmp 0x12c21
+
+loc_0001246b:
+sub esp, 0xc
+push esi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+and eax, 3
+cmp eax, 2
+jne near loc_00012c21 ; jne 0x12c21
+jmp short loc_00012463 ; jmp 0x12463
+
+loc_00012485:
+test al, 0x24
+je short loc_00012492 ; je 0x12492
+cmp bl, 1
+jne short loc_00012495 ; jne 0x12495
+test al, 0x20
+
+loc_00012490:
+jne short loc_00012495 ; jne 0x12495
+
+loc_00012492:
+or edi, 2
+
+loc_00012495:
+cmp dword [ebp - 0x2c], 1
+sete dl
+mov byte [ebp - 0x3b], dl
+cmp bl, 2
+jne short loc_000124ae ; jne 0x124ae
+mov eax, edi
+or eax, 4
+test dl, dl
+cmovne edi, eax
+
+loc_000124ae:
+cmp dword [ebp - 0x2c], 2
+sete cl
+mov byte [ebp - 0x3c], cl
+test bl, bl
+jne short loc_000124c6 ; jne 0x124c6
+mov eax, edi
+or eax, 4
+test cl, cl
+cmovne edi, eax
+
+loc_000124c6:
+cmp bl, 3
+jne short loc_000124d7 ; jne 0x124d7
+mov eax, edi
+or eax, 8
+cmp byte [ebp - 0x3b], 0
+cmovne edi, eax
+
+loc_000124d7:
+cmp bl, 1
+jne short loc_000124e8 ; jne 0x124e8
+mov eax, edi
+or eax, 8
+cmp byte [ebp - 0x3c], 0
+cmovne edi, eax
+
+loc_000124e8:
+cmp bl, 4
+jne short loc_000124f8 ; jne 0x124f8
+cmp byte [ebp - 0x3b], 0
+je short loc_000124f8 ; je 0x124f8
+or edi, 0x10
+jmp short loc_0001250c ; jmp 0x1250c
+
+loc_000124f8:
+cmp byte [ebp - 0x3c], 0
+je short loc_0001250c ; je 0x1250c
+mov eax, edi
+lea edx, [ebx - 2]
+or eax, 0x10
+cmp dl, 3
+cmovbe edi, eax
+
+loc_0001250c:
+cmp bl, 5
+jne short loc_0001251c ; jne 0x1251c
+cmp byte [ebp - 0x3b], 0
+je short loc_0001251c ; je 0x1251c
+or edi, 0x20
+jmp short loc_00012548 ; jmp 0x12548
+
+loc_0001251c:
+cmp byte [ebp - 0x3c], 0
+je short loc_00012542 ; je 0x12542
+mov eax, dword [ebp - 0x34]
+sub esp, 0xc
+add eax, 0x410
+push eax
+call fcn_00017e4e ; call 0x17e4e
+mov edx, edi
+add esp, 0x10
+or edx, 0x20
+test al, 0xf0
+cmove edi, edx
+jmp short loc_0001255c ; jmp 0x1255c
+
+loc_00012542:
+cmp byte [ebp - 0x3b], 0
+je short loc_0001255c ; je 0x1255c
+
+loc_00012548:
+cmp bl, 6
+jne short loc_00012552 ; jne 0x12552
+or edi, 0x40
+jmp short loc_0001255c ; jmp 0x1255c
+
+loc_00012552:
+mov eax, edi
+or al, 0x80
+cmp bl, 7
+cmove edi, eax
+
+loc_0001255c:
+mov eax, dword [ebp - 0x30]
+sub esp, 0xc
+add eax, 0x1030
+push eax
+mov dword [ebp - 0x4c], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov dword [ebp - 0x48], 0xff
+test eax, 0x400000
+je short loc_0001259f ; je 0x1259f
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0x1a6], 0
+je short loc_0001259f ; je 0x1259f
+call fcn_00015480 ; call 0x15480
+mov eax, dword [ebp + 8]
+movzx eax, byte [eax + 0x1a7]
+mov dword [ebp - 0x48], eax
+
+loc_0001259f:
+xor ecx, ecx
+mov eax, 0x10000
+mov dword [ebp - 0x34], 0
+mov edx, 1
+
+loc_000125b2:
+cmp byte [ebp - 0x39], cl
+jbe short loc_000125d9 ; jbe 0x125d9
+imul ebx, ecx, 0x2c
+mov esi, dword [ebp + 8]
+test byte [esi + ebx + 0x46], 1
+je short loc_000125d6 ; je 0x125d6
+mov esi, dword [ebp + 0xc]
+mov ebx, eax
+shl ebx, cl
+test dword [esi], ebx
+jne short loc_000125d6 ; jne 0x125d6
+mov ebx, edx
+shl ebx, cl
+or dword [ebp - 0x34], ebx
+
+loc_000125d6:
+inc ecx
+jmp short loc_000125b2 ; jmp 0x125b2
+
+loc_000125d9:
+cmp dword [ebp - 0x34], 0
+je short loc_000125e6 ; je 0x125e6
+mov eax, edi
+not eax
+and dword [ebp - 0x34], eax
+
+loc_000125e6:
+mov eax, dword [ebp + 8]
+mov byte [ebp - 0x3a], 0xff
+cmp byte [eax + 0x1a9], 0
+jne short loc_0001264c ; jne 0x1264c
+xor eax, eax
+
+loc_000125f8:
+mov dl, al
+cmp al, byte [ebp - 0x39]
+jae short loc_00012616 ; jae 0x12616
+imul ecx, eax, 0x2c
+mov esi, dword [ebp + 8]
+cmp byte [esi + ecx + 0x4f], 0
+mov cl, byte [ebp - 0x3a]
+cmove ecx, edx
+inc eax
+mov byte [ebp - 0x3a], cl
+jmp short loc_000125f8 ; jmp 0x125f8
+
+loc_00012616:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001263f ; je 0x1263f
+mov al, byte [ebp - 0x39]
+cmp byte [ebp - 0x3a], al
+jbe short loc_0001263f ; jbe 0x1263f
+push eax
+push ref_00024f5c ; push 0x24f5c
+push 0x173
+push ref_00024f7b ; push 0x24f7b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001263f:
+mov cl, byte [ebp - 0x3a]
+mov eax, 1
+shl eax, cl
+or dword [ebp - 0x34], eax
+
+loc_0001264c:
+sub esp, 0xc
+lea eax, [ebp - 0x20]
+push eax
+call fcn_00019797 ; call 0x19797
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001269f ; je 0x1269f
+test ebx, ebx
+jns short loc_0001269f ; jns 0x1269f
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00012687 ; je 0x12687
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00012687:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x181
+push ref_00024f7b ; push 0x24f7b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001269f:
+cmp dword [ebp - 0x20], 0x11
+je short loc_000126d9 ; je 0x126d9
+mov eax, dword [ebp + 8]
+mov dword [ebp - 0x38], 0
+cmp byte [eax], 9
+jbe short loc_000126e0 ; jbe 0x126e0
+mov edx, dword [ebp + 8]
+mov al, byte [eax + 0x1aa]
+movzx ecx, byte [edx + 0x1ab]
+shr al, 1
+movzx eax, al
+mov dword [ebp - 0x38], ecx
+and dword [ebp - 0x38], 7
+shl dword [ebp - 0x38], 7
+or dword [ebp - 0x38], eax
+jmp short loc_000126e0 ; jmp 0x126e0
+
+loc_000126d9:
+mov dword [ebp - 0x38], 0x3e8
+
+loc_000126e0:
+movzx eax, word [ebp - 0x3e]
+mov dword [ebp - 0x2c], 0
+mov dword [ebp - 0x44], 0
+mov dword [ebp - 0x58], eax
+
+loc_000126f5:
+mov edx, dword [ebp - 0x2c]
+mov al, byte [ebp - 0x39]
+mov byte [ebp - 0x3e], dl
+cmp dl, al
+jae near loc_00012ac0 ; jae 0x12ac0
+push eax
+push eax
+push dword [ebp - 0x2c]
+push dword [ebp - 0x30]
+call fcn_0001c39f ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+mov eax, dword [ebp + 8]
+push 0x1c
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+mov ebx, eax
+call fcn_0001c0bd ; call 0x1c0bd
+add esp, 0x10
+cmp eax, 2
+jne short loc_00012774 ; jne 0x12774
+cmp byte [ebp - 0x3c], 0
+je short loc_00012774 ; je 0x12774
+mov edx, dword [ebp + 8]
+mov eax, 0x2000430
+cmp byte [edx], 7
+jbe short loc_00012762 ; jbe 0x12762
+imul eax, dword [ebp - 0x2c], 0x2c
+mov al, byte [edx + eax + 0x46]
+shr al, 7
+cmp al, 1
+sbb eax, eax
+and eax, 0xfffffffd
+add eax, 0x2000433
+
+loc_00012762:
+push esi
+push esi
+push eax
+lea eax, [ebx + 0x418]
+push eax
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+
+loc_00012774:
+cmp byte [ebp - 0x3e], 0
+jne near loc_00012869 ; jne 0x12869
+mov esi, dword [ebp - 0x30]
+push eax
+push eax
+push 0
+push esi
+call fcn_0001c39f ; call 0x1c39f
+pop edx
+pop ecx
+lea edx, [ebp - 0x21]
+push edx
+sub eax, 0x20
+lea edx, [ebp - 0x1c]
+movzx eax, al
+push edx
+push eax
+push 4
+push 0xe00000e0
+push esi
+call fcn_00009ecd ; call 0x9ecd
+add esp, 0x20
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000127f0 ; je 0x127f0
+test esi, esi
+jns short loc_000127f0 ; jns 0x127f0
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000127d8 ; je 0x127d8
+push eax
+push esi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000127d8:
+push esi
+push ref_000206f4 ; push 0x206f4
+push 0x1ab
+push ref_00024f7b ; push 0x24f7b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000127f0:
+mov esi, dword [ebp - 0x30]
+push ecx
+push ecx
+push 0
+push esi
+or dword [ebp - 0x1c], 0x300000
+call fcn_0001c39f ; call 0x1c39f
+pop edx
+pop ecx
+lea ecx, [ebp - 0x21]
+lea edx, [ebp - 0x1c]
+push ecx
+sub eax, 0x20
+push edx
+movzx eax, al
+push eax
+push 5
+push 0xe00000e0
+push esi
+call fcn_00009ecd ; call 0x9ecd
+add esp, 0x20
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00012869 ; je 0x12869
+test esi, esi
+jns short loc_00012869 ; jns 0x12869
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00012851 ; je 0x12851
+push edx
+push esi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00012851:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x1b5
+push ref_00024f7b ; push 0x24f7b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00012869:
+mov cl, byte [ebp - 0x2c]
+mov esi, 1
+shl esi, cl
+mov eax, esi
+and eax, edi
+mov dword [ebp - 0x50], eax
+jne near loc_00012c4c ; jne 0x12c4c
+push eax
+push eax
+push 0x100
+lea eax, [ebx + 0x42]
+push eax
+call fcn_00018927 ; call 0x18927
+lea edx, [ebx + 0x5a]
+mov dword [esp], edx
+mov dword [ebp - 0x54], edx
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+mov edx, dword [ebp - 0x54]
+test al, 0x40
+jne near loc_00012939 ; jne 0x12939
+imul eax, dword [ebp - 0x2c], 0x2c
+mov ecx, dword [ebp + 8]
+test byte [ecx + eax + 0x46], 8
+jne short loc_00012939 ; jne 0x12939
+mov eax, dword [ebp - 0x48]
+cmp dword [ebp - 0x2c], eax
+je short loc_00012939 ; je 0x12939
+push eax
+mov esi, 0x1f4
+push eax
+push 0x4000000
+lea eax, [ebx + 0x338]
+push eax
+call fcn_00018b14 ; call 0x18b14
+lea eax, [ebx + 0x328]
+add esp, 0x10
+mov dword [ebp - 0x54], eax
+
+loc_000128e6:
+sub esp, 0xc
+push dword [ebp - 0x54]
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+and eax, 0xff000000
+cmp eax, 0x1000000
+jne short loc_00012927 ; jne 0x12927
+
+loc_00012900:
+push eax
+push eax
+push 0x8000000
+lea eax, [ebx + 0x408]
+push eax
+call fcn_00018b14 ; call 0x18b14
+mov cl, byte [ebp - 0x2c]
+mov eax, 0x10000
+mov edx, dword [ebp + 0xc]
+shl eax, cl
+or dword [edx], eax
+jmp near loc_00012a55 ; jmp 0x12a55
+
+loc_00012927:
+sub esp, 0xc
+push 0x64
+call fcn_0001bb03 ; call 0x1bb03
+add esp, 0x10
+dec esi
+jne short loc_000128e6 ; jne 0x128e6
+jmp short loc_00012900 ; jmp 0x12900
+
+loc_00012939:
+test dword [ebp - 0x34], esi
+jne short loc_00012972 ; jne 0x12972
+sub esp, 0xc
+push edx
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test al, 0x40
+je short loc_0001295e ; je 0x1295e
+push eax
+push eax
+push 0x10
+lea eax, [ebx + 0x50]
+push eax
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+
+loc_0001295e:
+mov cl, byte [ebp - 0x2c]
+mov eax, 0x10000
+mov edx, dword [ebp + 0xc]
+shl eax, cl
+or dword [edx], eax
+jmp near loc_00012a58 ; jmp 0x12a58
+
+loc_00012972:
+sub esp, 0xc
+lea eax, [ebx + 0xe0]
+push eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+cmp dword [ebp - 0x20], 0x11
+jne short loc_0001298e ; jne 0x1298e
+test al, 2
+je short loc_000129bc ; je 0x129bc
+
+loc_0001298e:
+lea esi, [ebx + 0x52]
+
+loc_00012991:
+mov eax, dword [ebp - 0x38]
+cmp dword [ebp - 0x44], eax
+jae short loc_000129bc ; jae 0x129bc
+sub esp, 0xc
+push esi
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test ah, 0x20
+jne short loc_000129bc ; jne 0x129bc
+sub esp, 0xc
+push 0x64
+call fcn_0001bb03 ; call 0x1bb03
+add esp, 0x10
+inc dword [ebp - 0x44]
+jmp short loc_00012991 ; jmp 0x12991
+
+loc_000129bc:
+sub esp, 0xc
+mov eax, dword [ebp - 0x2c]
+push dword [ebp - 0x30]
+push dword [ebp - 0x58]
+push dword [ebp + 8]
+push eax
+push eax
+call fcn_0001193a ; call 0x1193a
+add esp, 0x20
+test eax, eax
+js short loc_000129fc ; js 0x129fc
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000129fc ; je 0x129fc
+mov eax, dword [ebp - 0x2c]
+push dword [ebp - 0x34]
+inc eax
+push eax
+push ref_00024fa9 ; push 0x24fa9
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000129fc:
+imul eax, dword [ebp - 0x2c], 0x2c
+mov ecx, dword [ebp + 8]
+test byte [ecx + eax + 0x46], 0x40
+je short loc_00012a58 ; je 0x12a58
+sub esp, 0xc
+lea eax, [ebx + 0x328]
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+and eax, 0x780000
+cmp eax, 0x380000
+jne short loc_00012a58 ; jne 0x12a58
+push eax
+push eax
+push 0x10
+lea esi, [ebx + 0x50]
+push esi
+call fcn_00018730 ; call 0x18730
+pop eax
+pop edx
+lea eax, [ebx + 0xe8]
+push 0x2000
+push eax
+call fcn_00018927 ; call 0x18927
+pop ecx
+pop eax
+push 0xef
+push esi
+call fcn_0001875d ; call 0x1875d
+
+loc_00012a55:
+add esp, 0x10
+
+loc_00012a58:
+sub esp, 0xc
+push ebx
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+inc eax
+je short loc_00012ab8 ; je 0x12ab8
+cmp byte [ebp - 0x3b], 0
+je short loc_00012a73 ; je 0x12a73
+test byte [ebp - 0x3e], 0xfb
+jmp short loc_00012a87 ; jmp 0x12a87
+
+loc_00012a73:
+cmp byte [ebp - 0x3c], 0
+je short loc_00012a9f ; je 0x12a9f
+mov cl, byte [ebp - 0x3e]
+mov al, cl
+sub eax, 4
+cmp al, 1
+jbe short loc_00012a89 ; jbe 0x12a89
+test cl, cl
+
+loc_00012a87:
+jne short loc_00012a9f ; jne 0x12a9f
+
+loc_00012a89:
+push eax
+push eax
+push 0xf3
+lea eax, [ebx + 0xf7]
+push eax
+call fcn_0001875d ; call 0x1875d
+add esp, 0x10
+
+loc_00012a9f:
+cmp dword [ebp - 0x50], 0
+jne short loc_00012ab8 ; jne 0x12ab8
+push esi
+add ebx, 0xd4
+push esi
+push 2
+push ebx
+call fcn_00018730 ; call 0x18730
+add esp, 0x10
+
+loc_00012ab8:
+inc dword [ebp - 0x2c]
+jmp near loc_000126f5 ; jmp 0x126f5
+
+loc_00012ac0:
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0x1a9], 0
+jne short loc_00012afe ; jne 0x12afe
+mov eax, dword [ebp + 0xc]
+mov ecx, 8
+sub cl, byte [ebp - 0x39]
+mov edx, dword [eax]
+mov eax, 0xff
+sar eax, cl
+mov ecx, edx
+shr ecx, 0x10
+and ecx, eax
+cmp ecx, eax
+je short loc_00012afe ; je 0x12afe
+mov cl, byte [ebp - 0x3a]
+mov eax, 0x10000
+shl eax, cl
+not eax
+and eax, edx
+mov edx, dword [ebp + 0xc]
+mov dword [edx], eax
+
+loc_00012afe:
+sub esp, 0xc
+push dword [ebp - 0x4c]
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test eax, 0x400000
+je short loc_00012b66 ; je 0x12b66
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0x1a6], 0
+je short loc_00012b66 ; je 0x12b66
+movzx eax, byte [eax + 0x1a7]
+mov ecx, dword [ebp + 8]
+imul edx, eax, 0x2c
+test byte [ecx + edx + 0x46], 1
+je short loc_00012b66 ; je 0x12b66
+push edx
+push edx
+push eax
+push dword [ebp - 0x30]
+call fcn_0001c39f ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+mov eax, dword [ebp + 8]
+push 0x1c
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+pop ecx
+pop ebx
+push 3
+add eax, 0xec
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+
+loc_00012b66:
+mov edx, dword [ebp + 8]
+mov eax, dword [ebp + 0xc]
+cmp byte [edx + 0x1a8], 0
+mov eax, dword [eax]
+je short loc_00012b95 ; je 0x12b95
+sub esp, 0xc
+push dword [ebp - 0x30]
+shr eax, 0x10
+not eax
+movzx eax, al
+push edi
+push eax
+push edx
+movzx eax, byte [edx + 1]
+push eax
+call fcn_00011e74 ; call 0x11e74
+add esp, 0x20
+
+loc_00012b95:
+xor ebx, ebx
+
+loc_00012b97:
+cmp byte [ebp - 0x39], bl
+jbe short loc_00012bd7 ; jbe 0x12bd7
+push eax
+mov eax, dword [ebp + 8]
+push ebx
+push 0x1c
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+mov dword [esp], eax
+mov esi, eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_00012bd4 ; je 0x12bd4
+push edi
+add esi, 0x320
+push edi
+push 0x1800000
+push esi
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+
+loc_00012bd4:
+inc ebx
+jmp short loc_00012b97 ; jmp 0x12b97
+
+loc_00012bd7:
+mov edi, dword [ebp - 0x30]
+push edx
+push edx
+push 0x80000080
+mov eax, edi
+add eax, 0x2314
+push eax
+call fcn_00018b14 ; call 0x18b14
+mov eax, edi
+pop ecx
+add eax, 0x1114
+pop ebx
+push 0xc000
+push eax
+call fcn_00018927 ; call 0x18927
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00012c60 ; je 0x12c60
+push eax
+push eax
+push ref_00024fdb ; push 0x24fdb
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp short loc_00012c60 ; jmp 0x12c60
+
+loc_00012c21:
+sub esp, 0xc
+push esi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test al, 0xc
+je near loc_00012492 ; je 0x12492
+sub esp, 0xc
+push esi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+and eax, 0xc
+cmp eax, 8
+jmp near loc_00012490 ; jmp 0x12490
+
+loc_00012c4c:
+mov cl, byte [ebp - 0x2c]
+mov eax, 0x10000
+shl eax, cl
+mov ecx, dword [ebp + 0xc]
+or dword [ecx], eax
+jmp near loc_00012a58 ; jmp 0x12a58
+
+loc_00012c60:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00012c6a:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+mov ebx, 0xa
+sub esp, 0xc
+mov edi, dword [ebp + 0xc]
+mov esi, dword [ebp + 0x10]
+
+loc_00012c7e:
+sub esp, 0xc
+push dword [ebp + 8]
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+and eax, edi
+cmp ax, si
+je short loc_00012caa ; je 0x12caa
+sub esp, 0xc
+push 0x64
+call fcn_0001bb03 ; call 0x1bb03
+add esp, 0x10
+dec ebx
+jne short loc_00012c7e ; jne 0x12c7e
+mov eax, 0x80000012
+jmp short loc_00012cac ; jmp 0x12cac
+
+loc_00012caa:
+xor eax, eax
+
+loc_00012cac:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00012cb4:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov esi, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+push 0
+push 1
+lea ebx, [esi + 0x68]
+push ebx
+mov dword [ebp - 0x1c], eax
+call fcn_00012c6a ; call 0x12c6a
+add esp, 0x10
+test eax, eax
+jns short loc_00012cf0 ; jns 0x12cf0
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_00012d7a ; je 0x12d7a
+push eax
+push eax
+push ref_00024ff3 ; push 0x24ff3
+jmp short loc_00012d6d ; jmp 0x12d6d
+
+loc_00012cf0:
+mov eax, dword [ebp + 0xc]
+push ecx
+push ecx
+push dword [eax]
+lea eax, [esi + 0x60]
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop edi
+pop eax
+push 3
+push ebx
+call fcn_00018927 ; call 0x18927
+add esp, 0xc
+push 0
+push 1
+push ebx
+call fcn_00012c6a ; call 0x12c6a
+add esp, 0x10
+mov edi, eax
+test eax, eax
+jns short loc_00012d2f ; jns 0x12d2f
+push edx
+push edx
+push 0xfffe
+push ebx
+call fcn_00018954 ; call 0x18954
+jmp short loc_00012d58 ; jmp 0x12d58
+
+loc_00012d2f:
+xor edi, edi
+cmp byte [ebp - 0x1c], 1
+jne short loc_00012d7f ; jne 0x12d7f
+sub esp, 0xc
+push ebx
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test al, 2
+je short loc_00012d5d ; je 0x12d5d
+sub esp, 0xc
+add esi, 0x64
+push esi
+call fcn_00017e4e ; call 0x17e4e
+mov edx, dword [ebp + 0xc]
+mov dword [edx], eax
+
+loc_00012d58:
+add esp, 0x10
+jmp short loc_00012d7f ; jmp 0x12d7f
+
+loc_00012d5d:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00012d7a ; je 0x12d7a
+push eax
+push eax
+push ref_00025022 ; push 0x25022
+
+loc_00012d6d:
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00012d7a:
+mov edi, 0x80000007
+
+loc_00012d7f:
+lea esp, [ebp - 0xc]
+mov eax, edi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00012d89:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x2c
+mov al, byte [ebp + 0xc]
+mov byte [ebp - 0x29], al
+mov al, byte [ebp + 0x10]
+mov byte [ebp - 0x2a], al
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00012dc5 ; je 0x12dc5
+cmp dword [ebp + 8], 0
+jne short loc_00012dc5 ; jne 0x12dc5
+push eax
+push ref_00025045 ; push 0x25045
+push 0x96
+push ref_00025059 ; push 0x25059
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00012dc5:
+xor ebx, ebx
+lea esi, [ebp - 0x1c]
+
+loc_00012dca:
+push esi
+push 0
+push ebx
+push ref_0002912c ; push 0x2912c
+mov dword [ebp - 0x1c], 0
+call fcn_0001975d ; call 0x1975d
+add esp, 0x10
+test eax, eax
+jne short loc_00012e18 ; jne 0x12e18
+mov edx, dword [ebp - 0x1c]
+test edx, edx
+je short loc_00012e18 ; je 0x12e18
+movzx ecx, word [edx]
+movzx edi, word [edx + 2]
+shl ecx, 0x10
+or ecx, edi
+cmp ecx, dword [ebp + 8]
+jne short loc_00012e18 ; jne 0x12e18
+mov cl, byte [edx + 4]
+cmp cl, 0xff
+je short loc_00012e0b ; je 0x12e0b
+cmp cl, byte [ebp - 0x29]
+jne short loc_00012e18 ; jne 0x12e18
+
+loc_00012e0b:
+mov dl, byte [edx + 5]
+cmp dl, 0xff
+je short loc_00012e1d ; je 0x12e1d
+cmp dl, byte [ebp - 0x2a]
+je short loc_00012e1d ; je 0x12e1d
+
+loc_00012e18:
+inc ebx
+test eax, eax
+je short loc_00012dca ; je 0x12dca
+
+loc_00012e1d:
+mov eax, dword [ebp - 0x1c]
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00012e28:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+push eax
+push 0
+push 0x1f
+movzx eax, byte [ebx + 1]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+lea edx, [eax + 0x63bf]
+cmp dx, 6
+jbe short loc_00012e66 ; jbe 0x12e66
+add ax, 0x633f
+cmp ax, 0xa
+ja short loc_00012ea9 ; ja 0x12ea9
+
+loc_00012e66:
+push ecx
+push 0
+push 0x1b
+movzx eax, byte [ebx + 1]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+mov ebx, eax
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00012e94 ; je 0x12e94
+push edx
+push edx
+push ref_00025081 ; push 0x25081
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00012e94:
+push eax
+mov eax, esi
+movzx esi, al
+add ebx, 0x42
+push esi
+push 0x3f
+push ebx
+call fcn_0001878a ; call 0x1878a
+add esp, 0x10
+
+loc_00012ea9:
+lea esp, [ebp - 8]
+xor eax, eax
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00012eb2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x4c
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00012ed5 ; je 0x12ed5
+push eax
+push eax
+push ref_000250c6 ; push 0x250c6
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00012ed5:
+mov eax, dword [ebp + 8]
+mov esi, dword [eax + 4]
+call fcn_0001bfbb ; call 0x1bfbb
+lea edi, [esi + 0x2030]
+mov dword [ebp - 0x2c], eax
+push eax
+mov eax, dword [ebp + 8]
+push 0
+push 0x1b
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0x1f
+mov ebx, eax
+mov eax, dword [ebp + 8]
+lea esi, [ebx + 0x120]
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+mov dword [esp], edi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test eax, eax
+jns short loc_00012f6f ; jns 0x12f6f
+sub esp, 0xc
+push edi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0xc
+and eax, 0xfe
+or eax, 0x2000000
+push eax
+push 0xf8ffff01
+push esi
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp dword [ebp - 0x2c], 1
+jne short loc_00012f6f ; jne 0x12f6f
+push eax
+push eax
+push 0xf7ff
+lea eax, [ebx + 0x78]
+push eax
+call fcn_00018954 ; call 0x18954
+add esp, 0x10
+
+loc_00012f6f:
+sub esp, 0xc
+push esi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test eax, 0x7000000
+je short loc_00012fc3 ; je 0x12fc3
+push eax
+push eax
+push 0xffffff01
+lea eax, [ebx + 0x114]
+push eax
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+cmp dword [ebp - 0x2c], 1
+jne short loc_00012fad ; jne 0x12fad
+push edi
+push edi
+push 0x80000000
+push esi
+call fcn_00018b14 ; call 0x18b14
+jmp short loc_00012fc0 ; jmp 0x12fc0
+
+loc_00012fad:
+cmp dword [ebp - 0x2c], 2
+jne short loc_00012fc3 ; jne 0x12fc3
+push ecx
+push ecx
+push 0x7fffffff
+push esi
+call fcn_00018b3e ; call 0x18b3e
+
+loc_00012fc0:
+add esp, 0x10
+
+loc_00012fc3:
+mov eax, dword [ebp + 8]
+lea ecx, [ebx + 0x10]
+mov dword [ebp - 0x40], ecx
+mov eax, dword [eax + 0x1a]
+push edx
+push edx
+push eax
+push ecx
+mov dword [ebp - 0x34], eax
+call fcn_00017e8f ; call 0x17e8f
+lea eax, [ebx + 0x14]
+pop ecx
+pop esi
+mov dword [ebp - 0x44], eax
+push 0
+push eax
+call fcn_00017e8f ; call 0x17e8f
+lea eax, [ebx + 4]
+pop edi
+pop edx
+mov dword [ebp - 0x48], eax
+push 2
+push eax
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+cmp dword [ebp - 0x2c], 1
+jne short loc_0001302e ; jne 0x1302e
+push esi
+push esi
+push 0x10
+lea eax, [ebx + 0x43]
+push eax
+call fcn_00018730 ; call 0x18730
+pop edi
+pop eax
+lea eax, [ebx + 0xc0]
+push 0x20000
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+mov eax, 0x4000
+jmp short loc_0001304e ; jmp 0x1304e
+
+loc_0001302e:
+xor eax, eax
+cmp dword [ebp - 0x2c], 2
+jne short loc_0001304e ; jne 0x1304e
+push ecx
+push ecx
+push 0xbf
+lea eax, [ebx + 0x43]
+push eax
+call fcn_0001875d ; call 0x1875d
+add esp, 0x10
+mov eax, 0x1000000
+
+loc_0001304e:
+push edx
+push edx
+push eax
+lea eax, [ebx + 0xc4]
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+cmp dword [ebp - 0x2c], 1
+jne short loc_0001307c ; jne 0x1307c
+push eax
+push eax
+push 0x7fffffff
+lea eax, [ebx + 0xd0]
+push eax
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+
+loc_0001307c:
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0x372], 0
+jne short loc_00013097 ; jne 0x13097
+push eax
+push eax
+push 0x7f
+lea eax, [ebx + 0x4d]
+push eax
+call fcn_0001875d ; call 0x1875d
+jmp short loc_000130c3 ; jmp 0x130c3
+
+loc_00013097:
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0x373], 0
+je short loc_000130c6 ; je 0x130c6
+sub esp, 0xc
+lea eax, [ebx + 0x4d]
+push eax
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+test al, 1
+jne short loc_000130c6 ; jne 0x130c6
+push edi
+push edi
+push 1
+lea eax, [ebx + 0x4c]
+push eax
+call fcn_00018730 ; call 0x18730
+
+loc_000130c3:
+add esp, 0x10
+
+loc_000130c6:
+cmp dword [ebp - 0x2c], 2
+jne short loc_000130f9 ; jne 0x130f9
+push eax
+push eax
+mov eax, dword [ebp - 0x34]
+push 1
+add eax, 0x12
+push eax
+call fcn_00018927 ; call 0x18927
+pop eax
+pop edx
+lea eax, [ebx + 0x41]
+push 1
+push eax
+call fcn_00018730 ; call 0x18730
+lea eax, [ebx + 0x42]
+pop ecx
+pop esi
+push 4
+push eax
+call fcn_00018730 ; call 0x18730
+add esp, 0x10
+
+loc_000130f9:
+mov edi, dword [ebp - 0x34]
+push eax
+push eax
+push 1
+lea esi, [edi + 8]
+push esi
+call fcn_00018b14 ; call 0x18b14
+add esp, 0xc
+push 1
+push 1
+push esi
+call fcn_00012c6a ; call 0x12c6a
+mov dword [esp], edi
+call fcn_00017dc2 ; call 0x17dc2
+pop edx
+pop ecx
+movzx eax, ax
+push eax
+push edi
+call fcn_00017e04 ; call 0x17e04
+mov ecx, 3
+cmp dword [ebp - 0x2c], 2
+pop eax
+mov eax, 0xf
+pop edx
+cmove eax, ecx
+lea edx, [edi + 0xe]
+push eax
+push edx
+mov dword [ebp - 0x3c], edx
+call fcn_00018730 ; call 0x18730
+pop ecx
+pop edi
+push 0xfffffffffffffffe
+push esi
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0xc
+push 0
+push 1
+push esi
+call fcn_00012c6a ; call 0x12c6a
+add esp, 0x10
+mov edi, eax
+test eax, eax
+jns short loc_00013180 ; jns 0x13180
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_00013497 ; je 0x13497
+push eax
+push eax
+push ref_000250dd ; push 0x250dd
+jmp short loc_000131c6 ; jmp 0x131c6
+
+loc_00013180:
+push edi
+push edi
+push 1
+push esi
+call fcn_00018b14 ; call 0x18b14
+mov eax, dword [ebp + 8]
+movzx eax, word [eax + 0x374]
+mov dword [esp], eax
+call fcn_0001bb03 ; call 0x1bb03
+add esp, 0xc
+push 1
+push 1
+push esi
+call fcn_00012c6a ; call 0x12c6a
+add esp, 0x10
+mov edi, eax
+test eax, eax
+jns short loc_000131d8 ; jns 0x131d8
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_00013497 ; je 0x13497
+push ecx
+push ecx
+push ref_00025118 ; push 0x25118
+
+loc_000131c6:
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp near loc_00013497 ; jmp 0x13497
+
+loc_000131d8:
+cmp dword [ebp - 0x2c], 2
+mov edx, 3
+mov eax, 0xf
+mov edi, 0xa
+cmove eax, edx
+xor edx, edx
+mov word [ebp - 0x38], ax
+
+loc_000131f4:
+sub esp, 0xc
+push dword [ebp - 0x3c]
+mov dword [ebp - 0x4c], edx
+call fcn_00017d8b ; call 0x17d8b
+mov edx, dword [ebp - 0x4c]
+add esp, 0x10
+mov byte [ebp - 0x2d], al
+mov al, byte [ebp - 0x38]
+and byte [ebp - 0x2d], al
+mov al, byte [ebp - 0x2d]
+cmp al, dl
+jne short loc_0001321c ; jne 0x1321c
+test al, al
+jne short loc_0001326b ; jne 0x1326b
+
+loc_0001321c:
+sub esp, 0xc
+push 0x64
+call fcn_0001bb03 ; call 0x1bb03
+add esp, 0x10
+dec edi
+je short loc_00013231 ; je 0x13231
+mov dl, byte [ebp - 0x2d]
+jmp short loc_000131f4 ; jmp 0x131f4
+
+loc_00013231:
+cmp byte [ebp - 0x2d], 0
+jne short loc_0001326b ; jne 0x1326b
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00013254 ; je 0x13254
+push edx
+push edx
+push ref_00025153 ; push 0x25153
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00013254:
+push eax
+mov edi, 0x80000007
+push eax
+push 0xfffffffffffffffe
+push esi
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+jmp near loc_00013497 ; jmp 0x13497
+
+loc_0001326b:
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0x371], 1
+jne short loc_0001328a ; jne 0x1328a
+push eax
+add ebx, 0x54
+push eax
+push 0x100
+push ebx
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+
+loc_0001328a:
+xor eax, eax
+cmp dword [ebp - 0x2c], 2
+mov byte [ebp - 0x2c], 0
+setne al
+lea eax, [eax + eax + 2]
+mov word [ebp - 0x3c], ax
+
+loc_0001329f:
+movzx eax, byte [ebp - 0x2c]
+cmp ax, word [ebp - 0x3c]
+jae near loc_00013495 ; jae 0x13495
+test byte [ebp - 0x2d], 1
+jne short loc_000132d0 ; jne 0x132d0
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_0001348a ; je 0x1348a
+push eax
+movzx eax, byte [ebp - 0x2c]
+push eax
+push ref_00025172 ; push 0x25172
+jmp near loc_000133d5 ; jmp 0x133d5
+
+loc_000132d0:
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0x371], 0
+je short loc_000132fb ; je 0x132fb
+mov cl, byte [ebp - 0x2c]
+push eax
+push eax
+mov eax, 1
+shl eax, cl
+movzx eax, ax
+push eax
+mov eax, dword [ebp - 0x34]
+add eax, 0xc
+push eax
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+
+loc_000132fb:
+movzx ebx, byte [ebp - 0x2c]
+mov eax, ebx
+shl eax, 0x1c
+mov dword [ebp - 0x38], eax
+or eax, 0xf0000
+mov dword [ebp - 0x24], eax
+push eax
+push 1
+lea eax, [ebp - 0x24]
+push eax
+push dword [ebp - 0x34]
+call fcn_00012cb4 ; call 0x12cb4
+add esp, 0x10
+mov edi, eax
+test eax, eax
+jns short loc_00013340 ; jns 0x13340
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_00013497 ; je 0x13497
+push eax
+push eax
+push ref_0002518f ; push 0x2518f
+jmp near loc_000131c6 ; jmp 0x131c6
+
+loc_00013340:
+mov eax, dword [ebp - 0x38]
+push esi
+push 1
+or eax, 0xf0002
+mov dword [ebp - 0x20], eax
+lea eax, [ebp - 0x20]
+push eax
+push dword [ebp - 0x34]
+call fcn_00012cb4 ; call 0x12cb4
+add esp, 0x10
+mov edi, eax
+test eax, eax
+jns short loc_0001337c ; jns 0x1337c
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_00013497 ; je 0x13497
+push ecx
+push ecx
+push ref_000251c3 ; push 0x251c3
+jmp near loc_000131c6 ; jmp 0x131c6
+
+loc_0001337c:
+mov eax, dword [ebp - 0x20]
+movzx eax, ah
+mov dword [ebp - 0x20], eax
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000133a7 ; je 0x133a7
+sub esp, 0xc
+push dword [ebp - 0x20]
+push dword [ebp - 0x24]
+push ebx
+push ref_000251ef ; push 0x251ef
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_000133a7:
+movzx eax, byte [ebp - 0x20]
+push edx
+push ebx
+push eax
+push dword [ebp - 0x24]
+call fcn_00012d89 ; call 0x12d89
+add esp, 0x10
+mov esi, eax
+test eax, eax
+jne short loc_000133e7 ; jne 0x133e7
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_0001348a ; je 0x1348a
+push eax
+push dword [ebp - 0x24]
+push ref_0002521f ; push 0x2521f
+
+loc_000133d5:
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp near loc_0001348a ; jmp 0x1348a
+
+loc_000133e7:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00013418 ; je 0x13418
+push eax
+movzx eax, word [esi + 6]
+push eax
+movzx eax, byte [esi + 5]
+push eax
+movzx eax, byte [esi + 4]
+push eax
+movzx eax, word [esi + 2]
+push eax
+movzx eax, word [esi]
+push eax
+push ref_00025265 ; push 0x25265
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_00013418:
+xor ebx, ebx
+
+loc_0001341a:
+movzx eax, word [esi + 6]
+cmp ebx, eax
+jae short loc_0001348a ; jae 0x1348a
+mov eax, dword [esi + ebx*4 + 0xc]
+mov dword [ebp - 0x1c], eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00013452 ; je 0x13452
+mov eax, dword [ebp - 0x1c]
+shr eax, 0x1c
+je short loc_00013452 ; je 0x13452
+push eax
+push ref_000252bb ; push 0x252bb
+push 0x26a
+push ref_00025059 ; push 0x25059
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00013452:
+mov eax, dword [ebp - 0x38]
+or dword [ebp - 0x1c], eax
+push eax
+push 0
+lea eax, [ebp - 0x1c]
+push eax
+push dword [ebp - 0x34]
+call fcn_00012cb4 ; call 0x12cb4
+add esp, 0x10
+mov edi, eax
+test eax, eax
+jns short loc_00013487 ; jns 0x13487
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00013497 ; je 0x13497
+push eax
+push dword [ebp - 0x24]
+push ref_000252d5 ; push 0x252d5
+jmp near loc_000131c6 ; jmp 0x131c6
+
+loc_00013487:
+inc ebx
+jmp short loc_0001341a ; jmp 0x1341a
+
+loc_0001348a:
+inc byte [ebp - 0x2c]
+shr byte [ebp - 0x2d], 1
+jmp near loc_0001329f ; jmp 0x1329f
+
+loc_00013495:
+xor edi, edi
+
+loc_00013497:
+push edx
+push edx
+push 0xfffd
+push dword [ebp - 0x48]
+call fcn_00018954 ; call 0x18954
+pop ecx
+pop ebx
+push 0
+push dword [ebp - 0x40]
+call fcn_00017e8f ; call 0x17e8f
+pop esi
+pop eax
+push 0
+push dword [ebp - 0x44]
+call fcn_00017e8f ; call 0x17e8f
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_000134db ; je 0x134db
+push eax
+push eax
+push ref_00025309 ; push 0x25309
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000134db:
+lea esp, [ebp - 0xc]
+mov eax, edi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000134e5:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+mov ebx, 0xc8
+sub esp, 0xc
+mov esi, dword [ebp + 0xc]
+lea edi, [esi + 0x20]
+
+loc_000134f9:
+sub esp, 0xc
+push edi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test al, 2
+je short loc_00013519 ; je 0x13519
+sub esp, 0xc
+push 0x64
+call fcn_0001bb03 ; call 0x1bb03
+add esp, 0x10
+dec ebx
+jne short loc_000134f9 ; jne 0x134f9
+
+loc_00013519:
+sub esp, 0xc
+push edi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test al, 2
+jne short loc_00013542 ; jne 0x13542
+add esi, 0x60
+mov dword [ebp + 8], esi
+mov dword [ebp + 0xc], 1
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f ; jmp 0x17e8f
+
+loc_00013542:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001354a:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov ebx, dword [ebp + 0x14]
+lea esi, [ebx + 0x84]
+push esi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test al, 1
+je short loc_00013592 ; je 0x13592
+
+loc_00013569:
+sub esp, 0xc
+push esi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test al, 1
+je short loc_000135d7 ; je 0x135d7
+sub ebx, 0xffffff80
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], 2
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018927 ; jmp 0x18927
+
+loc_00013592:
+sub esp, 0xc
+lea edi, [ebx + 0x80]
+push edi
+call fcn_00017e4e ; call 0x17e4e
+pop edx
+pop ecx
+and eax, 0xfffffffe
+push eax
+push edi
+mov edi, 0xc8
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+
+loc_000135b5:
+sub esp, 0xc
+push esi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test al, 1
+jne short loc_00013569 ; jne 0x13569
+sub esp, 0xc
+push 0x64
+call fcn_0001bb03 ; call 0x1bb03
+add esp, 0x10
+dec edi
+jne short loc_000135b5 ; jne 0x135b5
+jmp short loc_00013569 ; jmp 0x13569
+
+loc_000135d7:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000135df:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x2c
+movzx eax, byte [ebp + 0x10]
+mov byte [ebp - 0x19], 0
+mov dword [ebp - 0x2c], eax
+
+loc_000135f3:
+call fcn_0001c245 ; call 0x1c245
+cmp byte [ebp - 0x19], al
+jae near loc_000137f4 ; jae 0x137f4
+movzx esi, byte [ebp - 0x19]
+push ecx
+movzx eax, byte [esi + esi + ref_000204f1] ; movzx eax, byte [esi + esi + 0x204f1]
+push eax
+movzx eax, byte [esi + esi + ref_000204f0] ; movzx eax, byte [esi + esi + 0x204f0]
+push eax
+push dword [ebp - 0x2c]
+mov dword [ebp - 0x28], eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0x10
+mov ebx, eax
+mov eax, dword [ebp + 8]
+lea eax, [eax + esi*8]
+cmp byte [eax], 0
+mov dword [ebp - 0x24], eax
+jne short loc_00013650 ; jne 0x13650
+push edi
+push edi
+push 0
+lea eax, [ebx + 0x10]
+add ebx, 4
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+pop edx
+push 0
+push ebx
+jmp near loc_000137af ; jmp 0x137af
+
+loc_00013650:
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0x13], 1
+jne short loc_0001366c ; jne 0x1366c
+push esi
+push esi
+push 0xfffc
+lea eax, [ebx + 0x78]
+push eax
+call fcn_00018954 ; call 0x18954
+add esp, 0x10
+
+loc_0001366c:
+sub esp, 0xc
+lea edi, [ebx + 0x10]
+push edi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test eax, eax
+jne short loc_000136af ; jne 0x136af
+sub esp, 0xc
+lea eax, [ebx + 4]
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test al, 2
+jne short loc_000136af ; jne 0x136af
+push ecx
+push ecx
+push dword [ebp + 0xc]
+push edi
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+mov esi, dword [ebp + 0xc]
+mov byte [ebp - 0x1a], 0
+mov word [ebp - 0x1c], 0
+jmp short loc_000136d0 ; jmp 0x136d0
+
+loc_000136af:
+sub esp, 0xc
+push edi
+call fcn_00017e4e ; call 0x17e4e
+mov esi, eax
+lea eax, [ebx + 4]
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+mov byte [ebp - 0x1a], 1
+mov word [ebp - 0x1c], ax
+
+loc_000136d0:
+push edx
+push edx
+lea eax, [ebx + 4]
+push 6
+push eax
+mov dword [ebp - 0x20], eax
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+cmp byte [ebp - 0x1a], 0
+jne short loc_000136f9 ; jne 0x136f9
+push eax
+push eax
+push 2
+lea eax, [esi + 0x20]
+push eax
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+
+loc_000136f9:
+push eax
+push eax
+push 1
+lea edx, [ebx + 0x80]
+push edx
+mov dword [ebp - 0x34], edx
+call fcn_00018927 ; call 0x18927
+lea ecx, [esi + 4]
+push 0
+push 0xf
+push 0xc
+push ecx
+mov dword [ebp - 0x30], ecx
+call fcn_00018bc6 ; call 0x18bc6
+mov eax, dword [ebp - 0x24]
+add esp, 0x20
+mov ecx, dword [ebp - 0x30]
+cmp byte [eax + 1], 1
+sbb eax, eax
+add eax, 3
+movzx eax, al
+push eax
+push 3
+push 0
+push ecx
+call fcn_00018bc6 ; call 0x18bc6
+pop eax
+pop edx
+mov edx, dword [ebp - 0x34]
+push 0xfffe
+push edx
+call fcn_00018954 ; call 0x18954
+lea edx, [ebx + 0x78]
+mov dword [esp], edx
+mov dword [ebp - 0x24], edx
+call fcn_00017e4e ; call 0x17e4e
+pop ecx
+pop edx
+mov edx, dword [ebp - 0x24]
+or eax, 4
+push eax
+push edx
+call fcn_00017e8f ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [ebx + 0x7c]
+add ebx, 0x8c
+push 0x4080
+push eax
+call fcn_00018b14 ; call 0x18b14
+mov dword [esp], ebx
+call fcn_00017e4e ; call 0x17e4e
+pop edx
+pop ecx
+and eax, 0xfbfff4ff
+or eax, 0x20400
+push eax
+push ebx
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+cmp byte [ebp - 0x1a], 0
+je short loc_000137b6 ; je 0x137b6
+movzx eax, word [ebp - 0x1c]
+push esi
+push esi
+push eax
+push dword [ebp - 0x20]
+
+loc_000137af:
+call fcn_00017e04 ; call 0x17e04
+jmp short loc_000137e9 ; jmp 0x137e9
+
+loc_000137b6:
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0xb5], 0
+je short loc_000137d0 ; je 0x137d0
+push ebx
+push ebx
+push esi
+push dword [ebp - 0x28]
+call fcn_000134e5 ; call 0x134e5
+add esp, 0x10
+
+loc_000137d0:
+push eax
+push eax
+push 0xfff9
+push dword [ebp - 0x20]
+call fcn_00018954 ; call 0x18954
+pop edx
+pop ecx
+push 0
+push edi
+call fcn_00017e8f ; call 0x17e8f
+
+loc_000137e9:
+add esp, 0x10
+inc byte [ebp - 0x19]
+jmp near loc_000135f3 ; jmp 0x135f3
+
+loc_000137f4:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000137fe:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov ecx, dword [ebp + 0x10]
+mov eax, dword [ebp + 8]
+mov ebx, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x18]
+mov dword [ebp - 0x24], ecx
+mov dword [ebp - 0x20], eax
+call fcn_0001bfbb ; call 0x1bfbb
+mov esi, eax
+call fcn_0001c0bd ; call 0x1c0bd
+mov dword [ebp - 0x1c], eax
+call fcn_0001bbfd ; call 0x1bbfd
+mov eax, dword [ebp - 0x20]
+cmp byte [eax + 0x10], 0
+je near loc_00013c36 ; je 0x13c36
+cmp esi, 1
+jne short loc_0001386c ; jne 0x1386c
+sub esp, 0xc
+lea eax, [edi + 0xe0]
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov edx, 0x15000000
+and eax, 0x18
+sub eax, 8
+cmp eax, 0x10
+ja short loc_00013868 ; ja 0x13868
+mov edx, dword [eax*4 + ref_0002046c] ; mov edx, dword [eax*4 + 0x2046c]
+
+loc_00013868:
+push eax
+push edx
+jmp short loc_00013878 ; jmp 0x13878
+
+loc_0001386c:
+cmp dword [ebp - 0x1c], 2
+jne short loc_00013889 ; jne 0x13889
+push ecx
+push 0xf000000
+
+loc_00013878:
+push 0xffffff
+lea eax, [ebx + 4]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_00013889:
+push eax
+push eax
+push 0xc401
+lea eax, [edi + 0x44]
+push eax
+call fcn_00018927 ; call 0x18927
+pop eax
+pop edx
+lea eax, [edi + 0x46]
+push 0xf
+push eax
+call fcn_00018730 ; call 0x18730
+add esp, 0xc
+mov edx, 0xe0000000
+cmp esi, 1
+mov eax, 0xf8000000
+cmovne eax, edx
+mov ecx, 0xfce2e5f
+mov edx, 0x7886e9f
+cmovne edx, ecx
+push edx
+push eax
+lea eax, [edi + 0x50]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0xc
+push 0x200000a
+push 0xff00
+lea eax, [ebx + 0xc]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0xc
+push 0x600
+push 0xffffffffffffffdf
+lea eax, [ebx + 0x10]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+cmp esi, 2
+jne short loc_00013946 ; jne 0x13946
+cmp dword [ebp - 0x1c], 1
+jne short loc_00013921 ; jne 0x13921
+push eax
+add edi, 0xb0
+push 0x20000
+push 0xffff9fff
+push edi
+call fcn_00018b68 ; call 0x18b68
+jmp short loc_0001393e ; jmp 0x1393e
+
+loc_00013921:
+cmp dword [ebp - 0x1c], 2
+jne near loc_00013a5a ; jne 0x13a5a
+push eax
+add edi, 0xa8
+push eax
+push 0x22000
+push edi
+call fcn_00018b14 ; call 0x18b14
+
+loc_0001393e:
+add esp, 0x10
+jmp near loc_00013a5a ; jmp 0x13a5a
+
+loc_00013946:
+cmp esi, 1
+jne short loc_0001397a ; jne 0x1397a
+push eax
+push eax
+push 0xfff7ffff
+lea eax, [ebx + 0x8008]
+push eax
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0xc
+push 0x110000
+
+loc_00013966:
+push 0xfffffeff
+lea eax, [ebx + 0x8058]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_0001397a:
+push ecx
+push ecx
+push 0x2040000
+lea eax, [ebx + 0x8060]
+push eax
+call fcn_00018b14 ; call 0x18b14
+pop edi
+pop eax
+lea eax, [ebx + 0x8090]
+push 0x4100
+push eax
+call fcn_00018b14 ; call 0x18b14
+pop eax
+pop edx
+lea eax, [ebx + 0x8094]
+push 0xa04000
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0xc
+push 0x40
+push 0xfffeffff
+lea eax, [ebx + 0x80e0]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0xc
+push 0xc00
+push 0xffff8dff
+lea eax, [ebx + 0x80ec]
+push eax
+call fcn_00018b68 ; call 0x18b68
+lea eax, [ebx + 0x80f0]
+pop ecx
+pop edi
+push 0xffefffff
+push eax
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+cmp esi, 2
+jne short loc_00013a65 ; jne 0x13a65
+push edi
+push edi
+push 0x2000000
+lea eax, [ebx + 0x80fc]
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0xc
+push 0x100800
+push 0xfffffefb
+lea eax, [ebx + 0x8110]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0xc
+push 0xff00f03c
+push 0
+lea eax, [ebx + 0x8140]
+push eax
+call fcn_00018b68 ; call 0x18b68
+pop eax
+pop edx
+lea eax, [ebx + 0x8144]
+push 0x1c0
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+jmp near loc_00013c27 ; jmp 0x13c27
+
+loc_00013a5a:
+push eax
+push 0x10000
+jmp near loc_00013966 ; jmp 0x13966
+
+loc_00013a65:
+cmp esi, 1
+jne near loc_00013c27 ; jne 0x13c27
+push ecx
+xor edi, edi
+push 0x100800
+push 0xfffffffffffffffb
+lea eax, [ebx + 0x8110]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0xc
+push 0xff03c132
+push 0
+lea eax, [ebx + 0x8140]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0xc
+push 0x100
+push 0xffffff3f
+lea eax, [ebx + 0x8144]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+mov eax, 0x202000
+
+loc_00013abb:
+push ecx
+not eax
+push edi
+push eax
+lea edx, [ebx + 0x8154]
+push edx
+mov dword [ebp - 0x28], edx
+call fcn_00018b68 ; call 0x18b68
+pop eax
+pop edx
+mov edx, dword [ebp - 0x28]
+push 0xfffffffffffffff7
+push edx
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+cmp esi, 2
+jne near loc_00013b80 ; jne 0x13b80
+push ecx
+push ecx
+push 3
+lea eax, [ebx + 0x8164]
+push eax
+call fcn_00018b14 ; call 0x18b14
+mov eax, dword [ebp - 0x1c]
+add esp, 0x10
+cmp eax, 1
+je short loc_00013b10 ; je 0x13b10
+cmp eax, 2
+mov eax, 0xe403f
+cmove edi, eax
+jmp short loc_00013b15 ; jmp 0x13b15
+
+loc_00013b10:
+mov edi, 0xe0038
+
+loc_00013b15:
+push eax
+push edi
+push 0xfff00000
+lea eax, [ebx + 0x816c]
+push eax
+call fcn_00018b68 ; call 0x18b68
+pop eax
+pop edx
+lea eax, [ebx + 0x8174]
+push 0x1400c0a
+push eax
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0xc
+push 0x33200a3
+push 0
+lea eax, [ebx + 0x817c]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0xc
+push 0xcb0028
+push 0
+lea eax, [ebx + 0x8180]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0xc
+push 0x64001e
+push 0
+lea eax, [ebx + 0x8184]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_00013b80:
+cmp esi, 2
+sete dl
+cmp dword [ebp - 0x1c], 1
+jne short loc_00013b95 ; jne 0x13b95
+mov eax, 0x5000000
+test dl, dl
+jne short loc_00013ba6 ; jne 0x13ba6
+
+loc_00013b95:
+cmp dword [ebp - 0x1c], 2
+mov eax, 0x1000000
+mov ecx, 0x5000000
+cmove eax, ecx
+
+loc_00013ba6:
+push ecx
+push ecx
+push eax
+lea eax, [ebx + 0x8188]
+push eax
+mov dword [ebp - 0x28], edx
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+cmp dword [ebp - 0x1c], 2
+jne short loc_00013c36 ; jne 0x13c36
+mov edx, dword [ebp - 0x28]
+test dl, dl
+je short loc_00013c36 ; je 0x13c36
+cmp byte [ebp - 0x24], 7
+jbe short loc_00013c36 ; jbe 0x13c36
+push edx
+push 2
+push 0xfffffffffffffff9
+lea eax, [ebx + 0x8098]
+push eax
+call fcn_00018b68 ; call 0x18b68
+mov ecx, dword [ebp - 0x20]
+add esp, 0xc
+mov edx, 0x1737d
+mov eax, 0x3737d
+cmp byte [ecx + 0x28], 1
+cmove eax, edx
+push eax
+push 0xfffd8000
+lea eax, [ebx + 0x8198]
+add ebx, 0x819c
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], 0xfffffff0
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018b3e ; jmp 0x18b3e
+
+loc_00013c27:
+mov eax, 0x200000
+mov edi, 0x2000
+jmp near loc_00013abb ; jmp 0x13abb
+
+loc_00013c36:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00013c3e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+call fcn_0001bfbb ; call 0x1bfbb
+mov esi, eax
+call fcn_0001c0bd ; call 0x1c0bd
+mov edi, eax
+call fcn_0001bbfd ; call 0x1bbfd
+mov eax, dword [ebp + 8]
+push ebx
+push 0
+push 0x14
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+push 0xc0
+push 0xffffffffffffffff
+push 0xe5004001
+push dword [ebp + 0xc]
+mov ebx, eax
+call fcn_00009dc2 ; call 0x9dc2
+add esp, 0x14
+lea edx, [ebx + 0x40]
+push edx
+mov dword [ebp - 0x20], edx
+call fcn_00017e4e ; call 0x17e4e
+pop edx
+mov edx, dword [ebp - 0x20]
+mov ecx, eax
+movzx eax, ax
+and ecx, 0xff7fffff
+or ah, 1
+mov dword [ebp - 0x1c], ecx
+pop ecx
+push eax
+push edx
+call fcn_00017e04 ; call 0x17e04
+pop eax
+mov eax, dword [ebp - 0x1c]
+pop edx
+or eax, 0x360100
+shr eax, 0x10
+movzx eax, al
+push eax
+lea eax, [ebx + 0x42]
+push eax
+call fcn_00017da5 ; call 0x17da5
+pop ecx
+pop eax
+lea eax, [ebx + 0x44]
+push 0x288
+push eax
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+cmp esi, 1
+je short loc_00013cfc ; je 0x13cfc
+mov eax, 0xc0
+cmp esi, 2
+jne short loc_00013d01 ; jne 0x13d01
+mov eax, 0x40040
+cmp edi, 2
+mov edx, 0x40000
+cmovne eax, edx
+jmp short loc_00013d01 ; jmp 0x13d01
+
+loc_00013cfc:
+mov eax, 0x40
+
+loc_00013d01:
+push ecx
+push ecx
+push eax
+lea eax, [ebx + 0xa0]
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+cmp edi, 2
+jne short loc_00013d22 ; jne 0x13d22
+mov eax, 0x1800
+cmp esi, 2
+je short loc_00013d24 ; je 0x13d24
+
+loc_00013d22:
+xor eax, eax
+
+loc_00013d24:
+push edx
+add ebx, 0xa4
+push eax
+push 0xffffdfff
+push ebx
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00013d42:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov edx, dword [ebp + 0xc]
+mov esi, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0x18]
+mov dword [ebp - 0x1c], edx
+call fcn_0001bfbb ; call 0x1bfbb
+mov edi, eax
+call fcn_0001c0bd ; call 0x1c0bd
+mov edx, dword [ebp - 0x1c]
+cmp eax, 1
+sete cl
+cmp edi, 1
+jne near loc_00013e6d ; jne 0x13e6d
+test cl, cl
+je near loc_00013e6d ; je 0x13e6d
+mov eax, dword [ebp + 8]
+sub esp, 0xc
+lea edi, [eax + 0xe0]
+push edi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov edx, dword [ebp - 0x1c]
+and eax, 6
+cmp eax, 4
+je short loc_00013dbd ; je 0x13dbd
+cmp eax, 6
+je short loc_00013db2 ; je 0x13db2
+cmp eax, 2
+jne short loc_00013dc8 ; jne 0x13dc8
+mov byte [edx], 0xc
+mov dword [ebx], 0x3f3f
+jmp short loc_00013dd1 ; jmp 0x13dd1
+
+loc_00013db2:
+mov byte [edx], 8
+mov dword [ebx], 0xf0f
+jmp short loc_00013dd1 ; jmp 0x13dd1
+
+loc_00013dbd:
+mov byte [edx], 0xa
+mov dword [ebx], 0xf3f
+jmp short loc_00013dd1 ; jmp 0x13dd1
+
+loc_00013dc8:
+mov byte [edx], 0xe
+mov dword [ebx], 0x3fff
+
+loc_00013dd1:
+or dword [ebx], 0xf0
+sub esp, 0xc
+push edi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+and eax, 0x18
+cmp eax, 0x10
+je short loc_00013e17 ; je 0x13e17
+cmp eax, 0x18
+je short loc_00013e06 ; je 0x13e06
+cmp eax, 8
+jne short loc_00013e28 ; jne 0x13e28
+mov eax, dword [ebp + 0x14]
+mov byte [eax], 4
+mov eax, dword [ebp + 0x1c]
+mov dword [eax], 0xf
+jmp short loc_00013e37 ; jmp 0x13e37
+
+loc_00013e06:
+mov eax, dword [ebp + 0x14]
+mov byte [eax], 0
+mov eax, dword [ebp + 0x1c]
+mov dword [eax], 0
+jmp short loc_00013e37 ; jmp 0x13e37
+
+loc_00013e17:
+mov eax, dword [ebp + 0x14]
+mov byte [eax], 2
+mov eax, dword [ebp + 0x1c]
+mov dword [eax], 3
+jmp short loc_00013e37 ; jmp 0x13e37
+
+loc_00013e28:
+mov eax, dword [ebp + 0x14]
+mov byte [eax], 6
+mov eax, dword [ebp + 0x1c]
+mov dword [eax], 0x3f
+
+loc_00013e37:
+sub esp, 0xc
+push edi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+and eax, 0x20
+je short loc_00013e5f ; je 0x13e5f
+cmp eax, 0x20
+jne near loc_00013f35 ; jne 0x13f35
+mov byte [esi], 0
+and dword [ebx], 0xffffbfff
+jmp near loc_00013f35 ; jmp 0x13f35
+
+loc_00013e5f:
+mov byte [esi], 1
+or dword [ebx], 0x4000
+jmp near loc_00013f35 ; jmp 0x13f35
+
+loc_00013e6d:
+cmp edi, 2
+jne short loc_00013ec7 ; jne 0x13ec7
+test cl, cl
+je short loc_00013ec7 ; je 0x13ec7
+mov eax, dword [ebp + 0x14]
+sub esp, 0xc
+mov byte [edx], 8
+mov dword [ebx], 0xff
+mov byte [eax], 4
+mov eax, dword [ebp + 0x1c]
+mov dword [eax], 0xf
+mov eax, dword [ebp + 8]
+lea edi, [eax + 0xe0]
+push edi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+and eax, 0x20
+je short loc_00013ebc ; je 0x13ebc
+cmp eax, 0x20
+jne near loc_00013f35 ; jne 0x13f35
+mov byte [esi], 0
+and dword [ebx], 0xfffffeff
+jmp short loc_00013f35 ; jmp 0x13f35
+
+loc_00013ebc:
+mov byte [esi], 1
+or dword [ebx], 0x100
+jmp short loc_00013f35 ; jmp 0x13f35
+
+loc_00013ec7:
+cmp eax, 2
+jne short loc_00013f35 ; jne 0x13f35
+mov eax, dword [ebp + 8]
+sub esp, 0xc
+mov dword [ebp - 0x1c], edx
+lea edi, [eax + 0xe0]
+push edi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov edx, dword [ebp - 0x1c]
+test al, 2
+je short loc_00013ef9 ; je 0x13ef9
+mov byte [edx], 8
+mov dword [ebx], 0xff
+mov byte [esi], 0
+jmp short loc_00013f26 ; jmp 0x13f26
+
+loc_00013ef9:
+sub esp, 0xc
+mov byte [edx], 0xa
+mov dword [ebx], 0xff
+push edi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test al, 0x20
+jne short loc_00013f1d ; jne 0x13f1d
+mov byte [esi], 1
+or dword [ebx], 0x400
+jmp short loc_00013f26 ; jmp 0x13f26
+
+loc_00013f1d:
+mov byte [esi], 0
+and dword [ebx], 0xfffffbff
+
+loc_00013f26:
+mov eax, dword [ebp + 0x14]
+mov byte [eax], 4
+mov eax, dword [ebp + 0x1c]
+mov dword [eax], 0xf
+
+loc_00013f35:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00013f3d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x3c
+call fcn_0001c0bd ; call 0x1c0bd
+mov ebx, eax
+call fcn_0001bfbb ; call 0x1bfbb
+cmp ebx, 1
+jne short loc_00013f76 ; jne 0x13f76
+cmp eax, 2
+je short loc_00013f92 ; je 0x13f92
+mov ecx, ref_000273cc ; mov ecx, 0x273cc
+xor edx, edx
+mov edi, ecx
+dec eax
+mov eax, ref_00027408 ; mov eax, 0x27408
+cmovne edi, edx
+cmove edx, eax
+mov dword [ebp - 0x34], edx
+jmp short loc_00013f9e ; jmp 0x13f9e
+
+loc_00013f76:
+mov edx, ref_00027380 ; mov edx, 0x27380
+xor eax, eax
+mov edi, edx
+cmp ebx, 2
+mov edx, ref_00027390 ; mov edx, 0x27390
+cmovne edi, eax
+cmove eax, edx
+mov dword [ebp - 0x34], eax
+jmp short loc_00013f9e ; jmp 0x13f9e
+
+loc_00013f92:
+mov edi, ref_000273bc ; mov edi, 0x273bc
+mov dword [ebp - 0x34], ref_000273e4 ; mov dword [ebp - 0x34], 0x273e4
+
+loc_00013f9e:
+test edi, edi
+je short loc_00013fa8 ; je 0x13fa8
+cmp dword [ebp - 0x34], 0
+jne short loc_00013fd2 ; jne 0x13fd2
+
+loc_00013fa8:
+call fcn_00015480 ; call 0x15480
+test al, al
+je near loc_0001489b ; je 0x1489b
+push eax
+push ref_00022281 ; push 0x22281
+push 0x601
+push ref_0002531e ; push 0x2531e
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+jmp near loc_0001489b ; jmp 0x1489b
+
+loc_00013fd2:
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0x10], 0
+je near loc_0001489b ; je 0x1489b
+push eax
+push eax
+lea eax, [ebp - 0x20]
+push eax
+lea eax, [ebp - 0x24]
+push eax
+lea eax, [ebp - 0x25]
+push eax
+lea eax, [ebp - 0x26]
+push eax
+lea eax, [ebp - 0x27]
+push eax
+push dword [ebp + 0x18]
+call fcn_00013d42 ; call 0x13d42
+mov eax, dword [ebp + 0xc]
+add esp, 0x14
+add eax, 0x10
+push eax
+call fcn_00017e4e ; call 0x17e4e
+mov ecx, dword [ebp + 0xc]
+shr eax, 0x10
+lea ebx, [ecx + eax*4]
+mov dword [esp], ebx
+call fcn_00017e4e ; call 0x17e4e
+mov esi, eax
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_0001403f ; je 0x1403f
+push eax
+push ebx
+push ref_0002534c ; push 0x2534c
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+
+loc_0001403c:
+add esp, 0x10
+
+loc_0001403f:
+mov eax, esi
+cmp al, 0xa
+jne short loc_000140c3 ; jne 0x140c3
+sub esp, 0xc
+lea eax, [ebx + 0x20]
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test al, 1
+je near loc_000140df ; je 0x140df
+sub esp, 0xc
+add ebx, 0x24
+push ebx
+call fcn_00017e4e ; call 0x17e4e
+movzx edx, byte [ebp - 0x25]
+add esp, 0x10
+mov dword [ebp - 0x2c], 0
+shr eax, 0x18
+add eax, 0x47
+shl eax, 4
+
+loc_0001407f:
+cmp dword [ebp - 0x2c], edx
+jae short loc_000140b6 ; jae 0x140b6
+mov ecx, dword [ebp - 0x2c]
+cmp eax, dword [edi + ecx*4]
+jne short loc_000140b1 ; jne 0x140b1
+call fcn_00015479 ; call 0x15479
+mov byte [ebp - 0x2d], 1
+test al, al
+je short loc_000140ea ; je 0x140ea
+push esi
+push dword [ebp - 0x2c]
+push ref_00025379 ; push 0x25379
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp short loc_000140ea ; jmp 0x140ea
+
+loc_000140b1:
+inc dword [ebp - 0x2c]
+jmp short loc_0001407f ; jmp 0x1407f
+
+loc_000140b6:
+mov dword [ebp - 0x2c], 0xffffffff
+mov byte [ebp - 0x2d], 1
+jmp short loc_000140ea ; jmp 0x140ea
+
+loc_000140c3:
+mov eax, esi
+movzx esi, ah
+test esi, esi
+je short loc_000140df ; je 0x140df
+lea ebx, [ebx + esi*4]
+sub esp, 0xc
+push ebx
+call fcn_00017e4e ; call 0x17e4e
+mov esi, eax
+jmp near loc_0001403c ; jmp 0x1403c
+
+loc_000140df:
+mov dword [ebp - 0x2c], 0xffffffff
+mov byte [ebp - 0x2d], 0
+
+loc_000140ea:
+mov eax, dword [ebp + 0x18]
+push ebx
+push dword [ebp - 0x24]
+add eax, 0xd4
+mov dword [ebp - 0x38], eax
+push 0xffff8000
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0xc
+mov eax, dword [ebp + 0x18]
+push dword [ebp - 0x20]
+add eax, 0xdc
+push 0xffffffffffffffc0
+push eax
+mov dword [ebp - 0x3c], eax
+call fcn_00018b68 ; call 0x18b68
+lea eax, [ebp - 0x1c]
+mov dword [esp], eax
+call fcn_00019797 ; call 0x19797
+add esp, 0x10
+cmp dword [ebp - 0x1c], 0x11
+je near loc_0001489b ; je 0x1489b
+mov eax, dword [ebp + 0x1c]
+sub esp, 0xc
+add eax, 0xa2
+push eax
+mov dword [ebp - 0x40], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test al, 0x20
+je short loc_000141c8 ; je 0x141c8
+mov eax, dword [ebp + 0x1c]
+sub esp, 0xc
+add eax, 0xac
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test eax, 0x10000
+je short loc_000141c8 ; je 0x141c8
+sub esp, 0xc
+push dword [ebp - 0x3c]
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+and eax, 0x3f
+cmp byte [ebp - 0x2d], 0
+je short loc_0001418e ; je 0x1418e
+mov cl, byte [ebp - 0x2c]
+mov edx, 1
+shl edx, cl
+or eax, edx
+
+loc_0001418e:
+push edx
+push eax
+mov eax, dword [ebp + 0x18]
+push 0xffffffffffffffc0
+add eax, 0xd8
+push eax
+call fcn_00018b68 ; call 0x18b68
+pop ecx
+push dword [ebp - 0x38]
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0xc
+and eax, 0x7fff
+push eax
+mov eax, dword [ebp + 0x18]
+push 0xffff8000
+add eax, 0xd0
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_000141c8:
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0xb5], 0
+jne short loc_000141ec ; jne 0x141ec
+push eax
+push eax
+mov eax, dword [ebp + 0x1c]
+push 0xfffeffff
+add eax, 0xac
+push eax
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+
+loc_000141ec:
+mov eax, dword [ebp + 8]
+mov esi, 1
+mov al, byte [eax + 0x11]
+test al, al
+je near loc_000142d0 ; je 0x142d0
+xor esi, esi
+dec al
+jne near loc_000142d0 ; jne 0x142d0
+mov eax, dword [ebp + 8]
+mov al, byte [eax + 0x10]
+cmp al, 2
+sete cl
+dec al
+mov esi, ecx
+jne near loc_000142d0 ; jne 0x142d0
+sub esp, 0xc
+push dword [ebp - 0x40]
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test al, 0x20
+jne short loc_0001423a ; jne 0x1423a
+
+loc_00014230:
+mov esi, 2
+jmp near loc_000142d0 ; jmp 0x142d0
+
+loc_0001423a:
+mov bl, byte [ebp - 0x2d]
+xor esi, esi
+and ebx, 1
+
+loc_00014242:
+movzx eax, byte [ebp - 0x25]
+cmp esi, eax
+jae short loc_0001426d ; jae 0x1426d
+cmp esi, dword [ebp - 0x2c]
+jne short loc_00014253 ; jne 0x14253
+test bl, bl
+jne short loc_0001426a ; jne 0x1426a
+
+loc_00014253:
+push eax
+mov eax, dword [ebp + 0xc]
+push 0x80000000
+push 0xfffffffffffffffd
+add eax, dword [edi + esi*4]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_0001426a:
+inc esi
+jmp short loc_00014242 ; jmp 0x14242
+
+loc_0001426d:
+mov al, byte [ebp - 0x2d]
+mov ebx, 0xa
+and eax, 1
+mov byte [ebp - 0x2e], al
+
+loc_0001427b:
+xor esi, esi
+xor edx, edx
+
+loc_0001427f:
+movzx eax, byte [ebp - 0x25]
+cmp edx, eax
+jae short loc_000142af ; jae 0x142af
+cmp edx, dword [ebp - 0x2c]
+jne short loc_00014292 ; jne 0x14292
+cmp byte [ebp - 0x2e], 0
+jne short loc_000142ac ; jne 0x142ac
+
+loc_00014292:
+mov eax, dword [ebp + 0xc]
+sub esp, 0xc
+add eax, dword [edi + edx*4]
+mov dword [ebp - 0x44], edx
+push eax
+call fcn_00017e4e ; call 0x17e4e
+mov edx, dword [ebp - 0x44]
+add esp, 0x10
+or esi, eax
+
+loc_000142ac:
+inc edx
+jmp short loc_0001427f ; jmp 0x1427f
+
+loc_000142af:
+sub esp, 0xc
+push 0x2710
+call fcn_0001bb03 ; call 0x1bb03
+add esp, 0x10
+and esi, 0x10
+je near loc_00014230 ; je 0x14230
+dec ebx
+jne short loc_0001427b ; jne 0x1427b
+jmp near loc_00014230 ; jmp 0x14230
+
+loc_000142d0:
+cmp byte [ebp - 0x25], 0
+je near loc_00014506 ; je 0x14506
+mov eax, esi
+dec al
+jne near loc_00014506 ; jne 0x14506
+mov eax, dword [ebp + 0x18]
+sub esp, 0xc
+lea ebx, [eax + 0xd0]
+push ebx
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test eax, eax
+je short loc_00014301 ; je 0x14301
+
+loc_000142fd:
+xor esi, esi
+jmp short loc_0001434f ; jmp 0x1434f
+
+loc_00014301:
+mov eax, dword [ebp + 0x18]
+sub esp, 0xc
+add eax, 0xd8
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test eax, eax
+jne short loc_000142fd ; jne 0x142fd
+jmp near loc_00014506 ; jmp 0x14506
+
+loc_0001431e:
+mov ecx, dword [ebp - 0x34]
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+add eax, dword [ecx + esi*4]
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test al, 1
+je short loc_0001434e ; je 0x1434e
+mov ecx, dword [ebp - 0x34]
+push eax
+mov eax, dword [ebp + 0xc]
+push 0x10
+push 0xfffffffffffffffd
+add eax, dword [ecx + esi*4]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_0001434e:
+inc esi
+
+loc_0001434f:
+movzx eax, byte [ebp - 0x27]
+cmp esi, eax
+jb short loc_0001431e ; jb 0x1431e
+mov dword [ebp - 0x38], 0xa
+
+loc_0001435e:
+xor esi, esi
+xor edx, edx
+
+loc_00014362:
+movzx eax, byte [ebp - 0x27]
+cmp edx, eax
+jae short loc_0001438a ; jae 0x1438a
+mov ecx, dword [ebp - 0x34]
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x3c], edx
+add eax, dword [ecx + edx*4]
+push eax
+call fcn_00017e4e ; call 0x17e4e
+mov edx, dword [ebp - 0x3c]
+add esp, 0x10
+inc edx
+or esi, eax
+jmp short loc_00014362 ; jmp 0x14362
+
+loc_0001438a:
+sub esp, 0xc
+push 0x2710
+call fcn_0001bb03 ; call 0x1bb03
+add esp, 0x10
+and esi, 0x10
+je short loc_000143a4 ; je 0x143a4
+dec dword [ebp - 0x38]
+jne short loc_0001435e ; jne 0x1435e
+
+loc_000143a4:
+push esi
+push esi
+push 0xffff8000
+push ebx
+xor ebx, ebx
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+
+loc_000143b6:
+movzx eax, byte [ebp - 0x27]
+cmp ebx, eax
+jae short loc_000143db ; jae 0x143db
+push ecx
+mov ecx, dword [ebp - 0x34]
+push 0xfe0000
+mov eax, dword [ebp + 0xc]
+push 0xfffffffffffffffd
+add eax, dword [ecx + ebx*4]
+inc ebx
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+jmp short loc_000143b6 ; jmp 0x143b6
+
+loc_000143db:
+cmp byte [ebp - 0x26], 0
+je short loc_000143fb ; je 0x143fb
+push edx
+mov edx, dword [ebp - 0x34]
+push 0xfe0000
+mov ecx, dword [ebp + 0xc]
+push 0xfffffffffffffffd
+add ecx, dword [edx + eax*4]
+push ecx
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_000143fb:
+mov bl, byte [ebp - 0x2d]
+xor esi, esi
+and ebx, 1
+
+loc_00014403:
+movzx eax, byte [ebp - 0x25]
+cmp esi, eax
+jae short loc_0001442e ; jae 0x1442e
+cmp esi, dword [ebp - 0x2c]
+jne short loc_00014414 ; jne 0x14414
+test bl, bl
+jne short loc_0001442b ; jne 0x1442b
+
+loc_00014414:
+push eax
+mov eax, dword [ebp + 0xc]
+push 0x80000000
+push 0xfffffffffffffffd
+add eax, dword [edi + esi*4]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_0001442b:
+inc esi
+jmp short loc_00014403 ; jmp 0x14403
+
+loc_0001442e:
+cmp byte [ebp - 0x2d], 0
+mov eax, 0xffffffc0
+je short loc_00014446 ; je 0x14446
+mov cl, byte [ebp - 0x2c]
+mov eax, 1
+shl eax, cl
+or eax, 0xffffffc0
+
+loc_00014446:
+push ebx
+push ebx
+mov ebx, 0xa
+push eax
+mov eax, dword [ebp + 0x18]
+add eax, 0xd8
+push eax
+call fcn_00018b3e ; call 0x18b3e
+mov al, byte [ebp - 0x2d]
+add esp, 0x10
+and eax, 1
+mov byte [ebp - 0x38], al
+
+loc_00014468:
+xor esi, esi
+xor edx, edx
+
+loc_0001446c:
+movzx eax, byte [ebp - 0x25]
+cmp edx, eax
+jae short loc_0001449c ; jae 0x1449c
+cmp edx, dword [ebp - 0x2c]
+jne short loc_0001447f ; jne 0x1447f
+cmp byte [ebp - 0x38], 0
+jne short loc_00014499 ; jne 0x14499
+
+loc_0001447f:
+mov eax, dword [ebp + 0xc]
+sub esp, 0xc
+add eax, dword [edi + edx*4]
+mov dword [ebp - 0x3c], edx
+push eax
+call fcn_00017e4e ; call 0x17e4e
+mov edx, dword [ebp - 0x3c]
+add esp, 0x10
+or esi, eax
+
+loc_00014499:
+inc edx
+jmp short loc_0001446c ; jmp 0x1446c
+
+loc_0001449c:
+sub esp, 0xc
+push 0x2710
+call fcn_0001bb03 ; call 0x1bb03
+add esp, 0x10
+and esi, 0x10
+je short loc_000144b4 ; je 0x144b4
+dec ebx
+jne short loc_00014468 ; jne 0x14468
+
+loc_000144b4:
+mov bl, byte [ebp - 0x2d]
+xor esi, esi
+and ebx, 1
+
+loc_000144bc:
+movzx eax, byte [ebp - 0x25]
+cmp esi, eax
+jae short loc_000144e7 ; jae 0x144e7
+cmp esi, dword [ebp - 0x2c]
+jne short loc_000144cd ; jne 0x144cd
+test bl, bl
+jne short loc_000144e4 ; jne 0x144e4
+
+loc_000144cd:
+push ecx
+mov eax, dword [ebp + 0xc]
+push 0xfe0000
+push 0xfffffffffffffffd
+add eax, dword [edi + esi*4]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_000144e4:
+inc esi
+jmp short loc_000144bc ; jmp 0x144bc
+
+loc_000144e7:
+mov eax, dword [ebp + 0xc]
+push esi
+push esi
+push 1
+lea ebx, [eax + 0x80]
+push ebx
+call fcn_00018b14 ; call 0x18b14
+pop eax
+pop edx
+push 0xfffffffffffffffe
+push ebx
+call fcn_00018b3e ; call 0x18b3e
+jmp short loc_00014570 ; jmp 0x14570
+
+loc_00014506:
+cmp byte [ebp - 0x25], 0
+je near loc_0001461f ; je 0x1461f
+mov eax, esi
+cmp al, 2
+jne short loc_00014578 ; jne 0x14578
+sub esp, 0xc
+push dword [ebp - 0x3c]
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+and eax, 0x3f
+cmp byte [ebp - 0x2d], 0
+je short loc_00014539 ; je 0x14539
+mov cl, byte [ebp - 0x2c]
+mov edx, 1
+shl edx, cl
+or eax, edx
+
+loc_00014539:
+push edx
+push eax
+mov eax, dword [ebp + 0x18]
+push 0xffffffffffffffc0
+add eax, 0xd8
+push eax
+call fcn_00018b68 ; call 0x18b68
+pop ecx
+push dword [ebp - 0x38]
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0xc
+and eax, 0x7fff
+push eax
+mov eax, dword [ebp + 0x18]
+push 0xffff8000
+add eax, 0xd0
+push eax
+call fcn_00018b68 ; call 0x18b68
+
+loc_00014570:
+add esp, 0x10
+jmp near loc_0001461f ; jmp 0x1461f
+
+loc_00014578:
+sub esp, 0xc
+push dword [ebp - 0x40]
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+test al, 0x20
+je near loc_0001461f ; je 0x1461f
+mov bl, byte [ebp - 0x2d]
+xor esi, esi
+and ebx, 1
+
+loc_00014596:
+movzx eax, byte [ebp - 0x25]
+cmp esi, eax
+jae short loc_000145c1 ; jae 0x145c1
+cmp esi, dword [ebp - 0x2c]
+jne short loc_000145a7 ; jne 0x145a7
+test bl, bl
+jne short loc_000145be ; jne 0x145be
+
+loc_000145a7:
+push eax
+mov eax, dword [ebp + 0xc]
+push 0x80000000
+push 0xfffffffffffffffd
+add eax, dword [edi + esi*4]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_000145be:
+inc esi
+jmp short loc_00014596 ; jmp 0x14596
+
+loc_000145c1:
+mov al, byte [ebp - 0x2d]
+mov dword [ebp - 0x38], 0
+and eax, 1
+mov byte [ebp - 0x3c], al
+
+loc_000145d1:
+cmp esi, dword [ebp - 0x2c]
+jne short loc_000145de ; jne 0x145de
+xor ebx, ebx
+cmp byte [ebp - 0x3c], 0
+jne short loc_00014614 ; jne 0x14614
+
+loc_000145de:
+xor ebx, ebx
+xor esi, esi
+
+loc_000145e2:
+movzx eax, byte [ebp - 0x25]
+cmp esi, eax
+jae short loc_00014601 ; jae 0x14601
+mov eax, dword [ebp + 0xc]
+sub esp, 0xc
+add eax, dword [edi + esi*4]
+inc esi
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+or ebx, eax
+jmp short loc_000145e2 ; jmp 0x145e2
+
+loc_00014601:
+sub esp, 0xc
+push 0x2710
+call fcn_0001bb03 ; call 0x1bb03
+add esp, 0x10
+inc dword [ebp - 0x38]
+
+loc_00014614:
+and bl, 0x10
+je short loc_0001461f ; je 0x1461f
+cmp dword [ebp - 0x38], 9
+jbe short loc_000145d1 ; jbe 0x145d1
+
+loc_0001461f:
+mov eax, dword [ebp + 8]
+xor ebx, ebx
+cmp byte [eax + 0x13], 1
+jne near loc_0001485c ; jne 0x1485c
+
+loc_0001462e:
+movzx eax, byte [ebp - 0x27]
+cmp ebx, eax
+jae short loc_00014669 ; jae 0x14669
+mov ecx, dword [ebp - 0x34]
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+add eax, dword [ecx + ebx*4]
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test al, 1
+je short loc_00014666 ; je 0x14666
+push ecx
+mov ecx, dword [ebp - 0x34]
+push 0x10
+mov eax, dword [ebp + 0xc]
+push 0xfffffffffffffffd
+add eax, dword [ecx + ebx*4]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_00014666:
+inc ebx
+jmp short loc_0001462e ; jmp 0x1462e
+
+loc_00014669:
+mov ebx, 0xa
+
+loc_0001466e:
+xor esi, esi
+xor edx, edx
+
+loc_00014672:
+movzx eax, byte [ebp - 0x27]
+cmp edx, eax
+jae short loc_0001469a ; jae 0x1469a
+mov ecx, dword [ebp - 0x34]
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x38], edx
+add eax, dword [ecx + edx*4]
+push eax
+call fcn_00017e4e ; call 0x17e4e
+mov edx, dword [ebp - 0x38]
+add esp, 0x10
+inc edx
+or esi, eax
+jmp short loc_00014672 ; jmp 0x14672
+
+loc_0001469a:
+sub esp, 0xc
+push 0x2710
+call fcn_0001bb03 ; call 0x1bb03
+add esp, 0x10
+and esi, 0x10
+je short loc_000146b2 ; je 0x146b2
+dec ebx
+jne short loc_0001466e ; jne 0x1466e
+
+loc_000146b2:
+movzx edx, byte [ebp - 0x27]
+xor eax, eax
+xor ecx, ecx
+mov ebx, 1
+
+loc_000146bf:
+cmp ecx, edx
+jae short loc_000146d6 ; jae 0x146d6
+mov esi, dword [ebp + 8]
+cmp byte [esi + ecx + 0x14], 1
+jne short loc_000146d3 ; jne 0x146d3
+mov esi, ebx
+shl esi, cl
+or eax, esi
+
+loc_000146d3:
+inc ecx
+jmp short loc_000146bf ; jmp 0x146bf
+
+loc_000146d6:
+push edx
+xor ebx, ebx
+push eax
+mov eax, dword [ebp + 0x18]
+push 0xffff8000
+add eax, 0xd0
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_000146f0:
+movzx eax, byte [ebp - 0x27]
+cmp ebx, eax
+jae short loc_00014715 ; jae 0x14715
+mov ecx, dword [ebp - 0x34]
+push esi
+mov eax, dword [ebp + 0xc]
+push 0xfe0000
+push 0xfffffffffffffffd
+add eax, dword [ecx + ebx*4]
+inc ebx
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+jmp short loc_000146f0 ; jmp 0x146f0
+
+loc_00014715:
+cmp byte [ebp - 0x26], 0
+je short loc_00014735 ; je 0x14735
+mov edx, dword [ebp - 0x34]
+push ebx
+mov ecx, dword [ebp + 0xc]
+push 0xfe0000
+push 0xfffffffffffffffd
+add ecx, dword [edx + eax*4]
+push ecx
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_00014735:
+mov bl, byte [ebp - 0x2d]
+xor esi, esi
+and ebx, 1
+
+loc_0001473d:
+movzx edx, byte [ebp - 0x25]
+cmp esi, edx
+jae short loc_00014768 ; jae 0x14768
+cmp esi, dword [ebp - 0x2c]
+jne short loc_0001474e ; jne 0x1474e
+test bl, bl
+jne short loc_00014765 ; jne 0x14765
+
+loc_0001474e:
+push ecx
+mov eax, dword [ebp + 0xc]
+push 0x80000000
+push 0xfffffffffffffffd
+add eax, dword [edi + esi*4]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_00014765:
+inc esi
+jmp short loc_0001473d ; jmp 0x1473d
+
+loc_00014768:
+xor eax, eax
+xor ecx, ecx
+mov ebx, 1
+
+loc_00014771:
+cmp ecx, edx
+je short loc_00014788 ; je 0x14788
+mov esi, dword [ebp + 8]
+cmp byte [esi + ecx + 0x22], 1
+jne short loc_00014785 ; jne 0x14785
+mov esi, ebx
+shl esi, cl
+or eax, esi
+
+loc_00014785:
+inc ecx
+jmp short loc_00014771 ; jmp 0x14771
+
+loc_00014788:
+cmp byte [ebp - 0x2d], 0
+je short loc_0001479a ; je 0x1479a
+mov cl, byte [ebp - 0x2c]
+mov edx, 1
+shl edx, cl
+or eax, edx
+
+loc_0001479a:
+push edx
+mov ebx, 0xa
+push eax
+mov eax, dword [ebp + 0x18]
+push 0xffffffffffffffc0
+add eax, 0xd8
+push eax
+call fcn_00018b68 ; call 0x18b68
+mov al, byte [ebp - 0x2d]
+add esp, 0x10
+and eax, 1
+mov byte [ebp - 0x38], al
+
+loc_000147bd:
+xor esi, esi
+xor edx, edx
+
+loc_000147c1:
+movzx eax, byte [ebp - 0x25]
+cmp edx, eax
+jae short loc_000147f1 ; jae 0x147f1
+cmp edx, dword [ebp - 0x2c]
+jne short loc_000147d4 ; jne 0x147d4
+cmp byte [ebp - 0x38], 0
+jne short loc_000147ee ; jne 0x147ee
+
+loc_000147d4:
+mov eax, dword [ebp + 0xc]
+sub esp, 0xc
+add eax, dword [edi + edx*4]
+mov dword [ebp - 0x3c], edx
+push eax
+call fcn_00017e4e ; call 0x17e4e
+mov edx, dword [ebp - 0x3c]
+add esp, 0x10
+or esi, eax
+
+loc_000147ee:
+inc edx
+jmp short loc_000147c1 ; jmp 0x147c1
+
+loc_000147f1:
+sub esp, 0xc
+push 0x2710
+call fcn_0001bb03 ; call 0x1bb03
+add esp, 0x10
+and esi, 0x10
+je short loc_00014809 ; je 0x14809
+dec ebx
+jne short loc_000147bd ; jne 0x147bd
+
+loc_00014809:
+mov bl, byte [ebp - 0x2d]
+xor esi, esi
+and ebx, 1
+
+loc_00014811:
+movzx eax, byte [ebp - 0x25]
+cmp esi, eax
+jae short loc_0001483c ; jae 0x1483c
+cmp esi, dword [ebp - 0x2c]
+jne short loc_00014822 ; jne 0x14822
+test bl, bl
+jne short loc_00014839 ; jne 0x14839
+
+loc_00014822:
+push eax
+mov eax, dword [ebp + 0xc]
+push 0xfe0000
+push 0xfffffffffffffffd
+add eax, dword [edi + esi*4]
+push eax
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+
+loc_00014839:
+inc esi
+jmp short loc_00014811 ; jmp 0x14811
+
+loc_0001483c:
+mov eax, dword [ebp + 0xc]
+lea ebx, [eax + 0x80]
+push eax
+push eax
+push 1
+push ebx
+call fcn_00018b14 ; call 0x18b14
+pop edx
+pop ecx
+push 0xfffffffffffffffe
+push ebx
+call fcn_00018b3e ; call 0x18b3e
+add esp, 0x10
+
+loc_0001485c:
+mov eax, dword [ebp + 8]
+test byte [eax + 0x10], 0xfd
+je short loc_0001489b ; je 0x1489b
+cmp byte [eax + 0x11], 0
+je short loc_0001489b ; je 0x1489b
+cmp byte [eax + 0xb5], 0
+je short loc_0001489b ; je 0x1489b
+movzx eax, byte [ebp - 0x25]
+push eax
+movzx eax, byte [ebp - 0x27]
+push edi
+push eax
+mov eax, dword [ebp + 0x18]
+push dword [ebp - 0x34]
+push dword [ebp + 0xc]
+shr eax, 0x14
+movzx eax, al
+push 0
+push 0x14
+push eax
+call fcn_0001354a ; call 0x1354a
+add esp, 0x20
+
+loc_0001489b:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000148a3:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x44
+push 0x10
+lea eax, [ebp - 0x38]
+push eax
+call fcn_00016fff ; call 0x16fff
+pop eax
+pop edx
+lea eax, [ebp - 0x28]
+push 0x10
+push eax
+call fcn_00016fff ; call 0x16fff
+call fcn_0001bfbb ; call 0x1bfbb
+mov dword [ebp - 0x40], eax
+call fcn_0001c0bd ; call 0x1c0bd
+mov edx, dword [ebp + 8]
+add esp, 0x10
+cmp byte [edx + 0x10], 0
+je near loc_00014b50 ; je 0x14b50
+cmp eax, 1
+jne near loc_00014a1b ; jne 0x14a1b
+mov dword [ebp - 0x3c], 0
+xor edi, edi
+xor ebx, ebx
+
+loc_000148f5:
+call fcn_0001c261 ; call 0x1c261
+movzx eax, al
+cmp ebx, eax
+jae short loc_0001497a ; jae 0x1497a
+mov eax, dword [ebp + 8]
+movzx ecx, byte [eax + ebx*8 + 0x2d]
+cmp cl, 8
+je short loc_00014974 ; je 0x14974
+cmp ebx, 7
+ja short loc_0001493c ; ja 0x1493c
+cmp cl, 3
+jbe short loc_0001492e ; jbe 0x1492e
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00014974 ; je 0x14974
+push eax
+push ref_00022281 ; push 0x22281
+push 0x9c4
+jmp short loc_00014957 ; jmp 0x14957
+
+loc_0001492e:
+lea ecx, [ebx + ecx*8]
+mov eax, 1
+shl eax, cl
+or edi, eax
+jmp short loc_00014974 ; jmp 0x14974
+
+loc_0001493c:
+lea eax, [ecx - 4]
+cmp al, 3
+jbe short loc_00014966 ; jbe 0x14966
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00014974 ; je 0x14974
+push eax
+push ref_00022281 ; push 0x22281
+push 0x9d0
+
+loc_00014957:
+push ref_0002531e ; push 0x2531e
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+jmp short loc_00014974 ; jmp 0x14974
+
+loc_00014966:
+lea ecx, [ebx + ecx*8 - 0x28]
+mov eax, 1
+shl eax, cl
+or dword [ebp - 0x3c], eax
+
+loc_00014974:
+inc ebx
+jmp near loc_000148f5 ; jmp 0x148f5
+
+loc_0001497a:
+xor ebx, ebx
+xor esi, esi
+xor edx, edx
+
+loc_00014980:
+mov dword [ebp - 0x44], edx
+call fcn_0001c2f8 ; call 0x1c2f8
+mov edx, dword [ebp - 0x44]
+movzx eax, al
+cmp edx, eax
+jae short loc_000149c3 ; jae 0x149c3
+mov eax, dword [ebp + 8]
+movzx eax, byte [eax + edx*4 + 0x9d]
+cmp al, 8
+je short loc_000149c0 ; je 0x149c0
+cmp al, 3
+ja short loc_000149b3 ; ja 0x149b3
+lea ecx, [edx + eax*8]
+mov eax, 1
+shl eax, cl
+or esi, eax
+jmp short loc_000149c0 ; jmp 0x149c0
+
+loc_000149b3:
+lea ecx, [edx + eax*8 - 0x20]
+mov eax, 1
+shl eax, cl
+or ebx, eax
+
+loc_000149c0:
+inc edx
+jmp short loc_00014980 ; jmp 0x14980
+
+loc_000149c3:
+mov eax, dword [ebp + 0xc]
+push ecx
+push ecx
+push edi
+add eax, 0xc0
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop edi
+pop eax
+mov eax, dword [ebp + 0xc]
+push esi
+add eax, 0xc8
+push eax
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+cmp dword [ebp - 0x40], 1
+jne near loc_00014b50 ; jne 0x14b50
+push eax
+push eax
+mov eax, dword [ebp + 0xc]
+push dword [ebp - 0x3c]
+add eax, 0xc4
+push eax
+call fcn_00017e8f ; call 0x17e8f
+pop eax
+mov eax, dword [ebp + 0xc]
+pop edx
+add eax, 0xcc
+push ebx
+push eax
+call fcn_00017e8f ; call 0x17e8f
+jmp near loc_00014b4d ; jmp 0x14b4d
+
+loc_00014a1b:
+xor ebx, ebx
+cmp eax, 2
+jne near loc_00014b2f ; jne 0x14b2f
+
+loc_00014a26:
+call fcn_0001c2f8 ; call 0x1c2f8
+movzx eax, al
+cmp ebx, eax
+jae short loc_00014a79 ; jae 0x14a79
+mov eax, dword [ebp + 8]
+mov al, byte [eax + ebx*4 + 0x9d]
+cmp al, 8
+je short loc_00014a76 ; je 0x14a76
+movzx esi, al
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00014a69 ; je 0x14a69
+cmp esi, 3
+jbe short loc_00014a69 ; jbe 0x14a69
+push eax
+push ref_0002539d ; push 0x2539d
+push 0x9fd
+push ref_0002531e ; push 0x2531e
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00014a69:
+mov eax, 1
+mov cl, bl
+shl eax, cl
+or dword [ebp + esi*4 - 0x28], eax
+
+loc_00014a76:
+inc ebx
+jmp short loc_00014a26 ; jmp 0x14a26
+
+loc_00014a79:
+mov edx, dword [ebp + 0xc]
+mov eax, dword [ebp + 0xc]
+lea edi, [edx + 0xd0]
+mov dword [ebp - 0x3c], edi
+mov edi, edx
+add eax, 0xc0
+neg edi
+mov esi, eax
+mov dword [ebp - 0x40], eax
+lea ebx, [ebp + edi - 0x28]
+
+loc_00014a9a:
+push eax
+push eax
+push dword [ebx + esi - 0xc0]
+push esi
+add esi, 4
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+cmp esi, dword [ebp - 0x3c]
+jne short loc_00014a9a ; jne 0x14a9a
+xor ebx, ebx
+
+loc_00014ab6:
+call fcn_0001c2c1 ; call 0x1c2c1
+movzx eax, al
+cmp ebx, eax
+jae short loc_00014b06 ; jae 0x14b06
+mov eax, dword [ebp + 8]
+mov al, byte [eax + ebx*8 + 0x2d]
+cmp al, 8
+je short loc_00014b03 ; je 0x14b03
+movzx esi, al
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00014af6 ; je 0x14af6
+cmp esi, 3
+jbe short loc_00014af6 ; jbe 0x14af6
+push ecx
+push ref_0002539d ; push 0x2539d
+push 0xa0d
+push ref_0002531e ; push 0x2531e
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00014af6:
+mov eax, 1
+mov cl, bl
+shl eax, cl
+or dword [ebp + esi*4 - 0x38], eax
+
+loc_00014b03:
+inc ebx
+jmp short loc_00014ab6 ; jmp 0x14ab6
+
+loc_00014b06:
+mov eax, dword [ebp + 0xc]
+lea esi, [ebp + edi - 0x38]
+lea ebx, [eax + 0xb0]
+
+loc_00014b13:
+push edx
+push edx
+push dword [esi + ebx - 0xb0]
+push ebx
+add ebx, 4
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+cmp ebx, dword [ebp - 0x40]
+jne short loc_00014b13 ; jne 0x14b13
+jmp short loc_00014b50 ; jmp 0x14b50
+
+loc_00014b2f:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00014b50 ; je 0x14b50
+push eax
+push ref_00022281 ; push 0x22281
+push 0xa16
+push ref_0002531e ; push 0x2531e
+call fcn_0001548c ; call 0x1548c
+
+loc_00014b4d:
+add esp, 0x10
+
+loc_00014b50:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00014b58:
+push ebp
+mov ebp, esp
+push edi
+xor edi, edi
+push esi
+push ebx
+xor ebx, ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0xc]
+mov esi, dword [ebp + 8]
+mov dword [ebp - 0x24], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp - 0x28], eax
+call fcn_0001bfbb ; call 0x1bfbb
+mov dword [ebp - 0x20], 0
+mov dword [ebp - 0x1c], eax
+
+loc_00014b83:
+call fcn_0001c298 ; call 0x1c298
+movzx eax, al
+cmp ebx, eax
+jae short loc_00014c09 ; jae 0x14c09
+movzx ecx, byte [esi + ebx*8 + 0x2d]
+cmp cl, 8
+je short loc_00014c03 ; je 0x14c03
+cmp ebx, 7
+ja short loc_00014bc7 ; ja 0x14bc7
+cmp cl, 3
+jbe short loc_00014bb9 ; jbe 0x14bb9
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00014c03 ; je 0x14c03
+push ecx
+push ref_00022281 ; push 0x22281
+push 0xa69
+jmp short loc_00014be8 ; jmp 0x14be8
+
+loc_00014bb9:
+lea ecx, [ebx + ecx*8]
+mov eax, 1
+shl eax, cl
+or edi, eax
+jmp short loc_00014c03 ; jmp 0x14c03
+
+loc_00014bc7:
+cmp dword [ebp - 0x1c], 1
+jne short loc_00014c03 ; jne 0x14c03
+lea eax, [ecx - 4]
+cmp al, 3
+jbe short loc_00014bf7 ; jbe 0x14bf7
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00014c03 ; je 0x14c03
+push edx
+push ref_00022281 ; push 0x22281
+push 0xa76
+
+loc_00014be8:
+push ref_0002531e ; push 0x2531e
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+jmp short loc_00014c03 ; jmp 0x14c03
+
+loc_00014bf7:
+mov eax, dword [ebp - 0x1c]
+lea ecx, [ebx + ecx*8 - 0x28]
+shl eax, cl
+or dword [ebp - 0x20], eax
+
+loc_00014c03:
+inc ebx
+jmp near loc_00014b83 ; jmp 0x14b83
+
+loc_00014c09:
+cmp byte [esi], 1
+jne short loc_00014c20 ; jne 0x14c20
+push eax
+push eax
+mov eax, dword [ebp - 0x24]
+push edi
+add eax, 0x74
+push eax
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+
+loc_00014c20:
+cmp dword [ebp - 0x1c], 1
+jne short loc_00014c47 ; jne 0x14c47
+cmp byte [esi + 8], 1
+jne short loc_00014c47 ; jne 0x14c47
+mov eax, dword [ebp - 0x20]
+mov dword [ebp + 0xc], eax
+mov eax, dword [ebp - 0x28]
+add eax, 0x74
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f ; jmp 0x17e8f
+
+loc_00014c47:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00014c4f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+xor ebx, ebx
+sub esp, 0x1c
+mov esi, dword [ebp + 8]
+call fcn_0001bfbb ; call 0x1bfbb
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0xc]
+add eax, 0x64
+mov dword [ebp - 0x20], eax
+mov eax, dword [ebp + 0x10]
+lea edi, [eax + 0x64]
+
+loc_00014c74:
+call fcn_0001c298 ; call 0x1c298
+movzx eax, al
+cmp ebx, eax
+jae near loc_00014d11 ; jae 0x14d11
+cmp ebx, 7
+ja short loc_00014cc5 ; ja 0x14cc5
+cmp byte [esi], 1
+jne short loc_00014cc5 ; jne 0x14cc5
+cmp byte [esi + ebx*8 + 0x2c], 0
+jne short loc_00014cab ; jne 0x14cab
+push eax
+mov cl, bl
+push eax
+mov eax, 1
+shl eax, cl
+push eax
+push dword [ebp - 0x20]
+call fcn_00018730 ; call 0x18730
+jmp short loc_00014cc2 ; jmp 0x14cc2
+
+loc_00014cab:
+push ecx
+mov eax, 0xfffffffe
+push ecx
+mov cl, bl
+rol eax, cl
+movzx eax, al
+push eax
+push dword [ebp - 0x20]
+call fcn_0001875d ; call 0x1875d
+
+loc_00014cc2:
+add esp, 0x10
+
+loc_00014cc5:
+cmp dword [ebp - 0x1c], 1
+jne short loc_00014d0b ; jne 0x14d0b
+cmp ebx, 0xd
+ja short loc_00014d0b ; ja 0x14d0b
+cmp byte [esi + 8], 1
+jne short loc_00014d0b ; jne 0x14d0b
+cmp byte [esi + ebx*8 + 0x2c], 0
+lea ecx, [ebx - 8]
+jne short loc_00014cf3 ; jne 0x14cf3
+mov eax, dword [ebp - 0x1c]
+push edx
+push edx
+shl eax, cl
+movzx ecx, al
+push ecx
+push edi
+call fcn_00018730 ; call 0x18730
+jmp short loc_00014d08 ; jmp 0x14d08
+
+loc_00014cf3:
+push eax
+push eax
+mov eax, dword [ebp - 0x1c]
+shl eax, cl
+mov ecx, eax
+not ecx
+movzx ecx, cl
+push ecx
+push edi
+call fcn_0001875d ; call 0x1875d
+
+loc_00014d08:
+add esp, 0x10
+
+loc_00014d0b:
+inc ebx
+jmp near loc_00014c74 ; jmp 0x14c74
+
+loc_00014d11:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00014d19:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+call fcn_0001bfbb ; call 0x1bfbb
+cmp byte [esi + 0x10], 0
+mov dword [ebp - 0x1c], eax
+je near loc_00014e0a ; je 0x14e0a
+lea eax, [edi + 0xe4]
+sub esp, 0xc
+push eax
+mov dword [ebp - 0x20], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+xor edx, edx
+mov ebx, eax
+and ebx, 0x7fff
+
+loc_00014d59:
+mov dword [ebp - 0x24], edx
+call fcn_0001c261 ; call 0x1c261
+mov edx, dword [ebp - 0x24]
+movzx eax, al
+cmp edx, eax
+jae short loc_00014d98 ; jae 0x14d98
+cmp dword [ebp - 0x1c], 1
+mov ecx, edx
+jne short loc_00014d7a ; jne 0x14d7a
+mov ecx, dword [edx*4 + ref_000204b0] ; mov ecx, dword [edx*4 + 0x204b0]
+
+loc_00014d7a:
+cmp byte [esi + edx*8 + 0x2c], 0
+jne short loc_00014d8c ; jne 0x14d8c
+mov eax, 1
+shl eax, cl
+or ebx, eax
+jmp short loc_00014d95 ; jmp 0x14d95
+
+loc_00014d8c:
+mov eax, 0xfffffffe
+rol eax, cl
+and ebx, eax
+
+loc_00014d95:
+inc edx
+jmp short loc_00014d59 ; jmp 0x14d59
+
+loc_00014d98:
+lea eax, [edi + 0xe8]
+sub esp, 0xc
+push eax
+mov dword [ebp - 0x1c], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+xor ecx, ecx
+mov edi, eax
+and edi, 0x3f
+
+loc_00014db4:
+mov dword [ebp - 0x24], ecx
+call fcn_0001c2f8 ; call 0x1c2f8
+mov ecx, dword [ebp - 0x24]
+movzx eax, al
+cmp ecx, eax
+jae short loc_00014de7 ; jae 0x14de7
+cmp byte [esi + ecx*4 + 0x9c], 0
+je short loc_00014ddb ; je 0x14ddb
+mov eax, 0xfffffffe
+rol eax, cl
+and edi, eax
+jmp short loc_00014de4 ; jmp 0x14de4
+
+loc_00014ddb:
+mov eax, 1
+shl eax, cl
+or edi, eax
+
+loc_00014de4:
+inc ecx
+jmp short loc_00014db4 ; jmp 0x14db4
+
+loc_00014de7:
+push eax
+push eax
+push ebx
+push dword [ebp - 0x20]
+call fcn_00017e8f ; call 0x17e8f
+mov eax, dword [ebp - 0x1c]
+add esp, 0x10
+mov dword [ebp + 0xc], edi
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f ; jmp 0x17e8f
+
+loc_00014e0a:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00014e12:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+mov eax, dword [ebp + 8]
+push 0x100
+add eax, 0x7a
+push eax
+call fcn_00018927 ; call 0x18927
+add esp, 0x10
+leave
+ret
+
+fcn_00014e2e:
+push ebp
+mov ebp, esp
+push ebx
+push ecx
+mov edx, dword [ebp + 8]
+mov eax, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+cmp byte [edx + 0x10], 0
+je short loc_00014e67 ; je 0x14e67
+push edx
+push edx
+push eax
+lea eax, [ebx + 0x10]
+add ebx, 4
+push eax
+call fcn_00017e8f ; call 0x17e8f
+add esp, 0x10
+mov dword [ebp + 8], ebx
+mov ebx, dword [ebp - 4]
+mov dword [ebp + 0xc], 6
+leave
+jmp near fcn_00018927 ; jmp 0x18927
+
+loc_00014e67:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00014e6c:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov eax, dword [ebp + 8]
+mov ebx, dword [ebp + 0x10]
+cmp byte [eax + 0x10], 0
+je short loc_00014ea6 ; je 0x14ea6
+push eax
+push eax
+push 0xfff9
+lea eax, [ebx + 4]
+add ebx, 0x10
+push eax
+call fcn_00018954 ; call 0x18954
+add esp, 0x10
+mov dword [ebp + 8], ebx
+mov ebx, dword [ebp - 4]
+mov dword [ebp + 0xc], 0
+leave
+jmp near fcn_00017e8f ; jmp 0x17e8f
+
+loc_00014ea6:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00014eab:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov esi, dword [ebp + 0x10]
+mov edi, dword [ebp + 8]
+call fcn_0001bfbb ; call 0x1bfbb
+mov dword [ebp - 0x24], eax
+call fcn_0001bbfd ; call 0x1bbfd
+mov ebx, eax
+call fcn_0001c0bd ; call 0x1c0bd
+cmp ebx, 0x40
+seta byte [ebp - 0x19]
+cmp eax, 2
+sete al
+and byte [ebp - 0x19], al
+cmp byte [ebp - 0x19], 1
+sbb eax, eax
+xor ebx, ebx
+and eax, 0x100
+add eax, 0x4381
+push eax
+push 0
+push 0xe5007f04
+push esi
+call fcn_00009dc2 ; call 0x9dc2
+add esp, 0x10
+
+loc_00014f01:
+call fcn_0001c261 ; call 0x1c261
+movzx eax, al
+cmp ebx, eax
+jae near loc_00014fc1 ; jae 0x14fc1
+inc ebx
+mov eax, ebx
+push 0
+shl eax, 8
+push 0xfffffffffffffffe
+mov dword [ebp - 0x28], eax
+sub eax, 0x1affbff1
+push eax
+push esi
+call fcn_00009dc2 ; call 0x9dc2
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00014f55 ; je 0x14f55
+cmp byte [edi + ebx*8 + 0x27], 7
+jbe short loc_00014f55 ; jbe 0x14f55
+push edx
+push ref_000253a7 ; push 0x253a7
+push 0xc0b
+push ref_0002531e ; push 0x2531e
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00014f55:
+mov al, byte [edi + ebx*8 + 0x27]
+and eax, 7
+mov dword [ebp - 0x20], eax
+shl dword [ebp - 0x20], 0xb
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00014f8b ; je 0x14f8b
+cmp byte [edi + ebx*8 + 0x26], 7
+jbe short loc_00014f8b ; jbe 0x14f8b
+push eax
+push ref_000253e3 ; push 0x253e3
+push 0xc0d
+push ref_0002531e ; push 0x2531e
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00014f8b:
+mov al, byte [edi + ebx*8 + 0x26]
+and eax, 7
+shl eax, 8
+or eax, dword [ebp - 0x20]
+mov edx, eax
+or edx, 0x30
+cmp byte [ebp - 0x19], 0
+cmovne eax, edx
+push eax
+mov eax, dword [ebp - 0x28]
+push 0xffff80ff
+sub eax, 0x1affc000
+push eax
+push esi
+call fcn_00009dc2 ; call 0x9dc2
+add esp, 0x10
+jmp near loc_00014f01 ; jmp 0x14f01
+
+loc_00014fc1:
+push 0x180000
+push 0xffffffffffffffff
+push 0xe5007f14
+push esi
+call fcn_00009dc2 ; call 0x9dc2
+add esp, 0x10
+cmp dword [ebp - 0x24], 2
+jne short loc_00014ff1 ; jne 0x14ff1
+push 0
+push 0xff3fffff
+push 0xe5007f02
+push esi
+call fcn_00009dc2 ; call 0x9dc2
+add esp, 0x10
+
+loc_00014ff1:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00014ff9:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov esi, dword [ebp + 8]
+mov ebx, dword [ebp + 0xc]
+call fcn_0001bfbb ; call 0x1bfbb
+cmp eax, 2
+jne short loc_0001502e ; jne 0x1502e
+cmp byte [esi + 0x284], 0
+jne short loc_0001502e ; jne 0x1502e
+push ecx
+push ecx
+push 5
+lea eax, [ebx + 0x3a84]
+push eax
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+
+loc_0001502e:
+push 0xc0
+push 0xffffffffffffffff
+push 0xe5004001
+push ebx
+xor ebx, ebx
+call fcn_00009dc2 ; call 0x9dc2
+add esp, 0x10
+
+loc_00015045:
+call fcn_0001c245 ; call 0x1c245
+cmp bl, al
+jae short loc_000150a7 ; jae 0x150a7
+movzx edi, bl
+push eax
+movzx eax, byte [edi + edi + ref_000204f1] ; movzx eax, byte [edi + edi + 0x204f1]
+push eax
+movzx eax, byte [edi + edi + ref_000204f0] ; movzx eax, byte [edi + edi + 0x204f0]
+add edi, 0x50
+push eax
+movzx eax, byte [esi + 1]
+push eax
+call fcn_00016c9a ; call 0x16c9a
+cmp byte [esi + edi*8 + 4], 1
+pop edx
+sbb edx, edx
+inc ebx
+not edx
+mov ecx, eax
+add edx, 0x27
+pop eax
+lea eax, [ecx + 0xdc]
+mov dword [ebp - 0x1c], ecx
+push edx
+push eax
+call fcn_00018b14 ; call 0x18b14
+mov ecx, dword [ebp - 0x1c]
+pop eax
+pop edx
+add ecx, 0x78
+push 3
+push ecx
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+jmp short loc_00015045 ; jmp 0x15045
+
+loc_000150a7:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000150af:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+push eax
+push eax
+push esi
+push ebx
+call fcn_00014ff9 ; call 0x14ff9
+add esp, 0x10
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], ebx
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00013c3e ; jmp 0x13c3e
+
+fcn_000150d7:
+push ebp
+mov edx, 0x18
+mov ebp, esp
+push edi
+push esi
+mov esi, ref_000271d0 ; mov esi, 0x271d0
+push ebx
+mov ebx, 0x24
+sub esp, 0x1c
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 8]
+dec al
+mov eax, ref_000270b0 ; mov eax, 0x270b0
+cmovne ebx, edx
+cmovne esi, eax
+call fcn_0001c2f8 ; call 0x1c2f8
+mov dword [ebp - 0x20], 0
+movzx ecx, al
+mov eax, ebx
+cdq
+idiv ecx
+lea ebx, [edi + 0x9e]
+mov dword [ebp - 0x28], eax
+mov word [ebp - 0x1c], ax
+lea eax, [edi + ecx*4 + 0x9e]
+mov dword [ebp - 0x24], eax
+
+loc_0001512d:
+cmp ebx, dword [ebp - 0x24]
+je near loc_000151bf ; je 0x151bf
+cmp byte [ebx], 1
+jne short loc_000151b1 ; jne 0x151b1
+mov byte [ebp - 0x19], 0
+
+loc_0001513f:
+movzx eax, byte [ebp - 0x19]
+cmp ax, word [ebp - 0x1c]
+jae short loc_000151b1 ; jae 0x151b1
+movzx eax, byte [ebp - 0x19]
+add eax, dword [ebp - 0x20]
+imul eax, eax, 0xc
+add eax, esi
+push dword [eax + 8]
+push dword [eax + 4]
+push dword [eax]
+push dword [ebp + 0xc]
+call fcn_00009dc2 ; call 0x9dc2
+mov edi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_000151ac ; je 0x151ac
+test edi, edi
+jns short loc_000151ac ; jns 0x151ac
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00015194 ; je 0x15194
+push edx
+push edi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00015194:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0xcbb
+push ref_0002531e ; push 0x2531e
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000151ac:
+inc byte [ebp - 0x19]
+jmp short loc_0001513f ; jmp 0x1513f
+
+loc_000151b1:
+mov eax, dword [ebp - 0x28]
+add ebx, 4
+add dword [ebp - 0x20], eax
+jmp near loc_0001512d ; jmp 0x1512d
+
+loc_000151bf:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000151c7:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x3c
+mov eax, dword [ebp + 0x20]
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0x1c]
+mov dword [ebp - 0x34], eax
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000151f9 ; je 0x151f9
+push eax
+push eax
+push ref_0002541f ; push 0x2541f
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000151f9:
+call fcn_0001bfbb ; call 0x1bfbb
+mov edx, esi
+movzx esi, dl
+mov dword [ebp - 0x20], eax
+push eax
+push 0
+push 0x1f
+push esi
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0x14
+push esi
+mov dword [ebp - 0x2c], eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0x1d
+push esi
+mov dword [ebp - 0x24], eax
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0x10
+cmp dword [ebp - 0x20], 1
+mov dword [ebp - 0x1c], 0
+mov dword [ebp - 0x30], eax
+jne short loc_00015255 ; jne 0x15255
+push ecx
+push 0
+push 0x1a
+push esi
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0x10
+mov dword [ebp - 0x1c], eax
+
+loc_00015255:
+mov eax, dword [ebp - 0x2c]
+sub esp, 0xc
+add eax, 0x40
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+mov word [ebp - 0x48], ax
+mov eax, dword [ebp - 0x2c]
+add eax, 2
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+cmp byte [ebx], 0
+jne short loc_00015284 ; jne 0x15284
+or dword [edi], 0x8000
+
+loc_00015284:
+cmp dword [ebp - 0x20], 1
+jne short loc_00015296 ; jne 0x15296
+cmp byte [ebx + 8], 0
+jne short loc_00015296 ; jne 0x15296
+or dword [edi], 0x2000
+
+loc_00015296:
+cmp byte [ebx + 0x10], 0
+jne short loc_000152a2 ; jne 0x152a2
+or dword [edi], 0x8000000
+
+loc_000152a2:
+push edx
+movzx edi, ax
+movzx eax, byte [ebp - 0x34]
+push edx
+push dword [ebp + 0x18]
+mov dword [ebp - 0x28], eax
+push edi
+push eax
+push esi
+push dword [ebp + 0xc]
+push ebx
+call fcn_000135df ; call 0x135df
+mov esi, dword [ebp - 0x24]
+add esp, 0x1c
+push esi
+push dword [ebp + 0x10]
+push ebx
+call fcn_00014e2e ; call 0x14e2e
+mov dword [esp], esi
+push edi
+push dword [ebp - 0x28]
+push dword [ebp + 0x10]
+push ebx
+call fcn_000137fe ; call 0x137fe
+add esp, 0x20
+cmp byte [ebp - 0x34], 7
+jbe short loc_000152f8 ; jbe 0x152f8
+movzx eax, byte [ebp - 0x20]
+push ecx
+push eax
+push dword [ebp + 0x18]
+push ebx
+call fcn_000150d7 ; call 0x150d7
+add esp, 0x10
+
+loc_000152f8:
+push eax
+mov esi, dword [ebp - 0x24]
+push eax
+push dword [ebp - 0x2c]
+push esi
+push edi
+push dword [ebp - 0x28]
+push dword [ebp + 0x10]
+push ebx
+call fcn_00013f3d ; call 0x13f3d
+add esp, 0x1c
+push dword [ebp - 0x1c]
+push dword [ebp - 0x30]
+push ebx
+call fcn_00014b58 ; call 0x14b58
+pop eax
+pop edx
+push esi
+push ebx
+call fcn_000148a3 ; call 0x148a3
+add esp, 0xc
+push dword [ebp + 0x18]
+push edi
+push ebx
+call fcn_00014eab ; call 0x14eab
+add esp, 0x10
+cmp byte [ebx + 0xb4], 1
+jne short loc_00015393 ; jne 0x15393
+mov esi, dword [ebp - 0x48]
+sub esp, 0xc
+and esi, 0xfffc
+add esi, 0x3c
+push esi
+call fcn_00018ef6 ; call 0x18ef6
+pop ecx
+mov edi, eax
+pop eax
+mov eax, edi
+or eax, 2
+and edi, 0xfffd
+movzx eax, ax
+push eax
+push esi
+call fcn_00018f27 ; call 0x18f27
+add esp, 0xc
+push dword [ebp - 0x1c]
+push dword [ebp - 0x30]
+push ebx
+call fcn_00014c4f ; call 0x14c4f
+pop eax
+pop edx
+push dword [ebp - 0x24]
+push ebx
+call fcn_00014d19 ; call 0x14d19
+pop ecx
+pop eax
+push edi
+push esi
+call fcn_00018f27 ; call 0x18f27
+add esp, 0x10
+
+loc_00015393:
+cmp byte [ebx + 1], 1
+jne short loc_000153ac ; jne 0x153ac
+cmp byte [ebx], 1
+jne short loc_000153ac ; jne 0x153ac
+sub esp, 0xc
+push dword [ebp - 0x30]
+call fcn_00014e12 ; call 0x14e12
+add esp, 0x10
+
+loc_000153ac:
+cmp dword [ebp - 0x20], 1
+jne short loc_000153cc ; jne 0x153cc
+cmp byte [ebx + 9], 1
+jne short loc_000153cc ; jne 0x153cc
+cmp byte [ebx + 8], 1
+jne short loc_000153cc ; jne 0x153cc
+sub esp, 0xc
+push dword [ebp - 0x1c]
+call fcn_00014e12 ; call 0x14e12
+add esp, 0x10
+
+loc_000153cc:
+push edx
+push dword [ebp - 0x24]
+push dword [ebp + 0x10]
+push ebx
+call fcn_00014e6c ; call 0x14e6c
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_000153f6 ; je 0x153f6
+push eax
+push eax
+push ref_00025438 ; push 0x25438
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000153f6:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00015400:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0x10]
+push ebx
+mov ebx, dword [ebp + 0xc]
+add esi, ebx
+
+loc_0001540d:
+cmp ebx, esi
+je short loc_00015424 ; je 0x15424
+inc ebx
+movzx eax, byte [ebx - 1]
+sub esp, 0xc
+push eax
+call fcn_0001641a ; call 0x1641a
+add esp, 0x10
+jmp short loc_0001540d ; jmp 0x1540d
+
+loc_00015424:
+lea esp, [ebp - 8]
+or eax, 0xffffffff
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001542e:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 8]
+push 0x80
+movzx eax, bx
+movzx ebx, bh
+push eax
+call fcn_00018eea ; call 0x18eea
+pop eax
+pop edx
+push 0x90
+push ebx
+call fcn_00018eea ; call 0x18eea
+add esp, 0x10
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001545e:
+push ebp
+mov ebp, esp
+sub esp, 8
+lea eax, [ebp + 0xc]
+push eax
+push dword [ebp + 8]
+push 0
+push fcn_00015400 ; push 0x15400
+call fcn_000155ac ; call 0x155ac
+leave
+ret
+
+fcn_00015479:
+push ebp
+xor eax, eax
+mov ebp, esp
+pop ebp
+ret
+
+fcn_00015480:
+push ebp
+xor eax, eax
+mov ebp, esp
+pop ebp
+ret
+
+fcn_00015487:
+push ebp
+mov ebp, esp
+pop ebp
+ret
+
+fcn_0001548c:
+push ebp
+mov ebp, esp
+pop ebp
+ret
+
+fcn_00015491:
+push ebp
+mov ebp, esp
+push edi
+mov edi, eax
+push esi
+push ebx
+mov ebx, edx
+sub esp, 0x1c
+
+loc_0001549e:
+test ebx, ebx
+jle short loc_000154ce ; jle 0x154ce
+push eax
+mov eax, dword [ebp + 8]
+cmp ebx, 0x10
+mov esi, 0x10
+cmovle esi, ebx
+push esi
+push edi
+push dword [eax]
+mov dword [ebp - 0x1c], ecx
+call ecx
+mov edx, dword [ebp + 8]
+add esp, 0x10
+mov ecx, dword [ebp - 0x1c]
+test eax, eax
+mov dword [edx], eax
+jne short loc_000154d2 ; jne 0x154d2
+or eax, 0xffffffff
+jmp short loc_000154d6 ; jmp 0x154d6
+
+loc_000154ce:
+xor eax, eax
+jmp short loc_000154d6 ; jmp 0x154d6
+
+loc_000154d2:
+sub ebx, esi
+jmp short loc_0001549e ; jmp 0x1549e
+
+loc_000154d6:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000154de:
+push ebp
+mov ebp, esp
+push edi
+mov edi, ecx
+push esi
+mov esi, eax
+push ebx
+mov ebx, edx
+sub esp, 0xc
+test ecx, ecx
+jne short loc_000154ff ; jne 0x154ff
+
+loc_000154f1:
+cmp dword [ebp + 8], 0
+je short loc_00015537 ; je 0x15537
+cmp dword [ebp + 0xc], 0
+je short loc_00015537 ; je 0x15537
+jmp short loc_00015520 ; jmp 0x15520
+
+loc_000154ff:
+sub esp, 0xc
+mov ecx, eax
+push edx
+mov eax, ref_00020558 ; mov eax, 0x20558
+mov edx, edi
+call fcn_00015491 ; call 0x15491
+add esp, 0x10
+test eax, eax
+jns short loc_000154f1 ; jns 0x154f1
+
+loc_00015518:
+or eax, 0xffffffff
+jmp near loc_000155a4 ; jmp 0x155a4
+
+loc_00015520:
+push edx
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push dword [ebx]
+call esi
+add esp, 0x10
+mov dword [ebx], eax
+test eax, eax
+je short loc_00015518 ; je 0x15518
+add edi, dword [ebp + 0xc]
+
+loc_00015537:
+cmp dword [ebp + 0x10], 0
+jne short loc_00015548 ; jne 0x15548
+
+loc_0001553d:
+add edi, dword [ebp + 0x10]
+cmp dword [ebp + 0x18], 0
+je short loc_00015578 ; je 0x15578
+jmp short loc_00015564 ; jmp 0x15564
+
+loc_00015548:
+mov edx, dword [ebp + 0x10]
+sub esp, 0xc
+mov ecx, esi
+push ebx
+mov eax, ref_00020544 ; mov eax, 0x20544
+call fcn_00015491 ; call 0x15491
+add esp, 0x10
+test eax, eax
+jns short loc_0001553d ; jns 0x1553d
+jmp short loc_00015518 ; jmp 0x15518
+
+loc_00015564:
+push eax
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebx]
+call esi
+add esp, 0x10
+mov dword [ebx], eax
+test eax, eax
+je short loc_00015518 ; je 0x15518
+
+loc_00015578:
+add edi, dword [ebp + 0x18]
+cmp dword [ebp + 0x1c], 0
+je short loc_0001559f ; je 0x1559f
+mov edx, dword [ebp + 0x1c]
+sub esp, 0xc
+mov ecx, esi
+push ebx
+mov eax, ref_00020558 ; mov eax, 0x20558
+call fcn_00015491 ; call 0x15491
+add esp, 0x10
+test eax, eax
+js near loc_00015518 ; js 0x15518
+
+loc_0001559f:
+mov eax, dword [ebp + 0x1c]
+add eax, edi
+
+loc_000155a4:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000155ac:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xec
+mov eax, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0x14]
+test eax, eax
+je short loc_00015610 ; je 0x15610
+mov dword [ebp - 0xe0], 0
+mov dword [ebp - 0xd4], 0
+jmp short loc_00015631 ; jmp 0x15631
+
+loc_000155d8:
+cmp dl, 0x2a
+jne near loc_0001566c ; jne 0x1566c
+mov ecx, dword [ebx]
+lea eax, [ebx + 4]
+mov dword [ebp - 0xc4], ecx
+test ecx, ecx
+jns short loc_000155fd ; jns 0x155fd
+neg dword [ebp - 0xc4]
+or dword [ebp - 0xb4], 4
+
+loc_000155fd:
+inc edi
+mov ebx, eax
+
+loc_00015600:
+cmp dword [ebp - 0xc4], 0x1f4
+jle near loc_000156c4 ; jle 0x156c4
+
+loc_00015610:
+or eax, 0xffffffff
+jmp near loc_00016176 ; jmp 0x16176
+
+loc_00015618:
+test dl, dl
+je short loc_00015624 ; je 0x15624
+inc esi
+
+loc_0001561d:
+mov dl, byte [esi]
+cmp dl, 0x25
+jne short loc_00015618 ; jne 0x15618
+
+loc_00015624:
+mov edi, esi
+sub edi, eax
+jne short loc_0001563e ; jne 0x1563e
+
+loc_0001562a:
+cmp byte [esi], 0
+jne short loc_00015659 ; jne 0x15659
+mov eax, esi
+
+loc_00015631:
+cmp byte [eax], 0
+je near loc_0001613b ; je 0x1613b
+mov esi, eax
+jmp short loc_0001561d ; jmp 0x1561d
+
+loc_0001563e:
+push edx
+push edi
+push eax
+push dword [ebp + 0xc]
+call dword [ebp + 8] ; ucall
+add esp, 0x10
+mov dword [ebp + 0xc], eax
+test eax, eax
+je short loc_00015610 ; je 0x15610
+add dword [ebp - 0xd4], edi
+jmp short loc_0001562a ; jmp 0x1562a
+
+loc_00015659:
+lea edi, [esi + 1]
+mov dword [ebp - 0xb4], 0
+
+loc_00015666:
+mov dl, byte [edi]
+test dl, dl
+jne short loc_00015678 ; jne 0x15678
+
+loc_0001566c:
+mov dword [ebp - 0xc4], 0
+jmp short loc_000156b4 ; jmp 0x156b4
+
+loc_00015678:
+mov eax, ref_0002053c ; mov eax, 0x2053c
+
+loc_0001567d:
+mov cl, byte [eax]
+cmp cl, dl
+je near loc_00016143 ; je 0x16143
+test cl, cl
+je near loc_000155d8 ; je 0x155d8
+inc eax
+jmp short loc_0001567d ; jmp 0x1567d
+
+loc_00015692:
+cmp dword [ebp - 0xc4], 0x1f3
+jg near loc_00015600 ; jg 0x15600
+imul edx, dword [ebp - 0xc4], 0xa
+inc edi
+lea eax, [edx + eax - 0x30]
+mov dword [ebp - 0xc4], eax
+
+loc_000156b4:
+movsx eax, byte [edi]
+lea edx, [eax - 0x30]
+cmp dl, 9
+jbe short loc_00015692 ; jbe 0x15692
+jmp near loc_00015600 ; jmp 0x15600
+
+loc_000156c4:
+cmp byte [edi], 0x2e
+mov dword [ebp - 0xc0], 0xffffffff
+jne short loc_0001573d ; jne 0x1573d
+cmp byte [edi + 1], 0x2a
+je short loc_000156e6 ; je 0x156e6
+inc edi
+mov dword [ebp - 0xc0], 0
+jmp short loc_00015722 ; jmp 0x15722
+
+loc_000156e6:
+lea eax, [ebx + 4]
+mov ebx, dword [ebx]
+mov dword [ebp - 0xc0], ebx
+cmp ebx, 0x1f4
+jg near loc_00015610 ; jg 0x15610
+add edi, 2
+mov ebx, eax
+jmp short loc_0001573d ; jmp 0x1573d
+
+loc_00015704:
+cmp dword [ebp - 0xc0], 0x1f3
+jg short loc_0001572d ; jg 0x1572d
+imul edx, dword [ebp - 0xc0], 0xa
+inc edi
+lea eax, [edx + eax - 0x30]
+mov dword [ebp - 0xc0], eax
+
+loc_00015722:
+movsx eax, byte [edi]
+lea edx, [eax - 0x30]
+cmp dl, 9
+jbe short loc_00015704 ; jbe 0x15704
+
+loc_0001572d:
+cmp dword [ebp - 0xc0], 0x1f4
+jg near loc_00015610 ; jg 0x15610
+
+loc_0001573d:
+cmp byte [edi], 0x3a
+mov dword [ebp - 0xb0], 0
+jne short loc_000157af ; jne 0x157af
+cmp byte [edi + 1], 0x2a
+jne short loc_00015796 ; jne 0x15796
+mov esi, dword [ebx]
+lea eax, [ebx + 4]
+mov dword [ebp - 0xb0], esi
+test esi, esi
+js short loc_0001576b ; js 0x1576b
+cmp esi, 0x24
+jle short loc_00015775 ; jle 0x15775
+jmp near loc_00015610 ; jmp 0x15610
+
+loc_0001576b:
+mov dword [ebp - 0xb0], 0
+
+loc_00015775:
+add edi, 2
+mov ebx, eax
+jmp short loc_000157af ; jmp 0x157af
+
+loc_0001577c:
+cmp dword [ebp - 0xb0], 0x23
+jg short loc_000157a2 ; jg 0x157a2
+imul ecx, dword [ebp - 0xb0], 0xa
+lea eax, [ecx + eax - 0x30]
+mov dword [ebp - 0xb0], eax
+
+loc_00015796:
+inc edi
+movsx eax, byte [edi]
+lea edx, [eax - 0x30]
+cmp dl, 9
+jbe short loc_0001577c ; jbe 0x1577c
+
+loc_000157a2:
+cmp dword [ebp - 0xb0], 0x24
+jg near loc_00015610 ; jg 0x15610
+
+loc_000157af:
+cmp byte [edi], 0x5b
+mov dword [ebp - 0xcc], 0
+jne short loc_000157e8 ; jne 0x157e8
+lea eax, [edi + 1]
+not edi
+mov dword [ebp - 0xe0], eax
+mov esi, edi
+
+loc_000157cb:
+mov dl, byte [eax]
+lea edi, [eax + esi]
+mov dword [ebp - 0xcc], edi
+test dl, dl
+je near loc_00015610 ; je 0x15610
+cmp dl, 0x5d
+lea eax, [eax + 1]
+jne short loc_000157cb ; jne 0x157cb
+mov edi, eax
+
+loc_000157e8:
+mov al, byte [edi]
+mov esi, ref_0002544f ; mov esi, 0x2544f
+test al, al
+je short loc_00015820 ; je 0x15820
+
+loc_000157f3:
+mov dl, byte [esi]
+cmp dl, al
+je short loc_00015804 ; je 0x15804
+test dl, dl
+je short loc_00015800 ; je 0x15800
+inc esi
+jmp short loc_000157f3 ; jmp 0x157f3
+
+loc_00015800:
+xor eax, eax
+jmp short loc_00015820 ; jmp 0x15820
+
+loc_00015804:
+mov dl, byte [edi + 1]
+lea esi, [edi + 1]
+test dl, dl
+je near loc_0001615b ; je 0x1615b
+cmp dl, al
+jne near loc_0001615b ; jne 0x1615b
+or eax, 1
+add edi, 2
+
+loc_00015820:
+mov dl, byte [edi]
+test dl, dl
+jne short loc_00015830 ; jne 0x15830
+mov eax, dword [ebx]
+add ebx, 4
+jmp near loc_00015631 ; jmp 0x15631
+
+loc_00015830:
+mov byte [ebp - 0xb8], 0
+cmp dl, 0x43
+jne short loc_00015852 ; jne 0x15852
+mov cl, byte [edi + 1]
+lea esi, [edi + 1]
+mov byte [ebp - 0xb8], cl
+test cl, cl
+je near loc_00015610 ; je 0x15610
+mov edi, esi
+
+loc_00015852:
+mov byte [ebp - 0xa3], dl
+cmp dl, 0x6e
+jne short loc_000158b3 ; jne 0x158b3
+mov edx, dword [ebx]
+test edx, edx
+je near loc_0001616f ; je 0x1616f
+cmp al, 0x68
+jne short loc_00015879 ; jne 0x15879
+mov eax, dword [ebp - 0xd4]
+mov word [edx], ax
+jmp near loc_0001616f ; jmp 0x1616f
+
+loc_00015879:
+cmp al, 0x69
+jne short loc_0001588a ; jne 0x1588a
+mov al, byte [ebp - 0xd4]
+mov byte [edx], al
+jmp near loc_0001616f ; jmp 0x1616f
+
+loc_0001588a:
+cmp al, 0x6c
+je short loc_000158a6 ; je 0x158a6
+cmp al, 0x6a
+jne short loc_000158a6 ; jne 0x158a6
+mov eax, dword [ebp - 0xd4]
+mov dword [edx + 4], 0
+mov dword [edx], eax
+jmp near loc_0001616f ; jmp 0x1616f
+
+loc_000158a6:
+mov eax, dword [ebp - 0xd4]
+mov dword [edx], eax
+jmp near loc_0001616f ; jmp 0x1616f
+
+loc_000158b3:
+cmp dl, 0x25
+jne short loc_000158e0 ; jne 0x158e0
+push eax
+xor ecx, ecx
+push eax
+push 0
+push 1
+lea eax, [ebp - 0xa3]
+push eax
+mov eax, dword [ebp + 8]
+push 0
+push 0
+push 0
+lea edx, [ebp + 0xc]
+call fcn_000154de ; call 0x154de
+add esp, 0x20
+jmp near loc_00016125 ; jmp 0x16125
+
+loc_000158e0:
+mov esi, edx
+and esi, 0xffffffdf
+mov ecx, esi
+cmp cl, 0x43
+jne short loc_00015964 ; jne 0x15964
+cmp dl, 0x63
+jne short loc_000158fe ; jne 0x158fe
+mov eax, dword [ebx]
+add ebx, 4
+mov byte [ebp - 0x9a], al
+jmp short loc_0001590a ; jmp 0x1590a
+
+loc_000158fe:
+mov al, byte [ebp - 0xb8]
+mov byte [ebp - 0x9a], al
+
+loc_0001590a:
+mov esi, dword [ebp - 0xc0]
+mov eax, 1
+test esi, esi
+cmovs esi, eax
+test esi, esi
+cmovg eax, esi
+xor esi, esi
+mov dword [ebp - 0xb0], eax
+
+loc_00015927:
+push eax
+xor ecx, ecx
+push eax
+push 0
+push 1
+lea eax, [ebp - 0x9a]
+push eax
+mov eax, dword [ebp + 8]
+push 0
+push 0
+push 0
+lea edx, [ebp + 0xc]
+call fcn_000154de ; call 0x154de
+add esp, 0x20
+cmp eax, 0xffffffff
+je near loc_00015610 ; je 0x15610
+add esi, eax
+dec dword [ebp - 0xb0]
+jne short loc_00015927 ; jne 0x15927
+mov eax, esi
+jmp near loc_00016125 ; jmp 0x16125
+
+loc_00015964:
+cmp dl, 0x73
+jne near loc_000159fb ; jne 0x159fb
+lea eax, [ebx + 4]
+mov edx, ref_00025456 ; mov edx, 0x25456
+mov dword [ebp - 0xb0], eax
+mov eax, dword [ebx]
+test eax, eax
+cmove eax, edx
+mov edx, eax
+
+loc_00015984:
+cmp byte [edx], 0
+je short loc_0001598c ; je 0x1598c
+inc edx
+jmp short loc_00015984 ; jmp 0x15984
+
+loc_0001598c:
+mov ebx, dword [ebp - 0xc0]
+sub edx, eax
+test ebx, ebx
+js short loc_0001599d ; js 0x1599d
+cmp edx, ebx
+cmovg edx, ebx
+
+loc_0001599d:
+mov esi, dword [ebp - 0xc4]
+xor ecx, ecx
+mov ebx, esi
+sub ebx, edx
+cmp edx, esi
+mov esi, dword [ebp - 0xb4]
+cmovl ecx, ebx
+xor ebx, ebx
+and esi, 4
+je short loc_000159bf ; je 0x159bf
+mov ebx, ecx
+xor ecx, ecx
+
+loc_000159bf:
+test byte [ebp - 0xb4], 0x40
+je short loc_000159d7 ; je 0x159d7
+add ebx, ecx
+xor ecx, ecx
+test esi, esi
+sete cl
+add ecx, ebx
+sar ecx, 1
+sub ebx, ecx
+
+loc_000159d7:
+push esi
+push esi
+push ebx
+push edx
+push eax
+mov eax, dword [ebp + 8]
+push 0
+push 0
+push 0
+lea edx, [ebp + 0xc]
+call fcn_000154de ; call 0x154de
+add esp, 0x20
+mov ebx, dword [ebp - 0xb0]
+jmp near loc_00016125 ; jmp 0x16125
+
+loc_000159fb:
+cmp dl, 0x70
+jne short loc_00015a27 ; jne 0x15a27
+mov byte [ebp - 0xa3], 0x58
+xor eax, eax
+mov dword [ebp - 0xc0], 8
+mov dword [ebp - 0xc4], 8
+mov dword [ebp - 0xb4], 0x28
+
+loc_00015a27:
+mov dl, byte [ebp - 0xa3]
+cmp dl, 0x69
+sete cl
+mov byte [ebp - 0xc8], dl
+mov byte [ebp - 0xd8], cl
+cmp dl, 0x64
+je short loc_00015a4f ; je 0x15a4f
+test cl, cl
+jne short loc_00015a4f ; jne 0x15a4f
+xor esi, esi
+cmp dl, 0x49
+jne short loc_00015a7e ; jne 0x15a7e
+
+loc_00015a4f:
+mov dl, byte [ebp - 0xc8]
+mov esi, 0xa
+and dword [ebp - 0xb4], 0xfffffff7
+or dword [ebp - 0xb4], 0x80
+and edx, 0xffffffdf
+cmp dl, 0x49
+jne short loc_00015a7e ; jne 0x15a7e
+mov ecx, dword [ebp - 0xb0]
+test ecx, ecx
+cmovne esi, ecx
+
+loc_00015a7e:
+mov dl, byte [ebp - 0xc8]
+and edx, 0xffffffdf
+cmp dl, 0x58
+sete cl
+test cl, cl
+mov byte [ebp - 0xbc], cl
+mov ecx, 0x10
+cmovne esi, ecx
+cmp dl, 0x55
+jne short loc_00015ab2 ; jne 0x15ab2
+mov ecx, dword [ebp - 0xb0]
+mov esi, 0xa
+test ecx, ecx
+cmovne esi, ecx
+
+loc_00015ab2:
+mov cl, byte [ebp - 0xc8]
+cmp cl, 0x6f
+je short loc_00015acc ; je 0x15acc
+cmp cl, 0x62
+je short loc_00015ad3 ; je 0x15ad3
+cmp esi, 1
+ja short loc_00015ad8 ; ja 0x15ad8
+jmp near loc_00015610 ; jmp 0x15610
+
+loc_00015acc:
+mov esi, 8
+jmp short loc_00015ad8 ; jmp 0x15ad8
+
+loc_00015ad3:
+mov esi, 2
+
+loc_00015ad8:
+test byte [ebp - 0xb4], 0x80
+je near loc_00015b9d ; je 0x15b9d
+cmp al, 0x6c
+jne short loc_00015aee ; jne 0x15aee
+lea eax, [ebx + 4]
+jmp short loc_00015af5 ; jmp 0x15af5
+
+loc_00015aee:
+cmp al, 0x6a
+jne short loc_00015aff ; jne 0x15aff
+lea eax, [ebx + 8]
+
+loc_00015af5:
+mov dword [ebp - 0xb8], eax
+
+loc_00015afb:
+mov edx, dword [ebx]
+jmp short loc_00015b23 ; jmp 0x15b23
+
+loc_00015aff:
+lea edx, [ebx + 4]
+cmp al, 0x7a
+mov dword [ebp - 0xb8], edx
+je short loc_00015afb ; je 0x15afb
+mov edx, dword [ebx]
+cmp al, 0x74
+je short loc_00015b23 ; je 0x15b23
+cmp al, 0x68
+jne short loc_00015b1b ; jne 0x15b1b
+movsx edx, dx
+jmp short loc_00015b23 ; jmp 0x15b23
+
+loc_00015b1b:
+movsx ecx, dl
+cmp al, 0x69
+cmove edx, ecx
+
+loc_00015b23:
+mov ecx, edx
+sar ecx, 0x1f
+mov eax, ecx
+xor eax, edx
+sub eax, ecx
+mov dword [ebp - 0xb0], eax
+sar eax, 0x1f
+mov dword [ebp - 0xac], eax
+test edx, edx
+jns short loc_00015b4a ; jns 0x15b4a
+mov byte [ebp - 0xa2], 0x2d
+jmp short loc_00015b70 ; jmp 0x15b70
+
+loc_00015b4a:
+test byte [ebp - 0xb4], 2
+je short loc_00015b5c ; je 0x15b5c
+mov byte [ebp - 0xa2], 0x2b
+jmp short loc_00015b70 ; jmp 0x15b70
+
+loc_00015b5c:
+mov eax, dword [ebp - 0xb4]
+and eax, 1
+neg eax
+and eax, 0x20
+mov byte [ebp - 0xa2], al
+
+loc_00015b70:
+cmp byte [ebp - 0xa2], 0
+mov dword [ebp - 0xd0], 0
+je near loc_00015c54 ; je 0x15c54
+or dword [ebp - 0xb4], 8
+mov dword [ebp - 0xd0], 1
+jmp near loc_00015c54 ; jmp 0x15c54
+
+loc_00015b9d:
+cmp al, 0x6c
+jne short loc_00015bb0 ; jne 0x15bb0
+lea eax, [ebx + 4]
+xor edx, edx
+mov dword [ebp - 0xb8], eax
+mov eax, dword [ebx]
+jmp short loc_00015bc2 ; jmp 0x15bc2
+
+loc_00015bb0:
+cmp al, 0x6a
+jne short loc_00015bd0 ; jne 0x15bd0
+lea eax, [ebx + 8]
+mov edx, dword [ebx + 4]
+mov dword [ebp - 0xb8], eax
+mov eax, dword [ebx]
+
+loc_00015bc2:
+mov dword [ebp - 0xb0], eax
+mov dword [ebp - 0xac], edx
+jmp short loc_00015c43 ; jmp 0x15c43
+
+loc_00015bd0:
+lea edx, [ebx + 4]
+cmp al, 0x7a
+mov dword [ebp - 0xb8], edx
+jne short loc_00015bf0 ; jne 0x15bf0
+mov eax, dword [ebx]
+mov dword [ebp - 0xb0], eax
+sar eax, 0x1f
+mov dword [ebp - 0xac], eax
+jmp short loc_00015c43 ; jmp 0x15c43
+
+loc_00015bf0:
+cmp al, 0x74
+jne short loc_00015c07 ; jne 0x15c07
+mov eax, dword [ebx]
+mov dword [ebp - 0xb0], eax
+sar eax, 0x1f
+mov dword [ebp - 0xac], eax
+jmp short loc_00015c43 ; jmp 0x15c43
+
+loc_00015c07:
+mov edx, dword [ebx]
+mov dword [ebp - 0xac], 0
+mov dword [ebp - 0xb0], edx
+cmp al, 0x68
+jne short loc_00015c28 ; jne 0x15c28
+movzx edx, dx
+mov dword [ebp - 0xb0], edx
+jmp short loc_00015c39 ; jmp 0x15c39
+
+loc_00015c28:
+cmp al, 0x69
+jne short loc_00015c43 ; jne 0x15c43
+movzx eax, byte [ebp - 0xb0]
+mov dword [ebp - 0xb0], eax
+
+loc_00015c39:
+mov dword [ebp - 0xac], 0
+
+loc_00015c43:
+mov byte [ebp - 0xa2], 0x30
+mov dword [ebp - 0xd0], 0
+
+loc_00015c54:
+mov eax, dword [ebp - 0xb0]
+mov edx, dword [ebp - 0xac]
+mov ebx, eax
+or ebx, edx
+setne al
+je short loc_00015c82 ; je 0x15c82
+cmp byte [ebp - 0xc8], 0x6f
+mov edx, 1
+cmovne edx, dword [ebp - 0xd0]
+mov dword [ebp - 0xd0], edx
+
+loc_00015c82:
+cmp byte [ebp - 0xbc], 0
+jne short loc_00015c94 ; jne 0x15c94
+cmp byte [ebp - 0xc8], 0x62
+jne short loc_00015cc2 ; jne 0x15cc2
+
+loc_00015c94:
+test byte [ebp - 0xb4], 0x20
+jne short loc_00015ca9 ; jne 0x15ca9
+test al, al
+je short loc_00015cc2 ; je 0x15cc2
+mov al, byte [ebp - 0xc8]
+jmp short loc_00015cb2 ; jmp 0x15cb2
+
+loc_00015ca9:
+mov al, byte [ebp - 0xc8]
+or eax, 0x20
+
+loc_00015cb2:
+mov byte [ebp - 0xa1], al
+mov dword [ebp - 0xd0], 2
+
+loc_00015cc2:
+test byte [ebp - 0xb4], 8
+je short loc_00015cd9 ; je 0x15cd9
+lea eax, [ebp - 0xa2]
+mov dword [ebp - 0xec], eax
+jmp short loc_00015ced ; jmp 0x15ced
+
+loc_00015cd9:
+mov dword [ebp - 0xec], 0
+mov dword [ebp - 0xd0], 0
+
+loc_00015ced:
+cmp esi, 0xa
+jne short loc_00015d58 ; jne 0x15d58
+mov dword [ebp - 0xbc], 0
+lea esi, [ebp - 0xa0]
+
+loc_00015d02:
+mov edx, dword [ebp - 0xac]
+mov eax, dword [ebp - 0xb0]
+mov ebx, edx
+or ebx, eax
+je near loc_00015ea6 ; je 0x15ea6
+push esi
+push 0xa
+push dword [ebp - 0xac]
+push dword [ebp - 0xb0]
+call fcn_00017502 ; call 0x17502
+mov bl, byte [ebp - 0xa0]
+add esp, 0x10
+inc dword [ebp - 0xbc]
+mov dword [ebp - 0xb0], eax
+mov eax, dword [ebp - 0xbc]
+mov dword [ebp - 0xac], edx
+lea edx, [ebx + 0x30]
+neg eax
+mov byte [eax + ebp - 0x18], dl
+jmp short loc_00015d02 ; jmp 0x15d02
+
+loc_00015d58:
+cmp byte [ebp - 0xc8], 0x75
+sete byte [ebp - 0xdc]
+cmp esi, 8
+sete dl
+cmp esi, 2
+je short loc_00015d89 ; je 0x15d89
+test dl, dl
+jne short loc_00015d89 ; jne 0x15d89
+cmp esi, 0x10
+je short loc_00015d89 ; je 0x15d89
+mov dword [ebp - 0xbc], 0
+jmp near loc_00015e8d ; jmp 0x15e8d
+
+loc_00015d89:
+lea eax, [esi - 1]
+cmp esi, 0x10
+je short loc_00015d9e ; je 0x15d9e
+cmp dl, 1
+sbb ecx, ecx
+and ecx, 0xfffffffe
+add ecx, 3
+jmp short loc_00015da3 ; jmp 0x15da3
+
+loc_00015d9e:
+mov ecx, 4
+
+loc_00015da3:
+mov dword [ebp - 0xbc], 0
+
+loc_00015dad:
+mov esi, dword [ebp - 0xac]
+mov ebx, dword [ebp - 0xb0]
+mov edx, esi
+or edx, ebx
+je near loc_00015ea6 ; je 0x15ea6
+mov edx, dword [ebp - 0xb0]
+and edx, eax
+cmp byte [ebp - 0xc8], 0x78
+mov dl, byte [edx + ref_000204f4] ; mov dl, byte [edx + 0x204f4]
+je short loc_00015dec ; je 0x15dec
+cmp byte [ebp - 0xd8], 0
+jne short loc_00015dec ; jne 0x15dec
+cmp byte [ebp - 0xdc], 0
+je short loc_00015def ; je 0x15def
+
+loc_00015dec:
+or edx, 0x20
+
+loc_00015def:
+inc dword [ebp - 0xbc]
+mov esi, dword [ebp - 0xbc]
+mov ebx, dword [ebp - 0xb0]
+neg esi
+mov byte [esi + ebp - 0x18], dl
+mov esi, dword [ebp - 0xac]
+xor edx, edx
+shrd ebx, esi, cl
+shr esi, cl
+test cl, 0x20
+cmovne ebx, esi
+cmovne esi, edx
+mov dword [ebp - 0xb0], ebx
+mov dword [ebp - 0xac], esi
+jmp short loc_00015dad ; jmp 0x15dad
+
+loc_00015e2b:
+push eax
+push esi
+push dword [ebp - 0xac]
+push dword [ebp - 0xb0]
+call fcn_00017470 ; call 0x17470
+add esp, 0x10
+cmp byte [ebp - 0xdc], 0
+mov al, byte [eax + ref_000204f4] ; mov al, byte [eax + 0x204f4]
+jne short loc_00015ea1 ; jne 0x15ea1
+cmp byte [ebp - 0xd8], 0
+jne short loc_00015ea1 ; jne 0x15ea1
+
+loc_00015e59:
+inc dword [ebp - 0xbc]
+mov edx, dword [ebp - 0xbc]
+neg edx
+mov byte [edx + ebp - 0x18], al
+push eax
+push esi
+push dword [ebp - 0xac]
+push dword [ebp - 0xb0]
+call fcn_000174b9 ; call 0x174b9
+add esp, 0x10
+mov dword [ebp - 0xb0], eax
+mov dword [ebp - 0xac], edx
+
+loc_00015e8d:
+mov edx, dword [ebp - 0xac]
+mov eax, dword [ebp - 0xb0]
+mov ebx, edx
+or ebx, eax
+jne short loc_00015e2b ; jne 0x15e2b
+jmp short loc_00015ea6 ; jmp 0x15ea6
+
+loc_00015ea1:
+or eax, 0x20
+jmp short loc_00015e59 ; jmp 0x15e59
+
+loc_00015ea6:
+cmp dword [ebp - 0xcc], 0
+mov dword [ebp - 0xe8], 0
+je near loc_00016060 ; je 0x16060
+mov eax, dword [ebp - 0xe0]
+mov ebx, dword [ebp - 0xcc]
+mov ecx, dword [ebp - 0xbc]
+mov dword [ebp - 0xc8], 0x82
+sub dword [ebp - 0xc8], ecx
+lea eax, [eax + ebx - 1]
+mov dword [ebp - 0xd8], eax
+xor eax, eax
+mov dword [ebp - 0xb0], ecx
+mov byte [ebp - 0xe4], 0
+
+loc_00015ef8:
+cmp dword [ebp - 0xb0], 0
+je near loc_00016060 ; je 0x16060
+cmp dword [ebp - 0xcc], 0
+je near loc_00016162 ; je 0x16162
+mov ebx, dword [ebp - 0xd8]
+mov al, byte [ebx]
+cmp al, 0x2d
+je near loc_00016060 ; je 0x16060
+cmp al, 0x2a
+je short loc_00015f43 ; je 0x15f43
+mov ecx, dword [ebp - 0xcc]
+mov edx, 1
+xor eax, eax
+sub ebx, ecx
+mov dword [ebp - 0xdc], ecx
+mov dword [ebp - 0xe4], ebx
+jmp short loc_00015f93 ; jmp 0x15f93
+
+loc_00015f43:
+mov eax, dword [ebp - 0xb8]
+lea esi, [eax + 4]
+mov eax, dword [eax]
+test eax, eax
+js near loc_0001605a ; js 0x1605a
+mov ecx, dword [ebp - 0xd8]
+mov edx, dword [ebp - 0xcc]
+mov dword [ebp - 0xb8], esi
+dec ecx
+dec edx
+mov dword [ebp - 0xdc], edx
+jne short loc_00015fc9 ; jne 0x15fc9
+jmp near loc_00016060 ; jmp 0x16060
+
+loc_00015f77:
+movsx esi, bl
+sub esi, 0x30
+imul esi, edx
+imul ebx, edx, 0xa
+add eax, esi
+dec dword [ebp - 0xdc]
+mov edx, ebx
+je near loc_00016060 ; je 0x16060
+
+loc_00015f93:
+mov ebx, dword [ebp - 0xdc]
+mov esi, dword [ebp - 0xe4]
+mov dword [ebp - 0xf0], eax
+mov ecx, ebx
+mov al, byte [esi + ebx]
+sub ecx, dword [ebp - 0xcc]
+add ecx, dword [ebp - 0xd8]
+mov esi, eax
+mov bl, al
+sub esi, 0x30
+mov eax, esi
+cmp al, 9
+mov eax, dword [ebp - 0xf0]
+jbe short loc_00015f77 ; jbe 0x15f77
+
+loc_00015fc9:
+mov dl, byte [ecx]
+lea ebx, [ecx - 1]
+mov ecx, dword [ebp - 0xdc]
+mov dword [ebp - 0xd8], ebx
+mov byte [ebp - 0xe4], dl
+dec ecx
+mov dword [ebp - 0xcc], ecx
+test eax, eax
+je short loc_0001604b ; je 0x1604b
+
+loc_00015feb:
+mov esi, dword [ebp - 0xb0]
+cmp esi, eax
+jle short loc_00016060 ; jle 0x16060
+lea ecx, [ebp - 0x9a]
+sub esi, eax
+add ecx, dword [ebp - 0xc8]
+xor edx, edx
+
+loc_00016005:
+cmp edx, esi
+je short loc_00016013 ; je 0x16013
+mov bl, byte [ecx + edx]
+mov byte [ecx + edx - 1], bl
+inc edx
+jmp short loc_00016005 ; jmp 0x16005
+
+loc_00016013:
+mov ecx, dword [ebp - 0xb0]
+dec dword [ebp - 0xc8]
+add ecx, dword [ebp - 0xc8]
+mov bl, byte [ebp - 0xe4]
+inc dword [ebp - 0xbc]
+sub ecx, eax
+inc dword [ebp - 0xe8]
+mov byte [ebp + ecx - 0x9a], bl
+mov dword [ebp - 0xb0], edx
+jmp near loc_00015ef8 ; jmp 0x15ef8
+
+loc_0001604b:
+cmp dword [ebp - 0xcc], 0
+jne near loc_00015ef8 ; jne 0x15ef8
+jmp short loc_00016060 ; jmp 0x16060
+
+loc_0001605a:
+mov dword [ebp - 0xb8], esi
+
+loc_00016060:
+cmp dword [ebp - 0xc0], 0
+js short loc_00016072 ; js 0x16072
+and dword [ebp - 0xb4], 0xffffffef
+jmp short loc_0001607c ; jmp 0x1607c
+
+loc_00016072:
+mov dword [ebp - 0xc0], 1
+
+loc_0001607c:
+mov ebx, dword [ebp - 0xbc]
+mov eax, dword [ebp - 0xc0]
+add eax, dword [ebp - 0xe8]
+cmp eax, ebx
+cmovl eax, ebx
+mov ebx, dword [ebp - 0xc4]
+xor ecx, ecx
+mov esi, eax
+mov eax, dword [ebp - 0xd0]
+mov edx, ebx
+add eax, esi
+sub edx, eax
+cmp eax, ebx
+cmovl ecx, edx
+mov edx, dword [ebp - 0xb4]
+xor eax, eax
+and edx, 4
+je short loc_000160bf ; je 0x160bf
+mov eax, ecx
+xor ecx, ecx
+
+loc_000160bf:
+test byte [ebp - 0xb4], 0x40
+je short loc_000160d7 ; je 0x160d7
+add eax, ecx
+xor ecx, ecx
+test edx, edx
+sete cl
+add ecx, eax
+sar ecx, 1
+sub eax, ecx
+
+loc_000160d7:
+sub esi, dword [ebp - 0xbc]
+mov edx, esi
+test byte [ebp - 0xb4], 0x10
+je short loc_000160ec ; je 0x160ec
+add edx, ecx
+xor ecx, ecx
+
+loc_000160ec:
+mov esi, dword [ebp - 0xbc]
+push ebx
+push ebx
+push eax
+lea eax, [ebp - 0x9a]
+sub eax, esi
+push esi
+add eax, 0x82
+push eax
+mov eax, dword [ebp + 8]
+push edx
+push dword [ebp - 0xd0]
+push dword [ebp - 0xec]
+lea edx, [ebp + 0xc]
+call fcn_000154de ; call 0x154de
+mov ebx, dword [ebp - 0xb8]
+add esp, 0x20
+
+loc_00016125:
+test eax, eax
+js near loc_00015610 ; js 0x15610
+
+loc_0001612d:
+add dword [ebp - 0xd4], eax
+lea eax, [edi + 1]
+jmp near loc_00015631 ; jmp 0x15631
+
+loc_0001613b:
+mov eax, dword [ebp - 0xd4]
+jmp short loc_00016176 ; jmp 0x16176
+
+loc_00016143:
+sub eax, ref_0002053c ; sub eax, 0x2053c
+inc edi
+mov eax, dword [eax*4 + ref_0002051c] ; mov eax, dword [eax*4 + 0x2051c]
+or dword [ebp - 0xb4], eax
+jmp near loc_00015666 ; jmp 0x15666
+
+loc_0001615b:
+mov edi, esi
+jmp near loc_00015820 ; jmp 0x15820
+
+loc_00016162:
+test eax, eax
+jne near loc_00015feb ; jne 0x15feb
+jmp near loc_00016060 ; jmp 0x16060
+
+loc_0001616f:
+add ebx, 4
+xor eax, eax
+jmp short loc_0001612d ; jmp 0x1612d
+
+loc_00016176:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001617e:
+push ebp
+mov edx, dword [ref_00029bb8] ; mov edx, dword [0x29bb8]
+mov ebp, esp
+mov eax, dword [ebp + 0xc]
+mov dword [eax], edx
+xor eax, eax
+pop ebp
+ret
+
+fcn_00016190:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0xc]
+pop ebp
+mov dword [ref_00029bb8], eax ; mov dword [0x29bb8], eax
+xor eax, eax
+ret
+
+fcn_0001619f:
+push ebp
+xor eax, eax
+mov ebp, esp
+pop ebp
+ret
+
+fcn_000161a6:
+push ebp
+mov ebp, esp
+pop ebp
+jmp near fcn_0001713e ; jmp 0x1713e
+
+fcn_000161af:
+push ebp
+mov ebp, esp
+push ebx
+mov ebx, eax
+push edx
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00016205 ; je 0x16205
+movzx eax, byte [ebx + 0xf]
+sub esp, 0xc
+push eax
+movzx eax, byte [ebx + 0xe]
+push eax
+movzx eax, byte [ebx + 0xd]
+push eax
+movzx eax, byte [ebx + 0xc]
+push eax
+movzx eax, byte [ebx + 0xb]
+push eax
+movzx eax, byte [ebx + 0xa]
+push eax
+movzx eax, byte [ebx + 9]
+push eax
+movzx eax, byte [ebx + 8]
+push eax
+movzx eax, word [ebx + 6]
+push eax
+movzx eax, word [ebx + 4]
+push eax
+push dword [ebx]
+push ref_0002545d ; push 0x2545d
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x40
+
+loc_00016205:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001620a:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 0xc]
+
+loc_00016216:
+mov esi, ref_00029b3c ; mov esi, 0x29b3c
+xor edi, edi
+
+loc_0001621d:
+cmp edi, dword [ref_00029cb0] ; cmp edi, dword [0x29cb0]
+jae short loc_00016267 ; jae 0x16267
+push eax
+add esi, 0xc
+push eax
+push dword [ebx + 4]
+push dword [esi + 0x7c]
+call fcn_00016ee8 ; call 0x16ee8
+add esp, 0x10
+test al, al
+je short loc_00016264 ; je 0x16264
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001625a ; je 0x1625a
+push esi
+push ref_00020584 ; push 0x20584
+push ref_00025491 ; push 0x25491
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001625a:
+mov eax, dword [ebx + 4]
+call fcn_000161af ; call 0x161af
+jmp short loc_00016267 ; jmp 0x16267
+
+loc_00016264:
+inc edi
+jmp short loc_0001621d ; jmp 0x1621d
+
+loc_00016267:
+cmp edi, dword [ref_00029cb0] ; cmp edi, dword [0x29cb0]
+jne short loc_000162a4 ; jne 0x162a4
+cmp edi, 0x13
+jbe short loc_0001629c ; jbe 0x1629c
+call fcn_00015479 ; call 0x15479
+mov ebx, 0x80000009
+test al, al
+je short loc_000162fc ; je 0x162fc
+push ecx
+push ref_00020584 ; push 0x20584
+push ref_000254a5 ; push 0x254a5
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp short loc_000162fc ; jmp 0x162fc
+
+loc_0001629c:
+lea eax, [edi + 1]
+mov dword [ref_00029cb0], eax ; mov dword [0x29cb0], eax
+
+loc_000162a4:
+imul edi, edi, 0xc
+mov ecx, 3
+mov esi, ebx
+add edi, ref_00029bc0 ; add edi, 0x29bc0
+rep movsd ; rep movsd dword es:[edi], dword ptr [esi]
+mov edi, ref_00029cb4 ; mov edi, 0x29cb4
+xor esi, esi
+
+loc_000162bd:
+cmp esi, dword [ref_00029da4] ; cmp esi, dword [0x29da4]
+jae short loc_000162ed ; jae 0x162ed
+push edx
+push edx
+push dword [ebx + 4]
+push dword [edi + 4]
+call fcn_00016ee8 ; call 0x16ee8
+add esp, 0x10
+test al, al
+je short loc_000162e7 ; je 0x162e7
+push eax
+push dword [ebx + 8]
+push edi
+push dword [ebp + 8]
+call dword [edi + 8] ; ucall
+add esp, 0x10
+
+loc_000162e7:
+inc esi
+add edi, 0xc
+jmp short loc_000162bd ; jmp 0x162bd
+
+loc_000162ed:
+mov eax, dword [ebx]
+add ebx, 0xc
+test eax, eax
+jns near loc_00016216 ; jns 0x16216
+xor ebx, ebx
+
+loc_000162fc:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00016306:
+push ebp
+mov ebp, esp
+push edi
+push esi
+mov esi, ref_00029bc0 ; mov esi, 0x29bc0
+push ebx
+xor ebx, ebx
+sub esp, 0xc
+
+loc_00016316:
+cmp ebx, dword [ref_00029cb0] ; cmp ebx, dword [0x29cb0]
+jae short loc_00016346 ; jae 0x16346
+push eax
+mov edi, esi
+push eax
+add esi, 0xc
+push dword [esi - 8]
+push dword [ebp + 0xc]
+call fcn_00016ee8 ; call 0x16ee8
+add esp, 0x10
+test al, al
+je short loc_00016343 ; je 0x16343
+mov eax, dword [ebp + 0x18]
+mov edx, dword [edi + 8]
+mov dword [eax], edx
+xor eax, eax
+jmp short loc_00016374 ; jmp 0x16374
+
+loc_00016343:
+inc ebx
+jmp short loc_00016316 ; jmp 0x16316
+
+loc_00016346:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00016367 ; je 0x16367
+push ebx
+push ref_0002056c ; push 0x2056c
+push ref_000254c0 ; push 0x254c0
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00016367:
+mov eax, dword [ebp + 0xc]
+call fcn_000161af ; call 0x161af
+mov eax, 0x8000000e
+
+loc_00016374:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001637c:
+push ebp
+xor eax, eax
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ref_00029da4] ; mov ebx, dword [0x29da4]
+imul edx, ebx, 0xc
+
+loc_00016390:
+cmp ebx, 0x13
+jbe short loc_000163b5 ; jbe 0x163b5
+call fcn_00015479 ; call 0x15479
+mov esi, 0x80000009
+test al, al
+je short loc_000163fc ; je 0x163fc
+push eax
+push ref_00020578 ; push 0x20578
+push ref_000254dd ; push 0x254dd
+push 0x80000000
+jmp short loc_000163f4 ; jmp 0x163f4
+
+loc_000163b5:
+mov esi, dword [ebp + 0xc]
+inc ebx
+mov ecx, 3
+mov dword [ref_00029da4], ebx ; mov dword [0x29da4], ebx
+lea edi, [eax + edx + ref_00029cb4] ; lea edi, [eax + edx + 0x29cb4]
+add esi, eax
+rep movsd ; rep movsd dword es:[edi], dword ptr [esi]
+mov edi, dword [ebp + 0xc]
+mov ecx, dword [edi + eax]
+add eax, 0xc
+test ecx, ecx
+jns short loc_00016390 ; jns 0x16390
+call fcn_00015479 ; call 0x15479
+xor esi, esi
+test al, al
+je short loc_000163fc ; je 0x163fc
+push ebx
+push ref_00020578 ; push 0x20578
+push ref_000254fd ; push 0x254fd
+push 0x40
+
+loc_000163f4:
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000163fc:
+lea esp, [ebp - 0xc]
+mov eax, esi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00016406:
+push ebp
+mov eax, ref_00029b3c ; mov eax, 0x29b3c
+mov ebp, esp
+pop ebp
+ret
+
+fcn_00016410:
+push ebp
+mov eax, dword [ref_00029bbc] ; mov eax, dword [0x29bbc]
+mov ebp, esp
+pop ebp
+ret
+
+fcn_0001641a:
+mov eax, dword [ref_00029dac] ; mov eax, dword [0x29dac]
+push ebp
+mov ebp, esp
+mov edx, dword [ebp + 8]
+test eax, eax
+je short loc_00016432 ; je 0x16432
+movzx edx, dl
+mov dword [ebp + 8], edx
+pop ebp
+jmp eax
+
+loc_00016432:
+pop ebp
+ret
+
+fcn_00016434:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+mov eax, dword [ebx]
+cmp eax, 0x16
+je short loc_0001645b ; je 0x1645b
+push ebx
+push 0x16
+push eax
+push ref_0002550e ; push 0x2550e
+call fcn_0001545e ; call 0x1545e
+add esp, 0x10
+xor eax, eax
+jmp near loc_000165b4 ; jmp 0x165b4
+
+loc_0001645b:
+mov eax, dword [ebx + 0xca]
+push ecx
+push ecx
+push 0x270
+push ref_00029b3c ; push 0x29b3c
+mov dword [ref_00029dac], eax ; mov dword [0x29dac], eax
+call fcn_00016fff ; call 0x16fff
+add esp, 0x10
+mov dword [ref_00029bbc], ebx ; mov dword [0x29bbc], ebx
+cmp dword [ebx + 8], 3
+mov dword [ref_00029b3c], 0xfeaddeaf ; mov dword [0x29b3c], 0xfeaddeaf
+jne short loc_000164b5 ; jne 0x164b5
+cmp dword [ebx + 0x8f6], 0
+je short loc_000164b5 ; je 0x164b5
+sub esp, 0xc
+push ref_00025532 ; push 0x25532
+call fcn_0001545e ; call 0x1545e
+add esp, 0x10
+mov dword [ref_00029bb8], 0x11 ; mov dword [0x29bb8], 0x11
+jmp short loc_000164bf ; jmp 0x164bf
+
+loc_000164b5:
+mov dword [ref_00029bb8], 6 ; mov dword [0x29bb8], 6
+
+loc_000164bf:
+sub esp, 0xc
+push ref_00029b38 ; push 0x29b38
+mov dword [ref_00029bc4], ref_0002909c ; mov dword [0x29bc4], 0x2909c
+mov dword [ref_00029cb0], 1 ; mov dword [0x29cb0], 1
+mov dword [ref_00029b60], fcn_00016306 ; mov dword [0x29b60], 0x16306
+mov dword [ref_00029b68], fcn_0001617e ; mov dword [0x29b68], 0x1617e
+mov dword [ref_00029b6c], fcn_00016190 ; mov dword [0x29b6c], 0x16190
+mov dword [ref_00029b70], fcn_0001d569 ; mov dword [0x29b70], 0x1d569
+mov dword [ref_00029b74], fcn_0001d49f ; mov dword [0x29b74], 0x1d49f
+mov dword [ref_00029b64], fcn_0001637c ; mov dword [0x29b64], 0x1637c
+mov dword [ref_00029b58], fcn_0001620a ; mov dword [0x29b58], 0x1620a
+mov dword [ref_00029b8c], fcn_0001d415 ; mov dword [0x29b8c], 0x1d415
+mov dword [ref_00029b90], fcn_000161a6 ; mov dword [0x29b90], 0x161a6
+mov dword [ref_00029bb4], fcn_0001619f ; mov dword [0x29bb4], 0x1619f
+mov dword [ref_00029b38], ref_00029b40 ; mov dword [0x29b38], 0x29b40
+call fcn_00019afc ; call 0x19afc
+pop eax
+pop edx
+push ref_00029b38 ; push 0x29b38
+push 0
+call fcn_0001ae82 ; call 0x1ae82
+mov dword [esp], ref_00025542 ; mov dword [esp], 0x25542
+call fcn_0001545e ; call 0x1545e
+pop ecx
+pop ebx
+push ref_00029b38 ; push 0x29b38
+push 0
+call fcn_00016cfa ; call 0x16cfa
+mov dword [esp], ref_00025557 ; mov dword [esp], 0x25557
+call fcn_0001545e ; call 0x1545e
+pop eax
+pop edx
+push ref_00029b38 ; push 0x29b38
+push 0
+call fcn_000165cb ; call 0x165cb
+pop ecx
+pop ebx
+push ref_00029b38 ; push 0x29b38
+push 0
+call fcn_0001b96b ; call 0x1b96b
+pop eax
+pop edx
+push ref_00029b38 ; push 0x29b38
+push 0
+call fcn_0001b0c6 ; call 0x1b0c6
+add esp, 0x10
+mov eax, ref_00029b38 ; mov eax, 0x29b38
+
+loc_000165b4:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000165b9:
+push ebp
+mov ebp, esp
+sub esp, 0x14
+push dword [ebp + 0x10]
+call fcn_0001bb03 ; call 0x1bb03
+xor eax, eax
+leave
+ret
+
+fcn_000165cb:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x10
+push ref_00029028 ; push 0x29028
+call fcn_0001972b ; call 0x1972b
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00016620 ; je 0x16620
+test ebx, ebx
+jns short loc_00016620 ; jns 0x16620
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001660b ; je 0x1660b
+push edx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001660b:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x42
+push ref_0002556e ; push 0x2556e
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00016620:
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00016627:
+push ebp
+xor eax, eax
+mov ebp, esp
+pop ebp
+ret
+
+fcn_0001662e:
+push ebp
+mov ebp, esp
+pop ebp
+ret
+
+fcn_00016633:
+push ebp
+mov ebp, esp
+pop ebp
+ret
+
+fcn_00016638:
+push ebp
+mov ebp, esp
+push edi
+push esi
+mov esi, edx
+push ebx
+sub esp, 0x2c
+mov edx, dword [ebp + 8]
+mov word [ebp - 0x2a], cx
+mov dword [ebp - 0x1c], 0x80000007
+test esi, esi
+je near loc_00016701 ; je 0x16701
+cmp cx, 0x1ff
+ja near loc_00016701 ; ja 0x16701
+mov edi, edx
+movzx edx, dx
+add edx, ecx
+cmp edx, 0x1ff
+jg near loc_00016701 ; jg 0x16701
+lea ecx, [edi + esi]
+movzx eax, al
+mov ebx, esi
+mov word [ebp - 0x2c], cx
+mov dword [ebp - 0x30], eax
+
+loc_00016686:
+cmp word [ebp - 0x2c], bx
+je short loc_000166fa ; je 0x166fa
+mov dx, word [ebp - 0x2a]
+mov edi, dword [ebp + 0xc]
+sub edx, esi
+movzx ecx, byte [edi]
+add edx, ebx
+mov eax, edx
+shr ax, 8
+cmp ax, cx
+je short loc_000166ab ; je 0x166ab
+mov byte [edi], al
+mov al, 1
+jmp short loc_000166ad ; jmp 0x166ad
+
+loc_000166ab:
+xor eax, eax
+
+loc_000166ad:
+dec al
+movzx edi, dl
+jne short loc_000166d2 ; jne 0x166d2
+mov eax, dword [ebp + 0xc]
+cmp byte [eax], 1
+push edx
+lea edx, [ebp - 0x1c]
+sbb eax, eax
+push edx
+and eax, 0xfffffffe
+push 0
+add eax, 0x6e
+push eax
+call fcn_0001a2fa ; call 0x1a2fa
+add esp, 0x10
+
+loc_000166d2:
+shl edi, 8
+push eax
+or edi, dword [ebp - 0x30]
+push eax
+lea eax, [ebp - 0x1c]
+push eax
+push edi
+mov dword [ebp - 0x34], ebx
+inc ebx
+call fcn_0001a282 ; call 0x1a282
+add esp, 0x10
+mov edx, dword [ebp - 0x34]
+mov byte [ebx - 1], al
+cmp dword [ebp - 0x1c], 0
+je short loc_00016686 ; je 0x16686
+mov byte [edx], 0
+
+loc_000166fa:
+mov dword [ebp - 0x1c], 0
+
+loc_00016701:
+mov eax, dword [ebp - 0x1c]
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001670c:
+push ebp
+mov ecx, 2
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x34
+mov esi, dword [ebp + 0x10]
+movzx eax, byte [ebp + 0xc]
+lea edi, [ebp - 0x19]
+push edi
+push 1
+lea edx, [esi + 2]
+mov byte [ebp - 0x19], 0xff
+mov dword [ebp - 0x30], eax
+call fcn_00016638 ; call 0x16638
+add esp, 0x10
+mov esi, eax
+test eax, eax
+jne short loc_000167a0 ; jne 0x167a0
+mov eax, dword [ebp + 0x18]
+xor edx, edx
+mov ecx, dword [ebp + 8]
+mov dword [ebp - 0x2c], 1
+mov ebx, dword [ebp + 0x14]
+shl dword [ebp - 0x2c], cl
+mov ecx, 5
+div ecx
+lea eax, [eax + eax*4]
+add eax, ebx
+mov dword [ebp - 0x34], eax
+
+loc_00016763:
+cmp ebx, dword [ebp - 0x34]
+je short loc_000167a0 ; je 0x167a0
+movzx eax, byte [ebx + 4]
+test dword [ebp - 0x2c], eax
+je short loc_0001679b ; je 0x1679b
+push eax
+mov edx, dword [ebp + 0x10]
+push eax
+movzx ecx, word [ebx]
+push edi
+mov ax, word [ebx + 2]
+add edx, ecx
+inc eax
+sub ax, word [ebx]
+movzx eax, ax
+push eax
+mov eax, dword [ebp - 0x30]
+call fcn_00016638 ; call 0x16638
+add esp, 0x10
+test eax, eax
+je short loc_0001679b ; je 0x1679b
+mov esi, eax
+jmp short loc_000167a0 ; jmp 0x167a0
+
+loc_0001679b:
+add ebx, 5
+jmp short loc_00016763 ; jmp 0x16763
+
+loc_000167a0:
+test esi, esi
+sete al
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000167ad:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000167ce ; je 0x167ce
+push eax
+push eax
+push dword [ebp + 8]
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000167ce:
+leave
+ret
+
+fcn_000167d0:
+push ebp
+mov ebp, esp
+mov edx, dword [ebp + 0x10]
+movzx eax, byte [ebp + 0x14]
+and edx, 7
+shl edx, 8
+or eax, 0x80000000
+or eax, edx
+movzx edx, byte [ebp + 8]
+shl edx, 0x10
+or eax, edx
+movzx edx, byte [ebp + 0xc]
+pop ebp
+shl edx, 0xb
+movzx edx, dx
+or eax, edx
+ret
+
+fcn_000167fe:
+push ebp
+mov ebp, esp
+movzx eax, byte [ebp + 0x10]
+movzx edx, byte [ebp + 0x14]
+shl eax, 0xc
+add edx, eax
+movzx eax, byte [ebp + 0xc]
+shl eax, 0xf
+add edx, eax
+movzx eax, byte [ebp + 8]
+pop ebp
+shl eax, 0x14
+add eax, edx
+ret
+
+fcn_00016822:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0xc
+mov edx, dword [ebp + 8]
+mov al, dl
+mov bl, dl
+sar al, 7
+and edx, 0x7f
+and eax, 2
+add eax, 0x74
+push edx
+movzx eax, al
+sar bl, 7
+push eax
+and ebx, 2
+call fcn_00018eea ; call 0x18eea
+add ebx, 0x75
+add esp, 0x10
+movzx ebx, bl
+mov dword [ebp + 8], ebx
+mov ebx, dword [ebp - 4]
+leave
+jmp near fcn_00018ee1 ; jmp 0x18ee1
+
+fcn_00016861:
+push ebp
+mov edx, 0xfffff
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+
+loc_00016878:
+push ecx
+push ecx
+push 0xa
+push 0x70
+mov dword [ebp - 0x1c], edx
+call fcn_00018eea ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1 ; call 0x18ee1
+add esp, 0x10
+mov edx, dword [ebp - 0x1c]
+test al, al
+jns short loc_000168a1 ; jns 0x168a1
+dec edx
+jne short loc_00016878 ; jne 0x16878
+jmp short loc_000168a5 ; jmp 0x168a5
+
+loc_000168a1:
+test edx, edx
+jne short loc_0001691b ; jne 0x1691b
+
+loc_000168a5:
+push eax
+push eax
+push 0xb
+push 0x70
+call fcn_00018eea ; call 0x18eea
+pop eax
+pop edx
+push 0x82
+push 0x71
+call fcn_00018eea ; call 0x18eea
+pop ecx
+pop eax
+push 0xa
+push 0x70
+call fcn_00018eea ; call 0x18eea
+pop eax
+pop edx
+push 0x26
+push 0x71
+call fcn_00018eea ; call 0x18eea
+pop ecx
+pop eax
+push 0xc
+push 0x70
+call fcn_00018eea ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1 ; call 0x18ee1
+pop eax
+pop edx
+push 0xd
+push 0x70
+call fcn_00018eea ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1 ; call 0x18ee1
+pop ecx
+pop eax
+push 0xb
+push 0x70
+call fcn_00018eea ; call 0x18eea
+pop eax
+pop edx
+push 2
+push 0x71
+call fcn_00018eea ; call 0x18eea
+add esp, 0x10
+
+loc_0001691b:
+push eax
+push eax
+push 0
+push 0x70
+call fcn_00018eea ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1 ; call 0x18ee1
+mov byte [edi], al
+pop edx
+pop ecx
+push 2
+push 0x70
+call fcn_00018eea ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1 ; call 0x18ee1
+mov byte [esi], al
+pop eax
+pop edx
+push 4
+push 0x70
+call fcn_00018eea ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1 ; call 0x18ee1
+mov byte [ebx], al
+pop ecx
+pop eax
+push 7
+push 0x70
+call fcn_00018eea ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1 ; call 0x18ee1
+mov edx, dword [ebp + 0x14]
+mov byte [edx], al
+pop eax
+pop edx
+push 8
+push 0x70
+call fcn_00018eea ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1 ; call 0x18ee1
+mov edx, dword [ebp + 0x18]
+mov byte [edx], al
+pop ecx
+pop eax
+push 9
+push 0x70
+call fcn_00018eea ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1 ; call 0x18ee1
+mov edx, dword [ebp + 0x1c]
+movzx eax, al
+mov word [edx], ax
+mov cl, byte [edi]
+mov dl, 0xa
+mov al, cl
+and ecx, 0xf
+shr al, 4
+imul eax, edx
+add eax, ecx
+mov byte [edi], al
+mov cl, byte [esi]
+mov edi, dword [ebp + 0x1c]
+mov al, cl
+and ecx, 0xf
+shr al, 4
+imul eax, edx
+add eax, ecx
+mov byte [esi], al
+mov cl, byte [ebx]
+mov esi, dword [ebp + 0x18]
+mov al, cl
+and ecx, 0xf
+shr al, 4
+imul eax, edx
+add eax, ecx
+mov byte [ebx], al
+mov eax, dword [ebp + 0x14]
+mov ebx, dword [ebp + 0x14]
+mov cl, byte [eax]
+mov al, cl
+and ecx, 0xf
+shr al, 4
+imul eax, edx
+add eax, ecx
+mov byte [ebx], al
+mov eax, dword [ebp + 0x18]
+mov cl, byte [eax]
+mov al, cl
+and ecx, 0xf
+shr al, 4
+imul eax, edx
+add eax, ecx
+mov byte [esi], al
+mov eax, dword [ebp + 0x1c]
+mov ax, word [eax]
+mov edx, eax
+and edx, 0xf
+shr ax, 4
+add esp, 0x10
+and eax, 0xf
+imul eax, eax, 0xa
+lea eax, [edx + eax + 0x7d0]
+mov word [edi], ax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00016a4e:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x10
+push 0xce
+call fcn_000175bc ; call 0x175bc
+add esp, 0x10
+xor edx, edx
+movzx ebx, ah
+xor eax, eax
+imul ebx, ebx, 0x186a0
+test ebx, ebx
+je short loc_00016a84 ; je 0x16a84
+call fcn_00017876 ; call 0x17876
+push ecx
+push ebx
+push edx
+push eax
+call fcn_000174b9 ; call 0x174b9
+add esp, 0x10
+
+loc_00016a84:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00016a89:
+push ebp
+xor edx, edx
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov ecx, dword [ebp + 0x10]
+
+loc_00016a94:
+cmp edx, dword [ebp + 0xc]
+je short loc_00016aa0 ; je 0x16aa0
+mov word [eax + edx*2], cx
+inc edx
+jmp short loc_00016a94 ; jmp 0x16a94
+
+loc_00016aa0:
+pop ebp
+ret
+
+fcn_00016aa2:
+push ebp
+xor edx, edx
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov ecx, dword [ebp + 0x10]
+
+loc_00016aad:
+cmp edx, dword [ebp + 0xc]
+je short loc_00016ab8 ; je 0x16ab8
+mov dword [eax + edx*4], ecx
+inc edx
+jmp short loc_00016aad ; jmp 0x16aad
+
+loc_00016ab8:
+pop ebp
+ret
+
+fcn_00016aba:
+push ebp
+mov ebp, esp
+push edi
+sub esp, 0x24
+mov eax, dword [ebp + 8]
+mov dword [ebp - 0x18], 0
+mov dword [ebp - 0x14], 0
+mov dword [ebp - 0x20], eax
+lea eax, [ebp - 0x10]
+mov dword [ebp - 0x1c], eax
+movq qword [ebp - 0x18], mm0
+mov edi, dword [ebp - 0x20]
+movq mm0, qword [edi]
+mov edi, dword [ebp - 0x1c]
+movq qword [edi], mm0
+movq mm0, qword [ebp - 0x18]
+emms
+mov eax, dword [ebp - 0x10]
+mov edx, dword [ebp - 0xc]
+add esp, 0x24
+pop edi
+pop ebp
+ret
+
+fcn_00016afd:
+push ebp
+mov ebp, esp
+push edi
+sub esp, 0x1c
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x10], 0
+mov dword [ebp - 0xc], 0
+mov dword [ebp - 0x20], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 8]
+mov dword [ebp - 0x14], eax
+movq qword [ebp - 0x10], mm0
+mov edi, dword [ebp - 0x14]
+movq mm0, qword [ebp - 0x20]
+movq qword [edi], mm0
+movq mm0, qword [ebp - 0x10]
+emms
+mov eax, dword [ebp - 0x20]
+mov edx, dword [ebp - 0x1c]
+add esp, 0x1c
+pop edi
+pop ebp
+ret
+
+fcn_00016b44:
+push ebp
+xor eax, eax
+mov ebp, esp
+push ebx
+mov ebx, 0x186a0
+sub esp, 0x14
+
+loc_00016b52:
+test eax, eax
+jne short loc_00016b9f ; jne 0x16b9f
+test ebx, ebx
+je short loc_00016b9f ; je 0x16b9f
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00016b74 ; je 0x16b74
+push edx
+push edx
+push ref_00025576 ; push 0x25576
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00016b74:
+clc
+
+loc_00016b75:
+rdrand eax
+mov dword [ebp - 0xc], eax
+jae short loc_00016b75 ; jae 0x16b75
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00016b99 ; je 0x16b99
+push eax
+push dword [ebp - 0xc]
+push ref_00025593 ; push 0x25593
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00016b99:
+mov eax, dword [ebp - 0xc]
+dec ebx
+jmp short loc_00016b52 ; jmp 0x16b52
+
+loc_00016b9f:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00016ba4:
+push ebp
+xor eax, eax
+mov ebp, esp
+pop ebp
+ret
+
+fcn_00016bab:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x14]
+pop ebp
+ret
+
+fcn_00016bb3:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+cmp dword [ebp + 0xc], 0x41
+mov edx, dword [eax + 0x241b]
+mov edx, dword [edx + 0x1e]
+jne short loc_00016bd8 ; jne 0x16bd8
+sub esp, 0xc
+push eax
+call dword [edx + 0xcc] ; ucall
+add esp, 0x10
+
+loc_00016bd8:
+xor eax, eax
+leave
+ret
+
+fcn_00016bdc:
+push ebp
+mov ebp, esp
+mov edx, dword [ebp + 8]
+mov eax, dword [ebp + 0xc]
+push esi
+push ebx
+mov word [edx + 0x2468], ax
+movzx esi, ax
+mov ebx, eax
+push edx
+push edx
+push esi
+push 0x80
+call fcn_00018f27 ; call 0x18f27
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00016c1d ; je 0x16c1d
+push eax
+push esi
+push ref_000255b1 ; push 0x255b1
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00016c1d:
+sub esp, 0xc
+push 0x48
+call fcn_00016822 ; call 0x16822
+mov dword [esp], 0x49
+mov esi, eax
+call fcn_00016822 ; call 0x16822
+add esp, 0x10
+mov edx, eax
+mov eax, esi
+shl edx, 8
+movzx esi, al
+or edx, esi
+cmp bx, dx
+je short loc_00016c1d ; je 0x16c1d
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00016c50:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00016c72 ; je 0x16c72
+push eax
+push dword [ebp + 0xc]
+push ref_000255c3 ; push 0x255c3
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00016c72:
+push eax
+mov eax, 0x1000
+in al, 0x99
+pop eax
+leave
+ret
+
+fcn_00016c7d:
+push ebp
+mov ebp, esp
+push ebx
+mov edx, cr4
+mov eax, edx
+or eax, 0x4000
+mov cr4, eax
+xor eax, eax
+mov ebx, eax
+getsec
+mov cr4, edx
+pop ebx
+pop ebp
+ret
+
+fcn_00016c9a:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+call fcn_00016410 ; call 0x16410
+mov ebx, dword [eax + 0x14]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00016cdd ; je 0x16cdd
+cmp dword [ebp + 8], 0xff
+ja short loc_00016cc5 ; ja 0x16cc5
+cmp dword [ebp + 0xc], 0x1f
+ja short loc_00016cc5 ; ja 0x16cc5
+cmp dword [ebp + 0x10], 7
+jbe short loc_00016cdd ; jbe 0x16cdd
+
+loc_00016cc5:
+push eax
+push ref_00025603 ; push 0x25603
+push 0x31a
+push ref_0002563a ; push 0x2563a
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00016cdd:
+mov eax, dword [ebp + 0x10]
+mov edx, dword [ebp + 0xc]
+shl eax, 0xc
+add eax, ebx
+mov ebx, dword [ebp - 4]
+shl edx, 0xf
+add eax, edx
+mov edx, dword [ebp + 8]
+leave
+shl edx, 0x14
+add eax, edx
+ret
+
+fcn_00016cfa:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+mov ebx, dword [ebp + 0xc]
+sub esp, 0xc
+push ebx
+call fcn_0001dfb2 ; call 0x1dfb2
+mov esi, eax
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00016d2a ; je 0x16d2a
+push ecx
+push ecx
+push ref_00025655 ; push 0x25655
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00016d2a:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00016d69 ; je 0x16d69
+test esi, esi
+jns short loc_00016d69 ; jns 0x16d69
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00016d54 ; je 0x16d54
+push edx
+push esi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00016d54:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x33
+push ref_00025683 ; push 0x25683
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00016d69:
+sub esp, 0xc
+push ebx
+call fcn_0001ecfb ; call 0x1ecfb
+mov esi, eax
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00016d91 ; je 0x16d91
+push eax
+push eax
+push ref_000256b9 ; push 0x256b9
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00016d91:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00016dd0 ; je 0x16dd0
+test esi, esi
+jns short loc_00016dd0 ; jns 0x16dd0
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00016dbb ; je 0x16dbb
+push eax
+push esi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00016dbb:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x3a
+push ref_00025683 ; push 0x25683
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00016dd0:
+sub esp, 0xc
+push ebx
+call fcn_0001ef8b ; call 0x1ef8b
+mov esi, eax
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00016df8 ; je 0x16df8
+push eax
+push eax
+push ref_000256e7 ; push 0x256e7
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00016df8:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00016e37 ; je 0x16e37
+test esi, esi
+jns short loc_00016e37 ; jns 0x16e37
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00016e22 ; je 0x16e22
+push eax
+push esi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00016e22:
+push esi
+push ref_000206f4 ; push 0x206f4
+push 0x43
+push ref_00025683 ; push 0x25683
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00016e37:
+sub esp, 0xc
+push ebx
+call fcn_0001d586 ; call 0x1d586
+mov ebx, eax
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00016e5f ; je 0x16e5f
+push ecx
+push ecx
+push ref_00025714 ; push 0x25714
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00016e5f:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00016e9e ; je 0x16e9e
+test ebx, ebx
+jns short loc_00016e9e ; jns 0x16e9e
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00016e89 ; je 0x16e89
+push edx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00016e89:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x4a
+push ref_00025683 ; push 0x25683
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00016e9e:
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00016ea7:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push esi
+add esi, 8
+call fcn_000173ed ; call 0x173ed
+add esp, 0xc
+push edx
+push eax
+push ebx
+call fcn_00017424 ; call 0x17424
+mov dword [esp], esi
+call fcn_000173ed ; call 0x173ed
+add esp, 0xc
+push edx
+push eax
+lea eax, [ebx + 8]
+push eax
+call fcn_00017424 ; call 0x17424
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00016ee8:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov esi, dword [ebp + 8]
+push esi
+add esi, 8
+call fcn_000173ed ; call 0x173ed
+mov ebx, eax
+pop eax
+push dword [ebp + 0xc]
+mov dword [ebp - 0x1c], edx
+call fcn_000173ed ; call 0x173ed
+mov dword [esp], esi
+mov dword [ebp - 0x20], eax
+mov dword [ebp - 0x24], edx
+call fcn_000173ed ; call 0x173ed
+mov edi, eax
+mov eax, dword [ebp + 0xc]
+mov esi, edx
+add eax, 8
+mov dword [esp], eax
+call fcn_000173ed ; call 0x173ed
+mov ecx, dword [ebp - 0x1c]
+add esp, 0x10
+xor eax, edi
+xor edx, esi
+or eax, edx
+sete al
+xor ebx, dword [ebp - 0x20]
+xor ecx, dword [ebp - 0x24]
+or ebx, ecx
+sete dl
+lea esp, [ebp - 0xc]
+and eax, edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00016f4f:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00016f80 ; je 0x16f80
+test bl, 3
+je short loc_00016f80 ; je 0x16f80
+push eax
+push ref_0002574a ; push 0x2574a
+push 0x81
+push ref_0002577c ; push 0x2577c
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00016f80:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00016fa9 ; je 0x16fa9
+mov eax, ebx
+neg eax
+cmp esi, eax
+jbe short loc_00016fa9 ; jbe 0x16fa9
+push ecx
+push ref_000257be ; push 0x257be
+push 0x82
+push ref_0002577c ; push 0x2577c
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00016fa9:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00016fd2 ; je 0x16fd2
+test esi, 0xf
+je short loc_00016fd2 ; je 0x16fd2
+push edx
+push ref_000257e9 ; push 0x257e9
+push 0x83
+push ref_0002577c ; push 0x2577c
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00016fd2:
+and esi, 0xfffffff0
+add esi, ebx
+
+loc_00016fd7:
+cmp ebx, esi
+jae short loc_00016ff2 ; jae 0x16ff2
+push eax
+push eax
+push dword [ebp + 0x10]
+push ebx
+call fcn_00016ee8 ; call 0x16ee8
+add esp, 0x10
+test al, al
+jne short loc_00016ff6 ; jne 0x16ff6
+add ebx, 0x10
+jmp short loc_00016fd7 ; jmp 0x16fd7
+
+loc_00016ff2:
+xor eax, eax
+jmp short loc_00016ff8 ; jmp 0x16ff8
+
+loc_00016ff6:
+mov eax, ebx
+
+loc_00016ff8:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00016fff:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017030 ; je 0x17030
+test ebx, ebx
+jne short loc_00017030 ; jne 0x17030
+test esi, esi
+je short loc_00017030 ; je 0x17030
+push edx
+push ref_00025811 ; push 0x25811
+push 0x31
+push ref_00025839 ; push 0x25839
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017030:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017056 ; je 0x17056
+mov eax, ebx
+neg eax
+cmp esi, eax
+jbe short loc_00017056 ; jbe 0x17056
+push eax
+push ref_000257be ; push 0x257be
+push 0x32
+push ref_00025839 ; push 0x25839
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017056:
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], ebx
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near loc_0001721c ; jmp 0x1721c
+
+fcn_00017067:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov edi, dword [ebp + 0x10]
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+test edi, edi
+je near loc_00017134 ; je 0x17134
+cmp ebx, esi
+je near loc_00017134 ; je 0x17134
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000170ab ; je 0x170ab
+test ebx, ebx
+jne short loc_000170ab ; jne 0x170ab
+push eax
+push ref_0002587f ; push 0x2587f
+push 0x3c
+push ref_000258a1 ; push 0x258a1
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000170ab:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000170cd ; je 0x170cd
+test esi, esi
+jne short loc_000170cd ; jne 0x170cd
+push ecx
+push ref_000258ea ; push 0x258ea
+push 0x3d
+push ref_000258a1 ; push 0x258a1
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000170cd:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000170f6 ; je 0x170f6
+mov eax, ebx
+lea edx, [edi - 1]
+not eax
+cmp edx, eax
+jbe short loc_000170f6 ; jbe 0x170f6
+push edx
+push ref_00025907 ; push 0x25907
+push 0x3e
+push ref_000258a1 ; push 0x258a1
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000170f6:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001711f ; je 0x1711f
+mov eax, esi
+lea edx, [edi - 1]
+not eax
+cmp edx, eax
+jbe short loc_0001711f ; jbe 0x1711f
+push eax
+push ref_0002593f ; push 0x2593f
+push 0x3f
+push ref_000258a1 ; push 0x258a1
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001711f:
+mov dword [ebp + 0x10], edi
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], ebx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_000171c9 ; jmp 0x171c9
+
+loc_00017134:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001713e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 0x10]
+mov ebx, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+test esi, esi
+je short loc_000171bf ; je 0x171bf
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001717d ; je 0x1717d
+mov eax, ebx
+lea edx, [esi - 1]
+not eax
+cmp edx, eax
+jbe short loc_0001717d ; jbe 0x1717d
+push edx
+push ref_00025907 ; push 0x25907
+push 0x38
+push ref_00025972 ; push 0x25972
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001717d:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000171a6 ; je 0x171a6
+mov eax, edi
+lea edx, [esi - 1]
+not eax
+cmp edx, eax
+jbe short loc_000171a6 ; jbe 0x171a6
+push eax
+push ref_0002593f ; push 0x2593f
+push 0x39
+push ref_00025972 ; push 0x25972
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000171a6:
+cmp ebx, edi
+je short loc_000171bf ; je 0x171bf
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], edi
+mov dword [ebp + 8], ebx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_000171e6 ; jmp 0x171e6
+
+loc_000171bf:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+loc_000171c9:
+push esi
+push edi
+mov esi, dword [esp + 0xc]
+mov edi, dword [esp + 0x10]
+mov ecx, dword [esp + 0x14]
+repe cmpsb ; repe cmpsb byte [esi], byte ptr es:[edi]
+movzx eax, byte [esi - 1]
+movzx edx, byte [edi - 1]
+sub eax, edx
+pop edi
+pop esi
+ret
+
+loc_000171e6:
+push esi
+push edi
+mov esi, dword [esp + 0x10]
+mov edi, dword [esp + 0xc]
+mov edx, dword [esp + 0x14]
+cmp edi, esi
+je short loc_00017215 ; je 0x17215
+cmp edx, 0
+je short loc_00017215 ; je 0x17215
+lea eax, [esi + edx - 1]
+cmp esi, edi
+jae short loc_00017210 ; jae 0x17210
+cmp eax, edi
+jb short loc_00017210 ; jb 0x17210
+mov esi, eax
+lea edi, [edi + edx - 1]
+std
+
+loc_00017210:
+mov ecx, edx
+rep movsb ; rep movsb byte es:[edi], byte ptr [esi]
+cld
+
+loc_00017215:
+mov eax, dword [esp + 0xc]
+pop edi
+pop esi
+ret
+
+loc_0001721c:
+push edi
+xor eax, eax
+mov edi, dword [esp + 8]
+mov ecx, dword [esp + 0xc]
+mov edx, ecx
+shr ecx, 2
+and edx, 3
+push edi
+rep stosd ; rep stosd dword es:[edi], eax
+mov ecx, edx
+rep stosb ; rep stosb byte es:[edi], al
+pop eax
+pop edi
+ret
+
+fcn_00017239:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+mov dword [ebp - 4], 0
+
+loc_00017246:
+mov eax, dword [ebp - 4]
+test eax, eax
+je short loc_00017246 ; je 0x17246
+leave
+ret
+
+fcn_0001724f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017284 ; je 0x17284
+cmp ebx, 0x3f
+jbe short loc_00017284 ; jbe 0x17284
+push eax
+push ref_000259b8 ; push 0x259b8
+push 0x27
+push ref_000259c3 ; push 0x259c3
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017284:
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 8], esi
+mov dword [ebp + 0xc], edi
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_000178a0 ; jmp 0x178a0
+
+fcn_00017299:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000172c3 ; je 0x172c3
+test ebx, ebx
+jne short loc_000172c3 ; jne 0x172c3
+push eax
+push ref_0002619a ; push 0x2619a
+push 0x26
+push ref_000259f8 ; push 0x259f8
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000172c3:
+mov ax, word [ebx]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000172cb:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000172f8 ; je 0x172f8
+test esi, esi
+jne short loc_000172f8 ; jne 0x172f8
+push eax
+push ref_0002619a ; push 0x2619a
+push 0x41
+push ref_000259f8 ; push 0x259f8
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000172f8:
+mov word [esi], bx
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00017304:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001732e ; je 0x1732e
+test ebx, ebx
+jne short loc_0001732e ; jne 0x1732e
+push eax
+push ref_0002619a ; push 0x2619a
+push 0x59
+push ref_000259f8 ; push 0x259f8
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001732e:
+mov eax, dword [ebx]
+mov ebx, dword [ebp - 4]
+leave
+and eax, 0xffffff
+ret
+
+fcn_0001733a:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017367 ; je 0x17367
+test ebx, ebx
+jne short loc_00017367 ; jne 0x17367
+push eax
+push ref_0002619a ; push 0x2619a
+push 0x74
+push ref_000259f8 ; push 0x259f8
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017367:
+push esi
+push 0x17
+push 0
+push dword [ebx]
+call fcn_0001f9ae ; call 0x1f9ae
+mov dword [ebx], eax
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001737e:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000173ab ; je 0x173ab
+test ebx, ebx
+jne short loc_000173ab ; jne 0x173ab
+push eax
+push ref_0002619a ; push 0x2619a
+push 0x8d
+push ref_000259f8 ; push 0x259f8
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000173ab:
+mov eax, dword [ebx]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000173b2:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000173e2 ; je 0x173e2
+test esi, esi
+jne short loc_000173e2 ; jne 0x173e2
+push eax
+push ref_0002619a ; push 0x2619a
+push 0xa8
+push ref_000259f8 ; push 0x259f8
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000173e2:
+mov dword [esi], ebx
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_000173ed:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001741a ; je 0x1741a
+test ebx, ebx
+jne short loc_0001741a ; jne 0x1741a
+push eax
+push ref_0002619a ; push 0x2619a
+push 0xc0
+push ref_000259f8 ; push 0x259f8
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001741a:
+mov eax, dword [ebx]
+mov edx, dword [ebx + 4]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00017424:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+mov edx, dword [ebp + 0x10]
+mov ebx, dword [ebp + 8]
+mov esi, eax
+mov edi, edx
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001745f ; je 0x1745f
+test ebx, ebx
+jne short loc_0001745f ; jne 0x1745f
+push eax
+push ref_0002619a ; push 0x2619a
+push 0xdb
+push ref_000259f8 ; push 0x259f8
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001745f:
+mov dword [ebx], esi
+mov eax, esi
+mov edx, edi
+mov dword [ebx + 4], edi
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00017470:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000174a4 ; je 0x174a4
+test ebx, ebx
+jne short loc_000174a4 ; jne 0x174a4
+push eax
+push ref_00025a2d ; push 0x25a2d
+push 0x2b
+push ref_00025a3a ; push 0x25a3a
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000174a4:
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 8], esi
+mov dword [ebp + 0xc], edi
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_00017557 ; jmp 0x17557
+
+fcn_000174b9:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000174ed ; je 0x174ed
+test ebx, ebx
+jne short loc_000174ed ; jne 0x174ed
+push eax
+push ref_00025a2d ; push 0x25a2d
+push 0x2b
+push ref_00025a6f ; push 0x25a6f
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000174ed:
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 8], esi
+mov dword [ebp + 0xc], edi
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_0001756c ; jmp 0x1756c
+
+fcn_00017502:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0x14]
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov dword [ebp - 0x1c], eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001753c ; je 0x1753c
+test ebx, ebx
+jne short loc_0001753c ; jne 0x1753c
+push eax
+push ref_00025a2d ; push 0x25a2d
+push 0x2f
+push ref_00025aa4 ; push 0x25aa4
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001753c:
+mov eax, dword [ebp - 0x1c]
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 8], esi
+mov dword [ebp + 0xc], edi
+mov dword [ebp + 0x14], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_00017581 ; jmp 0x17581
+
+loc_00017557:
+mov eax, dword [esp + 8]
+mov ecx, dword [esp + 0xc]
+xor edx, edx
+div ecx
+mov eax, dword [esp + 4]
+div ecx
+mov eax, edx
+ret
+
+loc_0001756c:
+mov eax, dword [esp + 8]
+mov ecx, dword [esp + 0xc]
+xor edx, edx
+div ecx
+push eax
+mov eax, dword [esp + 8]
+div ecx
+pop edx
+ret
+
+loc_00017581:
+mov ecx, dword [esp + 0xc]
+mov eax, dword [esp + 8]
+xor edx, edx
+div ecx
+push eax
+mov eax, dword [esp + 8]
+div ecx
+mov ecx, dword [esp + 0x14]
+jecxz loc_0001759c ; jecxz 0x1759c
+mov dword [ecx], edx
+
+loc_0001759c:
+pop edx
+ret
+
+fcn_0001759e:
+push ebp
+mov ebp, esp
+pop ebp
+ret
+
+fcn_000175a3:
+push ebp
+mov ebp, esp
+sti
+pop ebp
+ret
+
+fcn_000175a9:
+push ebp
+mov ebp, esp
+cli
+pop ebp
+ret
+
+fcn_000175af:
+push ebp
+mov ebp, esp
+pause
+pop ebp
+ret
+
+fcn_000175b6:
+push ebp
+mov ebp, esp
+int3
+pop ebp
+ret
+
+fcn_000175bc:
+push ebp
+mov ebp, esp
+mov ecx, dword [ebp + 8]
+rdmsr
+pop ebp
+ret
+
+fcn_000175c6:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0xc]
+mov edx, dword [ebp + 0x10]
+mov ecx, dword [ebp + 8]
+wrmsr
+pop ebp
+ret
+
+fcn_000175d6:
+push ebp
+mov ebp, esp
+pushfd
+pop eax
+pop ebp
+ret
+
+fcn_000175dd:
+push ebp
+mov ebp, esp
+mov eax, cr0
+pop ebp
+ret
+
+fcn_000175e5:
+push ebp
+mov ebp, esp
+mov eax, cr2
+pop ebp
+ret
+
+fcn_000175ed:
+push ebp
+mov ebp, esp
+mov eax, cr3
+pop ebp
+ret
+
+fcn_000175f5:
+push ebp
+mov ebp, esp
+mov eax, cr4
+pop ebp
+ret
+
+fcn_000175fd:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov cr0, eax
+pop ebp
+ret
+
+fcn_00017608:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov cr2, eax
+pop ebp
+ret
+
+fcn_00017613:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov cr3, eax
+pop ebp
+ret
+
+fcn_0001761e:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov cr4, eax
+pop ebp
+ret
+
+fcn_00017629:
+push ebp
+mov ebp, esp
+mov eax, dr0
+pop ebp
+ret
+
+fcn_00017631:
+push ebp
+mov ebp, esp
+mov eax, dr1
+pop ebp
+ret
+
+fcn_00017639:
+push ebp
+mov ebp, esp
+mov eax, dr2
+pop ebp
+ret
+
+fcn_00017641:
+push ebp
+mov ebp, esp
+mov eax, dr3
+pop ebp
+ret
+
+fcn_00017649:
+push ebp
+mov ebp, esp
+mov eax, dr4
+pop ebp
+ret
+
+fcn_00017651:
+push ebp
+mov ebp, esp
+mov eax, dr5
+pop ebp
+ret
+
+fcn_00017659:
+push ebp
+mov ebp, esp
+mov eax, dr6
+pop ebp
+ret
+
+fcn_00017661:
+push ebp
+mov ebp, esp
+mov eax, dr7
+pop ebp
+ret
+
+fcn_00017669:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov dr0, eax
+pop ebp
+ret
+
+fcn_00017674:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov dr1, eax
+pop ebp
+ret
+
+fcn_0001767f:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov dr2, eax
+pop ebp
+ret
+
+fcn_0001768a:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov dr3, eax
+pop ebp
+ret
+
+fcn_00017695:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov dr4, eax
+pop ebp
+ret
+
+fcn_000176a0:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov dr5, eax
+pop ebp
+ret
+
+fcn_000176ab:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov dr6, eax
+pop ebp
+ret
+
+fcn_000176b6:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov dr7, eax
+pop ebp
+ret
+
+fcn_000176c1:
+push ebp
+mov ebp, esp
+mov ax, cs
+pop ebp
+ret
+
+fcn_000176c9:
+push ebp
+mov ebp, esp
+mov ax, ds
+pop ebp
+ret
+
+fcn_000176d1:
+push ebp
+mov ebp, esp
+mov ax, es
+pop ebp
+ret
+
+fcn_000176d9:
+push ebp
+mov ebp, esp
+mov ax, fs
+pop ebp
+ret
+
+fcn_000176e1:
+push ebp
+mov ebp, esp
+mov ax, gs
+pop ebp
+ret
+
+fcn_000176e9:
+push ebp
+mov ebp, esp
+mov ax, ds
+pop ebp
+ret
+
+fcn_000176f1:
+push ebp
+mov ebp, esp
+str ax
+pop ebp
+ret
+
+fcn_000176fa:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+sgdt [eax]
+pop ebp
+ret
+
+fcn_00017705:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+lgdt [eax]
+pop ebp
+ret
+
+fcn_00017710:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+sidt [eax]
+pop ebp
+ret
+
+fcn_0001771b:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+lidt [eax]
+pop ebp
+ret
+
+fcn_00017726:
+push ebp
+mov ebp, esp
+sldt ax
+pop ebp
+ret
+
+fcn_0001772f:
+push ebp
+mov ebp, esp
+lldt word [ebp + 8]
+pop ebp
+ret
+
+fcn_00017738:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+fxsave [eax]
+pop ebp
+ret
+
+fcn_00017743:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+fxrstor [eax]
+pop ebp
+ret
+
+fcn_0001774e:
+push ebp
+mov ebp, esp
+push eax
+push eax
+movq qword [esp], mm0
+pop eax
+pop edx
+pop ebp
+ret
+
+fcn_0001775b:
+push ebp
+mov ebp, esp
+push eax
+push eax
+movq qword [esp], mm1
+pop eax
+pop edx
+pop ebp
+ret
+
+fcn_00017768:
+push ebp
+mov ebp, esp
+push eax
+push eax
+movq qword [esp], mm2
+pop eax
+pop edx
+pop ebp
+ret
+
+fcn_00017775:
+push ebp
+mov ebp, esp
+push eax
+push eax
+movq qword [esp], mm3
+pop eax
+pop edx
+pop ebp
+ret
+
+fcn_00017782:
+push ebp
+mov ebp, esp
+push eax
+push eax
+movq qword [esp], mm4
+pop eax
+pop edx
+pop ebp
+ret
+
+fcn_0001778f:
+push ebp
+mov ebp, esp
+push eax
+push eax
+movq qword [esp], mm5
+pop eax
+pop edx
+pop ebp
+ret
+
+fcn_0001779c:
+push ebp
+mov ebp, esp
+push eax
+push eax
+movq qword [esp], mm6
+pop eax
+pop edx
+pop ebp
+ret
+
+fcn_000177a9:
+push ebp
+mov ebp, esp
+push eax
+push eax
+movq qword [esp], mm7
+pop eax
+pop edx
+pop ebp
+ret
+
+fcn_000177b6:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov dword [ebp - 8], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 4], eax
+movq mm0, qword [ebp - 8]
+leave
+ret
+
+fcn_000177ce:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov dword [ebp - 8], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 4], eax
+movq mm1, qword [ebp - 8]
+leave
+ret
+
+fcn_000177e6:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov dword [ebp - 8], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 4], eax
+movq mm2, qword [ebp - 8]
+leave
+ret
+
+fcn_000177fe:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov dword [ebp - 8], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 4], eax
+movq mm3, qword [ebp - 8]
+leave
+ret
+
+fcn_00017816:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov dword [ebp - 8], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 4], eax
+movq mm4, qword [ebp - 8]
+leave
+ret
+
+fcn_0001782e:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov dword [ebp - 8], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 4], eax
+movq mm5, qword [ebp - 8]
+leave
+ret
+
+fcn_00017846:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov dword [ebp - 8], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 4], eax
+movq mm6, qword [ebp - 8]
+leave
+ret
+
+fcn_0001785e:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov dword [ebp - 8], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 4], eax
+movq mm7, qword [ebp - 8]
+leave
+ret
+
+fcn_00017876:
+push ebp
+mov ebp, esp
+rdtsc
+pop ebp
+ret
+
+fcn_0001787d:
+push ebp
+mov ebp, esp
+mov ecx, dword [ebp + 8]
+rdpmc
+pop ebp
+ret
+
+fcn_00017887:
+push ebp
+mov ebp, esp
+wbinvd
+pop ebp
+ret
+
+fcn_0001788e:
+push ebp
+mov ebp, esp
+invd
+pop ebp
+ret
+
+fcn_00017895:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+clflush [eax]
+pop ebp
+ret
+
+loc_000178a0:
+mov cl, byte [esp + 0xc]
+xor edx, edx
+mov eax, dword [esp + 8]
+test cl, 0x20
+cmove edx, eax
+cmove eax, dword [esp + 4]
+shrd eax, edx, cl
+shr edx, cl
+ret
+
+fcn_000178bb:
+push ebp
+mov ebp, esp
+sub esp, 0x14
+push dword [ebp + 8]
+call fcn_000175bc ; call 0x175bc
+leave
+ret
+
+fcn_000178cb:
+push ebp
+xor edx, edx
+mov ebp, esp
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+push edx
+push eax
+push dword [ebp + 8]
+call fcn_000175c6 ; call 0x175c6
+leave
+ret
+
+fcn_000178e2:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0x10]
+push ebx
+mov ebx, dword [ebp + 0xc]
+sub esp, 0xc
+push dword [ebp + 8]
+call fcn_000178bb ; call 0x178bb
+add esp, 0x10
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], ebx
+mov dword [ebp + 8], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_0001f7b4 ; jmp 0x1f7b4
+
+fcn_0001790f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_000175bc ; call 0x175bc
+add esp, 0x10
+mov dword [ebp + 8], edi
+or eax, esi
+or edx, ebx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_000175c6 ; jmp 0x175c6
+
+fcn_00017943:
+push ebp
+xor edx, edx
+mov ebp, esp
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+push edx
+push eax
+push dword [ebp + 8]
+call fcn_0001790f ; call 0x1790f
+leave
+ret
+
+fcn_0001795a:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_000175bc ; call 0x175bc
+add esp, 0x10
+mov dword [ebp + 8], edi
+and eax, esi
+and edx, ebx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_000175c6 ; jmp 0x175c6
+
+fcn_0001798e:
+push ebp
+xor edx, edx
+mov ebp, esp
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+push edx
+push eax
+push dword [ebp + 8]
+call fcn_0001795a ; call 0x1795a
+leave
+ret
+
+fcn_000179a5:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov eax, dword [ebp + 0x14]
+mov ecx, dword [ebp + 0x18]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov esi, dword [ebp + 0x10]
+mov dword [ebp - 0x1c], eax
+mov dword [ebp - 0x20], ecx
+call fcn_000175bc ; call 0x175bc
+add esp, 0x10
+mov dword [ebp + 8], ebx
+and eax, edi
+and edx, esi
+or eax, dword [ebp - 0x1c]
+or edx, dword [ebp - 0x20]
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_000175c6 ; jmp 0x175c6
+
+fcn_000179eb:
+push ebp
+xor edx, edx
+mov ebp, esp
+sub esp, 0x14
+mov eax, dword [ebp + 0x10]
+push edx
+xor edx, edx
+push eax
+mov eax, dword [ebp + 0xc]
+push edx
+push eax
+push dword [ebp + 8]
+call fcn_000179a5 ; call 0x179a5
+leave
+ret
+
+fcn_00017a09:
+push ebp
+mov ebp, esp
+sub esp, 0x14
+push dword [ebp + 8]
+call fcn_000175bc ; call 0x175bc
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push edx
+push eax
+call fcn_0001fa1d ; call 0x1fa1d
+leave
+ret
+
+fcn_00017a26:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ecx, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+push ecx
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x1c], eax
+call fcn_000175bc ; call 0x175bc
+pop ecx
+pop ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001fd53 ; call 0x1fd53
+mov ecx, dword [ebp - 0x20]
+add esp, 0x20
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_000175c6 ; jmp 0x175c6
+
+fcn_00017a74:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017aa5 ; je 0x17aa5
+cmp ebx, 0x1f
+jbe short loc_00017aa5 ; jbe 0x17aa5
+push edx
+push ref_00025ae2 ; push 0x25ae2
+push 0xe3
+push ref_00025afe ; push 0x25afe
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017aa5:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017aca ; je 0x17aca
+cmp esi, ebx
+jbe short loc_00017aca ; jbe 0x17aca
+push eax
+push ref_00025b30 ; push 0x25b30
+push 0xe4
+push ref_00025afe ; push 0x25afe
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017aca:
+mov eax, dword [ebp + 0x14]
+sub esp, 0xc
+xor edx, edx
+push edx
+push eax
+push ebx
+push esi
+push dword [ebp + 8]
+call fcn_00017a26 ; call 0x17a26
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00017ae5:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ecx, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+push ecx
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x1c], eax
+call fcn_000175bc ; call 0x175bc
+pop ecx
+pop ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001faac ; call 0x1faac
+mov ecx, dword [ebp - 0x20]
+add esp, 0x20
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_000175c6 ; jmp 0x175c6
+
+fcn_00017b33:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017b64 ; je 0x17b64
+cmp ebx, 0x1f
+jbe short loc_00017b64 ; jbe 0x17b64
+push edx
+push ref_00025b43 ; push 0x25b43
+push 0x10c
+push ref_00025afe ; push 0x25afe
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017b64:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017b89 ; je 0x17b89
+cmp esi, ebx
+jbe short loc_00017b89 ; jbe 0x17b89
+push eax
+push ref_00025b30 ; push 0x25b30
+push 0x10d
+push ref_00025afe ; push 0x25afe
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017b89:
+mov eax, dword [ebp + 0x14]
+sub esp, 0xc
+xor edx, edx
+push edx
+push eax
+push ebx
+push esi
+push dword [ebp + 8]
+call fcn_00017ae5 ; call 0x17ae5
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00017ba4:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ecx, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+push ecx
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x1c], eax
+call fcn_000175bc ; call 0x175bc
+pop ecx
+pop ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001fb9e ; call 0x1fb9e
+mov ecx, dword [ebp - 0x20]
+add esp, 0x20
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_000175c6 ; jmp 0x175c6
+
+fcn_00017bf2:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017c23 ; je 0x17c23
+cmp ebx, 0x1f
+jbe short loc_00017c23 ; jbe 0x17c23
+push edx
+push ref_00025b60 ; push 0x25b60
+push 0x135
+push ref_00025afe ; push 0x25afe
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017c23:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017c48 ; je 0x17c48
+cmp esi, ebx
+jbe short loc_00017c48 ; jbe 0x17c48
+push eax
+push ref_00025b30 ; push 0x25b30
+push 0x136
+push ref_00025afe ; push 0x25afe
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017c48:
+mov eax, dword [ebp + 0x14]
+sub esp, 0xc
+xor edx, edx
+push edx
+push eax
+push ebx
+push esi
+push dword [ebp + 8]
+call fcn_00017ba4 ; call 0x17ba4
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00017c63:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov eax, dword [ebp + 0x10]
+mov ecx, dword [ebp + 8]
+mov edi, dword [ebp + 0x20]
+mov edx, dword [ebp + 0x18]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x14]
+mov esi, dword [ebp + 0x1c]
+push ecx
+mov ebx, dword [ebp + 0xc]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x28], eax
+mov dword [ebp - 0x24], edx
+call fcn_000175bc ; call 0x175bc
+push edi
+push esi
+push dword [ebp - 0x24]
+push dword [ebp - 0x28]
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001fc9c ; call 0x1fc9c
+mov ecx, dword [ebp - 0x20]
+add esp, 0x30
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_000175c6 ; jmp 0x175c6
+
+fcn_00017cc1:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017cf2 ; je 0x17cf2
+cmp ebx, 0x1f
+jbe short loc_00017cf2 ; jbe 0x17cf2
+push ecx
+push ref_00025b60 ; push 0x25b60
+push 0x163
+push ref_00025afe ; push 0x25afe
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017cf2:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017d17 ; je 0x17d17
+cmp esi, ebx
+jbe short loc_00017d17 ; jbe 0x17d17
+push edx
+push ref_00025b30 ; push 0x25b30
+push 0x164
+push ref_00025afe ; push 0x25afe
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017d17:
+push eax
+mov eax, dword [ebp + 0x18]
+xor edx, edx
+push edx
+xor edx, edx
+push eax
+mov eax, dword [ebp + 0x14]
+push edx
+push eax
+push ebx
+push esi
+push dword [ebp + 8]
+call fcn_00017c63 ; call 0x17c63
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00017d37:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017d5b ; je 0x17d5b
+push eax
+push ref_00022281 ; push 0x22281
+push 0x26
+push ref_00025b7e ; push 0x25b7e
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017d5b:
+xor eax, eax
+xor edx, edx
+leave
+ret
+
+fcn_00017d61:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017d85 ; je 0x17d85
+push eax
+push ref_00022281 ; push 0x22281
+push 0x41
+push ref_00025b7e ; push 0x25b7e
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017d85:
+xor eax, eax
+xor edx, edx
+leave
+ret
+
+fcn_00017d8b:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+call fcn_0001759e ; call 0x1759e
+mov eax, dword [ebp + 8]
+mov bl, byte [eax]
+call fcn_0001759e ; call 0x1759e
+pop edx
+mov al, bl
+pop ebx
+pop ebp
+ret
+
+fcn_00017da5:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 0xc]
+call fcn_0001759e ; call 0x1759e
+mov eax, dword [ebp + 8]
+mov byte [eax], bl
+call fcn_0001759e ; call 0x1759e
+mov al, bl
+pop edx
+pop ebx
+pop ebp
+ret
+
+fcn_00017dc2:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017df0 ; je 0x17df0
+test bl, 1
+je short loc_00017df0 ; je 0x17df0
+push eax
+push ref_00025bba ; push 0x25bba
+push 0x97
+push ref_00025b7e ; push 0x25b7e
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017df0:
+call fcn_0001759e ; call 0x1759e
+mov bx, word [ebx]
+call fcn_0001759e ; call 0x1759e
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00017e04:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017e38 ; je 0x17e38
+test esi, 1
+je short loc_00017e38 ; je 0x17e38
+push eax
+push ref_00025bba ; push 0x25bba
+push 0xb7
+push ref_00025b7e ; push 0x25b7e
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017e38:
+call fcn_0001759e ; call 0x1759e
+mov word [esi], bx
+call fcn_0001759e ; call 0x1759e
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00017e4e:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017e7c ; je 0x17e7c
+test bl, 3
+je short loc_00017e7c ; je 0x17e7c
+push eax
+push ref_00025bcd ; push 0x25bcd
+push 0xd7
+push ref_00025b7e ; push 0x25b7e
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017e7c:
+call fcn_0001759e ; call 0x1759e
+mov ebx, dword [ebx]
+call fcn_0001759e ; call 0x1759e
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00017e8f:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017ec3 ; je 0x17ec3
+test esi, 3
+je short loc_00017ec3 ; je 0x17ec3
+push eax
+push ref_00025bcd ; push 0x25bcd
+push 0xf7
+push ref_00025b7e ; push 0x25b7e
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017ec3:
+call fcn_0001759e ; call 0x1759e
+mov dword [esi], ebx
+call fcn_0001759e ; call 0x1759e
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00017ed8:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x14
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017f08 ; je 0x17f08
+test bl, 7
+je short loc_00017f08 ; je 0x17f08
+push eax
+push ref_00025be0 ; push 0x25be0
+push 0x117
+push ref_00025b7e ; push 0x25b7e
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017f08:
+call fcn_0001759e ; call 0x1759e
+mov eax, dword [ebx]
+mov edx, dword [ebx + 4]
+mov dword [ebp - 0x10], eax
+mov dword [ebp - 0xc], edx
+call fcn_0001759e ; call 0x1759e
+mov eax, dword [ebp - 0x10]
+mov edx, dword [ebp - 0xc]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00017f28:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+mov edx, dword [ebp + 0x10]
+mov ebx, dword [ebp + 8]
+mov esi, eax
+mov edi, edx
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00017f64 ; je 0x17f64
+test bl, 7
+je short loc_00017f64 ; je 0x17f64
+push eax
+push ref_00025be0 ; push 0x25be0
+push 0x135
+push ref_00025b7e ; push 0x25b7e
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00017f64:
+call fcn_0001759e ; call 0x1759e
+mov dword [ebx], esi
+mov dword [ebx + 4], edi
+call fcn_0001759e ; call 0x1759e
+lea esp, [ebp - 0xc]
+mov eax, esi
+pop ebx
+mov edx, edi
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00017f7f:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00018ee1 ; call 0x18ee1
+add esp, 0x10
+mov dword [ebp + 8], ebx
+or eax, esi
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00018eea ; jmp 0x18eea
+
+fcn_00017fac:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00018ee1 ; call 0x18ee1
+add esp, 0x10
+mov dword [ebp + 8], ebx
+and eax, esi
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00018eea ; jmp 0x18eea
+
+fcn_00017fd9:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00018ee1 ; call 0x18ee1
+add esp, 0x10
+mov dword [ebp + 8], edi
+and eax, esi
+or eax, ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018eea ; jmp 0x18eea
+
+fcn_0001800d:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0x10]
+push ebx
+mov ebx, dword [ebp + 0xc]
+sub esp, 0xc
+push dword [ebp + 8]
+call fcn_00018ee1 ; call 0x18ee1
+add esp, 0x10
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], ebx
+movzx eax, al
+mov dword [ebp + 8], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_0001f2b6 ; jmp 0x1f2b6
+
+fcn_0001803d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00018ee1 ; call 0x18ee1
+mov edx, dword [ebp - 0x1c]
+mov ecx, esi
+movzx esi, cl
+push esi
+push edx
+push edi
+movzx eax, al
+push eax
+call fcn_0001f4bc ; call 0x1f4bc
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018eea ; jmp 0x18eea
+
+fcn_00018087:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00018ee1 ; call 0x18ee1
+mov edx, dword [ebp - 0x1c]
+mov ecx, esi
+movzx esi, cl
+push esi
+push edx
+push edi
+movzx eax, al
+push eax
+call fcn_0001f329 ; call 0x1f329
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018eea ; jmp 0x18eea
+
+fcn_000180d1:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00018ee1 ; call 0x18ee1
+mov edx, dword [ebp - 0x1c]
+mov ecx, esi
+movzx esi, cl
+push esi
+push edx
+push edi
+movzx eax, al
+push eax
+call fcn_0001f3a4 ; call 0x1f3a4
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018eea ; jmp 0x18eea
+
+fcn_0001811b:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0x18]
+push ebx
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x1c], ecx
+call fcn_00018ee1 ; call 0x18ee1
+mov ecx, esi
+mov edx, edi
+movzx esi, cl
+mov ecx, dword [ebp - 0x1c]
+movzx edi, dl
+mov edx, dword [ebp - 0x20]
+mov dword [esp], edi
+push esi
+push ecx
+push edx
+movzx eax, al
+push eax
+call fcn_0001f41f ; call 0x1f41f
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018eea ; jmp 0x18eea
+
+fcn_00018176:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00018ef6 ; call 0x18ef6
+add esp, 0x10
+mov dword [ebp + 8], ebx
+or eax, esi
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00018f27 ; jmp 0x18f27
+
+fcn_000181a3:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00018ef6 ; call 0x18ef6
+add esp, 0x10
+mov dword [ebp + 8], ebx
+and eax, esi
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00018f27 ; jmp 0x18f27
+
+fcn_000181d0:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00018ef6 ; call 0x18ef6
+add esp, 0x10
+mov dword [ebp + 8], edi
+and eax, esi
+or eax, ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f27 ; jmp 0x18f27
+
+fcn_00018204:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0x10]
+push ebx
+mov ebx, dword [ebp + 0xc]
+sub esp, 0xc
+push dword [ebp + 8]
+call fcn_00018ef6 ; call 0x18ef6
+add esp, 0x10
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], ebx
+movzx eax, ax
+mov dword [ebp + 8], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_0001f53c ; jmp 0x1f53c
+
+fcn_00018234:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+movzx esi, si
+call fcn_00018ef6 ; call 0x18ef6
+mov edx, dword [ebp - 0x1c]
+push esi
+push edx
+push edi
+movzx eax, ax
+push eax
+call fcn_0001f738 ; call 0x1f738
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f27 ; jmp 0x18f27
+
+fcn_0001827c:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+movzx esi, si
+call fcn_00018ef6 ; call 0x18ef6
+mov edx, dword [ebp - 0x1c]
+push esi
+push edx
+push edi
+movzx eax, ax
+push eax
+call fcn_0001f5af ; call 0x1f5af
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f27 ; jmp 0x18f27
+
+fcn_000182c4:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+movzx esi, si
+call fcn_00018ef6 ; call 0x18ef6
+mov edx, dword [ebp - 0x1c]
+push esi
+push edx
+push edi
+movzx eax, ax
+push eax
+call fcn_0001f626 ; call 0x1f626
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f27 ; jmp 0x18f27
+
+fcn_0001830c:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+push ebx
+mov edi, dword [ebp + 0x18]
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x1c], ecx
+movzx esi, si
+call fcn_00018ef6 ; call 0x18ef6
+mov ecx, dword [ebp - 0x1c]
+movzx edi, di
+mov edx, dword [ebp - 0x20]
+mov dword [esp], edi
+push esi
+push ecx
+push edx
+movzx eax, ax
+push eax
+call fcn_0001f69d ; call 0x1f69d
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f27 ; jmp 0x18f27
+
+fcn_00018363:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00018f64 ; call 0x18f64
+add esp, 0x10
+mov dword [ebp + 8], ebx
+or eax, esi
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00018f97 ; jmp 0x18f97
+
+fcn_0001838d:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00018f64 ; call 0x18f64
+add esp, 0x10
+mov dword [ebp + 8], ebx
+and eax, esi
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00018f97 ; jmp 0x18f97
+
+fcn_000183b7:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00018f64 ; call 0x18f64
+add esp, 0x10
+mov dword [ebp + 8], edi
+and eax, esi
+or eax, ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f97 ; jmp 0x18f97
+
+fcn_000183e8:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0x10]
+push ebx
+mov ebx, dword [ebp + 0xc]
+sub esp, 0xc
+push dword [ebp + 8]
+call fcn_00018f64 ; call 0x18f64
+add esp, 0x10
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], ebx
+mov dword [ebp + 8], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_0001f7b4 ; jmp 0x1f7b4
+
+fcn_00018415:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x14]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00018f64 ; call 0x18f64
+mov edx, dword [ebp - 0x1c]
+push edx
+push edi
+push esi
+push eax
+call fcn_0001f9ae ; call 0x1f9ae
+add esp, 0x20
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f97 ; jmp 0x18f97
+
+fcn_00018454:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x14]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00018f64 ; call 0x18f64
+mov edx, dword [ebp - 0x1c]
+push edx
+push edi
+push esi
+push eax
+call fcn_0001f820 ; call 0x1f820
+add esp, 0x20
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f97 ; jmp 0x18f97
+
+fcn_00018493:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x14]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00018f64 ; call 0x18f64
+mov edx, dword [ebp - 0x1c]
+push edx
+push edi
+push esi
+push eax
+call fcn_0001f89e ; call 0x1f89e
+add esp, 0x20
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f97 ; jmp 0x18f97
+
+fcn_000184d2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x14]
+mov ecx, dword [ebp + 0x18]
+mov esi, dword [ebp + 0xc]
+push ebx
+mov edi, dword [ebp + 0x10]
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x1c], ecx
+call fcn_00018f64 ; call 0x18f64
+mov ecx, dword [ebp - 0x1c]
+mov edx, dword [ebp - 0x20]
+mov dword [esp], ecx
+push edx
+push edi
+push esi
+push eax
+call fcn_0001f91c ; call 0x1f91c
+add esp, 0x20
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f97 ; jmp 0x18f97
+
+fcn_0001851d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00017d37 ; call 0x17d37
+add esp, 0x10
+mov dword [ebp + 8], edi
+or eax, esi
+or edx, ebx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017d61 ; jmp 0x17d61
+
+fcn_00018551:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00017d37 ; call 0x17d37
+add esp, 0x10
+mov dword [ebp + 8], edi
+and eax, esi
+and edx, ebx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017d61 ; jmp 0x17d61
+
+fcn_00018585:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov eax, dword [ebp + 0x14]
+mov ecx, dword [ebp + 0x18]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov esi, dword [ebp + 0x10]
+mov dword [ebp - 0x1c], eax
+mov dword [ebp - 0x20], ecx
+call fcn_00017d37 ; call 0x17d37
+add esp, 0x10
+mov dword [ebp + 8], ebx
+and eax, edi
+and edx, esi
+or eax, dword [ebp - 0x1c]
+or edx, dword [ebp - 0x20]
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017d61 ; jmp 0x17d61
+
+fcn_000185cb:
+push ebp
+mov ebp, esp
+sub esp, 0x14
+push dword [ebp + 8]
+call fcn_00017d37 ; call 0x17d37
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push edx
+push eax
+call fcn_0001fa1d ; call 0x1fa1d
+leave
+ret
+
+fcn_000185e8:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ecx, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+push ecx
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x1c], eax
+call fcn_00017d37 ; call 0x17d37
+pop ecx
+pop ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001fd53 ; call 0x1fd53
+mov ecx, dword [ebp - 0x20]
+add esp, 0x20
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017d61 ; jmp 0x17d61
+
+fcn_00018636:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ecx, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+push ecx
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x1c], eax
+call fcn_00017d37 ; call 0x17d37
+pop ecx
+pop ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001faac ; call 0x1faac
+mov ecx, dword [ebp - 0x20]
+add esp, 0x20
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017d61 ; jmp 0x17d61
+
+fcn_00018684:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ecx, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+push ecx
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x1c], eax
+call fcn_00017d37 ; call 0x17d37
+pop ecx
+pop ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001fb9e ; call 0x1fb9e
+mov ecx, dword [ebp - 0x20]
+add esp, 0x20
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017d61 ; jmp 0x17d61
+
+fcn_000186d2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov eax, dword [ebp + 0x10]
+mov ecx, dword [ebp + 8]
+mov edi, dword [ebp + 0x20]
+mov edx, dword [ebp + 0x18]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x14]
+mov esi, dword [ebp + 0x1c]
+push ecx
+mov ebx, dword [ebp + 0xc]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x28], eax
+mov dword [ebp - 0x24], edx
+call fcn_00017d37 ; call 0x17d37
+push edi
+push esi
+push dword [ebp - 0x24]
+push dword [ebp - 0x28]
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001fc9c ; call 0x1fc9c
+mov ecx, dword [ebp - 0x20]
+add esp, 0x30
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017d61 ; jmp 0x17d61
+
+fcn_00018730:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov dword [ebp + 8], ebx
+or eax, esi
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00017da5 ; jmp 0x17da5
+
+fcn_0001875d:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov dword [ebp + 8], ebx
+and eax, esi
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00017da5 ; jmp 0x17da5
+
+fcn_0001878a:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov dword [ebp + 8], edi
+and eax, esi
+or eax, ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017da5 ; jmp 0x17da5
+
+fcn_000187be:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0x10]
+push ebx
+mov ebx, dword [ebp + 0xc]
+sub esp, 0xc
+push dword [ebp + 8]
+call fcn_00017d8b ; call 0x17d8b
+add esp, 0x10
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], ebx
+movzx eax, al
+mov dword [ebp + 8], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_0001f2b6 ; jmp 0x1f2b6
+
+fcn_000187ee:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00017d8b ; call 0x17d8b
+mov edx, dword [ebp - 0x1c]
+mov ecx, esi
+movzx esi, cl
+push esi
+push edx
+push edi
+movzx eax, al
+push eax
+call fcn_0001f4bc ; call 0x1f4bc
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017da5 ; jmp 0x17da5
+
+fcn_00018838:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00017d8b ; call 0x17d8b
+mov edx, dword [ebp - 0x1c]
+mov ecx, esi
+movzx esi, cl
+push esi
+push edx
+push edi
+movzx eax, al
+push eax
+call fcn_0001f329 ; call 0x1f329
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017da5 ; jmp 0x17da5
+
+fcn_00018882:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00017d8b ; call 0x17d8b
+mov edx, dword [ebp - 0x1c]
+mov ecx, esi
+movzx esi, cl
+push esi
+push edx
+push edi
+movzx eax, al
+push eax
+call fcn_0001f3a4 ; call 0x1f3a4
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017da5 ; jmp 0x17da5
+
+fcn_000188cc:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0x18]
+push ebx
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x1c], ecx
+call fcn_00017d8b ; call 0x17d8b
+mov ecx, esi
+mov edx, edi
+movzx esi, cl
+mov ecx, dword [ebp - 0x1c]
+movzx edi, dl
+mov edx, dword [ebp - 0x20]
+mov dword [esp], edi
+push esi
+push ecx
+push edx
+movzx eax, al
+push eax
+call fcn_0001f41f ; call 0x1f41f
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017da5 ; jmp 0x17da5
+
+fcn_00018927:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+mov dword [ebp + 8], ebx
+or eax, esi
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00017e04 ; jmp 0x17e04
+
+fcn_00018954:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+mov dword [ebp + 8], ebx
+and eax, esi
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00017e04 ; jmp 0x17e04
+
+fcn_00018981:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+mov dword [ebp + 8], edi
+and eax, esi
+or eax, ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e04 ; jmp 0x17e04
+
+fcn_000189b5:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0x10]
+push ebx
+mov ebx, dword [ebp + 0xc]
+sub esp, 0xc
+push dword [ebp + 8]
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], ebx
+movzx eax, ax
+mov dword [ebp + 8], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_0001f53c ; jmp 0x1f53c
+
+fcn_000189e5:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+movzx esi, si
+call fcn_00017dc2 ; call 0x17dc2
+mov edx, dword [ebp - 0x1c]
+push esi
+push edx
+push edi
+movzx eax, ax
+push eax
+call fcn_0001f738 ; call 0x1f738
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e04 ; jmp 0x17e04
+
+fcn_00018a2d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+movzx esi, si
+call fcn_00017dc2 ; call 0x17dc2
+mov edx, dword [ebp - 0x1c]
+push esi
+push edx
+push edi
+movzx eax, ax
+push eax
+call fcn_0001f5af ; call 0x1f5af
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e04 ; jmp 0x17e04
+
+fcn_00018a75:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+movzx esi, si
+call fcn_00017dc2 ; call 0x17dc2
+mov edx, dword [ebp - 0x1c]
+push esi
+push edx
+push edi
+movzx eax, ax
+push eax
+call fcn_0001f626 ; call 0x1f626
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e04 ; jmp 0x17e04
+
+fcn_00018abd:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+push ebx
+mov edi, dword [ebp + 0x18]
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x1c], ecx
+movzx esi, si
+call fcn_00017dc2 ; call 0x17dc2
+mov ecx, dword [ebp - 0x1c]
+movzx edi, di
+mov edx, dword [ebp - 0x20]
+mov dword [esp], edi
+push esi
+push ecx
+push edx
+movzx eax, ax
+push eax
+call fcn_0001f69d ; call 0x1f69d
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e04 ; jmp 0x17e04
+
+fcn_00018b14:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov dword [ebp + 8], ebx
+or eax, esi
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00017e8f ; jmp 0x17e8f
+
+fcn_00018b3e:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov dword [ebp + 8], ebx
+and eax, esi
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00017e8f ; jmp 0x17e8f
+
+fcn_00018b68:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov dword [ebp + 8], edi
+and eax, esi
+or eax, ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f ; jmp 0x17e8f
+
+fcn_00018b99:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0x10]
+push ebx
+mov ebx, dword [ebp + 0xc]
+sub esp, 0xc
+push dword [ebp + 8]
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], ebx
+mov dword [ebp + 8], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_0001f7b4 ; jmp 0x1f7b4
+
+fcn_00018bc6:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x14]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00017e4e ; call 0x17e4e
+mov edx, dword [ebp - 0x1c]
+push edx
+push edi
+push esi
+push eax
+call fcn_0001f9ae ; call 0x1f9ae
+add esp, 0x20
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f ; jmp 0x17e8f
+
+fcn_00018c05:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x14]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00017e4e ; call 0x17e4e
+mov edx, dword [ebp - 0x1c]
+push edx
+push edi
+push esi
+push eax
+call fcn_0001f820 ; call 0x1f820
+add esp, 0x20
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f ; jmp 0x17e8f
+
+fcn_00018c44:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x14]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00017e4e ; call 0x17e4e
+mov edx, dword [ebp - 0x1c]
+push edx
+push edi
+push esi
+push eax
+call fcn_0001f89e ; call 0x1f89e
+add esp, 0x20
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f ; jmp 0x17e8f
+
+fcn_00018c83:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x14]
+mov ecx, dword [ebp + 0x18]
+mov esi, dword [ebp + 0xc]
+push ebx
+mov edi, dword [ebp + 0x10]
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x1c], ecx
+call fcn_00017e4e ; call 0x17e4e
+mov ecx, dword [ebp - 0x1c]
+mov edx, dword [ebp - 0x20]
+mov dword [esp], ecx
+push edx
+push edi
+push esi
+push eax
+call fcn_0001f91c ; call 0x1f91c
+add esp, 0x20
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f ; jmp 0x17e8f
+
+fcn_00018cce:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00017ed8 ; call 0x17ed8
+add esp, 0x10
+mov dword [ebp + 8], edi
+or eax, esi
+or edx, ebx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017f28 ; jmp 0x17f28
+
+fcn_00018d02:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00017ed8 ; call 0x17ed8
+add esp, 0x10
+mov dword [ebp + 8], edi
+and eax, esi
+and edx, ebx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017f28 ; jmp 0x17f28
+
+fcn_00018d36:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov eax, dword [ebp + 0x14]
+mov ecx, dword [ebp + 0x18]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov esi, dword [ebp + 0x10]
+mov dword [ebp - 0x1c], eax
+mov dword [ebp - 0x20], ecx
+call fcn_00017ed8 ; call 0x17ed8
+add esp, 0x10
+mov dword [ebp + 8], ebx
+and eax, edi
+and edx, esi
+or eax, dword [ebp - 0x1c]
+or edx, dword [ebp - 0x20]
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017f28 ; jmp 0x17f28
+
+fcn_00018d7c:
+push ebp
+mov ebp, esp
+sub esp, 0x14
+push dword [ebp + 8]
+call fcn_00017ed8 ; call 0x17ed8
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push edx
+push eax
+call fcn_0001fa1d ; call 0x1fa1d
+leave
+ret
+
+fcn_00018d99:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ecx, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+push ecx
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x1c], eax
+call fcn_00017ed8 ; call 0x17ed8
+pop ecx
+pop ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001fd53 ; call 0x1fd53
+mov ecx, dword [ebp - 0x20]
+add esp, 0x20
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017f28 ; jmp 0x17f28
+
+fcn_00018de7:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ecx, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+push ecx
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x1c], eax
+call fcn_00017ed8 ; call 0x17ed8
+pop ecx
+pop ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001faac ; call 0x1faac
+mov ecx, dword [ebp - 0x20]
+add esp, 0x20
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017f28 ; jmp 0x17f28
+
+fcn_00018e35:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ecx, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+push ecx
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x1c], eax
+call fcn_00017ed8 ; call 0x17ed8
+pop ecx
+pop ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001fb9e ; call 0x1fb9e
+mov ecx, dword [ebp - 0x20]
+add esp, 0x20
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017f28 ; jmp 0x17f28
+
+fcn_00018e83:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov eax, dword [ebp + 0x10]
+mov ecx, dword [ebp + 8]
+mov edi, dword [ebp + 0x20]
+mov edx, dword [ebp + 0x18]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x14]
+mov esi, dword [ebp + 0x1c]
+push ecx
+mov ebx, dword [ebp + 0xc]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x28], eax
+mov dword [ebp - 0x24], edx
+call fcn_00017ed8 ; call 0x17ed8
+push edi
+push esi
+push dword [ebp - 0x24]
+push dword [ebp - 0x28]
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001fc9c ; call 0x1fc9c
+mov ecx, dword [ebp - 0x20]
+add esp, 0x30
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017f28 ; jmp 0x17f28
+
+fcn_00018ee1:
+push ebp
+mov ebp, esp
+mov edx, dword [ebp + 8]
+in al, dx
+pop ebp
+ret
+
+fcn_00018eea:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0xc]
+mov edx, dword [ebp + 8]
+out dx, al
+pop ebp
+ret
+
+fcn_00018ef6:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00018f20 ; je 0x18f20
+test byte [ebp + 8], 1
+je short loc_00018f20 ; je 0x18f20
+push eax
+push ref_00025bf3 ; push 0x25bf3
+push 0x69
+push ref_00025c03 ; push 0x25c03
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00018f20:
+mov edx, dword [ebp + 8]
+in ax, dx
+leave
+ret
+
+fcn_00018f27:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00018f56 ; je 0x18f56
+test byte [ebp + 8], 1
+je short loc_00018f56 ; je 0x18f56
+push eax
+push ref_00025bf3 ; push 0x25bf3
+push 0x86
+push ref_00025c03 ; push 0x25c03
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00018f56:
+mov eax, ebx
+mov edx, dword [ebp + 8]
+out dx, ax
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00018f64:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00018f91 ; je 0x18f91
+test byte [ebp + 8], 3
+je short loc_00018f91 ; je 0x18f91
+push eax
+push ref_00025c42 ; push 0x25c42
+push 0xa3
+push ref_00025c03 ; push 0x25c03
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00018f91:
+mov edx, dword [ebp + 8]
+in eax, dx
+leave
+ret
+
+fcn_00018f97:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00018fc4 ; je 0x18fc4
+test byte [ebp + 8], 3
+je short loc_00018fc4 ; je 0x18fc4
+push eax
+push ref_00025c42 ; push 0x25c42
+push 0xc0
+push ref_00025c03 ; push 0x25c03
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00018fc4:
+mov eax, dword [ebp + 0xc]
+mov edx, dword [ebp + 8]
+out dx, eax
+mov eax, dword [ebp + 0xc]
+leave
+ret
+
+fcn_00018fd0:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x20
+lea eax, [ebp - 0xc]
+push eax
+call fcn_000197c7 ; call 0x197c7
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00019024 ; je 0x19024
+test ebx, ebx
+jns short loc_00019024 ; jns 0x19024
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001900f ; je 0x1900f
+push ecx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001900f:
+push edx
+push ref_000206f4 ; push 0x206f4
+push 0x32
+push ref_00025c52 ; push 0x25c52
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00019024:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00019048 ; je 0x19048
+cmp dword [ebp - 0xc], 0
+jne short loc_00019048 ; jne 0x19048
+push eax
+push ref_00025c86 ; push 0x25c86
+push 0x33
+push ref_00025c52 ; push 0x25c52
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00019048:
+mov eax, dword [ebp - 0xc]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00019050:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001908a ; je 0x1908a
+test ebx, ebx
+jne short loc_0001908a ; jne 0x1908a
+push eax
+push ref_00025c9e ; push 0x25c9e
+push 0x52
+push ref_00025c52 ; push 0x25c52
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+jmp short loc_0001908a ; jmp 0x1908a
+
+loc_0001907f:
+cmp ax, si
+je short loc_00019097 ; je 0x19097
+movzx eax, word [ebx + 2]
+add ebx, eax
+
+loc_0001908a:
+mov ax, word [ebx]
+cmp ax, 0xffff
+jne short loc_0001907f ; jne 0x1907f
+xor eax, eax
+jmp short loc_00019099 ; jmp 0x19099
+
+loc_00019097:
+mov eax, ebx
+
+loc_00019099:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_000190a0:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00018fd0 ; call 0x18fd0
+movzx ebx, bx
+push edx
+push edx
+push eax
+push ebx
+call fcn_00019050 ; call 0x19050
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000190be:
+push ebp
+mov ebp, esp
+push ebx
+push ecx
+mov ebx, dword [ebp + 0xc]
+
+loc_000190c6:
+push eax
+push eax
+push ebx
+push 4
+call fcn_00019050 ; call 0x19050
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+je short loc_000190f6 ; je 0x190f6
+push edx
+push edx
+lea eax, [ebx + 8]
+push eax
+push dword [ebp + 8]
+call fcn_00016ee8 ; call 0x16ee8
+add esp, 0x10
+test al, al
+jne short loc_000190f6 ; jne 0x190f6
+movzx eax, word [ebx + 2]
+add ebx, eax
+jmp short loc_000190c6 ; jmp 0x190c6
+
+loc_000190f6:
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000190fd:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00018fd0 ; call 0x18fd0
+push edx
+push edx
+push eax
+push dword [ebp + 8]
+call fcn_000190be ; call 0x190be
+leave
+ret
+
+fcn_00019115:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x20
+lea eax, [ebp - 0xc]
+push eax
+call fcn_00019797 ; call 0x19797
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001916c ; je 0x1916c
+test ebx, ebx
+jns short loc_0001916c ; jns 0x1916c
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00019154 ; je 0x19154
+push edx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00019154:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0xd8
+push ref_00025c52 ; push 0x25c52
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001916c:
+mov eax, dword [ebp - 0xc]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00019174:
+push ebp
+mov ebp, esp
+sub esp, 0x1c
+lea eax, [ebp - 0xc]
+push eax
+movzx eax, word [ebp + 0xc]
+push eax
+movzx eax, word [ebp + 8]
+push eax
+call fcn_000197df ; call 0x197df
+add esp, 0x10
+test eax, eax
+jns short loc_0001919b ; jns 0x1919b
+mov dword [ebp - 0xc], 0
+
+loc_0001919b:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000191c2 ; je 0x191c2
+cmp dword [ebp - 0xc], 0
+jne short loc_000191c2 ; jne 0x191c2
+push eax
+push ref_00025cb7 ; push 0x25cb7
+push 0xfa
+push ref_00025c52 ; push 0x25c52
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000191c2:
+mov eax, dword [ebp - 0xc]
+leave
+ret
+
+fcn_000191c7:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0x10]
+mov edx, dword [ebp + 0x20]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x14]
+mov dword [ebp - 0x24], eax
+mov eax, dword [ebp + 0x18]
+mov dword [ebp - 0x1c], edx
+mov dword [ebp - 0x28], eax
+mov eax, dword [ebp + 0x1c]
+mov dword [ebp - 0x20], eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001921f ; je 0x1921f
+test esi, 0xfff
+jne short loc_00019207 ; jne 0x19207
+test ebx, 0xfff
+je short loc_0001921f ; je 0x1921f
+
+loc_00019207:
+push eax
+push ref_00025ccb ; push 0x25ccb
+push 0x11a
+push ref_00025c52 ; push 0x25c52
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001921f:
+push edi
+push edi
+push 0x48
+push 2
+call fcn_00019174 ; call 0x19174
+add esp, 0x10
+mov edi, eax
+test eax, eax
+je short loc_00019286 ; je 0x19286
+push eax
+push eax
+push ref_0002905c ; push 0x2905c
+lea eax, [edi + 8]
+push eax
+call fcn_00016ea7 ; call 0x16ea7
+mov eax, dword [ebp - 0x24]
+mov dword [edi + 0x18], esi
+mov dword [edi + 0x20], ebx
+mov dword [edi + 0x28], 3
+mov dword [edi + 0x1c], eax
+mov eax, dword [ebp - 0x28]
+mov dword [edi + 0x24], eax
+lea eax, [edi + 0x2c]
+pop edx
+pop ecx
+push 4
+push eax
+call fcn_00016fff ; call 0x16fff
+lea eax, [edi + 0x30]
+pop ebx
+pop esi
+push dword [ebp + 8]
+push eax
+call fcn_00016ea7 ; call 0x16ea7
+mov eax, dword [ebp - 0x20]
+add esp, 0x10
+mov edx, dword [ebp - 0x1c]
+mov dword [edi + 0x40], eax
+mov dword [edi + 0x44], edx
+
+loc_00019286:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001928e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+sub esp, 0x18
+mov eax, dword [ebp + 0x18]
+mov edx, dword [ebp + 0x1c]
+push 0x30
+mov esi, dword [ebp + 0x10]
+push 3
+mov edi, dword [ebp + 0x14]
+mov dword [ebp - 0x10], eax
+mov dword [ebp - 0xc], edx
+call fcn_00019174 ; call 0x19174
+add esp, 0x10
+test eax, eax
+je short loc_000192d6 ; je 0x192d6
+mov edx, dword [ebp + 8]
+mov dword [eax + 0x20], esi
+mov esi, dword [ebp - 0x10]
+mov dword [eax + 0x24], edi
+mov edi, dword [ebp - 0xc]
+mov dword [eax + 0x18], edx
+mov edx, dword [ebp + 0xc]
+mov dword [eax + 0x28], esi
+mov dword [eax + 0x2c], edi
+mov dword [eax + 0x1c], edx
+
+loc_000192d6:
+lea esp, [ebp - 8]
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000192dd:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001930d ; je 0x1930d
+test esi, esi
+jne short loc_0001930d ; jne 0x1930d
+push eax
+push ref_00025d2a ; push 0x25d2a
+push 0x176
+push ref_00025c52 ; push 0x25c52
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001930d:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00019336 ; je 0x19336
+cmp ebx, 0xffe0
+jbe short loc_00019336 ; jbe 0x19336
+push ecx
+push ref_00025d3f ; push 0x25d3f
+push 0x17b
+push ref_00025c52 ; push 0x25c52
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00019336:
+add ebx, 0x18
+push edx
+movzx ebx, bx
+push edx
+push ebx
+push 4
+call fcn_00019174 ; call 0x19174
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+je short loc_00019363 ; je 0x19363
+push eax
+push eax
+push esi
+lea eax, [ebx + 8]
+push eax
+call fcn_00016ea7 ; call 0x16ea7
+lea eax, [ebx + 0x18]
+add esp, 0x10
+jmp short loc_00019365 ; jmp 0x19365
+
+loc_00019363:
+xor eax, eax
+
+loc_00019365:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001936c:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000193a7 ; je 0x193a7
+test esi, esi
+jne short loc_000193a7 ; jne 0x193a7
+test ebx, ebx
+je short loc_000193a7 ; je 0x193a7
+push edx
+push ref_00025d73 ; push 0x25d73
+push 0x1a8
+push ref_00025c52 ; push 0x25c52
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000193a7:
+push eax
+push eax
+push ebx
+push edi
+call fcn_000192dd ; call 0x192dd
+add esp, 0x10
+test eax, eax
+je short loc_000193cc ; je 0x193cc
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001713e ; jmp 0x1713e
+
+loc_000193cc:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000193d6:
+push ebp
+mov ebp, esp
+push edi
+push esi
+sub esp, 0x18
+mov eax, dword [ebp + 0x10]
+mov edx, dword [ebp + 0x14]
+push 0x18
+mov esi, dword [ebp + 8]
+push 5
+mov edi, dword [ebp + 0xc]
+mov dword [ebp - 0x10], eax
+mov dword [ebp - 0xc], edx
+call fcn_00019174 ; call 0x19174
+add esp, 0x10
+test eax, eax
+je short loc_00019412 ; je 0x19412
+mov edx, dword [ebp - 0x10]
+mov ecx, dword [ebp - 0xc]
+mov dword [eax + 8], esi
+mov dword [eax + 0xc], edi
+mov dword [eax + 0x10], edx
+mov dword [eax + 0x14], ecx
+
+loc_00019412:
+lea esp, [ebp - 8]
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00019419:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x24
+mov edx, dword [ebp + 0x14]
+mov eax, dword [ebp + 0x10]
+mov ecx, dword [ebp + 0x18]
+push 0x38
+mov esi, dword [ebp + 8]
+push 9
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x1c]
+mov dword [ebp - 0x1c], edx
+mov dword [ebp - 0x20], eax
+mov dword [ebp - 0x24], ecx
+call fcn_00019174 ; call 0x19174
+add esp, 0x10
+mov edx, eax
+test eax, eax
+je short loc_0001948e ; je 0x1948e
+mov dword [eax + 8], esi
+mov esi, dword [ebp - 0x20]
+mov dword [eax + 0xc], edi
+mov edi, dword [ebp - 0x1c]
+mov ecx, dword [ebp - 0x24]
+mov dword [ebp - 0x20], edx
+mov dword [eax + 0x10], esi
+mov dword [eax + 0x14], edi
+push eax
+push eax
+push ecx
+lea eax, [edx + 0x18]
+push eax
+call fcn_00016ea7 ; call 0x16ea7
+mov edx, dword [ebp - 0x20]
+add esp, 0x10
+mov dword [ebp + 0xc], ebx
+add edx, 0x28
+mov dword [ebp + 8], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00016ea7 ; jmp 0x16ea7
+
+loc_0001948e:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00019496:
+push ebp
+mov ebp, esp
+push edi
+push esi
+sub esp, 0x18
+mov eax, dword [ebp + 0x10]
+mov edx, dword [ebp + 0x14]
+push 0x18
+mov esi, dword [ebp + 8]
+push 0xb
+mov edi, dword [ebp + 0xc]
+mov dword [ebp - 0x10], eax
+mov dword [ebp - 0xc], edx
+call fcn_00019174 ; call 0x19174
+add esp, 0x10
+test eax, eax
+je short loc_000194d2 ; je 0x194d2
+mov edx, dword [ebp - 0x10]
+mov ecx, dword [ebp - 0xc]
+mov dword [eax + 8], esi
+mov dword [eax + 0xc], edi
+mov dword [eax + 0x10], edx
+mov dword [eax + 0x14], ecx
+
+loc_000194d2:
+lea esp, [ebp - 8]
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000194d9:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0xc]
+push eax
+push eax
+push 0x10
+push 6
+call fcn_00019174 ; call 0x19174
+add esp, 0x10
+test eax, eax
+je short loc_00019516 ; je 0x19516
+mov edx, esi
+add eax, 0xa
+mov byte [eax - 2], dl
+mov byte [eax - 1], bl
+mov dword [ebp + 0xc], 6
+mov dword [ebp + 8], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00016fff ; jmp 0x16fff
+
+loc_00019516:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001951d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0x14]
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov dword [ebp - 0x1c], eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00019566 ; je 0x19566
+test esi, 0xfff
+jne short loc_0001954e ; jne 0x1954e
+test ebx, 0xfff
+je short loc_00019566 ; je 0x19566
+
+loc_0001954e:
+push ecx
+push ref_00025d9b ; push 0x25d9b
+push 0x251
+push ref_00025c52 ; push 0x25c52
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00019566:
+push edx
+push edx
+push 0x30
+push 2
+call fcn_00019174 ; call 0x19174
+add esp, 0x10
+mov edx, eax
+test eax, eax
+je short loc_000195c2 ; je 0x195c2
+push eax
+push eax
+push ref_0002904c ; push 0x2904c
+lea eax, [edx + 8]
+push eax
+mov dword [ebp - 0x20], edx
+call fcn_00016ea7 ; call 0x16ea7
+mov edx, dword [ebp - 0x20]
+add esp, 0x10
+mov eax, dword [ebp - 0x1c]
+mov dword [edx + 0x18], esi
+add edx, 0x2c
+mov dword [edx - 0x10], edi
+mov dword [edx - 0xc], ebx
+mov dword [edx - 8], eax
+mov dword [edx - 4], 4
+mov dword [ebp + 0xc], 4
+mov dword [ebp + 8], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00016fff ; jmp 0x16fff
+
+loc_000195c2:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000195ca:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0x14]
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov dword [ebp - 0x20], eax
+mov eax, dword [ebp + 0x18]
+mov dword [ebp - 0x1c], eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00019619 ; je 0x19619
+test esi, 0xfff
+jne short loc_00019601 ; jne 0x19601
+test ebx, 0xfff
+je short loc_00019619 ; je 0x19619
+
+loc_00019601:
+push ecx
+push ref_00025d9b ; push 0x25d9b
+push 0x27c
+push ref_00025c52 ; push 0x25c52
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00019619:
+push edx
+push edx
+push 0x30
+push 2
+call fcn_00019174 ; call 0x19174
+add esp, 0x10
+mov edx, eax
+test eax, eax
+je short loc_00019674 ; je 0x19674
+push eax
+push eax
+push ref_0002903c ; push 0x2903c
+lea eax, [edx + 8]
+push eax
+mov dword [ebp - 0x24], edx
+call fcn_00016ea7 ; call 0x16ea7
+mov edx, dword [ebp - 0x24]
+add esp, 0x10
+mov eax, dword [ebp - 0x20]
+mov dword [edx + 0x18], esi
+add edx, 0x2c
+mov dword [edx - 8], eax
+mov eax, dword [ebp - 0x1c]
+mov dword [edx - 0x10], edi
+mov dword [edx - 0xc], ebx
+mov dword [edx - 4], eax
+mov dword [ebp + 0xc], 4
+mov dword [ebp + 8], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00016fff ; jmp 0x16fff
+
+loc_00019674:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001967c:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0x14]
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov dword [ebp - 0x20], eax
+mov eax, dword [ebp + 0x18]
+mov dword [ebp - 0x1c], eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_000196cb ; je 0x196cb
+test esi, 0xfff
+jne short loc_000196b3 ; jne 0x196b3
+test ebx, 0xfff
+je short loc_000196cb ; je 0x196cb
+
+loc_000196b3:
+push ecx
+push ref_00025d9b ; push 0x25d9b
+push 0x2a7
+push ref_00025c52 ; push 0x25c52
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000196cb:
+push edx
+push edx
+push 0x30
+push 2
+call fcn_00019174 ; call 0x19174
+add esp, 0x10
+mov edx, eax
+test eax, eax
+je short loc_00019723 ; je 0x19723
+push eax
+push eax
+push 0x10
+lea eax, [edx + 8]
+push eax
+mov dword [ebp - 0x24], edx
+call fcn_00016fff ; call 0x16fff
+mov edx, dword [ebp - 0x24]
+add esp, 0x10
+mov eax, dword [ebp - 0x20]
+mov dword [edx + 0x18], esi
+add edx, 0x2c
+mov dword [edx - 8], eax
+mov eax, dword [ebp - 0x1c]
+mov dword [edx - 0x10], edi
+mov dword [edx - 0xc], ebx
+mov dword [edx - 4], eax
+mov dword [ebp + 0xc], 4
+mov dword [ebp + 8], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00016fff ; jmp 0x16fff
+
+loc_00019723:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001972b:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31 ; call 0x19b31
+push edx
+push edx
+mov edx, dword [eax]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x18] ; ucall
+leave
+ret
+
+fcn_00019743:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31 ; call 0x19b31
+push edx
+mov edx, dword [eax]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x1c] ; ucall
+leave
+ret
+
+fcn_0001975d:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31 ; call 0x19b31
+sub esp, 0xc
+mov edx, dword [eax]
+push dword [ebp + 0x14]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x20] ; ucall
+leave
+ret
+
+fcn_0001977f:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31 ; call 0x19b31
+push edx
+push edx
+mov edx, dword [eax]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x24] ; ucall
+leave
+ret
+
+fcn_00019797:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31 ; call 0x19b31
+push edx
+push edx
+mov edx, dword [eax]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x28] ; ucall
+leave
+ret
+
+fcn_000197af:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31 ; call 0x19b31
+push edx
+push edx
+mov edx, dword [eax]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x2c] ; ucall
+leave
+ret
+
+fcn_000197c7:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31 ; call 0x19b31
+push edx
+push edx
+mov edx, dword [eax]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x30] ; ucall
+leave
+ret
+
+fcn_000197df:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00019b31 ; call 0x19b31
+movzx esi, si
+movzx ebx, bx
+mov edx, dword [eax]
+push dword [ebp + 0x10]
+push esi
+push ebx
+push eax
+call dword [edx + 0x34] ; ucall
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00019807:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31 ; call 0x19b31
+push edx
+mov edx, dword [eax]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x38] ; ucall
+leave
+ret
+
+fcn_00019821:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00019b31 ; call 0x19b31
+movzx ebx, bl
+mov edx, dword [eax]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push ebx
+push eax
+call dword [edx + 0x3c] ; ucall
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00019843:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00019b31 ; call 0x19b31
+movzx ebx, bl
+mov edx, dword [eax]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push ebx
+push eax
+call dword [edx + 0x40] ; ucall
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00019865:
+push ebp
+mov ebp, esp
+push edi
+push esi
+sub esp, 0x10
+mov edx, dword [ebp + 0xc]
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+mov dword [ebp - 0xc], edx
+mov dword [ebp - 0x10], eax
+call fcn_00019b31 ; call 0x19b31
+sub esp, 0xc
+mov edx, dword [eax]
+push edi
+push esi
+push dword [ebp - 0xc]
+push dword [ebp - 0x10]
+push eax
+call dword [edx + 0x44] ; ucall
+lea esp, [ebp - 8]
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001989c:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31 ; call 0x19b31
+mov edx, dword [eax]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x48] ; ucall
+leave
+ret
+
+fcn_000198b8:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31 ; call 0x19b31
+push edx
+mov edx, dword [eax]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x4c] ; ucall
+leave
+ret
+
+fcn_000198d2:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31 ; call 0x19b31
+sub esp, 0xc
+mov edx, dword [eax]
+push eax
+call dword [edx + 0x5c] ; ucall
+leave
+ret
+
+fcn_000198e8:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00019b31 ; call 0x19b31
+mov eax, dword [eax]
+mov dword [ebp + 8], ebx
+mov eax, dword [eax + 0x74]
+pop edx
+pop ebx
+pop ebp
+jmp eax
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00019b31 ; call 0x19b31
+mov eax, dword [eax]
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], ebx
+pop ebx
+mov eax, dword [eax + 0x6c]
+pop esi
+pop ebp
+jmp eax
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+call fcn_00019b31 ; call 0x19b31
+mov eax, dword [eax]
+mov dword [ebp + 0x10], edi
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], ebx
+mov eax, dword [eax + 0x68]
+add esp, 0xc
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp eax
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00019b31 ; call 0x19b31
+mov eax, dword [eax]
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], ebx
+pop ebx
+mov eax, dword [eax + 0x70]
+pop esi
+pop ebp
+jmp eax
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov eax, dword [ebp + 0xc]
+push 0x20
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp - 0x20], eax
+mov eax, dword [ebp + 0x18]
+mov dword [ebp - 0x24], eax
+call fcn_00019db6 ; call 0x19db6
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_000199c2 ; je 0x199c2
+test ebx, ebx
+jne short loc_000199c2 ; jne 0x199c2
+push eax
+push ref_00025de9 ; push 0x25de9
+push 0x23d
+push ref_00025e03 ; push 0x25e03
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_000199c2:
+test edi, edi
+je short loc_000199cb ; je 0x199cb
+push eax
+push eax
+push edi
+jmp short loc_000199d2 ; jmp 0x199d2
+
+loc_000199cb:
+push eax
+push eax
+push ref_0002906c ; push 0x2906c
+
+loc_000199d2:
+push ebx
+call fcn_00016ea7 ; call 0x16ea7
+mov eax, dword [ebp - 0x1c]
+add esp, 0x10
+mov dword [ebx + 0x10], eax
+mov eax, dword [ebp - 0x20]
+mov dword [ebx + 0x14], eax
+test esi, esi
+je short loc_00019a22 ; je 0x19a22
+push edi
+push edi
+push esi
+push 0x10
+call fcn_00019e91 ; call 0x19e91
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00019a1f ; je 0x19a1f
+test esi, esi
+jne short loc_00019a1f ; jne 0x19a1f
+push ecx
+push ref_00025e44 ; push 0x25e44
+push 0x248
+push ref_00025e03 ; push 0x25e03
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00019a1f:
+mov dword [ebx + 0x18], esi
+
+loc_00019a22:
+mov eax, dword [ebp - 0x24]
+test eax, eax
+je short loc_00019a60 ; je 0x19a60
+push edx
+push edx
+push eax
+push 0x10
+call fcn_00019e91 ; call 0x19e91
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00019a5d ; je 0x19a5d
+test esi, esi
+jne short loc_00019a5d ; jne 0x19a5d
+push edi
+push ref_00025e66 ; push 0x25e66
+push 0x24d
+push ref_00025e03 ; push 0x25e03
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00019a5d:
+mov dword [ebx + 0x1c], esi
+
+loc_00019a60:
+push ecx
+push ecx
+push ref_00020594 ; push 0x20594
+push 0xc
+call fcn_00019e91 ; call 0x19e91
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00019a98 ; je 0x19a98
+test esi, esi
+jne short loc_00019a98 ; jne 0x19a98
+push edx
+push ref_00025e8a ; push 0x25e8a
+push 0x252
+push ref_00025e03 ; push 0x25e03
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00019a98:
+sub esp, 0xc
+mov dword [esi + 8], ebx
+push esi
+call fcn_0001972b ; call 0x1972b
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00019af4 ; je 0x19af4
+test ebx, ebx
+jns short loc_00019af4 ; jns 0x19af4
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_00019ad3 ; je 0x19ad3
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_00019ad3:
+mov dword [ebp + 0x10], ref_000206f4 ; mov dword [ebp + 0x10], 0x206f4
+mov dword [ebp + 0xc], 0x256
+mov dword [ebp + 8], ref_00025e03 ; mov dword [ebp + 8], 0x25e03
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001548c ; jmp 0x1548c
+
+loc_00019af4:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00019afc:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00019b26 ; je 0x19b26
+test ebx, ebx
+jne short loc_00019b26 ; jne 0x19b26
+push eax
+push ref_00025eae ; push 0x25eae
+push 0x29
+push ref_00025ed6 ; push 0x25ed6
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00019b26:
+mov dword [ref_000312f0], ebx ; mov dword [0x312f0], ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00019b31:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00019b5e ; je 0x19b5e
+cmp dword [ref_000312f0], 0 ; cmp dword [0x312f0], 0
+jne short loc_00019b5e ; jne 0x19b5e
+push eax
+push ref_00025f2c ; push 0x25f2c
+push 0x3f
+push ref_00025ed6 ; push 0x25ed6
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00019b5e:
+mov eax, dword [ref_000312f0] ; mov eax, dword [0x312f0]
+leave
+ret
+
+fcn_00019b65:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0xc]
+pop ebp
+mov dword [ref_000312f0], eax ; mov dword [0x312f0], eax
+xor eax, eax
+ret
+
+fcn_00019b74:
+push ebp
+mov ebp, esp
+sub esp, 0x18
+mov eax, dword [ebp + 0xc]
+test eax, eax
+jne short loc_00019b85 ; jne 0x19b85
+
+loc_00019b81:
+xor eax, eax
+jmp short loc_00019b9d ; jmp 0x19b9d
+
+loc_00019b85:
+push edx
+lea edx, [ebp - 0x10]
+push edx
+push eax
+push dword [ebp + 8]
+call fcn_0001989c ; call 0x1989c
+add esp, 0x10
+test eax, eax
+js short loc_00019b81 ; js 0x19b81
+mov eax, dword [ebp - 0x10]
+
+loc_00019b9d:
+leave
+ret
+
+fcn_00019b9f:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+push dword [ebp + 8]
+push 4
+call fcn_00019b74 ; call 0x19b74
+leave
+ret
+
+fcn_00019bb1:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+push dword [ebp + 8]
+push 6
+call fcn_00019b74 ; call 0x19b74
+leave
+ret
+
+fcn_00019bc3:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+push dword [ebp + 8]
+push 0
+call fcn_00019b74 ; call 0x19b74
+leave
+ret
+
+fcn_00019bd5:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00019c02 ; je 0x19c02
+cmp dword [ebp + 0xc], 0
+jne short loc_00019c02 ; jne 0x19c02
+push eax
+push ref_00025f49 ; push 0x25f49
+push 0x95
+push ref_00025f54 ; push 0x25f54
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00019c02:
+leave
+ret
+
+fcn_00019c04:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00019c37 ; je 0x19c37
+lea eax, [ebx - 1]
+test eax, ebx
+je short loc_00019c37 ; je 0x19c37
+push ecx
+push ref_00025fa2 ; push 0x25fa2
+push 0xba
+push ref_00025f54 ; push 0x25f54
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00019c37:
+test esi, esi
+je short loc_00019ca6 ; je 0x19ca6
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00019c74 ; je 0x19c74
+xor edx, edx
+mov eax, ebx
+test ebx, 0xfff
+setne dl
+shr eax, 0xc
+add eax, edx
+not eax
+cmp esi, eax
+jbe short loc_00019c74 ; jbe 0x19c74
+push edx
+push ref_00025fc5 ; push 0x25fc5
+push 0xc2
+push ref_00025f54 ; push 0x25f54
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00019c74:
+push eax
+push eax
+mov eax, ebx
+shr eax, 0xc
+add esi, eax
+xor eax, eax
+test ebx, 0xfff
+setne al
+add esi, eax
+push esi
+push dword [ebp + 8]
+call fcn_00019b74 ; call 0x19b74
+add esp, 0x10
+cmp ebx, 1
+adc ebx, 0xffffffff
+mov edx, ebx
+not edx
+add ebx, eax
+and edx, ebx
+jmp short loc_00019ca8 ; jmp 0x19ca8
+
+loc_00019ca6:
+xor edx, edx
+
+loc_00019ca8:
+lea esp, [ebp - 8]
+mov eax, edx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00019cb1:
+push ebp
+mov ebp, esp
+sub esp, 0xc
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push 4
+call fcn_00019c04 ; call 0x19c04
+leave
+ret
+
+fcn_00019cc6:
+push ebp
+mov ebp, esp
+sub esp, 0xc
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push 6
+call fcn_00019c04 ; call 0x19c04
+leave
+ret
+
+fcn_00019cdb:
+push ebp
+mov ebp, esp
+sub esp, 0xc
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push 0
+call fcn_00019c04 ; call 0x19c04
+leave
+ret
+
+fcn_00019cf0:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00019d1d ; je 0x19d1d
+cmp dword [ebp + 0xc], 0
+jne short loc_00019d1d ; jne 0x19d1d
+push eax
+push ref_00025f49 ; push 0x25f49
+push 0x13b
+push ref_00025f54 ; push 0x25f54
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00019d1d:
+leave
+ret
+
+fcn_00019d1f:
+push ebp
+xor edx, edx
+mov ebp, esp
+mov eax, dword [ebp + 0xc]
+test eax, 0xfff
+setne dl
+shr eax, 0xc
+add eax, edx
+mov dword [ebp + 0xc], eax
+pop ebp
+jmp near fcn_00019b74 ; jmp 0x19b74
+
+fcn_00019d3d:
+push ebp
+mov ebp, esp
+sub esp, 0x20
+lea eax, [ebp - 0xc]
+push eax
+push dword [ebp + 8]
+call fcn_000198b8 ; call 0x198b8
+add esp, 0x10
+test eax, eax
+jns short loc_00019d5d ; jns 0x19d5d
+mov dword [ebp - 0xc], 0
+
+loc_00019d5d:
+mov eax, dword [ebp - 0xc]
+leave
+ret
+
+fcn_00019d62:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+push dword [ebp + 8]
+push 6
+call fcn_00019d1f ; call 0x19d1f
+leave
+ret
+
+fcn_00019d74:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+push dword [ebp + 8]
+push 0
+call fcn_00019d1f ; call 0x19d1f
+leave
+ret
+
+fcn_00019d86:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 0xc]
+push ebx
+push dword [ebp + 8]
+call fcn_00019d1f ; call 0x19d1f
+add esp, 0x10
+test eax, eax
+je short loc_00019daf ; je 0x19daf
+mov dword [ebp + 0xc], ebx
+mov ebx, dword [ebp - 4]
+mov dword [ebp + 8], eax
+leave
+jmp near fcn_00016fff ; jmp 0x16fff
+
+loc_00019daf:
+xor eax, eax
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00019db6:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 8]
+push ebx
+call fcn_00019d3d ; call 0x19d3d
+add esp, 0x10
+test eax, eax
+je short loc_00019dd9 ; je 0x19dd9
+push edx
+push edx
+push ebx
+push eax
+call fcn_00016fff ; call 0x16fff
+add esp, 0x10
+
+loc_00019dd9:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00019dde:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+push dword [ebp + 8]
+push 6
+call fcn_00019d86 ; call 0x19d86
+leave
+ret
+
+fcn_00019df0:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+push dword [ebp + 8]
+push 0
+call fcn_00019d86 ; call 0x19d86
+leave
+ret
+
+fcn_00019e02:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00019e39 ; je 0x19e39
+test ebx, ebx
+jne short loc_00019e39 ; jne 0x19e39
+push ecx
+push ref_0002619a ; push 0x2619a
+push 0x221
+push ref_00025f54 ; push 0x25f54
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00019e39:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00019e62 ; je 0x19e62
+mov eax, ebx
+neg eax
+cmp esi, eax
+jbe short loc_00019e62 ; jbe 0x19e62
+push edx
+push ref_00026015 ; push 0x26015
+push 0x222
+push ref_00025f54 ; push 0x25f54
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00019e62:
+push eax
+push eax
+push esi
+push edi
+call fcn_00019d1f ; call 0x19d1f
+add esp, 0x10
+test eax, eax
+je short loc_00019e87 ; je 0x19e87
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], ebx
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001713e ; jmp 0x1713e
+
+loc_00019e87:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00019e91:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00019ec1 ; je 0x19ec1
+test ebx, ebx
+jne short loc_00019ec1 ; jne 0x19ec1
+push eax
+push ref_0002619a ; push 0x2619a
+push 0x245
+push ref_00025f54 ; push 0x25f54
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00019ec1:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00019eea ; je 0x19eea
+mov eax, ebx
+neg eax
+cmp esi, eax
+jbe short loc_00019eea ; jbe 0x19eea
+push ecx
+push ref_00026015 ; push 0x26015
+push 0x246
+push ref_00025f54 ; push 0x25f54
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00019eea:
+sub esp, 0xc
+push esi
+call fcn_00019d3d ; call 0x19d3d
+add esp, 0x10
+test eax, eax
+je short loc_00019f06 ; je 0x19f06
+push edx
+push esi
+push ebx
+push eax
+call fcn_0001713e ; call 0x1713e
+add esp, 0x10
+
+loc_00019f06:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00019f0d:
+push ebp
+mov ebp, esp
+sub esp, 0xc
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push 6
+call fcn_00019e02 ; call 0x19e02
+leave
+ret
+
+fcn_00019f22:
+push ebp
+mov ebp, esp
+sub esp, 0xc
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push 0
+call fcn_00019e02 ; call 0x19e02
+leave
+ret
+
+fcn_00019f37:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x14
+mov ebx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+push ebx
+push dword [ebp + 8]
+call fcn_00019d86 ; call 0x19d86
+add esp, 0x10
+mov edi, eax
+test eax, eax
+je short loc_00019f6f ; je 0x19f6f
+test esi, esi
+je short loc_00019f6f ; je 0x19f6f
+cmp ebx, dword [ebp + 0xc]
+cmova ebx, dword [ebp + 0xc]
+push eax
+push ebx
+push esi
+push edi
+call fcn_0001713e ; call 0x1713e
+add esp, 0x10
+
+loc_00019f6f:
+lea esp, [ebp - 0xc]
+mov eax, edi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00019f79:
+push ebp
+mov ebp, esp
+sub esp, 8
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push 4
+call fcn_00019f37 ; call 0x19f37
+leave
+ret
+
+fcn_00019f91:
+push ebp
+mov ebp, esp
+sub esp, 8
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push 6
+call fcn_00019f37 ; call 0x19f37
+leave
+ret
+
+fcn_00019fa9:
+push ebp
+mov ebp, esp
+sub esp, 8
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push 0
+call fcn_00019f37 ; call 0x19f37
+leave
+ret
+
+fcn_00019fc1:
+push ebp
+mov ebp, esp
+pop ebp
+ret
+
+fcn_00019fc6:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_00019ff4 ; je 0x19ff4
+test ebx, 0x400000
+je short loc_00019ff4 ; je 0x19ff4
+push eax
+push ref_00026049 ; push 0x26049
+push 0x33
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_00019ff4:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a019 ; je 0x1a019
+movzx eax, bh
+test eax, eax
+je short loc_0001a019 ; je 0x1a019
+push ecx
+push ref_000260bc ; push 0x260bc
+push 0x34
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a019:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a03f ; je 0x1a03f
+test ebx, 0x3f0000
+je short loc_0001a03f ; je 0x1a03f
+push edx
+push ref_000260e0 ; push 0x260e0
+push 0x35
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a03f:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a065 ; je 0x1a065
+test ebx, 0xff800001
+je short loc_0001a065 ; je 0x1a065
+push eax
+push ref_00026105 ; push 0x26105
+push 0x36
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a065:
+sub esp, 0xc
+push dword [ebp + 0xc]
+push 0
+push 0
+push ebx
+push 0
+call fcn_0001a7eb ; call 0x1a7eb
+add esp, 0x20
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001a07f:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a0ad ; je 0x1a0ad
+test ebx, 0x400000
+je short loc_0001a0ad ; je 0x1a0ad
+push eax
+push ref_00026049 ; push 0x26049
+push 0x5c
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a0ad:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a0d2 ; je 0x1a0d2
+movzx eax, bh
+test eax, eax
+je short loc_0001a0d2 ; je 0x1a0d2
+push ecx
+push ref_000260bc ; push 0x260bc
+push 0x5d
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a0d2:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a0f8 ; je 0x1a0f8
+test ebx, 0x3f0000
+je short loc_0001a0f8 ; je 0x1a0f8
+push edx
+push ref_000260e0 ; push 0x260e0
+push 0x5e
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a0f8:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a11e ; je 0x1a11e
+test ebx, 0xff800001
+je short loc_0001a11e ; je 0x1a11e
+push eax
+push ref_00026105 ; push 0x26105
+push 0x5f
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a11e:
+sub esp, 0xc
+push dword [ebp + 0xc]
+push 0
+push 0
+push ebx
+push 1
+call fcn_0001a7eb ; call 0x1a7eb
+add esp, 0x20
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001a138:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x14
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a16a ; je 0x1a16a
+movzx eax, bh
+test eax, eax
+je short loc_0001a16a ; je 0x1a16a
+push ecx
+push ref_000260bc ; push 0x260bc
+push 0x8a
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a16a:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a193 ; je 0x1a193
+test ebx, 0x3f0000
+je short loc_0001a193 ; je 0x1a193
+push edx
+push ref_000260e0 ; push 0x260e0
+push 0x8b
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a193:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a1bc ; je 0x1a1bc
+test ebx, 0xff800001
+je short loc_0001a1bc ; je 0x1a1bc
+push eax
+push ref_00026105 ; push 0x26105
+push 0x8c
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a1bc:
+sub esp, 0xc
+push dword [ebp + 0xc]
+lea eax, [ebp - 9]
+push eax
+push 1
+push ebx
+push 2
+call fcn_0001a7eb ; call 0x1a7eb
+mov al, byte [ebp - 9]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001a1d8:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a20e ; je 0x1a20e
+movzx eax, bh
+test eax, eax
+je short loc_0001a20e ; je 0x1a20e
+push ecx
+push ref_000260bc ; push 0x260bc
+push 0xbb
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a20e:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a237 ; je 0x1a237
+test ebx, 0x3f0000
+je short loc_0001a237 ; je 0x1a237
+push edx
+push ref_000260e0 ; push 0x260e0
+push 0xbc
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a237:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a260 ; je 0x1a260
+test ebx, 0xff800001
+je short loc_0001a260 ; je 0x1a260
+push eax
+push ref_00026105 ; push 0x26105
+push 0xbd
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a260:
+sub esp, 0xc
+mov eax, esi
+push dword [ebp + 0x10]
+mov byte [ebp - 9], al
+lea eax, [ebp - 9]
+push eax
+push 1
+push ebx
+push 3
+call fcn_0001a7eb ; call 0x1a7eb
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001a282:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x14
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a2b5 ; je 0x1a2b5
+test ebx, 0x3f0000
+je short loc_0001a2b5 ; je 0x1a2b5
+push edx
+push ref_000260e0 ; push 0x260e0
+push 0xea
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a2b5:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a2de ; je 0x1a2de
+test ebx, 0xff800001
+je short loc_0001a2de ; je 0x1a2de
+push eax
+push ref_00026105 ; push 0x26105
+push 0xeb
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a2de:
+sub esp, 0xc
+push dword [ebp + 0xc]
+lea eax, [ebp - 9]
+push eax
+push 1
+push ebx
+push 4
+call fcn_0001a7eb ; call 0x1a7eb
+mov al, byte [ebp - 9]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001a2fa:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a331 ; je 0x1a331
+test ebx, 0x3f0000
+je short loc_0001a331 ; je 0x1a331
+push edx
+push ref_000260e0 ; push 0x260e0
+push 0x11a
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a331:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a35a ; je 0x1a35a
+test ebx, 0xff800001
+je short loc_0001a35a ; je 0x1a35a
+push eax
+push ref_00026105 ; push 0x26105
+push 0x11b
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a35a:
+sub esp, 0xc
+mov eax, esi
+push dword [ebp + 0x10]
+mov byte [ebp - 9], al
+lea eax, [ebp - 9]
+push eax
+push 1
+push ebx
+push 5
+call fcn_0001a7eb ; call 0x1a7eb
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001a37c:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x14
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a3af ; je 0x1a3af
+test ebx, 0x3f0000
+je short loc_0001a3af ; je 0x1a3af
+push edx
+push ref_000260e0 ; push 0x260e0
+push 0x148
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a3af:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a3d8 ; je 0x1a3d8
+test ebx, 0xff800001
+je short loc_0001a3d8 ; je 0x1a3d8
+push eax
+push ref_00026105 ; push 0x26105
+push 0x149
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a3d8:
+sub esp, 0xc
+push dword [ebp + 0xc]
+lea eax, [ebp - 0xa]
+push eax
+push 2
+push ebx
+push 6
+call fcn_0001a7eb ; call 0x1a7eb
+mov ax, word [ebp - 0xa]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001a3f5:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a42c ; je 0x1a42c
+test ebx, 0x3f0000
+je short loc_0001a42c ; je 0x1a42c
+push edx
+push ref_000260e0 ; push 0x260e0
+push 0x178
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a42c:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a455 ; je 0x1a455
+test ebx, 0xff800001
+je short loc_0001a455 ; je 0x1a455
+push eax
+push ref_00026105 ; push 0x26105
+push 0x179
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a455:
+sub esp, 0xc
+push dword [ebp + 0x10]
+lea eax, [ebp - 0xa]
+mov word [ebp - 0xa], si
+push eax
+push 2
+push ebx
+push 7
+call fcn_0001a7eb ; call 0x1a7eb
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001a476:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x14
+mov eax, dword [ebp + 0xc]
+mov ebx, dword [ebp + 8]
+mov word [ebp - 0xc], ax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a4b0 ; je 0x1a4b0
+test ebx, 0x3f0000
+je short loc_0001a4b0 ; je 0x1a4b0
+push edx
+push ref_000260e0 ; push 0x260e0
+push 0x1a7
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a4b0:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a4d9 ; je 0x1a4d9
+test ebx, 0xff800001
+je short loc_0001a4d9 ; je 0x1a4d9
+push eax
+push ref_00026105 ; push 0x26105
+push 0x1a8
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a4d9:
+sub esp, 0xc
+push dword [ebp + 0x10]
+lea eax, [ebp - 0xc]
+push eax
+push 2
+push ebx
+push 0xa
+call fcn_0001a7eb ; call 0x1a7eb
+mov eax, dword [ebp - 0xc]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001a4f5:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a525 ; je 0x1a525
+test esi, esi
+jne short loc_0001a525 ; jne 0x1a525
+push ecx
+push ref_0002619a ; push 0x2619a
+push 0x1d8
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a525:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a54e ; je 0x1a54e
+test ebx, 0x3f0000
+je short loc_0001a54e ; je 0x1a54e
+push edx
+push ref_000260e0 ; push 0x260e0
+push 0x1d9
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a54e:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a577 ; je 0x1a577
+test ebx, 0xff800001
+je short loc_0001a577 ; je 0x1a577
+push eax
+push ref_00026105 ; push 0x26105
+push 0x1da
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a577:
+sub esp, 0xc
+push dword [ebp + 0x10]
+push esi
+push 0x20
+push ebx
+push 8
+call fcn_0001a7eb ; call 0x1a7eb
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001a58f:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a5bf ; je 0x1a5bf
+test esi, esi
+jne short loc_0001a5bf ; jne 0x1a5bf
+push eax
+push ref_0002619a ; push 0x2619a
+push 0x207
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a5bf:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a5e8 ; je 0x1a5e8
+test ebx, 0x3f0000
+jne short loc_0001a5e8 ; jne 0x1a5e8
+push ecx
+push ref_0002612f ; push 0x2612f
+push 0x208
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a5e8:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a616 ; je 0x1a616
+mov eax, ebx
+shr eax, 0x10
+and eax, 0x3f
+cmp eax, 0x20
+jbe short loc_0001a616 ; jbe 0x1a616
+push edx
+push ref_00026154 ; push 0x26154
+push 0x209
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a616:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a63f ; je 0x1a63f
+test ebx, 0xff800001
+je short loc_0001a63f ; je 0x1a63f
+push eax
+push ref_00026105 ; push 0x26105
+push 0x20a
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a63f:
+sub esp, 0xc
+mov eax, ebx
+push dword [ebp + 0x10]
+shr eax, 0x10
+and eax, 0x3f
+push esi
+push eax
+push ebx
+push 9
+call fcn_0001a7eb ; call 0x1a7eb
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001a65e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a692 ; je 0x1a692
+test edi, edi
+jne short loc_0001a692 ; jne 0x1a692
+push eax
+push ref_0002617a ; push 0x2617a
+push 0x23c
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a692:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a6b9 ; je 0x1a6b9
+cmp dword [ebp + 0x10], 0
+jne short loc_0001a6b9 ; jne 0x1a6b9
+push eax
+push ref_00026196 ; push 0x26196
+push 0x23d
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a6b9:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a6e2 ; je 0x1a6e2
+test ebx, 0x3f0000
+jne short loc_0001a6e2 ; jne 0x1a6e2
+push eax
+push ref_0002612f ; push 0x2612f
+push 0x23e
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a6e2:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a710 ; je 0x1a710
+mov eax, ebx
+shr eax, 0x10
+and eax, 0x3f
+cmp eax, 0x20
+jbe short loc_0001a710 ; jbe 0x1a710
+push esi
+push ref_00026154 ; push 0x26154
+push 0x23f
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a710:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a739 ; je 0x1a739
+test ebx, 0xff800001
+je short loc_0001a739 ; je 0x1a739
+push ecx
+push ref_00026105 ; push 0x26105
+push 0x240
+push ref_0002607b ; push 0x2607b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a739:
+mov esi, ebx
+shr esi, 0x10
+push eax
+and esi, 0x3f
+push esi
+push edi
+push dword [ebp + 0x10]
+call fcn_0001713e ; call 0x1713e
+pop edx
+push dword [ebp + 0x14]
+push eax
+push esi
+push ebx
+push 0xb
+call fcn_0001a7eb ; call 0x1a7eb
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001a762:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x14
+lea eax, [ebp - 0xc]
+push eax
+push 0
+push 0
+push ref_000290bc ; push 0x290bc
+call fcn_0001975d ; call 0x1975d
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001a7bf ; je 0x1a7bf
+test ebx, ebx
+jns short loc_0001a7bf ; jns 0x1a7bf
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001a7aa ; je 0x1a7aa
+push ecx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001a7aa:
+push edx
+push ref_000206f4 ; push 0x206f4
+push 0x24
+push ref_000261b1 ; push 0x261b1
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a7bf:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001a7e3 ; je 0x1a7e3
+cmp dword [ebp - 0xc], 0
+jne short loc_0001a7e3 ; jne 0x1a7e3
+push eax
+push ref_000261f5 ; push 0x261f5
+push 0x25
+push ref_000261b1 ; push 0x261b1
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001a7e3:
+mov eax, dword [ebp - 0xc]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001a7eb:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0x18]
+push ebx
+mov ebx, dword [ebp + 0xc]
+call fcn_0001a762 ; call 0x1a762
+mov ecx, ebx
+shr ecx, 1
+and ecx, 0x7f
+push edx
+push dword [ebp + 0x14]
+lea edx, [ebp + 0x10]
+push edx
+mov edx, ebx
+shr edx, 0x16
+movzx ebx, bh
+and edx, 1
+push edx
+push dword [ebp + 8]
+push ebx
+push ecx
+push eax
+call dword [eax] ; ucall
+add esp, 0x20
+test esi, esi
+je short loc_0001a827 ; je 0x1a827
+mov dword [esi], eax
+
+loc_0001a827:
+mov eax, dword [ebp + 0x10]
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001a831:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+movzx eax, byte [ebp + 8]
+push eax
+push 0x80
+call fcn_00018eea ; call 0x18eea
+mov eax, dword [ebp + 8]
+leave
+ret
+
+fcn_0001a84b:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+movzx eax, byte [ebp + 8]
+push eax
+push 0x80
+call fcn_00018eea ; call 0x18eea
+mov eax, dword [ebp + 8]
+leave
+ret
+
+fcn_0001a865:
+push ebp
+xor eax, eax
+mov ebp, esp
+pop ebp
+ret
+
+fcn_0001a86c:
+push ebp
+xor eax, eax
+mov ebp, esp
+pop ebp
+ret
+
+fcn_0001a873:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00017d8b ; jmp 0x17d8b
+
+fcn_0001a882:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00017dc2 ; jmp 0x17dc2
+
+fcn_0001a891:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00017e4e ; jmp 0x17e4e
+
+fcn_0001a8a0:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00017ed8 ; jmp 0x17ed8
+
+fcn_0001a8af:
+push ebp
+mov ebp, esp
+movzx eax, byte [ebp + 0x18]
+mov dword [ebp + 0xc], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00017da5 ; jmp 0x17da5
+
+fcn_0001a8c5:
+push ebp
+mov ebp, esp
+movzx eax, word [ebp + 0x18]
+mov dword [ebp + 0xc], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00017e04 ; jmp 0x17e04
+
+fcn_0001a8db:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x18]
+mov dword [ebp + 0xc], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00017e8f ; jmp 0x17e8f
+
+fcn_0001a8f0:
+push ebp
+mov ebp, esp
+mov ecx, dword [ebp + 0x10]
+mov eax, dword [ebp + 0x18]
+mov edx, dword [ebp + 0x1c]
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+pop ebp
+jmp near fcn_00017f28 ; jmp 0x17f28
+
+fcn_0001a90b:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00018ee1 ; jmp 0x18ee1
+
+fcn_0001a91a:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00018ef6 ; jmp 0x18ef6
+
+fcn_0001a929:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00018f64 ; jmp 0x18f64
+
+fcn_0001a938:
+push ebp
+mov ebp, esp
+movzx eax, byte [ebp + 0x18]
+mov dword [ebp + 0xc], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00018eea ; jmp 0x18eea
+
+fcn_0001a94e:
+push ebp
+mov ebp, esp
+movzx eax, word [ebp + 0x18]
+mov dword [ebp + 0xc], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00018f27 ; jmp 0x18f27
+
+fcn_0001a964:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x18]
+mov dword [ebp + 0xc], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00018f97 ; jmp 0x18f97
+
+fcn_0001a979:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00017d37 ; jmp 0x17d37
+
+fcn_0001a988:
+push ebp
+mov ebp, esp
+mov ecx, dword [ebp + 0x10]
+mov eax, dword [ebp + 0x18]
+mov edx, dword [ebp + 0x1c]
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+pop ebp
+jmp near fcn_00017d61 ; jmp 0x17d61
+
+fcn_0001a9a3:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0x10]
+cmp dword [ebp + 0x1c], 0
+mov ecx, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov dword [ebp - 0x1c], eax
+mov edi, dword [ebp + 0x14]
+mov eax, 0x80000002
+mov ebx, dword [ebp + 0x18]
+je near loc_0001aa50 ; je 0x1aa50
+cmp esi, 0xb
+ja short loc_0001aa50 ; ja 0x1aa50
+lea edx, [esi - 4]
+cmp edx, 3
+mov edx, 1
+cmovbe ebx, edx
+and esi, 3
+cmp esi, 3
+jne short loc_0001a9ec ; jne 0x1a9ec
+test cl, cl
+je short loc_0001aa50 ; je 0x1aa50
+
+loc_0001a9ec:
+mov eax, 0xffff
+xor edx, edx
+test cl, cl
+je short loc_0001a9fc ; je 0x1a9fc
+or eax, 0xffffffff
+xor edx, edx
+
+loc_0001a9fc:
+test ebx, ebx
+jne short loc_0001aa12 ; jne 0x1aa12
+cmp edi, edx
+jb short loc_0001aa46 ; jb 0x1aa46
+ja short loc_0001aa0b ; ja 0x1aa0b
+
+loc_0001aa06:
+cmp dword [ebp - 0x1c], eax
+jbe short loc_0001aa46 ; jbe 0x1aa46
+
+loc_0001aa0b:
+mov eax, 0x80000003
+jmp short loc_0001aa50 ; jmp 0x1aa50
+
+loc_0001aa12:
+push ecx
+push esi
+push edx
+push eax
+call fcn_0001724f ; call 0x1724f
+lea ecx, [ebx - 1]
+add esp, 0x10
+cmp edx, 0
+jbe short loc_0001aa4a ; jbe 0x1aa4a
+
+loc_0001aa26:
+push ecx
+mov ecx, ebx
+xor ebx, ebx
+sub eax, ecx
+sbb edx, ebx
+add eax, 1
+push esi
+adc edx, 0
+push edx
+push eax
+call fcn_0001fdda ; call 0x1fdda
+add esp, 0x10
+cmp edi, edx
+ja short loc_0001aa0b ; ja 0x1aa0b
+jae short loc_0001aa06 ; jae 0x1aa06
+
+loc_0001aa46:
+xor eax, eax
+jmp short loc_0001aa50 ; jmp 0x1aa50
+
+loc_0001aa4a:
+cmp eax, ecx
+jb short loc_0001aa0b ; jb 0x1aa0b
+jmp short loc_0001aa26 ; jmp 0x1aa26
+
+loc_0001aa50:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001aa58:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x24
+mov ebx, dword [ebp + 0x20]
+mov edi, dword [ebp + 0x18]
+mov esi, dword [ebp + 0x14]
+mov edx, dword [ebp + 0x10]
+push ebx
+push dword [ebp + 0x1c]
+mov dword [ebp - 0x1c], edx
+push edi
+push esi
+push edx
+push 1
+call fcn_0001a9a3 ; call 0x1a9a3
+add esp, 0x20
+test eax, eax
+js near loc_0001ab7d ; js 0x1ab7d
+mov edx, dword [ebp - 0x1c]
+mov dword [ebp - 0x24], 0
+mov al, byte [edx + ref_000295ec] ; mov al, byte [edx + 0x295ec]
+mov byte [ebp - 0x1e], al
+mov eax, edx
+and eax, 3
+mov dword [ebp - 0x1c], eax
+movzx eax, byte [eax + ref_000295f8] ; movzx eax, byte [eax + 0x295f8]
+dec eax
+test ebx, eax
+movzx eax, byte [edx + ref_000295f8] ; movzx eax, byte [edx + 0x295f8]
+sete byte [ebp - 0x1d]
+mov dword [ebp - 0x28], eax
+
+loc_0001aabc:
+cmp dword [ebp + 0x1c], 0
+je near loc_0001ab7b ; je 0x1ab7b
+cmp dword [ebp - 0x1c], 0
+jne short loc_0001aadc ; jne 0x1aadc
+sub esp, 0xc
+push esi
+call fcn_00017d8b ; call 0x17d8b
+mov byte [ebx], al
+jmp near loc_0001ab64 ; jmp 0x1ab64
+
+loc_0001aadc:
+cmp dword [ebp - 0x1c], 1
+jne short loc_0001ab0d ; jne 0x1ab0d
+cmp byte [ebp - 0x1d], 0
+je short loc_0001aaf6 ; je 0x1aaf6
+sub esp, 0xc
+push esi
+call fcn_00017dc2 ; call 0x17dc2
+mov word [ebx], ax
+jmp short loc_0001ab64 ; jmp 0x1ab64
+
+loc_0001aaf6:
+sub esp, 0xc
+push esi
+call fcn_00017dc2 ; call 0x17dc2
+pop edx
+pop ecx
+movzx eax, ax
+push eax
+push ebx
+call fcn_000172cb ; call 0x172cb
+jmp short loc_0001ab64 ; jmp 0x1ab64
+
+loc_0001ab0d:
+cmp dword [ebp - 0x1c], 2
+jne short loc_0001ab3a ; jne 0x1ab3a
+cmp byte [ebp - 0x1d], 0
+je short loc_0001ab26 ; je 0x1ab26
+sub esp, 0xc
+push esi
+call fcn_00017e4e ; call 0x17e4e
+mov dword [ebx], eax
+jmp short loc_0001ab64 ; jmp 0x1ab64
+
+loc_0001ab26:
+sub esp, 0xc
+push esi
+call fcn_00017e4e ; call 0x17e4e
+pop edx
+pop ecx
+push eax
+push ebx
+call fcn_000173b2 ; call 0x173b2
+jmp short loc_0001ab64 ; jmp 0x1ab64
+
+loc_0001ab3a:
+cmp byte [ebp - 0x1d], 0
+je short loc_0001ab50 ; je 0x1ab50
+sub esp, 0xc
+push esi
+call fcn_00017ed8 ; call 0x17ed8
+mov dword [ebx], eax
+mov dword [ebx + 4], edx
+jmp short loc_0001ab64 ; jmp 0x1ab64
+
+loc_0001ab50:
+sub esp, 0xc
+push esi
+call fcn_00017ed8 ; call 0x17ed8
+add esp, 0xc
+push edx
+push eax
+push ebx
+call fcn_00017424 ; call 0x17424
+
+loc_0001ab64:
+movzx eax, byte [ebp - 0x1e]
+add esp, 0x10
+add esi, dword [ebp - 0x28]
+adc edi, dword [ebp - 0x24]
+dec dword [ebp + 0x1c]
+add ebx, eax
+jmp near loc_0001aabc ; jmp 0x1aabc
+
+loc_0001ab7b:
+xor eax, eax
+
+loc_0001ab7d:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001ab85:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x24
+mov ebx, dword [ebp + 0x20]
+mov edi, dword [ebp + 0x18]
+mov esi, dword [ebp + 0x14]
+mov edx, dword [ebp + 0x10]
+push ebx
+push dword [ebp + 0x1c]
+mov dword [ebp - 0x1c], edx
+push edi
+push esi
+push edx
+push 1
+call fcn_0001a9a3 ; call 0x1a9a3
+add esp, 0x20
+test eax, eax
+js near loc_0001ac92 ; js 0x1ac92
+mov edx, dword [ebp - 0x1c]
+mov dword [ebp - 0x24], 0
+mov al, byte [edx + ref_000295ec] ; mov al, byte [edx + 0x295ec]
+mov byte [ebp - 0x1e], al
+mov eax, edx
+and eax, 3
+mov dword [ebp - 0x1c], eax
+movzx eax, byte [eax + ref_000295f8] ; movzx eax, byte [eax + 0x295f8]
+dec eax
+test ebx, eax
+movzx eax, byte [edx + ref_000295f8] ; movzx eax, byte [edx + 0x295f8]
+sete byte [ebp - 0x1d]
+mov dword [ebp - 0x28], eax
+
+loc_0001abe9:
+cmp dword [ebp + 0x1c], 0
+je near loc_0001ac90 ; je 0x1ac90
+cmp dword [ebp - 0x1c], 0
+jne short loc_0001ac07 ; jne 0x1ac07
+push eax
+push eax
+movzx eax, byte [ebx]
+push eax
+push esi
+call fcn_00017da5 ; call 0x17da5
+jmp short loc_0001ac79 ; jmp 0x1ac79
+
+loc_0001ac07:
+cmp dword [ebp - 0x1c], 1
+jne short loc_0001ac31 ; jne 0x1ac31
+cmp byte [ebp - 0x1d], 0
+je short loc_0001ac1a ; je 0x1ac1a
+push eax
+push eax
+movzx eax, word [ebx]
+jmp short loc_0001ac28 ; jmp 0x1ac28
+
+loc_0001ac1a:
+sub esp, 0xc
+push ebx
+call fcn_00017299 ; call 0x17299
+pop edx
+pop ecx
+movzx eax, ax
+
+loc_0001ac28:
+push eax
+push esi
+call fcn_00017e04 ; call 0x17e04
+jmp short loc_0001ac79 ; jmp 0x1ac79
+
+loc_0001ac31:
+cmp dword [ebp - 0x1c], 2
+jne short loc_0001ac57 ; jne 0x1ac57
+cmp byte [ebp - 0x1d], 0
+je short loc_0001ac43 ; je 0x1ac43
+push eax
+push eax
+push dword [ebx]
+jmp short loc_0001ac4f ; jmp 0x1ac4f
+
+loc_0001ac43:
+sub esp, 0xc
+push ebx
+call fcn_0001737e ; call 0x1737e
+pop edx
+pop ecx
+push eax
+
+loc_0001ac4f:
+push esi
+call fcn_00017e8f ; call 0x17e8f
+jmp short loc_0001ac79 ; jmp 0x1ac79
+
+loc_0001ac57:
+cmp byte [ebp - 0x1d], 0
+je short loc_0001ac65 ; je 0x1ac65
+push eax
+push dword [ebx + 4]
+push dword [ebx]
+jmp short loc_0001ac73 ; jmp 0x1ac73
+
+loc_0001ac65:
+sub esp, 0xc
+push ebx
+call fcn_000173ed ; call 0x173ed
+add esp, 0xc
+push edx
+push eax
+
+loc_0001ac73:
+push esi
+call fcn_00017f28 ; call 0x17f28
+
+loc_0001ac79:
+movzx eax, byte [ebp - 0x1e]
+add esp, 0x10
+add esi, dword [ebp - 0x28]
+adc edi, dword [ebp - 0x24]
+dec dword [ebp + 0x1c]
+add ebx, eax
+jmp near loc_0001abe9 ; jmp 0x1abe9
+
+loc_0001ac90:
+xor eax, eax
+
+loc_0001ac92:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001ac9a:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x24
+mov ebx, dword [ebp + 0x20]
+mov edi, dword [ebp + 0x18]
+mov esi, dword [ebp + 0x14]
+mov edx, dword [ebp + 0x10]
+push ebx
+push dword [ebp + 0x1c]
+mov dword [ebp - 0x1c], edx
+push edi
+push esi
+push edx
+push 0
+call fcn_0001a9a3 ; call 0x1a9a3
+add esp, 0x20
+test eax, eax
+js near loc_0001ad90 ; js 0x1ad90
+mov edx, dword [ebp - 0x1c]
+mov dword [ebp - 0x24], 0
+mov al, byte [edx + ref_000295ec] ; mov al, byte [edx + 0x295ec]
+mov byte [ebp - 0x1e], al
+mov eax, edx
+and eax, 3
+mov dword [ebp - 0x1c], eax
+movzx eax, byte [eax + ref_000295f8] ; movzx eax, byte [eax + 0x295f8]
+dec eax
+test ebx, eax
+movzx eax, byte [edx + ref_000295f8] ; movzx eax, byte [edx + 0x295f8]
+sete byte [ebp - 0x1d]
+mov dword [ebp - 0x28], eax
+
+loc_0001acfe:
+cmp dword [ebp + 0x1c], 0
+je near loc_0001ad8e ; je 0x1ad8e
+cmp dword [ebp - 0x1c], 0
+jne short loc_0001ad1b ; jne 0x1ad1b
+sub esp, 0xc
+push esi
+call fcn_00018ee1 ; call 0x18ee1
+mov byte [ebx], al
+jmp short loc_0001ad77 ; jmp 0x1ad77
+
+loc_0001ad1b:
+cmp dword [ebp - 0x1c], 1
+jne short loc_0001ad4c ; jne 0x1ad4c
+cmp byte [ebp - 0x1d], 0
+je short loc_0001ad35 ; je 0x1ad35
+sub esp, 0xc
+push esi
+call fcn_00018ef6 ; call 0x18ef6
+mov word [ebx], ax
+jmp short loc_0001ad77 ; jmp 0x1ad77
+
+loc_0001ad35:
+sub esp, 0xc
+push esi
+call fcn_00018ef6 ; call 0x18ef6
+pop edx
+pop ecx
+movzx eax, ax
+push eax
+push ebx
+call fcn_000172cb ; call 0x172cb
+jmp short loc_0001ad77 ; jmp 0x1ad77
+
+loc_0001ad4c:
+cmp dword [ebp - 0x1c], 2
+jne short loc_0001ad7a ; jne 0x1ad7a
+cmp byte [ebp - 0x1d], 0
+je short loc_0001ad65 ; je 0x1ad65
+sub esp, 0xc
+push esi
+call fcn_00018f64 ; call 0x18f64
+mov dword [ebx], eax
+jmp short loc_0001ad77 ; jmp 0x1ad77
+
+loc_0001ad65:
+sub esp, 0xc
+push esi
+call fcn_00018f64 ; call 0x18f64
+pop edx
+pop ecx
+push eax
+push ebx
+call fcn_000173b2 ; call 0x173b2
+
+loc_0001ad77:
+add esp, 0x10
+
+loc_0001ad7a:
+movzx eax, byte [ebp - 0x1e]
+add esi, dword [ebp - 0x28]
+adc edi, dword [ebp - 0x24]
+dec dword [ebp + 0x1c]
+add ebx, eax
+jmp near loc_0001acfe ; jmp 0x1acfe
+
+loc_0001ad8e:
+xor eax, eax
+
+loc_0001ad90:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001ad98:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x24
+mov ebx, dword [ebp + 0x20]
+mov edi, dword [ebp + 0x18]
+mov esi, dword [ebp + 0x14]
+mov edx, dword [ebp + 0x10]
+push ebx
+push dword [ebp + 0x1c]
+mov dword [ebp - 0x1c], edx
+push edi
+push esi
+push edx
+push 0
+call fcn_0001a9a3 ; call 0x1a9a3
+add esp, 0x20
+test eax, eax
+js near loc_0001ae7a ; js 0x1ae7a
+mov edx, dword [ebp - 0x1c]
+mov dword [ebp - 0x24], 0
+mov al, byte [edx + ref_000295ec] ; mov al, byte [edx + 0x295ec]
+mov byte [ebp - 0x1e], al
+mov eax, edx
+and eax, 3
+mov dword [ebp - 0x1c], eax
+movzx eax, byte [eax + ref_000295f8] ; movzx eax, byte [eax + 0x295f8]
+dec eax
+test ebx, eax
+movzx eax, byte [edx + ref_000295f8] ; movzx eax, byte [edx + 0x295f8]
+sete byte [ebp - 0x1d]
+mov dword [ebp - 0x28], eax
+
+loc_0001adfc:
+cmp dword [ebp + 0x1c], 0
+je short loc_0001ae78 ; je 0x1ae78
+cmp dword [ebp - 0x1c], 0
+jne short loc_0001ae16 ; jne 0x1ae16
+push eax
+push eax
+movzx eax, byte [ebx]
+push eax
+push esi
+call fcn_00018eea ; call 0x18eea
+jmp short loc_0001ae64 ; jmp 0x1ae64
+
+loc_0001ae16:
+cmp dword [ebp - 0x1c], 1
+jne short loc_0001ae40 ; jne 0x1ae40
+cmp byte [ebp - 0x1d], 0
+je short loc_0001ae29 ; je 0x1ae29
+push eax
+push eax
+movzx eax, word [ebx]
+jmp short loc_0001ae37 ; jmp 0x1ae37
+
+loc_0001ae29:
+sub esp, 0xc
+push ebx
+call fcn_00017299 ; call 0x17299
+pop edx
+pop ecx
+movzx eax, ax
+
+loc_0001ae37:
+push eax
+push esi
+call fcn_00018f27 ; call 0x18f27
+jmp short loc_0001ae64 ; jmp 0x1ae64
+
+loc_0001ae40:
+cmp dword [ebp - 0x1c], 2
+jne short loc_0001ae67 ; jne 0x1ae67
+cmp byte [ebp - 0x1d], 0
+je short loc_0001ae52 ; je 0x1ae52
+push eax
+push eax
+push dword [ebx]
+jmp short loc_0001ae5e ; jmp 0x1ae5e
+
+loc_0001ae52:
+sub esp, 0xc
+push ebx
+call fcn_0001737e ; call 0x1737e
+pop edx
+pop ecx
+push eax
+
+loc_0001ae5e:
+push esi
+call fcn_00018f97 ; call 0x18f97
+
+loc_0001ae64:
+add esp, 0x10
+
+loc_0001ae67:
+movzx eax, byte [ebp - 0x1e]
+add esi, dword [ebp - 0x28]
+adc edi, dword [ebp - 0x24]
+dec dword [ebp + 0x1c]
+add ebx, eax
+jmp short loc_0001adfc ; jmp 0x1adfc
+
+loc_0001ae78:
+xor eax, eax
+
+loc_0001ae7a:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001ae82:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x10
+push dword [ebp + 8]
+call fcn_000198e8 ; call 0x198e8
+mov edx, dword [ebp + 0xc]
+add esp, 0x10
+mov edx, dword [edx]
+mov dword [edx + 0x60], ref_00029610 ; mov dword [edx + 0x60], 0x29610
+cmp eax, 0x80000014
+jne short loc_0001aec4 ; jne 0x1aec4
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001af18 ; je 0x1af18
+push ecx
+push ref_00029610 ; push 0x29610
+push ref_0002620e ; push 0x2620e
+push 0x40
+call fcn_00015487 ; call 0x15487
+jmp short loc_0001af15 ; jmp 0x1af15
+
+loc_0001aec4:
+sub esp, 0xc
+push ref_00029604 ; push 0x29604
+call fcn_0001972b ; call 0x1972b
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001af18 ; je 0x1af18
+test ebx, ebx
+jns short loc_0001af18 ; jns 0x1af18
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001af00 ; je 0x1af00
+push edx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001af00:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x35c
+push ref_0002624c ; push 0x2624c
+call fcn_0001548c ; call 0x1548c
+
+loc_0001af15:
+add esp, 0x10
+
+loc_0001af18:
+xor eax, eax
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001af1f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov al, byte [ebp + 0xc]
+mov esi, dword [ebp + 8]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov byte [ebp - 0x28], al
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001af62 ; je 0x1af62
+mov eax, dword [ebp - 0x28]
+sub esp, 0xc
+push dword [ebp + 0x14]
+and eax, 0x7f
+push ebx
+add eax, eax
+push eax
+push ref_0002627d ; push 0x2627d
+push 0x80000
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_0001af62:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001af8b ; je 0x1af8b
+cmp dword [esi - 0x18], 0x626d7370
+je short loc_0001af8b ; je 0x1af8b
+push ecx
+push ref_000262c8 ; push 0x262c8
+push 0x43
+push ref_000262dd ; push 0x262dd
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+jmp short loc_0001af8e ; jmp 0x1af8e
+
+loc_0001af8b:
+sub esi, 0x18
+
+loc_0001af8e:
+push edx
+mov eax, edi
+push edx
+movzx edi, al
+mov al, byte [ebp - 0x28]
+push dword [ebp + 0x20]
+push dword [ebp + 0x1c]
+push edi
+push dword [ebp + 0x14]
+push ebx
+push eax
+call fcn_0001b3e8 ; call 0x1b3e8
+add esp, 0x14
+push esi
+mov ebx, eax
+call fcn_0001b2c0 ; call 0x1b2c0
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_0001afd4 ; je 0x1afd4
+push eax
+push eax
+push ref_00026307 ; push 0x26307
+push 0x80000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001afd4:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001afde:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 0xc]
+mov eax, dword [ebp + 8]
+mov dword [ebx], 0x626d7370
+mov dword [ebx + 4], eax
+lea eax, [ebp - 0xc]
+push eax
+push 0
+push 0
+push ref_000291dc ; push 0x291dc
+call fcn_0001975d ; call 0x1975d
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001b04e ; je 0x1b04e
+test esi, esi
+jns short loc_0001b04e ; jns 0x1b04e
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001b036 ; je 0x1b036
+push edx
+push esi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001b036:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0xee
+push ref_000262dd ; push 0x262dd
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001b04e:
+mov eax, dword [ebp - 0xc]
+movzx edx, word [eax + 0x388]
+add eax, 0x38e
+mov dword [ebx + 8], edx
+mov dl, byte [eax - 1]
+mov dword [ebx + 0xce], eax
+lea eax, [ebx + 0x18]
+mov dword [ebx + 0xc], 0x80000010
+mov dword [ebx + 0x10], ref_000290bc ; mov dword [ebx + 0x10], 0x290bc
+mov byte [ebx + 0xcd], dl
+mov dword [ebx + 0x14], eax
+mov dword [ebx + 0x18], fcn_0001af1f ; mov dword [ebx + 0x18], 0x1af1f
+mov dword [ebx + 0x1c], fcn_0001b2a2 ; mov dword [ebx + 0x1c], 0x1b2a2
+mov dword [ebx + 0x20], fcn_0001b2ac ; mov dword [ebx + 0x20], 0x1b2ac
+mov dword [ebx + 0x24], fcn_0001b2b6 ; mov dword [ebx + 0x24], 0x1b2b6
+mov dword [ebx + 0x38], 0x80000020
+mov dword [ebx + 0x3c], ref_0002909c ; mov dword [ebx + 0x3c], 0x2909c
+mov dword [ebx + 0x40], fcn_0001b259 ; mov dword [ebx + 0x40], 0x1b259
+mov byte [ebx + 0x44], 0
+mov byte [ebx + 0xd2], 0
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001b0c6:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001b0e5 ; je 0x1b0e5
+push eax
+push eax
+push ref_0002631f ; push 0x2631f
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001b0e5:
+sub esp, 0xc
+push 0x11b
+call fcn_00019d3d ; call 0x19d3d
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+jne short loc_0001b11e ; jne 0x1b11e
+call fcn_00015479 ; call 0x15479
+mov ebx, 0x80000009
+test al, al
+je near loc_0001b250 ; je 0x1b250
+push eax
+push eax
+push ref_0002633f ; push 0x2633f
+push 0x80000000
+jmp near loc_0001b248 ; jmp 0x1b248
+
+loc_0001b11e:
+push eax
+push eax
+push ebx
+push dword [ebp + 0xc]
+call fcn_0001afde ; call 0x1afde
+add esp, 0xc
+push 3
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add esp, 0xc
+push dword [ebx + 8]
+push 0xffe0
+mov esi, eax
+lea eax, [eax + 0x20]
+push eax
+call fcn_00018b68 ; call 0x18b68
+pop eax
+pop edx
+lea eax, [esi + 4]
+add esi, 0x40
+push 1
+push eax
+call fcn_00018730 ; call 0x18730
+pop ecx
+pop eax
+push 0x10
+push esi
+call fcn_00018730 ; call 0x18730
+pop eax
+pop edx
+push 8
+push esi
+call fcn_00018730 ; call 0x18730
+add esp, 0xc
+push 1
+push 0xf9
+push esi
+call fcn_0001878a ; call 0x1878a
+pop ecx
+pop esi
+push 0xff
+push 0
+call fcn_0001b33b ; call 0x1b33b
+lea eax, [ebx + 0xc]
+mov dword [esp], eax
+call fcn_0001972b ; call 0x1972b
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001b1e1 ; je 0x1b1e1
+test esi, esi
+jns short loc_0001b1e1 ; jns 0x1b1e1
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001b1c9 ; je 0x1b1c9
+push eax
+push esi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001b1c9:
+push esi
+push ref_000206f4 ; push 0x206f4
+push 0xc4
+push ref_000262dd ; push 0x262dd
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001b1e1:
+sub esp, 0xc
+add ebx, 0x38
+push ebx
+call fcn_0001977f ; call 0x1977f
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001b234 ; je 0x1b234
+test ebx, ebx
+jns short loc_0001b234 ; jns 0x1b234
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001b21c ; je 0x1b21c
+push ecx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001b21c:
+push edx
+push ref_000206f4 ; push 0x206f4
+push 0xca
+push ref_000262dd ; push 0x262dd
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001b234:
+call fcn_00015479 ; call 0x15479
+xor ebx, ebx
+test al, al
+je short loc_0001b250 ; je 0x1b250
+push eax
+push eax
+push ref_00026368 ; push 0x26368
+push 0x40
+
+loc_0001b248:
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001b250:
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001b259:
+push ebp
+mov ebp, esp
+push ebx
+push ecx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001b28d ; je 0x1b28d
+cmp dword [ebx - 0x38], 0x626d7370
+je short loc_0001b28d ; je 0x1b28d
+push edx
+push ref_000262c8 ; push 0x262c8
+push 0x120
+push ref_000262dd ; push 0x262dd
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+jmp short loc_0001b290 ; jmp 0x1b290
+
+loc_0001b28d:
+sub ebx, 0x38
+
+loc_0001b290:
+push eax
+push eax
+push ebx
+push dword [ebp + 8]
+call fcn_0001afde ; call 0x1afde
+xor eax, eax
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001b2a2:
+push ebp
+mov eax, 0x80000003
+mov ebp, esp
+pop ebp
+ret
+
+fcn_0001b2ac:
+push ebp
+mov eax, 0x80000003
+mov ebp, esp
+pop ebp
+ret
+
+fcn_0001b2b6:
+push ebp
+mov eax, 0x80000003
+mov ebp, esp
+pop ebp
+ret
+
+fcn_0001b2c0:
+push ebp
+mov ebp, esp
+pop ebp
+ret
+
+fcn_0001b2c5:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 8
+push 3
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x20
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+and ebx, 0xffe0
+add esp, 0x10
+test al, al
+je short loc_0001b317 ; je 0x1b317
+test ebx, ebx
+je short loc_0001b302 ; je 0x1b302
+cmp ebx, 0xffe0
+jne short loc_0001b317 ; jne 0x1b317
+
+loc_0001b302:
+push eax
+push ref_00026386 ; push 0x26386
+push 0x2c
+push ref_000263b4 ; push 0x263b4
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001b317:
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001b31e:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_0001b2c5 ; call 0x1b2c5
+movzx ebx, bl
+add eax, ebx
+mov dword [ebp + 8], eax
+pop edx
+pop ebx
+pop ebp
+jmp near fcn_00018ee1 ; jmp 0x18ee1
+
+fcn_0001b33b:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_0001b2c5 ; call 0x1b2c5
+mov edx, esi
+movzx ebx, bl
+movzx esi, dl
+mov dword [ebp + 0xc], esi
+add eax, ebx
+mov dword [ebp + 8], eax
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00018eea ; jmp 0x18eea
+
+fcn_0001b363:
+push ebp
+mov ebp, esp
+push ebx
+mov ebx, 0x186a0
+push eax
+
+loc_0001b36d:
+sub esp, 0xc
+push 0
+call fcn_0001b31e ; call 0x1b31e
+mov edx, dword [ebp + 8]
+add esp, 0x10
+mov byte [edx], al
+test al, 0x8e
+jne short loc_0001b397 ; jne 0x1b397
+sub esp, 0xc
+push 0xa
+call fcn_0001bb03 ; call 0x1bb03
+add esp, 0x10
+dec ebx
+jne short loc_0001b36d ; jne 0x1b36d
+xor eax, eax
+jmp short loc_0001b399 ; jmp 0x1b399
+
+loc_0001b397:
+mov al, 1
+
+loc_0001b399:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001b39e:
+push ebp
+mov ebp, esp
+push ebx
+mov ebx, 0x80000012
+sub esp, 0x10
+push 0
+call fcn_0001b31e ; call 0x1b31e
+add esp, 0x10
+test al, 0x40
+jne short loc_0001b3e1 ; jne 0x1b3e1
+test al, 1
+je short loc_0001b3cf ; je 0x1b3cf
+push ecx
+push ecx
+push 0xff
+push 0
+call fcn_0001b33b ; call 0x1b33b
+add esp, 0x10
+jmp short loc_0001b3e1 ; jmp 0x1b3e1
+
+loc_0001b3cf:
+push edx
+movzx eax, al
+push edx
+xor ebx, ebx
+push eax
+push 0
+call fcn_0001b33b ; call 0x1b33b
+add esp, 0x10
+
+loc_0001b3e1:
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001b3e8:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x3c
+mov al, byte [ebp + 0x14]
+cmp dword [ebp + 0x10], 1
+mov edi, dword [ebp + 0x18]
+mov byte [ebp - 0x2f], al
+jbe short loc_0001b412 ; jbe 0x1b412
+cmp dword [ebp + 0x1c], 0
+je near loc_0001b914 ; je 0x1b914
+test edi, edi
+je near loc_0001b914 ; je 0x1b914
+
+loc_0001b412:
+call fcn_0001b39e ; call 0x1b39e
+test eax, eax
+js near loc_0001b919 ; js 0x1b919
+mov al, byte [ebp + 8]
+mov dword [ebp - 0x34], 3
+mov byte [ebp - 0x2d], 0
+lea eax, [eax + eax + 1]
+mov byte [ebp - 0x2e], al
+
+loc_0001b434:
+mov al, byte [ebp - 0x2e]
+cmp dword [ebp + 0x10], 0xb
+mov byte [ebp - 0x2c], al
+mov al, byte [ebp + 0xc]
+mov byte [ebp - 0x30], al
+ja near loc_0001b5e9 ; ja 0x1b5e9
+mov eax, dword [ebp + 0x10]
+jmp dword [eax*4 + ref_000205a0] ; ujmp: jmp dword [eax*4 + 0x205a0]
+
+loc_0001b454:
+mov al, byte [ebp - 0x2e]
+dec eax
+mov byte [ebp - 0x2c], al
+
+loc_0001b45b:
+cmp byte [ebp - 0x2f], 1
+je near loc_0001b5d9 ; je 0x1b5d9
+xor esi, esi
+jmp near loc_0001b5d5 ; jmp 0x1b5d5
+
+loc_0001b46c:
+mov eax, dword [ebp + 0x1c]
+mov al, byte [eax]
+mov byte [ebp - 0x30], al
+mov al, byte [ebp - 0x2e]
+dec eax
+mov byte [ebp - 0x2c], al
+
+loc_0001b47b:
+cmp dword [edi], 1
+mov esi, 4
+mov dword [edi], 1
+sbb ebx, ebx
+and ebx, 0x80000005
+jmp near loc_0001b597 ; jmp 0x1b597
+
+loc_0001b496:
+mov eax, dword [ebp + 0x1c]
+push ecx
+push ecx
+movzx eax, byte [eax]
+push eax
+push 5
+call fcn_0001b33b ; call 0x1b33b
+mov al, byte [ebp - 0x2e]
+add esp, 0x10
+mov dword [edi], 1
+dec eax
+mov byte [ebp - 0x2c], al
+
+loc_0001b4b6:
+mov eax, dword [edi]
+test eax, eax
+je near loc_0001b5c6 ; je 0x1b5c6
+cmp eax, 1
+je near loc_0001b5d0 ; je 0x1b5d0
+cmp eax, 0x100
+ja near loc_0001b5e9 ; ja 0x1b5e9
+cmp byte [ebp - 0x2f], 1
+je near loc_0001b5d9 ; je 0x1b5d9
+mov esi, 0x18
+jmp near loc_0001b5d5 ; jmp 0x1b5d5
+
+loc_0001b4e8:
+mov al, byte [ebp - 0x2e]
+dec eax
+mov byte [ebp - 0x2c], al
+push eax
+push eax
+mov eax, dword [ebp + 0x1c]
+movzx eax, byte [eax + 1]
+push eax
+push 6
+call fcn_0001b33b ; call 0x1b33b
+pop eax
+mov eax, dword [ebp + 0x1c]
+pop edx
+movzx eax, byte [eax]
+push eax
+push 5
+call fcn_0001b33b ; call 0x1b33b
+add esp, 0x10
+
+loc_0001b513:
+cmp dword [edi], 2
+mov esi, 0xc
+mov dword [edi], 2
+sbb ebx, ebx
+and ebx, 0x80000005
+jmp short loc_0001b597 ; jmp 0x1b597
+
+loc_0001b52b:
+push eax
+push eax
+movzx eax, byte [edi]
+push eax
+push 5
+call fcn_0001b33b ; call 0x1b33b
+mov al, byte [ebp - 0x2e]
+add esp, 0x10
+dec eax
+mov byte [ebp - 0x2c], al
+mov al, byte [edi]
+mov byte [ebp - 0x2d], al
+
+loc_0001b547:
+mov eax, dword [edi]
+dec eax
+cmp eax, 0x1f
+ja near loc_0001b5e9 ; ja 0x1b5e9
+mov esi, 0x14
+jmp near loc_0001b5e3 ; jmp 0x1b5e3
+
+loc_0001b55d:
+mov eax, dword [ebp + 0x1c]
+push ebx
+push ebx
+movzx eax, byte [eax + 1]
+push eax
+push 6
+call fcn_0001b33b ; call 0x1b33b
+pop esi
+mov esi, 0x10
+pop eax
+mov eax, dword [ebp + 0x1c]
+movzx eax, byte [eax]
+push eax
+push 5
+call fcn_0001b33b ; call 0x1b33b
+add esp, 0x10
+cmp dword [edi], 2
+mov dword [edi], 2
+sbb ebx, ebx
+and ebx, 0x80000005
+
+loc_0001b597:
+xor eax, eax
+test ebx, ebx
+jns short loc_0001b5f3 ; jns 0x1b5f3
+jmp near loc_0001b8e9 ; jmp 0x1b8e9
+
+loc_0001b5a2:
+mov eax, dword [edi]
+dec eax
+cmp eax, 0x1f
+ja short loc_0001b5e9 ; ja 0x1b5e9
+push ecx
+mov esi, 0x1c
+push ecx
+movzx eax, byte [edi]
+push eax
+push 5
+call fcn_0001b33b ; call 0x1b33b
+mov al, byte [edi]
+add esp, 0x10
+mov byte [ebp - 0x2d], al
+jmp short loc_0001b5e3 ; jmp 0x1b5e3
+
+loc_0001b5c6:
+mov ebx, 0x80000005
+jmp near loc_0001b8e9 ; jmp 0x1b8e9
+
+loc_0001b5d0:
+mov esi, 8
+
+loc_0001b5d5:
+xor eax, eax
+jmp short loc_0001b5e5 ; jmp 0x1b5e5
+
+loc_0001b5d9:
+mov ebx, 0x80000003
+jmp near loc_0001b8e9 ; jmp 0x1b8e9
+
+loc_0001b5e3:
+mov al, 2
+
+loc_0001b5e5:
+xor ebx, ebx
+jmp short loc_0001b5f3 ; jmp 0x1b5f3
+
+loc_0001b5e9:
+mov ebx, 0x80000002
+jmp near loc_0001b8e9 ; jmp 0x1b8e9
+
+loc_0001b5f3:
+mov dl, al
+or edx, 1
+cmp byte [ebp - 0x2f], 1
+cmove eax, edx
+push edx
+movzx eax, al
+push edx
+push eax
+push 0xd
+call fcn_0001b33b ; call 0x1b33b
+mov dword [esp], 2
+call fcn_0001b31e ; call 0x1b31e
+mov eax, dword [ebp + 0x10]
+add esp, 0x10
+and eax, 0xfffffffd
+cmp eax, 9
+je short loc_0001b643 ; je 0x1b643
+
+loc_0001b626:
+movzx eax, byte [ebp - 0x2c]
+push ecx
+push ecx
+push eax
+push 4
+call fcn_0001b33b ; call 0x1b33b
+add esp, 0x10
+movzx eax, byte [ebp - 0x30]
+cmp dword [ebp + 0x10], 4
+jne short loc_0001b67a ; jne 0x1b67a
+jmp short loc_0001b66e ; jmp 0x1b66e
+
+loc_0001b643:
+movzx ecx, byte [ebp - 0x2d]
+xor eax, eax
+mov dword [ebp - 0x38], ecx
+
+loc_0001b64c:
+cmp eax, dword [ebp - 0x38]
+jae short loc_0001b626 ; jae 0x1b626
+mov ecx, dword [ebp + 0x1c]
+push edx
+push edx
+movzx edx, byte [ecx + eax]
+mov dword [ebp - 0x3c], eax
+push edx
+push 7
+call fcn_0001b33b ; call 0x1b33b
+mov eax, dword [ebp - 0x3c]
+add esp, 0x10
+inc eax
+jmp short loc_0001b64c ; jmp 0x1b64c
+
+loc_0001b66e:
+cmp dword [edi], 1
+jbe short loc_0001b67a ; jbe 0x1b67a
+push ecx
+push ecx
+push eax
+push 6
+jmp short loc_0001b67f ; jmp 0x1b67f
+
+loc_0001b67a:
+push edx
+push edx
+push eax
+push 3
+
+loc_0001b67f:
+call fcn_0001b33b ; call 0x1b33b
+add esp, 0x10
+lea eax, [esi + 0x40]
+movzx esi, al
+push ecx
+push ecx
+push esi
+push 2
+call fcn_0001b33b ; call 0x1b33b
+lea eax, [ebp - 0x19]
+mov dword [esp], eax
+call fcn_0001b363 ; call 0x1b363
+add esp, 0x10
+test al, al
+je near loc_0001b8e4 ; je 0x1b8e4
+mov al, byte [ebp - 0x19]
+test al, 4
+je short loc_0001b6d6 ; je 0x1b6d6
+sub esp, 0xc
+push 0xc
+call fcn_0001b31e ; call 0x1b31e
+add esp, 0x10
+and eax, 1
+cmp al, 1
+sbb ebx, ebx
+and ebx, 0xffffffec
+sub ebx, 0x7fffffe5
+jmp near loc_0001b8e9 ; jmp 0x1b8e9
+
+loc_0001b6d6:
+test al, 8
+je short loc_0001b6fe ; je 0x1b6fe
+push ebx
+push ebx
+push 8
+push 0
+call fcn_0001b33b ; call 0x1b33b
+pop esi
+pop eax
+push 0xff
+push 0
+call fcn_0001b33b ; call 0x1b33b
+pop eax
+pop edx
+push 1
+push 0xc
+jmp near loc_0001b8c0 ; jmp 0x1b8c0
+
+loc_0001b6fe:
+mov eax, dword [ebp + 0x10]
+sub eax, 2
+cmp eax, 9
+ja near loc_0001b8ac ; ja 0x1b8ac
+jmp dword [eax*4 + ref_000205d0] ; ujmp: jmp dword [eax*4 + 0x205d0]
+
+loc_0001b714:
+sub esp, 0xc
+push 6
+call fcn_0001b31e ; call 0x1b31e
+mov ecx, dword [ebp + 0x1c]
+mov byte [ecx + 1], al
+mov dword [esp], 5
+jmp near loc_0001b7eb ; jmp 0x1b7eb
+
+loc_0001b730:
+cmp dword [edi], 1
+jbe near loc_0001b7e6 ; jbe 0x1b7e6
+xor esi, esi
+
+loc_0001b73b:
+cmp esi, dword [edi]
+jae near loc_0001b8ac ; jae 0x1b8ac
+sub esp, 0xc
+push 7
+call fcn_0001b31e ; call 0x1b31e
+mov ecx, dword [ebp + 0x1c]
+add esp, 0x10
+mov byte [ecx + esi], al
+mov eax, dword [edi]
+lea edx, [eax - 2]
+cmp esi, edx
+jne short loc_0001b773 ; jne 0x1b773
+sub esp, 0xc
+push 2
+call fcn_0001b31e ; call 0x1b31e
+pop edx
+pop ecx
+or eax, 0x20
+movzx eax, al
+jmp short loc_0001b789 ; jmp 0x1b789
+
+loc_0001b773:
+dec eax
+cmp esi, eax
+jne short loc_0001b794 ; jne 0x1b794
+sub esp, 0xc
+push 2
+call fcn_0001b31e ; call 0x1b31e
+pop edx
+pop ecx
+and eax, 0xdf
+
+loc_0001b789:
+push eax
+push 2
+call fcn_0001b33b ; call 0x1b33b
+add esp, 0x10
+
+loc_0001b794:
+push eax
+push eax
+push 0x80
+push 0
+call fcn_0001b33b ; call 0x1b33b
+mov eax, dword [edi]
+add esp, 0x10
+dec eax
+cmp esi, eax
+jae short loc_0001b7e0 ; jae 0x1b7e0
+mov dword [ebp - 0x2c], 0x64
+
+loc_0001b7b3:
+sub esp, 0xc
+push 0
+call fcn_0001b31e ; call 0x1b31e
+add esp, 0x10
+test al, al
+js short loc_0001b7e0 ; js 0x1b7e0
+sub esp, 0xc
+push 0xa
+call fcn_0001bb03 ; call 0x1bb03
+add esp, 0x10
+dec dword [ebp - 0x2c]
+jne short loc_0001b7b3 ; jne 0x1b7b3
+mov ebx, 0x80000012
+jmp near loc_0001b8ac ; jmp 0x1b8ac
+
+loc_0001b7e0:
+inc esi
+jmp near loc_0001b73b ; jmp 0x1b73b
+
+loc_0001b7e6:
+sub esp, 0xc
+push 5
+
+loc_0001b7eb:
+call fcn_0001b31e ; call 0x1b31e
+mov ecx, dword [ebp + 0x1c]
+mov byte [ecx], al
+jmp short loc_0001b805 ; jmp 0x1b805
+
+loc_0001b7f7:
+push eax
+push eax
+push 0x80
+push 0
+call fcn_0001b33b ; call 0x1b33b
+
+loc_0001b805:
+add esp, 0x10
+jmp near loc_0001b8ac ; jmp 0x1b8ac
+
+loc_0001b80d:
+sub esp, 0xc
+xor esi, esi
+push 5
+call fcn_0001b31e ; call 0x1b31e
+add esp, 0x10
+mov byte [ebp - 0x2d], al
+movzx edx, al
+mov al, 1
+cmp dword [edi], edx
+jb short loc_0001b84a ; jb 0x1b84a
+
+loc_0001b828:
+cmp esi, edx
+jae short loc_0001b848 ; jae 0x1b848
+sub esp, 0xc
+push 7
+mov dword [ebp - 0x2c], edx
+call fcn_0001b31e ; call 0x1b31e
+mov ecx, dword [ebp + 0x1c]
+add esp, 0x10
+mov edx, dword [ebp - 0x2c]
+mov byte [ecx + esi], al
+inc esi
+jmp short loc_0001b828 ; jmp 0x1b828
+
+loc_0001b848:
+xor eax, eax
+
+loc_0001b84a:
+test al, al
+mov eax, 0x80000005
+mov dword [edi], edx
+cmovne ebx, eax
+jmp short loc_0001b8ac ; jmp 0x1b8ac
+
+loc_0001b858:
+sub esp, 0xc
+push 5
+call fcn_0001b31e ; call 0x1b31e
+add esp, 0x10
+mov byte [ebp - 0x2d], al
+test al, al
+je short loc_0001b8a0 ; je 0x1b8a0
+movzx eax, byte [edi]
+xor esi, esi
+movzx edx, byte [ebp - 0x2d]
+add eax, edx
+cmp eax, 0x20
+jg short loc_0001b8a7 ; jg 0x1b8a7
+
+loc_0001b87c:
+cmp esi, edx
+jae short loc_0001b89c ; jae 0x1b89c
+sub esp, 0xc
+push 7
+mov dword [ebp - 0x2c], edx
+call fcn_0001b31e ; call 0x1b31e
+mov ecx, dword [ebp + 0x1c]
+add esp, 0x10
+mov edx, dword [ebp - 0x2c]
+mov byte [ecx + esi], al
+inc esi
+jmp short loc_0001b87c ; jmp 0x1b87c
+
+loc_0001b89c:
+mov dword [edi], edx
+jmp short loc_0001b8ac ; jmp 0x1b8ac
+
+loc_0001b8a0:
+mov ebx, 0x80000005
+jmp short loc_0001b8ac ; jmp 0x1b8ac
+
+loc_0001b8a7:
+mov ebx, 0x80000007
+
+loc_0001b8ac:
+test byte [ebp - 0x19], 8
+je short loc_0001b8e9 ; je 0x1b8e9
+cmp ebx, 0x80000005
+je short loc_0001b8e9 ; je 0x1b8e9
+push eax
+push eax
+push 8
+push 0
+
+loc_0001b8c0:
+call fcn_0001b33b ; call 0x1b33b
+mov dword [esp], 0xa
+call fcn_0001bb03 ; call 0x1bb03
+add esp, 0x10
+dec dword [ebp - 0x34]
+jne near loc_0001b434 ; jne 0x1b434
+mov ebx, 0x80000007
+jmp short loc_0001b8e9 ; jmp 0x1b8e9
+
+loc_0001b8e4:
+mov ebx, 0x80000012
+
+loc_0001b8e9:
+push eax
+push eax
+push 0xff
+push 0
+call fcn_0001b33b ; call 0x1b33b
+pop edx
+pop ecx
+push 1
+push 0xc
+call fcn_0001b33b ; call 0x1b33b
+pop esi
+pop edi
+push 0
+push 0xd
+call fcn_0001b33b ; call 0x1b33b
+add esp, 0x10
+mov eax, ebx
+jmp short loc_0001b919 ; jmp 0x1b919
+
+loc_0001b914:
+mov eax, 0x80000002
+
+loc_0001b919:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001b921:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 8
+push 3
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+pop edx
+pop ecx
+push 1
+mov ebx, eax
+lea eax, [eax + 4]
+add ebx, 0x40
+push eax
+call fcn_00018730 ; call 0x18730
+add esp, 0xc
+push 1
+push 0xf9
+push ebx
+call fcn_0001878a ; call 0x1878a
+pop ebx
+pop eax
+push 0xff
+push 0
+call fcn_0001b33b ; call 0x1b33b
+add esp, 0x10
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001b96b:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001b98a ; je 0x1b98a
+push ebx
+push ebx
+push ref_000263e0 ; push 0x263e0
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001b98a:
+sub esp, 0xc
+mov esi, 0x80000009
+push 0x20
+call fcn_00019db6 ; call 0x19db6
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+je near loc_0001ba2d ; je 0x1ba2d
+sub esp, 0xc
+lea eax, [eax + 0xc]
+push eax
+call fcn_0001ff91 ; call 0x1ff91
+lea eax, [ebx + 0x14]
+mov dword [ebx], 0x80000010
+mov dword [ebx + 4], ref_0002913c ; mov dword [ebx + 4], 0x2913c
+mov dword [ebx + 8], eax
+mov dword [esp], ebx
+call fcn_0001972b ; call 0x1972b
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001ba11 ; je 0x1ba11
+test ebx, ebx
+jns short loc_0001ba11 ; jns 0x1ba11
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001b9fc ; je 0x1b9fc
+push ecx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001b9fc:
+push edx
+push ref_000206f4 ; push 0x206f4
+push 0x4c
+push ref_000263f9 ; push 0x263f9
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001ba11:
+call fcn_00015479 ; call 0x15479
+mov esi, ebx
+test al, al
+je short loc_0001ba2d ; je 0x1ba2d
+push eax
+push eax
+push ref_0002641e ; push 0x2641e
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001ba2d:
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001ba36:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+sub eax, 4
+cmp eax, 1
+ja short loc_0001ba89 ; ja 0x1ba89
+push 0
+push 0
+push 0
+push ref_0002909c ; push 0x2909c
+call fcn_0001975d ; call 0x1975d
+add esp, 0x10
+test eax, eax
+jne short loc_0001ba89 ; jne 0x1ba89
+call fcn_00015479 ; call 0x15479
+mov ebx, 0x80000003
+test al, al
+je near loc_0001baf9 ; je 0x1baf9
+push ecx
+push ecx
+push ref_00026435 ; push 0x26435
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp short loc_0001baf9 ; jmp 0x1baf9
+
+loc_0001ba89:
+xor ebx, ebx
+lea edi, [ebp - 0x1c]
+
+loc_0001ba8e:
+push edi
+push 0
+push ebx
+push ref_0002915c ; push 0x2915c
+call fcn_0001975d ; call 0x1975d
+add esp, 0x10
+mov esi, eax
+test eax, eax
+jne short loc_0001bab2 ; jne 0x1bab2
+mov eax, dword [ebp - 0x1c]
+sub esp, 0xc
+push dword [ebp + 8]
+call dword [eax] ; ucall
+jmp short loc_0001baeb ; jmp 0x1baeb
+
+loc_0001bab2:
+cmp eax, 0x8000000e
+jne short loc_0001bad4 ; jne 0x1bad4
+test ebx, ebx
+jne short loc_0001bad4 ; jne 0x1bad4
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001baee ; je 0x1baee
+push edx
+push edx
+push ref_0002645f ; push 0x2645f
+push 0x80000040
+jmp short loc_0001bae6 ; jmp 0x1bae6
+
+loc_0001bad4:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001baee ; je 0x1baee
+push eax
+push eax
+push ref_0002648a ; push 0x2648a
+push 0x40
+
+loc_0001bae6:
+call fcn_00015487 ; call 0x15487
+
+loc_0001baeb:
+add esp, 0x10
+
+loc_0001baee:
+inc ebx
+cmp esi, 0x8000000e
+jne short loc_0001ba8e ; jne 0x1ba8e
+xor ebx, ebx
+
+loc_0001baf9:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001bb03:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov edi, dword [ebp + 8]
+test edi, edi
+je near loc_0001bba1 ; je 0x1bba1
+push eax
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x40
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+mov esi, eax
+and esi, 0xfffc
+add esi, 8
+mov dword [esp], esi
+call fcn_00018f64 ; call 0x18f64
+mov ecx, 0x64
+xor edx, edx
+add esp, 0x10
+mov ebx, eax
+imul eax, edi, 0x166
+and ebx, 0xffffff
+div ecx
+lea edi, [ebx + eax + 1]
+mov ecx, edi
+and edi, 0xffffff
+shr ecx, 0x18
+
+loc_0001bb6a:
+test ecx, ecx
+setne dl
+cmp edi, ebx
+jbe short loc_0001bb9d ; jbe 0x1bb9d
+
+loc_0001bb73:
+sub esp, 0xc
+push esi
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x1c], ecx
+call fcn_00018f64 ; call 0x18f64
+add esp, 0x10
+mov ecx, dword [ebp - 0x1c]
+mov edx, dword [ebp - 0x20]
+and eax, 0xffffff
+cmp eax, ebx
+jae short loc_0001bb99 ; jae 0x1bb99
+test dl, dl
+je short loc_0001bba1 ; je 0x1bba1
+dec ecx
+
+loc_0001bb99:
+mov ebx, eax
+jmp short loc_0001bb6a ; jmp 0x1bb6a
+
+loc_0001bb9d:
+test dl, dl
+jne short loc_0001bb73 ; jne 0x1bb73
+
+loc_0001bba1:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001bba9:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 8]
+lea eax, [ebx + 0x3804]
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+xor edx, edx
+test ah, 0x40
+je short loc_0001bbf6 ; je 0x1bbf6
+push eax
+push 0
+push 0xffff8003
+lea eax, [ebx + 0x38b0]
+add ebx, 0x38b4
+push eax
+call fcn_00018b68 ; call 0x18b68
+mov dword [esp], ebx
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+cmp eax, 0xff0a55a
+sete dl
+
+loc_0001bbf6:
+mov al, dl
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001bbfd:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x18
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov ebx, eax
+lea eax, [eax + 8]
+add ebx, 2
+mov dword [esp], eax
+call fcn_00017d8b ; call 0x17d8b
+mov dword [esp], ebx
+mov dl, al
+mov dword [ebp - 0xc], edx
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+mov edx, dword [ebp - 0xc]
+mov ecx, eax
+and ecx, 0xfffffffd
+cmp cx, 0x8c44
+je short loc_0001bc80 ; je 0x1bc80
+lea ecx, [eax + 0x73b2]
+cmp cx, 2
+jbe short loc_0001bc80 ; jbe 0x1bc80
+lea ecx, [eax + 0x73b7]
+cmp cx, 3
+jbe short loc_0001bc80 ; jbe 0x1bc80
+lea ecx, [eax + 0x73bf]
+cmp cx, 1
+jbe short loc_0001bc80 ; jbe 0x1bc80
+cmp ax, 0x8c58
+je short loc_0001bc80 ; je 0x1bc80
+mov ecx, eax
+and ecx, 0xfffffffb
+cmp cx, 0x8c52
+je short loc_0001bc80 ; je 0x1bc80
+mov ecx, eax
+and ecx, 0xfffffff7
+cmp cx, 0x8c54
+jne short loc_0001bca7 ; jne 0x1bca7
+
+loc_0001bc80:
+cmp dl, 4
+je near loc_0001bd5d ; je 0x1bd5d
+cmp dl, 5
+je short loc_0001bc9d ; je 0x1bc9d
+mov eax, 1
+cmp dl, 3
+jne short loc_0001bcc0 ; jne 0x1bcc0
+jmp near loc_0001bd70 ; jmp 0x1bd70
+
+loc_0001bc9d:
+mov eax, 3
+jmp near loc_0001bd70 ; jmp 0x1bd70
+
+loc_0001bca7:
+lea ecx, [eax + 0x733f]
+cmp cx, 5
+ja short loc_0001bcd5 ; ja 0x1bcd5
+mov eax, 0x10
+test dl, dl
+je near loc_0001bd70 ; je 0x1bd70
+
+loc_0001bcc0:
+call fcn_00015479 ; call 0x15479
+test al, al
+je near loc_0001bd56 ; je 0x1bd56
+push ecx
+push ref_000264b4 ; push 0x264b4
+jmp short loc_0001bd44 ; jmp 0x1bd44
+
+loc_0001bcd5:
+lea ecx, [eax + 0x63bf]
+cmp cx, 6
+ja short loc_0001bd0f ; ja 0x1bd0f
+cmp dl, 3
+je short loc_0001bd64 ; je 0x1bd64
+cmp dl, 4
+je short loc_0001bcf7 ; je 0x1bcf7
+mov eax, 0x20
+cmp dl, 2
+jne short loc_0001bcfe ; jne 0x1bcfe
+jmp short loc_0001bd70 ; jmp 0x1bd70
+
+loc_0001bcf7:
+mov eax, 0x22
+jmp short loc_0001bd70 ; jmp 0x1bd70
+
+loc_0001bcfe:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001bd56 ; je 0x1bd56
+push edx
+push ref_000264bb ; push 0x264bb
+jmp short loc_0001bd44 ; jmp 0x1bd44
+
+loc_0001bd0f:
+add ax, 0x633f
+cmp ax, 0xa
+ja short loc_0001bd56 ; ja 0x1bd56
+cmp dl, 2
+je short loc_0001bd6b ; je 0x1bd6b
+cmp dl, 3
+je short loc_0001bd2e ; je 0x1bd2e
+dec dl
+jne short loc_0001bd35 ; jne 0x1bd35
+mov eax, 0x41
+jmp short loc_0001bd70 ; jmp 0x1bd70
+
+loc_0001bd2e:
+mov eax, 0x43
+jmp short loc_0001bd70 ; jmp 0x1bd70
+
+loc_0001bd35:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001bd56 ; je 0x1bd56
+push eax
+push ref_000264c3 ; push 0x264c3
+
+loc_0001bd44:
+push ref_00029660 ; push 0x29660
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001bd56:
+mov eax, 0x44
+jmp short loc_0001bd70 ; jmp 0x1bd70
+
+loc_0001bd5d:
+mov eax, 2
+jmp short loc_0001bd70 ; jmp 0x1bd70
+
+loc_0001bd64:
+mov eax, 0x21
+jmp short loc_0001bd70 ; jmp 0x1bd70
+
+loc_0001bd6b:
+mov eax, 0x42
+
+loc_0001bd70:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001bd75:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+push edx
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov esi, eax
+lea eax, [eax + 2]
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+mov dword [esp], esi
+movzx ebx, ax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+cmp ax, 0x8086
+jne short loc_0001be20 ; jne 0x1be20
+mov eax, ebx
+mov esi, 1
+and eax, 0xfffffffd
+cmp ax, 0x8c44
+je near loc_0001be46 ; je 0x1be46
+lea eax, [ebx + 0x73b2]
+cmp ax, 2
+jbe short loc_0001be46 ; jbe 0x1be46
+lea eax, [ebx + 0x73b7]
+cmp ax, 3
+jbe short loc_0001be46 ; jbe 0x1be46
+lea eax, [ebx + 0x73bf]
+cmp ax, 1
+jbe short loc_0001be46 ; jbe 0x1be46
+cmp bx, 0x8c58
+je short loc_0001be46 ; je 0x1be46
+mov eax, ebx
+and eax, 0xfffffffb
+cmp ax, 0x8c52
+je short loc_0001be41 ; je 0x1be41
+mov eax, ebx
+and eax, 0xfffffff7
+cmp ax, 0x8c54
+je short loc_0001be41 ; je 0x1be41
+lea eax, [ebx + 0x63bf]
+cmp ax, 6
+jbe short loc_0001be46 ; jbe 0x1be46
+lea eax, [ebx + 0x733f]
+cmp ax, 5
+jbe short loc_0001be41 ; jbe 0x1be41
+lea eax, [ebx + 0x633f]
+cmp ax, 0xa
+jbe short loc_0001be46 ; jbe 0x1be46
+
+loc_0001be20:
+call fcn_00015479 ; call 0x15479
+xor esi, esi
+test al, al
+je short loc_0001be46 ; je 0x1be46
+push eax
+push ebx
+push ref_000264cb ; push 0x264cb
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp short loc_0001be46 ; jmp 0x1be46
+
+loc_0001be41:
+mov esi, 1
+
+loc_0001be46:
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001be4f:
+push ebp
+mov ebp, esp
+push ebx
+push ebx
+mov eax, dword [ebp + 0xc]
+mov ebx, dword [ebp + 8]
+cmp al, 1
+je short loc_0001be6a ; je 0x1be6a
+xor edx, edx
+cmp al, 1
+sbb eax, eax
+and eax, 0xfffffff0
+dec eax
+jmp short loc_0001be72 ; jmp 0x1be72
+
+loc_0001be6a:
+mov edx, 0x10
+or eax, 0xffffffff
+
+loc_0001be72:
+push ecx
+add ebx, 0x3410
+push edx
+push eax
+push ebx
+call fcn_00018b68 ; call 0x18b68
+add esp, 0x10
+mov dword [ebp + 8], ebx
+mov ebx, dword [ebp - 4]
+leave
+jmp near fcn_00017e4e ; jmp 0x17e4e
+
+fcn_0001be90:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 8]
+push ebx
+call fcn_0001bba9 ; call 0x1bba9
+add esp, 0x10
+xor edx, edx
+dec al
+jne short loc_0001bec3 ; jne 0x1bec3
+sub esp, 0xc
+add ebx, 0x3860
+push ebx
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+cmp eax, 0x7fff
+setne dl
+
+loc_0001bec3:
+mov al, dl
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001beca:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x10
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov esi, eax
+pop eax
+and esi, 0xffffc000
+pop edx
+lea ebx, [esi + 0x38b0]
+add esi, 0x38b4
+push 0xffff8003
+push ebx
+call fcn_00018b3e ; call 0x18b3e
+pop ecx
+pop edi
+push 0x4010
+push ebx
+call fcn_00018b14 ; call 0x18b14
+mov dword [esp], esi
+call fcn_00017e4e ; call 0x17e4e
+mov edi, eax
+pop eax
+pop edx
+push 0xffff8003
+push ebx
+call fcn_00018b3e ; call 0x18b3e
+pop ecx
+pop eax
+push 0x403c
+push ebx
+call fcn_00018b14 ; call 0x18b14
+mov dword [esp], esi
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+xor edx, edx
+and edi, 3
+je short loc_0001bf57 ; je 0x1bf57
+shr eax, 6
+mov edx, eax
+and edx, 1
+
+loc_0001bf57:
+lea esp, [ebp - 0xc]
+mov al, dl
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001bf61:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_0001bba9 ; call 0x1bba9
+add esp, 0x10
+mov dl, al
+xor eax, eax
+test dl, dl
+je short loc_0001bfb4 ; je 0x1bfb4
+push eax
+push eax
+push 0xffff8003
+lea esi, [ebx + 0x38b0]
+add ebx, 0x38b4
+push esi
+call fcn_00018b3e ; call 0x18b3e
+pop edx
+pop ecx
+push 0x4024
+push esi
+call fcn_00018b14 ; call 0x18b14
+mov dword [esp], ebx
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+shr eax, 0xe
+and eax, 1
+
+loc_0001bfb4:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001bfbb:
+push ebp
+mov ebp, esp
+push esi
+mov esi, 1
+push ebx
+push ecx
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+movzx ebx, ax
+mov eax, ebx
+and eax, 0xfffffffd
+cmp ax, 0x8c44
+je near loc_0001c0b4 ; je 0x1c0b4
+lea eax, [ebx + 0x73b2]
+cmp ax, 2
+jbe near loc_0001c0b4 ; jbe 0x1c0b4
+lea eax, [ebx + 0x73b7]
+cmp ax, 3
+jbe near loc_0001c0b4 ; jbe 0x1c0b4
+lea eax, [ebx + 0x73bf]
+cmp ax, 1
+jbe near loc_0001c0b4 ; jbe 0x1c0b4
+cmp bx, 0x8c58
+je near loc_0001c0b4 ; je 0x1c0b4
+mov eax, ebx
+and eax, 0xfffffffb
+cmp ax, 0x8c52
+je short loc_0001c0af ; je 0x1c0af
+mov eax, ebx
+and eax, 0xfffffff7
+cmp ax, 0x8c54
+je short loc_0001c0af ; je 0x1c0af
+lea eax, [ebx + 0x733f]
+cmp ax, 5
+jbe short loc_0001c0b4 ; jbe 0x1c0b4
+lea eax, [ebx + 0x63bf]
+mov si, 2
+cmp ax, 6
+jbe short loc_0001c0b4 ; jbe 0x1c0b4
+lea eax, [ebx + 0x633f]
+cmp ax, 0xa
+jbe short loc_0001c0b4 ; jbe 0x1c0b4
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001c087 ; je 0x1c087
+push edx
+push ebx
+push ref_000264fe ; push 0x264fe
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001c087:
+call fcn_00015480 ; call 0x15480
+mov esi, 3
+test al, al
+je short loc_0001c0b4 ; je 0x1c0b4
+push eax
+push ref_00022281 ; push 0x22281
+push 0x1cd
+push ref_00026529 ; push 0x26529
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+jmp short loc_0001c0b4 ; jmp 0x1c0b4
+
+loc_0001c0af:
+mov esi, 1
+
+loc_0001c0b4:
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001c0bd:
+push ebp
+mov ebp, esp
+push esi
+mov esi, 1
+push ebx
+push ecx
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+movzx ebx, ax
+mov eax, ebx
+and eax, 0xfffffffd
+cmp ax, 0x8c44
+je near loc_0001c1b6 ; je 0x1c1b6
+lea eax, [ebx + 0x73b2]
+cmp ax, 2
+jbe near loc_0001c1b6 ; jbe 0x1c1b6
+lea eax, [ebx + 0x73b7]
+cmp ax, 3
+jbe near loc_0001c1b6 ; jbe 0x1c1b6
+lea eax, [ebx + 0x73bf]
+cmp ax, 1
+jbe near loc_0001c1b6 ; jbe 0x1c1b6
+cmp bx, 0x8c58
+je near loc_0001c1b6 ; je 0x1c1b6
+mov eax, ebx
+and eax, 0xfffffffb
+cmp ax, 0x8c52
+je short loc_0001c1b1 ; je 0x1c1b1
+mov eax, ebx
+and eax, 0xfffffff7
+cmp ax, 0x8c54
+je short loc_0001c1b1 ; je 0x1c1b1
+lea eax, [ebx + 0x63bf]
+cmp ax, 6
+jbe short loc_0001c1b6 ; jbe 0x1c1b6
+lea eax, [ebx + 0x733f]
+cmp ax, 5
+jbe short loc_0001c1b6 ; jbe 0x1c1b6
+lea eax, [ebx + 0x633f]
+mov si, 2
+cmp ax, 0xa
+jbe short loc_0001c1b6 ; jbe 0x1c1b6
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001c189 ; je 0x1c189
+push edx
+push ebx
+push ref_000264fe ; push 0x264fe
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001c189:
+call fcn_00015480 ; call 0x15480
+mov esi, 3
+test al, al
+je short loc_0001c1b6 ; je 0x1c1b6
+push eax
+push ref_00022281 ; push 0x22281
+push 0x1ec
+push ref_00026529 ; push 0x26529
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+jmp short loc_0001c1b6 ; jmp 0x1c1b6
+
+loc_0001c1b1:
+mov esi, 1
+
+loc_0001c1b6:
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001c1bf:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_0001bfbb ; call 0x1bfbb
+cmp eax, 1
+je short loc_0001c1db ; je 0x1c1db
+xor edx, edx
+cmp eax, 2
+mov al, 6
+cmove edx, eax
+jmp short loc_0001c1dd ; jmp 0x1c1dd
+
+loc_0001c1db:
+mov dl, 8
+
+loc_0001c1dd:
+mov al, dl
+leave
+ret
+
+fcn_0001c1e1:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_0001bfbb ; call 0x1bfbb
+cmp eax, 1
+je short loc_0001c1fc ; je 0x1c1fc
+cmp eax, 2
+sete al
+shl eax, 2
+jmp short loc_0001c1fe ; jmp 0x1c1fe
+
+loc_0001c1fc:
+mov al, 6
+
+loc_0001c1fe:
+leave
+ret
+
+fcn_0001c200:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_0001bfbb ; call 0x1bfbb
+cmp eax, 1
+je short loc_0001c218 ; je 0x1c218
+cmp eax, 2
+sete al
+jmp short loc_0001c21a ; jmp 0x1c21a
+
+loc_0001c218:
+mov al, 2
+
+loc_0001c21a:
+leave
+ret
+
+fcn_0001c21c:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_0001c0bd ; call 0x1c0bd
+cmp eax, 1
+jne short loc_0001c23a ; jne 0x1c23a
+call fcn_0001bfbb ; call 0x1bfbb
+cmp eax, 1
+jne short loc_0001c23a ; jne 0x1c23a
+mov al, 0xe
+jmp short loc_0001c243 ; jmp 0x1c243
+
+loc_0001c23a:
+cmp eax, 2
+sete al
+shl eax, 3
+
+loc_0001c243:
+leave
+ret
+
+fcn_0001c245:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_0001bfbb ; call 0x1bfbb
+cmp eax, 1
+je short loc_0001c25d ; je 0x1c25d
+cmp eax, 2
+sete al
+jmp short loc_0001c25f ; jmp 0x1c25f
+
+loc_0001c25d:
+mov al, 2
+
+loc_0001c25f:
+leave
+ret
+
+fcn_0001c261:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_0001c0bd ; call 0x1c0bd
+cmp eax, 1
+jne short loc_0001c28a ; jne 0x1c28a
+call fcn_0001bfbb ; call 0x1bfbb
+cmp eax, 1
+je short loc_0001c286 ; je 0x1c286
+cmp eax, 2
+sete dl
+shl edx, 3
+jmp short loc_0001c294 ; jmp 0x1c294
+
+loc_0001c286:
+mov dl, 0xe
+jmp short loc_0001c294 ; jmp 0x1c294
+
+loc_0001c28a:
+cmp eax, 2
+mov dl, 0xa
+mov al, 0
+cmovne edx, eax
+
+loc_0001c294:
+mov al, dl
+leave
+ret
+
+fcn_0001c298:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_0001c0bd ; call 0x1c0bd
+cmp eax, 1
+jne short loc_0001c2b6 ; jne 0x1c2b6
+call fcn_0001bfbb ; call 0x1bfbb
+cmp eax, 1
+jne short loc_0001c2b6 ; jne 0x1c2b6
+mov al, 0xe
+jmp short loc_0001c2bf ; jmp 0x1c2bf
+
+loc_0001c2b6:
+cmp eax, 2
+sete al
+shl eax, 3
+
+loc_0001c2bf:
+leave
+ret
+
+fcn_0001c2c1:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_0001c0bd ; call 0x1c0bd
+cmp eax, 1
+jne short loc_0001c2ea ; jne 0x1c2ea
+call fcn_0001bfbb ; call 0x1bfbb
+cmp eax, 1
+je short loc_0001c2e6 ; je 0x1c2e6
+cmp eax, 2
+sete dl
+lea edx, [edx + edx*8]
+jmp short loc_0001c2f4 ; jmp 0x1c2f4
+
+loc_0001c2e6:
+mov dl, 0xf
+jmp short loc_0001c2f4 ; jmp 0x1c2f4
+
+loc_0001c2ea:
+cmp eax, 2
+mov dl, 0xb
+mov al, 0
+cmovne edx, eax
+
+loc_0001c2f4:
+mov al, dl
+leave
+ret
+
+fcn_0001c2f8:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_0001c0bd ; call 0x1c0bd
+cmp eax, 1
+jne short loc_0001c316 ; jne 0x1c316
+call fcn_0001bfbb ; call 0x1bfbb
+cmp eax, 1
+jne short loc_0001c316 ; jne 0x1c316
+mov al, 6
+jmp short loc_0001c31f ; jmp 0x1c31f
+
+loc_0001c316:
+cmp eax, 2
+sete al
+shl eax, 2
+
+loc_0001c31f:
+leave
+ret
+
+fcn_0001c321:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+push eax
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov esi, eax
+lea eax, [eax + 0xa2]
+add esi, 0xa4
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+mov dword [esp], esi
+mov ebx, eax
+call fcn_00017dc2 ; call 0x17dc2
+mov ecx, dword [ebp + 8]
+add esp, 0x10
+lea edx, [ecx - 1]
+cmp edx, 4
+ja short loc_0001c394 ; ja 0x1c394
+jmp dword [edx*4 + ref_000205f8] ; ujmp: jmp dword [edx*4 + 0x205f8]
+
+loc_0001c367:
+shr bx, 5
+jmp short loc_0001c377 ; jmp 0x1c377
+
+loc_0001c36d:
+shr ax, 1
+mov edx, eax
+jmp short loc_0001c37d ; jmp 0x1c37d
+
+loc_0001c374:
+shr bx, 1
+
+loc_0001c377:
+mov edx, ebx
+jmp short loc_0001c37d ; jmp 0x1c37d
+
+loc_0001c37b:
+mov dl, bl
+
+loc_0001c37d:
+and edx, 1
+jmp short loc_0001c396 ; jmp 0x1c396
+
+loc_0001c382:
+xor edx, edx
+test al, 2
+je short loc_0001c396 ; je 0x1c396
+and ebx, 0x22
+cmp bx, 2
+sete dl
+jmp short loc_0001c396 ; jmp 0x1c396
+
+loc_0001c394:
+xor edx, edx
+
+loc_0001c396:
+lea esp, [ebp - 8]
+mov al, dl
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001c39f:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x10
+mov eax, dword [ebp + 8]
+mov ebx, dword [ebp + 0xc]
+add eax, 0x404
+push eax
+movzx ebx, bl
+call fcn_00017e4e ; call 0x17e4e
+lea ecx, [ebx*4]
+mov ebx, dword [ebp - 4]
+leave
+shr eax, cl
+and eax, 7
+ret
+
+fcn_0001c3cb:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+xor ebx, ebx
+sub esp, 0xc
+mov eax, dword [ebp + 8]
+movzx edi, byte [ebp + 0xc]
+lea esi, [eax + 0x404]
+
+loc_0001c3e3:
+call fcn_0001c1bf ; call 0x1c1bf
+cmp bl, al
+jae short loc_0001c40a ; jae 0x1c40a
+sub esp, 0xc
+push esi
+call fcn_00017e4e ; call 0x17e4e
+movzx ecx, bl
+add esp, 0x10
+shl ecx, 2
+shr eax, cl
+and eax, 7
+cmp eax, edi
+je short loc_0001c42d ; je 0x1c42d
+inc ebx
+jmp short loc_0001c3e3 ; jmp 0x1c3e3
+
+loc_0001c40a:
+call fcn_00015480 ; call 0x15480
+mov bl, 0xff
+test al, al
+je short loc_0001c42d ; je 0x1c42d
+push eax
+push ref_00022281 ; push 0x22281
+push 0x390
+push ref_00026529 ; push 0x26529
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001c42d:
+lea esp, [ebp - 0xc]
+mov al, bl
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001c437:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x18
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov ebx, eax
+pop eax
+and ebx, 0xffffc000
+pop edx
+push 0
+push ebx
+call fcn_0001c39f ; call 0x1c39f
+pop ecx
+pop edx
+lea edx, [ebp - 0xd]
+push edx
+sub eax, 0x20
+lea edx, [ebp - 0xc]
+movzx eax, al
+push edx
+push eax
+push 4
+push 0xe00000fc
+push ebx
+call fcn_00009ecd ; call 0x9ecd
+add esp, 0x20
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001c4cd ; je 0x1c4cd
+test ebx, ebx
+jns short loc_0001c4cd ; jns 0x1c4cd
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001c4b5 ; je 0x1c4b5
+push eax
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001c4b5:
+push ecx
+push ref_000206f4 ; push 0x206f4
+push 0x3b7
+push ref_00026529 ; push 0x26529
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001c4cd:
+mov ebx, dword [ebp - 0xc]
+test ebx, 0x80000
+je short loc_0001c543 ; je 0x1c543
+and ebx, 0x70000
+shr ebx, 0x10
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001c4fb ; je 0x1c4fb
+push edx
+push ebx
+push ref_00026565 ; push 0x26565
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001c4fb:
+call fcn_0001bfbb ; call 0x1bfbb
+lea edx, [ebx + 1]
+cmp eax, 2
+jne short loc_0001c54c ; jne 0x1c54c
+cmp ebx, 1
+je short loc_0001c547 ; je 0x1c547
+jb short loc_0001c51b ; jb 0x1c51b
+cmp ebx, 5
+ja short loc_0001c522 ; ja 0x1c522
+mov edx, 5
+jmp short loc_0001c54c ; jmp 0x1c54c
+
+loc_0001c51b:
+mov edx, 3
+jmp short loc_0001c54c ; jmp 0x1c54c
+
+loc_0001c522:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001c543 ; je 0x1c543
+push eax
+push ref_00022281 ; push 0x22281
+push 0x3c7
+push ref_00026529 ; push 0x26529
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001c543:
+xor edx, edx
+jmp short loc_0001c54c ; jmp 0x1c54c
+
+loc_0001c547:
+mov edx, 4
+
+loc_0001c54c:
+mov eax, edx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001c553:
+push ebp
+mov eax, 0x80000002
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov esi, dword [ebp + 0x10]
+cmp ebx, 7
+ja short loc_0001c5c9 ; ja 0x1c5c9
+push eax
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+and eax, 0xffffc000
+cmp ebx, 7
+je short loc_0001c5a1 ; je 0x1c5a1
+sub esp, 0xc
+lea eax, [eax + ebx*4 + 0x3854]
+jmp short loc_0001c5a9 ; jmp 0x1c5a9
+
+loc_0001c5a1:
+sub esp, 0xc
+add eax, 0x3800
+
+loc_0001c5a9:
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+mov edx, eax
+and ax, 0x7fff
+and edx, 0x7fff0000
+shr edx, 0x10
+mov word [edi], dx
+mov word [esi], ax
+xor eax, eax
+
+loc_0001c5c9:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001c5d1:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov edi, dword [ebp + 8]
+mov ebx, dword [ebp + 0xc]
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001c5fa ; je 0x1c5fa
+push eax
+push eax
+push ref_00026574 ; push 0x26574
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001c5fa:
+dec bl
+lea esi, [edi + 0x3428]
+jne short loc_0001c620 ; jne 0x1c620
+push ecx
+push ecx
+push 0x10
+lea ebx, [edi + 0x3424]
+push ebx
+call fcn_00017e04 ; call 0x17e04
+pop ebx
+pop edi
+push 1
+push esi
+call fcn_00018b14 ; call 0x18b14
+jmp short loc_0001c62a ; jmp 0x1c62a
+
+loc_0001c620:
+push edx
+push edx
+push 0xfffffffffffffffe
+push esi
+call fcn_00018b3e ; call 0x18b3e
+
+loc_0001c62a:
+add esp, 0x10
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001c647 ; je 0x1c647
+push eax
+push eax
+push ref_0002658e ; push 0x2658e
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001c647:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001c651:
+push ebp
+mov ebp, esp
+sub esp, 0x24
+lea edx, [ebp - 0xc]
+push edx
+lea edx, [ebp - 0x10]
+push edx
+lea edx, [ebp - 0x14]
+push edx
+lea eax, [ebp - 0x18]
+push eax
+push 1
+call fcn_0001ff1b ; call 0x1ff1b
+mov eax, dword [ebp - 0x18]
+leave
+and eax, 0xfff0ff0
+ret
+
+fcn_0001c678:
+push ebp
+mov ebp, esp
+sub esp, 0x24
+lea edx, [ebp - 0xc]
+push edx
+lea edx, [ebp - 0x10]
+push edx
+lea edx, [ebp - 0x14]
+push edx
+lea eax, [ebp - 0x18]
+push eax
+push 1
+call fcn_0001ff1b ; call 0x1ff1b
+mov eax, dword [ebp - 0x18]
+leave
+and eax, 0xf
+ret
+
+fcn_0001c69d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+call fcn_0001c651 ; call 0x1c651
+mov esi, eax
+call fcn_0001c678 ; call 0x1c678
+lea edx, [eax + esi]
+mov edi, eax
+cmp edx, 0x306c3
+je short loc_0001c708 ; je 0x1c708
+cmp edx, 0x40651
+je short loc_0001c708 ; je 0x1c708
+cmp edx, 0x40661
+je short loc_0001c708 ; je 0x1c708
+lea eax, [edx - 0x306d3]
+cmp eax, 1
+jbe short loc_0001c708 ; jbe 0x1c708
+sub edx, 0x40670
+mov bl, 1
+cmp edx, 1
+jbe short loc_0001c70a ; jbe 0x1c70a
+call fcn_00015479 ; call 0x15479
+xor ebx, ebx
+test al, al
+je short loc_0001c70a ; je 0x1c70a
+push esi
+push edi
+push ref_000265a6 ; push 0x265a6
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp short loc_0001c70a ; jmp 0x1c70a
+
+loc_0001c708:
+mov bl, 1
+
+loc_0001c70a:
+lea esp, [ebp - 0xc]
+mov al, bl
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001c714:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x20
+lea edx, [ebp - 0xc]
+push edx
+lea edx, [ebp - 0x10]
+push edx
+lea edx, [ebp - 0x14]
+push edx
+lea eax, [ebp - 0x18]
+push eax
+push 1
+call fcn_0001ff1b ; call 0x1ff1b
+mov eax, dword [ebp - 0x18]
+add esp, 0x20
+and eax, 0xfff0ff0
+cmp eax, 0x40650
+je short loc_0001c766 ; je 0x1c766
+ja short loc_0001c756 ; ja 0x1c756
+cmp eax, 0x306c0
+je short loc_0001c7b1 ; je 0x1c7b1
+cmp eax, 0x306d0
+je short loc_0001c766 ; je 0x1c766
+jmp short loc_0001c76a ; jmp 0x1c76a
+
+loc_0001c756:
+cmp eax, 0x40660
+je short loc_0001c7b1 ; je 0x1c7b1
+cmp eax, 0x40670
+jne short loc_0001c76a ; jne 0x1c76a
+jmp short loc_0001c7b1 ; jmp 0x1c7b1
+
+loc_0001c766:
+xor ebx, ebx
+jmp short loc_0001c7b3 ; jmp 0x1c7b3
+
+loc_0001c76a:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001c78f ; je 0x1c78f
+mov eax, dword [ebp - 0x18]
+push edx
+and eax, 0xfff0ff0
+push eax
+push ref_000265e0 ; push 0x265e0
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001c78f:
+call fcn_00015480 ; call 0x15480
+mov bl, 2
+test al, al
+je short loc_0001c7b3 ; je 0x1c7b3
+push eax
+push ref_00022281 ; push 0x22281
+push 0x7f
+push ref_0002660b ; push 0x2660b
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+jmp short loc_0001c7b3 ; jmp 0x1c7b3
+
+loc_0001c7b1:
+mov bl, 1
+
+loc_0001c7b3:
+mov al, bl
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001c7ba:
+push ebp
+mov ebp, esp
+sub esp, 0x20
+push 0
+push 0
+push 0
+lea eax, [ebp - 0x18]
+push eax
+push 0
+push 4
+call fcn_0001ff47 ; call 0x1ff47
+mov eax, dword [ebp - 0x18]
+add esp, 0x1c
+push 0x1a
+xor edx, edx
+push edx
+push eax
+call fcn_0001724f ; call 0x1724f
+leave
+and eax, 0x3f
+inc eax
+ret
+
+fcn_0001c7ea:
+push ebp
+mov ebp, esp
+sub esp, 0xc
+push 0
+push 0
+push 0x8b
+call fcn_000175c6 ; call 0x175c6
+mov dword [esp], 0
+push 0
+push 0
+push 0
+push 1
+call fcn_0001ff1b ; call 0x1ff1b
+add esp, 0x14
+push 0x8b
+call fcn_000175bc ; call 0x175bc
+add esp, 0xc
+push 0x20
+push edx
+push eax
+call fcn_0001724f ; call 0x1724f
+leave
+ret
+
+fcn_0001c82d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov eax, dword [ebp + 0x14]
+push 0x35
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov dword [ebp - 0x24], eax
+call fcn_000175bc ; call 0x175bc
+add esp, 0x10
+mov dword [ebp - 0x20], eax
+mov dword [ebp - 0x1c], edx
+test edi, edi
+jne short loc_0001c879 ; jne 0x1c879
+call fcn_00015480 ; call 0x15480
+test al, al
+je near loc_0001c920 ; je 0x1c920
+mov dword [ebp + 0x10], ref_00026647 ; mov dword [ebp + 0x10], 0x26647
+mov dword [ebp + 0xc], 0xc8
+jmp near loc_0001c905 ; jmp 0x1c905
+
+loc_0001c879:
+push ecx
+push 0x10
+push dword [ebp - 0x1c]
+push dword [ebp - 0x20]
+call fcn_0001724f ; call 0x1724f
+add esp, 0x10
+mov word [edi], ax
+test esi, esi
+jne short loc_0001c8ae ; jne 0x1c8ae
+call fcn_00015480 ; call 0x15480
+test al, al
+je near loc_0001c920 ; je 0x1c920
+mov dword [ebp + 0x10], ref_00026672 ; mov dword [ebp + 0x10], 0x26672
+mov dword [ebp + 0xc], 0xd2
+jmp short loc_0001c905 ; jmp 0x1c905
+
+loc_0001c8ae:
+movzx eax, ax
+push edx
+xor edx, edx
+push eax
+movzx eax, word [ebp - 0x20]
+push edx
+push eax
+call fcn_000174b9 ; call 0x174b9
+add esp, 0x10
+mov word [esi], ax
+test ebx, ebx
+jne short loc_0001c8e3 ; jne 0x1c8e3
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001c920 ; je 0x1c920
+mov dword [ebp + 0x10], ref_000266a0 ; mov dword [ebp + 0x10], 0x266a0
+mov dword [ebp + 0xc], 0xdc
+jmp short loc_0001c905 ; jmp 0x1c905
+
+loc_0001c8e3:
+cmp dword [ebp - 0x24], 0
+mov word [ebx], 1
+jne short loc_0001c918 ; jne 0x1c918
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001c920 ; je 0x1c920
+mov dword [ebp + 0x10], ref_000266c7 ; mov dword [ebp + 0x10], 0x266c7
+mov dword [ebp + 0xc], 0xe3
+
+loc_0001c905:
+mov dword [ebp + 8], ref_0002660b ; mov dword [ebp + 8], 0x2660b
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001548c ; jmp 0x1548c
+
+loc_0001c918:
+mov eax, dword [ebp - 0x24]
+mov word [eax], 1
+
+loc_0001c920:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001c928:
+push ebp
+mov al, 1
+mov ebp, esp
+push edi
+push esi
+push ebx
+xor ebx, ebx
+sub esp, 0x2c
+lea esi, [ebp - 0x28]
+lea edi, [ebp - 0x20]
+
+loc_0001c93b:
+cmp dword [ebp + 8], 1
+je short loc_0001c96e ; je 0x1c96e
+cmp dword [ebp + 8], 2
+jne short loc_0001c99b ; jne 0x1c99b
+sub esp, 0xc
+push 0x150
+call fcn_000175bc ; call 0x175bc
+add esp, 0xc
+push 8
+push esi
+push edi
+mov dword [ebp - 0x28], eax
+mov dword [ebp - 0x24], edx
+call fcn_0001713e ; call 0x1713e
+mov al, byte [ebp - 0x19]
+shr al, 7
+jmp short loc_0001c998 ; jmp 0x1c998
+
+loc_0001c96e:
+push edx
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+and eax, 0xfffffffe
+add eax, 0x5da4
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+shr eax, 0x1f
+
+loc_0001c998:
+add esp, 0x10
+
+loc_0001c99b:
+sub esp, 0xc
+inc ebx
+push 1
+mov dword [ebp - 0x2c], eax
+call fcn_0001bb03 ; call 0x1bb03
+mov eax, dword [ebp - 0x2c]
+add esp, 0x10
+mov dl, al
+and dl, 1
+je short loc_0001c9c1 ; je 0x1c9c1
+cmp bx, 0x3e7
+jbe near loc_0001c93b ; jbe 0x1c93b
+
+loc_0001c9c1:
+cmp bx, 0x3e8
+jne short loc_0001c9f0 ; jne 0x1c9f0
+test dl, dl
+je short loc_0001c9f0 ; je 0x1c9f0
+call fcn_00015479 ; call 0x15479
+mov ebx, 0x80000012
+test al, al
+je short loc_0001c9f2 ; je 0x1c9f2
+push eax
+push eax
+push ref_000266e8 ; push 0x266e8
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp short loc_0001c9f2 ; jmp 0x1c9f2
+
+loc_0001c9f0:
+xor ebx, ebx
+
+loc_0001c9f2:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001c9fc:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x48
+mov edi, dword [ebp + 8]
+push edi
+call fcn_0001c928 ; call 0x1c928
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+js near loc_0001cc05 ; js 0x1cc05
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001ca39 ; je 0x1ca39
+movzx eax, byte [ebp + 0xc]
+push ecx
+push eax
+push ref_00026710 ; push 0x26710
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001ca39:
+cmp edi, 1
+je short loc_0001ca4c ; je 0x1ca4c
+cmp edi, 2
+je near loc_0001cb13 ; je 0x1cb13
+jmp near loc_0001cbc5 ; jmp 0x1cbc5
+
+loc_0001ca4c:
+push esi
+push 0
+push 0
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov edi, eax
+pop eax
+and edi, 0xfffffffe
+pop edx
+push dword [ebp + 0x10]
+lea esi, [edi + 0x5da0]
+add edi, 0x5da4
+push esi
+call fcn_00017e8f ; call 0x17e8f
+mov eax, dword [ebp + 0xc]
+pop ecx
+pop edx
+or eax, 0x80000000
+push eax
+push edi
+call fcn_00017e8f ; call 0x17e8f
+mov dword [esp], 1
+call fcn_0001c928 ; call 0x1c928
+mov dword [esp], edi
+call fcn_00017e4e ; call 0x17e4e
+mov dword [esp], esi
+mov dword [ebp - 0x40], eax
+call fcn_00017e4e ; call 0x17e4e
+mov dword [esp], 0xa
+mov dword [ebp - 0x3c], eax
+call fcn_0001bb03 ; call 0x1bb03
+mov dword [esp], edi
+call fcn_00017e4e ; call 0x17e4e
+mov dword [esp], esi
+mov edi, eax
+call fcn_00017e4e ; call 0x17e4e
+mov ecx, dword [ebp - 0x40]
+add esp, 0x10
+cmp ecx, edi
+je short loc_0001cb06 ; je 0x1cb06
+cmp dword [ebp - 0x3c], eax
+je short loc_0001cb06 ; je 0x1cb06
+
+loc_0001cadf:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001cafc ; je 0x1cafc
+push ebx
+push ebx
+push ref_00026738 ; push 0x26738
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001cafc:
+mov ebx, 0x80000002
+jmp near loc_0001cc05 ; jmp 0x1cc05
+
+loc_0001cb06:
+mov eax, dword [ebp + 0x14]
+movzx ecx, cl
+mov dword [eax], ecx
+jmp near loc_0001cbe7 ; jmp 0x1cbe7
+
+loc_0001cb13:
+mov eax, dword [ebp + 0xc]
+lea edi, [ebp - 0x30]
+push ecx
+push 8
+lea ecx, [ebp - 0x28]
+mov dword [ebp - 0x24], eax
+mov eax, dword [ebp + 0x10]
+push ecx
+push edi
+or byte [ebp - 0x21], 0x80
+mov dword [ebp - 0x3c], ecx
+mov dword [ebp - 0x28], eax
+call fcn_0001713e ; call 0x1713e
+add esp, 0xc
+push dword [ebp - 0x2c]
+push dword [ebp - 0x30]
+push 0x150
+call fcn_000175c6 ; call 0x175c6
+mov dword [esp], 2
+call fcn_0001c928 ; call 0x1c928
+mov dword [esp], 0x150
+call fcn_000175bc ; call 0x175bc
+mov ecx, dword [ebp - 0x3c]
+add esp, 0xc
+push 8
+push edi
+push ecx
+mov dword [ebp - 0x2c], edx
+mov dword [ebp - 0x30], eax
+call fcn_0001713e ; call 0x1713e
+mov dword [esp], 0xa
+call fcn_0001bb03 ; call 0x1bb03
+mov dword [esp], 0x150
+call fcn_000175bc ; call 0x175bc
+add esp, 0xc
+push 8
+push edi
+mov dword [ebp - 0x30], eax
+lea eax, [ebp - 0x20]
+push eax
+mov dword [ebp - 0x2c], edx
+call fcn_0001713e ; call 0x1713e
+mov eax, dword [ebp - 0x1c]
+add esp, 0x10
+cmp dword [ebp - 0x24], eax
+je short loc_0001cbba ; je 0x1cbba
+mov eax, dword [ebp - 0x20]
+cmp dword [ebp - 0x28], eax
+jne near loc_0001cadf ; jne 0x1cadf
+
+loc_0001cbba:
+movzx eax, byte [ebp - 0x24]
+mov edx, dword [ebp + 0x14]
+mov dword [edx], eax
+jmp short loc_0001cbe7 ; jmp 0x1cbe7
+
+loc_0001cbc5:
+call fcn_00015479 ; call 0x15479
+mov ebx, 0x80000003
+test al, al
+je short loc_0001cbe7 ; je 0x1cbe7
+push edx
+push edx
+push ref_00026763 ; push 0x26763
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001cbe7:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001cc05 ; je 0x1cc05
+push eax
+mov eax, dword [ebp + 0x14]
+push dword [eax]
+push ref_00026789 ; push 0x26789
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001cc05:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001cc0f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x38
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+push edi
+call fcn_0001c928 ; call 0x1c928
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+js near loc_0001ce1b ; js 0x1ce1b
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001cc50 ; je 0x1cc50
+mov eax, esi
+movzx eax, al
+push ecx
+push eax
+push ref_000267aa ; push 0x267aa
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001cc50:
+cmp edi, 1
+je short loc_0001cc63 ; je 0x1cc63
+cmp edi, 2
+je near loc_0001cd24 ; je 0x1cd24
+jmp near loc_0001cddb ; jmp 0x1cddb
+
+loc_0001cc63:
+push eax
+push 0
+push 0
+push 0
+mov dword [ebp - 0x30], esi
+or byte [ebp - 0x2d], 0x80
+call fcn_00016c9a ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+mov esi, eax
+pop eax
+and esi, 0xfffffffe
+pop edx
+push dword [ebp - 0x30]
+lea edi, [esi + 0x5da4]
+add esi, 0x5da0
+push edi
+call fcn_00017e8f ; call 0x17e8f
+mov dword [esp], 1
+call fcn_0001c928 ; call 0x1c928
+mov dword [esp], edi
+call fcn_00017e4e ; call 0x17e4e
+mov dword [esp], esi
+mov dword [ebp - 0x30], eax
+call fcn_00017e4e ; call 0x17e4e
+mov dword [esp], 0xa
+mov dword [ebp - 0x2c], eax
+call fcn_0001bb03 ; call 0x1bb03
+mov dword [esp], edi
+call fcn_00017e4e ; call 0x17e4e
+mov dword [esp], esi
+mov edi, eax
+call fcn_00017e4e ; call 0x17e4e
+mov edx, dword [ebp - 0x30]
+add esp, 0x10
+cmp edx, edi
+je short loc_0001cd13 ; je 0x1cd13
+cmp dword [ebp - 0x2c], eax
+je short loc_0001cd13 ; je 0x1cd13
+
+loc_0001ccec:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001cd09 ; je 0x1cd09
+push eax
+push eax
+push ref_00026738 ; push 0x26738
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001cd09:
+mov ebx, 0x80000002
+jmp near loc_0001ce1b ; jmp 0x1ce1b
+
+loc_0001cd13:
+mov eax, dword [ebp + 0x14]
+mov dword [eax], edx
+lea eax, [ebp - 0x2c]
+push edi
+push 4
+push eax
+jmp near loc_0001cdd1 ; jmp 0x1cdd1
+
+loc_0001cd24:
+mov eax, dword [ebp + 0x10]
+lea edi, [ebp - 0x38]
+mov dword [ebp - 0x24], esi
+mov eax, dword [eax]
+push esi
+push 8
+lea esi, [ebp - 0x28]
+push esi
+push edi
+or byte [ebp - 0x21], 0x80
+mov dword [ebp - 0x28], eax
+call fcn_0001713e ; call 0x1713e
+add esp, 0xc
+push dword [ebp - 0x34]
+push dword [ebp - 0x38]
+push 0x150
+call fcn_000175c6 ; call 0x175c6
+mov dword [esp], 2
+call fcn_0001c928 ; call 0x1c928
+mov dword [esp], 0x150
+call fcn_000175bc ; call 0x175bc
+add esp, 0xc
+push 8
+push edi
+push esi
+mov dword [ebp - 0x34], edx
+mov dword [ebp - 0x38], eax
+call fcn_0001713e ; call 0x1713e
+mov dword [esp], 0xa
+call fcn_0001bb03 ; call 0x1bb03
+mov dword [esp], 0x150
+call fcn_000175bc ; call 0x175bc
+add esp, 0xc
+push 8
+push edi
+mov dword [ebp - 0x38], eax
+lea eax, [ebp - 0x20]
+push eax
+mov dword [ebp - 0x34], edx
+call fcn_0001713e ; call 0x1713e
+mov eax, dword [ebp - 0x1c]
+add esp, 0x10
+cmp dword [ebp - 0x24], eax
+je short loc_0001cdc4 ; je 0x1cdc4
+mov eax, dword [ebp - 0x20]
+cmp dword [ebp - 0x28], eax
+jne near loc_0001ccec ; jne 0x1ccec
+
+loc_0001cdc4:
+mov ecx, dword [ebp + 0x14]
+movzx eax, byte [ebp - 0x24]
+mov dword [ecx], eax
+push ecx
+push 4
+push esi
+
+loc_0001cdd1:
+push dword [ebp + 0x10]
+call fcn_0001713e ; call 0x1713e
+jmp short loc_0001cdfa ; jmp 0x1cdfa
+
+loc_0001cddb:
+call fcn_00015479 ; call 0x15479
+mov ebx, 0x80000003
+test al, al
+je short loc_0001cdfd ; je 0x1cdfd
+push edx
+push edx
+push ref_00026763 ; push 0x26763
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+
+loc_0001cdfa:
+add esp, 0x10
+
+loc_0001cdfd:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001ce1b ; je 0x1ce1b
+push eax
+mov eax, dword [ebp + 0x14]
+push dword [eax]
+push ref_00026789 ; push 0x26789
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001ce1b:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001ce25:
+push ebp
+mov eax, 0x80000002
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov ebx, dword [ebp + 0xc]
+test ebx, ebx
+je near loc_0001cf0f ; je 0x1cf0f
+lea edi, [ebp - 0x1c]
+call fcn_0001c651 ; call 0x1c651
+lea esi, [ebp - 0x20]
+call fcn_0001c678 ; call 0x1c678
+push edi
+push esi
+push 0x8000000a
+push 1
+call fcn_0001cc0f ; call 0x1cc0f
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_0001ce7b ; je 0x1ce7b
+push edx
+push dword [ebp - 0x20]
+push ref_000267d1 ; push 0x267d1
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001ce7b:
+cmp dword [ebp - 0x1c], 0
+je short loc_0001ce8b ; je 0x1ce8b
+
+loc_0001ce81:
+mov eax, 0x8000000e
+jmp near loc_0001cf0f ; jmp 0x1cf0f
+
+loc_0001ce8b:
+mov edx, dword [ebp - 0x20]
+xor eax, eax
+
+loc_0001ce90:
+mov ecx, edx
+and edx, 0x3f
+mov byte [ebx + eax], dl
+inc eax
+shr ecx, 6
+cmp eax, 4
+je short loc_0001cea5 ; je 0x1cea5
+mov edx, ecx
+jmp short loc_0001ce90 ; jmp 0x1ce90
+
+loc_0001cea5:
+cmp dword [ebp + 8], 4
+mov dword [ebp - 0x20], ecx
+ja short loc_0001ceb2 ; ja 0x1ceb2
+
+loc_0001ceae:
+xor eax, eax
+jmp short loc_0001cf0f ; jmp 0x1cf0f
+
+loc_0001ceb2:
+call fcn_0001c714 ; call 0x1c714
+test al, al
+jne short loc_0001ceae ; jne 0x1ceae
+push edi
+push esi
+push 0x8000000b
+push 1
+call fcn_0001cc0f ; call 0x1cc0f
+call fcn_00015479 ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_0001cee8 ; je 0x1cee8
+push eax
+push dword [ebp - 0x20]
+push ref_000267d1 ; push 0x267d1
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001cee8:
+cmp dword [ebp - 0x1c], 0
+jne short loc_0001ce81 ; jne 0x1ce81
+mov eax, dword [ebp - 0x20]
+mov edx, eax
+mov cl, al
+shr edx, 6
+and ecx, 0x3f
+shr eax, 0xc
+and edx, 0x3f
+and eax, 0x3f
+mov byte [ebx + 4], cl
+mov byte [ebx + 5], dl
+mov byte [ebx + 6], al
+jmp short loc_0001ceae ; jmp 0x1ceae
+
+loc_0001cf0f:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001cf17:
+push ebp
+mov ebp, esp
+sub esp, 0x14
+push 0x1b
+call fcn_000175bc ; call 0x175bc
+leave
+shrd eax, edx, 8
+and eax, 1
+ret
+
+fcn_0001cf2d:
+push ebp
+mov ebp, esp
+sub esp, 0x14
+push 0x35
+call fcn_000175bc ; call 0x175bc
+add esp, 0x10
+leave
+mov edx, eax
+movzx eax, al
+shr edx, 0x10
+div dl
+cmp al, 1
+seta al
+ret
+
+fcn_0001cf4e:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x14
+mov edx, dword [ebp + 8]
+mov ebx, dword [ebp + 0xc]
+mov eax, dword [ebp + 0x10]
+mov dword [ebp - 0xc], 0
+test dx, dx
+jne short loc_0001cf71 ; jne 0x1cf71
+mov word [ebx], 0
+jmp short loc_0001cfc4 ; jmp 0x1cfc4
+
+loc_0001cf71:
+test al, al
+jne short loc_0001cf93 ; jne 0x1cf93
+lea eax, [ebp - 0xc]
+cmp dx, 0xfff
+push eax
+mov eax, 0xfff
+cmovbe eax, edx
+movzx eax, ax
+push 0x3e8
+shl eax, 0xa
+jmp short loc_0001cfa9 ; jmp 0x1cfa9
+
+loc_0001cf93:
+dec al
+jne short loc_0001cfc4 ; jne 0x1cfc4
+lea eax, [ebp - 0xc]
+push eax
+movzx eax, dx
+imul eax, eax, 0x3e8
+push 0x400
+
+loc_0001cfa9:
+cdq
+push edx
+push eax
+call fcn_00017502 ; call 0x17502
+add esp, 0x10
+cmp dword [ebp - 0xc], 0x1f3
+mov word [ebx], ax
+jbe short loc_0001cfc4 ; jbe 0x1cfc4
+inc eax
+mov word [ebx], ax
+
+loc_0001cfc4:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001cfc9:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x10
+mov eax, dword [ebp + 8]
+mov ebx, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0x10]
+mov dword [ebp - 0xc], 0
+mov word [ebx], 0
+test ax, ax
+je near loc_0001d073 ; je 0x1d073
+mov edx, eax
+test cl, cl
+jne short loc_0001d024 ; jne 0x1d024
+xor esi, esi
+test ax, ax
+jns short loc_0001d008 ; jns 0x1d008
+neg edx
+mov esi, 1
+and dx, 0x7fff
+
+loc_0001d008:
+lea eax, [ebp - 0xc]
+cmp dx, 0x1f4
+push eax
+mov eax, 0x1f4
+cmovle eax, edx
+cwde
+push 0x3e8
+shl eax, 0xa
+jmp short loc_0001d04f ; jmp 0x1d04f
+
+loc_0001d024:
+dec cl
+jne short loc_0001d073 ; jne 0x1d073
+xor esi, esi
+test ah, 4
+je short loc_0001d03d ; je 0x1d03d
+mov edx, eax
+mov esi, 1
+neg edx
+and dx, 0x3ff
+
+loc_0001d03d:
+lea eax, [ebp - 0xc]
+push eax
+movsx eax, dx
+imul eax, eax, 0x3e8
+push 0x400
+
+loc_0001d04f:
+cdq
+push edx
+push eax
+call fcn_00017502 ; call 0x17502
+add esp, 0x10
+cmp dword [ebp - 0xc], 0x1f3
+mov word [ebx], ax
+jbe short loc_0001d06a ; jbe 0x1d06a
+inc eax
+mov word [ebx], ax
+
+loc_0001d06a:
+mov eax, esi
+test al, al
+je short loc_0001d073 ; je 0x1d073
+neg word [ebx]
+
+loc_0001d073:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001d07a:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x24
+mov ebx, dword [ebp + 0xc]
+push 8
+mov esi, dword [ebp + 8]
+push ebx
+call fcn_00016fff ; call 0x16fff
+mov eax, dword [ebp + 0x10]
+add esp, 0x10
+dec eax
+cmp eax, 0x14
+ja near loc_0001d1d0 ; ja 0x1d1d0
+jmp dword [eax*4 + ref_0002060c] ; ujmp: jmp dword [eax*4 + 0x2060c]
+
+loc_0001d0a8:
+mov dword [ebx], 0
+mov byte [ebx + 4], 1
+mov al, byte [esi + 4]
+jmp short loc_0001d0dd ; jmp 0x1d0dd
+
+loc_0001d0b7:
+mov dword [ebx], 0
+mov byte [ebx + 4], 2
+mov byte [ebx + 5], 0
+mov al, byte [esi + 4]
+mov byte [ebx + 6], al
+jmp near loc_0001d1ed ; jmp 0x1d1ed
+
+loc_0001d0d0:
+mov dword [ebx], 0
+mov byte [ebx + 4], 0x10
+mov al, byte [esi + 6]
+
+loc_0001d0dd:
+mov byte [ebx + 5], al
+jmp near loc_0001d1ed ; jmp 0x1d1ed
+
+loc_0001d0e5:
+mov al, byte [esi]
+lea edi, [ebp - 0x1e]
+push ecx
+push 0
+push edi
+mov byte [ebp - 0x1c], al
+movzx eax, word [esi + 2]
+mov word [ebp - 0x1e], 0
+push eax
+call fcn_0001cf4e ; call 0x1cf4e
+movzx edx, word [ebp - 0x1e]
+add esp, 0xc
+mov eax, dword [ebp - 0x1c]
+mov word [ebp - 0x1e], 0
+and edx, 0xfff
+shl edx, 8
+and eax, 0xfff000ff
+or eax, edx
+mov dword [ebp - 0x1c], eax
+mov dl, byte [esi + 1]
+mov al, byte [ebp - 0x1a]
+push 0
+push edi
+and edx, 1
+shl edx, 4
+and eax, 0xffffffef
+or eax, edx
+mov byte [ebp - 0x1a], al
+movsx eax, word [esi + 4]
+push eax
+call fcn_0001cfc9 ; call 0x1cfc9
+mov ax, word [ebp - 0x1a]
+add esp, 0xc
+mov dx, word [ebp - 0x1e]
+push 4
+and eax, 0x1f
+shl edx, 5
+or eax, edx
+mov word [ebp - 0x1a], ax
+lea eax, [ebp - 0x1c]
+push eax
+push ebx
+call fcn_0001713e ; call 0x1713e
+mov byte [ebx + 4], 0x11
+mov al, byte [esi + 6]
+mov byte [ebx + 5], al
+jmp short loc_0001d1ea ; jmp 0x1d1ea
+
+loc_0001d174:
+mov dword [ebx], 0
+mov byte [ebx + 4], 0x12
+jmp short loc_0001d1ca ; jmp 0x1d1ca
+
+loc_0001d180:
+push edx
+push 0
+lea eax, [ebp - 0x1e]
+push eax
+movzx eax, word [esi]
+push eax
+call fcn_0001cf4e ; call 0x1cf4e
+movzx eax, byte [esi + 2]
+movzx edx, word [ebp - 0x1e]
+mov byte [ebx + 4], 0x13
+mov byte [ebx + 5], 0
+shl eax, 0x1f
+or eax, edx
+mov dword [ebx], eax
+jmp short loc_0001d1ea ; jmp 0x1d1ea
+
+loc_0001d1a9:
+mov dword [ebx], 0
+mov byte [ebx + 4], 0x14
+jmp short loc_0001d1ca ; jmp 0x1d1ca
+
+loc_0001d1b5:
+mov al, byte [esi + 1]
+mov dl, byte [esi]
+mov byte [ebx + 4], 0x15
+and eax, 1
+add eax, eax
+and edx, 1
+or eax, edx
+mov dword [ebx], eax
+
+loc_0001d1ca:
+mov byte [ebx + 5], 0
+jmp short loc_0001d1ed ; jmp 0x1d1ed
+
+loc_0001d1d0:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001d1ed ; je 0x1d1ed
+push eax
+push eax
+push ref_00026801 ; push 0x26801
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+
+loc_0001d1ea:
+add esp, 0x10
+
+loc_0001d1ed:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001d1f5:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x34
+mov ebx, dword [ebp + 8]
+push 8
+mov edi, dword [ebp + 0xc]
+lea esi, [ebp - 0x20]
+push esi
+call fcn_00016fff ; call 0x16fff
+add esp, 0xc
+push 0x10
+push esi
+push ebx
+call fcn_0001d07a ; call 0x1d07a
+push edi
+push esi
+push dword [ebp - 0x1c]
+push 2
+call fcn_0001cc0f ; call 0x1cc0f
+add esp, 0x20
+test eax, eax
+jne short loc_0001d274 ; jne 0x1d274
+cmp dword [edi], 0
+jne short loc_0001d274 ; jne 0x1d274
+mov edx, dword [ebp - 0x20]
+mov dword [ebp - 0x2c], eax
+mov ecx, edx
+and ecx, 0x100000
+shr ecx, 0x14
+mov byte [ebx], dl
+movzx edx, dh
+mov byte [ebx + 1], cl
+lea ecx, [ebx + 2]
+add ebx, 4
+push eax
+push 1
+push ecx
+push edx
+call fcn_0001cf4e ; call 0x1cf4e
+mov edx, dword [ebp - 0x20]
+add esp, 0xc
+push 1
+push ebx
+shr edx, 0x15
+push edx
+call fcn_0001cfc9 ; call 0x1cfc9
+mov eax, dword [ebp - 0x2c]
+add esp, 0x10
+
+loc_0001d274:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001d27c:
+push ebp
+mov ebp, esp
+sub esp, 0x1c
+push 0x11
+lea eax, [ebp - 0x10]
+push eax
+lea eax, [ebp + 8]
+push eax
+call fcn_0001d07a ; call 0x1d07a
+push dword [ebp + 0x10]
+push dword [ebp - 0x10]
+push dword [ebp - 0xc]
+push 2
+call fcn_0001c9fc ; call 0x1c9fc
+leave
+ret
+
+fcn_0001d2a3:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x24
+mov ebx, dword [ebp + 8]
+push 8
+mov edi, dword [ebp + 0xc]
+lea esi, [ebp - 0x20]
+push esi
+call fcn_00016fff ; call 0x16fff
+add esp, 0xc
+push 0x14
+push esi
+push ebx
+call fcn_0001d07a ; call 0x1d07a
+push edi
+push esi
+push dword [ebp - 0x1c]
+push 2
+call fcn_0001cc0f ; call 0x1cc0f
+add esp, 0x20
+test eax, eax
+jne short loc_0001d2f3 ; jne 0x1d2f3
+cmp dword [edi], 0
+jne short loc_0001d2f3 ; jne 0x1d2f3
+mov edx, dword [ebp - 0x20]
+mov cl, dl
+and edx, 2
+and ecx, 1
+shr edx, 1
+mov byte [ebx], cl
+mov byte [ebx + 1], dl
+
+loc_0001d2f3:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001d2fb:
+push ebp
+mov ebp, esp
+sub esp, 0x1c
+push 0x15
+lea eax, [ebp - 0x10]
+push eax
+lea eax, [ebp + 8]
+push eax
+call fcn_0001d07a ; call 0x1d07a
+push dword [ebp + 0xc]
+push dword [ebp - 0x10]
+push dword [ebp - 0xc]
+push 2
+call fcn_0001c9fc ; call 0x1c9fc
+leave
+ret
+
+fcn_0001d322:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x24
+mov ebx, dword [ebp + 8]
+push 8
+mov edi, dword [ebp + 0xc]
+lea esi, [ebp - 0x20]
+push esi
+call fcn_00016fff ; call 0x16fff
+add esp, 0xc
+push 0x12
+push esi
+push ebx
+call fcn_0001d07a ; call 0x1d07a
+push edi
+push esi
+push dword [ebp - 0x1c]
+push 2
+call fcn_0001cc0f ; call 0x1cc0f
+add esp, 0x20
+test eax, eax
+jne short loc_0001d373 ; jne 0x1d373
+cmp dword [edi], 0
+jne short loc_0001d373 ; jne 0x1d373
+mov edx, dword [ebp - 0x20]
+mov ecx, edx
+and cx, 0xfff
+shr edx, 0x1f
+mov word [ebx], cx
+mov byte [ebx + 2], dl
+
+loc_0001d373:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001d37b:
+push ebp
+mov ebp, esp
+sub esp, 0x1c
+push 0x13
+lea eax, [ebp - 0x10]
+push eax
+lea eax, [ebp + 8]
+push eax
+call fcn_0001d07a ; call 0x1d07a
+push dword [ebp + 0xc]
+push dword [ebp - 0x10]
+push dword [ebp - 0xc]
+push 2
+call fcn_0001c9fc ; call 0x1c9fc
+leave
+ret
+
+fcn_0001d3a2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x24
+mov ebx, dword [ebp + 8]
+push 8
+mov edi, dword [ebp + 0xc]
+lea esi, [ebp - 0x20]
+push esi
+call fcn_00016fff ; call 0x16fff
+add esp, 0xc
+push 1
+push esi
+push ebx
+call fcn_0001d07a ; call 0x1d07a
+push edi
+push esi
+push dword [ebp - 0x1c]
+push 2
+call fcn_0001cc0f ; call 0x1cc0f
+add esp, 0x20
+test eax, eax
+jne short loc_0001d40d ; jne 0x1d40d
+cmp dword [edi], 0
+jne short loc_0001d40d ; jne 0x1d40d
+mov edx, dword [ebp - 0x20]
+mov ecx, edx
+and ecx, 0x100
+shr ecx, 8
+mov byte [ebx + 1], cl
+mov ecx, edx
+mov byte [ebx], dl
+and ecx, 0x200
+and edx, 0x400
+shr ecx, 9
+shr edx, 0xa
+mov byte [ebx + 2], cl
+mov byte [ebx + 3], dl
+
+loc_0001d40d:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001d415:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov edx, dword [ref_000312e0] ; mov edx, dword [0x312e0]
+mov eax, dword [ebp + 0xc]
+add eax, 3
+and eax, 0xfffffffc
+test edx, edx
+jne short loc_0001d43a ; jne 0x1d43a
+mov dword [ref_000312e4], ref_00029db0 ; mov dword [0x312e4], 0x29db0
+jmp short loc_0001d460 ; jmp 0x1d460
+
+loc_0001d43a:
+mov ecx, dword [ref_000312e4] ; mov ecx, dword [0x312e4]
+cmp dword [ecx + edx], 0x900ddea1
+je short loc_0001d460 ; je 0x1d460
+push eax
+push 0x3d
+push ref_00020660 ; push 0x20660
+push ref_00026822 ; push 0x26822
+call fcn_0001545e ; call 0x1545e
+add esp, 0x10
+
+loc_0001d45e:
+jmp short loc_0001d45e ; jmp 0x1d45e
+
+loc_0001d460:
+lea ecx, [eax + edx]
+cmp ecx, 0x752c
+jbe short loc_0001d482 ; jbe 0x1d482
+push eax
+push 0x4b
+push ref_00020660 ; push 0x20660
+push ref_00026842 ; push 0x26842
+call fcn_0001545e ; call 0x1545e
+add esp, 0x10
+
+loc_0001d480:
+jmp short loc_0001d480 ; jmp 0x1d480
+
+loc_0001d482:
+mov eax, dword [ref_000312e4] ; mov eax, dword [0x312e4]
+mov dword [ref_000312e0], ecx ; mov dword [0x312e0], ecx
+mov dword [eax + ecx], 0x900ddea1
+mov ecx, dword [ebp + 0x10]
+add edx, eax
+xor eax, eax
+mov dword [ecx], edx
+leave
+ret
+
+fcn_0001d49f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0x14]
+mov dword [ebp - 0x1c], eax
+call fcn_00016406 ; call 0x16406
+movzx esi, di
+sub esp, 0xc
+mov dword [ebp - 0x20], eax
+lea eax, [esi + 0xc]
+push eax
+call fcn_00019d3d ; call 0x19d3d
+add esp, 0x10
+mov ecx, dword [ebp - 0x20]
+test eax, eax
+mov edx, eax
+jne short loc_0001d4fb ; jne 0x1d4fb
+call fcn_00015479 ; call 0x15479
+mov edi, 0x80000009
+test al, al
+je short loc_0001d55f ; je 0x1d55f
+push eax
+push esi
+push ref_00026868 ; push 0x26868
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+jmp short loc_0001d55f ; jmp 0x1d55f
+
+loc_0001d4fb:
+lea eax, [eax + 4]
+mov dword [ebx], eax
+mov eax, dword [ebp - 0x1c]
+mov word [edx + 4], ax
+mov eax, dword [ebx]
+mov word [eax + 2], di
+mov eax, dword [ebx]
+xor edi, edi
+mov dword [eax + 4], 0
+mov eax, dword [ebx]
+add eax, esi
+mov word [eax], 0xffff
+mov word [eax + 2], 8
+mov dword [eax + 4], 0
+mov eax, dword [ecx + 0x26c]
+mov dword [edx], eax
+mov dword [ecx + 0x26c], edx
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001d55f ; je 0x1d55f
+sub esp, 0xc
+movzx eax, word [ebp - 0x1c]
+push dword [ebx]
+push esi
+push eax
+push ref_0002688e ; push 0x2688e
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x20
+
+loc_0001d55f:
+lea esp, [ebp - 0xc]
+mov eax, edi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001d569:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00016406 ; call 0x16406
+mov edx, dword [eax + 0x26c]
+mov eax, dword [ebp + 0xc]
+add edx, 4
+mov dword [eax], edx
+xor eax, eax
+leave
+ret
+
+fcn_0001d586:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x3c
+call fcn_00016410 ; call 0x16410
+sub esp, 0xc
+push 0x27
+mov edi, eax
+call fcn_00019db6 ; call 0x19db6
+mov dword [ebp - 0x1c], eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001d5c2 ; je 0x1d5c2
+cmp dword [ebp - 0x1c], 0
+jne short loc_0001d5cc ; jne 0x1d5cc
+push edi
+push ref_000268a8 ; push 0x268a8
+push 0x41
+jmp near loc_0001d72a ; jmp 0x1d72a
+
+loc_0001d5c2:
+cmp dword [ebp - 0x1c], 0
+je near loc_0001d737 ; je 0x1d737
+
+loc_0001d5cc:
+sub esp, 0xc
+push 0xc
+call fcn_00019db6 ; call 0x19db6
+mov dword [ebp - 0x20], eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001d5f8 ; je 0x1d5f8
+cmp dword [ebp - 0x20], 0
+jne short loc_0001d602 ; jne 0x1d602
+push esi
+push ref_000268e8 ; push 0x268e8
+push 0x47
+jmp near loc_0001d72a ; jmp 0x1d72a
+
+loc_0001d5f8:
+cmp dword [ebp - 0x20], 0
+je near loc_0001d737 ; je 0x1d737
+
+loc_0001d602:
+sub esp, 0xc
+push 0x36
+call fcn_00019db6 ; call 0x19db6
+mov dword [ebp - 0x24], eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001d62e ; je 0x1d62e
+cmp dword [ebp - 0x24], 0
+jne short loc_0001d638 ; jne 0x1d638
+push ebx
+push ref_00026910 ; push 0x26910
+push 0x4d
+jmp near loc_0001d72a ; jmp 0x1d72a
+
+loc_0001d62e:
+cmp dword [ebp - 0x24], 0
+je near loc_0001d737 ; je 0x1d737
+
+loc_0001d638:
+sub esp, 0xc
+push 0xd
+call fcn_00019db6 ; call 0x19db6
+mov dword [ebp - 0x28], eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001d664 ; je 0x1d664
+cmp dword [ebp - 0x28], 0
+jne short loc_0001d66e ; jne 0x1d66e
+push ecx
+push ref_0002692d ; push 0x2692d
+push 0x53
+jmp near loc_0001d72a ; jmp 0x1d72a
+
+loc_0001d664:
+cmp dword [ebp - 0x28], 0
+je near loc_0001d737 ; je 0x1d737
+
+loc_0001d66e:
+sub esp, 0xc
+push 0x102
+call fcn_00019db6 ; call 0x19db6
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001d69a ; je 0x1d69a
+test ebx, ebx
+jne short loc_0001d6a2 ; jne 0x1d6a2
+push edx
+push ref_00026946 ; push 0x26946
+push 0x59
+jmp near loc_0001d72a ; jmp 0x1d72a
+
+loc_0001d69a:
+test ebx, ebx
+je near loc_0001d737 ; je 0x1d737
+
+loc_0001d6a2:
+sub esp, 0xc
+push 0xdc
+call fcn_00019db6 ; call 0x19db6
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001d6cb ; je 0x1d6cb
+test esi, esi
+jne short loc_0001d6cf ; jne 0x1d6cf
+push eax
+push ref_00026960 ; push 0x26960
+push 0x5f
+jmp short loc_0001d72a ; jmp 0x1d72a
+
+loc_0001d6cb:
+test esi, esi
+je short loc_0001d737 ; je 0x1d737
+
+loc_0001d6cf:
+sub esp, 0xc
+push 0x6b
+call fcn_00019db6 ; call 0x19db6
+mov dword [ebp - 0x2c], eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+mov edx, dword [ebp - 0x2c]
+test al, al
+je short loc_0001d6f9 ; je 0x1d6f9
+test edx, edx
+jne short loc_0001d6fd ; jne 0x1d6fd
+push eax
+push ref_0002697f ; push 0x2697f
+push 0x65
+jmp short loc_0001d72a ; jmp 0x1d72a
+
+loc_0001d6f9:
+test edx, edx
+je short loc_0001d737 ; je 0x1d737
+
+loc_0001d6fd:
+sub esp, 0xc
+push 5
+mov dword [ebp - 0x30], edx
+call fcn_00019db6 ; call 0x19db6
+mov dword [ebp - 0x2c], eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+mov edx, dword [ebp - 0x30]
+test al, al
+je short loc_0001d741 ; je 0x1d741
+cmp dword [ebp - 0x2c], 0
+jne short loc_0001d747 ; jne 0x1d747
+push eax
+push ref_0002699a ; push 0x2699a
+push 0x6b
+
+loc_0001d72a:
+push ref_000268cc ; push 0x268cc
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001d737:
+mov edx, 0x80000009
+jmp near loc_0001dfa8 ; jmp 0x1dfa8
+
+loc_0001d741:
+cmp dword [ebp - 0x2c], 0
+je short loc_0001d737 ; je 0x1d737
+
+loc_0001d747:
+sub esp, 0xc
+push 0x11
+mov dword [ebp - 0x34], edx
+call fcn_00019db6 ; call 0x19db6
+mov dword [ebp - 0x30], eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+mov edx, dword [ebp - 0x34]
+test al, al
+je short loc_0001d776 ; je 0x1d776
+cmp dword [ebp - 0x30], 0
+jne short loc_0001d77c ; jne 0x1d77c
+push eax
+push ref_000269b6 ; push 0x269b6
+push 0x71
+jmp short loc_0001d72a ; jmp 0x1d72a
+
+loc_0001d776:
+cmp dword [ebp - 0x30], 0
+je short loc_0001d737 ; je 0x1d737
+
+loc_0001d77c:
+lea eax, [edi + 0xce]
+mov dword [esi + 0xd0], eax
+lea eax, [edi + 0x8ce]
+mov dword [esi + 0xd4], eax
+lea eax, [edi + 0x8e6]
+mov dword [esi + 0xd8], eax
+push eax
+push 0
+push 0x27
+push dword [ebp - 0x1c]
+mov dword [ebp - 0x40], edx
+call fcn_0001f079 ; call 0x1f079
+mov eax, dword [ebp - 0x20]
+mov ecx, dword [ebp - 0x1c]
+mov dword [eax], 0x80000010
+mov dword [eax + 8], ecx
+mov dword [eax + 4], ref_0002930c ; mov dword [eax + 4], 0x2930c
+mov byte [ecx], 0x13
+call fcn_0001c651 ; call 0x1c651
+add esp, 0x10
+mov edx, dword [ebp - 0x40]
+cmp eax, 0x306d0
+sete cl
+cmp eax, 0x40670
+mov dword [ebp - 0x38], eax
+sete al
+mov byte [ebp - 0x34], al
+or al, cl
+mov byte [ebp - 0x39], cl
+mov byte [ebp - 0x3a], al
+je short loc_0001d811 ; je 0x1d811
+push eax
+push 0
+push 2
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+mov edx, dword [ebp - 0x40]
+add esp, 0x10
+
+loc_0001d811:
+mov al, byte [edi + 0x42]
+mov dword [ebp - 0x40], edx
+mov edx, dword [ebp - 0x24]
+mov ecx, dword [ebp - 0x1c]
+cmp byte [ebp - 0x3a], 1
+mov byte [edx], al
+mov al, byte [edi + 0x43]
+mov byte [edx + 1], al
+mov al, byte [edi + 0x44]
+mov byte [edx + 2], al
+mov al, byte [edi + 0x45]
+mov dword [edx + 4], 0xfed10000
+mov dword [edx + 8], 0xfed18000
+mov dword [edx + 0xc], 0xfed19000
+mov byte [edx + 3], al
+mov dword [edx + 0x22], 0xfed80000
+mov eax, dword [edi + 0x14]
+mov dword [edx + 0x10], eax
+movzx eax, word [edi + 0x18]
+mov dword [edx + 0x14], eax
+mov eax, dword [edi + 0x36]
+mov dword [edx + 0x2b], 0x400000
+mov dword [edx + 0x18], 0xfed84000
+mov word [edx + 0x26], 0
+mov dword [edx + 0x1c], eax
+mov eax, dword [edi + 4]
+mov byte [edx + 0x20], al
+sbb eax, eax
+mov dword [ecx + 1], edx
+mov edx, dword [ebp - 0x28]
+add eax, 3
+mov word [edx + 2], ax
+mov byte [edx + 4], 1
+mov byte [edx + 5], 1
+mov byte [edx + 6], 0
+mov byte [edx + 7], 1
+mov byte [edx + 0xc], 1
+mov eax, dword [edi + 0x22]
+mov word [edx], 0x800
+mov dword [edx + 8], eax
+mov dword [ecx + 5], edx
+mov byte [ebx], 0
+mov eax, dword [edi + 0x4e]
+mov byte [ebx + 3], 1
+mov dword [ebx + 4], 0
+mov byte [ebx + 0x10], 0
+mov word [ebx + 1], ax
+mov byte [ebx + 0x11], 1
+mov byte [ebx + 0x5d], 0xff
+mov byte [ebx + 0x5e], 0x80
+mov byte [ebx + 0x5f], 1
+mov byte [ebx + 0x60], 1
+mov byte [ebx + 0x61], 1
+mov byte [ebx + 0x62], 7
+mov byte [ebx + 0x63], 0
+mov byte [ebx + 0xcf], 1
+mov byte [ebx + 0xfe], 0
+mov byte [ebx + 0xff], 0xe
+mov byte [ebx + 0x100], 0
+mov byte [ebx + 0xc2], 1
+mov byte [ebx + 0xc3], 1
+mov byte [ebx + 0xf2], 0
+mov byte [ebx + 0x24], 1
+mov byte [ebx + 0x25], 0
+mov byte [ebx + 0x26], 0
+mov byte [ebx + 0x27], 0
+mov byte [ebx + 0x28], 0
+mov eax, dword [edi + 0x3a]
+mov byte [ebx + 0x2a], al
+mov eax, dword [edi + 0x3e]
+mov byte [ebx + 0x2b], al
+mov cl, byte [ebp - 0x39]
+cmp dword [ebp - 0x38], 0x40650
+mov byte [ebx + 0x6d], 2
+mov edx, dword [ebp - 0x40]
+mov word [ebx + 0x6e], 0x30ce
+sete al
+or cl, al
+mov byte [ebx + 0x70], 1
+mov byte [ebx + 0x71], 0
+mov byte [ebx + 0x72], 0
+mov byte [ebx + 0x73], 0
+mov byte [ebx + 0x74], 1
+jne short loc_0001d971 ; jne 0x1d971
+cmp byte [ebp - 0x34], 0
+je short loc_0001d975 ; je 0x1d975
+
+loc_0001d971:
+mov byte [ebx + 0x75], 0
+
+loc_0001d975:
+mov al, byte [edi + 0x46]
+mov byte [ebx + 0x77], 1
+mov byte [ebx + 0x78], 0
+mov byte [ebx + 0x79], 0
+mov byte [ebx + 0x76], al
+mov byte [ebx + 0x7a], 3
+mov byte [ebx + 0x7b], 0
+mov byte [ebx + 0x7c], 0
+mov byte [ebx + 0x7d], 0
+mov byte [ebx + 0x7e], 0
+mov byte [ebx + 0x7f], 0
+mov byte [ebx + 0x80], 0
+mov word [ebx + 0x81], 0
+mov byte [ebx + 0x83], 0
+mov byte [ebx + 0x84], 0
+mov byte [ebx + 0x85], 0
+mov word [ebx + 0x86], 0
+mov byte [ebx + 0x88], 0xff
+mov byte [ebx + 0x89], 0xff
+mov byte [ebx + 0x8a], 0xff
+mov byte [ebx + 0x8b], 0xff
+mov byte [ebx + 0x8c], 0xff
+mov byte [ebx + 0x8d], 0xff
+mov byte [ebx + 0x8e], 0xff
+mov byte [ebx + 0x8f], 0xff
+mov byte [ebx + 0x90], 0xff
+mov byte [ebx + 0x91], 0xff
+mov byte [ebx + 0x92], 0xff
+mov byte [ebx + 0x93], 0xff
+mov byte [ebx + 0x94], 0xff
+mov byte [ebx + 0x95], 0xff
+mov byte [ebx + 0x96], 0xff
+mov byte [ebx + 0x97], 0xff
+mov byte [ebx + 0x98], 0
+mov byte [ebx + 0x99], 0
+mov byte [ebx + 0x9a], 0
+mov byte [ebx + 0x9b], 0
+mov byte [ebx + 0x9c], 0
+mov byte [ebx + 0x9d], 0
+mov byte [ebx + 0x9e], 0
+mov byte [ebx + 0x9f], 0
+mov byte [ebx + 0xa0], 0
+mov byte [ebx + 0xa1], 0
+mov byte [ebx + 0xa2], 0
+mov byte [ebx + 0xa3], 0
+mov byte [ebx + 0xa4], 0
+mov byte [ebx + 0xa5], 0
+mov byte [ebx + 0xa6], 0
+mov byte [ebx + 0xa7], 0
+mov byte [ebx + 0xa8], 0
+mov byte [ebx + 0xa9], 0
+mov byte [ebx + 0xaa], 0
+mov byte [ebx + 0xab], 0
+cmp dword [edi + 0x52], 0
+mov word [ebx + 0xad], 0x200
+mov byte [ebx + 0xaf], 0
+sete byte [ebx + 0xac]
+mov byte [ebx + 0xb0], 0x30
+test cl, cl
+jne short loc_0001daf5 ; jne 0x1daf5
+cmp byte [ebp - 0x34], 0
+je short loc_0001db03 ; je 0x1db03
+
+loc_0001daf5:
+mov byte [ebx + 0xb1], 1
+mov byte [ebx + 0xb2], 0x40
+
+loc_0001db03:
+mov byte [ebx + 0x101], 0xff
+mov byte [ebx + 0x2e], 1
+mov byte [ebx + 0x2f], 0
+mov byte [ebx + 0x30], 4
+mov byte [ebx + 0x31], 0xc
+mov byte [ebx + 0x6b], 0
+mov byte [ebx + 0x32], 0
+mov byte [ebx + 0x33], 1
+mov byte [ebx + 0x34], 1
+mov byte [ebx + 0x35], 1
+mov byte [ebx + 0x36], 1
+mov byte [ebx + 0x37], 0
+mov byte [ebx + 0x38], 1
+mov byte [ebx + 0x39], 1
+mov byte [ebx + 0x3a], 1
+mov byte [ebx + 0x3b], 0
+mov byte [ebx + 0x3c], 1
+mov byte [ebx + 0x3e], 1
+mov byte [ebx + 0x3f], 0
+mov byte [ebx + 0x40], 1
+mov byte [ebx + 0x41], 1
+mov byte [ebx + 0x42], 1
+mov byte [ebx + 0x5c], 1
+mov byte [ebx + 0x43], 1
+mov byte [ebx + 0x44], 1
+mov byte [ebx + 0x47], 1
+mov byte [ebx + 0x48], 1
+mov byte [ebx + 0x49], 1
+mov byte [ebx + 0x4a], 0
+mov byte [ebx + 0x4b], 0
+mov byte [ebx + 0x58], 0
+mov byte [ebx + 0x59], 0
+mov byte [ebx + 0x5a], 1
+mov byte [ebx + 0x6a], 1
+mov byte [ebx + 0xc5], 1
+mov byte [ebx + 0xce], 1
+cmp dword [edi + 0x56], 0
+mov byte [ebx + 0xd0], 1
+mov byte [ebx + 0x2c], 1
+sete byte [ebx + 0xfd]
+mov byte [ebx + 0x55], 0
+mov byte [ebx + 0x56], 1
+mov word [ebx + 0x4c], 0
+mov dword [ebx + 0x4e], 0
+mov byte [ebx + 0x53], 2
+mov byte [ebx + 0x54], 0
+mov dword [ebx + 0x64], 0x5f5e100
+mov byte [ebx + 0xc4], 0
+mov byte [ebx + 0x5b], 1
+mov byte [ebx + 0xf3], 1
+mov byte [ebx + 0xc7], 0
+mov al, byte [edi + 0x4a]
+mov byte [ebx + 0x57], al
+test cl, cl
+jne short loc_0001dbff ; jne 0x1dbff
+cmp byte [ebp - 0x34], 0
+jmp short loc_0001dc06 ; jmp 0x1dc06
+
+loc_0001dbff:
+cmp dword [ebp - 0x38], 0x40650
+
+loc_0001dc06:
+je short loc_0001dc87 ; je 0x1dc87
+mov byte [ebx + 0xfc], 0
+mov byte [ebx + 0xd1], 0
+mov dword [ebx + 0xd2], 0
+mov dword [ebx + 0xd6], 0
+mov dword [ebx + 0xda], 0
+mov dword [ebx + 0xde], 0
+mov dword [ebx + 0xe2], 0
+mov dword [ebx + 0xe6], 0
+mov dword [ebx + 0xea], 0
+mov dword [ebx + 0xee], 0
+mov byte [ebx + 0xf4], 1
+mov dword [ebx + 0xf5], 0x320
+mov word [ebx + 0xf9], 0x118
+mov byte [ebx + 0xfb], 7
+
+loc_0001dc87:
+push ecx
+push 0
+push 0
+push 0
+mov dword [ebp - 0x24], edx
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+mov edx, dword [ebp - 0x24]
+mov ecx, eax
+and ch, 0xfe
+cmp cx, 0xc04
+je short loc_0001dcce ; je 0x1dcce
+mov ecx, eax
+and ecx, 0xfffffff7
+cmp cx, 0xa04
+je short loc_0001dcce ; je 0x1dcce
+and eax, 0xffffffef
+cmp ax, 0x1604
+sete al
+movzx eax, al
+jmp short loc_0001dcd3 ; jmp 0x1dcd3
+
+loc_0001dcce:
+mov eax, 1
+
+loc_0001dcd3:
+mov byte [ebx + 0xc6], al
+mov word [ebx + 0xc8], 0xcf8
+mov word [ebx + 0xca], 0xcfc
+mov byte [ebx + 0xcc], 0xaa
+mov dword [esi], fcn_00018ee1 ; mov dword [esi], 0x18ee1
+mov dword [esi + 4], fcn_00018ef6 ; mov dword [esi + 4], 0x18ef6
+mov dword [esi + 8], fcn_00018f64 ; mov dword [esi + 8], 0x18f64
+mov dword [esi + 0xc], fcn_00018eea ; mov dword [esi + 0xc], 0x18eea
+mov dword [esi + 0x10], fcn_00018f27 ; mov dword [esi + 0x10], 0x18f27
+mov dword [esi + 0x14], fcn_00018f97 ; mov dword [esi + 0x14], 0x18f97
+mov dword [esi + 0x18], fcn_00017d8b ; mov dword [esi + 0x18], 0x17d8b
+mov dword [esi + 0x1c], fcn_00017dc2 ; mov dword [esi + 0x1c], 0x17dc2
+mov dword [esi + 0x20], fcn_00017e4e ; mov dword [esi + 0x20], 0x17e4e
+mov dword [esi + 0x24], fcn_00017ed8 ; mov dword [esi + 0x24], 0x17ed8
+mov dword [esi + 0x28], fcn_00017da5 ; mov dword [esi + 0x28], 0x17da5
+mov dword [esi + 0x2c], fcn_00017e04 ; mov dword [esi + 0x2c], 0x17e04
+mov dword [esi + 0x30], fcn_00017e8f ; mov dword [esi + 0x30], 0x17e8f
+mov dword [esi + 0x34], fcn_00016afd ; mov dword [esi + 0x34], 0x16afd
+mov dword [esi + 0x38], fcn_0001a282 ; mov dword [esi + 0x38], 0x1a282
+mov dword [esi + 0x3c], fcn_0001a37c ; mov dword [esi + 0x3c], 0x1a37c
+mov dword [esi + 0x40], fcn_0001a2fa ; mov dword [esi + 0x40], 0x1a2fa
+mov dword [esi + 0x44], fcn_0001a3f5 ; mov dword [esi + 0x44], 0x1a3f5
+mov dword [esi + 0x48], fcn_000167d0 ; mov dword [esi + 0x48], 0x167d0
+mov dword [esi + 0x4c], fcn_000167fe ; mov dword [esi + 0x4c], 0x167fe
+mov dword [esi + 0x50], fcn_00016861 ; mov dword [esi + 0x50], 0x16861
+mov dword [esi + 0x54], fcn_00016a4e ; mov dword [esi + 0x54], 0x16a4e
+mov dword [esi + 0x58], fcn_0001713e ; mov dword [esi + 0x58], 0x1713e
+mov dword [esi + 0x5c], fcn_0001f079 ; mov dword [esi + 0x5c], 0x1f079
+mov dword [esi + 0x60], fcn_00016a89 ; mov dword [esi + 0x60], 0x16a89
+mov dword [esi + 0x64], fcn_00016aa2 ; mov dword [esi + 0x64], 0x16aa2
+mov dword [esi + 0x68], fcn_0001fdda ; mov dword [esi + 0x68], 0x1fdda
+mov dword [esi + 0x6c], fcn_0001724f ; mov dword [esi + 0x6c], 0x1724f
+mov dword [esi + 0x70], fcn_0001fe24 ; mov dword [esi + 0x70], 0x1fe24
+mov dword [esi + 0x74], fcn_0001fe2d ; mov dword [esi + 0x74], 0x1fe2d
+mov eax, dword [ebp - 0x1c]
+mov dword [esi + 0x78], fcn_0001670c ; mov dword [esi + 0x78], 0x1670c
+mov dword [esi + 0x7c], fcn_00016b44 ; mov dword [esi + 0x7c], 0x16b44
+mov dword [esi + 0x80], fcn_0001cc0f ; mov dword [esi + 0x80], 0x1cc0f
+mov dword [esi + 0x84], fcn_0001c9fc ; mov dword [esi + 0x84], 0x1c9fc
+mov dword [esi + 0x88], fcn_00016ba4 ; mov dword [esi + 0x88], 0x16ba4
+mov dword [esi + 0x8c], fcn_00016bab ; mov dword [esi + 0x8c], 0x16bab
+mov dword [esi + 0x90], fcn_00016bb3 ; mov dword [esi + 0x90], 0x16bb3
+mov dword [esi + 0x94], fcn_00016bdc ; mov dword [esi + 0x94], 0x16bdc
+mov dword [esi + 0x98], fcn_000167ad ; mov dword [esi + 0x98], 0x167ad
+mov dword [esi + 0x9c], fcn_00016822 ; mov dword [esi + 0x9c], 0x16822
+mov dword [esi + 0xa0], fcn_000175bc ; mov dword [esi + 0xa0], 0x175bc
+mov dword [esi + 0xa4], fcn_000175c6 ; mov dword [esi + 0xa4], 0x175c6
+mov dword [esi + 0xa8], fcn_00016c50 ; mov dword [esi + 0xa8], 0x16c50
+mov dword [eax + 9], ebx
+mov dword [eax + 0x1e], esi
+xor eax, eax
+mov byte [edx], 0
+mov byte [edx + 1], 1
+mov byte [edx + 2], 1
+mov byte [edx + 3], 1
+mov byte [edx + 4], 0
+mov byte [edx + 5], 0
+mov byte [edx + 6], 0
+mov byte [edx + 7], 0
+mov byte [edx + 0x5c], 0xff
+mov byte [edx + 0x61], 0
+mov byte [edx + 0x5d], 0xff
+mov byte [edx + 0x62], 0
+mov byte [edx + 0x5e], 0xff
+mov byte [edx + 0x63], 0
+mov byte [edx + 8], 1
+mov byte [edx + 0x39], 0
+mov byte [edx + 0x40], 2
+mov byte [edx + 0x5f], 0
+mov byte [edx + 0x60], 0
+mov byte [edx + 0x64], 2
+mov word [edx + 0x65], 0x2710
+mov word [edx + 0x67], 2
+mov byte [edx + 0x69], 2
+mov byte [edx + 0x6a], 2
+mov byte [edx + 0x3b], 1
+mov byte [edx + 0x48], 0
+mov word [edx + 0x3c], 0x3e8
+mov byte [edx + 0x3f], 0xf
+mov byte [edx + 0x42], 0x14
+mov word [edx + 0x50], 1
+
+loc_0001dec9:
+mov byte [edx + eax + 9], 8
+mov byte [edx + eax + 0x19], 7
+mov byte [edx + eax + 0x29], 2
+inc eax
+cmp eax, 0x10
+jne short loc_0001dec9 ; jne 0x1dec9
+mov eax, dword [ebp - 0x2c]
+mov byte [edx + 0x49], 0
+mov byte [eax], 0
+xor eax, eax
+mov byte [edx + 0x52], 0
+mov byte [edx + 0x53], 0
+
+loc_0001def2:
+mov byte [edx + eax + 0x54], 8
+inc eax
+cmp eax, 8
+jne short loc_0001def2 ; jne 0x1def2
+mov esi, dword [ebp - 0x30]
+sub esp, 0xc
+mov ecx, dword [ebp - 0x1c]
+mov dword [edx + 0x44], 0
+mov dword [ecx + 0xd], edx
+mov word [esi], 0
+mov word [esi + 2], 0
+mov word [esi + 4], 0
+mov word [esi + 6], 0
+mov word [esi + 8], 0
+mov byte [esi + 0xa], 0
+mov byte [esi + 0xb], 0
+mov word [esi + 0xc], 0
+mov word [esi + 0xe], 0
+mov byte [esi + 0x10], 0
+mov dword [ecx + 0x11], esi
+mov byte [ecx + 0x22], 0
+mov eax, dword [edi + 0x8f6]
+mov dword [ecx + 0x15], eax
+push dword [ebp - 0x20]
+call fcn_0001972b ; call 0x1972b
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+mov edx, ebx
+test al, al
+je short loc_0001dfa8 ; je 0x1dfa8
+test ebx, ebx
+jns short loc_0001dfa8 ; jns 0x1dfa8
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001df8e ; je 0x1df8e
+push edx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001df8e:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x237
+push ref_000268cc ; push 0x268cc
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+mov edx, ebx
+
+loc_0001dfa8:
+lea esp, [ebp - 0xc]
+mov eax, edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001dfb2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+call fcn_00016410 ; call 0x16410
+mov esi, eax
+call fcn_0001bfbb ; call 0x1bfbb
+sub esp, 0xc
+push 0x5ac
+mov dword [ebp - 0x1c], eax
+call fcn_00019db6 ; call 0x19db6
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+jne short loc_0001e00b ; jne 0x1e00b
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001e001 ; je 0x1e001
+push eax
+push ref_00022281 ; push 0x22281
+push 0x129
+
+loc_0001dff4:
+push ref_000269cf ; push 0x269cf
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001e001:
+mov edx, 0x80000009
+jmp near loc_0001e677 ; jmp 0x1e677
+
+loc_0001e00b:
+sub esp, 0xc
+push 0xc
+call fcn_00019db6 ; call 0x19db6
+add esp, 0x10
+mov dword [ebp - 0x20], eax
+test eax, eax
+jne short loc_0001e035 ; jne 0x1e035
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001e001 ; je 0x1e001
+push eax
+push ref_00022281 ; push 0x22281
+push 0x12f
+jmp short loc_0001dff4 ; jmp 0x1dff4
+
+loc_0001e035:
+mov eax, dword [ebp - 0x20]
+xor edi, edi
+mov dword [eax], 0x80000010
+mov dword [eax + 4], ref_000291dc ; mov dword [eax + 4], 0x291dc
+mov dword [eax + 8], ebx
+lea eax, [ebx + 0x284]
+mov byte [ebx], 0xc
+mov byte [ebx + 1], 0
+mov dword [ebx + 4], 0xfed1c000
+mov dword [ebp - 0x24], eax
+mov eax, dword [esi + 0x2a]
+mov word [ebx + 8], ax
+mov eax, dword [esi + 0x2e]
+mov byte [ebx + 0xc], 0
+mov byte [ebx + 0x37e], 1 ; enable GbE
+mov byte [ebx + 0x370], 1
+mov word [ebx + 0xa], ax
+mov byte [ebx + 0x1da], 1
+mov byte [ebx + 0x386], 1
+mov ax, word [esi + 0x18]
+or byte [ebx + 0x45e], 1
+or byte [ebx + 0x49e], 0x80
+and byte [ebx + 0x486], 0xfe
+mov word [ebx + 0x388], ax
+mov byte [ebx + 0x3a], 0
+mov byte [ebx + 0x496], 1
+mov byte [ebx + 0x497], 1
+mov byte [ebx + 0x498], 1
+mov byte [ebx + 0x499], 1
+mov byte [ebx + 0x49a], 1
+mov byte [ebx + 0x49b], 1
+mov byte [ebx + 0x49c], 1
+mov byte [ebx + 0x49d], 1
+or byte [ebx + 0x412], 0xf
+or byte [ebx + 0x419], 0xc0
+or byte [ebx + 0x41e], 2
+or byte [ebx + 0x424], 0x40
+mov byte [ebx + 0x43c], 1
+
+loc_0001e10e:
+call fcn_0001c1e1 ; call 0x1c1e1
+movzx eax, al
+cmp edi, eax
+jae short loc_0001e128 ; jae 0x1e128
+imul eax, edi, 0x12
+inc edi
+or byte [ebx + eax + 0x1e1], 0x40
+jmp short loc_0001e10e ; jmp 0x1e10e
+
+loc_0001e128:
+mov al, byte [ebx + 0x436]
+xor ecx, ecx
+and byte [ebx + 0x426], 0xfe
+or byte [ebx + 0x432], 7
+or eax, 3
+and eax, 0xfffffffb
+mov word [ebx + 0x43a], 0
+mov byte [ebx + 0x436], al
+mov byte [ebx + 0x1a8], 1
+
+loc_0001e15a:
+mov dword [ebp - 0x28], ecx
+call fcn_0001c1bf ; call 0x1c1bf
+mov ecx, dword [ebp - 0x28]
+cmp cl, al
+jae short loc_0001e192 ; jae 0x1e192
+movzx eax, cl
+imul eax, eax, 0x2c
+add eax, ebx
+mov dl, byte [eax + 0x46]
+mov byte [eax + 0x4f], cl
+mov byte [eax + 0x50], cl
+inc ecx
+mov byte [eax + 0x56], 4
+or edx, 5
+and edx, 0x7f
+mov byte [eax + 0x57], 3
+mov byte [eax + 0x4e], 0
+mov byte [eax + 0x46], dl
+jmp short loc_0001e15a ; jmp 0x1e15a
+
+loc_0001e192:
+or byte [ebx + 0x17a], 8
+sub esp, 0xc
+and byte [ebx + 0x1aa], 0xfe
+mov byte [ebx + 0x1a6], 0
+mov byte [ebx + 0x1a7], 0
+mov byte [ebx + 0x1a9], 1
+push 0xc
+call fcn_00019db6 ; call 0x19db6
+add esp, 0x10
+test eax, eax
+jne short loc_0001e1dc ; jne 0x1e1dc
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001e240 ; je 0x1e240
+push eax
+push ref_00022281 ; push 0x22281
+push 0xf8
+jmp short loc_0001e233 ; jmp 0x1e233
+
+loc_0001e1dc:
+sub esp, 0xc
+mov dword [eax], 0x80000010
+mov dword [eax + 4], ref_0002911c ; mov dword [eax + 4], 0x2911c
+mov dword [eax + 8], ref_00029748 ; mov dword [eax + 8], 0x29748
+push eax
+call fcn_0001972b ; call 0x1972b
+mov edi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001e240 ; je 0x1e240
+test edi, edi
+jns short loc_0001e240 ; jns 0x1e240
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001e228 ; je 0x1e228
+push eax
+push edi
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001e228:
+push ecx
+push ref_000206f4 ; push 0x206f4
+push 0x101
+
+loc_0001e233:
+push ref_000269cf ; push 0x269cf
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001e240:
+mov dword [ebx + 0x1db], 1
+xor edi, edi
+
+loc_0001e24c:
+call fcn_0001c1e1 ; call 0x1c1e1
+mov edx, edi
+cmp dl, al
+jae near loc_0001e2db ; jae 0x1e2db
+mov eax, edi
+inc edi
+movzx eax, al
+imul eax, eax, 0x12
+add eax, ebx
+mov dl, byte [eax + 0x1e1]
+lea ecx, [eax + 0x1da]
+mov byte [eax + 0x1df], 0x71
+mov byte [eax + 0x1e0], 0x1f
+mov byte [eax + 0x1e4], 1
+and edx, 0xffffffc0
+or edx, 0x27
+mov byte [eax + 0x1e1], dl
+mov byte [eax + 0x1e6], 1
+mov byte [eax + 0x1e8], 1
+mov byte [eax + 0x1e3], 0
+mov byte [eax + 0x1e5], 0
+mov byte [eax + 0x1e7], 0
+mov byte [eax + 0x1e9], 0
+mov byte [eax + 0x1ea], 0
+mov byte [eax + 0x1eb], 0
+mov byte [eax + 0x1ec], 0
+and byte [ecx + 0x13], 0xf0
+jmp near loc_0001e24c ; jmp 0x1e24c
+
+loc_0001e2db:
+mov al, byte [ebx + 0x24c]
+mov byte [ebx + 0x24b], 0x7e
+mov byte [ebx + 0x253], 0
+mov byte [ebx + 0x255], 1
+or eax, 0x1e
+and eax, 0xfffffffe
+mov byte [ebx + 0x24c], al
+mov byte [ebx + 0x254], 0
+mov dword [ebx + 0x24f], 0
+mov byte [ebx + 0x257], 0
+mov byte [ebx + 0x258], 0
+mov byte [ebx + 0x259], 0
+mov byte [ebx + 0x25a], 0
+mov byte [ebx + 0x25b], 0x64
+call fcn_00015480 ; call 0x15480
+mov byte [ebx + 0x38d], 4
+push eax
+push 4
+push ref_000296b0 ; push 0x296b0
+lea eax, [ebx + 0x38e]
+push eax
+call fcn_0001713e ; call 0x1713e
+mov word [ebx + 0x36], 0x8086
+mov word [ebx + 0x38], 0x7270
+mov byte [ebx + 0x3b], 0
+mov byte [ebx + 0x360], 2
+mov byte [ebx + 0x361], 0
+mov byte [ebx + 0x362], 1
+mov byte [ebx + 0x35c], 1
+mov byte [ebx + 0x35d], 0xf0
+mov byte [ebx + 0x35e], 0x1f
+mov byte [ebx + 0x35f], 0
+mov eax, dword [esi + 0xc]
+mov word [ebx + 0x22], 0xd000
+mov word [ebx + 0x24], 0x10
+mov byte [ebx + 0x11], al
+mov eax, dword [esi + 0x32]
+mov dword [ebx + 0x1e], 0x10000
+mov byte [ebx + 0x18], 2
+mov byte [ebx + 0x19], 6
+mov dword [ebx + 0x1a], eax
+mov byte [ebx + 0x371], 0
+mov word [ebx + 0x374], 0x12c
+mov byte [ebx + 0x372], 1
+mov byte [ebx + 0x373], 0
+pop eax
+pop edx
+lea eax, [ebx + 0x57c]
+push eax
+push dword [ebp - 0x24]
+call fcn_0001e681 ; call 0x1e681
+mov al, byte [ebx + 0x40e]
+add esp, 0x10
+or eax, 3
+and eax, 0xffffffc3
+mov byte [ebx + 0x40e], al
+xor eax, eax
+
+loc_0001e404:
+and byte [ebx + eax*8 + 0x554], 0xfc
+mov word [ebx + eax*8 + 0x558], 0
+mov word [ebx + eax*8 + 0x55a], 0
+inc eax
+cmp eax, 5
+jne short loc_0001e404 ; jne 0x1e404
+mov al, byte [ebx + 0x46a]
+xor ecx, ecx
+mov byte [ebx + 0x364], 1
+mov dword [ebx + 0x368], 0xfed00000
+mov byte [ebx + 0x36c], 1
+and eax, 0xffffffb0
+or eax, 0x49
+mov byte [ebx + 0x365], 0xf0
+mov byte [ebx + 0x366], 0xf
+mov byte [ebx + 0x367], 0
+mov byte [ebx + 0x476], 1
+mov dword [ebx + 0x47e], 0
+mov dword [ebx + 0x47a], 1
+mov byte [ebx + 0x46a], al
+mov byte [ebx + 0x37f], 0
+mov byte [ebx + 0x256], 1
+
+loc_0001e490:
+mov dword [ebp - 0x24], ecx
+call fcn_0001c1bf ; call 0x1c1bf
+mov ecx, dword [ebp - 0x24]
+cmp cl, al
+jae short loc_0001e4ad ; jae 0x1e4ad
+movzx eax, cl
+inc ecx
+imul eax, eax, 0x2c
+mov byte [ebx + eax + 0x58], 1
+jmp short loc_0001e490 ; jmp 0x1e490
+
+loc_0001e4ad:
+and byte [ebx + 0x45e], 0xf7
+xor ecx, ecx
+
+loc_0001e4b6:
+mov dword [ebp - 0x24], ecx
+call fcn_0001c1bf ; call 0x1c1bf
+mov ecx, dword [ebp - 0x24]
+cmp cl, al
+jae short loc_0001e524 ; jae 0x1e524
+cmp dword [ebp - 0x1c], 2
+movzx eax, cl
+jne short loc_0001e4e3 ; jne 0x1e4e3
+imul esi, eax, 0x2c
+lea esi, [ebx + esi + 0x50]
+mov word [esi + 0xa], 0x1003
+mov word [esi + 0xc], 0x1003
+jmp short loc_0001e4fc ; jmp 0x1e4fc
+
+loc_0001e4e3:
+cmp dword [ebp - 0x1c], 1
+jne short loc_0001e4fc ; jne 0x1e4fc
+imul esi, eax, 0x2c
+lea esi, [ebx + esi + 0x50]
+mov word [esi + 0xa], 0x846
+mov word [esi + 0xc], 0x846
+
+loc_0001e4fc:
+imul eax, eax, 0x2c
+inc ecx
+add eax, ebx
+mov byte [eax + 0x59], 0
+mov byte [eax + 0x5e], 2
+mov byte [eax + 0x5f], 2
+mov word [eax + 0x60], 0x3c
+mov byte [eax + 0x62], 2
+mov byte [eax + 0x63], 2
+mov word [eax + 0x64], 0x3c
+jmp short loc_0001e4b6 ; jmp 0x1e4b6
+
+loc_0001e524:
+mov al, byte [ebx + 0x446]
+or byte [ebx + 0x442], 7
+and byte [ebx + 0x45e], 0xf9
+and eax, 0xffffffcc
+or eax, 0xc
+mov byte [ebx + 0x446], al
+mov al, byte [ebx + 0x486]
+mov dword [ebx + 0x44a], 0
+mov dword [ebx + 0x44e], 2
+mov dword [ebx + 0x452], 4
+and eax, 1
+or eax, 0x32
+mov byte [ebx + 0x486], al
+mov al, byte [ebx + 0x49e]
+mov dword [ebx + 0x456], 3
+mov dword [ebx + 0x45a], 3
+mov byte [ebx + 0x462], 4
+or eax, 1
+and eax, 0xffffffbd
+mov byte [ebx + 0x49e], al
+xor eax, eax
+mov byte [ebx + 0x10], 0xdd
+
+loc_0001e5a7:
+mov dword [ebx + eax*4 + 0x1ba], 0
+inc eax
+cmp eax, 8
+jne short loc_0001e5a7 ; jne 0x1e5a7
+cmp dword [ebp - 0x1c], 2
+lea eax, [ebx + 0x4de]
+lea esi, [ebx + 0x527]
+jne short loc_0001e5f2 ; jne 0x1e5f2
+mov byte [ebx + 0x526], 5
+push edi
+push 0x28
+push ref_000296f0 ; push 0x296f0
+push eax
+call fcn_0001713e ; call 0x1713e
+add esp, 0xc
+mov byte [ebx + 0x553], 9
+push 0x24
+push ref_000296b4 ; push 0x296b4
+jmp short loc_0001e618 ; jmp 0x1e618
+
+loc_0001e5f2:
+mov byte [ebx + 0x526], 6
+push ecx
+push 0x30
+push ref_00029718 ; push 0x29718
+push eax
+call fcn_0001713e ; call 0x1713e
+add esp, 0xc
+mov byte [ebx + 0x553], 6
+push 0x18
+push ref_000296d8 ; push 0x296d8
+
+loc_0001e618:
+push esi
+call fcn_0001713e ; call 0x1713e
+add esp, 0x10
+sub esp, 0xc
+push dword [ebp - 0x20]
+call fcn_0001972b ; call 0x1972b
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+mov edx, ebx
+test al, al
+je short loc_0001e677 ; je 0x1e677
+test ebx, ebx
+jns short loc_0001e677 ; jns 0x1e677
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001e65d ; je 0x1e65d
+push edx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001e65d:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0x2d5
+push ref_000269cf ; push 0x269cf
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+mov edx, ebx
+
+loc_0001e677:
+lea esp, [ebp - 0xc]
+mov eax, edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001e681:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov ebx, dword [ebp + 8]
+call fcn_00016410 ; call 0x16410
+test ebx, ebx
+jne short loc_0001e6bd ; jne 0x1e6bd
+call fcn_00015480 ; call 0x15480
+test al, al
+je near loc_0001ecf3 ; je 0x1ecf3
+push edx
+push ref_00022281 ; push 0x22281
+push 0x35
+push ref_000269ec ; push 0x269ec
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+jmp near loc_0001ecf3 ; jmp 0x1ecf3
+
+loc_0001e6bd:
+mov esi, eax
+call fcn_0001bfbb ; call 0x1bfbb
+mov edi, eax
+push eax
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+xor ecx, ecx
+mov byte [ebx], 0
+mov byte [ebx + 8], 0
+mov byte [ebx + 0x11], 1
+mov byte [ebx + 0x10], 1
+mov byte [ebx + 0x13], 0
+mov edx, eax
+mov byte [ebx + 0x12], 1
+
+loc_0001e6fb:
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x1c], ecx
+call fcn_0001c261 ; call 0x1c261
+mov ecx, dword [ebp - 0x1c]
+mov edx, dword [ebp - 0x20]
+movzx eax, al
+cmp ecx, eax
+jae short loc_0001e71b ; jae 0x1e71b
+mov byte [ebx + ecx + 0x14], 0
+inc ecx
+jmp short loc_0001e6fb ; jmp 0x1e6fb
+
+loc_0001e71b:
+xor ecx, ecx
+
+loc_0001e71d:
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x1c], ecx
+call fcn_0001c2f8 ; call 0x1c2f8
+mov ecx, dword [ebp - 0x1c]
+mov edx, dword [ebp - 0x20]
+movzx eax, al
+cmp ecx, eax
+jae short loc_0001e73d ; jae 0x1e73d
+mov byte [ebx + ecx + 0x22], 0
+inc ecx
+jmp short loc_0001e71d ; jmp 0x1e71d
+
+loc_0001e73d:
+mov byte [ebx + 0x28], 0
+mov byte [ebx + 1], 0
+mov byte [ebx + 9], 0
+mov byte [ebx + 0xb5], 0
+mov byte [ebx + 0xb4], 1
+mov al, byte [esi + 0x5c]
+mov byte [ebx + 0x2c], al
+mov al, byte [esi + 0x61]
+mov byte [ebx + 0x34], al
+mov al, byte [esi + 0x66]
+mov byte [ebx + 0x3c], al
+mov al, byte [esi + 0x6b]
+mov byte [ebx + 0x44], al
+mov al, byte [esi + 0x70]
+mov byte [ebx + 0x4c], al
+mov al, byte [esi + 0x75]
+mov byte [ebx + 0x54], al
+mov al, byte [esi + 0x7a]
+mov byte [ebx + 0x5c], al
+mov al, byte [esi + 0x7f]
+mov byte [ebx + 0x64], al
+mov al, byte [esi + 0x84]
+mov byte [ebx + 0x6c], al
+mov al, byte [esi + 0x89]
+mov byte [ebx + 0x74], al
+mov al, byte [esi + 0x8e]
+mov byte [ebx + 0x7c], al
+mov al, byte [esi + 0x93]
+mov byte [ebx + 0x84], al
+mov al, byte [esi + 0x98]
+mov byte [ebx + 0x8c], al
+mov al, byte [esi + 0x9d]
+mov byte [ebx + 0x94], al
+mov al, byte [esi + 0xa0]
+mov byte [ebx + 0x9c], al
+mov al, byte [esi + 0xa3]
+mov byte [ebx + 0xa0], al
+mov al, byte [esi + 0xa6]
+mov byte [ebx + 0xa4], al
+mov al, byte [esi + 0xa9]
+mov byte [ebx + 0xa8], al
+mov al, byte [esi + 0xac]
+mov byte [ebx + 0xac], al
+mov al, byte [esi + 0xaf]
+mov byte [ebx + 0xb0], al
+mov al, byte [esi + 0x5d]
+mov byte [ebx + 0x2d], al
+mov al, byte [esi + 0x62]
+mov byte [ebx + 0x35], al
+mov al, byte [esi + 0x67]
+mov byte [ebx + 0x3d], al
+mov al, byte [esi + 0x6c]
+mov byte [ebx + 0x45], al
+mov al, byte [esi + 0x71]
+mov byte [ebx + 0x4d], al
+mov al, byte [esi + 0x76]
+mov byte [ebx + 0x55], al
+mov al, byte [esi + 0x7b]
+mov byte [ebx + 0x5d], al
+mov al, byte [esi + 0x80]
+mov byte [ebx + 0x65], al
+mov al, byte [esi + 0x85]
+mov byte [ebx + 0x6d], al
+mov al, byte [esi + 0x8a]
+mov byte [ebx + 0x75], al
+mov al, byte [esi + 0x8f]
+mov byte [ebx + 0x7d], al
+mov al, byte [esi + 0x94]
+mov byte [ebx + 0x85], al
+mov al, byte [esi + 0x99]
+mov byte [ebx + 0x8d], al
+mov al, byte [esi + 0x9e]
+mov byte [ebx + 0x95], al
+mov al, byte [esi + 0xa1]
+mov byte [ebx + 0x9d], al
+mov al, byte [esi + 0xa4]
+mov byte [ebx + 0xa1], al
+mov al, byte [esi + 0xa7]
+mov byte [ebx + 0xa5], al
+mov al, byte [esi + 0xaa]
+mov byte [ebx + 0xa9], al
+mov al, byte [esi + 0xad]
+mov byte [ebx + 0xad], al
+mov al, byte [esi + 0xb0]
+mov byte [ebx + 0xb1], al
+mov ax, word [esi + 0x5a]
+mov word [ebx + 0x30], ax
+mov ax, word [esi + 0x5f]
+mov word [ebx + 0x38], ax
+mov ax, word [esi + 0x64]
+mov word [ebx + 0x40], ax
+mov ax, word [esi + 0x69]
+mov word [ebx + 0x48], ax
+mov ax, word [esi + 0x6e]
+mov word [ebx + 0x50], ax
+mov ax, word [esi + 0x73]
+mov word [ebx + 0x58], ax
+mov ax, word [esi + 0x78]
+mov word [ebx + 0x60], ax
+mov ax, word [esi + 0x7d]
+mov word [ebx + 0x68], ax
+mov ax, word [esi + 0x82]
+mov word [ebx + 0x70], ax
+mov ax, word [esi + 0x87]
+mov word [ebx + 0x78], ax
+mov ax, word [esi + 0x8c]
+mov word [ebx + 0x80], ax
+mov ax, word [esi + 0x91]
+mov word [ebx + 0x88], ax
+mov ax, word [esi + 0x96]
+mov word [ebx + 0x90], ax
+mov ax, word [esi + 0x9b]
+mov word [ebx + 0x98], ax
+mov al, byte [esi + 0xa2]
+mov byte [ebx + 0x9e], al
+mov al, byte [esi + 0xa5]
+mov byte [ebx + 0xa2], al
+mov al, byte [esi + 0xa8]
+mov byte [ebx + 0xa6], al
+mov al, byte [esi + 0xab]
+mov byte [ebx + 0xaa], al
+mov al, byte [esi + 0xae]
+mov byte [ebx + 0xae], al
+mov al, byte [esi + 0xb1]
+mov byte [ebx + 0xb2], al
+mov al, byte [esi + 0x5e]
+mov byte [ebx + 0x32], al
+mov al, byte [esi + 0x63]
+mov byte [ebx + 0x3a], al
+mov al, byte [esi + 0x68]
+mov byte [ebx + 0x42], al
+mov al, byte [esi + 0x6d]
+mov byte [ebx + 0x4a], al
+mov al, byte [esi + 0x72]
+mov byte [ebx + 0x52], al
+mov al, byte [esi + 0x77]
+mov byte [ebx + 0x5a], al
+mov al, byte [esi + 0x7c]
+mov byte [ebx + 0x62], al
+mov al, byte [esi + 0x81]
+mov byte [ebx + 0x6a], al
+mov al, byte [esi + 0x86]
+mov byte [ebx + 0x72], al
+mov al, byte [esi + 0x8b]
+mov byte [ebx + 0x7a], al
+mov al, byte [esi + 0x90]
+mov byte [ebx + 0x82], al
+mov al, byte [esi + 0x95]
+mov byte [ebx + 0x8a], al
+mov al, byte [esi + 0x9a]
+mov byte [ebx + 0x92], al
+mov al, byte [esi + 0x9f]
+mov byte [ebx + 0x9a], al
+cmp edi, 1
+jne near loc_0001eb4c ; jne 0x1eb4c
+mov eax, edx
+and eax, 0xfffffff7
+cmp ax, 0x8c44
+je short loc_0001ea33 ; je 0x1ea33
+mov ecx, edx
+and ecx, 0xfffffffb
+cmp dx, 0x8c50
+jne short loc_0001ea3a ; jne 0x1ea3a
+
+loc_0001ea33:
+lea edi, [ebx + 0x2f]
+xor edx, edx
+jmp short loc_0001ea8a ; jmp 0x1ea8a
+
+loc_0001ea3a:
+cmp dx, 0x8c5c
+je short loc_0001ea33 ; je 0x1ea33
+mov edi, edx
+and edi, 0xfffffff3
+cmp di, 0x8c42
+je short loc_0001ea33 ; je 0x1ea33
+cmp dx, 0x8cc4
+je short loc_0001ea33 ; je 0x1ea33
+cmp cx, 0x8cc2
+jne short loc_0001eaa3 ; jne 0x1eaa3
+jmp short loc_0001ea33 ; jmp 0x1ea33
+
+loc_0001ea5d:
+cmp byte [edi + 3], 1
+sbb eax, eax
+not eax
+add eax, 4
+cmp byte [edi + 3], 0
+mov byte [edi - 1], al
+jne short loc_0001ea9e ; jne 0x1ea9e
+mov ax, word [edi + 1]
+cmp ax, 0x7f
+jbe short loc_0001ea9e ; jbe 0x1ea9e
+cmp ax, 0x130
+sbb eax, eax
+add eax, 4
+mov byte [edi], al
+
+loc_0001ea86:
+inc edx
+add edi, 8
+
+loc_0001ea8a:
+mov dword [ebp - 0x1c], edx
+call fcn_0001c261 ; call 0x1c261
+mov edx, dword [ebp - 0x1c]
+movzx eax, al
+cmp edx, eax
+jb short loc_0001ea5d ; jb 0x1ea5d
+jmp short loc_0001eacd ; jmp 0x1eacd
+
+loc_0001ea9e:
+mov byte [edi], 2
+jmp short loc_0001ea86 ; jmp 0x1ea86
+
+loc_0001eaa3:
+cmp cx, 0x8c4b
+je short loc_0001eae5 ; je 0x1eae5
+cmp ax, 0x8c41
+je short loc_0001eae5 ; je 0x1eae5
+lea eax, [edx + 0x63bf]
+cmp ax, 6
+jbe short loc_0001eae5 ; jbe 0x1eae5
+cmp dx, 0x8cc5
+je short loc_0001eae5 ; je 0x1eae5
+and edx, 0xfffffffd
+cmp dx, 0x8cc1
+je short loc_0001eae5 ; je 0x1eae5
+
+loc_0001eacd:
+cmp dword [esi + 0x10], 0
+je near loc_0001ec26 ; je 0x1ec26
+mov byte [ebx], 1
+xor edi, edi
+mov byte [ebx + 0x13], 1
+jmp near loc_0001ebf4 ; jmp 0x1ebf4
+
+loc_0001eae5:
+lea edi, [ebx + 0x2f]
+xor edx, edx
+
+loc_0001eaea:
+mov dword [ebp - 0x1c], edx
+call fcn_0001c261 ; call 0x1c261
+mov edx, dword [ebp - 0x1c]
+movzx eax, al
+cmp edx, eax
+jae short loc_0001eacd ; jae 0x1eacd
+mov al, byte [edi + 3]
+cmp al, 5
+jne short loc_0001eb09 ; jne 0x1eb09
+mov byte [edi - 1], 5
+jmp short loc_0001eb24 ; jmp 0x1eb24
+
+loc_0001eb09:
+cmp al, 2
+jne short loc_0001eb13 ; jne 0x1eb13
+mov byte [edi - 1], 4
+jmp short loc_0001eb2d ; jmp 0x1eb2d
+
+loc_0001eb13:
+cmp word [edi + 1], 0x70
+sbb ecx, ecx
+add ecx, 6
+mov byte [edi - 1], cl
+cmp al, 5
+jne short loc_0001eb29 ; jne 0x1eb29
+
+loc_0001eb24:
+mov byte [edi], 2
+jmp short loc_0001eb46 ; jmp 0x1eb46
+
+loc_0001eb29:
+cmp al, 2
+jne short loc_0001eb39 ; jne 0x1eb39
+
+loc_0001eb2d:
+cmp word [edi + 1], 0x50
+sbb eax, eax
+add eax, 2
+jmp short loc_0001eb44 ; jmp 0x1eb44
+
+loc_0001eb39:
+cmp word [edi + 1], 0x100
+sbb eax, eax
+add eax, 3
+
+loc_0001eb44:
+mov byte [edi], al
+
+loc_0001eb46:
+inc edx
+add edi, 8
+jmp short loc_0001eaea ; jmp 0x1eaea
+
+loc_0001eb4c:
+cmp edi, 2
+jne near loc_0001eacd ; jne 0x1eacd
+lea eax, [edx + 0x63bf]
+xor ecx, ecx
+mov word [ebp - 0x1c], ax
+lea eax, [edx + 0x633f]
+lea edi, [ebx + 0x2f]
+mov word [ebp - 0x20], ax
+
+loc_0001eb6e:
+mov dword [ebp - 0x24], ecx
+call fcn_0001c261 ; call 0x1c261
+mov ecx, dword [ebp - 0x24]
+movzx eax, al
+cmp ecx, eax
+jae near loc_0001eacd ; jae 0x1eacd
+cmp word [ebp - 0x1c], 6
+ja short loc_0001ebad ; ja 0x1ebad
+mov al, byte [edi + 3]
+cmp al, 3
+je short loc_0001eb96 ; je 0x1eb96
+test al, al
+jne short loc_0001eba2 ; jne 0x1eba2
+
+loc_0001eb96:
+cmp word [edi + 1], 0x70
+sbb eax, eax
+add eax, 6
+jmp short loc_0001ebaa ; jmp 0x1ebaa
+
+loc_0001eba2:
+cmp al, 2
+setne al
+add eax, 4
+
+loc_0001ebaa:
+mov byte [edi - 1], al
+
+loc_0001ebad:
+cmp word [ebp - 0x20], 0xa
+ja short loc_0001ebb8 ; ja 0x1ebb8
+mov byte [edi - 1], 6
+
+loc_0001ebb8:
+mov al, byte [edi + 3]
+mov dl, al
+and edx, 0xfffffffb
+cmp dl, 3
+je short loc_0001ebc9 ; je 0x1ebc9
+test al, al
+jne short loc_0001ebd6 ; jne 0x1ebd6
+
+loc_0001ebc9:
+cmp word [edi + 1], 0x100
+sbb eax, eax
+add eax, 3
+jmp short loc_0001ebe4 ; jmp 0x1ebe4
+
+loc_0001ebd6:
+cmp al, 2
+jne short loc_0001ebe8 ; jne 0x1ebe8
+cmp word [edi + 1], 0x50
+sbb eax, eax
+add eax, 2
+
+loc_0001ebe4:
+mov byte [edi], al
+jmp short loc_0001ebeb ; jmp 0x1ebeb
+
+loc_0001ebe8:
+mov byte [edi], 2
+
+loc_0001ebeb:
+inc ecx
+add edi, 8
+jmp near loc_0001eb6e ; jmp 0x1eb6e
+
+loc_0001ebf4:
+call fcn_0001c261 ; call 0x1c261
+movzx eax, al
+cmp edi, eax
+jae short loc_0001ec08 ; jae 0x1ec08
+mov byte [ebx + edi + 0x14], 1
+inc edi
+jmp short loc_0001ebf4 ; jmp 0x1ebf4
+
+loc_0001ec08:
+mov byte [ebx + 0x15], 0
+xor edi, edi
+
+loc_0001ec0e:
+call fcn_0001c2f8 ; call 0x1c2f8
+movzx eax, al
+cmp edi, eax
+jae short loc_0001ec22 ; jae 0x1ec22
+mov byte [ebx + edi + 0x22], 1
+inc edi
+jmp short loc_0001ec0e ; jmp 0x1ec0e
+
+loc_0001ec22:
+mov byte [ebx + 0x23], 0
+
+loc_0001ec26:
+xor ebx, ebx
+
+loc_0001ec28:
+call fcn_0001c2f8 ; call 0x1c2f8
+movzx eax, al
+cmp ebx, eax
+jae near loc_0001ecf3 ; jae 0x1ecf3
+mov dl, byte [esi + ebx + 0xb2]
+mov eax, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0xc]
+test dl, dl
+mov al, byte [eax + ebx*8 + 4]
+je short loc_0001ec55 ; je 0x1ec55
+mov byte [ecx + ebx*8], dl
+or eax, 1
+jmp short loc_0001ec5c ; jmp 0x1ec5c
+
+loc_0001ec55:
+mov byte [ecx + ebx*8], 0
+and eax, 0xfffffffe
+
+loc_0001ec5c:
+mov byte [ecx + ebx*8 + 4], al
+mov dl, byte [esi + ebx + 0xb8]
+mov eax, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0xc]
+test dl, dl
+mov al, byte [eax + ebx*8 + 4]
+je short loc_0001ec7e ; je 0x1ec7e
+mov byte [ecx + ebx*8 + 1], dl
+or eax, 2
+jmp short loc_0001ec86 ; jmp 0x1ec86
+
+loc_0001ec7e:
+mov byte [ecx + ebx*8 + 1], 0
+and eax, 0xfffffffd
+
+loc_0001ec86:
+mov byte [ecx + ebx*8 + 4], al
+mov dl, byte [esi + ebx + 0xbe]
+mov eax, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0xc]
+test dl, dl
+mov al, byte [eax + ebx*8 + 4]
+je short loc_0001ecac ; je 0x1ecac
+or eax, 4
+mov byte [ecx + ebx*8 + 2], dl
+mov byte [ecx + ebx*8 + 4], al
+jmp short loc_0001ecb8 ; jmp 0x1ecb8
+
+loc_0001ecac:
+and eax, 0xfffffffb
+mov byte [ecx + ebx*8 + 2], 0
+mov byte [ecx + ebx*8 + 4], al
+
+loc_0001ecb8:
+mov dl, byte [esi + ebx + 0xc4]
+mov eax, dword [ebp + 0xc]
+test dl, dl
+mov al, byte [eax + ebx*8 + 4]
+je short loc_0001ecde ; je 0x1ecde
+mov ecx, dword [ebp + 0xc]
+lea edx, [edx + edx + 1]
+or eax, 8
+mov byte [ecx + ebx*8 + 3], dl
+mov byte [ecx + ebx*8 + 4], al
+jmp short loc_0001eced ; jmp 0x1eced
+
+loc_0001ecde:
+mov ecx, dword [ebp + 0xc]
+and eax, 0xfffffff7
+mov byte [ecx + ebx*8 + 3], 0
+mov byte [ecx + ebx*8 + 4], al
+
+loc_0001eced:
+inc ebx
+jmp near loc_0001ec28 ; jmp 0x1ec28
+
+loc_0001ecf3:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001ecfb:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+push 0x15
+call fcn_00019db6 ; call 0x19db6
+add esp, 0x10
+mov edi, eax
+test eax, eax
+jne short loc_0001ed2b ; jne 0x1ed2b
+call fcn_00015480 ; call 0x15480
+test al, al
+je near loc_0001edab ; je 0x1edab
+push eax
+push ref_00026a09 ; push 0x26a09
+push 0x34
+jmp short loc_0001ed9e ; jmp 0x1ed9e
+
+loc_0001ed2b:
+sub esp, 0xc
+push 0xc
+call fcn_00019db6 ; call 0x19db6
+add esp, 0x10
+mov dword [ebp - 0x1c], eax
+test eax, eax
+jne short loc_0001ed52 ; jne 0x1ed52
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001edab ; je 0x1edab
+push eax
+push ref_00026a4b ; push 0x26a4b
+push 0x3a
+jmp short loc_0001ed9e ; jmp 0x1ed9e
+
+loc_0001ed52:
+sub esp, 0xc
+push 5
+call fcn_00019db6 ; call 0x19db6
+add esp, 0x10
+test eax, eax
+jne short loc_0001ed76 ; jne 0x1ed76
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001edab ; je 0x1edab
+push edi
+push ref_00026a74 ; push 0x26a74
+push 0x40
+jmp short loc_0001ed9e ; jmp 0x1ed9e
+
+loc_0001ed76:
+sub esp, 0xc
+push 0xc
+mov dword [ebp - 0x20], eax
+call fcn_00019db6 ; call 0x19db6
+add esp, 0x10
+mov edx, dword [ebp - 0x20]
+test eax, eax
+jne short loc_0001edb5 ; jne 0x1edb5
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001edab ; je 0x1edab
+push esi
+push ref_00026a8e ; push 0x26a8e
+push 0x46
+
+loc_0001ed9e:
+push ref_00026a2e ; push 0x26a2e
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001edab:
+mov edx, 0x80000009
+jmp near loc_0001ef81 ; jmp 0x1ef81
+
+loc_0001edb5:
+sub esp, 0xc
+push 0x1d
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x24], eax
+call fcn_00019db6 ; call 0x19db6
+add esp, 0x10
+mov edx, dword [ebp - 0x20]
+mov ecx, dword [ebp - 0x24]
+test eax, eax
+mov ebx, eax
+jne short loc_0001ede7 ; jne 0x1ede7
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001edab ; je 0x1edab
+push ebx
+push ref_00026aad ; push 0x26aad
+push 0x4c
+jmp short loc_0001ed9e ; jmp 0x1ed9e
+
+loc_0001ede7:
+sub esp, 0xc
+push 0x13
+mov dword [ebp - 0x24], ecx
+mov dword [ebp - 0x20], edx
+call fcn_00019db6 ; call 0x19db6
+add esp, 0x10
+mov edx, dword [ebp - 0x20]
+mov ecx, dword [ebp - 0x24]
+test eax, eax
+mov esi, eax
+jne short loc_0001ee19 ; jne 0x1ee19
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001edab ; je 0x1edab
+push ecx
+push ref_000269b6 ; push 0x269b6
+push 0x52
+jmp short loc_0001ed9e ; jmp 0x1ed9e
+
+loc_0001ee19:
+mov dword [edi + 9], ecx
+mov byte [edi], 0xa
+mov dword [edi + 1], edx
+mov dword [ecx], 0
+mov eax, dword [edi + 9]
+mov dword [eax + 4], 0
+mov dword [edi + 5], ebx
+mov dword [edi + 0xd], esi
+mov dword [edi + 0x11], edi
+mov byte [edx + 3], 0x3f
+mov byte [edx + 4], 0x3f
+mov byte [edx + 2], 0
+mov byte [edx], 0x62
+mov byte [ebx + 6], 0
+mov byte [ebx + 7], 0
+mov byte [ebx + 8], 0
+mov byte [ebx + 9], 0
+mov byte [ebx + 1], 0
+mov word [ebx + 2], 0
+mov byte [ebx + 4], 0
+mov byte [ebx + 5], 0
+mov byte [ebx], 0
+mov word [ebx + 0x11], 0x200
+mov byte [ebx + 0x13], 0
+mov word [ebx + 0x14], 0
+mov byte [ebx + 0xa], 0
+mov byte [ebx + 0xb], 1
+mov byte [ebx + 0xc], 0
+mov byte [ebx + 0xd], 1
+call fcn_0001c651 ; call 0x1c651
+cmp eax, 0x40650
+jne short loc_0001eebd ; jne 0x1eebd
+
+loc_0001ee9b:
+mov byte [ebx + 0xe], 1
+call fcn_0001c651 ; call 0x1c651
+mov byte [ebx + 0x10], 0
+mov byte [ebx + 0x16], 1
+cmp eax, 0x306d0
+setne al
+lea eax, [eax + eax*4 + 0x6a]
+mov byte [ebx + 0xf], al
+jmp short loc_0001eec9 ; jmp 0x1eec9
+
+loc_0001eebd:
+call fcn_0001c651 ; call 0x1c651
+cmp eax, 0x306d0
+je short loc_0001ee9b ; je 0x1ee9b
+
+loc_0001eec9:
+mov eax, dword [ebp - 0x1c]
+sub esp, 0xc
+mov byte [ebx + 0x17], 0x14
+mov byte [ebx + 0x18], 5
+mov byte [ebx + 0x19], 1
+mov byte [ebx + 0x1a], 0
+mov byte [ebx + 0x1b], 0
+mov byte [ebx + 0x1c], 0
+mov word [esi], 0
+mov word [esi + 2], 0
+mov word [esi + 4], 0
+mov word [esi + 6], 0
+mov word [esi + 8], 0
+mov word [esi + 0xa], 0
+mov word [esi + 0xc], 0
+mov word [esi + 0xe], 0
+mov word [esi + 0x10], 0
+mov byte [esi + 0x12], 0
+mov dword [eax], 0x80000010
+mov dword [eax + 4], ref_0002928c ; mov dword [eax + 4], 0x2928c
+mov dword [eax + 8], edi
+push eax
+call fcn_0001972b ; call 0x1972b
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+mov edx, ebx
+test al, al
+je short loc_0001ef81 ; je 0x1ef81
+test ebx, ebx
+jns short loc_0001ef81 ; jns 0x1ef81
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001ef67 ; je 0x1ef67
+push edx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001ef67:
+push eax
+push ref_000206f4 ; push 0x206f4
+push 0xb3
+push ref_00026a2e ; push 0x26a2e
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+mov edx, ebx
+
+loc_0001ef81:
+lea esp, [ebp - 0xc]
+mov eax, edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001ef8b:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0xc
+push 2
+call fcn_00019db6 ; call 0x19db6
+mov esi, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001efb6 ; je 0x1efb6
+test esi, esi
+jne short loc_0001efba ; jne 0x1efba
+push esi
+push ref_00026acd ; push 0x26acd
+push 0x2d
+jmp short loc_0001efde ; jmp 0x1efde
+
+loc_0001efb6:
+test esi, esi
+je short loc_0001efeb ; je 0x1efeb
+
+loc_0001efba:
+sub esp, 0xc
+push 0xc
+call fcn_00019db6 ; call 0x19db6
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001eff2 ; je 0x1eff2
+test ebx, ebx
+jne short loc_0001eff6 ; jne 0x1eff6
+push ebx
+push ref_00026b0d ; push 0x26b0d
+push 0x33
+
+loc_0001efde:
+push ref_00026af1 ; push 0x26af1
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001efeb:
+mov ebx, 0x80000009
+jmp short loc_0001f070 ; jmp 0x1f070
+
+loc_0001eff2:
+test ebx, ebx
+je short loc_0001efeb ; je 0x1efeb
+
+loc_0001eff6:
+sub esp, 0xc
+mov dword [ebx], 0x80000010
+mov dword [ebx + 4], ref_0002920c ; mov dword [ebx + 4], 0x2920c
+mov byte [esi], 1
+mov dword [ebx + 8], esi
+push ebx
+call fcn_0001972b ; call 0x1972b
+mov ebx, eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001f056 ; je 0x1f056
+test ebx, ebx
+jns short loc_0001f056 ; jns 0x1f056
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001f041 ; je 0x1f041
+push ecx
+push ebx
+push ref_000206d3 ; push 0x206d3
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001f041:
+push edx
+push ref_000206f4 ; push 0x206f4
+push 0x4e
+push ref_00026af1 ; push 0x26af1
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f056:
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_0001f070 ; je 0x1f070
+push eax
+push eax
+push ref_00026b35 ; push 0x26b35
+push 0x40
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_0001f070:
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001f079:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 8]
+mov edi, dword [ebp + 0x10]
+test esi, esi
+je short loc_0001f0d2 ; je 0x1f0d2
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f0b8 ; je 0x1f0b8
+mov eax, ebx
+lea edx, [esi - 1]
+not eax
+cmp edx, eax
+jbe short loc_0001f0b8 ; jbe 0x1f0b8
+push eax
+push ref_00026b5b ; push 0x26b5b
+push 0x36
+push ref_00026b88 ; push 0x26b88
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f0b8:
+mov eax, edi
+movzx edi, al
+mov dword [ebp + 0x10], edi
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], ebx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_0001f1b5 ; jmp 0x1f1b5
+
+loc_0001f0d2:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001f0dc:
+push ebp
+mov ebp, esp
+pop ebp
+jmp near fcn_0001f0e5 ; jmp 0x1f0e5
+
+fcn_0001f0e5:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 8]
+mov edi, dword [ebp + 0x10]
+test esi, esi
+je near loc_0001f1ab ; je 0x1f1ab
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f121 ; je 0x1f121
+test ebx, ebx
+jne short loc_0001f121 ; jne 0x1f121
+push eax
+push ref_0002619a ; push 0x2619a
+push 0x3a
+push ref_00026bcd ; push 0x26bcd
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f121:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f14a ; je 0x1f14a
+mov eax, ebx
+lea edx, [esi - 1]
+not eax
+cmp edx, eax
+jbe short loc_0001f14a ; jbe 0x1f14a
+push ecx
+push ref_00026b5b ; push 0x26b5b
+push 0x3b
+push ref_00026bcd ; push 0x26bcd
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f14a:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f16d ; je 0x1f16d
+test bl, 3
+je short loc_0001f16d ; je 0x1f16d
+push edx
+push ref_00026c14 ; push 0x26c14
+push 0x3c
+push ref_00026bcd ; push 0x26bcd
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f16d:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f193 ; je 0x1f193
+test esi, 3
+je short loc_0001f193 ; je 0x1f193
+push eax
+push ref_00026c42 ; push 0x26c42
+push 0x3d
+push ref_00026bcd ; push 0x26bcd
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f193:
+shr esi, 2
+mov dword [ebp + 0x10], edi
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], ebx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_0001f1e0 ; jmp 0x1f1e0
+
+loc_0001f1ab:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+loc_0001f1b5:
+push edi
+mov ecx, dword [esp + 0xc]
+mov al, byte [esp + 0x10]
+mov ah, al
+shrd edx, eax, 0x10
+shld eax, edx, 0x10
+mov edx, ecx
+mov edi, dword [esp + 8]
+shr ecx, 2
+rep stosd ; rep stosd dword es:[edi], eax
+mov ecx, edx
+and ecx, 3
+rep stosb ; rep stosb byte es:[edi], al
+mov eax, dword [esp + 8]
+pop edi
+ret
+
+loc_0001f1e0:
+push edi
+mov eax, dword [esp + 0x10]
+mov edi, dword [esp + 8]
+mov ecx, dword [esp + 0xc]
+rep stosd ; rep stosd dword es:[edi], eax
+mov eax, dword [esp + 8]
+pop edi
+ret
+
+fcn_0001f1f5:
+push ebp
+mov eax, 0xfffffffe
+mov ebp, esp
+mov ecx, dword [ebp + 0x10]
+shl eax, cl
+mov ecx, dword [ebp + 0xc]
+not eax
+and eax, dword [ebp + 8]
+pop ebp
+shr eax, cl
+ret
+
+fcn_0001f20e:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f246 ; je 0x1f246
+mov ecx, dword [ebp + 0x10]
+mov eax, dword [ebp + 0x14]
+sub ecx, dword [ebp + 0xc]
+shr eax, cl
+mov edx, eax
+and edx, 1
+cmp eax, edx
+je short loc_0001f246 ; je 0x1f246
+push eax
+push ref_00026c67 ; push 0x26c67
+push 0x4d
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f246:
+mov cl, byte [ebp + 0x10]
+mov eax, 0xfffffffe
+mov edx, dword [ebp + 0x14]
+shl eax, cl
+mov cl, byte [ebp + 0xc]
+not eax
+shl edx, cl
+and eax, edx
+or eax, dword [ebp + 8]
+leave
+ret
+
+fcn_0001f261:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f299 ; je 0x1f299
+mov ecx, dword [ebp + 0x10]
+mov eax, dword [ebp + 0x14]
+sub ecx, dword [ebp + 0xc]
+shr eax, cl
+mov edx, eax
+and edx, 1
+cmp eax, edx
+je short loc_0001f299 ; je 0x1f299
+push eax
+push ref_00026ce4 ; push 0x26ce4
+push 0x77
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f299:
+mov cl, byte [ebp + 0x10]
+mov edx, 0xfffffffe
+mov eax, dword [ebp + 0x14]
+shl edx, cl
+mov cl, byte [ebp + 0xc]
+not eax
+shl eax, cl
+not eax
+or eax, edx
+and eax, dword [ebp + 8]
+leave
+ret
+
+fcn_0001f2b6:
+push ebp
+mov ebp, esp
+push ebx
+push ecx
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f2e5 ; je 0x1f2e5
+cmp dword [ebp + 0x10], 7
+jbe short loc_0001f2e5 ; jbe 0x1f2e5
+push edx
+push ref_00026d2f ; push 0x26d2f
+push 0x9b
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f2e5:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f30e ; je 0x1f30e
+mov eax, dword [ebp + 0x10]
+cmp dword [ebp + 0xc], eax
+jbe short loc_0001f30e ; jbe 0x1f30e
+push eax
+push ref_00025b30 ; push 0x25b30
+push 0x9c
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f30e:
+mov cl, byte [ebp + 0x10]
+mov eax, 0xfffffffe
+movzx ebx, bl
+shl eax, cl
+mov cl, byte [ebp + 0xc]
+not eax
+and eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+shr eax, cl
+ret
+
+fcn_0001f329:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f361 ; je 0x1f361
+cmp ebx, 7
+jbe short loc_0001f361 ; jbe 0x1f361
+push edx
+push ref_00026d2f ; push 0x26d2f
+push 0xe6
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f361:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f387 ; je 0x1f387
+cmp dword [ebp + 0xc], ebx
+jbe short loc_0001f387 ; jbe 0x1f387
+push eax
+push ref_00025b30 ; push 0x25b30
+push 0xe7
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f387:
+mov eax, edi
+movzx edi, al
+mov eax, esi
+push edi
+movzx esi, al
+push ebx
+push dword [ebp + 0xc]
+push esi
+call fcn_0001f20e ; call 0x1f20e
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001f3a4:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f3dc ; je 0x1f3dc
+cmp ebx, 7
+jbe short loc_0001f3dc ; jbe 0x1f3dc
+push edx
+push ref_00026d2f ; push 0x26d2f
+push 0x10c
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f3dc:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f402 ; je 0x1f402
+cmp dword [ebp + 0xc], ebx
+jbe short loc_0001f402 ; jbe 0x1f402
+push eax
+push ref_00025b30 ; push 0x25b30
+push 0x10d
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f402:
+mov eax, edi
+movzx edi, al
+mov eax, esi
+push edi
+movzx esi, al
+push ebx
+push dword [ebp + 0xc]
+push esi
+call fcn_0001f261 ; call 0x1f261
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001f41f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x18]
+mov dword [ebp - 0x20], eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f463 ; je 0x1f463
+cmp ebx, 7
+jbe short loc_0001f463 ; jbe 0x1f463
+push edx
+push ref_00026d2f ; push 0x26d2f
+push 0x136
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f463:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f488 ; je 0x1f488
+cmp esi, ebx
+jbe short loc_0001f488 ; jbe 0x1f488
+push eax
+push ref_00025b30 ; push 0x25b30
+push 0x137
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f488:
+mov eax, edi
+movzx edi, al
+movzx eax, byte [ebp - 0x1c]
+push edi
+push ebx
+push esi
+push eax
+call fcn_0001f3a4 ; call 0x1f3a4
+movzx edx, byte [ebp - 0x20]
+add esp, 0x10
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 0x14], edx
+movzx eax, al
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001f329 ; jmp 0x1f329
+
+fcn_0001f4bc:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f4f4 ; je 0x1f4f4
+cmp ebx, 7
+jbe short loc_0001f4f4 ; jbe 0x1f4f4
+push edx
+push ref_00026d2f ; push 0x26d2f
+push 0xc0
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f4f4:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f51a ; je 0x1f51a
+cmp dword [ebp + 0xc], ebx
+jbe short loc_0001f51a ; jbe 0x1f51a
+push eax
+push ref_00025b30 ; push 0x25b30
+push 0xc1
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f51a:
+mov eax, edi
+sub esp, 0xc
+movzx edi, al
+mov eax, esi
+push edi
+movzx esi, al
+push 0
+push ebx
+push dword [ebp + 0xc]
+push esi
+call fcn_0001f41f ; call 0x1f41f
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001f53c:
+push ebp
+mov ebp, esp
+push ebx
+push ecx
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f56b ; je 0x1f56b
+cmp dword [ebp + 0x10], 0xf
+jbe short loc_0001f56b ; jbe 0x1f56b
+push edx
+push ref_00026d3a ; push 0x26d3a
+push 0x15b
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f56b:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f594 ; je 0x1f594
+mov eax, dword [ebp + 0x10]
+cmp dword [ebp + 0xc], eax
+jbe short loc_0001f594 ; jbe 0x1f594
+push eax
+push ref_00025b30 ; push 0x25b30
+push 0x15c
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f594:
+mov cl, byte [ebp + 0x10]
+mov eax, 0xfffffffe
+movzx ebx, bx
+shl eax, cl
+mov cl, byte [ebp + 0xc]
+not eax
+and eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+shr eax, cl
+ret
+
+fcn_0001f5af:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f5e7 ; je 0x1f5e7
+cmp ebx, 0xf
+jbe short loc_0001f5e7 ; jbe 0x1f5e7
+push edx
+push ref_00026d3a ; push 0x26d3a
+push 0x1a6
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f5e7:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f60d ; je 0x1f60d
+cmp dword [ebp + 0xc], ebx
+jbe short loc_0001f60d ; jbe 0x1f60d
+push eax
+push ref_00025b30 ; push 0x25b30
+push 0x1a7
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f60d:
+movzx edi, di
+movzx esi, si
+push edi
+push ebx
+push dword [ebp + 0xc]
+push esi
+call fcn_0001f20e ; call 0x1f20e
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001f626:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f65e ; je 0x1f65e
+cmp ebx, 0xf
+jbe short loc_0001f65e ; jbe 0x1f65e
+push edx
+push ref_00026d3a ; push 0x26d3a
+push 0x1cc
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f65e:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f684 ; je 0x1f684
+cmp dword [ebp + 0xc], ebx
+jbe short loc_0001f684 ; jbe 0x1f684
+push eax
+push ref_00025b30 ; push 0x25b30
+push 0x1cd
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f684:
+movzx edi, di
+movzx esi, si
+push edi
+push ebx
+push dword [ebp + 0xc]
+push esi
+call fcn_0001f261 ; call 0x1f261
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001f69d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x18]
+mov dword [ebp - 0x20], eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f6e1 ; je 0x1f6e1
+cmp ebx, 0xf
+jbe short loc_0001f6e1 ; jbe 0x1f6e1
+push edx
+push ref_00026d3a ; push 0x26d3a
+push 0x1f6
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f6e1:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f706 ; je 0x1f706
+cmp esi, ebx
+jbe short loc_0001f706 ; jbe 0x1f706
+push eax
+push ref_00025b30 ; push 0x25b30
+push 0x1f7
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f706:
+movzx eax, word [ebp - 0x1c]
+movzx edi, di
+push edi
+push ebx
+push esi
+push eax
+call fcn_0001f626 ; call 0x1f626
+movzx edx, word [ebp - 0x20]
+add esp, 0x10
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 0x14], edx
+movzx eax, ax
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001f5af ; jmp 0x1f5af
+
+fcn_0001f738:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f770 ; je 0x1f770
+cmp ebx, 0xf
+jbe short loc_0001f770 ; jbe 0x1f770
+push edx
+push ref_00026d3a ; push 0x26d3a
+push 0x180
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f770:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f796 ; je 0x1f796
+cmp dword [ebp + 0xc], ebx
+jbe short loc_0001f796 ; jbe 0x1f796
+push eax
+push ref_00025b30 ; push 0x25b30
+push 0x181
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f796:
+sub esp, 0xc
+movzx edi, di
+push edi
+movzx esi, si
+push 0
+push ebx
+push dword [ebp + 0xc]
+push esi
+call fcn_0001f69d ; call 0x1f69d
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001f7b4:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f7e1 ; je 0x1f7e1
+cmp dword [ebp + 0x10], 0x1f
+jbe short loc_0001f7e1 ; jbe 0x1f7e1
+push edx
+push ref_00026d46 ; push 0x26d46
+push 0x21b
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f7e1:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f80a ; je 0x1f80a
+mov eax, dword [ebp + 0x10]
+cmp dword [ebp + 0xc], eax
+jbe short loc_0001f80a ; jbe 0x1f80a
+push eax
+push ref_00025b30 ; push 0x25b30
+push 0x21c
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f80a:
+mov cl, byte [ebp + 0x10]
+mov eax, 0xfffffffe
+shl eax, cl
+mov cl, byte [ebp + 0xc]
+not eax
+and eax, dword [ebp + 8]
+leave
+shr eax, cl
+ret
+
+fcn_0001f820:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+mov dword [ebp - 0x1c], eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f85e ; je 0x1f85e
+cmp ebx, 0x1f
+jbe short loc_0001f85e ; jbe 0x1f85e
+push edx
+push ref_00026d46 ; push 0x26d46
+push 0x266
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f85e:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f883 ; je 0x1f883
+cmp esi, ebx
+jbe short loc_0001f883 ; jbe 0x1f883
+push eax
+push ref_00025b30 ; push 0x25b30
+push 0x267
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f883:
+mov eax, dword [ebp - 0x1c]
+mov dword [ebp + 0x14], edi
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001f20e ; jmp 0x1f20e
+
+fcn_0001f89e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+mov dword [ebp - 0x1c], eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f8dc ; je 0x1f8dc
+cmp ebx, 0x1f
+jbe short loc_0001f8dc ; jbe 0x1f8dc
+push edx
+push ref_00026d46 ; push 0x26d46
+push 0x28c
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f8dc:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f901 ; je 0x1f901
+cmp esi, ebx
+jbe short loc_0001f901 ; jbe 0x1f901
+push eax
+push ref_00025b30 ; push 0x25b30
+push 0x28d
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f901:
+mov eax, dword [ebp - 0x1c]
+mov dword [ebp + 0x14], edi
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001f261 ; jmp 0x1f261
+
+fcn_0001f91c:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x18]
+mov dword [ebp - 0x20], eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f960 ; je 0x1f960
+cmp ebx, 0x1f
+jbe short loc_0001f960 ; jbe 0x1f960
+push edx
+push ref_00026d46 ; push 0x26d46
+push 0x2b6
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f960:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f985 ; je 0x1f985
+cmp esi, ebx
+jbe short loc_0001f985 ; jbe 0x1f985
+push eax
+push ref_00025b30 ; push 0x25b30
+push 0x2b7
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f985:
+push edi
+push ebx
+push esi
+push dword [ebp - 0x1c]
+call fcn_0001f89e ; call 0x1f89e
+mov edx, dword [ebp - 0x20]
+add esp, 0x10
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 0x14], edx
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001f820 ; jmp 0x1f820
+
+fcn_0001f9ae:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001f9df ; je 0x1f9df
+cmp ebx, 0x1f
+jbe short loc_0001f9df ; jbe 0x1f9df
+push edx
+push ref_00026d46 ; push 0x26d46
+push 0x240
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001f9df:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001fa04 ; je 0x1fa04
+cmp esi, ebx
+jbe short loc_0001fa04 ; jbe 0x1fa04
+push eax
+push ref_00025b30 ; push 0x25b30
+push 0x241
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001fa04:
+sub esp, 0xc
+push dword [ebp + 0x14]
+push 0
+push ebx
+push esi
+push dword [ebp + 8]
+call fcn_0001f91c ; call 0x1f91c
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001fa1d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0xc]
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0x14]
+mov dword [ebp - 0x1c], eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001fa5b ; je 0x1fa5b
+cmp ebx, 0x3f
+jbe short loc_0001fa5b ; jbe 0x1fa5b
+push ecx
+push ref_00026d52 ; push 0x26d52
+push 0x2db
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001fa5b:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001fa80 ; je 0x1fa80
+cmp esi, ebx
+jbe short loc_0001fa80 ; jbe 0x1fa80
+push edx
+push ref_00025b30 ; push 0x25b30
+push 0x2dc
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001fa80:
+push eax
+push ebx
+push 0xffffffffffffffff
+push 0xfffffffffffffffe
+call fcn_0001fdda ; call 0x1fdda
+add esp, 0x10
+mov dword [ebp + 0x10], esi
+not edx
+not eax
+and edx, dword [ebp - 0x1c]
+and eax, edi
+mov dword [ebp + 8], eax
+mov dword [ebp + 0xc], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001724f ; jmp 0x1724f
+
+fcn_0001faac:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0x18]
+mov edi, dword [ebp + 0x1c]
+mov dword [ebp - 0x20], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x24], eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001faee ; je 0x1faee
+cmp dword [ebp + 0x14], 0x3f
+jbe short loc_0001faee ; jbe 0x1faee
+push eax
+push ref_00026d52 ; push 0x26d52
+push 0x329
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001faee:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001fb17 ; je 0x1fb17
+mov eax, dword [ebp + 0x14]
+cmp dword [ebp + 0x10], eax
+jbe short loc_0001fb17 ; jbe 0x1fb17
+push ebx
+push ref_00025b30 ; push 0x25b30
+push 0x32a
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001fb17:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001fb6a ; je 0x1fb6a
+mov ebx, dword [ebp + 0x14]
+sub ebx, dword [ebp + 0x10]
+push ecx
+push ebx
+push edi
+push esi
+call fcn_0001724f ; call 0x1724f
+add esp, 0xc
+push ebx
+push edi
+push esi
+mov dword [ebp - 0x1c], eax
+mov dword [ebp - 0x28], edx
+call fcn_0001724f ; call 0x1724f
+mov ecx, dword [ebp - 0x28]
+add esp, 0x10
+and eax, 1
+test ecx, ecx
+jne short loc_0001fb52 ; jne 0x1fb52
+cmp dword [ebp - 0x1c], eax
+je short loc_0001fb6a ; je 0x1fb6a
+
+loc_0001fb52:
+push edx
+push ref_00026d5e ; push 0x26d5e
+push 0x331
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001fb6a:
+push eax
+push dword [ebp + 0x10]
+push edi
+push esi
+call fcn_0001fdda ; call 0x1fdda
+add esp, 0xc
+push dword [ebp + 0x14]
+push 0xffffffffffffffff
+push 0xfffffffffffffffe
+mov esi, eax
+mov ebx, edx
+call fcn_0001fdda ; call 0x1fdda
+not eax
+not edx
+and eax, esi
+and edx, ebx
+or eax, dword [ebp - 0x20]
+or edx, dword [ebp - 0x24]
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001fb9e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0x18]
+mov edi, dword [ebp + 0x1c]
+mov dword [ebp - 0x20], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x24], eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001fbe0 ; je 0x1fbe0
+cmp dword [ebp + 0x14], 0x3f
+jbe short loc_0001fbe0 ; jbe 0x1fbe0
+push eax
+push ref_00026d52 ; push 0x26d52
+push 0x35d
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001fbe0:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001fc09 ; je 0x1fc09
+mov eax, dword [ebp + 0x14]
+cmp dword [ebp + 0x10], eax
+jbe short loc_0001fc09 ; jbe 0x1fc09
+push ebx
+push ref_00025b30 ; push 0x25b30
+push 0x35e
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001fc09:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001fc5c ; je 0x1fc5c
+mov ebx, dword [ebp + 0x14]
+sub ebx, dword [ebp + 0x10]
+push ecx
+push ebx
+push edi
+push esi
+call fcn_0001724f ; call 0x1724f
+add esp, 0xc
+push ebx
+push edi
+push esi
+mov dword [ebp - 0x1c], eax
+mov dword [ebp - 0x28], edx
+call fcn_0001724f ; call 0x1724f
+mov ecx, dword [ebp - 0x28]
+add esp, 0x10
+and eax, 1
+test ecx, ecx
+jne short loc_0001fc44 ; jne 0x1fc44
+cmp dword [ebp - 0x1c], eax
+je short loc_0001fc5c ; je 0x1fc5c
+
+loc_0001fc44:
+push edx
+push ref_00026db3 ; push 0x26db3
+push 0x365
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001fc5c:
+push eax
+mov ecx, esi
+push dword [ebp + 0x10]
+not edi
+not ecx
+push edi
+push ecx
+call fcn_0001fdda ; call 0x1fdda
+add esp, 0xc
+push dword [ebp + 0x14]
+push 0xffffffffffffffff
+push 0xfffffffffffffffe
+mov esi, eax
+mov ebx, edx
+call fcn_0001fdda ; call 0x1fdda
+not ebx
+mov ecx, eax
+or ebx, edx
+mov eax, esi
+and ebx, dword [ebp - 0x24]
+not eax
+or eax, ecx
+and eax, dword [ebp - 0x20]
+lea esp, [ebp - 0xc]
+mov edx, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001fc9c:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x2c
+mov eax, dword [ebp + 8]
+mov edx, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x14]
+mov esi, dword [ebp + 0x20]
+mov dword [ebp - 0x28], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp - 0x24], edx
+mov edx, dword [ebp + 0x1c]
+mov edi, dword [ebp + 0x24]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x18]
+mov dword [ebp - 0x2c], edx
+mov dword [ebp - 0x30], eax
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001fcf2 ; je 0x1fcf2
+cmp ebx, 0x3f
+jbe short loc_0001fcf2 ; jbe 0x1fcf2
+push ecx
+push ref_00026d52 ; push 0x26d52
+push 0x392
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001fcf2:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001fd18 ; je 0x1fd18
+cmp dword [ebp - 0x1c], ebx
+jbe short loc_0001fd18 ; jbe 0x1fd18
+push edx
+push ref_00025b30 ; push 0x25b30
+push 0x393
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001fd18:
+push eax
+push eax
+push dword [ebp - 0x2c]
+push dword [ebp - 0x30]
+push ebx
+push dword [ebp - 0x1c]
+push dword [ebp - 0x24]
+push dword [ebp - 0x28]
+call fcn_0001fb9e ; call 0x1fb9e
+mov ecx, dword [ebp - 0x1c]
+add esp, 0x20
+mov dword [ebp + 0x18], esi
+mov dword [ebp + 0x1c], edi
+mov dword [ebp + 0x14], ebx
+mov dword [ebp + 0x10], ecx
+mov dword [ebp + 8], eax
+mov dword [ebp + 0xc], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001faac ; jmp 0x1faac
+
+fcn_0001fd53:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov edx, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x14]
+mov esi, dword [ebp + 0x18]
+mov dword [ebp - 0x20], eax
+mov edi, dword [ebp + 0x1c]
+mov dword [ebp - 0x1c], edx
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001fd97 ; je 0x1fd97
+cmp ebx, 0x3f
+jbe short loc_0001fd97 ; jbe 0x1fd97
+push edx
+push ref_00026d52 ; push 0x26d52
+push 0x300
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001fd97:
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001fdbd ; je 0x1fdbd
+cmp dword [ebp + 0x10], ebx
+jbe short loc_0001fdbd ; jbe 0x1fdbd
+push eax
+push ref_00025b30 ; push 0x25b30
+push 0x301
+push ref_00026cb0 ; push 0x26cb0
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001fdbd:
+push edi
+push esi
+push 0
+push 0
+push ebx
+push dword [ebp + 0x10]
+push dword [ebp - 0x1c]
+push dword [ebp - 0x20]
+call fcn_0001fc9c ; call 0x1fc9c
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001fdda:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001fe0f ; je 0x1fe0f
+cmp ebx, 0x3f
+jbe short loc_0001fe0f ; jbe 0x1fe0f
+push eax
+push ref_000259b8 ; push 0x259b8
+push 0x27
+push ref_00026e0a ; push 0x26e0a
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001fe0f:
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 8], esi
+mov dword [ebp + 0xc], edi
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_0001ff76 ; jmp 0x1ff76
+
+fcn_0001fe24:
+push ebp
+mov ebp, esp
+pop ebp
+jmp near loc_0001fe90 ; jmp 0x1fe90
+
+fcn_0001fe2d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov edx, dword [ebp + 0xc]
+mov esi, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0x14]
+mov dword [ebp - 0x20], eax
+mov edi, dword [ebp + 0x18]
+mov dword [ebp - 0x1c], edx
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0001fe6f ; je 0x1fe6f
+mov eax, ebx
+or eax, esi
+jne short loc_0001fe6f ; jne 0x1fe6f
+push eax
+push ref_00025a2d ; push 0x25a2d
+push 0x2f
+push ref_00026e3f ; push 0x26e3f
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001fe6f:
+mov eax, dword [ebp - 0x20]
+mov edx, dword [ebp - 0x1c]
+mov dword [ebp + 0x18], edi
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0x14], ebx
+mov dword [ebp + 8], eax
+mov dword [ebp + 0xc], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_0001fea2 ; jmp 0x1fea2
+
+loc_0001fe90:
+mov ecx, dword [esp + 0xc]
+mov eax, ecx
+imul ecx, dword [esp + 8]
+mul dword [esp + 4]
+add edx, ecx
+ret
+
+loc_0001fea2:
+mov ecx, dword [esp + 0x10]
+test ecx, ecx
+jne short loc_0001febd ; jne 0x1febd
+mov ecx, dword [esp + 0x14]
+jecxz loc_0001feb8 ; jecxz 0x1feb8
+and dword [ecx + 4], 0
+mov dword [esp + 0x10], ecx
+
+loc_0001feb8:
+jmp near loc_00017581 ; jmp 0x17581
+
+loc_0001febd:
+push ebx
+push esi
+push edi
+mov edx, dword [esp + 0x14]
+mov eax, dword [esp + 0x10]
+mov edi, edx
+mov esi, eax
+mov ebx, dword [esp + 0x18]
+
+loc_0001fed0:
+shr edx, 1
+rcr eax, 1
+shrd ebx, ecx, 1
+shr ecx, 1
+jne short loc_0001fed0 ; jne 0x1fed0
+div ebx
+mov ebx, eax
+mov ecx, dword [esp + 0x1c]
+mul dword [esp + 0x18]
+imul ecx, ebx
+add edx, ecx
+mov ecx, dword [esp + 0x20]
+jb short loc_0001fefd ; jb 0x1fefd
+cmp edi, edx
+ja short loc_0001ff08 ; ja 0x1ff08
+jb short loc_0001fefd ; jb 0x1fefd
+cmp esi, eax
+jae short loc_0001ff08 ; jae 0x1ff08
+
+loc_0001fefd:
+dec ebx
+jecxz loc_0001ff13 ; jecxz 0x1ff13
+sub eax, dword [esp + 0x18]
+sbb edx, dword [esp + 0x1c]
+
+loc_0001ff08:
+jecxz loc_0001ff13 ; jecxz 0x1ff13
+sub esi, eax
+sbb edi, edx
+mov dword [ecx], esi
+mov dword [ecx + 4], edi
+
+loc_0001ff13:
+mov eax, ebx
+xor edx, edx
+pop edi
+pop esi
+pop ebx
+ret
+
+fcn_0001ff1b:
+push ebx
+
+fcn_0001ff1c:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0xc]
+cpuid
+push ecx
+mov ecx, dword [ebp + 0x10]
+jecxz loc_0001ff2c ; jecxz 0x1ff2c
+mov dword [ecx], eax
+
+loc_0001ff2c:
+mov ecx, dword [ebp + 0x14]
+jecxz loc_0001ff33 ; jecxz 0x1ff33
+mov dword [ecx], ebx
+
+loc_0001ff33:
+mov ecx, dword [ebp + 0x18]
+jecxz loc_0001ff3a ; jecxz 0x1ff3a
+pop dword [ecx]
+
+loc_0001ff3a:
+mov ecx, dword [ebp + 0x1c]
+jecxz loc_0001ff41 ; jecxz 0x1ff41
+mov dword [ecx], edx
+
+loc_0001ff41:
+mov eax, dword [ebp + 0xc]
+leave
+pop ebx
+ret
+
+fcn_0001ff47:
+push ebx
+
+fcn_0001ff48:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0x10]
+cpuid
+push ecx
+mov ecx, dword [ebp + 0x14]
+jecxz loc_0001ff5b ; jecxz 0x1ff5b
+mov dword [ecx], eax
+
+loc_0001ff5b:
+mov ecx, dword [ebp + 0x18]
+jecxz loc_0001ff62 ; jecxz 0x1ff62
+mov dword [ecx], ebx
+
+loc_0001ff62:
+mov ecx, dword [ebp + 0x20]
+jecxz loc_0001ff69 ; jecxz 0x1ff69
+mov dword [ecx], edx
+
+loc_0001ff69:
+mov ecx, dword [ebp + 0x1c]
+jecxz loc_0001ff70 ; jecxz 0x1ff70
+pop dword [ecx]
+
+loc_0001ff70:
+mov eax, dword [ebp + 0xc]
+leave
+pop ebx
+ret
+
+loc_0001ff76:
+mov cl, byte [esp + 0xc]
+xor eax, eax
+mov edx, dword [esp + 4]
+test cl, 0x20
+cmove eax, edx
+cmove edx, dword [esp + 8]
+shld edx, eax, cl
+shl eax, cl
+ret
+
+fcn_0001ff91:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 8
+mov ebx, dword [ebp + 8]
+mov dword [ebx], 0x53524549
+mov dword [ebx + 4], 0
+mov dword [ebx + 8], fcn_000200f7 ; mov dword [ebx + 8], 0x200f7
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a ; call 0x16c9a
+mov dword [ebx + 0x10], eax
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e ; call 0x17e4e
+and eax, 0xffffc000
+mov dword [ebx + 0xc], eax
+call fcn_00015480 ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001fff9 ; je 0x1fff9
+cmp dword [ebx + 0xc], 0
+jne short loc_0001fff9 ; jne 0x1fff9
+push eax
+push ref_00026e7d ; push 0x26e7d
+push 0x39
+push ref_00026ea6 ; push 0x26ea6
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+
+loc_0001fff9:
+xor eax, eax
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00020000:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+push esi
+mov esi, 1
+push ebx
+sub esp, 0xc
+add eax, 2
+push eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+movzx ebx, ax
+mov eax, ebx
+and eax, 0xfffffffd
+cmp ax, 0x8c44
+je near loc_000200ee ; je 0x200ee
+lea eax, [ebx + 0x73b2]
+cmp ax, 2
+jbe near loc_000200ee ; jbe 0x200ee
+lea eax, [ebx + 0x73b7]
+cmp ax, 3
+jbe near loc_000200ee ; jbe 0x200ee
+lea eax, [ebx + 0x73bf]
+cmp ax, 1
+jbe near loc_000200ee ; jbe 0x200ee
+cmp bx, 0x8c58
+je near loc_000200ee ; je 0x200ee
+mov eax, ebx
+and eax, 0xfffffffb
+cmp ax, 0x8c52
+je short loc_000200e9 ; je 0x200e9
+mov eax, ebx
+and eax, 0xfffffff7
+cmp ax, 0x8c54
+je short loc_000200e9 ; je 0x200e9
+lea eax, [ebx + 0x733f]
+cmp ax, 5
+jbe short loc_000200ee ; jbe 0x200ee
+lea eax, [ebx + 0x63bf]
+mov si, 2
+cmp ax, 6
+jbe short loc_000200ee ; jbe 0x200ee
+lea eax, [ebx + 0x633f]
+cmp ax, 0xa
+jbe short loc_000200ee ; jbe 0x200ee
+call fcn_00015479 ; call 0x15479
+test al, al
+je short loc_000200c4 ; je 0x200c4
+push edx
+push ebx
+push ref_000264fe ; push 0x264fe
+push 0x80000000
+call fcn_00015487 ; call 0x15487
+add esp, 0x10
+
+loc_000200c4:
+call fcn_00015480 ; call 0x15480
+mov esi, 3
+test al, al
+je short loc_000200ee ; je 0x200ee
+push eax
+push ref_00022281 ; push 0x22281
+push 0x57
+push ref_00026ea6 ; push 0x26ea6
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+jmp short loc_000200ee ; jmp 0x200ee
+
+loc_000200e9:
+mov esi, 1
+
+loc_000200ee:
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_000200f7:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov ebx, dword [ebp + 8]
+call fcn_00015480 ; call 0x15480
+test al, al
+je short loc_0002012c ; je 0x2012c
+cmp dword [ebx - 8], 0x53524549
+je short loc_0002012c ; je 0x2012c
+push eax
+push ref_000262c8 ; push 0x262c8
+push 0x79
+push ref_00026ea6 ; push 0x26ea6
+call fcn_0001548c ; call 0x1548c
+add esp, 0x10
+jmp short loc_0002012f ; jmp 0x2012f
+
+loc_0002012c:
+sub ebx, 8
+
+loc_0002012f:
+mov esi, dword [ebx + 0x10]
+sub esp, 0xc
+push esi
+call fcn_00020000 ; call 0x20000
+mov edi, eax
+mov eax, dword [ebx + 0xc]
+mov dword [ebp - 0x1c], eax
+lea eax, [esi + 0x40]
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+mov ebx, eax
+lea eax, [esi + 0x48]
+mov dword [esp], eax
+call fcn_00017dc2 ; call 0x17dc2
+add esp, 0x10
+cmp dword [ebp + 0xc], 5
+ja near loc_00020388 ; ja 0x20388
+mov edx, dword [ebp + 0xc]
+jmp dword [edx*4 + ref_00020670] ; ujmp: jmp dword [edx*4 + 0x20670]
+
+loc_00020172:
+push eax
+mov esi, 4
+push eax
+push 0
+push 0xcf9
+call fcn_00018eea ; call 0x18eea
+add esp, 0x10
+jmp near loc_0002034f ; jmp 0x2034f
+
+loc_0002018d:
+push eax
+mov esi, 6
+push eax
+push 2
+push 0xcf9
+call fcn_00018eea ; call 0x18eea
+add esp, 0x10
+jmp near loc_0002034f ; jmp 0x2034f
+
+loc_000201a8:
+push eax
+add esi, 0x44
+push eax
+and ebx, 0xfffffffc
+push 0x80
+movzx ebx, bx
+push esi
+call fcn_00018730 ; call 0x18730
+add esp, 0x10
+cmp edi, 2
+jne short loc_000201d8 ; jne 0x201d8
+push eax
+push eax
+push 0
+lea eax, [ebx + 0x9c]
+push eax
+call fcn_00018f97 ; call 0x18f97
+jmp short loc_000201f5 ; jmp 0x201f5
+
+loc_000201d8:
+dec edi
+jne short loc_000201f8 ; jne 0x201f8
+push ecx
+push ecx
+push 0
+lea eax, [ebx + 0x28]
+push eax
+call fcn_00018f27 ; call 0x18f27
+lea eax, [ebx + 0x2c]
+pop esi
+pop edi
+push 0
+push eax
+call fcn_00018f27 ; call 0x18f27
+
+loc_000201f5:
+add esp, 0x10
+
+loc_000201f8:
+push ecx
+push ecx
+push 0x100
+lea eax, [ebx + 0x34]
+add ebx, 4
+push eax
+call fcn_00018f27 ; call 0x18f27
+mov dword [esp], ebx
+call fcn_00018f64 ; call 0x18f64
+pop edi
+mov esi, eax
+and esi, 0xffffc3ff
+pop eax
+mov eax, esi
+or ah, 0x1c
+or esi, 0x3c00
+push eax
+push ebx
+call fcn_00018f97 ; call 0x18f97
+pop eax
+pop edx
+push esi
+push ebx
+call fcn_00018f97 ; call 0x18f97
+add esp, 0x10
+xor eax, eax
+jmp near loc_0002038d ; jmp 0x2038d
+
+loc_00020242:
+mov ebx, eax
+push edx
+and ebx, 0xfffc
+push edx
+push 0
+lea eax, [ebx + 0x60]
+push eax
+mov dword [ebp - 0x20], eax
+call fcn_00018f97 ; call 0x18f97
+pop ecx
+pop eax
+lea eax, [ebx + 0x64]
+push 0
+push eax
+call fcn_00018f97 ; call 0x18f97
+pop eax
+pop edx
+lea eax, [ebx + 0x68]
+push 0
+push eax
+call fcn_00018f97 ; call 0x18f97
+mov eax, dword [ebp + 0xc]
+add esp, 0x10
+sub eax, 4
+cmp eax, 1
+ja near loc_0002034a ; ja 0x2034a
+push ecx
+add esi, 0xac
+push ecx
+push 0x100000
+push esi
+call fcn_00018b14 ; call 0x18b14
+add esp, 0x10
+cmp dword [ebp + 0xc], 5
+jne near loc_0002034a ; jne 0x2034a
+mov eax, dword [ebp - 0x1c]
+sub esp, 0xc
+add eax, 0x332c
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test al, 3
+jne near loc_0002034a ; jne 0x2034a
+mov eax, dword [ebp - 0x1c]
+sub esp, 0xc
+add eax, 0x3330
+push eax
+call fcn_00017e4e ; call 0x17e4e
+add esp, 0x10
+test ah, 0xc0
+jne short loc_0002034a ; jne 0x2034a
+cmp edi, 1
+jne short loc_00020309 ; jne 0x20309
+push ecx
+push ecx
+push 0x40000000
+push ebx
+call fcn_00018363 ; call 0x18363
+lea eax, [ebx + 4]
+add ebx, 0xc
+pop esi
+pop edi
+push 0xbfffffff
+push eax
+call fcn_0001838d ; call 0x1838d
+pop eax
+pop edx
+push 0xbfffffff
+jmp short loc_0002032f ; jmp 0x2032f
+
+loc_00020309:
+cmp edi, 2
+jne short loc_00020338 ; jne 0x20338
+push ecx
+add ebx, 0x1f0
+push ecx
+push 1
+push ebx
+call fcn_00018363 ; call 0x18363
+pop esi
+pop edi
+push 0xfffffffffffffffb
+push ebx
+call fcn_0001838d ; call 0x1838d
+pop eax
+pop edx
+push 0x7fffffff
+
+loc_0002032f:
+push ebx
+call fcn_0001838d ; call 0x1838d
+add esp, 0x10
+
+loc_00020338:
+push edx
+push edx
+push 0x40000000
+push dword [ebp - 0x20]
+call fcn_00018363 ; call 0x18363
+add esp, 0x10
+
+loc_0002034a:
+mov esi, 0xe
+
+loc_0002034f:
+sub esp, 0xc
+push dword [ebp + 0xc]
+call fcn_0001ba36 ; call 0x1ba36
+add esp, 0x10
+mov ebx, eax
+cmp eax, 0x8000000e
+je short loc_0002036a ; je 0x2036a
+test ebx, ebx
+jne short loc_0002038d ; jne 0x2038d
+
+loc_0002036a:
+push eax
+push eax
+mov eax, esi
+movzx esi, al
+push esi
+push 0xcf9
+call fcn_00018eea ; call 0x18eea
+call fcn_00017239 ; call 0x17239
+add esp, 0x10
+mov eax, ebx
+jmp short loc_0002038d ; jmp 0x2038d
+
+loc_00020388:
+mov eax, 0x80000002
+
+loc_0002038d:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+endloc_00020395:
+db 0x66
+db 0x90
+db 0x66
+dd 0x66906690
+dd 0x90906690
+
+ref_000203a0:
+dd 0x08000100
+dd 0x01010000
+dd 0x01000004
+dd 0x00000202
+
+ref_000203b0:
+dd 0x00000100
+dd 0x00001000
+dd 0x00010101
+dd 0x01000008
+dd 0x04000202
+dd 0x00000000
+
+ref_000203c8:
+dd 0x07000301
+dd 0x0f000000
+
+ref_000203d0:
+dd loc_000094ae
+dd loc_000094b5
+dd loc_000093fa
+dd loc_00009404
+dd loc_0000940e
+dd loc_00009444
+dd loc_00009448
+dd loc_00009451
+dd loc_00009415
+dd loc_0000941c
+
+ref_000203f8:
+dd 0x00000002
+dd 0x0000000a
+dd 0x00000064
+dd 0x00000000
+
+ref_00020408:
+dd 0xea002600
+dd 0xea002400
+dd 0xea002200
+dd 0xea002000
+dd 0x00000000
+dd 0x00000000
+
+ref_00020420:
+dd 0xea002400
+dd 0xea002600
+dd 0xea000800
+dd 0xea000a00
+dd 0xea002000
+dd 0xea002200
+
+ref_00020438:
+dd 0xe9002000
+dd 0xe9002200
+dd 0xe9002400
+dd 0xe9002600
+dd 0x00000000
+dd 0x00000000
+
+ref_00020450:
+dd 0xe9001600
+dd 0xe9001400
+dd 0xe9002e00
+dd 0xe9002c00
+dd 0xe9003200
+dd 0xe9003000
+
+ref_00020468:
+dd 0x0a090605
+
+ref_0002046c:
+dd 0x13000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x11000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x0f000000
+
+ref_000204b0:
+dd 0x00000000
+dd 0x00000001
+dd 0x00000002
+dd 0x00000003
+dd 0x00000008
+dd 0x00000009
+dd 0x0000000c
+dd 0x0000000d
+dd 0x00000004
+dd 0x00000005
+dd 0x00000006
+dd 0x00000007
+dd 0x0000000a
+dd 0x0000000b
+dd 0x0000000c
+dd 0x0000000d
+
+ref_000204f0:
+db 0x1d
+
+ref_000204f1:
+db 0x00
+db 0x1a
+db 0x00
+
+ref_000204f4:
+db '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ',0x00,0x00,0x00,0x00
+
+ref_0002051c:
+dd 0x00000001
+dd 0x00000002
+dd 0x00000004
+dd 0x00000008
+dd 0x00000010
+dd 0x00000020
+dd 0x00000040
+dd 0x00000000
+
+ref_0002053c:
+db ' +-#0!^',0x00
+
+ref_00020544:
+db '0000000000000000',0x00,0x00,0x00,0x00
+
+ref_00020558:
+dd 0x20202020
+dd 0x20202020
+dd 0x20202020
+dd 0x20202020
+dd 0x90906600
+
+ref_0002056c:
+db 'CbLocatePpi',0x00
+
+ref_00020578:
+db 'CbNotifyPpi',0x00
+
+ref_00020584:
+dd 0x6e496243
+dd 0x6c617473
+dd 0x6970506c
+dd 0x90906600
+
+ref_00020594:
+dd 0x80000010
+dd ref_0002907c
+dd 0x00000000
+
+ref_000205a0:
+dd loc_0001b45b
+dd loc_0001b454
+dd loc_0001b47b
+dd loc_0001b46c
+dd loc_0001b4b6
+dd loc_0001b496
+dd loc_0001b513
+dd loc_0001b4e8
+dd loc_0001b547
+dd loc_0001b52b
+dd loc_0001b55d
+dd loc_0001b5a2
+
+ref_000205d0:
+dd loc_0001b7e6
+dd loc_0001b8ac
+dd loc_0001b730
+dd loc_0001b8ac
+dd loc_0001b714
+dd loc_0001b8ac
+dd loc_0001b80d
+dd loc_0001b7f7
+dd loc_0001b714
+dd loc_0001b858
+
+ref_000205f8:
+dd loc_0001c367
+dd loc_0001c382
+dd loc_0001c36d
+dd loc_0001c374
+dd loc_0001c37b
+
+ref_0002060c:
+dd loc_0001d0a8
+dd loc_0001d0b7
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d0d0
+dd loc_0001d0e5
+dd loc_0001d174
+dd loc_0001d180
+dd loc_0001d1a9
+dd loc_0001d1b5
+
+ref_00020660:
+dd 0x6c416243
+dd 0x61636f6c
+dd 0x6f506574
+dd 0x90006c6f
+
+ref_00020670:
+dd loc_0002018d
+dd loc_00020172
+dd loc_000201a8
+dd loc_00020242
+dd loc_00020242
+dd loc_00020242
+
+ref_00020688:
+db 'PEI: Starting...',0x0a,0x00
+
+ref_0002069a:
+db 'Initializing System Agent',0x0a,0x00
+
+ref_000206b5:
+db 'Initializing PCH',0x0a,0x00
+
+ref_000206c7:
+db 'PEI: Done.',0x0a,0x00
+
+ref_000206d3:
+db 0x0a,'ASSERT_EFI_ERROR (Status = %r)',0x0a,0x00
+
+ref_000206f4:
+db '!EFI_ERROR (Status)',0x00
+
+ref_00020708:
+db '../../intel/SystemAgent/SaInit/Pei/SaInitPeim.c',0x00
+
+ref_00020738:
+db 'Set BIOS_RESET_CPL to indicate all configurations complete',0x0a,0x00
+
+ref_00020774:
+db '[SA] Programming MSR 2E7',0x0a,0x00
+
+ref_0002078e:
+db 'SA Data HOB installed',0x0a,0x00
+
+ref_000207a5:
+db '***************** System Agent PCIe code version *****************',0x0a,0x00
+
+ref_000207e9:
+db '** Major version number is: %3d **',0x0a,0x00
+
+ref_0002082d:
+db '** Minor version number is: %3d **',0x0a,0x00
+
+ref_00020871:
+db '** Rev version number is: %3d **',0x0a,0x00
+
+ref_000208b5:
+db '** Build number is: %3d **',0x0a,0x00
+
+ref_000208f9:
+db '******************************************************************',0x0a,0x00
+
+ref_0002093d:
+db 'Programming SA Bars',0x0a,0x00
+
+ref_00020952:
+db 'Reporting SA PCIe code version',0x0a,0x00
+
+ref_00020972:
+db 'Initializing DMI',0x0a,0x00
+
+ref_00020984:
+db 'Initializing SA PCIe',0x0a,0x00
+
+ref_0002099a:
+db 'Initializing Graphics',0x0a,0x00
+
+ref_000209b1:
+db 'Initializing System Agent Overclocking',0x0a,0x00
+
+ref_000209d9:
+db 'Initializing DMI Tc/Vc mapping',0x0a,0x00
+
+ref_000209f9:
+db 'Early BIOS POST Programming',0x0a,0x00
+
+ref_00020a16:
+db '[SA] BootMode = %X',0x0a,0x00
+
+ref_00020a2a:
+db '[SA] Install SA S3 Notify callback',0x0a,0x00
+
+ref_00020a4e:
+db '[SA] Install Notify callback for Rapid Start Resume',0x0a,0x00
+
+ref_00020a83:
+db '(OC) Overclocking is disabled. Bypassing SA overclocking flow.',0x0a,0x00
+
+ref_00020ac3:
+db '../../intel/SystemAgent/SaInit/Pei/SaOcInit.c',0x00
+
+ref_00020af1:
+db '(OC) Updating EDRAM ratio value = %X',0x0a,0x00
+
+ref_00020b17:
+db '(OC) Set Voltage Frequency failed. EFI Status = %X, Library Status = %X',0x0a,0x00
+
+ref_00020b60:
+db '(OC) No OC support for this Domain = %X',0x0a,0x00
+
+ref_00020b89:
+db '(OC) GetOcCapabilities message failed. Library Status = %X, Domain = %X',0x0a,0x00
+
+ref_00020bd2:
+db '../../intel/SystemAgent/SaInit/Pei/GraphicsInit.c',0x00
+
+ref_00020c04:
+db 'PCH PCIe Graphics Card enabled.',0x0a,0x00
+
+ref_00020c25:
+db 'PCIe card on PEG%x%x (%x:%x:%x) enabled as VGA.',0x0a,0x00
+
+ref_00020c56:
+db 'PEG%x%x (%x:%x:%x) ISAEN has been set.',0x0a,0x00
+
+ref_00020c7e:
+db '(StallCount != 3000)',0x00
+
+ref_00020c93:
+db 'Temporary GttMmAdr Bar is not initialized. Returning from GraphicsInit().',0x0a,0x00
+
+ref_00020cde:
+db 'GttMmAdr != 0',0x00
+
+ref_00020cec:
+db 'IGD enabled.',0x0a,0x00
+
+ref_00020cfa:
+db 'SaPlatformPolicyPpi->GtConfig->GttSize <= 3',0x00
+
+ref_00020d26:
+db 'IGD VGA Decode is disabled because it',0x27,'s not a primary display.',0x0a,0x00
+
+ref_00020d66:
+db 'Disable IGD Device.',0x0a,0x00
+
+ref_00020d7b:
+db '../../intel/SystemAgent/SaInit/Pei/SaDmiPeim.c',0x00
+
+ref_00020daa:
+db 'Can',0x27,'t locate PchPlatformPolicy PPI - exiting.',0x0a,0x00
+
+ref_00020dd9:
+db 'DMI Recipe...',0x0a,0x00
+
+ref_00020de8:
+db 'Run AdditionalDmiProgramSteps!',0x0a,0x00
+
+ref_00020e08:
+db 'DMI Gen2 is Disabled or not capable, staying at Gen1 !',0x0a,0x00
+
+ref_00020e40:
+db 'DMI Link re-train to set GEN2',0x0a,0x00
+
+ref_00020e5f:
+db 'DMI trained to x%d at Gen%d',0x0a,0x00
+
+ref_00020e7c:
+db 'PEG%x%x (%x:%x:%x) - ',0x00
+
+ref_00020e92:
+db 'Trained to x%d at Gen%d.',0x00
+
+ref_00020eab:
+db ' VC0 Negotiation Pending = %d.',0x00
+
+ref_00020eca:
+db 'PEG%x%x (%x:%x:%x) - VC0 Negotiation Pending = %x after %d msec.',0x0a,0x00
+
+ref_00020f0c:
+db '../../intel/SystemAgent/SaInit/Pei/PciExpressInit.c',0x00
+
+ref_00020f40:
+db 'Previous Link Training Fail Mask 0x%2.2X',0x0a,0x00
+
+ref_00020f6a:
+db 'New Link Training Fail Mask 0x%2.2X',0x0a,0x00
+
+ref_00020f8f:
+db ' PEG%x%x (%x:%x:%x) - skipping due to furcation',0x0a,0x00
+
+ref_00020fc0:
+db ' PEG%x%x (%x:%x:%x) - checking',0x0a,0x00
+
+ref_00020fe0:
+db ' VC negotiation is complete',0x0a,0x00
+
+ref_00020ffe:
+db 'Total Stall: %d msec',0x0a,0x00
+
+ref_00021014:
+db 'Returned PegLinkFailMask 0x%2.2X',0x0a,0x00
+
+ref_00021036:
+db 'Invalid input to ProgramPreset() function! PegFunc=%d, Lane=%d',0x0a,0x00
+
+ref_00021077:
+db '--- Sampler values before calibration ---',0x0a,0x00
+
+ref_000210a2:
+db 'ERROR: PEG dev=%d, lane=%d, sampler=%d, iteration=%d, found more than %d distinct codes!!!',0x0a,0x00
+
+ref_000210fe:
+db '--- Sampler values after calibration ---',0x0a,0x00
+
+ref_00021128:
+db 'PEG Link Status after auto speed disable:',0x0a,0x00
+
+ref_00021153:
+db 'Auto',0x0a,0x00
+
+ref_00021159:
+db 'Speed From Setup %x',0x0a,0x00
+
+ref_0002116e:
+db 'PEG%x%x (%x:%x:%x) - Max Link Speed = Gen%d',0x0a,0x00
+
+ref_0002119b:
+db 'ERROR: Attempted to reserve > %d IOTRK (Attempt = %d)! Skipping programming.',0x0a,0x00
+
+ref_000211e9:
+db 'IOTRK: Reserved = %d. Shared = %d. Total = %d.',0x0a,0x00
+
+ref_00021219:
+db 'ERROR: Attempted to reserve > %d RRTRK (Attempt = %d)! Skipping programming.',0x0a,0x00
+
+ref_00021267:
+db 'RRTRK: Reserved = %d. Shared = %d. Total = %d.',0x0a,0x00
+
+ref_00021297:
+db 'Crdtctl4 Crdtctl6 Crdtctl8 Before = %x %x %x',0x0a,0x00
+
+ref_000212c5:
+db 'PEG10: LinkDisabled = %x. Width = %x',0x0a,0x00
+
+ref_000212eb:
+db 'PEG11: LinkDisabled = %x. Width = %x',0x0a,0x00
+
+ref_00021311:
+db 'PEG12: LinkDisabled = %x. Width = %x',0x0a,0x00
+
+ref_00021337:
+db 'Crdtctl4 Crdtctl6 Crdtctl8 After = %x %x %x',0x0a,0x00
+
+ref_00021364:
+db 'VCU Busy Timeout after %d tries: MCHBAR=%8.8X. Interface=%8.8X. Data=%4.4X.',0x0a,0x00
+
+ref_000213b1:
+db 'ERROR: VCU Response Error after %d tries: MCHBAR=%8.8X. Interface=%4.4X. Data=%8.8X. ResponseCode=%4.4X',0x0a,0x00
+
+ref_0002141a:
+db 'In GetMaxBundles procedure',0x0a,0x00
+
+ref_00021436:
+db 'MaxBndlPwrdnCount = %d',0x0a,0x00
+
+ref_0002144e:
+db 'In PowerDownUnusedBundles sequence',0x0a,0x00
+
+ref_00021472:
+db 'All lanes are used. Do nothing.',0x0a,0x00
+
+ref_00021493:
+db 'PegLaneReversal is true',0x0a,0x00
+
+ref_000214ac:
+db 'BNDL_PWRDN PEG%d%d[%d:%d]',0x0a,0x00
+
+ref_000214c7:
+db 'PEG controller not detected',0x0a,0x00
+
+ref_000214e4:
+db 'PEG HW Strap value %x',0x0a,0x00
+
+ref_000214fb:
+db 'PEG Gen3 Fused off',0x0a,0x00
+
+ref_0002150f:
+db 0x0a,'Restore SA PEG DATA from previous boot: Size=%X',0x0a,0x00
+
+ref_00021541:
+db 0x0a,'PegGen3PresetSearch is disabled, Clear old Preset data',0x0a,0x00
+
+ref_0002157a:
+db 'PEG Recipe...',0x0a,0x00
+
+ref_00021589:
+db 'PEG Gen3 Equalization...',0x0a,0x00
+
+ref_000215a3:
+db 'Presence detect table...',0x0a,0x00
+
+ref_000215bd:
+db ' PEG%d%d PresenceDetect: %x. EndpointMaxLinkSpeed: %x.',0x0a,0x00
+
+ref_000215f5:
+db 'PEG SamplerCalibration...',0x0a,0x00
+
+ref_00021610:
+db 'PEG Ports Scanning starts.',0x0a,0x00
+
+ref_0002162c:
+db 'PEG%d%d - Endpoint not responding to PCI config space access, assuming negotiated width (X%d) is max width',0x0a,0x00
+
+ref_00021698:
+db 'CtrlMLW[%d]. EpMLW[%d]. UnusedLanes[%d]. BndlPwrdnCount[%d].',0x0a,0x00
+
+ref_000216d6:
+db 'BndlPwrdnCount violation! Overriding BndlPwrdnCount! '
+
+ref_0002170b:
+db 'BndlPwrdnCount[%d].',0x0a,0x00
+
+ref_00021720:
+db 'Run AdditionalPegProgramSteps on PEG%x%x!',0x0a,0x00
+
+ref_0002174b:
+db 'PEG10 '
+
+ref_00021751:
+db 'Disabled.',0x0a,0x00
+
+ref_0002175c:
+db 'PEG11 Disabled.',0x0a,0x00
+
+ref_0002176d:
+db 'PEG12 Disabled.',0x0a,0x00
+
+ref_0002177e:
+db 'Original PegLinkFailMask=%X, Final PegLinkFailMask=%X',0x0a,0x00
+
+ref_000217b5:
+db 'Setting GPIO%d to %x',0x0a,0x00
+
+ref_000217cb:
+db 'Asserting PEG slot reset.',0x0a,0x00
+
+ref_000217e6:
+db 'Deasserting PEG slot reset.',0x0a,0x00
+
+ref_00021803:
+db 'Toggling PEG slot reset.',0x0a,0x00
+
+ref_0002181d:
+db 'SECONDARY BUS RESET!',0x0a,0x00
+
+ref_00021833:
+db 'Reset Complete',0x0a,0x00
+
+ref_00021843:
+db 'PHY LAYER RESET!',0x0a,0x00
+
+ref_00021855:
+db 'Link retrain FAILED!!!',0x0a,0x00
+
+ref_0002186d:
+db 'DOWNGRADE from x%d to x%d detected',0x0a,0x00
+
+ref_00021891:
+db 'Width Recovery Successful',0x0a,0x00
+
+ref_000218ac:
+db 'Width Recovery FAILED!',0x0a,0x00
+
+ref_000218c4:
+db 'Error 0x%x.',0x0a,0x00
+
+ref_000218d1:
+db 'Success.',0x0a,0x00
+
+ref_000218db:
+db 'Link Width DOWNGRADED!',0x0a,0x00
+
+ref_000218f3:
+db 'Link Speed DOWNGRADED!',0x0a,0x00
+
+ref_0002190b:
+db 'Link speed downgrade detected',0x0a,0x00
+
+ref_0002192a:
+db 'Link width downgrade detected',0x0a,0x00
+
+ref_00021949:
+db 'DOWNGRADE from Gen %d to Gen %d detected',0x0a,0x00
+
+ref_00021973:
+db 'Link Speed Recovery FAILED!',0x0a,0x00
+
+ref_00021990:
+db 'Link Speed Recovery Successful',0x0a,0x00
+
+ref_000219b0:
+db 'DOWNGRADE, Link is not in L0',0x0a,0x00
+
+ref_000219ce:
+db '../../intel/SystemAgent/SaInit/Pei/PcieTrainingLinkRecovery.c',0x00
+
+ref_00021a0c:
+db ' PcieControllerList Array Index Out of Bounds PortInfoListLength: %x',0x0a,0x00
+
+ref_00021a53:
+db ' LaneList Array Index Out of Bounds LaneListLength%x',0x0a,0x00
+
+ref_00021a89:
+db ' PEG%x%x (%x:%x:%x) - Root Port is not Gen3-capable. Max Link Speed = %d.',0x0a,0x00
+
+ref_00021ad4:
+db ' PEG%x%x (%x:%x:%x) - Root Port is Gen3-capable.',0x0a,0x00
+
+ref_00021b06:
+db ' PEG%x%x (%x:%x:%x) - VC0 negotiation is pending! Skipping endpoint.',0x0a,0x00
+
+ref_00021b4c:
+db ' PEG%x%x (%x:%x:%x) - Endpoint is not Gen3-capable. No PCIe Capability found.',0x0a,0x00
+
+ref_00021b9b:
+db ' PEG%x%x (%x:%x:%x) - Endpoint is not Gen3-capable. Max Link Speed = %d.',0x0a,0x00
+
+ref_00021be5:
+db ' PEG%x%x (%x:%x:%x) - Endpoint is Gen3-capable',0x0a,0x00
+
+ref_00021c15:
+db '../../intel/SystemAgent/SaInit/Pei/PcieTraining.c',0x00
+
+ref_00021c47:
+db 'Invalid Margin Test Requested.',0x0a,0x00
+
+ref_00021c67:
+db 'Preset for Lane %2d: ',0x00
+
+ref_00021c7d:
+db 'Search Result: P%d',0x00
+
+ref_00021c90:
+db 'Applying Policy value: P%d'
+
+ref_00021caa:
+db '. Saving value for next boot.',0x00
+
+ref_00021cc8:
+db 'Applying Policy value: P%d',0x00
+
+ref_00021ce3:
+db 'Restoring previous value: P%d',0x00
+
+ref_00021d01:
+db 'Illegal Lane: %d',0x00
+
+ref_00021d12:
+db 'PEG Gen3 Preset Search',0x0a,0x00
+
+ref_00021d2a:
+db ' Gen3 is disabled by policy',0x0a,0x00
+
+ref_00021d47:
+db 'Lane Reversal is Disabled',0x0a,0x00
+
+ref_00021d62:
+db 'Lane Reversal is Enabled',0x0a,0x00
+
+ref_00021d7c:
+db '../../intel/SystemAgent/SaInit/Pei/PcieTrainingPhase3.c',0x00
+
+ref_00021db4:
+db 'Calling CpuReplacementCheck',0x0a,0x00
+
+ref_00021dd1:
+db ' ME reported CPU Replacement value: %x',0x0a,0x00
+
+ref_00021df9:
+db ' PEG%x%x (%x:%x:%x) - LoadedSavedPreset = %d. EndpointDeviceChanged = %d.',0x0a,0x00
+
+ref_00021e44:
+db 'Skipping Preset Search - No Gen3 capable links',0x0a,0x00
+
+ref_00021e74:
+db 'Skipping PEG%d%d - Not Gen3 capable',0x0a,0x00
+
+ref_00021e99:
+db 'Using Lane %2d',0x27,'s Best Preset for Lanes %2d-%2d.',0x0a,0x00
+
+ref_00021eca:
+db 'PEG%d%d - Not Gen3 capable, skip coefficient programming.',0x0a,0x00
+
+ref_00021f05:
+db 'PEG Gen3 Preset Search done',0x0a
+
+ref_00021f21:
+db 0x0a
+db 0x00
+
+ref_00021f23:
+db 'GetCoefficientsFromPreset(): Unsupported Preset Requested: P%d. Using P7.',0x0a,0x00
+
+ref_00021f6e:
+db 'ConfigureTxJitterMux: System unsupported, no PEG.',0x0a,0x00
+
+ref_00021fa1:
+db 'Unsupported CPU stepping!',0x0a,0x00
+
+ref_00021fbc:
+db 'TempValue >= 47',0x00
+
+ref_00021fcc:
+db '../../intel/SystemAgent/SaInit/Pei/PcieTrainingMargining.c',0x00
+
+ref_00022007:
+db 'TempValue <= 17',0x00
+
+ref_00022017:
+db 'ProgramIobp Read Error, Address:%x AndMask:%x OrMask:%x',0x0a,0x00
+
+ref_00022050:
+db '../../intel/Pch/Library/PchPlatformLib/IobpAccess.c',0x00
+
+ref_00022084:
+db 'ProgramIobp Write Error, Address:%x AndMask:%x OrMask:%x',0x0a,0x00
+
+ref_000220be:
+db '(((*LatencyValue1) & (0x00000400 + 0x00000800 + 0x00001000)) >> 10) < 6',0x00
+
+ref_00022106:
+db '../../intel/Pch/Library/PchPciExpressHelpersLib/PchPciExpressHelpersLibrary.c',0x00
+
+ref_00022154:
+db '(((LatencyValue2) & (0x00000400 + 0x00000800 + 0x00001000)) >> 10) < 6',0x00
+
+ref_0002219b:
+db 'Endpoint Device %0x Capability ASPM: %0x',0x0a,0x00
+
+ref_000221c5:
+db 'Override root port ASPM to L1 for pre-1.1 devices',0x0a,0x00
+
+ref_000221f8:
+db 'Calculate Endpoint Device %0x Aspm Value: %0x',0x0a,0x00
+
+ref_00022227:
+db 'Program Endpoint Device %0x Aspm Value: %0x',0x0a,0x00
+
+ref_00022254:
+db 'Check DownStreamBus:%d and no device found!',0x0a,0x00
+
+ref_00022281:
+db '((BOOLEAN)(0==1))',0x00
+
+ref_00022293:
+db 'PchCpuStrapSet() - Start',0x0a,0x00
+
+ref_000222ad:
+db 'PchCpuStrapSet() - End',0x0a,0x00
+
+ref_000222c5:
+db 'PchOnMemoryInstalled() Start',0x0a,0x00
+
+ref_000222e3:
+db 'PCH Installing PcieDeviceTable HOB (%d entries)',0x0a,0x00
+
+ref_00022314:
+db 'HobPtr != 0',0x00
+
+ref_00022320:
+db '../../intel/Pch/PchInit/Pei/PchInitPeim.c',0x00
+
+ref_0002234a:
+db 'Index != 0',0x00
+
+ref_00022355:
+db 'PCH Installing PchPlatformPolicy HOB (PCH bus = %d)',0x0a,0x00
+
+ref_0002238a:
+db 'Disable Azalia: initialization error in Auto mode!',0x0a,0x00
+
+ref_000223be:
+db 'PchOnMemoryInstalled() End',0x0a,0x00
+
+ref_000223da:
+db 'Gen3TxOutVoltDnAmpAdj is out of valid range ',0x0a,0x00
+
+ref_00022408:
+db 'Gen12TxOutVoltDnAmpAdj is out of valid range ',0x0a,0x00
+
+ref_00022437:
+db 'Gen3TxOutDeEmAdj is out of valid range ',0x0a,0x00
+
+ref_00022460:
+db 'Gen12TxOutDeEmAdj is out of valid range ',0x0a,0x00
+
+ref_0002248a:
+db 'PchSataInit() - Start',0x0a,0x00
+
+ref_000224a1:
+db 'Please do not enable any SATA port before SATA Hsio initialization is done.',0x0a,0x00
+
+ref_000224ef:
+db 'PchSataInit() - End',0x0a,0x00
+
+ref_00022504:
+db 'PchGbeMandatedReset: resetting the board via CF9 to unlock LAN Disable register...',0x0a,0x00
+
+ref_00022558:
+db 'PchGbeMandatedReset: resetting the board via CF9...',0x0a,0x00
+
+ref_0002258d:
+db 'isCLK 0xED00015C Read warning: %r',0x0a,0x00
+
+ref_000225b0:
+db 'isCLK 0xED000118 Read warning: %r',0x0a,0x00
+
+ref_000225d3:
+db 'isCLK 0xED000120 Read warning: %r',0x0a,0x00
+
+ref_000225f6:
+db 'PchInitialize() - Start',0x0a,0x00
+
+ref_0002260f:
+db '(PchPlatformPolicyPpi->Rcba & (UINT32) (~0xFFFFC000)) == 0',0x00
+
+ref_0002264a:
+db '(MmioRead32 (AcpiBarAddress) & 0xFFFC) == PchPlatformPolicyPpi->PmBase',0x00
+
+ref_00022691:
+db '(MmioRead32 (GpioBarAddress) & 0xFFFC) == PchPlatformPolicyPpi->GpioBase',0x00
+
+ref_000226da:
+db 'PchInitialize() - End',0x0a,0x00
+
+ref_000226f1:
+db 'PchConfigureInterruptRegister() Start',0x0a,0x00
+
+ref_00022718:
+db 'PchConfigureInterruptRegister() End',0x0a,0x00
+
+ref_0002273d:
+db 'PchEarlyInit() - Start',0x0a,0x00
+
+ref_00022755:
+db 'PchEarlyInit() - End',0x0a,0x00
+
+ref_0002276b:
+db 'InstallPchInitPpi() - Start',0x0a,0x00
+
+ref_00022788:
+db 'PCH SKU is not supported due to no proper PCH LPC found!',0x0a,0x00
+
+ref_000227c2:
+db 'Rcba needs to be programmed before here',0x0a,0x00
+
+ref_000227eb:
+db 'Failed to allocate memory for PchDmiTcVcMapPpiDesc! ',0x0a,0x00
+
+ref_00022821:
+db 'Failed to allocate memory for PchDmiTcVcMapPpi! ',0x0a,0x00
+
+ref_00022853:
+db 'InstallPchInitPpi() - End',0x0a,0x00
+
+ref_0002286e:
+db '------------------ PCH USB Config ------------------',0x0a,0x00
+
+ref_000228a4:
+db ' UsbPerPortCtl= %x',0x0a,0x00
+
+ref_000228b8:
+db ' Ehci1Usbr= %x',0x0a,0x00
+
+ref_000228c8:
+db ' Ehci2Usbr= %x',0x0a,0x00
+
+ref_000228d8:
+db ' PortSettings[%d] Enabled= %x',0x0a,0x00
+
+ref_000228f7:
+db ' PortSettings[%d] Location = %x',0x0a,0x00
+
+ref_00022918:
+db ' Port30Settings[%d] Enabled= %x',0x0a,0x00
+
+ref_00022939:
+db ' Usb20Settings[%d] Enabled= %x',0x0a,0x00
+
+ref_00022959:
+db ' Usb30Settings.Mode= %x',0x0a,0x00
+
+ref_00022972:
+db ' Usb30Settings.PreBootSupport= %x',0x0a,0x00
+
+ref_00022995:
+db ' Usb30Settings.Btcg= %x',0x0a,0x00
+
+ref_000229ae:
+db ' Usb30Settings.ManualMode= %x',0x0a,0x00
+
+ref_000229cd:
+db ' Usb30Settings.ManualModeUsb20PerPinRoute[%d]= EHCI',0x0a,0x00
+
+ref_00022a02:
+db ' Usb30Settings.ManualModeUsb20PerPinRoute[%d]= XHCI',0x0a,0x00
+
+ref_00022a37:
+db ' Usb30Settings.ManualModeUsb30PerPinEnable[%d]= %x',0x0a,0x00
+
+ref_00022a6b:
+db ' PortUsb20[%d].OverCurrentPin= OC%x',0x0a,0x00
+
+ref_00022a90:
+db ' PortUsb20[%d].Usb20EyeDiagramTuningParam1= %x',0x0a,0x00
+
+ref_00022ac0:
+db ' PortUsb20[%d].Usb20EyeDiagramTuningParam2= %x',0x0a,0x00
+
+ref_00022af0:
+db ' PortUsb30[%d].OverCurrentPin= OC%x',0x0a,0x00
+
+ref_00022b15:
+db ' PortUsb30[%d].FixedEqualization = %x',0x0a,0x00
+
+ref_00022b3c:
+db ' Usb20PortLength[%d]= %x.%0x',0x0a,0x00
+
+ref_00022b5a:
+db '------------------ PCH USB 3.0 Iobp Config ------------------',0x0a,0x00
+
+ref_00022b99:
+db ' Usb30IobpConfig[%d].Usb30TxOutVoltDnAmpAdj= %x',0x0a,0x00
+
+ref_00022bca:
+db ' Usb30IobpConfig[%d].Usb30TxOutImpScVoltAmpAdj= %x',0x0a,0x00
+
+ref_00022bfe:
+db ' Usb30IobpConfig[%d].Usb30TxOutDeEmpAdj= %x',0x0a,0x00
+
+ref_00022c2b:
+db ' Usb30IobpConfig[%d].Usb30TxOutAdjEn= %x',0x0a,0x00
+
+ref_00022c55:
+db ' Usb30IobpConfig[%d].Usb30TxOutImpAdjVoltAmp= %x',0x0a,0x00
+
+ref_00022c87:
+db ' Usb30IobpConfig[%d].Usb30TxOutVoltDnAmpAdjEnable= %x',0x0a,0x00
+
+ref_00022cbe:
+db ' Usb30IobpConfig[%d].Usb30TxOutImpScVoltAmpAdjEnable= %x',0x0a,0x00
+
+ref_00022cf8:
+db ' Usb30IobpConfig[%d].Usb30TxOutDeEmpAdjEnable= %x',0x0a,0x00
+
+ref_00022d2b:
+db ' Usb30IobpConfig[%d].Usb30Ecrt98Enable= %x',0x0a,0x00
+
+ref_00022d57:
+db '------------------ PCH PCIE Config ------------------',0x0a,0x00
+
+ref_00022d8e:
+db ' RootPort[%d] Enabled= %x',0x0a,0x00
+
+ref_00022da9:
+db ' RootPort[%d] Hide= %x',0x0a,0x00
+
+ref_00022dc1:
+db ' RootPort[%d] SlotImplemented= %x',0x0a,0x00
+
+ref_00022de4:
+db ' RootPort[%d] HotPlug= %x',0x0a,0x00
+
+ref_00022dff:
+db ' RootPort[%d] PmSci= %x',0x0a,0x00
+
+ref_00022e18:
+db ' RootPort[%d] ExtSync= %x',0x0a,0x00
+
+ref_00022e33:
+db ' RootPort[%d] UnsupportedRequestReport= %x',0x0a,0x00
+
+ref_00022e5f:
+db ' RootPort[%d] FatalErrorReport= %x',0x0a,0x00
+
+ref_00022e83:
+db ' RootPort[%d] NoFatalErrorReport= %x',0x0a,0x00
+
+ref_00022ea9:
+db ' RootPort[%d] CorrectableErrorReport= %x',0x0a,0x00
+
+ref_00022ed3:
+db ' RootPort[%d] PmeInterrupt= %x',0x0a,0x00
+
+ref_00022ef3:
+db ' RootPort[%d] SystemErrorOnFatalError= %x',0x0a,0x00
+
+ref_00022f1e:
+db ' RootPort[%d] SystemErrorOnNonFatalError= %x',0x0a,0x00
+
+ref_00022f4c:
+db ' RootPort[%d] SystemErrorOnCorrectableError= %x',0x0a,0x00
+
+ref_00022f7d:
+db ' RootPort[%d] AdvancedErrorReporting= %x',0x0a,0x00
+
+ref_00022fa7:
+db ' RootPort[%d] TransmitterHalfSwing= %x',0x0a,0x00
+
+ref_00022fcf:
+db ' RootPort[%d] PcieSpeed= %x',0x0a,0x00
+
+ref_00022fec:
+db ' RootPort[%d]'
+
+ref_00022ff9:
+db ' FunctionNumber= %x',0x0a,0x00
+
+ref_0002300e:
+db ' RootPort[%d] PhysicalSlotNumber= %x',0x0a,0x00
+
+ref_00023034:
+db ' RootPort[%d] CompletionTimeout= %x',0x0a,0x00
+
+ref_00023059:
+db ' RootPort[%d] Aspm= %x',0x0a,0x00
+
+ref_00023071:
+db ' RootPort[%d] L1Substates= %x',0x0a,0x00
+
+ref_00023090:
+db ' RootPort[%d]'
+
+ref_0002309d:
+db ' LtrEnable= %x',0x0a,0x00
+
+ref_000230ad:
+db ' RootPort[%d] LtrConfigLock= %x',0x0a,0x00
+
+ref_000230ce:
+db ' RootPort[%d] LtrMaxSnoopLatency= %x',0x0a,0x00
+
+ref_000230f4:
+db ' RootPort[%d] LtrMaxNoSnoopLatency= %x',0x0a,0x00
+
+ref_0002311c:
+db ' RootPort[%d] SnoopLatencyOverrideMode= %x',0x0a,0x00
+
+ref_00023148:
+db ' RootPort[%d] SnoopLatencyOverrideMultiplier= %x',0x0a,0x00
+
+ref_0002317a:
+db ' RootPort[%d] SnoopLatencyOverrideValue= %x',0x0a,0x00
+
+ref_000231a7:
+db ' RootPort[%d] NonSnoopLatencyOverrideMode= %x',0x0a,0x00
+
+ref_000231d6:
+db ' RootPort[%d] NonSnoopLatencyOverrideMultiplier= %x',0x0a,0x00
+
+ref_0002320b:
+db ' RootPort[%d] NonSnoopLatencyOverrideValue= %x',0x0a,0x00
+
+ref_0002323b:
+db ' EnableSubDecode= %x',0x0a,0x00
+
+ref_00023251:
+db ' PchPcieSbdePort= %x',0x0a,0x00
+
+ref_00023267:
+db ' RootPortClockGating= %x',0x0a,0x00
+
+ref_00023281:
+db ' RootPortFunctionSwapping= %x',0x0a,0x00
+
+ref_000232a0:
+db ' AllowNoLtrIccPllShutdown= %x',0x0a,0x00
+
+ref_000232bf:
+db '------------------ PCH SATA Config ------------------',0x0a,0x00
+
+ref_000232f6:
+db ' SataMode= %x',0x0a,0x00
+
+ref_00023305:
+db ' PortSettings[%d] HotPlug= %x',0x0a,0x00
+
+ref_00023324:
+db ' PortSettings[%d] InterlockSw= %x',0x0a,0x00
+
+ref_00023347:
+db ' PortSettings[%d] External= %x',0x0a,0x00
+
+ref_00023367:
+db ' PortSettings[%d] SpinUp= %x',0x0a,0x00
+
+ref_00023385:
+db ' PortSettings[%d] SolidStateDrive= %x',0x0a,0x00
+
+ref_000233ac:
+db ' PortSettings[%d] DevSlp= %x',0x0a,0x00
+
+ref_000233ca:
+db ' PortSettings[%d] EnableDitoConfig= %x',0x0a,0x00
+
+ref_000233f2:
+db ' PortSettings[%d] DmVal= %x',0x0a,0x00
+
+ref_0002340f:
+db ' PortSettings[%d] DitoVal= %x',0x0a,0x00
+
+ref_0002342e:
+db ' PortSettings[%d] PortRxEq GenSpeed[0]'
+
+ref_00023454:
+db ' Enable= %x',0x0a,0x00
+
+ref_00023461:
+db ' PortSettings[%d] PortRxEq GenSpeed[0] RxEq= %x',0x0a,0x00
+
+ref_00023492:
+db ' PortSettings[%d] PortRxEq GenSpeed[1] Enable= %x',0x0a,0x00
+
+ref_000234c5:
+db ' PortSettings[%d] PortRxEq GenSpeed[1] RxEq= %x',0x0a,0x00
+
+ref_000234f6:
+db ' PortSettings[%d] PortRxEq GenSpeed[2] Enable= %x',0x0a,0x00
+
+ref_00023529:
+db ' PortSettings[%d] PortRxEq GenSpeed[2] RxEq= %x',0x0a,0x00
+
+ref_0002355a:
+db ' PortSettings[%d] PortIobp Gen3TxOutVoltDnAmpAdj= %x',0x0a,0x00
+
+ref_00023590:
+db ' PortSettings[%d] PortIobp Gen12TxOutVoltDnAmpAdj= %x',0x0a,0x00
+
+ref_000235c7:
+db ' PortSettings[%d] PortIobp Gen3TxOutDeEmAdj= %x',0x0a,0x00
+
+ref_000235f8:
+db ' PortSettings[%d] PortIobp Gen12TxOutDeEmAdj= %x',0x0a,0x00
+
+ref_0002362a:
+db ' PortSettings[%d] PortIobp Gen3TxOutVoltDnAmpAdjEnable= %x',0x0a,0x00
+
+ref_00023666:
+db ' PortSettings[%d] PortIobp Gen12TxOutVoltDnAmpAdjEnable= %x',0x0a,0x00
+
+ref_000236a3:
+db ' PortSettings[%d] PortIobp Gen3TxOutDeEmAdjEnable= %x',0x0a,0x00
+
+ref_000236da:
+db ' PortSettings[%d] PortIobp Gen12TxOutDeEmAdjEnable= %x',0x0a,0x00
+
+ref_00023712:
+db ' PortSettings[%d] Sata Thermal Throttling Enabled= %x',0x0a,0x00
+
+ref_00023749:
+db ' RaidAlternateId= %x',0x0a,0x00
+
+ref_0002375f:
+db ' Raid0= %x',0x0a,0x00
+
+ref_0002376b:
+db ' Raid1= %x',0x0a,0x00
+
+ref_00023777:
+db ' Raid10= %x',0x0a,0x00
+
+ref_00023784:
+db ' Raid5= %x',0x0a,0x00
+
+ref_00023790:
+db ' Irrt= %x',0x0a,0x00
+
+ref_0002379b:
+db ' OromUiBanner= %x',0x0a,0x00
+
+ref_000237ae:
+db ' OromUiDelay= %x',0x0a,0x00
+
+ref_000237c0:
+db ' HddUnlock= %x',0x0a,0x00
+
+ref_000237d0:
+db ' LedLocate= %x',0x0a,0x00
+
+ref_000237e0:
+db ' IrrtOnly= %x',0x0a,0x00
+
+ref_000237ef:
+db ' SmartStorage= %x',0x0a,0x00
+
+ref_00023802:
+db ' SpeedSupport= %x',0x0a,0x00
+
+ref_00023815:
+db ' eSATASpeedLimit= %x',0x0a,0x00
+
+ref_0002382b:
+db ' TestMode= %x',0x0a,0x00
+
+ref_0002383a:
+db ' LegacyMode= %x',0x0a,0x00
+
+ref_0002384b:
+db ' SalpSupport= %x',0x0a,0x00
+
+ref_0002385d:
+db ' PwrOptEnable= %x',0x0a,0x00
+
+ref_00023870:
+db ' PcieNandRemap Enable= %x',0x0a,0x00
+
+ref_0002388b:
+db ' PcieNandRemap PcieNandPort= %x',0x0a,0x00
+
+ref_000238ac:
+db ' PcieNandRemap ConfigAccessLockDown= %x',0x0a,0x00
+
+ref_000238d5:
+db ' PcieNandRemap DeviceResetDelay= %x',0x0a,0x00
+
+ref_000238fa:
+db '------------------ PCH IOAPIC Config ------------------',0x0a,0x00
+
+ref_00023933:
+db ' BdfValid= %x',0x0a,0x00
+
+ref_00023942:
+db ' BusNumber= %x',0x0a,0x00
+
+ref_00023952:
+db ' DeviceNumber= %x',0x0a,0x00
+
+ref_00023965:
+db ' IoApicId= %x',0x0a,0x00
+
+ref_00023974:
+db ' ApicRangeSelect= %x',0x0a,0x00
+
+ref_0002398a:
+db ' IoApicEntry24_39= %x',0x0a,0x00
+
+ref_000239a1:
+db '------------------ PCH HPET Config ------------------',0x0a,0x00
+
+ref_000239d8:
+db ' Enable %x',0x0a,0x00
+
+ref_000239e4:
+db ' BdfValid %x',0x0a,0x00
+
+ref_000239f2:
+db ' BusNumber %x',0x0a,0x00
+
+ref_00023a01:
+db ' DeviceNumber %x',0x0a,0x00
+
+ref_00023a13:
+db ' FunctionNumber %x',0x0a,0x00
+
+ref_00023a27:
+db ' Base %x',0x0a,0x00
+
+ref_00023a31:
+db '------------------ PCH Lock Down Config ------------------',0x0a,0x00
+
+ref_00023a6d:
+db ' GlobalSmi= %x',0x0a,0x00
+
+ref_00023a7d:
+db ' BiosInterface= %x',0x0a,0x00
+
+ref_00023a91:
+db ' GpioLockDown= %x',0x0a,0x00
+
+ref_00023aa4:
+db ' RtcLock= %x',0x0a,0x00
+
+ref_00023ab2:
+db ' BiosLock= %x',0x0a,0x00
+
+ref_00023ac1:
+db ' SmmBwp= %x',0x0a,0x00
+
+ref_00023ace:
+db '------------------ PCH Flash Protection Config ------------------',0x0a,0x00
+
+ref_00023b11:
+db ' WriteProtectionEnable[%d]= %x',0x0a,0x00
+
+ref_00023b31:
+db ' ReadProtectionEnable[%d]= %x',0x0a,0x00
+
+ref_00023b50:
+db ' ProtectedRangeLimit[%d]= %x',0x0a,0x00
+
+ref_00023b6e:
+db ' ProtectedRangeBase[%d]= %x',0x0a,0x00
+
+ref_00023b8b:
+db '------------------ PCH SMBUS Config ------------------',0x0a,0x00
+
+ref_00023bc3:
+db ' SmbusIoBase= %x',0x0a,0x00
+
+ref_00023bd5:
+db ' NumRsvdSmbusAddresses= %x',0x0a,0x00
+
+ref_00023bf1:
+db ' RsvdSmbusAddressTable= {',0x00
+
+ref_00023c0b:
+db ' %02xh',0x00
+
+ref_00023c12:
+db ' }',0x0a,0x00
+
+ref_00023c16:
+db '------------------ PCH Azalia Config ------------------',0x0a,0x00
+
+ref_00023c4f:
+db ' Pme= %x',0x0a,0x00
+
+ref_00023c59:
+db ' DockSupport= %x',0x0a,0x00
+
+ref_00023c6b:
+db ' ResetWaitTimer= %x',0x0a,0x00
+
+ref_00023c80:
+db '------------------ PCH PM Config ------------------',0x0a,0x00
+
+ref_00023cb5:
+db ' PowerResetStatusClear MeWakeSts= %x',0x0a,0x00
+
+ref_00023cdb:
+db ' PowerResetStatusClear MeHrstColdSts= %x',0x0a,0x00
+
+ref_00023d05:
+db ' PowerResetStatusClear MeHrstWarmSts= %x',0x0a,0x00
+
+ref_00023d2f:
+db ' PowerResetStatusClear MeHostPowerDn= %x',0x0a,0x00
+
+ref_00023d59:
+db ' PowerResetStatusClear WolOvrWkSts= %x',0x0a,0x00
+
+ref_00023d81:
+db ' WakeConfig PmeB0S5Dis= %x',0x0a,0x00
+
+ref_00023d9d:
+db ' WakeConfig WolEnableOverride= %x',0x0a,0x00
+
+ref_00023dc0:
+db ' WakeConfig Gp27WakeFromDeepSx= %x',0x0a,0x00
+
+ref_00023de4:
+db ' WakeConfig PcieWakeFromDeepSx= %x',0x0a,0x00
+
+ref_00023e08:
+db ' WakeConfig WoWlanEnable= %x',0x0a,0x00
+
+ref_00023e26:
+db ' WakeConfig WoWlanDeepSxEnable= %x',0x0a,0x00
+
+ref_00023e4a:
+db ' PchDeepSxPol= %x',0x0a,0x00
+
+ref_00023e5d:
+db ' PchSlpS3MinAssert= %x',0x0a,0x00
+
+ref_00023e75:
+db ' PchSlpS4MinAssert= %x',0x0a,0x00
+
+ref_00023e8d:
+db ' PchSlpSusMinAssert= %x',0x0a,0x00
+
+ref_00023ea6:
+db ' PchSlpAMinAssert= %x',0x0a,0x00
+
+ref_00023ebd:
+db ' PciClockRun= %x',0x0a,0x00
+
+ref_00023ecf:
+db ' SlpStrchSusUp= %x',0x0a,0x00
+
+ref_00023ee3:
+db ' SlpLanLowDc= %x',0x0a,0x00
+
+ref_00023ef5:
+db ' LegacyDmaDisable= %x',0x0a,0x00
+
+ref_00023f0c:
+db ' PchPwrCycDur= %x',0x0a,0x00
+
+ref_00023f1f:
+db '------------------ PCH DMI Config ------------------',0x0a,0x00
+
+ref_00023f55:
+db ' DmiAspm= %x',0x0a,0x00
+
+ref_00023f63:
+db ' DmiExtSync= %x',0x0a,0x00
+
+ref_00023f74:
+db ' DmiIot= %x',0x0a,0x00
+
+ref_00023f81:
+db ' MemCloseStateEn= %x',0x0a,0x00
+
+ref_00023f97:
+db ' InternalObffEn= %x',0x0a,0x00
+
+ref_00023fac:
+db '------------------ PCH LPC SIRQ Config ------------------',0x0a,0x00
+
+ref_00023fe7:
+db ' SirqEnable= %x',0x0a,0x00
+
+ref_00023ff8:
+db ' SirqMode= %x',0x0a,0x00
+
+ref_00024007:
+db ' StartFramePulse= %x',0x0a,0x00
+
+ref_0002401d:
+db '------------------ PCH Thermal Config ------------------',0x0a,0x00
+
+ref_00024057:
+db ' ThermalAlertEnable TselLock %x',0x0a,0x00
+
+ref_00024078:
+db ' ThermalAlertEnable TscLock %x',0x0a,0x00
+
+ref_00024098:
+db ' ThermalAlertEnable TsmicLock= %x',0x0a,0x00
+
+ref_000240bb:
+db ' ThermalAlertEnable PhlcLock= %x',0x0a,0x00
+
+ref_000240dd:
+db ' ThermalThrottling TTLevels T0Level %x centigrade degree',0x0a,0x00
+
+ref_00024117:
+db ' ThermalThrottling TTLevels T1Level %x centigrade degree',0x0a,0x00
+
+ref_00024151:
+db ' ThermalThrottling TTLevels T2Level %x centigrade degree',0x0a,0x00
+
+ref_0002418b:
+db ' ThermalThrottling TTLevels TTEnable %x',0x0a,0x00
+
+ref_000241b4:
+db ' ThermalThrottling TTLevels TTState13Enable %x',0x0a,0x00
+
+ref_000241e4:
+db ' ThermalThrottling TTLevels TTLock %x',0x0a,0x00
+
+ref_0002420b:
+db ' ThermalThrottling TTLevels SuggestedSetting %x',0x0a,0x00
+
+ref_0002423c:
+db ' ThermalThrottling TTLevels PchCrossThrottling %x',0x0a,0x00
+
+ref_0002426f:
+db ' ThermalThrottling DmiHaAWC DmiTsawEn %x',0x0a,0x00
+
+ref_00024299:
+db ' ThermalThrottling DmiHaAWC TS0TW %x',0x0a,0x00
+
+ref_000242bf:
+db ' ThermalThrottling DmiHaAWC TS1TW %x',0x0a,0x00
+
+ref_000242e5:
+db ' ThermalThrottling DmiHaAWC TS2TW %x',0x0a,0x00
+
+ref_0002430b:
+db ' ThermalThrottling DmiHaAWC TS3TW %x',0x0a,0x00
+
+ref_00024331:
+db ' ThermalThrottling DmiHaAWC SuggestedSetting %x',0x0a,0x00
+
+ref_00024362:
+db ' ThermalThrottling SataTT P0T1M %x',0x0a,0x00
+
+ref_00024386:
+db ' ThermalThrottling SataTT P0T2M %x',0x0a,0x00
+
+ref_000243aa:
+db ' ThermalThrottling SataTT P0T3M %x',0x0a,0x00
+
+ref_000243ce:
+db ' ThermalThrottling SataTT P0TDisp %x',0x0a,0x00
+
+ref_000243f4:
+db ' ThermalThrottling SataTT P0Tinact %x',0x0a,0x00
+
+ref_0002441b:
+db ' ThermalThrottling SataTT P0TDispFinit %x',0x0a,0x00
+
+ref_00024446:
+db ' ThermalThrottling SataTT P1T1M %x',0x0a,0x00
+
+ref_0002446a:
+db ' ThermalThrottling SataTT P1T2M %x',0x0a,0x00
+
+ref_0002448e:
+db ' ThermalThrottling SataTT P1T3M %x',0x0a,0x00
+
+ref_000244b2:
+db ' ThermalThrottling SataTT P1TDisp %x',0x0a,0x00
+
+ref_000244d8:
+db ' ThermalThrottling SataTT P1Tinact %x',0x0a,0x00
+
+ref_000244ff:
+db ' ThermalThrottling SataTT P1TDispFinit %x',0x0a,0x00
+
+ref_0002452a:
+db ' ThermalThrottling SataTT SuggestedSetting %x',0x0a,0x00
+
+ref_00024559:
+db ' MemoryThrottling Enable= %x',0x0a,0x00
+
+ref_00024577:
+db ' MemoryThrottling TsGpioPinSetting PmsyncEnable= %x',0x0a,0x00
+
+ref_000245ac:
+db ' MemoryThrottling TsGpioPinSetting C0TransmitEnable= %x',0x0a,0x00
+
+ref_000245e5:
+db ' MemoryThrottling TsGpioPinSetting PinSelection= %x',0x0a,0x00
+
+ref_0002461a:
+db ' PchHotLevel = %x',0x0a,0x00
+
+ref_0002462d:
+db ' ThermalDeviceEnable (D31:F6) %x',0x0a,0x00
+
+ref_0002464f:
+db '------------------ PCH General Config ------------------',0x0a,0x00
+
+ref_00024689:
+db ' SubSystemVendorId= %x',0x0a,0x00
+
+ref_000246a1:
+db ' SubSystemId= %x',0x0a,0x00
+
+ref_000246b3:
+db ' Crid= %x',0x0a,0x00
+
+ref_000246be:
+db ' DciEn= %x',0x0a,0x00
+
+ref_000246ca:
+db '------------------ PCH LAN Config ------------------',0x0a,0x00
+
+ref_00024700:
+db '------------------ PCH Serial IO Config ------------------',0x0a,0x00
+
+ref_0002473c:
+db ' SerialIoGpio= %x',0x0a,0x00
+
+ref_0002474f:
+db ' SerialIoDma= %x',0x0a,0x00
+
+ref_00024761:
+db ' SerialIoI2c0= %x',0x0a,0x00
+
+ref_00024774:
+db ' SerialIoI2c1= %x',0x0a,0x00
+
+ref_00024787:
+db ' SerialIoSpi0= %x',0x0a,0x00
+
+ref_0002479a:
+db ' SerialIoSpi1= %x',0x0a,0x00
+
+ref_000247ad:
+db ' SerialIoUart0= %x',0x0a,0x00
+
+ref_000247c1:
+db ' SerialIoUart1= %x',0x0a,0x00
+
+ref_000247d5:
+db ' SerialIoSdio= %x',0x0a,0x00
+
+ref_000247e8:
+db ' I2c0VoltageSelect= %x',0x0a,0x00
+
+ref_00024800:
+db ' I2c1VoltageSelect= %x',0x0a,0x00
+
+ref_00024818:
+db ' GpioIrqRoute= %x',0x0a,0x00
+
+ref_0002482b:
+db ' DriverModeTouchPanel= %x',0x0a,0x00
+
+ref_00024846:
+db ' DriverModeTouchPad= %x',0x0a,0x00
+
+ref_0002485f:
+db ' DriverModeSensorHub= %x',0x0a,0x00
+
+ref_00024879:
+db ' Ddr50Support= %x',0x0a,0x00
+
+ref_0002488c:
+db '------------------ PCH Audio DSP Config ------------------',0x0a,0x00
+
+ref_000248c8:
+db ' AudioDspAcpiMode= %x',0x0a,0x00
+
+ref_000248df:
+db ' AudioDspD3PowerGating= %x',0x0a,0x00
+
+ref_000248fb:
+db ' AudioDspSramPowerGating= %x',0x0a,0x00
+
+ref_00024919:
+db ' AudioDspBluetoothSupport= %x',0x0a,0x00
+
+ref_00024938:
+db ' AudioDspAcpiInterruptMode= %x',0x0a,0x00
+
+ref_00024958:
+db ' AudioDspMclkOutputSelect= %x',0x0a,0x00
+
+ref_00024977:
+db ' AudioDspFeatureMask= %x',0x0a,0x00
+
+ref_00024991:
+db '------------------ PCH Platform Data ------------------',0x0a,0x00
+
+ref_000249ca:
+db ' FviSmbiosType= %x',0x0a,0x00
+
+ref_000249de:
+db ' EcPresent= %x',0x0a,0x00
+
+ref_000249ee:
+db ' TempPciBusMin= %x',0x0a,0x00
+
+ref_00024a02:
+db ' TempPciBusMax= %x',0x0a,0x00
+
+ref_00024a16:
+db ' TempMemBaseAddr= %x',0x0a,0x00
+
+ref_00024a2c:
+db ' TempMemSize= %x',0x0a,0x00
+
+ref_00024a3e:
+db '------------------ PCH Interrupt Config ------------------',0x0a,0x00
+
+ref_00024a7a:
+db ' DXXIP[%d] Offset = %x',0x0a,0x00
+
+ref_00024a92:
+db ' DXXIP[%d] Settings = %x',0x0a,0x00
+
+ref_00024aac:
+db ' DXXIR[%d] Offset = %x',0x0a,0x00
+
+ref_00024ac4:
+db ' DXXIR[%d] Settings = %x',0x0a,0x00
+
+ref_00024ade:
+db '------------------------ PCH Dump Platform Policy Start ------------------------',0x0a,0x00
+
+ref_00024b30:
+db ' Revision= %x',0x0a,0x00
+
+ref_00024b3f:
+db ' Rcba= %x',0x0a,0x00
+
+ref_00024b4a:
+db ' PmBase= %x',0x0a,0x00
+
+ref_00024b57:
+db ' GpioBase= %x',0x0a,0x00
+
+ref_00024b66:
+db ' Port80Route= %x',0x0a,0x00
+
+ref_00024b78:
+db '------------------------ PCH Dump Platform Policy End --------------------------',0x0a,0x00
+
+ref_00024bca:
+db 'PchPlatformPolicy->Rcba != '
+
+ref_00024be5:
+db 0x30
+db 0x00
+
+ref_00024be7:
+db '../../intel/Pch/PchInit/Pei/PchDebugDump.c',0x00
+
+ref_00024c12:
+db 'PchPlatformPolicy->PmBase != 0',0x00
+
+ref_00024c31:
+db 'PchPlatformPolicy->GpioBase != 0',0x00
+
+ref_00024c52:
+db 'PchPlatformPolicy->PlatformData.TempMemBaseAddr != 0',0x00
+
+ref_00024c87:
+db 'PchPlatformPolicy->PlatformData.TempMemSize >= 0x10000',0x00
+
+ref_00024cbe:
+db 'PchPlatformPolicy->PlatformData.TempIoBaseAddr != 0',0x00
+
+ref_00024cf2:
+db 'PchPlatformPolicy->PlatformData.TempIoSize >= 0x10',0x00
+
+ref_00024d25:
+db '../../intel/Pch/PchInit/Pei/PchDmiPeim.c',0x00
+
+ref_00024d4e:
+db 'TC:%0x VC:%0x!',0x0a,0x00
+
+ref_00024d5e:
+db 'VC:%0x VCID:%0x Enable:%0x!',0x0a,0x00
+
+ref_00024d7b:
+db 'PchDmiGen2Prog() Start',0x0a,0x00
+
+ref_00024d93:
+db 'PchDmiGen2Prog() End',0x0a,0x00
+
+ref_00024da9:
+db 'Usb30TxOutVoltDnAmpAdj is out of valid range ',0x0a,0x00
+
+ref_00024dd8:
+db 'Usb30TxOutImpScVoltAmpAdj is out of valid range ',0x0a,0x00
+
+ref_00024e0a:
+db 'Usb30TxOutDeEmpAdj is out of valid range ',0x0a,0x00
+
+ref_00024e35:
+db 'Usb30TxOutImpAdjVoltAmp is out of valid range ',0x0a,0x00
+
+ref_00024e65:
+db 'PchStartUsbInit() - Start',0x0a,0x00
+
+ref_00024e80:
+db 'Revision : 0x%x',0x0a,0x00
+
+ref_00024e91:
+db 'EhciMemBaseAddr : 0x%x',0x0a,0x00
+
+ref_00024ea9:
+db 'XhciMemBaseAddr : 0x%x',0x0a,0x00
+
+ref_00024ec1:
+db '../../intel/Pch/PchInit/Pei/PchUsbInit.c',0x00
+
+ref_00024eea:
+db 'PchStartUsbInit() - End',0x0a,0x00
+
+ref_00024f03:
+db 'PchUsbInit() - Start',0x0a,0x00
+
+ref_00024f19:
+db 'PchUsbInit() - End',0x0a,0x00
+
+ref_00024f2d:
+db 'Invalid Vendor ID! ',0x0a,0x00
+
+ref_00024f42:
+db 'PchInitRootPorts() Start',0x0a,0x00
+
+ref_00024f5c:
+db 'Func0PortNum <= MaxPciePortNum',0x00
+
+ref_00024f7b:
+db '../../intel/Pch/PchInit/Pei/PchRootPortsPei.c',0x00
+
+ref_00024fa9:
+db ' Root Port %x device enabled. RpEnableMask: 0x%x',0x0a,0x00
+
+ref_00024fdb:
+db 'PchInitRootPorts() End',0x0a,0x00
+
+ref_00024ff3:
+db 'ICB bit is not zero before SendCodecCommand! ',0x0a,0x00
+
+ref_00025022:
+db 'SendCodecCommand: ReadBack fail! ',0x0a,0x00
+
+ref_00025045:
+db 'VendorDeviceId != 0',0x00
+
+ref_00025059:
+db '../../intel/Pch/PchInit/Pei/PchHdaPei.c',0x00
+
+ref_00025081:
+db 'Set the ownership of I/O buffers to HD-Audio or Audio DSP subsystem',0x0a,0x00
+
+ref_000250c6:
+db 'PchAzaliaInit() Start',0x0a,0x00
+
+ref_000250dd:
+db 'Reset High Definition Audio (Azalia) Codec Time Out - 1! ',0x0a,0x00
+
+ref_00025118:
+db 'Reset High Definition Audio (Azalia) Codec Time Out - 2! ',0x0a,0x00
+
+ref_00025153:
+db 'No Azalia device is detected.',0x0a,0x00
+
+ref_00025172:
+db 'SDI%d has no Azalia device.',0x0a,0x00
+
+ref_0002518f:
+db 'Error: Reading the Codec Vendor ID/Device ID fail!',0x0a,0x00
+
+ref_000251c3:
+db 'Error: Reading the Codec Revision ID fail!',0x0a,0x00
+
+ref_000251ef:
+db 'SDI:%d Detected Azalia Codec 0x%08X rev 0x%02X',0x0a,0x00
+
+ref_0002521f:
+db 'Error: No matching Azalia codec verb table found for codec (0x%08X).',0x0a,0x00
+
+ref_00025265:
+db 'Found verb table for vendor 0x%04X devId 0x%04X rev 0x%02X (SDI:%X, size: %d dwords)',0x0a,0x00
+
+ref_000252bb:
+db '(CodecCmdData >> 28) == 0',0x00
+
+ref_000252d5:
+db 'Error loading verb table for Azalia Codec of 0x%08X',0x00
+
+ref_00025309:
+db 'PchAzaliaInit() End',0x0a,0x00
+
+ref_0002531e:
+db '../../intel/Pch/PchInit/Common/PchUsbCommon.c',0x00
+
+ref_0002534c:
+db 'PchUsbCommon XHCI Capability Pointer = 0x%x',0x0a,0x00
+
+ref_00025379:
+db 'PchUsbCommon DebugPortSsIndex = %d',0x0a,0x00
+
+ref_0002539d:
+db 'OCPin < 4',0x00
+
+ref_000253a7:
+db 'UsbConfig->PortUsb20[Index].Usb20EyeDiagramTuningParam2 < 8',0x00
+
+ref_000253e3:
+db 'UsbConfig->PortUsb20[Index].Usb20EyeDiagramTuningParam1 < 8',0x00
+
+ref_0002541f:
+db 'CommonUsbInit() - Start',0x0a,0x00
+
+ref_00025438:
+db 'CommonUsbInit() - End',0x0a,0x00
+
+ref_0002544f:
+db 'hljztL',0x00
+
+ref_00025456:
+db '(null)',0x00
+
+ref_0002545d:
+db '{%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}',0x0a,0x00
+
+ref_00025491:
+db '%s: overwrite GUID ',0x00
+
+ref_000254a5:
+db '%s: no room for a new PPI',0x0a,0x00
+
+ref_000254c0:
+db '%s: NOT_FOUND in %d entries ',0x00
+
+ref_000254dd:
+db '%s: no room for a new notifier',0x0a,0x00
+
+ref_000254fd:
+db '%s installed %d',0x0a,0x00
+
+ref_0002550e:
+db 'Invalid PEI data version, %d != %d',0x0a,0x00
+
+ref_00025532:
+db 'MRC: S3 Resume',0x0a,0x00
+
+ref_00025542:
+db 'Initializing Policy',0x0a,0x00
+
+ref_00025557:
+db 'Installing common PPI',0x0a,0x00
+
+ref_0002556e:
+db 'stall.c',0x00
+
+ref_00025576:
+db 'Generating Random number...',0x0a,0x00
+
+ref_00025593:
+db 'Exiting Random number: %08Xh',0x0a,0x00
+
+ref_000255b1:
+db 'Post Code: %04Xh',0x0a,0x00
+
+ref_000255c3:
+db 'Returned From MrcStartMemoryConfiguration(). MrcStatus = %08Xh',0x0a,0x00
+
+ref_00025603:
+db '(Bus <= 0xFF) && (Device <= 0x1F) && (Function <= 0x7)',0x00
+
+ref_0002563a:
+db '../policy/MrcOemPlatform.c',0x00
+
+ref_00025655:
+db 'Pch PEI Platform Policy Initialization Done ',0x0a,0x00
+
+ref_00025683:
+db '../../intel/SampleCode/PolicyInit/Pei/PolicyInitPei.c',0x00
+
+ref_000256b9:
+db 'CPU PEI Platform Policy Initialization Done ',0x0a,0x00
+
+ref_000256e7:
+db 'Me PEI Platform Policy Initialization Done ',0x0a,0x00
+
+ref_00025714:
+db 'SystemAgent PEI Platform Policy Initialization Done ',0x0a,0x00
+
+ref_0002574a:
+db '((UINTN)Buffer & (sizeof (Guid->Data1) - 1)) == 0',0x00
+
+ref_0002577c:
+db '../../UDK2010.SR1/MdePkg/Library/BaseMemoryLibOptPei/MemLibGuid.c',0x00
+
+ref_000257be:
+db 'Length <= (0xFFFFFFFF - (UINTN)Buffer + 1)',0x00
+
+ref_000257e9:
+db '(Length & (sizeof (*GuidPtr) - 1)) == 0',0x00
+
+ref_00025811:
+db '!(Buffer == ((void *) 0) && Length > 0)',0x00
+
+ref_00025839:
+db '../../UDK2010.SR1/MdePkg/Library/BaseMemoryLibOptPei/ZeroMemWrapper.c',0x00
+
+ref_0002587f:
+db 'DestinationBuffer != ((void *) 0)',0x00
+
+ref_000258a1:
+db '../../UDK2010.SR1/MdePkg/Library/BaseMemoryLibOptPei/CompareMemWrapper.c',0x00
+
+ref_000258ea:
+db 'SourceBuffer != ((void *) 0)',0x00
+
+ref_00025907:
+db '(Length - 1) <= (0xFFFFFFFF - (UINTN)DestinationBuffer)',0x00
+
+ref_0002593f:
+db '(Length - 1) <= (0xFFFFFFFF - (UINTN)SourceBuffer)',0x00
+
+ref_00025972:
+db '../../UDK2010.SR1/MdePkg/Library/BaseMemoryLibOptPei/CopyMemWrapper.c',0x00
+
+ref_000259b8:
+db 'Count < 64',0x00
+
+ref_000259c3:
+db '../../UDK2010.SR1/MdePkg/Library/BaseLib/RShiftU64.c',0x00
+
+ref_000259f8:
+db '../../UDK2010.SR1/MdePkg/Library/BaseLib/Unaligned.c',0x00
+
+ref_00025a2d:
+db 'Divisor != 0',0x00
+
+ref_00025a3a:
+db '../../UDK2010.SR1/MdePkg/Library/BaseLib/ModU64x32.c',0x00
+
+ref_00025a6f:
+db '../../UDK2010.SR1/MdePkg/Library/BaseLib/DivU64x32.c',0x00
+
+ref_00025aa4:
+db '../../UDK2010.SR1/MdePkg/Library/BaseLib/DivU64x32Remainder.c',0x00
+
+ref_00025ae2:
+db 'EndBit < sizeof (Value) * 8',0x00
+
+ref_00025afe:
+db '../../UDK2010.SR1/MdePkg/Library/BaseLib/X86Msr.c',0x00
+
+ref_00025b30:
+db 'StartBit <= EndBit',0x00
+
+ref_00025b43:
+db 'EndBit < sizeof (OrData) * 8',0x00
+
+ref_00025b60:
+db 'EndBit < sizeof (AndData) * 8',0x00
+
+ref_00025b7e:
+db '../../UDK2010.SR1/MdePkg/Library/BaseIoLibIntrinsic/IoLib.c',0x00
+
+ref_00025bba:
+db '(Address & 1) == 0',0x00
+
+ref_00025bcd:
+db '(Address & 3) == 0',0x00
+
+ref_00025be0:
+db '(Address & 7) == 0',0x00
+
+ref_00025bf3:
+db '(Port & 1) == 0',0x00
+
+ref_00025c03:
+db '../../UDK2010.SR1/MdePkg/Library/BaseIoLibIntrinsic/IoLibGcc.c',0x00
+
+ref_00025c42:
+db '(Port & 3) == 0',0x00
+
+ref_00025c52:
+db '../../UDK2010.SR1/MdePkg/Library/PeiHobLib/HobLib.c',0x00
+
+ref_00025c86:
+db 'HobList != ((void *) 0)',0x00
+
+ref_00025c9e:
+db 'HobStart != ((void *) 0)',0x00
+
+ref_00025cb7:
+db 'Hob != ((void *) 0)',0x00
+
+ref_00025ccb:
+db '((MemoryAllocationModule & (0x00001000 - 1)) == 0) && ((ModuleLength & (0x00001000 - 1)) == 0)',0x00
+
+ref_00025d2a:
+db 'Guid != ((void *) 0)',0x00
+
+ref_00025d3f:
+db 'DataLength <= (0xFFF8 - sizeof (EFI_HOB_GUID_TYPE))',0x00
+
+ref_00025d73:
+db 'Data != ((void *) 0) || DataLength == 0',0x00
+
+ref_00025d9b:
+db '((BaseAddress & (0x00001000 - 1)) == 0) && ((Length & (0x00001000 - 1)) == 0)',0x00
+
+ref_00025de9:
+db 'FvInfoPpi != ((void *) 0)',0x00
+
+ref_00025e03:
+db '../../UDK2010.SR1/MdePkg/Library/PeiServicesLib/PeiServicesLib.c',0x00
+
+ref_00025e44:
+db 'ParentFvNameValue != ((void *) 0)',0x00
+
+ref_00025e66:
+db 'ParentFileNameValue != ((void *) 0)',0x00
+
+ref_00025e8a:
+db 'FvInfoPpiDescriptor != ((void *) 0)',0x00
+
+ref_00025eae:
+db 'PeiServicesTablePointer != ((void *) 0)',0x00
+
+ref_00025ed6:
+db '../../UDK2010.SR1/MdePkg/Library/PeiServicesTablePointerLib/PeiServicesTablePointer.c',0x00
+
+ref_00025f2c:
+db 'gPeiServices != ((void *) 0)',0x00
+
+ref_00025f49:
+db 'Pages != 0',0x00
+
+ref_00025f54:
+db '../../UDK2010.SR1/MdePkg/Library/PeiMemoryAllocationLib/MemoryAllocationLib.c',0x00
+
+ref_00025fa2:
+db '(Alignment & (Alignment - 1)) == 0',0x00
+
+ref_00025fc5:
+db 'Pages <= (0xFFFFFFFF - (((Alignment) >> 12) + (((Alignment) & 0xFFF) ? 1 : 0)))',0x00
+
+ref_00026015:
+db 'AllocationSize <= (0xFFFFFFFF - (UINTN) Buffer + 1)',0x00
+
+ref_00026049:
+db '!((BOOLEAN) (((SmBusAddress) & 0x00400000) != 0))',0x00
+
+ref_0002607b:
+db '../../UDK2010.SR1/MdePkg/Library/PeiSmbusLibSmbus2Ppi/SmbusLib.c',0x00
+
+ref_000260bc:
+db '(((SmBusAddress) >> 8) & 0xff) == 0',0x00
+
+ref_000260e0:
+db '(((SmBusAddress) >> 16) & 0x3f) == 0',0x00
+
+ref_00026105:
+db '((SmBusAddress) & ~(0x00800000 - 2)) == 0',0x00
+
+ref_0002612f:
+db '(((SmBusAddress) >> 16) & 0x3f) >= 1',0x00
+
+ref_00026154:
+db '(((SmBusAddress) >> 16) & 0x3f) <= 32',0x00
+
+ref_0002617a:
+db 'WriteBuffer != ((void *) 0)',0x00
+
+ref_00026196:
+db 'Read'
+
+ref_0002619a:
+db 'Buffer != ((void *) 0)',0x00
+
+ref_000261b1:
+db '../../UDK2010.SR1/MdePkg/Library/PeiSmbusLibSmbus2Ppi/PeiSmbusLib.c',0x00
+
+ref_000261f5:
+db 'SmbusPpi != ((void *) 0)',0x00
+
+ref_0002620e:
+db 'CpuIO PPI has been loaded into memory. Reinstalled PPI=0x%x',0x0a,0x00
+
+ref_0002624c:
+db '../../UDK2010.SR1/UefiCpuPkg/CpuIoPei/CpuIoPei.c',0x00
+
+ref_0002627d:
+db 'PEI SmbusExecute() Start, SmbusDeviceAddress=%x, Command=%x, Operation=%x',0x0a,0x00
+
+ref_000262c8:
+db 'CR has Bad Signature',0x00
+
+ref_000262dd:
+db '../../intel/Pch/Smbus/Pei/PchSmbusEntry.c',0x00
+
+ref_00026307:
+db 'PEI SmbusExecute() End',0x0a,0x00
+
+ref_0002631f:
+db 'InitializePchSmbusPeim() Start',0x0a,0x00
+
+ref_0002633f:
+db 'Failed to allocate memory for Private! ',0x0a,0x00
+
+ref_00026368:
+db 'InitializePchSmbusPeim() End',0x0a,0x00
+
+ref_00026386:
+db 'SmbusIoBase != 0x0000FFE0 && SmbusIoBase != 0',0x00
+
+ref_000263b4:
+db '../../intel/Pch/Smbus/Common/PchSmbusExec.c',0x00
+
+ref_000263e0:
+db 'InstallPchReset() Start',0x0a,0x00
+
+ref_000263f9:
+db '../../intel/Pch/Reset/Pei/PchReset.c',0x00
+
+ref_0002641e:
+db 'InstallPchReset() End',0x0a,0x00
+
+ref_00026435:
+db 'Please do the global reset through HECI ',0x0a,0x00
+
+ref_0002645f:
+db 'None of Pch Reset Callback Ppi is found .',0x0a,0x00
+
+ref_0002648a:
+db 'Failed to locate Pch Reset Callback Ppi.',0x0a,0x00
+
+ref_000264b4:
+db 'LptHC0',0x00
+
+ref_000264bb:
+db 'LptLpB0',0x00
+
+ref_000264c3:
+db 'WptLpB0',0x00
+
+ref_000264cb:
+db 'PCH code doesn',0x27,'t support the LpcDeviceId: 0x%04x!',0x0a,0x00
+
+ref_000264fe:
+db 'Unsupported PCH SKU, LpcDeviceId: 0x%04x!',0x0a,0x00
+
+ref_00026529:
+db '../../intel/Pch/Library/PchPlatformLib/PchPlatformLibrary.c',0x00
+
+ref_00026565:
+db 'GbePortSel=%d',0x0a,0x00
+
+ref_00026574:
+db 'ConfigureDisplay() Start',0x0a,0x00
+
+ref_0002658e:
+db 'ConfigureDisplay() End',0x0a,0x00
+
+ref_000265a6:
+db 'CPU stepping = %x and CpuFamily = %x is not supported !',0x0a,0x00
+
+ref_000265e0:
+db 'Unsupported CPU SKU, CpuFamilyId: 0x%08X!',0x0a,0x00
+
+ref_0002660b:
+db '../../intel/Cpu/Library/CpuPlatformLib/CpuPlatformLibrary.c',0x00
+
+ref_00026647:
+db 'NumberOfEnabledCoresPerDie != ((void *) 0)',0x00
+
+ref_00026672:
+db 'NumberOfEnabledThreadsPerCore != ((void *) 0)',0x00
+
+ref_000266a0:
+db 'NumberOfDiesPerPackage != ((void *) 0)',0x00
+
+ref_000266c7:
+db 'NumberOfPackages != ((void *) 0)',0x00
+
+ref_000266e8:
+db '(MAILBOX) Mailbox interface timed out.',0x0a,0x00
+
+ref_00026710:
+db '(MAILBOX) Mailbox Write Command = %2Xh',0x0a,0x00
+
+ref_00026738:
+db '(MAILBOX) Mailbox read data is corrupted.',0x0a,0x00
+
+ref_00026763:
+db '(MAILBOX) Unrecognized Mailbox Type.',0x0a,0x00
+
+ref_00026789:
+db '(MAILBOX) Mailbox Status = %2Xh',0x0a,0x00
+
+ref_000267aa:
+db '(MAILBOX) Mailbox Read Command = %2Xh',0x0a,0x00
+
+ref_000267d1:
+db 'Read PCH Power Limit from PCODE Mail Box : %x ',0x0a,0x00
+
+ref_00026801:
+db '(OC MAILBOX) Unknown Command ID',0x0a,0x00
+
+ref_00026822:
+db '%s:%d pool cookie corrupted...',0x0a,0x00
+
+ref_00026842:
+db '%s:%d failed to allocate %d bytes...',0x0a,0x00
+
+ref_00026868:
+db 'No memory to create HOB of %d bytes!',0x0a,0x00
+
+ref_0002688e:
+db 'Created hob: %x %u at %p',0x0a,0x00
+
+ref_000268a8:
+db 'SaPlatformPolicyPpi != ((void *) 0)',0x00
+
+ref_000268cc:
+db '../policy/SaPolicyInitPei.c',0x00
+
+ref_000268e8:
+db 'SaPlatformPolicyPpiDesc != ((void *) 0)',0x00
+
+ref_00026910:
+db 'PlatformData != ((void *) 0)',0x00
+
+ref_0002692d:
+db 'GtConfig != ((void *) 0)',0x00
+
+ref_00026946:
+db 'MemConfig != ((void *) 0)',0x00
+
+ref_00026960:
+db 'MemConfigNoCrc != ((void *) 0)',0x00
+
+ref_0002697f:
+db 'PcieConfig != ((void *) 0)',0x00
+
+ref_0002699a:
+db 'PegGpioData != ((void *) 0)',0x00
+
+ref_000269b6:
+db 'OcConfig != ((void *) 0)',0x00
+
+ref_000269cf:
+db '../policy/PchPolicyInitPei.c',0x00
+
+ref_000269ec:
+db '../policy/PchPolicyInitUsb.c',0x00
+
+ref_00026a09:
+db 'CpuPlatformPolicyPpi != ((void *) 0)',0x00
+
+ref_00026a2e:
+db '../policy/CpuPolicyInitPei.c',0x00
+
+ref_00026a4b:
+db 'CpuPlatformPolicyPpiDesc != ((void *) 0)',0x00
+
+ref_00026a74:
+db 'CpuConfig != ((void *) 0)',0x00
+
+ref_00026a8e:
+db 'SecurityConfig != ((void *) 0)',0x00
+
+ref_00026aad:
+db 'PowerMgmtConfig != ((void *) 0)',0x00
+
+ref_00026acd:
+db 'MePlatformPolicyPpi != ((void *) 0)',0x00
+
+ref_00026af1:
+db '../policy/MePolicyInitPei.c',0x00
+
+ref_00026b0d:
+db 'MePlatformPolicyPpiDesc != ((void *) 0)',0x00
+
+ref_00026b35:
+db 'ME PEI Platform Policy PPI Installed',0x0a,0x00
+
+ref_00026b5b:
+db '(Length - 1) <= (0xFFFFFFFF - (UINTN)Buffer)',0x00
+
+ref_00026b88:
+db '../../UDK2010.SR1/MdePkg/Library/BaseMemoryLibOptPei/SetMemWrapper.c',0x00
+
+ref_00026bcd:
+db '../../UDK2010.SR1/MdePkg/Library/BaseMemoryLibOptPei/SetMem32Wrapper.c',0x00
+
+ref_00026c14:
+db '(((UINTN)Buffer) & (sizeof (Value) - 1)) == 0',0x00
+
+ref_00026c42:
+db '(Length & (sizeof (Value) - 1)) == 0',0x00
+
+ref_00026c67:
+db '(OrData >> (EndBit - StartBit)) == ((OrData >> (EndBit - StartBit)) & 1)',0x00
+
+ref_00026cb0:
+db '../../UDK2010.SR1/MdePkg/Library/BaseLib/BitField.c',0x00
+
+ref_00026ce4:
+db '(AndData >> (EndBit - StartBit)) == ((AndData >> (EndBit - StartBit)) & 1)',0x00
+
+ref_00026d2f:
+db 'EndBit < 8',0x00
+
+ref_00026d3a:
+db 'EndBit < 16',0x00
+
+ref_00026d46:
+db 'EndBit < 32',0x00
+
+ref_00026d52:
+db 'EndBit < 64',0x00
+
+ref_00026d5e:
+db 'RShiftU64 (OrData, EndBit - StartBit) == (RShiftU64 (OrData, EndBit - StartBit) & 1)',0x00
+
+ref_00026db3:
+db 'RShiftU64 (AndData, EndBit - StartBit) == (RShiftU64 (AndData, EndBit - StartBit) & 1)',0x00
+
+ref_00026e0a:
+db '../../UDK2010.SR1/MdePkg/Library/BaseLib/LShiftU64.c',0x00
+
+ref_00026e3f:
+db '../../UDK2010.SR1/MdePkg/Library/BaseLib/DivU64x64Remainder.c',0x00
+
+ref_00026e7d:
+db 'PchResetInstance->PchRootComplexBar != 0',0x00
+
+ref_00026ea6:
+db 0x2e
+db 0x2e
+dd 0x2f2e2e2f
+dd 0x65746e69
+dd 0x63502f6c
+dd 0x65522f68
+dd 0x2f746573
+dd 0x6d6d6f43
+dd 0x502f6e6f
+dd 0x65526863
+dd 0x43746573
+dd 0x6f6d6d6f
+dd 0x00632e6e
+dd 0x90669066
+
+ref_00026ed8:
+dd 0x80000020
+dd ref_0002908c
+dd fcn_00000197
+
+ref_00026ee4:
+dd 0x80000020
+dd ref_0002909c
+dd fcn_000000ce
+
+ref_00026ef0:
+dd 0x80000010
+dd ref_0002931c
+dd 0x00000000
+
+ref_00026efc:
+dd 0x00014001
+dd 0x00022101
+dd 0x00034003
+dd 0x00045004
+dd 0x00056105
+dd 0x00068006
+dd 0x00078107
+dd 0x0008a108
+dd 0x0009c009
+dd 0x000ac10a
+dd 0x000be10b
+dd 0x010c800c
+dd 0x010d810d
+dd 0x010e910e
+dd 0x010fa00f
+dd 0x0110a110
+dd 0x0111b111
+dd 0x0112c012
+dd 0x0113c113
+dd 0x0114d114
+dd 0x0115e015
+dd 0x0116e116
+dd 0x0117f117
+dd 0x0118f618
+
+ref_00026f5c:
+dd 0x00000020
+dd ref_000291dc
+dd fcn_0000d87f
+dd 0x80000040
+dd ref_0002909c
+dd fcn_0000be41
+
+ref_00026f74:
+dd 0x80000010
+dd ref_0002914c
+dd 0x00000000
+
+ref_00026f80:
+dd 0x80000010
+dd ref_000291ac
+dd ref_00026f8c
+
+ref_00026f8c:
+dd fcn_000118c3
+dd fcn_00010bc2
+dd fcn_00010d5e
+dd fcn_0000bd38
+
+ref_00026f9c:
+dd 0x02353140
+dd 0x20373144
+dd 0x32103146
+dd 0x32163148
+dd 0x3250314c
+dd 0x76543150
+dd 0x00063158
+dd 0x55443164
+dd 0x00073168
+
+ref_00026fc0:
+dd 0x02353140
+dd 0x20373144
+dd 0x32103146
+dd 0x32163148
+dd 0x3250314c
+dd 0x76543150
+
+ref_00026fd8:
+dd 0x00003100
+dd 0x03203200
+dd 0x00003108
+dd 0x00000001
+dd 0x0000310c
+dd 0x43214321
+dd 0x00003110
+dd 0x00000001
+dd 0x00003118
+dd 0x00000001
+
+ref_00027000:
+dd 0x00003100
+dd 0x03203200
+dd 0x00003108
+dd 0x00000001
+dd 0x0000310c
+dd 0x43214321
+dd 0x00003110
+dd 0x00000001
+dd 0x00003114
+dd 0x00000001
+dd 0x00003118
+dd 0x00000001
+
+ref_00027030:
+dd 0x00000000
+dd 0x00000001
+dd 0x00000002
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000003
+dd 0x01010001
+dd 0x07010201
+dd 0xe9002440
+dd 0xe9002640
+dd 0xe9000840
+dd 0xe9000a40
+dd 0xe9000c40
+dd 0xe9000e40
+dd 0xe9001040
+dd 0xe9001240
+dd 0xea002040
+dd 0xea002240
+dd 0xea002440
+dd 0xea002640
+dd 0xe9002e40
+dd 0xe9002c40
+dd 0xe9002a40
+dd 0xe9002840
+dd 0xe9002640
+dd 0xe9002440
+dd 0xe9002240
+dd 0xe9002040
+dd 0xea002040
+dd 0xea002240
+
+ref_000270b0:
+dd 0xe9002168
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002160
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9002160
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe900215c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe90021cc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002170
+dd 0xffffff9f
+dd 0x00000000
+dd 0xe9002368
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002360
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9002360
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe900235c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe90023cc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002370
+dd 0xffffff9f
+dd 0x00000000
+dd 0xe9002568
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002560
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9002560
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe900255c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe90025cc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002570
+dd 0xffffff9f
+dd 0x00000000
+dd 0xe9002768
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002760
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9002760
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe900275c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe90027cc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002770
+dd 0xffffff9f
+dd 0x00000000
+
+ref_000271d0:
+dd 0xe9001768
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9001760
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9001760
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe900175c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe90017cc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9001770
+dd 0xffffff9f
+dd 0x00000000
+dd 0xe9001568
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9001560
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9001560
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe900155c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe90015cc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9001570
+dd 0xffffff9f
+dd 0x00000000
+dd 0xe9002f68
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002f60
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9002f60
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe9002f5c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe9002fcc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002f70
+dd 0xffffff9f
+dd 0x00000000
+dd 0xe9002d68
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002d60
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9002d60
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe9002d5c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe9002dcc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002d70
+dd 0xffffff9f
+dd 0x00000000
+dd 0xe9003368
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9003360
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9003360
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe900335c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe90033cc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9003370
+dd 0xffffff9f
+dd 0x00000000
+dd 0xe9003168
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9003160
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9003160
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe900315c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe90031cc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9003170
+dd 0xffffff9f
+dd 0x00000000
+
+ref_00027380:
+dd 0x00000530
+dd 0x00000540
+dd 0x00000550
+dd 0x00000560
+
+ref_00027390:
+dd 0x00000480
+dd 0x00000490
+dd 0x000004a0
+dd 0x000004b0
+dd 0x000004c0
+dd 0x000004d0
+dd 0x000004e0
+dd 0x000004f0
+dd 0x00000500
+dd 0x00000510
+dd 0x00000520
+
+ref_000273bc:
+dd 0x00000510
+dd 0x00000520
+dd 0x00000530
+dd 0x00000540
+
+ref_000273cc:
+dd 0x00000570
+dd 0x00000580
+dd 0x00000590
+dd 0x000005a0
+dd 0x000005b0
+dd 0x000005c0
+
+ref_000273e4:
+dd 0x00000480
+dd 0x00000490
+dd 0x000004a0
+dd 0x000004b0
+dd 0x000004c0
+dd 0x000004d0
+dd 0x000004e0
+dd 0x000004f0
+dd 0x00000500
+
+ref_00027408:
+dd 0x00000480
+dd 0x00000490
+dd 0x000004a0
+dd 0x000004b0
+dd 0x000004c0
+dd 0x000004d0
+dd 0x000004e0
+dd 0x000004f0
+dd 0x00000500
+dd 0x00000510
+dd 0x00000520
+dd 0x00000530
+dd 0x00000540
+dd 0x00000550
+dd 0x00000560
+
+ref_00027444:
+dd 0x00000000
+dd 0xea002554
+dd 0xffffc0ff
+dd 0x00000000
+dd 0xea002558
+dd 0xffffffc0
+dd 0x00000001
+dd 0xea002754
+dd 0xffffc0ff
+dd 0x00000001
+dd 0xea002758
+dd 0xffffffc0
+dd 0x00000002
+dd 0xea000954
+dd 0xffffc0ff
+dd 0x00000002
+dd 0xea000958
+dd 0xffffffc0
+dd 0x00000003
+dd 0xea000b54
+dd 0xffffc0ff
+dd 0x00000003
+dd 0xea000b58
+dd 0xffffffc0
+dd 0x00010000
+dd 0xea002554
+dd 0xc0ffffc0
+dd 0x00010001
+dd 0xea002754
+dd 0xc0ffffc0
+dd 0x00010002
+dd 0xea000954
+dd 0xc0ffffc0
+dd 0x00010003
+dd 0xea000b54
+dd 0xc0ffffc0
+dd 0x00020000
+dd 0xea002550
+dd 0xc0ffffff
+dd 0x00020000
+dd 0xea002554
+dd 0xffc0ffff
+dd 0x00020001
+dd 0xea002750
+dd 0xc0ffffff
+dd 0x00020001
+dd 0xea002754
+dd 0xffc0ffff
+dd 0x00020002
+dd 0xea000950
+dd 0xc0ffffff
+dd 0x00020002
+dd 0xea000954
+dd 0xffc0ffff
+dd 0x00020003
+dd 0xea000b50
+dd 0xc0ffffff
+dd 0x00020003
+dd 0xea000b54
+dd 0xffc0ffff
+
+ref_00027534:
+dd 0x00000004
+dd 0xea002154
+dd 0xffffc0ff
+dd 0x00000004
+dd 0xea002158
+dd 0xffffffc0
+dd 0x00000005
+dd 0xea002354
+dd 0xffffc0ff
+dd 0x00000005
+dd 0xea002358
+dd 0xffffffc0
+dd 0x00010004
+dd 0xea002154
+dd 0xc0ffffc0
+dd 0x00010005
+dd 0xea002354
+dd 0xc0ffffc0
+dd 0x00020004
+dd 0xea002150
+dd 0xc0ffffff
+dd 0x00020004
+dd 0xea002154
+dd 0xffc0ffff
+dd 0x00020005
+dd 0xea002350
+dd 0xc0ffffff
+dd 0x00020005
+dd 0xea002354
+dd 0xffc0ffff
+
+ref_000275ac:
+dd 0xea002490
+dd 0xffff0000
+dd 0x00003e67
+dd 0xea002690
+dd 0xffff0000
+dd 0x00003e67
+dd 0xea000890
+dd 0xffff0000
+dd 0x00003e67
+dd 0xea000a90
+dd 0xffff0000
+dd 0x00003e67
+
+ref_000275dc:
+dd 0xea002090
+dd 0xffff0000
+dd 0x00003e67
+dd 0xea002290
+dd 0xffff0000
+dd 0x00003e67
+
+ref_000275f4:
+dd 0xea002490
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea002690
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea000890
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea000a90
+dd 0xffff0000
+dd 0x00004c5a
+
+ref_00027624:
+dd 0xea002090
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea002290
+dd 0xffff0000
+dd 0x00004c5a
+
+ref_0002763c:
+dd 0xe9002e08
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9002c08
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9002a08
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9002808
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9002608
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9002408
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9002208
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9002008
+dd 0x0ffffeff
+dd 0xe0000100
+
+ref_0002769c:
+dd 0xe90031cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe90033cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe90015cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe90017cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe9003168
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe9003368
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe9001568
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe9001768
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe900316c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900336c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900156c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900176c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900314c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe900334c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe900154c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe900174c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe9003114
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9003314
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9001514
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9001714
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9003164
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9003364
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9001564
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9001764
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9003170
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9003370
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9001570
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9001770
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9003038
+dd 0xc0fffff0
+dd 0x0700000b
+dd 0xe9003238
+dd 0xc0fffff0
+dd 0x0700000b
+dd 0xe9001438
+dd 0xc0fffff0
+dd 0x0700000b
+dd 0xe9001638
+dd 0xc0fffff0
+dd 0x0700000b
+dd 0xe9003140
+dd 0xff7fffff
+dd 0x00000000
+dd 0xe9003340
+dd 0xff7fffff
+dd 0x00000000
+dd 0xe9001540
+dd 0xff7fffff
+dd 0x00000000
+dd 0xe9001740
+dd 0xff7fffff
+dd 0x00000000
+
+ref_0002784c:
+dd 0xe9002c2c
+dd 0xfffff8ff
+dd 0x00000100
+dd 0xe9002e2c
+dd 0xfffff8ff
+dd 0x00000100
+dd 0xe9002dcc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe9002fcc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe9002d68
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe9002f68
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe9002d6c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe9002f6c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe9002d4c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe9002f4c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe9002d14
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002f14
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002d64
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002f64
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002d70
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002f70
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002c38
+dd 0xc0fffff0
+dd 0x0700000b
+dd 0xe9002e38
+dd 0xc0fffff0
+dd 0x0700000b
+dd 0xe9002d40
+dd 0xff7fffff
+dd 0x00000000
+dd 0xe9002f40
+dd 0xff7fffff
+dd 0x00000000
+
+ref_0002793c:
+dd 0xea008008
+dd 0x00ffffff
+dd 0x1c000000
+dd 0xea002408
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002608
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea000808
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea000a08
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002438
+dd 0xc0fffff0
+dd 0x0700000d
+dd 0xea002638
+dd 0xc0fffff0
+dd 0x0700000d
+dd 0xea000838
+dd 0xc0fffff0
+dd 0x0700000d
+dd 0xea000a38
+dd 0xc0fffff0
+dd 0x0700000d
+dd 0xea002440
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002640
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea000840
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea000a40
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002410
+dd 0x0000ffff
+dd 0x0d510000
+dd 0xea002610
+dd 0x0000ffff
+dd 0x0d510000
+dd 0xea000810
+dd 0x0000ffff
+dd 0x0d510000
+dd 0xea000a10
+dd 0x0000ffff
+dd 0x0d510000
+dd 0xea00242c
+dd 0xfffdf7ff
+dd 0x00020000
+dd 0xea00262c
+dd 0xfffdf7ff
+dd 0x00020000
+dd 0xea00082c
+dd 0xfffdf7ff
+dd 0x00020000
+dd 0xea000a2c
+dd 0xfffdf7ff
+dd 0x00020000
+dd 0xea002418
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002618
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea000818
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea000a18
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002400
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002600
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea000800
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea000a00
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002428
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea002628
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea000828
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea000a28
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea00241c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00261c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00081c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea000a1c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00248c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea00268c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea00088c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea000a8c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea0024a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0026a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0008a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea000aa4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0024ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea0026ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea0008ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea000aac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea002540
+dd 0xff000000
+dd 0x00140718
+dd 0xea002740
+dd 0xff000000
+dd 0x00140718
+dd 0xea000940
+dd 0xff000000
+dd 0x00140718
+dd 0xea000b40
+dd 0xff000000
+dd 0x00140718
+dd 0xea002544
+dd 0xff000000
+dd 0x00140998
+dd 0xea002744
+dd 0xff000000
+dd 0x00140998
+dd 0xea000944
+dd 0xff000000
+dd 0x00140998
+dd 0xea000b44
+dd 0xff000000
+dd 0x00140998
+dd 0xea002548
+dd 0xff000000
+dd 0x00140998
+dd 0xea002748
+dd 0xff000000
+dd 0x00140998
+dd 0xea000948
+dd 0xff000000
+dd 0x00140998
+dd 0xea000b48
+dd 0xff000000
+dd 0x00140998
+dd 0xea00257c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00277c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00097c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea000b7c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea002578
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea002778
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea000978
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea000b78
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea00250c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea00270c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea00090c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea000b0c
+dd 0xffc7fff0
+dd 0x00000005
+
+ref_00027ca8:
+dd 0xea002008
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002208
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002038
+dd 0xc0fffff0
+dd 0x0700000d
+dd 0xea002238
+dd 0xc0fffff0
+dd 0x0700000d
+dd 0xea00202c
+dd 0xfffdf0ff
+dd 0x00020100
+dd 0xea00222c
+dd 0xfffdf0ff
+dd 0x00020100
+dd 0xea002040
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002240
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002010
+dd 0x0000ffff
+dd 0x0d510000
+dd 0xea002210
+dd 0x0000ffff
+dd 0x0d510000
+dd 0xea002018
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002218
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002000
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002200
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002028
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea002228
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea00201c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00221c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00208c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea00228c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea0020a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0022a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0020ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea0022ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea002140
+dd 0xff000000
+dd 0x00140718
+dd 0xea002340
+dd 0xff000000
+dd 0x00140718
+dd 0xea002144
+dd 0xff000000
+dd 0x00140998
+dd 0xea002344
+dd 0xff000000
+dd 0x00140998
+dd 0xea002148
+dd 0xff000000
+dd 0x00140998
+dd 0xea002348
+dd 0xff000000
+dd 0x00140998
+dd 0xea00217c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00237c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea002178
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea002378
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea00210c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea00230c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0x032c599d
+dd 0x00c02c29
+dd 0xeb0f000a
+dd 0x0a00822c
+dd 0x40e90f00
+dd 0x88059cc1
+dd 0xc098e900
+dd 0x1f203b41
+dd 0x41c098eb
+dd 0xe91f203b
+dd 0x3b41c098
+dd 0x2cea1f20
+dd 0x000a0082
+dd 0xc030ea0f
+dd 0x00000f00
+dd 0x00c030eb
+dd 0xe900000f
+dd 0x6055c094
+dd 0x30eb4740
+dd 0x000f00c0
+dd 0x8340ea00
+dd 0x0088059c
+dd 0x80c178ea
+dd 0xeb000019
+dd 0x6055c094
+dd 0x94e94740
+dd 0x406055c0
+dd 0xc088ea47
+dd 0x5580983a
+dd 0x80c178eb
+dd 0xe9000019
+dd 0x983ac088
+dd 0x88e95580
+dd 0x80983a82
+dd 0xc08cea55
+dd 0x0c782046
+dd 0x46c08ceb
+dd 0xe90c7820
+dd 0x2046828c
+dd 0x78ea0c78
+dd 0x001980c1
+dd 0xc1ccea00
+dd 0x38254304
+dd 0x04c1cce9
+dd 0xeb382543
+dd 0x4304c1cc
+dd 0x7cea3825
+dd 0xa02400c1
+dd 0xc17ce94e
+dd 0x3ec02400
+dd 0x00c17ceb
+dd 0xea3ec024
+dd 0x05acc140
+dd 0x90eb0088
+dd 0x3e5155c0
+dd 0xc090eb2b
+dd 0x2b3e5155
+dd 0x558290e9
+dd 0xea2b3e51
+dd 0xa000c008
+dd 0x08e9b000
+dd 0x00a000c0
+dd 0xc144eab0
+dd 0x00840394
+dd 0x94c144eb
+dd 0xe9008403
+dd 0x03948344
+dd 0x38ea0084
+dd 0xce0032c0
+dd 0xc038eb38
+dd 0x38ce0032
+dd 0x32c038e9
+dd 0xea38ce00
+
+ref_00027f7c:
+dd 0x00000003
+dd 0xea002154
+dd 0xffffc0ff
+dd 0x00000003
+dd 0xea002158
+dd 0xffffffc0
+dd 0x00000002
+dd 0xea002354
+dd 0xffffc0ff
+dd 0x00000002
+dd 0xea002358
+dd 0xffffffc0
+dd 0x00000001
+dd 0xea002554
+dd 0xffffc0ff
+dd 0x00000001
+dd 0xea002558
+dd 0xffffffc0
+dd 0x00000000
+dd 0xea002754
+dd 0xffffc0ff
+dd 0x00000000
+dd 0xea002758
+dd 0xffffffc0
+dd 0x00010003
+dd 0xea002154
+dd 0xc0ffffc0
+dd 0x00010002
+dd 0xea002354
+dd 0xc0ffffc0
+dd 0x00010001
+dd 0xea002554
+dd 0xc0ffffc0
+dd 0x00010000
+dd 0xea002754
+dd 0xc0ffffc0
+dd 0x00020003
+dd 0xea002150
+dd 0xc0ffffff
+dd 0x00020003
+dd 0xea002154
+dd 0xffc0ffff
+dd 0x00020002
+dd 0xea002350
+dd 0xc0ffffff
+dd 0x00020002
+dd 0xea002354
+dd 0xffc0ffff
+dd 0x00020001
+dd 0xea002550
+dd 0xc0ffffff
+dd 0x00020001
+dd 0xea002554
+dd 0xffc0ffff
+dd 0x00020000
+dd 0xea002750
+dd 0xc0ffffff
+dd 0x00020000
+dd 0xea002754
+dd 0xffc0ffff
+
+ref_0002806c:
+dd 0xea002090
+dd 0xffff0000
+dd 0x00003e67
+dd 0xea002290
+dd 0xffff0000
+dd 0x00003e67
+dd 0xea002490
+dd 0xffff0000
+dd 0x00003e67
+dd 0xea002690
+dd 0xffff0000
+dd 0x00003e67
+
+ref_0002809c:
+dd 0xea002090
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea002290
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea002490
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea002690
+dd 0xffff0000
+dd 0x00004c5a
+
+ref_000280cc:
+dd 0xe9000808
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9000a08
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9000c08
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9000e08
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9001008
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9001208
+dd 0x0ffffeff
+dd 0xe0000100
+
+ref_00028114:
+dd 0xea008008
+dd 0x00ffffff
+dd 0x1c000000
+dd 0xea002008
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002208
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002408
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002608
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002038
+dd 0xfffffff0
+dd 0x0000000d
+dd 0xea002238
+dd 0xfffffff0
+dd 0x0000000d
+dd 0xea002438
+dd 0xfffffff0
+dd 0x0000000d
+dd 0xea002638
+dd 0xfffffff0
+dd 0x0000000d
+dd 0xea00202c
+dd 0xfffdf0ff
+dd 0x00020100
+dd 0xea00222c
+dd 0xfffdf0ff
+dd 0x00020100
+dd 0xea00242c
+dd 0xfffdf0ff
+dd 0x00020100
+dd 0xea00262c
+dd 0xfffdf0ff
+dd 0x00020100
+dd 0xea002040
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002240
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002440
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002640
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002010
+dd 0x0000ffff
+dd 0x55510000
+dd 0xea002210
+dd 0x0000ffff
+dd 0x55510000
+dd 0xea002410
+dd 0x0000ffff
+dd 0x55510000
+dd 0xea002610
+dd 0x0000ffff
+dd 0x55510000
+dd 0xea002140
+dd 0xff000000
+dd 0x00140718
+dd 0xea002340
+dd 0xff000000
+dd 0x00140718
+dd 0xea002540
+dd 0xff000000
+dd 0x00140718
+dd 0xea002740
+dd 0xff000000
+dd 0x00140718
+dd 0xea002144
+dd 0xff000000
+dd 0x00140998
+dd 0xea002344
+dd 0xff000000
+dd 0x00140998
+dd 0xea002544
+dd 0xff000000
+dd 0x00140998
+dd 0xea002744
+dd 0xff000000
+dd 0x00140998
+dd 0xea002148
+dd 0xff000000
+dd 0x00140998
+dd 0xea002348
+dd 0xff000000
+dd 0x00140998
+dd 0xea002548
+dd 0xff000000
+dd 0x00140998
+dd 0xea002748
+dd 0xff000000
+dd 0x00140998
+dd 0xea00217c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00237c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00257c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00277c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00208c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea00228c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea00248c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea00268c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea0020a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0022a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0024a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0026a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0020ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea0022ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea0024ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea0026ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea002018
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002218
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002418
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002618
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002000
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002200
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002400
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002600
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002028
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea002228
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea002428
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea002628
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea00201c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00221c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00241c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00261c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea002178
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea002378
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea002578
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea002778
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea00210c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea00230c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea00250c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea00270c
+dd 0xffc7fff0
+dd 0x00000005
+
+ref_00028480:
+dd 0xe90025cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe90027cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe9002568
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe9002768
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe900242c
+dd 0xfffff8ff
+dd 0x00000100
+dd 0xe900262c
+dd 0xfffff8ff
+dd 0x00000100
+dd 0xe900256c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900276c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900254c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe900274c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe9002564
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002764
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002570
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002770
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002514
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002714
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002438
+dd 0xfffffff0
+dd 0x0000000b
+dd 0xe9002638
+dd 0xfffffff0
+dd 0x0000000b
+dd 0xe9002414
+dd 0xffff01ff
+dd 0x00006600
+dd 0xe9002614
+dd 0xffff01ff
+dd 0x00006600
+dd 0xe9002540
+dd 0xff7fffff
+dd 0x00000000
+dd 0xe9002740
+dd 0xff7fffff
+dd 0x00000000
+
+ref_00028588:
+dd 0xe90021cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe90023cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe9002168
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe9002368
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe900216c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900236c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900214c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe900234c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe9002164
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002364
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002170
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002370
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002114
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002314
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002038
+dd 0xfffffff0
+dd 0x0000000b
+dd 0xe9002238
+dd 0xfffffff0
+dd 0x0000000b
+dd 0xe9002014
+dd 0xffff01ff
+dd 0x00006600
+dd 0xe9002214
+dd 0xffff01ff
+dd 0x00006600
+dd 0xe9002140
+dd 0xff7fffff
+dd 0x00000000
+dd 0xe9002340
+dd 0xff7fffff
+dd 0x00000000
+dd 0x1119fbc2
+dd 0x09c00c20
+dd 0xe9072237
+dd 0x3709c00c
+dd 0x2cea0722
+dd 0x000a0082
+dd 0xc140e90f
+dd 0x0088059c
+dd 0x00c02cea
+dd 0xea0f000a
+dd 0x3b41c098
+dd 0x30e91f20
+dd 0x000f00c0
+dd 0xc098e900
+dd 0x1f203b41
+dd 0x9cc140ea
+dd 0xe9008805
+dd 0x6055c094
+dd 0x30e94740
+dd 0x000f00c0
+dd 0xc178ea00
+dd 0x00001980
+dd 0x55c094e9
+dd 0xea474060
+dd 0x1980c178
+dd 0x88ea0000
+dd 0x80983ac0
+dd 0xc088e955
+dd 0x5580983a
+dd 0x46c08cea
+dd 0xe90c7820
+dd 0x2046c08c
+dd 0x90ea0c78
+dd 0x3e5155c0
+dd 0xc090e92b
+dd 0x2b3e5155
+dd 0x04c1ccea
+dd 0xe9380043
+dd 0x2400c17c
+dd 0xcce94ea0
+dd 0x004304c1
+dd 0xc17cea38
+dd 0x3ec02400
+dd 0x00c1c4ea
+dd 0xea000002
+dd 0x0200c1c4
+dd 0x08e90000
+dd 0x00a000c0
+dd 0xc008e9b0
+dd 0xb000a000
+dd 0x94c144ea
+dd 0xe9008403
+dd 0x0394c144
+dd 0x0cea0084
+dd 0x221709c0
+dd 0xc00ce907
+dd 0x07221709
+dd 0x000000ea
+
+ref_00028760:
+dd 0x00000003
+dd 0xea002154
+dd 0xffffc0ff
+dd 0x00000003
+dd 0xea002158
+dd 0xffffffc0
+dd 0x00000002
+dd 0xea002354
+dd 0xffffc0ff
+dd 0x00000002
+dd 0xea002358
+dd 0xffffffc0
+dd 0x00000001
+dd 0xea002554
+dd 0xffffc0ff
+dd 0x00000001
+dd 0xea002558
+dd 0xffffffc0
+dd 0x00000000
+dd 0xea002754
+dd 0xffffc0ff
+dd 0x00000000
+dd 0xea002758
+dd 0xffffffc0
+dd 0x00010003
+dd 0xea002154
+dd 0xc0ffffc0
+dd 0x00010002
+dd 0xea002354
+dd 0xc0ffffc0
+dd 0x00010001
+dd 0xea002554
+dd 0xc0ffffc0
+dd 0x00010000
+dd 0xea002754
+dd 0xc0ffffc0
+dd 0x00020003
+dd 0xea002150
+dd 0xc0ffffff
+dd 0x00020003
+dd 0xea002154
+dd 0xffc0ffff
+dd 0x00020002
+dd 0xea002350
+dd 0xc0ffffff
+dd 0x00020002
+dd 0xea002354
+dd 0xffc0ffff
+dd 0x00020001
+dd 0xea002550
+dd 0xc0ffffff
+dd 0x00020001
+dd 0xea002554
+dd 0xffc0ffff
+dd 0x00020000
+dd 0xea002750
+dd 0xc0ffffff
+dd 0x00020000
+dd 0xea002754
+dd 0xffc0ffff
+
+ref_00028850:
+dd 0xe9000808
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9000a08
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9000c08
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9000e08
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9001008
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9001208
+dd 0x0ffffeff
+dd 0xe0000100
+
+ref_00028898:
+dd 0xea008008
+dd 0x00ffffff
+dd 0x1c000000
+dd 0xea002008
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002208
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002408
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002608
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002038
+dd 0xfffffff0
+dd 0x0000000d
+dd 0xea002238
+dd 0xfffffff0
+dd 0x0000000d
+dd 0xea002438
+dd 0xfffffff0
+dd 0x0000000d
+dd 0xea002638
+dd 0xfffffff0
+dd 0x0000000d
+dd 0xea00202c
+dd 0xfffdf8ff
+dd 0x00020100
+dd 0xea00222c
+dd 0xfffdf8ff
+dd 0x00020100
+dd 0xea00242c
+dd 0xfffdf8ff
+dd 0x00020100
+dd 0xea00262c
+dd 0xfffdf8ff
+dd 0x00020100
+dd 0xea002040
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002240
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002440
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002640
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002010
+dd 0x0000ffff
+dd 0x55510000
+dd 0xea002210
+dd 0x0000ffff
+dd 0x55510000
+dd 0xea002410
+dd 0x0000ffff
+dd 0x55510000
+dd 0xea002610
+dd 0x0000ffff
+dd 0x55510000
+dd 0xea002140
+dd 0xff000000
+dd 0x00140718
+dd 0xea002340
+dd 0xff000000
+dd 0x00140718
+dd 0xea002540
+dd 0xff000000
+dd 0x00140718
+dd 0xea002740
+dd 0xff000000
+dd 0x00140718
+dd 0xea002144
+dd 0xff000000
+dd 0x00140998
+dd 0xea002344
+dd 0xff000000
+dd 0x00140998
+dd 0xea002544
+dd 0xff000000
+dd 0x00140998
+dd 0xea002744
+dd 0xff000000
+dd 0x00140998
+dd 0xea002148
+dd 0xff000000
+dd 0x00140998
+dd 0xea002348
+dd 0xff000000
+dd 0x00140998
+dd 0xea002548
+dd 0xff000000
+dd 0x00140998
+dd 0xea002748
+dd 0xff000000
+dd 0x00140998
+dd 0xea00217c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00237c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00257c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00277c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00208c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea00228c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea00248c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea00268c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea0020a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0022a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0024a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0026a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0020ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea0022ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea0024ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea0026ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea002090
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea002290
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea002490
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea002690
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea002018
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002218
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002418
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002618
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002000
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002200
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002400
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002600
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002028
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea002228
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea002428
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea002628
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea00201c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00221c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00241c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00261c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea002178
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea002378
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea002578
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea002778
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea00210c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea00230c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea00250c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea00270c
+dd 0xffc7fff0
+dd 0x00000005
+
+ref_00028c34:
+dd 0xe90025cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe90027cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe9002568
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe9002768
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe900242c
+dd 0xfffff8ff
+dd 0x00000100
+dd 0xe900262c
+dd 0xfffff8ff
+dd 0x00000100
+dd 0xe900256c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900276c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900254c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe900274c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe9002564
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002764
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002570
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002770
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002514
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002714
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002438
+dd 0xfffffff0
+dd 0x0000000b
+dd 0xe9002638
+dd 0xfffffff0
+dd 0x0000000b
+dd 0xe9002414
+dd 0xffff01ff
+dd 0x00006600
+dd 0xe9002614
+dd 0xffff01ff
+dd 0x00006600
+dd 0xe9002490
+dd 0xffff00ff
+dd 0x00004100
+dd 0xe9002690
+dd 0xffff00ff
+dd 0x00004100
+dd 0xe9002540
+dd 0xff7fffff
+dd 0x00000000
+dd 0xe9002740
+dd 0xff7fffff
+dd 0x00000000
+
+ref_00028d54:
+dd 0xe90021cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe90023cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe9002168
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe9002368
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe900216c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900236c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900214c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe900234c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe9002164
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002364
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002170
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002370
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002114
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002314
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002038
+dd 0xfffffff0
+dd 0x0000000b
+dd 0xe9002238
+dd 0xfffffff0
+dd 0x0000000b
+dd 0xe9002014
+dd 0xffff01ff
+dd 0x00006600
+dd 0xe9002214
+dd 0xffff01ff
+dd 0x00006600
+dd 0xe9002090
+dd 0xffff00ff
+dd 0x00004100
+dd 0xe9002290
+dd 0xffff00ff
+dd 0x00004100
+dd 0xe9002140
+dd 0xff7fffff
+dd 0x00000000
+dd 0xe9002340
+dd 0xff7fffff
+dd 0x00000000
+dd 0x2201fbc2
+dd 0x09c00c20
+dd 0xe9072237
+dd 0x3709c00c
+dd 0x2cea0722
+dd 0x000a0082
+dd 0xc140e90f
+dd 0x0088059c
+dd 0x00c02cea
+dd 0xea0f000a
+dd 0x3b41c098
+dd 0x30e91f20
+dd 0x000f00c0
+dd 0xc098e900
+dd 0x1f203b41
+dd 0x9cc140ea
+dd 0xe9008805
+dd 0x6055c094
+dd 0x30e94740
+dd 0x000f00c0
+dd 0xc178ea00
+dd 0x00001980
+dd 0x55c094e9
+dd 0xea474060
+dd 0x1980c178
+dd 0x88ea0000
+dd 0x80983ac0
+dd 0xc088e955
+dd 0x5580983a
+dd 0x46c08cea
+dd 0xe90c7820
+dd 0x2046c08c
+dd 0x90ea0c78
+dd 0x3e5155c0
+dd 0xc090e92b
+dd 0x2b3e5155
+dd 0x04c1ccea
+dd 0xe9380043
+dd 0x2400c17c
+dd 0xcce94ea0
+dd 0x004304c1
+dd 0xc17cea38
+dd 0x3ec02400
+dd 0x00c1c4ea
+dd 0xea000002
+dd 0x0200c1c4
+dd 0x08e90000
+dd 0x00a000c0
+dd 0xc008e9b0
+dd 0xb000a000
+dd 0x94c144ea
+dd 0xe9008403
+dd 0x0394c144
+dd 0x0cea0084
+dd 0x221709c0
+dd 0xc00ce907
+dd 0x07221709
+dd 0x000000ea
+dd 0xcb000240
+dd 0xffffffc3
+dd 0x00000008
+dd 0xcb000248
+dd 0xffffffc3
+dd 0x0000000c
+dd 0xcb000250
+dd 0xffffffc3
+dd 0x0000000c
+dd 0xcb000258
+dd 0xffffffc3
+dd 0x0000000c
+dd 0xcb000260
+dd 0xffffffc3
+dd 0x0000000c
+dd 0xcb000268
+dd 0xffffffc3
+dd 0x00000010
+dd 0xcb000270
+dd 0xffffffc3
+dd 0x00000010
+dd 0xcb000240
+dd 0xfff3ffff
+dd 0x00040000
+dd 0xcb000248
+dd 0xfff3ffff
+dd 0x00040000
+dd 0xcb000250
+dd 0xfff3ffff
+dd 0x00040000
+dd 0xcb000258
+dd 0xfff3ffff
+dd 0x00040000
+dd 0xcb000260
+dd 0xfff3ffff
+dd 0x00040000
+dd 0xcb000268
+dd 0xfff3ffff
+dd 0x00040000
+dd 0xcb000270
+dd 0xfff3ffff
+dd 0x00040000
+dd 0xcb000014
+dd 0xffff9fff
+dd 0x00002000
+
+ref_00028ff8:
+dd 0xb3e123d0
+dd 0x4db47a1e
+dd 0xd4be66af
+dd 0x38669c1e
+
+ref_00029008:
+dd 0x524ed3ca
+dd 0x49f5b250
+dd 0xbaa2d994
+dd 0x140ec7ff
+dd 0xc1392859
+dd 0x446e1f65
+dd 0x3584f5b3
+dd 0xc4d1c7fc
+
+ref_00029028:
+dd 0x80000010
+dd ref_000290cc
+dd ref_00029034
+
+ref_00029034:
+dd 0x00000000
+dd fcn_000165b9
+
+ref_0002903c:
+dd 0x564b33cd
+dd 0x4593c92a
+dd 0x7324bf90
+dd 0x22633ce4
+
+ref_0002904c:
+dd 0x4ed4bf27
+dd 0x42e94092
+dd 0x7b527d80
+dd 0xbdc9001d
+
+ref_0002905c:
+dd 0xf8e21975
+dd 0x4f580899
+dd 0x2555bea4
+dd 0x7ad7c6a9
+
+ref_0002906c:
+dd 0x8c8ce578
+dd 0x4f1c8a3d
+dd 0x61893599
+dd 0xd32dc385
+
+ref_0002907c:
+dd 0x49edb1c1
+dd 0x4761bf21
+dd 0x00eb12bb
+dd 0x39bbaa31
+
+ref_0002908c:
+dd 0x605ea650
+dd 0x42e1c65c
+dd 0xa59180ba
+dd 0xc618b62a
+
+ref_0002909c:
+dd 0xf894643d
+dd 0x42d1c449
+dd 0xbd85a88e
+dd 0xde5bc6d8
+
+ref_000290ac:
+dd 0xe6af1f7b
+dd 0x46dafc3f
+dd 0xb4a328a8
+dd 0x8242a457
+
+ref_000290bc:
+dd 0x9ca93627
+dd 0x4324b65b
+dd 0xb4c002a2
+dd 0x43457661
+
+ref_000290cc:
+dd 0x1f4c6f90
+dd 0x48d8b06b
+dd 0xe5ba01a2
+dd 0x567dcdf1
+dd 0xde8f2878
+dd 0x498e36d5
+dd 0x8c1659ba
+dd 0x35b34726
+dd 0xc4d6994a
+dd 0x47c0aa3d
+dd 0xbfb00aae
+dd 0x13a6baad
+dd 0xd0a2562e
+dd 0x4a7ca1b1
+dd 0xc7c85297
+dd 0x466cfcbb
+dd 0x3d0e663a
+dd 0x4489dc72
+dd 0x9ee4c587
+dd 0x52a473e7
+
+ref_0002911c:
+dd 0xaf4a1998
+dd 0x45454949
+dd 0xe7c14c9c
+dd 0x56e042c0
+
+ref_0002912c:
+dd 0x220307a4
+dd 0x42a53670
+dd 0x9d3201aa
+dd 0x6b913ecd
+
+ref_0002913c:
+dd 0x433e0f9f
+dd 0x410a05ae
+dd 0x29bfc3a0
+dd 0xac25cb8e
+
+ref_0002914c:
+dd 0x1edcbdf9
+dd 0x4bd4ffc6
+dd 0x5d19f694
+dd 0x5670e11d
+
+ref_0002915c:
+dd 0x17865dc0
+dd 0x4da80b8b
+dd 0x467c428b
+dd 0x4dca5cb8
+dd 0x63b6e435
+dd 0x49c632bc
+dd 0xa1b7bd81
+dd 0x6c1afea0
+
+ref_0002917c:
+dd 0xed097352
+dd 0x445a9041
+dd 0x9db2b680
+dd 0x45889e50
+dd 0xfbf26154
+dd 0x4bdc4e55
+dd 0x18d97baf
+dd 0x613f44ac
+
+ref_0002919c:
+dd 0xf38d1338
+dd 0x4fb6af7a
+dd 0x9c1adb91
+dd 0x0d578321
+
+ref_000291ac:
+dd 0x908c7f8b
+dd 0x47fb5c48
+dd 0xfdf55783
+dd 0x7652234e
+
+ref_000291bc:
+dd 0xc02b0573
+dd 0x4a312b4e
+dd 0x56941aa3
+dd 0x2c44507b
+dd 0x3bc1f6de
+dd 0x4547693e
+dd 0x822100a3
+dd 0xb220a43c
+
+ref_000291dc:
+dd 0x50031131
+dd 0x43ef4f24
+dd 0x3773afb7
+dd 0xac0ef794
+dd 0xe806424f
+dd 0x4b1ad425
+dd 0x695f26bc
+dd 0x5aa18903
+
+ref_000291fc:
+dd 0x794a0deb
+dd 0x4e7bc971
+dd 0xbfd0f28a
+dd 0x9826ca3c
+
+ref_0002920c:
+dd 0x98191174
+dd 0x41060b26
+dd 0x45d002af
+dd 0x2b05e851
+dd 0x21d56275
+dd 0x405ff984
+dd 0x08ea0b9f
+dd 0x7e0aef4d
+dd 0x881807d2
+dd 0x4ec998d1
+dd 0x4677a0af
+dd 0x49242fc4
+dd 0x2549016d
+dd 0x4d002b17
+dd 0x441da4b5
+dd 0xf838013a
+dd 0x7408d748
+dd 0x4ee6fc8c
+dd 0xbec48892
+dd 0x10a492c0
+dd 0x38cdd10b
+dd 0x4f6e767d
+dd 0xee6744a7
+dd 0xa52ffe1d
+dd 0xe9db0d58
+dd 0x47f6d48d
+dd 0x406f6e9c
+dd 0x417b6ce8
+dd 0x09be4bc2
+dd 0x4dea790e
+dd 0x0538dc8b
+dd 0x44399816
+
+ref_0002928c:
+dd 0xf8d5438e
+dd 0x481d26e1
+dd 0xd6303cb6
+dd 0x20a4f4ef
+dd 0x9a7ef41e
+dd 0x4bd1c140
+dd 0x111e84b8
+dd 0xe64c0b24
+dd 0x30eb2979
+dd 0x4d60b0f7
+dd 0x2c1adcb2
+dd 0xf4b1ce96
+dd 0x3acf33ee
+dd 0x40f4d892
+dd 0x5438fca2
+dd 0x3d32e1d2
+dd 0xb6ec423c
+dd 0x490d21d2
+dd 0x58ddc685
+dd 0x74a6ea64
+dd 0x268f33a9
+dd 0x48becccd
+dd 0x05861788
+dd 0xd62ec33a
+dd 0x55750d10
+dd 0x4bf56d3d
+dd 0x5ee3d889
+dd 0xf490b0f0
+dd 0x99b56126
+dd 0x4d9be16c
+dd 0x35aa71bb
+dd 0x2f701a46
+
+ref_0002930c:
+dd 0x573eaf99
+dd 0x46b5f445
+dd 0x4abcd5a5
+dd 0xf3983593
+
+ref_0002931c:
+dd 0x09ea8911
+dd 0x4230be0d
+dd 0xc6ed03a0
+dd 0x118eb493
+
+ref_0002932c:
+dd 0x3e14d361
+dd 0x42e4c7d7
+dd 0xebb907ae
+dd 0x2aed9648
+dd 0x61c68702
+dd 0x4f434d7e
+dd 0x43a7ef8d
+dd 0xc574ce05
+dd 0xd3bfe2de
+dd 0x11df3daf
+dd 0xa5e340ba
+dd 0x9395d856
+dd 0x69a20012
+dd 0x4e35b167
+dd 0xee9899a9
+dd 0x2ef03508
+dd 0xfa2ddc38
+dd 0x42183f19
+dd 0xd7d93eb5
+dd 0x6767629d
+dd 0xf9f0b131
+dd 0x4f16f346
+dd 0x41f9dd80
+dd 0x7d3a2b07
+dd 0x60ac3a8f
+dd 0x4cd44d66
+dd 0xf0c35a89
+dd 0xee65666e
+dd 0xfc5f2e00
+dd 0x11e1fc68
+dd 0x00081fa2
+dd 0x669a0c20
+dd 0x3ea94650
+dd 0x11e1fc5b
+dd 0x00081fa2
+dd 0x669a0c20
+dd 0x707be83e
+dd 0x40a50bf6
+dd 0xc03464be
+dd 0xe2b8a03a
+dd 0xbb929da9
+dd 0x403568f7
+dd 0xbba32cb2
+dd 0x55da233f
+dd 0x7d279373
+dd 0x4d4feecc
+dd 0xc4ce2fae
+dd 0x6ab006b7
+dd 0x1e94f097
+dd 0x40895acd
+dd 0xa5b9e3b2
+dd 0x0ca779c8
+dd 0x4efa0db6
+dd 0x4bb126dc
+dd 0xbc146fa7
+dd 0x3c7b0c63
+dd 0xca0801d3
+dd 0x4decafb1
+dd 0x6593659b
+dd 0x6b93c7ec
+dd 0x9a8f82d5
+dd 0x48da39b1
+dd 0x2da2dc92
+dd 0xf64d83a8
+dd 0x7c66ffdc
+dd 0xe5d4423c
+dd 0xad551b25
+dd 0x982695ba
+dd 0xb441df87
+dd 0x48118d94
+dd 0x9a0ff785
+dd 0x2a9df87b
+dd 0x03fdf171
+dd 0x4ace1d67
+dd 0x363e04a9
+dd 0x74fa38d3
+dd 0x1bad711c
+dd 0x4241d451
+dd 0x3785f3b1
+dd 0x700c2e81
+dd 0x368cda0d
+dd 0x4b9bcf31
+dd 0xd1e7f68c
+dd 0x7e15ffbf
+dd 0xd7ac94af
+dd 0x45eca498
+dd 0x6ea5a2bf
+dd 0x8b613495
+dd 0xacc8e1e4
+dd 0x4e409f9f
+dd 0x9ef97ea5
+dd 0xa54cf352
+dd 0x1bf06aea
+dd 0x4a8d5bec
+dd 0x9b747695
+dd 0x302d5609
+dd 0xbe644001
+dd 0x48b1e7d4
+dd 0xa08b96b0
+dd 0xe77abc47
+dd 0x3d989471
+dd 0x46b7cfac
+dd 0x43081c9b
+dd 0x2d400901
+dd 0x2986883f
+dd 0x48d088e0
+dd 0xc220824b
+dd 0xacdd4869
+dd 0xc38fb0e2
+dd 0x49c90c43
+dd 0x179b44b5
+dd 0xa3cb4daa
+dd 0x5848fd2d
+dd 0x474bd6af
+dd 0xdd957582
+dd 0x23e80ae7
+dd 0x429501d9
+dd 0x40f4e447
+dd 0xc9757b86
+dd 0x4eb51d3a
+dd 0x87f22dcb
+dd 0x41057304
+dd 0x71317cbb
+dd 0x3bc2cc43
+dd 0xc020489e
+dd 0x4ef26db2
+dd 0x06caa59a
+dd 0x6ad311fc
+dd 0xcbcb3817
+dd 0x497e81e6
+dd 0xfac8ff87
+dd 0x28ec248f
+dd 0xaaa99a23
+dd 0x4c3113b6
+dd 0x9e298bbb
+dd 0xa44fc08e
+dd 0xcacb3817
+dd 0x497e81e6
+dd 0xfac8ff87
+dd 0x28ec248f
+
+ref_0002955c:
+dd 0x4c10d934
+dd 0x45a438e6
+dd 0x792a249a
+dd 0x7fcb3db9
+dd 0x27e569d5
+dd 0x4d8f0afc
+dd 0x3a78908c
+dd 0xab18a3c4
+dd 0x711c703f
+dd 0x4b10c285
+dd 0xec36b0a3
+dd 0xe28b3cbd
+dd 0xe39e5bea
+dd 0x45f65f1e
+dd 0xbfd81caf
+dd 0xcd49475f
+dd 0x1ea81bec
+dd 0x4d98f01a
+dd 0x614a01a2
+dd 0x22c02fce
+dd 0x76b6bdfa
+dd 0x44622acd
+dd 0x58cb3f9e
+dd 0x37d969c9
+dd 0x9a4e9246
+dd 0x11d5d553
+dd 0x0600e287
+dd 0xb9c34529
+dd 0x4c19049f
+dd 0x4dd34137
+dd 0x978b109c
+dd 0xfafd3fa8
+dd 0x86cf2b1a
+dd 0x4642b3da
+dd 0x1cd0f595
+dd 0xb8601c6c
+
+ref_000295ec:
+dd 0x08040201
+dd 0x08040201
+dd 0x00000000
+
+ref_000295f8:
+dd 0x08040201
+dd 0x00000000
+dd 0x08040201
+
+ref_00029604:
+dd 0x80000010
+dd ref_000290ac
+dd 0x00000000
+
+ref_00029610:
+dd fcn_0001aa58
+dd fcn_0001ab85
+dd fcn_0001ac9a
+dd fcn_0001ad98
+dd fcn_0001a90b
+dd fcn_0001a91a
+dd fcn_0001a929
+dd fcn_0001a979
+dd fcn_0001a938
+dd fcn_0001a94e
+dd fcn_0001a964
+dd fcn_0001a988
+dd fcn_0001a873
+dd fcn_0001a882
+dd fcn_0001a891
+dd fcn_0001a8a0
+dd fcn_0001a8af
+dd fcn_0001a8c5
+dd fcn_0001a8db
+dd fcn_0001a8f0
+
+ref_00029660:
+dd 0x75736e55
+dd 0x726f7070
+dd 0x20646574
+dd 0x20484350
+dd 0x70657453
+dd 0x676e6970
+dd 0x7553202e
+dd 0x726f7070
+dd 0x676e6974
+dd 0x48435020
+dd 0x65747320
+dd 0x6e697070
+dd 0x74732067
+dd 0x69747261
+dd 0x6620676e
+dd 0x206d6f72
+dd 0x61207325
+dd 0x6120646e
+dd 0x65766f62
+dd 0x9066000a
+
+ref_000296b0:
+dd 0xa6a4a2a0
+
+ref_000296b4:
+dd 0x02353140
+dd 0x20373144
+dd 0x32103146
+dd 0x32163148
+dd 0x3250314c
+dd 0x76543150
+dd 0x00063158
+dd 0x55443164
+dd 0x00073168
+
+ref_000296d8:
+dd 0x02353140
+dd 0x20373144
+dd 0x32103146
+dd 0x32163148
+dd 0x3250314c
+dd 0x76543150
+
+ref_000296f0:
+dd 0x00003100
+dd 0x03203200
+dd 0x00003108
+dd 0x00000001
+dd 0x0000310c
+dd 0x43214321
+dd 0x00003110
+dd 0x00000001
+dd 0x00003118
+dd 0x00000001
+
+ref_00029718:
+dd 0x00003100
+dd 0x03203200
+dd 0x00003108
+dd 0x00000001
+dd 0x0000310c
+dd 0x43214321
+dd 0x00003110
+dd 0x00000001
+dd 0x00003114
+dd 0x00000001
+dd 0x00003118
+dd 0x00000001
+
+ref_00029748:
+dd 0x422b8086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x422c8086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x42388086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x42398086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00828086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00858086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00838086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00848086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00868086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00878086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00888086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00898086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x008f8086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00908086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08ae8086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08af8086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08968086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08978086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08858086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08868086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08948086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08958086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08928086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08938086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08908086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08918086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08878086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08888086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x088e8086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x088f8086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08b58086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08b68086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08b38086
+dd 0x028002ff
+dd 0x01540003
+dd 0x00000003
+dd 0x00000000
+dd 0x00000000
+dd 0x08b38086
+dd 0x028002ff
+dd 0x01580002
+dd 0x00000003
+dd 0x00000000
+dd 0x00000000
+dd 0x08b48086
+dd 0x028002ff
+dd 0x01540003
+dd 0x00000003
+dd 0x00000000
+dd 0x00000000
+dd 0x08b48086
+dd 0x028002ff
+dd 0x01580002
+dd 0x00000003
+dd 0x00000000
+dd 0x00000000
+dd 0x08b18086
+dd 0x028002ff
+dd 0x01540003
+dd 0x00000003
+dd 0x00000000
+dd 0x00000000
+dd 0x08b18086
+dd 0x028002ff
+dd 0x01580002
+dd 0x00000003
+dd 0x00000000
+dd 0x00000000
+dd 0x08b28086
+dd 0x028002ff
+dd 0x01540003
+dd 0x00000003
+dd 0x00000000
+dd 0x00000000
+dd 0x08b28086
+dd 0x028002ff
+dd 0x01580002
+dd 0x00000003
+dd 0x00000000
+dd 0x00000000
+dd 0x08b08086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+
+; .bss
+ref_00029b38:
+dd 0x00000000
+
+ref_00029b3c:
+dd 0x00000000
+
+ref_00029b40:
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+
+ref_00029b58:
+dd 0x00000000
+dd 0x00000000
+
+ref_00029b60:
+dd 0x00000000
+
+ref_00029b64:
+dd 0x00000000
+
+ref_00029b68:
+dd 0x00000000
+
+ref_00029b6c:
+dd 0x00000000
+
+ref_00029b70:
+dd 0x00000000
+
+ref_00029b74:
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+
+ref_00029b8c:
+dd 0x00000000
+
+ref_00029b90:
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+
+ref_00029bb4:
+dd 0x00000000
+
+ref_00029bb8:
+dd 0x00000000
+
+ref_00029bbc:
+dd 0x00000000
+
+ref_00029bc0:
+dd 0x00000000
+
+ref_00029bc4:
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+
+ref_00029cb0:
+dd 0x00000000
+
+ref_00029cb4:
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+
+ref_00029da4:
+dd 0x00000000
+dd 0x00000000
+
+ref_00029dac:
+dd 0x00000000
+
+ref_00029db0:
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+
+ref_000312e0:
+dd 0x00000000
+
+ref_000312e4:
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+
+ref_000312f0:
+dd 0x00000000
+dd 0x00000000