add broadwell_refcode.asm

6 files changed, 66473 insertions, 55 deletions

diff --git a/src/soc/intel/broadwell/Kconfig b/src/soc/intel/broadwell/Kconfig
index 5cdfb5488f..ddde4d357b 100644
--- a/src/soc/intel/broadwell/Kconfig
+++ b/src/soc/intel/broadwell/Kconfig
@@ -179,21 +179,4 @@ config SERIRQ_CONTINUOUS_MODE
 	  If you set this option to y, the serial IRQ machine will be
 	  operated in continuous mode.
 
-config HAVE_REFCODE_BLOB
-	depends on ARCH_X86
-	bool "An external reference code blob should be put into cbfs."
-	default n
-	help
-	 The reference code blob will be placed into cbfs.
-
-if HAVE_REFCODE_BLOB
-
-config REFCODE_BLOB_FILE
-	string "Path and filename to reference code blob."
-	default "refcode.elf"
-	help
-	 The path and filename to the file to be added to cbfs.
-
-endif # HAVE_REFCODE_BLOB
-
 endif
diff --git a/src/soc/intel/broadwell/Makefile.inc b/src/soc/intel/broadwell/Makefile.inc
index 55eddf18fd..971a5dc939 100644
--- a/src/soc/intel/broadwell/Makefile.inc
+++ b/src/soc/intel/broadwell/Makefile.inc
@@ -1,6 +1,7 @@
 ifeq ($(CONFIG_SOC_INTEL_BROADWELL),y)
 
 subdirs-y += pch
+subdirs-y += refcode
 
 bootblock-y += bootblock.c
 
@@ -19,7 +20,7 @@ ramstage-y += minihd.c
 ramstage-y += northbridge.c
 ramstage-y += pei_data.c
 romstage-y += pei_data.c
-ramstage-$(CONFIG_HAVE_REFCODE_BLOB) += refcode.c
+ramstage-y += refcode.c
 
 CPPFLAGS_common += -Isrc/soc/intel/broadwell/include
 
diff --git a/src/soc/intel/broadwell/include/soc/ramstage.h b/src/soc/intel/broadwell/include/soc/ramstage.h
index 3900c7339e..13477555c6 100644
--- a/src/soc/intel/broadwell/include/soc/ramstage.h
+++ b/src/soc/intel/broadwell/include/soc/ramstage.h
@@ -6,10 +6,6 @@
 #include <device/device.h>
 #include <soc/intel/broadwell/chip.h>
 
-#if CONFIG(HAVE_REFCODE_BLOB)
 void broadwell_run_reference_code(void);
-#else
-static inline void broadwell_run_reference_code(void) { }
-#endif
 
 #endif
diff --git a/src/soc/intel/broadwell/refcode.c b/src/soc/intel/broadwell/refcode.c
index ae175b0f68..4edadfa7d2 100644
--- a/src/soc/intel/broadwell/refcode.c
+++ b/src/soc/intel/broadwell/refcode.c
@@ -13,37 +13,10 @@
 #include <soc/pm.h>
 #include <soc/ramstage.h>
 
-static pei_wrapper_entry_t load_reference_code(void)
-{
-	if (resume_from_stage_cache()) {
-		struct prog prog;
-		stage_cache_load_stage(STAGE_REFCODE, &prog);
-		return prog_entry(&prog);
-	}
-
-	struct prog prog =
-		PROG_INIT(PROG_REFCODE, CONFIG_CBFS_PREFIX "/refcode");
-	struct rmod_stage_load refcode = {
-		.cbmem_id = CBMEM_ID_REFCODE,
-		.prog = &prog,
-	};
-
-	if (rmodule_stage_load(&refcode)) {
-		printk(BIOS_DEBUG, "Error loading reference code.\n");
-		return NULL;
-	}
-
-	/* Cache loaded reference code. */
-	stage_cache_add(STAGE_REFCODE, &prog);
-
-	return (pei_wrapper_entry_t)prog_entry(&prog);
-}
-
 void broadwell_run_reference_code(void)
 {
 	int ret, dummy;
 	struct pei_data pei_data;
-	pei_wrapper_entry_t entry;
 
 	memset(&pei_data, 0, sizeof(pei_data));
 	mainboard_fill_pei_data(&pei_data);
@@ -52,14 +25,10 @@ void broadwell_run_reference_code(void)
 	pei_data.boot_mode = acpi_is_wakeup_s3() ? ACPI_S3 : 0;
 	pei_data.saved_data = (void *) &dummy;
 
-	entry = load_reference_code();
-	if (entry == NULL) {
-		printk(BIOS_ERR, "Reference code not found\n");
-		return;
-	}
+	extern int ABI_X86 refcode_entry(struct pei_data *pei_data);
 
 	/* Call into reference code. */
-	ret = entry(&pei_data);
+	ret = refcode_entry(&pei_data);
 	if (ret != 0) {
 		printk(BIOS_ERR, "Reference code returned %d\n", ret);
 		return;
diff --git a/src/soc/intel/broadwell/refcode/Makefile.inc b/src/soc/intel/broadwell/refcode/Makefile.inc
new file mode 100644
index 0000000000..74bd08dfcd
--- /dev/null
+++ b/src/soc/intel/broadwell/refcode/Makefile.inc
@@ -0,0 +1,5 @@
+ramstage-libs += $(obj)/broadwell_refcode.o
+
+$(obj)/%.o: $(src)/soc/intel/broadwell/refcode/%.asm
+	echo "NASM $@"
+	nasm -f elf32 -o $@ $<
diff --git a/src/soc/intel/broadwell/refcode/broadwell_refcode.asm b/src/soc/intel/broadwell/refcode/broadwell_refcode.asm
new file mode 100644
index 0000000000..2ca802859d
--- /dev/null
+++ b/src/soc/intel/broadwell/refcode/broadwell_refcode.asm
@@ -0,0 +1,66464 @@
+;; Generated with r2dumpbin (https://github.com/mytbk/r2dumpbin)
+;; label comments removed
+
+bits 32
+
+global refcode_entry
+
+refcode_entry:
+pushad
+mov eax, dword [esp + 0x24]
+push eax
+call fcn_00000012  ; call 0x12
+pop ecx
+mov dword [esp + 0x1c], eax
+popad
+ret
+
+fcn_00000012:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x1c
+mov esi, dword [ebp + 8]
+push esi
+call fcn_00016434  ; call 0x16434
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+je near loc_000000c4  ; je 0xc4
+sub esp, 0xc
+push ref_00020688  ; push 0x20688
+call fcn_0001545e  ; call 0x1545e
+pop eax
+pop edx
+push ebx
+push 0
+call fcn_0000e020  ; call 0xe020
+mov dword [esp], ref_0002069a  ; mov dword [esp], 0x2069a
+call fcn_0001545e  ; call 0x1545e
+pop ecx
+pop eax
+push ebx
+push 0
+call fcn_0000058b  ; call 0x58b
+mov dword [esp], ref_000206b5  ; mov dword [esp], 0x206b5
+call fcn_0001545e  ; call 0x1545e
+add esp, 0xc
+push 0
+push 0
+push ebx
+call fcn_0000d87f  ; call 0xd87f
+lea eax, [ebp - 0xc]
+push eax
+push 0
+push 0
+push ref_000291dc  ; push 0x291dc
+call fcn_0001975d  ; call 0x1975d
+mov eax, dword [ebp - 0xc]
+add esp, 0x20
+movzx edx, byte [eax]
+add eax, 0x284
+push edx
+push dword [esi + 0x1a]
+push dword [esi + 0x1e]
+push eax
+call fcn_00011751  ; call 0x11751
+mov eax, dword [ebp - 0xc]
+pop edx
+pop ecx
+push dword [eax + 4]
+push eax
+call fcn_000150af  ; call 0x150af
+mov dword [esp], ref_000206c7  ; mov dword [esp], 0x206c7
+call fcn_0001545e  ; call 0x1545e
+add esp, 0x10
+xor eax, eax
+jmp short loc_000000c7  ; jmp 0xc7
+
+loc_000000c4:
+or eax, 0xffffffff
+
+loc_000000c7:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_000000ce:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x14
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017ed8  ; call 0x17ed8
+mov ebx, eax
+lea eax, [ebp - 0xc]
+and ebx, 0xfffffffe
+push eax
+push 0
+push 0
+push ref_0002930c  ; push 0x2930c
+call fcn_0001975d  ; call 0x1975d
+add esp, 0x20
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0000014a  ; je 0x14a
+test esi, esi
+jns short loc_0000014a  ; jns 0x14a
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00000132  ; je 0x132
+push eax
+push esi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00000132:
+push esi
+push ref_000206f4  ; push 0x206f4
+push 0x126
+push ref_00020708  ; push 0x20708
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000014a:
+push ecx
+push 0x600
+push 0xfffff9ff
+lea eax, [ebx + 0x5f00]
+push eax
+call fcn_00018b68  ; call 0x18b68
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_0000017e  ; je 0x17e
+push edx
+push edx
+push ref_00020738  ; push 0x20738
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000017e:
+push eax
+add ebx, 0x5da8
+push eax
+push 3
+push ebx
+call fcn_00018730  ; call 0x18730
+lea esp, [ebp - 8]
+xor eax, eax
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00000197:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+call fcn_0001c678  ; call 0x1c678
+mov esi, eax
+call fcn_0001c651  ; call 0x1c651
+sub esp, 0xc
+push ref_0002955c  ; push 0x2955c
+mov ebx, eax
+call fcn_000190fd  ; call 0x190fd
+add esp, 0x10
+test eax, eax
+je short loc_000001c4  ; je 0x1c4
+cmp byte [eax + 0x4a], 0
+jne short loc_00000228  ; jne 0x228
+
+loc_000001c4:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000001de  ; je 0x1de
+push eax
+push eax
+push ref_00020774  ; push 0x20774
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000001de:
+test esi, esi
+jne short loc_000001ea  ; jne 0x1ea
+cmp ebx, 0x40670
+je short loc_000001fc  ; je 0x1fc
+
+loc_000001ea:
+push esi
+push 0
+push 1
+push 0x2e7
+call fcn_0001790f  ; call 0x1790f
+add esp, 0x10
+
+loc_000001fc:
+cmp ebx, 0x40670
+je short loc_0000020c  ; je 0x20c
+cmp ebx, 0x306d0
+jne short loc_00000228  ; jne 0x228
+
+loc_0000020c:
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+push 1
+sub eax, 0xffffff80
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+
+loc_00000228:
+lea esp, [ebp - 8]
+xor eax, eax
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00000231:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 8]
+call fcn_0001c651  ; call 0x1c651
+push edx
+mov esi, eax
+push 0
+and esi, 0xffffffef
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+xor edx, edx
+mov edi, eax
+mov eax, dword [ebx + 1]
+mov eax, dword [eax + 4]
+push edx
+or eax, 1
+push eax
+lea eax, [edi + 0x48]
+push eax
+call fcn_00017f28  ; call 0x17f28
+mov eax, dword [ebx + 1]
+add esp, 0xc
+xor edx, edx
+mov eax, dword [eax + 8]
+push edx
+or eax, 1
+push eax
+lea eax, [edi + 0x68]
+add edi, 0x40
+push eax
+call fcn_00017f28  ; call 0x17f28
+mov eax, dword [ebx + 1]
+add esp, 0xc
+xor edx, edx
+mov eax, dword [eax + 0xc]
+push edx
+or eax, 1
+push eax
+push edi
+call fcn_00017f28  ; call 0x17f28
+mov ecx, dword [ebx + 1]
+add esp, 0xc
+xor edx, edx
+mov eax, dword [ecx + 0x18]
+push edx
+or eax, 1
+push eax
+mov eax, dword [ecx + 4]
+add eax, 0x5420
+push eax
+call fcn_00017f28  ; call 0x17f28
+add esp, 0x10
+cmp esi, 0x40660
+jne short loc_000002e8  ; jne 0x2e8
+mov ecx, dword [ebx + 1]
+xor edx, edx
+push eax
+mov eax, dword [ecx + 0x22]
+push edx
+or eax, 1
+push eax
+mov eax, dword [ecx + 4]
+add eax, 0x5408
+push eax
+call fcn_00017f28  ; call 0x17f28
+add esp, 0x10
+
+loc_000002e8:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000002f0:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+mov eax, dword [ebp + 8]
+push 1
+mov eax, dword [eax + 1]
+mov eax, dword [eax + 4]
+add eax, 0x5f00
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+leave
+ret
+
+fcn_00000311:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov ebx, dword [ebp + 0xc]
+lea eax, [ebp - 0x20]
+push eax
+push 0x73
+push 4
+call fcn_000197df  ; call 0x197df
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00000371  ; je 0x371
+test esi, esi
+jns short loc_00000371  ; jns 0x371
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00000359  ; je 0x359
+push eax
+push esi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00000359:
+push edi
+push ref_000206f4  ; push 0x206f4
+push 0x18b
+push ref_00020708  ; push 0x20708
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00000371:
+mov eax, dword [ebp - 0x20]
+mov esi, ref_0002955c  ; mov esi, 0x2955c
+mov ecx, 4
+lea edi, [eax + 8]
+add eax, 0x18
+rep movsd  ; rep movsd dword es:[edi], dword ptr [esi]
+push edi
+push edi
+push 8
+push eax
+call fcn_00016fff  ; call 0x16fff
+pop eax
+mov eax, dword [ebp - 0x20]
+pop edx
+add eax, 0x20
+push 8
+push eax
+call fcn_00016fff  ; call 0x16fff
+mov eax, dword [ebp - 0x20]
+pop ecx
+pop esi
+add eax, 0x29
+push 0x21
+push eax
+call fcn_00016fff  ; call 0x16fff
+mov eax, dword [ebp - 0x20]
+add esp, 0x10
+mov byte [eax + 0x28], 0
+mov byte [eax + 0x71], 0
+cmp byte [ebx], 1
+jbe short loc_000003ce  ; jbe 0x3ce
+mov edx, dword [ebx + 0xd]
+mov dl, byte [edx + 0x49]
+mov byte [eax + 0x4a], dl
+jmp short loc_000003d2  ; jmp 0x3d2
+
+loc_000003ce:
+mov byte [eax + 0x4a], 0
+
+loc_000003d2:
+mov edx, dword [ebx + 5]
+mov dl, byte [edx + 7]
+mov byte [eax + 0x72], dl
+lea eax, [ebp - 0x1c]
+push eax
+push 0
+push 0
+push ref_0002928c  ; push 0x2928c
+call fcn_0001975d  ; call 0x1975d
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00000434  ; je 0x434
+test ebx, ebx
+jns short loc_00000434  ; jns 0x434
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000041c  ; je 0x41c
+push esi
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000041c:
+push ecx
+push ref_000206f4  ; push 0x206f4
+push 0x1a6
+push ref_00020708  ; push 0x20708
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00000434:
+mov eax, dword [ebp - 0x1c]
+mov edx, dword [eax + 9]
+cmp dword [edx + 4], 0
+je short loc_00000469  ; je 0x469
+mov ebx, dword [ebp - 0x20]
+mov byte [ebx + 0x18], 1
+mov edx, dword [eax + 1]
+cmp byte [edx], 0
+jns short loc_00000469  ; jns 0x469
+push edx
+push 0x14
+mov eax, dword [eax + 9]
+mov eax, dword [eax + 4]
+push dword [eax + 0x1c]
+push dword [eax + 0x18]
+call fcn_0001724f  ; call 0x1724f
+add esp, 0x10
+mov byte [ebx + 0x19], al
+
+loc_00000469:
+mov eax, dword [ebp - 0x20]
+mov edx, dword [ebp - 0x1c]
+mov byte [eax + 0x20], 2
+mov ecx, dword [edx + 1]
+test byte [ecx], 0x10
+je short loc_00000489  ; je 0x489
+mov edx, dword [edx + 9]
+mov edx, dword [edx]
+mov dl, byte [edx + 0x301]
+mov byte [eax + 0x21], dl
+
+loc_00000489:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000004a3  ; je 0x4a3
+push eax
+push eax
+push ref_0002078e  ; push 0x2078e
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000004a3:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000004ad:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000004cf  ; je 0x4cf
+push eax
+push eax
+push ref_000207a5  ; push 0x207a5
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000004cf:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000004ea  ; je 0x4ea
+push eax
+push 2
+push ref_000207e9  ; push 0x207e9
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000004ea:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00000505  ; je 0x505
+push eax
+push 6
+push ref_0002082d  ; push 0x2082d
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00000505:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00000520  ; je 0x520
+push eax
+push 0
+push ref_00020871  ; push 0x20871
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00000520:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000053b  ; je 0x53b
+push eax
+push 0
+push ref_000208b5  ; push 0x208b5
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000053b:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00000555  ; je 0x555
+push eax
+push eax
+push ref_000208f9  ; push 0x208f9
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00000555:
+push eax
+push eax
+movzx eax, byte [ebx]
+push eax
+mov eax, dword [ebx + 1]
+mov eax, dword [eax + 8]
+add eax, 0x71c
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop edx
+pop ecx
+push 0x2060000
+mov eax, dword [ebx + 1]
+mov eax, dword [eax + 8]
+add eax, 0x720
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+xor eax, eax
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000058b:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov esi, dword [ebp + 0xc]
+call fcn_0001c651  ; call 0x1c651
+mov edi, eax
+lea eax, [ebp - 0x24]
+push eax
+push 0
+push 0
+push ref_0002930c  ; push 0x2930c
+call fcn_0001975d  ; call 0x1975d
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_000005f7  ; je 0x5f7
+test ebx, ebx
+jns short loc_000005f7  ; jns 0x5f7
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000005df  ; je 0x5df
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000005df:
+push ebx
+push ref_000206f4  ; push 0x206f4
+push 0x8e
+push ref_00020708  ; push 0x20708
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000005f7:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00000611  ; je 0x611
+push ecx
+push ecx
+push ref_0002093d  ; push 0x2093d
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00000611:
+sub esp, 0xc
+push dword [ebp - 0x24]
+call fcn_00000231  ; call 0x231
+pop eax
+pop edx
+push dword [ebp - 0x24]
+push esi
+call fcn_00000311  ; call 0x311
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00000644  ; je 0x644
+push eax
+push eax
+push ref_00020952  ; push 0x20952
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00000644:
+sub esp, 0xc
+push dword [ebp - 0x24]
+call fcn_000004ad  ; call 0x4ad
+add esp, 0x10
+cmp edi, 0x40660
+sete bl
+cmp edi, 0x306c0
+sete al
+or bl, al
+je short loc_00000684  ; je 0x684
+
+loc_00000668:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000006b0  ; je 0x6b0
+push ecx
+push ecx
+push ref_00020972  ; push 0x20972
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp short loc_000006b0  ; jmp 0x6b0
+
+loc_00000684:
+cmp edi, 0x40670
+jne near loc_00000714  ; jne 0x714
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+jne short loc_00000668  ; jne 0x668
+jmp short loc_000006e6  ; jmp 0x6e6
+
+loc_000006b0:
+push edx
+push edx
+push dword [ebp - 0x24]
+push esi
+call fcn_0000211b  ; call 0x211b
+add esp, 0x10
+test bl, bl
+je short loc_000006de  ; je 0x6de
+
+loc_000006c2:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00000706  ; je 0x706
+push eax
+push eax
+push ref_00020984  ; push 0x20984
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp short loc_00000706  ; jmp 0x706
+
+loc_000006de:
+cmp edi, 0x40670
+jne short loc_00000714  ; jne 0x714
+
+loc_000006e6:
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+jne short loc_000006c2  ; jne 0x6c2
+jmp short loc_00000714  ; jmp 0x714
+
+loc_00000706:
+push eax
+push eax
+push dword [ebp - 0x24]
+push esi
+call fcn_00004b08  ; call 0x4b08
+add esp, 0x10
+
+loc_00000714:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000072e  ; je 0x72e
+push eax
+push eax
+push ref_0002099a  ; push 0x2099a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000072e:
+push eax
+push eax
+push dword [ebp - 0x24]
+push esi
+call fcn_00001663  ; call 0x1663
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00000756  ; je 0x756
+push eax
+push eax
+push ref_000209b1  ; push 0x209b1
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00000756:
+push edi
+push edi
+push dword [ebp - 0x24]
+push esi
+call fcn_000009ac  ; call 0x9ac
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_0000077e  ; je 0x77e
+push ebx
+push ebx
+push ref_000209d9  ; push 0x209d9
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000077e:
+push ecx
+push ecx
+push dword [ebp - 0x24]
+push esi
+call fcn_00001e49  ; call 0x1e49
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_000007a6  ; je 0x7a6
+push edx
+push edx
+push ref_000209f9  ; push 0x209f9
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000007a6:
+sub esp, 0xc
+push dword [ebp - 0x24]
+call fcn_000002f0  ; call 0x2f0
+mov dword [esp], ref_00026ee4  ; mov dword [esp], 0x26ee4
+call fcn_0001977f  ; call 0x1977f
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00000804  ; je 0x804
+test ebx, ebx
+jns short loc_00000804  ; jns 0x804
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000007ec  ; je 0x7ec
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000007ec:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0xde
+push ref_00020708  ; push 0x20708
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00000804:
+sub esp, 0xc
+lea eax, [ebp - 0x20]
+push eax
+call fcn_00019797  ; call 0x19797
+mov ebx, eax
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00000831  ; je 0x831
+push eax
+push dword [ebp - 0x20]
+push ref_00020a16  ; push 0x20a16
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00000831:
+test ebx, ebx
+jne short loc_000008a9  ; jne 0x8a9
+cmp dword [ebp - 0x20], 0x11
+jne short loc_000008a9  ; jne 0x8a9
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00000855  ; je 0x855
+push eax
+push eax
+push ref_00020a2a  ; push 0x20a2a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00000855:
+sub esp, 0xc
+push ref_00026ed8  ; push 0x26ed8
+call fcn_0001977f  ; call 0x1977f
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je near loc_00000949  ; je 0x949
+test ebx, ebx
+jns near loc_00000949  ; jns 0x949
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00000899  ; je 0x899
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00000899:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0xe8
+jmp near loc_0000093c  ; jmp 0x93c
+
+loc_000008a9:
+lea eax, [ebp - 0x1c]
+push eax
+push 0
+push 0
+push ref_0002932c  ; push 0x2932c
+mov dword [ebp - 0x1c], 0
+call fcn_0001975d  ; call 0x1975d
+mov eax, dword [ebp - 0x1c]
+add esp, 0x10
+test eax, eax
+je short loc_00000949  ; je 0x949
+test byte [eax + 1], 1
+je short loc_00000949  ; je 0x949
+call fcn_00016627  ; call 0x16627
+dec al
+jne short loc_00000949  ; jne 0x949
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000008f5  ; je 0x8f5
+push edi
+push edi
+push ref_00020a4e  ; push 0x20a4e
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000008f5:
+sub esp, 0xc
+push ref_00026ed8  ; push 0x26ed8
+call fcn_0001977f  ; call 0x1977f
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00000949  ; je 0x949
+test ebx, ebx
+jns short loc_00000949  ; jns 0x949
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00000931  ; je 0x931
+push esi
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00000931:
+push ecx
+push ref_000206f4  ; push 0x206f4
+push 0xf8
+
+loc_0000093c:
+push ref_00020708  ; push 0x20708
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00000949:
+sub esp, 0xc
+push ref_00026ef0  ; push 0x26ef0
+call fcn_0001972b  ; call 0x1972b
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000099d  ; je 0x99d
+test ebx, ebx
+jns short loc_0000099d  ; jns 0x99d
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00000985  ; je 0x985
+push edx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00000985:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x102
+push ref_00020708  ; push 0x20708
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000099d:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000009a7:
+push ebp
+mov ebp, esp
+pop ebp
+ret
+
+fcn_000009ac:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x3c
+mov ebx, dword [ebp + 0xc]
+call fcn_0001c651  ; call 0x1c651
+mov dword [ebp - 0x34], 0
+mov edi, eax
+mov eax, dword [ebx + 0x11]
+cmp byte [eax + 0xb], 0
+jne short loc_000009f7  ; jne 0x9f7
+call fcn_00015479  ; call 0x15479
+xor ebx, ebx
+test al, al
+je near loc_00000d16  ; je 0xd16
+push ecx
+push ecx
+push ref_00020a83  ; push 0x20a83
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp near loc_00000d16  ; jmp 0xd16
+
+loc_000009f7:
+push eax
+push eax
+push 7
+lea eax, [ebp - 0x26]
+push eax
+call fcn_00016fff  ; call 0x16fff
+pop eax
+pop edx
+lea eax, [ebp - 0x1f]
+push 7
+push eax
+call fcn_00016fff  ; call 0x16fff
+lea eax, [ebp - 0x30]
+push eax
+push 0
+push 0
+push ref_0002919c  ; push 0x2919c
+call fcn_0001975d  ; call 0x1975d
+add esp, 0x20
+mov dword [ebp - 0x3c], eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00000a6c  ; je 0xa6c
+cmp dword [ebp - 0x3c], 0
+jns short loc_00000a6c  ; jns 0xa6c
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00000a57  ; je 0xa57
+push eax
+push dword [ebp - 0x3c]
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00000a57:
+push esi
+push ref_000206f4  ; push 0x206f4
+push 0x54
+push ref_00020ac3  ; push 0x20ac3
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00000a6c:
+push ecx
+and edi, 0xfff0ff0
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017ed8  ; call 0x17ed8
+add esp, 0x10
+cmp edi, 0x40670
+jne near loc_00000b4a  ; jne 0xb4a
+mov edx, dword [ebx + 0x11]
+cmp byte [edx + 0x10], 0
+je near loc_00000b4a  ; je 0xb4a
+and eax, 0xfffffffe
+mov esi, eax
+mov eax, dword [ebx + 9]
+mov eax, dword [eax + 0x64]
+cmp eax, 0x7735940
+je short loc_00000ada  ; je 0xada
+ja short loc_00000ac6  ; ja 0xac6
+cmp eax, 0x5f5e100
+jne short loc_00000af3  ; jne 0xaf3
+push edx
+push edx
+push 1
+jmp short loc_00000ae4  ; jmp 0xae4
+
+loc_00000ac6:
+cmp eax, 0x9f437c0
+je short loc_00000ae0  ; je 0xae0
+cmp eax, 0xee6b280
+jne short loc_00000af3  ; jne 0xaf3
+push eax
+push eax
+push 0xe
+jmp short loc_00000ae4  ; jmp 0xae4
+
+loc_00000ada:
+push eax
+push eax
+push 6
+jmp short loc_00000ae4  ; jmp 0xae4
+
+loc_00000ae0:
+push eax
+push eax
+push 0xa
+
+loc_00000ae4:
+lea eax, [esi + 0x5da0]
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+
+loc_00000af3:
+push eax
+push eax
+push 0x80000014
+lea eax, [esi + 0x5da4]
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00000b2a  ; je 0xb2a
+push eax
+mov eax, dword [ebx + 0x11]
+movzx eax, byte [eax + 0x10]
+push eax
+push ref_00020af1  ; push 0x20af1
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00000b2a:
+push eax
+add esi, 0x5e08
+push eax
+mov eax, dword [ebx + 0x11]
+mov al, byte [eax + 0x10]
+and eax, 0x7f
+or eax, 0x80000000
+push eax
+push esi
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+
+loc_00000b4a:
+mov dword [ebp - 0x40], 1
+
+loc_00000b51:
+mov ecx, dword [ebp - 0x40]
+cmp cl, 1
+mov eax, ecx
+mov byte [ebp - 0x41], cl
+sete cl
+sub eax, 3
+cmp al, 2
+mov byte [ebp - 0x43], cl
+setbe byte [ebp - 0x42]
+jbe short loc_00000b75  ; jbe 0xb75
+test cl, cl
+je near loc_00000d06  ; je 0xd06
+
+loc_00000b75:
+push ecx
+push ecx
+push 5
+lea eax, [ebp - 0x2b]
+push eax
+call fcn_00016fff  ; call 0x16fff
+mov al, byte [ebp - 0x41]
+pop esi
+pop edi
+mov byte [ebp - 0x27], al
+lea eax, [ebp - 0x34]
+push eax
+lea eax, [ebp - 0x2b]
+push eax
+call fcn_0001d3a2  ; call 0x1d3a2
+add esp, 0x10
+cmp dword [ebp - 0x34], 0
+mov dword [ebp - 0x3c], eax
+jne near loc_00000ce5  ; jne 0xce5
+cmp byte [ebp - 0x2a], 0
+jne short loc_00000bbd  ; jne 0xbbd
+cmp byte [ebp - 0x29], 0
+jne short loc_00000bbd  ; jne 0xbbd
+cmp byte [ebp - 0x28], 0
+je near loc_00000ccf  ; je 0xccf
+
+loc_00000bbd:
+push edi
+push edi
+push 7
+lea edi, [ebp - 0x26]
+push edi
+call fcn_00016fff  ; call 0x16fff
+mov al, byte [ebp - 0x41]
+mov byte [ebp - 0x20], al
+pop eax
+pop edx
+lea eax, [ebp - 0x34]
+push eax
+push edi
+call fcn_0001d1f5  ; call 0x1d1f5
+add esp, 0x10
+mov dword [ebp - 0x3c], eax
+test eax, eax
+jne near loc_00000d06  ; jne 0xd06
+cmp dword [ebp - 0x34], 0
+jne near loc_00000d06  ; jne 0xd06
+push esi
+push esi
+push 7
+lea esi, [ebp - 0x1f]
+push esi
+call fcn_00016fff  ; call 0x16fff
+mov al, byte [ebp - 0x41]
+add esp, 0x10
+cmp byte [ebp - 0x43], 0
+mov byte [ebp - 0x19], al
+je short loc_00000c7a  ; je 0xc7a
+mov eax, dword [ebx + 0x11]
+mov dx, word [eax + 6]
+mov byte [ebp - 0x1f], dl
+mov dl, byte [eax + 0xa]
+mov byte [ebp - 0x1e], dl
+test dl, dl
+jne short loc_00000c2a  ; jne 0xc2a
+mov dx, word [eax + 4]
+jmp short loc_00000c2e  ; jmp 0xc2e
+
+loc_00000c2a:
+mov dx, word [eax + 2]
+
+loc_00000c2e:
+mov word [ebp - 0x1d], dx
+mov ax, word [eax]
+push ecx
+push 7
+push edi
+push esi
+mov word [ebp - 0x1b], ax
+call fcn_00017067  ; call 0x17067
+add esp, 0x10
+test al, al
+
+loc_00000c48:
+je near loc_00000d06  ; je 0xd06
+mov eax, dword [ebp - 0x30]
+sub esp, 0xc
+push 0x3c
+call dword [eax]  ; ucall
+add esp, 0xc
+mov ecx, 7
+lea eax, [ebp - 0x34]
+push eax
+push edx
+push edx
+mov edi, esp
+rep movsb  ; rep movsb byte es:[edi], byte ptr [esi]
+call fcn_0001d27c  ; call 0x1d27c
+add esp, 0x10
+mov esi, eax
+test eax, eax
+je short loc_00000cb2  ; je 0xcb2
+jmp short loc_00000cb8  ; jmp 0xcb8
+
+loc_00000c7a:
+cmp byte [ebp - 0x42], 0
+je near loc_00000d06  ; je 0xd06
+mov cl, byte [ebp - 0x41]
+mov eax, dword [ebx + 0x11]
+cmp cl, 4
+je short loc_00000c9a  ; je 0xc9a
+cmp cl, 5
+je short loc_00000ca0  ; je 0xca0
+mov ax, word [eax + 8]
+jmp short loc_00000ca4  ; jmp 0xca4
+
+loc_00000c9a:
+mov ax, word [eax + 0xc]
+jmp short loc_00000ca4  ; jmp 0xca4
+
+loc_00000ca0:
+mov ax, word [eax + 0xe]
+
+loc_00000ca4:
+mov word [ebp - 0x1b], ax
+mov ax, word [ebp - 0x22]
+cmp word [ebp - 0x1b], ax
+jmp short loc_00000c48  ; jmp 0xc48
+
+loc_00000cb2:
+cmp dword [ebp - 0x34], 0
+je short loc_00000d06  ; je 0xd06
+
+loc_00000cb8:
+call fcn_00015479  ; call 0x15479
+mov dword [ebp - 0x3c], esi
+test al, al
+je short loc_00000d06  ; je 0xd06
+push dword [ebp - 0x34]
+push esi
+push ref_00020b17  ; push 0x20b17
+jmp short loc_00000cf9  ; jmp 0xcf9
+
+loc_00000ccf:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00000d06  ; je 0xd06
+push eax
+push dword [ebp - 0x40]
+push ref_00020b60  ; push 0x20b60
+push 0x40
+jmp short loc_00000cfe  ; jmp 0xcfe
+
+loc_00000ce5:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00000d06  ; je 0xd06
+push dword [ebp - 0x40]
+push dword [ebp - 0x34]
+push ref_00020b89  ; push 0x20b89
+
+loc_00000cf9:
+push 0x80000000
+
+loc_00000cfe:
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00000d06:
+inc dword [ebp - 0x40]
+cmp dword [ebp - 0x40], 6
+jne near loc_00000b51  ; jne 0xb51
+mov ebx, dword [ebp - 0x3c]
+
+loc_00000d16:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00000d20:
+push ebp
+mov ebp, esp
+push edi
+push esi
+mov esi, 0x10
+push ebx
+sub esp, 0x20
+mov eax, dword [ebp + 0x14]
+mov dword [eax], 0
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [ebp - 0x1c], eax
+add eax, 0xb
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+cmp al, 6
+je short loc_00000dd5  ; je 0xdd5
+
+loc_00000d5a:
+mov eax, dword [ebp - 0x1c]
+sub esp, 0xc
+lea ebx, [esi + eax]
+push ebx
+call fcn_00017e4e  ; call 0x17e4e
+mov edi, eax
+pop eax
+pop edx
+push 0
+push ebx
+call fcn_00018b3e  ; call 0x18b3e
+pop ecx
+pop eax
+push 0xffffffffffffffff
+push ebx
+call fcn_00018b14  ; call 0x18b14
+mov dword [esp], ebx
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+cmp edi, eax
+je short loc_00000d96  ; je 0xd96
+test edi, 1
+je short loc_00000da4  ; je 0xda4
+
+loc_00000d96:
+push ecx
+push ecx
+push edi
+push ebx
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+jmp short loc_00000dcd  ; jmp 0xdcd
+
+loc_00000da4:
+sub esp, 0xc
+push ebx
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, dword [ebp + 0x14]
+and eax, 0xfffffff0
+sub dword [edx], eax
+pop eax
+pop edx
+push edi
+and edi, 6
+push ebx
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+cmp edi, 4
+lea eax, [esi + 4]
+cmove esi, eax
+
+loc_00000dcd:
+add esi, 4
+cmp esi, 0x24
+jbe short loc_00000d5a  ; jbe 0xd5a
+
+loc_00000dd5:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00000ddd:
+push ebp
+mov ebp, esp
+push edi
+xor edi, edi
+push esi
+xor esi, esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov dword [ebp - 0x24], eax
+mov byte [ebp - 0x19], al
+movzx eax, al
+mov dword [ebp - 0x20], eax
+
+loc_00000df9:
+push eax
+push 0
+push esi
+push dword [ebp - 0x20]
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+mov ebx, eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+je near loc_00000e9b  ; je 0xe9b
+sub esp, 0xc
+lea eax, [ebx + 0xa]
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+cmp ax, 0x604
+jne short loc_00000e9b  ; jne 0xe9b
+mov al, byte [ebp - 0x19]
+inc eax
+mov byte [ebp - 0x19], al
+push eax
+push eax
+push dword [ebp - 0x20]
+lea eax, [ebx + 0x18]
+push eax
+call fcn_00017da5  ; call 0x17da5
+movzx edi, byte [ebp - 0x19]
+lea eax, [ebx + 0x19]
+pop edx
+add ebx, 0x1a
+pop ecx
+push edi
+push eax
+call fcn_00017da5  ; call 0x17da5
+pop eax
+pop edx
+push 0xff
+push ebx
+call fcn_00017da5  ; call 0x17da5
+add esp, 0xc
+push 0
+push 0
+push edi
+call fcn_00016c9a  ; call 0x16c9a
+pop ecx
+pop edx
+push 0
+push eax
+call fcn_00017e04  ; call 0x17e04
+mov dword [esp], edi
+call fcn_00000ddd  ; call 0xddd
+pop ecx
+mov edi, eax
+pop eax
+mov eax, edi
+movzx eax, al
+push eax
+push ebx
+call fcn_00017da5  ; call 0x17da5
+mov eax, edi
+add esp, 0x10
+mov byte [ebp - 0x19], al
+
+loc_00000e9b:
+inc esi
+cmp esi, 0x20
+jne near loc_00000df9  ; jne 0xdf9
+mov eax, edi
+test al, al
+mov al, byte [ebp - 0x24]
+cmovne eax, edi
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00000eb7:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x2c
+lea eax, [ebp - 0x1c]
+push eax
+push 0
+push 0
+push ref_000290cc  ; push 0x290cc
+mov dword [ebp - 0x20], 0
+call fcn_0001975d  ; call 0x1975d
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00000f20  ; je 0xf20
+test ebx, ebx
+jns short loc_00000f20  ; jns 0xf20
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00000f08  ; je 0xf08
+push esi
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00000f08:
+push ebx
+push ref_000206f4  ; push 0x206f4
+push 0x2d0
+push ref_00020bd2  ; push 0x20bd2
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00000f20:
+mov byte [ebp - 0x29], 0
+mov esi, 0x10100
+xor ebx, ebx
+
+loc_00000f2b:
+call fcn_0001c1bf  ; call 0x1c1bf
+cmp bl, al
+jae near loc_00000fc0  ; jae 0xfc0
+movzx eax, bl
+push ecx
+push eax
+push 0x1c
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+mov edi, eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_00000fba  ; je 0xfba
+push eax
+push eax
+push esi
+lea eax, [edi + 0x18]
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+lea eax, [edi + 0x19]
+add edi, 0x1a
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+pop edx
+pop ecx
+push 0xff
+push edi
+mov esi, eax
+call fcn_00017da5  ; call 0x17da5
+add esp, 0xc
+mov eax, esi
+push 0
+movzx esi, al
+push 0
+push esi
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+push 0
+push eax
+call fcn_00017e04  ; call 0x17e04
+mov dword [esp], esi
+call fcn_00000ddd  ; call 0xddd
+movzx esi, al
+mov byte [ebp - 0x29], al
+pop eax
+pop edx
+push esi
+inc esi
+push edi
+call fcn_00017da5  ; call 0x17da5
+shl esi, 8
+add esp, 0x10
+
+loc_00000fba:
+inc ebx
+jmp near loc_00000f2b  ; jmp 0xf2b
+
+loc_00000fc0:
+mov byte [ebp - 0x2b], 0
+mov byte [ebp - 0x2d], 1
+
+loc_00000fc8:
+mov al, byte [ebp - 0x29]
+mov dl, byte [ebp - 0x2d]
+cmp dl, al
+ja near loc_000010df  ; ja 0x10df
+xor ebx, ebx
+movzx esi, dl
+
+loc_00000fdb:
+push eax
+push 0
+push ebx
+push esi
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+mov edi, eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+je near loc_000010a3  ; je 0x10a3
+sub esp, 0xc
+add edi, 0xe
+push edi
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x2c], 0
+mov byte [ebp - 0x2a], al
+sar byte [ebp - 0x2a], 7
+and byte [ebp - 0x2a], 7
+
+loc_00001018:
+movzx edi, byte [ebp - 0x2c]
+push eax
+push edi
+push ebx
+push esi
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_00001094  ; je 0x1094
+lea eax, [ebp - 0x20]
+push eax
+push edi
+push ebx
+push esi
+call fcn_00000d20  ; call 0xd20
+mov ecx, dword [ebp + 0xc]
+add esp, 0xc
+mov eax, dword [ebp - 0x20]
+add dword [ecx], eax
+push edi
+push ebx
+push esi
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xa
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+cmp ax, 0x300
+jne short loc_00001094  ; jne 0x1094
+cmp byte [ebp - 0x2b], 1
+je short loc_00001090  ; je 0x1090
+mov eax, dword [ebp + 0x10]
+mov dword [eax], 2
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00001090  ; je 0x1090
+push eax
+push eax
+push ref_00020c04  ; push 0x20c04
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00001090:
+mov byte [ebp - 0x2b], 1
+
+loc_00001094:
+inc byte [ebp - 0x2c]
+mov al, byte [ebp - 0x2a]
+cmp byte [ebp - 0x2c], al
+jbe near loc_00001018  ; jbe 0x1018
+
+loc_000010a3:
+inc ebx
+cmp ebx, 0x20
+jne near loc_00000fdb  ; jne 0xfdb
+inc byte [ebp - 0x2d]
+jmp near loc_00000fc8  ; jmp 0xfc8
+
+loc_000010b5:
+movzx edi, byte [ebp - 0x29]
+xor ebx, ebx
+
+loc_000010bb:
+push eax
+push 0
+push ebx
+push edi
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+mov esi, eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_000010e9  ; jne 0x10e9
+
+loc_000010d6:
+inc ebx
+cmp ebx, 0x20
+jne short loc_000010bb  ; jne 0x10bb
+dec byte [ebp - 0x29]
+
+loc_000010df:
+cmp byte [ebp - 0x29], 0
+jne short loc_000010b5  ; jne 0x10b5
+xor ebx, ebx
+jmp short loc_00001110  ; jmp 0x1110
+
+loc_000010e9:
+sub esp, 0xc
+lea eax, [esi + 0xa]
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+cmp ax, 0x604
+jne short loc_000010d6  ; jne 0x10d6
+push eax
+add esi, 0x18
+push eax
+push 0
+push esi
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+jmp short loc_000010d6  ; jmp 0x10d6
+
+loc_00001110:
+call fcn_0001c1bf  ; call 0x1c1bf
+cmp bl, al
+jae short loc_0000113a  ; jae 0x113a
+push eax
+movzx eax, bl
+push eax
+inc ebx
+push 0x1c
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+push 0
+add eax, 0x18
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+jmp short loc_00001110  ; jmp 0x1110
+
+loc_0000113a:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00001142:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x30
+movzx eax, byte [ebp + 0x10]
+movzx edx, byte [ebp + 0xc]
+movzx ecx, byte [ebp + 8]
+push eax
+push edx
+push ecx
+mov dword [ebp - 0x38], ecx
+mov dword [ebp - 0x34], edx
+mov dword [ebp - 0x30], eax
+call fcn_00016c9a  ; call 0x16c9a
+mov ebx, eax
+pop eax
+pop edx
+lea eax, [ebx + 0x19]
+add ebx, 0x1a
+push 1
+push eax
+call fcn_00017da5  ; call 0x17da5
+pop ecx
+pop esi
+lea esi, [ebp - 0x1c]
+push 0xff
+push ebx
+call fcn_00017da5  ; call 0x17da5
+add esp, 0xc
+push 0
+push 0
+push 1
+call fcn_00016c9a  ; call 0x16c9a
+pop edi
+pop edx
+push 0
+push eax
+call fcn_00017e04  ; call 0x17e04
+mov dword [esp], 1
+call fcn_00000ddd  ; call 0xddd
+add esp, 0x10
+mov byte [ebp - 0x2b], 0
+mov byte [ebp - 0x2a], 1
+mov byte [ebp - 0x29], al
+
+loc_000011bc:
+mov al, byte [ebp - 0x29]
+mov dl, byte [ebp - 0x2a]
+cmp dl, al
+ja near loc_00001251  ; ja 0x1251
+xor ebx, ebx
+movzx edi, dl
+
+loc_000011cf:
+push eax
+push 0
+push ebx
+push edi
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_00001222  ; je 0x1222
+push esi
+push 0
+push ebx
+push edi
+call fcn_00000d20  ; call 0xd20
+mov ecx, dword [ebp + 0x14]
+add esp, 0xc
+mov eax, dword [ebp - 0x1c]
+add dword [ecx], eax
+push 0
+push ebx
+push edi
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xa
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+cmp ax, 0x300
+je short loc_0000121e  ; je 0x121e
+dec ax
+jne short loc_00001222  ; jne 0x1222
+
+loc_0000121e:
+mov byte [ebp - 0x2b], 1
+
+loc_00001222:
+inc ebx
+cmp ebx, 0x20
+jne short loc_000011cf  ; jne 0x11cf
+inc byte [ebp - 0x2a]
+jmp short loc_000011bc  ; jmp 0x11bc
+
+loc_0000122d:
+push eax
+push 0
+push ebx
+push edi
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+mov esi, eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_0000125f  ; jne 0x125f
+
+loc_00001248:
+inc ebx
+cmp ebx, 0x20
+jne short loc_0000122d  ; jne 0x122d
+dec byte [ebp - 0x29]
+
+loc_00001251:
+mov al, byte [ebp - 0x29]
+test al, al
+je short loc_00001286  ; je 0x1286
+xor ebx, ebx
+movzx edi, al
+jmp short loc_0000122d  ; jmp 0x122d
+
+loc_0000125f:
+sub esp, 0xc
+lea eax, [esi + 0xa]
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+cmp ax, 0x604
+jne short loc_00001248  ; jne 0x1248
+push eax
+add esi, 0x18
+push eax
+push 0
+push esi
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+jmp short loc_00001248  ; jmp 0x1248
+
+loc_00001286:
+push eax
+push dword [ebp - 0x30]
+push dword [ebp - 0x34]
+push dword [ebp - 0x38]
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+push 0
+add eax, 0x18
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+mov al, byte [ebp - 0x2b]
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000012ad:
+push ebp
+mov ecx, 0xf
+mov ebp, esp
+push edi
+push esi
+mov esi, ref_000203a0  ; mov esi, 0x203a0
+push ebx
+sub esp, 0x50
+mov al, byte [ebp + 0xc]
+lea edi, [ebp - 0x27]
+rep movsb  ; rep movsb byte es:[edi], byte ptr [esi]
+lea edi, [ebp - 0x27]
+push 0
+push 0
+push 1
+mov byte [ebp - 0x4f], al
+mov al, byte [ebp + 0x14]
+mov dword [ebp - 0x2c], 0
+mov byte [ebp - 0x50], al
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0
+push 0
+mov esi, eax
+mov dword [ebp - 0x48], eax
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x54
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0xc
+push 0
+push 2
+push 0
+mov word [ebp - 0x3c], ax
+and word [ebp - 0x3c], 0xe
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+mov byte [ebp - 0x39], 0xff
+inc ax
+mov eax, esi
+setne byte [ebp - 0x4e]
+add eax, 0xe
+mov dword [ebp - 0x54], eax
+
+loc_00001338:
+mov al, byte [edi]
+mov bx, word [edi + 3]
+mov cl, al
+mov byte [ebp - 0x4c], al
+mov al, byte [edi + 1]
+mov dl, al
+mov byte [ebp - 0x4d], al
+movzx eax, byte [edi + 2]
+push esi
+push eax
+mov byte [ebp - 0x3a], al
+movzx eax, dl
+push eax
+movzx eax, cl
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0x10
+mov esi, eax
+test word [ebp - 0x3c], bx
+je near loc_00001534  ; je 0x1534
+sub esp, 0xc
+lea eax, [eax + 0xba]
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0x40
+je near loc_00001534  ; je 0x1534
+push edx
+push 0x10100
+push 0xff0000ff
+lea eax, [esi + 0x18]
+push eax
+mov dword [ebp - 0x40], eax
+call fcn_00018b68  ; call 0x18b68
+pop ecx
+pop ebx
+mov ebx, dword [ebp - 0x48]
+push 0
+push ebx
+call fcn_00017e04  ; call 0x17e04
+mov dword [esp], ebx
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+je near loc_00001534  ; je 0x1534
+sub esp, 0xc
+push dword [ebp - 0x54]
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x44], 0
+mov bl, al
+sar bl, 7
+and ebx, 7
+
+loc_000013db:
+movzx edx, byte [ebp - 0x44]
+push eax
+push edx
+push 0
+push 1
+mov dword [ebp - 0x58], edx
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_00001418  ; je 0x1418
+mov edx, dword [ebp - 0x58]
+lea eax, [ebp - 0x2c]
+push eax
+push edx
+push 0
+push 1
+call fcn_00000d20  ; call 0xd20
+mov ecx, dword [ebp + 0x18]
+add esp, 0x10
+mov eax, dword [ebp - 0x2c]
+add dword [ecx], eax
+
+loc_00001418:
+inc byte [ebp - 0x44]
+cmp byte [ebp - 0x44], bl
+jbe short loc_000013db  ; jbe 0x13db
+mov eax, dword [ebp - 0x48]
+sub esp, 0xc
+add eax, 0xb
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+cmp al, 3
+jne short loc_000014b0  ; jne 0x14b0
+cmp byte [ebp - 0x4f], 0
+jne short loc_00001458  ; jne 0x1458
+cmp byte [ebp - 0x4e], 0
+je short loc_0000144c  ; je 0x144c
+cmp byte [ebp - 0x50], 0
+je near loc_00001522  ; je 0x1522
+
+loc_0000144c:
+mov eax, dword [ebp + 0x10]
+cmp dword [eax], 2
+je near loc_00001522  ; je 0x1522
+
+loc_00001458:
+mov eax, dword [ebp + 0x10]
+cmp dword [eax], 1
+je near loc_000015ad  ; je 0x15ad
+push ebx
+add esi, 0x3e
+push ebx
+push 0x18
+push esi
+call fcn_00018927  ; call 0x18927
+mov eax, dword [ebp + 0x10]
+mov dword [eax], 1
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je near loc_000015b3  ; je 0x15b3
+movzx edx, byte [ebp - 0x3a]
+movzx eax, byte [ebp - 0x4d]
+movzx ebx, byte [ebp - 0x4c]
+push ecx
+push edx
+push eax
+push ebx
+push edx
+push eax
+push ref_00020c25  ; push 0x20c25
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+jmp near loc_000015b3  ; jmp 0x15b3
+
+loc_000014b0:
+cmp al, 6
+jne short loc_00001522  ; jne 0x1522
+push dword [ebp + 0x18]
+movzx edx, byte [ebp - 0x3a]
+movzx ebx, byte [ebp - 0x4d]
+movzx eax, byte [ebp - 0x4c]
+push edx
+push ebx
+push eax
+mov dword [ebp - 0x44], eax
+mov dword [ebp - 0x4c], edx
+call fcn_00001142  ; call 0x1142
+add esp, 0x10
+dec al
+jne short loc_00001522  ; jne 0x1522
+mov eax, dword [ebp + 0x10]
+cmp dword [eax], 1
+je short loc_00001522  ; je 0x1522
+push eax
+add esi, 0x3e
+push eax
+push 0x18
+push esi
+call fcn_00018927  ; call 0x18927
+mov eax, dword [ebp + 0x10]
+mov dword [eax], 1
+call fcn_00015479  ; call 0x15479
+mov cl, byte [ebp - 0x3a]
+add esp, 0x10
+mov edx, dword [ebp - 0x4c]
+mov byte [ebp - 0x39], cl
+test al, al
+je short loc_00001522  ; je 0x1522
+push esi
+push edx
+push ebx
+push dword [ebp - 0x44]
+push edx
+push ebx
+push ref_00020c25  ; push 0x20c25
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_00001522:
+push ecx
+push ecx
+push 0xff0000ff
+push dword [ebp - 0x40]
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+
+loc_00001534:
+add edi, 5
+lea eax, [ebp - 0x18]
+cmp edi, eax
+jne near loc_00001338  ; jne 0x1338
+cmp byte [ebp - 0x39], 0xff
+je short loc_000015be  ; je 0x15be
+lea ebx, [ebp - 0x27]
+mov byte [ebp - 0x3a], 0
+
+loc_0000154f:
+mov al, byte [ebp - 0x3a]
+cmp byte [ebp - 0x39], al
+je short loc_0000159f  ; je 0x159f
+push edx
+movzx esi, byte [ebx + 2]
+push esi
+movzx edi, byte [ebx + 1]
+push edi
+movzx ecx, byte [ebx]
+push ecx
+mov dword [ebp - 0x40], ecx
+call fcn_00016c9a  ; call 0x16c9a
+pop ecx
+pop edx
+push 4
+add eax, 0x3e
+push eax
+call fcn_00018927  ; call 0x18927
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+mov ecx, dword [ebp - 0x40]
+test al, al
+je short loc_0000159f  ; je 0x159f
+push eax
+push esi
+push edi
+push ecx
+push esi
+push edi
+push ref_00020c56  ; push 0x20c56
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_0000159f:
+inc byte [ebp - 0x3a]
+add ebx, 5
+cmp byte [ebp - 0x3a], 3
+jne short loc_0000154f  ; jne 0x154f
+jmp short loc_000015be  ; jmp 0x15be
+
+loc_000015ad:
+mov al, byte [ebp - 0x39]
+mov byte [ebp - 0x3a], al
+
+loc_000015b3:
+mov al, byte [ebp - 0x3a]
+mov byte [ebp - 0x39], al
+jmp near loc_00001522  ; jmp 0x1522
+
+loc_000015be:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000015c6:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+xor ebx, ebx
+sub esp, 0x28
+mov eax, dword [ebp + 8]
+mov edi, dword [ebp + 0x18]
+add edi, dword [ebp + 0x10]
+mov esi, dword [ebp + 0xc]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x1c]
+push edi
+mov dword [ebp - 0x20], eax
+mov eax, dword [ebp + 0x20]
+mov dword [ebp - 0x24], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov ecx, eax
+
+loc_000015f7:
+and ecx, dword [ebp - 0x20]
+cmp ecx, dword [ebp - 0x24]
+je short loc_0000162a  ; je 0x162a
+cmp bx, 0xbb8
+je short loc_0000162a  ; je 0x162a
+sub esp, 0xc
+inc ebx
+push edi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0xc
+push 0x3e8
+push esi
+push dword [ebp - 0x1c]
+mov dword [ebp - 0x28], eax
+call dword [esi + 4]  ; ucall
+add esp, 0x10
+mov ecx, dword [ebp - 0x28]
+jmp short loc_000015f7  ; jmp 0x15f7
+
+loc_0000162a:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0000165b  ; je 0x165b
+cmp bx, 0xbb8
+jne short loc_0000165b  ; jne 0x165b
+mov dword [ebp + 0x10], ref_00020c7e  ; mov dword [ebp + 0x10], 0x20c7e
+mov dword [ebp + 0xc], 0x41b
+mov dword [ebp + 8], ref_00020bd2  ; mov dword [ebp + 8], 0x20bd2
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001548c  ; jmp 0x1548c
+
+loc_0000165b:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00001663:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x50
+mov edi, dword [ebp + 0xc]
+push 0
+push 0
+push 0
+mov dword [ebp - 0x30], 0
+mov dword [ebp - 0x2c], 0
+mov dword [ebp - 0x28], 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 0
+push 2
+push 0
+mov ebx, eax
+mov dword [ebp - 0x4c], eax
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [ebp - 0x44], eax
+mov eax, ebx
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [ebp - 0x54], eax
+call fcn_0001c651  ; call 0x1c651
+mov dword [ebp - 0x3c], eax
+lea eax, [ebp - 0x1c]
+mov dword [esp], eax
+call fcn_00019797  ; call 0x19797
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000170c  ; je 0x170c
+test ebx, ebx
+jns short loc_0000170c  ; jns 0x170c
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000016f7  ; je 0x16f7
+push edx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000016f7:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x55
+push ref_00020bd2  ; push 0x20bd2
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000170c:
+lea eax, [ebp - 0x20]
+push eax
+push 0
+push 0
+push ref_000291dc  ; push 0x291dc
+call fcn_0001975d  ; call 0x1975d
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00001762  ; je 0x1762
+test ebx, ebx
+jns short loc_00001762  ; jns 0x1762
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000174d  ; je 0x174d
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000174d:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x60
+push ref_00020bd2  ; push 0x20bd2
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00001762:
+mov eax, dword [ebp - 0x4c]
+lea ebx, [eax + 0x50]
+push eax
+push eax
+push 2
+push ebx
+call fcn_00018927  ; call 0x18927
+pop eax
+push dword [ebp - 0x44]
+mov dword [ebp - 0x34], 0
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+cmp byte [edi], 0x10
+mov word [ebp - 0x40], ax
+jbe short loc_00001797  ; jbe 0x1797
+mov eax, dword [edi + 1]
+cmp byte [eax + 0x33], 0
+jne short loc_000017ca  ; jne 0x17ca
+
+loc_00001797:
+lea esi, [ebp - 0x34]
+push eax
+push esi
+lea edx, [ebp - 0x30]
+push edx
+push dword [ebp + 8]
+call fcn_00000eb7  ; call 0xeb7
+lea edx, [ebp - 0x2c]
+mov dword [esp], edx
+mov edx, dword [edi + 5]
+movzx edx, byte [edx + 6]
+push edx
+push esi
+mov eax, dword [edi + 0xd]
+movzx eax, byte [eax + 4]
+push eax
+push dword [ebp + 8]
+call fcn_000012ad  ; call 0x12ad
+add esp, 0x20
+
+loc_000017ca:
+mov eax, dword [edi + 5]
+mov eax, dword [eax + 8]
+test eax, eax
+jne short loc_00001818  ; jne 0x1818
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000017ee  ; je 0x17ee
+push esi
+push esi
+push ref_00020c93  ; push 0x20c93
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000017ee:
+call fcn_00015480  ; call 0x15480
+test al, al
+je near loc_00001d2e  ; je 0x1d2e
+push ebx
+push ref_00020cde  ; push 0x20cde
+push 0x83
+push ref_00020bd2  ; push 0x20bd2
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+jmp near loc_00001d2e  ; jmp 0x1d2e
+
+loc_00001818:
+mov edx, dword [ebp - 0x3c]
+cmp edx, 0x40650
+sete cl
+cmp edx, 0x306c0
+sete dl
+or dl, cl
+mov byte [ebp - 0x47], cl
+mov byte [ebp - 0x45], dl
+jne short loc_00001848  ; jne 0x1848
+mov edx, eax
+and edx, 0xff000000
+cmp dword [ebp - 0x3c], 0x40660
+jne short loc_0000184f  ; jne 0x184f
+
+loc_00001848:
+and eax, 0xffc00000
+mov edx, eax
+
+loc_0000184f:
+mov eax, dword [ebp - 0x44]
+cmp word [ebp - 0x40], 0xffff
+setne byte [ebp - 0x46]
+add eax, 0x10
+mov esi, eax
+mov dword [ebp - 0x58], eax
+push eax
+push eax
+push edx
+push esi
+call fcn_00017e8f  ; call 0x17e8f
+mov dword [esp], esi
+call fcn_00017e4e  ; call 0x17e4e
+pop edx
+pop ecx
+push 6
+mov dword [ebp - 0x40], eax
+mov eax, dword [ebp - 0x44]
+and dword [ebp - 0x40], 0xfffffff0
+add eax, 4
+push eax
+mov dword [ebp - 0x50], eax
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+cmp byte [ebp - 0x46], 0
+je near loc_00001afa  ; je 0x1afa
+cmp dword [ebp - 0x34], 0
+mov eax, dword [edi + 5]
+je short loc_000018aa  ; je 0x18aa
+cmp byte [eax + 6], 0
+jne short loc_000018b0  ; jne 0x18b0
+
+loc_000018aa:
+cmp byte [eax + 5], 0
+jne short loc_000018ba  ; jne 0x18ba
+
+loc_000018b0:
+cmp byte [eax + 5], 1
+jne near loc_00001afa  ; jne 0x1afa
+
+loc_000018ba:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000018d4  ; je 0x18d4
+push eax
+push eax
+push ref_00020cec  ; push 0x20cec
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000018d4:
+push eax
+push eax
+mov eax, dword [ebp - 0x20]
+push 1
+push dword [eax + 4]
+call fcn_0001c5d1  ; call 0x1c5d1
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000192a  ; je 0x192a
+test esi, esi
+jns short loc_0000192a  ; jns 0x192a
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00001912  ; je 0x1912
+push eax
+push esi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00001912:
+push ecx
+push ref_000206f4  ; push 0x206f4
+push 0xae
+push ref_00020bd2  ; push 0x20bd2
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000192a:
+mov eax, dword [edi + 5]
+cmp byte [ebp - 0x45], 0
+movzx esi, byte [eax + 4]
+jne short loc_00001940  ; jne 0x1940
+cmp dword [ebp - 0x3c], 0x40660
+jne short loc_00001962  ; jne 0x1962
+
+loc_00001940:
+push eax
+push eax
+push 0xff07
+push ebx
+call fcn_00018954  ; call 0x18954
+pop eax
+pop edx
+lea eax, [esi*8]
+movzx esi, al
+push esi
+push ebx
+call fcn_00018730  ; call 0x18730
+jmp short loc_00001981  ; jmp 0x1981
+
+loc_00001962:
+push eax
+push eax
+push 0xff
+push ebx
+call fcn_00018954  ; call 0x18954
+shl esi, 8
+pop edx
+and esi, 0x3f00
+pop ecx
+push esi
+push ebx
+call fcn_00018927  ; call 0x18927
+
+loc_00001981:
+mov eax, dword [edi + 5]
+add esp, 0x10
+cmp word [eax + 2], 0
+mov eax, dword [ebp - 0x44]
+lea esi, [eax + 0x62]
+je short loc_00001a03  ; je 0x1a03
+cmp byte [ebp - 0x45], 0
+jne short loc_000019a3  ; jne 0x19a3
+cmp dword [ebp - 0x3c], 0x40660
+jne short loc_000019b9  ; jne 0x19b9
+
+loc_000019a3:
+push eax
+push 0x200
+push 0xfcff
+push ebx
+call fcn_00018981  ; call 0x18981
+add esp, 0x10
+jmp short loc_00001a03  ; jmp 0x1a03
+
+loc_000019b9:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000019e4  ; je 0x19e4
+mov eax, dword [edi + 5]
+cmp word [eax + 2], 3
+jbe short loc_000019e4  ; jbe 0x19e4
+push eax
+push ref_00020cfa  ; push 0x20cfa
+push 0xd0
+push ref_00020bd2  ; push 0x20bd2
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000019e4:
+push eax
+mov eax, dword [edi + 5]
+movzx eax, word [eax + 2]
+shl eax, 6
+movzx eax, al
+push eax
+push 0xff3f
+push ebx
+call fcn_00018981  ; call 0x18981
+add esp, 0x10
+jmp short loc_00001a26  ; jmp 0x1a26
+
+loc_00001a03:
+cmp byte [ebp - 0x45], 0
+jne short loc_00001a12  ; jne 0x1a12
+cmp dword [ebp - 0x3c], 0x40660
+jne short loc_00001a26  ; jne 0x1a26
+
+loc_00001a12:
+push eax
+mov eax, dword [edi + 5]
+mov al, byte [eax + 7]
+add eax, eax
+movzx eax, al
+push eax
+push 0xf9
+jmp short loc_00001a34  ; jmp 0x1a34
+
+loc_00001a26:
+push eax
+mov eax, dword [edi + 5]
+movzx eax, byte [eax + 7]
+push eax
+push 0xe0
+
+loc_00001a34:
+push esi
+call fcn_0001878a  ; call 0x1878a
+mov eax, dword [edi + 5]
+add esp, 0x10
+cmp byte [eax + 6], 0
+je short loc_00001a72  ; je 0x1a72
+cmp dword [ebp - 0x34], 0
+je short loc_00001a72  ; je 0x1a72
+push ecx
+push ecx
+push 2
+push ebx
+call fcn_00018927  ; call 0x18927
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00001a82  ; je 0x1a82
+push edx
+push edx
+push ref_00020d26  ; push 0x20d26
+push 0x40
+call fcn_00015487  ; call 0x15487
+jmp short loc_00001a7f  ; jmp 0x1a7f
+
+loc_00001a72:
+push eax
+push eax
+push 0xfffd
+push ebx
+call fcn_00018954  ; call 0x18954
+
+loc_00001a7f:
+add esp, 0x10
+
+loc_00001a82:
+mov eax, dword [ebp - 0x3c]
+cmp eax, 0x40670
+je short loc_00001a93  ; je 0x1a93
+cmp eax, 0x306d0
+jne short loc_00001aab  ; jne 0x1aab
+
+loc_00001a93:
+push eax
+push eax
+mov eax, dword [ebp - 0x40]
+push 0x4000
+add eax, 0x6c004
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+
+loc_00001aab:
+cmp byte [edi], 0xd
+jbe short loc_00001ad4  ; jbe 0x1ad4
+mov eax, dword [edi + 5]
+cmp byte [eax + 0xc], 1
+jne short loc_00001ad4  ; jne 0x1ad4
+cmp dword [ebp - 0x1c], 0x11
+je short loc_00001ad4  ; je 0x1ad4
+push eax
+push eax
+mov eax, dword [ebp - 0x40]
+push 8
+add eax, 0xc7204
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+
+loc_00001ad4:
+push eax
+push eax
+push 0xfff9
+push dword [ebp - 0x50]
+call fcn_00018954  ; call 0x18954
+lea eax, [ebp - 0x28]
+push eax
+push 0
+push 2
+push 0
+call fcn_00000d20  ; call 0xd20
+add esp, 0x20
+jmp near loc_00001cc4  ; jmp 0x1cc4
+
+loc_00001afa:
+push eax
+push eax
+mov eax, dword [ebp - 0x20]
+push 0
+push dword [eax + 4]
+call fcn_0001c5d1  ; call 0x1c5d1
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00001b50  ; je 0x1b50
+test esi, esi
+jns short loc_00001b50  ; jns 0x1b50
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00001b38  ; je 0x1b38
+push eax
+push esi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00001b38:
+push esi
+push ref_000206f4  ; push 0x206f4
+push 0x106
+push ref_00020bd2  ; push 0x20bd2
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00001b50:
+lea eax, [ebp - 0x24]
+push eax
+push 0
+push 0
+push ref_000290cc  ; push 0x290cc
+call fcn_0001975d  ; call 0x1975d
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00001ba9  ; je 0x1ba9
+test esi, esi
+jns short loc_00001ba9  ; jns 0x1ba9
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00001b91  ; je 0x1b91
+push ecx
+push esi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00001b91:
+push edx
+push ref_000206f4  ; push 0x206f4
+push 0x108
+push ref_00020bd2  ; push 0x20bd2
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00001ba9:
+cmp dword [ebp - 0x3c], 0x306d0
+je short loc_00001bbc  ; je 0x1bbc
+cmp byte [ebp - 0x47], 0
+je near loc_00001c4b  ; je 0x1c4b
+
+loc_00001bbc:
+push eax
+mov eax, dword [ebp - 0x40]
+push 0x80000000
+push 0xffffffffffffffff
+add eax, 0x130040
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp byte [ebp - 0x46], 0
+je short loc_00001bfd  ; je 0x1bfd
+push eax
+mov eax, dword [ebp - 0x40]
+xor edx, edx
+push 0
+push 0x40000000
+push 0x130040
+push edx
+push eax
+push dword [ebp - 0x24]
+push dword [ebp + 8]
+call fcn_000015c6  ; call 0x15c6
+add esp, 0x20
+
+loc_00001bfd:
+mov esi, dword [ebp - 0x54]
+push eax
+push 1
+push 0xffffffffffffffff
+and esi, 0xfffffffe
+lea eax, [esi + 0x5f0c]
+push eax
+call fcn_00018b68  ; call 0x18b68
+mov eax, dword [ebp - 0x24]
+add esp, 0xc
+push 1
+push eax
+push dword [ebp + 8]
+call dword [eax + 4]  ; ucall
+add esp, 0x10
+cmp byte [ebp - 0x46], 0
+je short loc_00001c4b  ; je 0x1c4b
+push eax
+xor edx, edx
+push 0
+push 0x200
+push 0x5f0c
+push edx
+push esi
+push dword [ebp - 0x24]
+push dword [ebp + 8]
+call fcn_000015c6  ; call 0x15c6
+add esp, 0x20
+
+loc_00001c4b:
+push eax
+push eax
+push 0xfff9
+push dword [ebp - 0x50]
+call fcn_00018954  ; call 0x18954
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00001c77  ; je 0x1c77
+push eax
+push eax
+push ref_00020d66  ; push 0x20d66
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00001c77:
+cmp byte [ebp - 0x45], 0
+jne short loc_00001c86  ; jne 0x1c86
+cmp dword [ebp - 0x3c], 0x40660
+jne short loc_00001c90  ; jne 0x1c90
+
+loc_00001c86:
+push esi
+push 2
+push 0xfc07
+jmp short loc_00001c95  ; jmp 0x1c95
+
+loc_00001c90:
+push ecx
+push 2
+push 0x3f
+
+loc_00001c95:
+push ebx
+call fcn_00018981  ; call 0x18981
+mov eax, dword [edi + 5]
+add esp, 0x10
+mov word [eax + 2], 0
+mov eax, dword [edi + 5]
+mov byte [eax + 4], 0
+mov eax, dword [ebp - 0x4c]
+push edx
+push edx
+push 0xef
+add eax, 0x54
+push eax
+call fcn_0001875d  ; call 0x1875d
+add esp, 0x10
+
+loc_00001cc4:
+mov eax, dword [ebp - 0x2c]
+mov esi, dword [ebp - 0x30]
+mov ebx, dword [ebp - 0x28]
+mov dword [ebp - 0x3c], eax
+push eax
+push eax
+push 0
+push dword [ebp - 0x58]
+call fcn_00018b3e  ; call 0x18b3e
+mov eax, dword [edi + 9]
+add esp, 0x10
+cmp byte [eax + 3], 0
+jne short loc_00001d2e  ; jne 0x1d2e
+add esi, dword [ebp - 0x3c]
+mov edx, dword [edi + 5]
+add ebx, esi
+cmp ebx, 0x3fffffff
+jbe short loc_00001cff  ; jbe 0x1cff
+mov word [edx], 0x800
+jmp short loc_00001d2e  ; jmp 0x1d2e
+
+loc_00001cff:
+cmp ebx, 0x2fffffff
+jbe short loc_00001d0e  ; jbe 0x1d0e
+mov word [edx], 0x700
+jmp short loc_00001d2e  ; jmp 0x1d2e
+
+loc_00001d0e:
+cmp ebx, 0x1fffffff
+jbe short loc_00001d1d  ; jbe 0x1d1d
+mov word [edx], 0x600
+jmp short loc_00001d2e  ; jmp 0x1d2e
+
+loc_00001d1d:
+cmp ebx, 0x10000000
+sbb eax, eax
+xor al, al
+add ax, 0x500
+mov word [edx], ax
+
+loc_00001d2e:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00001d36:
+push ebp
+xor ecx, ecx
+mov ebp, esp
+mov edx, 1
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov dword [ebp - 0x1c], 0
+
+loc_00001d53:
+mov eax, dword [esi + ecx*4]
+mov ebx, edx
+shl ebx, cl
+inc ecx
+or byte [ebp + eax - 0x1c], bl
+cmp ecx, 8
+jne short loc_00001d53  ; jne 0x1d53
+xor ebx, ebx
+
+loc_00001d66:
+cmp byte [esi + ebx*2 + 0x20], 1
+mov cl, bl
+jne short loc_00001dbd  ; jne 0x1dbd
+movzx eax, byte [esi + ebx*2 + 0x21]
+movzx edx, byte [ebp + ebx - 0x1c]
+shl eax, 0x18
+or edx, 0x80000000
+or edx, eax
+cmp bl, 2
+je short loc_00001d9f  ; je 0x1d9f
+cmp bl, 3
+je short loc_00001da6  ; je 0x1da6
+dec cl
+mov eax, 0x14
+mov ecx, 0x20
+cmove eax, ecx
+jmp short loc_00001dab  ; jmp 0x1dab
+
+loc_00001d9f:
+mov eax, 0x2c
+jmp short loc_00001dab  ; jmp 0x1dab
+
+loc_00001da6:
+mov eax, 0x38
+
+loc_00001dab:
+push ecx
+add eax, edi
+push edx
+push 0xf8ffff01
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_00001dbd:
+inc ebx
+cmp ebx, 4
+jne short loc_00001d66  ; jne 0x1d66
+push eax
+xor eax, eax
+cmp byte [esi + 0x22], 1
+sete al
+add edi, 4
+push eax
+push 0xf8
+push edi
+call fcn_0001878a  ; call 0x1878a
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00001de6:
+push ebp
+mov ebp, esp
+push edi
+xor edi, edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 0xc]
+
+loc_00001df4:
+mov ecx, dword [ebp + 8]
+mov eax, edi
+cmp byte [ecx + edi*2 + 0x20], 1
+je short loc_00001e10  ; je 0x1e10
+
+loc_00001e00:
+inc edi
+cmp edi, 4
+jne short loc_00001df4  ; jne 0x1df4
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+loc_00001e10:
+cmp al, 2
+je short loc_00001e29  ; je 0x1e29
+cmp al, 3
+je short loc_00001e30  ; je 0x1e30
+dec al
+mov esi, 0x1a
+mov eax, 0x26
+cmove esi, eax
+jmp short loc_00001e35  ; jmp 0x1e35
+
+loc_00001e29:
+mov esi, 0x32
+jmp short loc_00001e35  ; jmp 0x1e35
+
+loc_00001e30:
+mov esi, 0x3e
+
+loc_00001e35:
+add esi, ebx
+
+loc_00001e37:
+sub esp, 0xc
+push esi
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test al, 2
+jne short loc_00001e37  ; jne 0x1e37
+jmp short loc_00001e00  ; jmp 0x1e00
+
+fcn_00001e49:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x30
+mov ebx, dword [ebp + 0xc]
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov esi, eax
+add esi, 0x68
+lea eax, [eax + 0x48]
+mov dword [esp], eax
+call fcn_00017ed8  ; call 0x17ed8
+mov dword [esp], esi
+call fcn_00017ed8  ; call 0x17ed8
+and eax, 0xfffffffe
+mov edi, edx
+mov esi, eax
+call fcn_0001c651  ; call 0x1c651
+mov dword [ebp - 0x30], eax
+lea eax, [ebp - 0x20]
+push eax
+push 0
+push 0
+push ref_000291ac  ; push 0x291ac
+call fcn_0001975d  ; call 0x1975d
+add esp, 0x20
+mov dword [ebp - 0x2c], eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00001ee2  ; je 0x1ee2
+cmp dword [ebp - 0x2c], 0
+jns short loc_00001ee2  ; jns 0x1ee2
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00001ecd  ; je 0x1ecd
+push eax
+push dword [ebp - 0x2c]
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00001ecd:
+push ecx
+push ref_000206f4  ; push 0x206f4
+push 0x3e
+push ref_00020d7b  ; push 0x20d7b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00001ee2:
+lea eax, [ebp - 0x1c]
+push eax
+push 0
+push 0
+push ref_0002917c  ; push 0x2917c
+call fcn_0001975d  ; call 0x1975d
+mov dword [ebp - 0x2c], eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00001f3d  ; je 0x1f3d
+cmp dword [ebp - 0x2c], 0
+jns short loc_00001f3d  ; jns 0x1f3d
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00001f28  ; je 0x1f28
+push edx
+push dword [ebp - 0x2c]
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00001f28:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x41
+push ref_00020d7b  ; push 0x20d7b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00001f3d:
+mov eax, dword [ebp - 0x30]
+cmp eax, 0x40660
+je short loc_00001f88  ; je 0x1f88
+cmp eax, 0x306c0
+je short loc_00001f88  ; je 0x1f88
+cmp eax, 0x40670
+je short loc_00001f6a  ; je 0x1f6a
+
+loc_00001f55:
+push eax
+push eax
+push 2
+lea eax, [esi + 0xa78]
+push eax
+call fcn_00018730  ; call 0x18730
+add esp, 0x10
+jmp short loc_00001f88  ; jmp 0x1f88
+
+loc_00001f6a:
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+je short loc_00001f55  ; je 0x1f55
+
+loc_00001f88:
+mov edx, dword [ebx + 0xd]
+mov eax, dword [ebp - 0x1c]
+mov dl, byte [edx]
+mov byte [eax + 0x22], dl
+mov edx, dword [ebx + 0xd]
+mov dl, byte [edx + 1]
+mov byte [eax + 0x24], dl
+mov edx, dword [ebx + 0xd]
+mov dl, byte [edx + 2]
+mov byte [eax + 0x26], dl
+xor eax, eax
+
+loc_00001fa7:
+mov edx, dword [ebp - 0x1c]
+lea ebx, [edx + eax*4]
+mov ecx, dword [ebx]
+cmp ecx, 1
+jne short loc_00001fba  ; jne 0x1fba
+cmp byte [edx + 0x22], 0
+jmp short loc_00001fce  ; jmp 0x1fce
+
+loc_00001fba:
+cmp ecx, 2
+jne short loc_00001fc5  ; jne 0x1fc5
+cmp byte [edx + 0x24], 0
+jmp short loc_00001fce  ; jmp 0x1fce
+
+loc_00001fc5:
+cmp ecx, 3
+jne short loc_00001fd6  ; jne 0x1fd6
+cmp byte [edx + 0x26], 0
+
+loc_00001fce:
+jne short loc_00001fd6  ; jne 0x1fd6
+mov dword [ebx], 0
+
+loc_00001fd6:
+inc eax
+cmp eax, 8
+jne short loc_00001fa7  ; jne 0x1fa7
+push eax
+push edi
+push esi
+push dword [ebp - 0x1c]
+call fcn_00001d36  ; call 0x1d36
+mov eax, dword [ebp - 0x20]
+call dword [eax + 4]  ; ucall
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00002031  ; je 0x2031
+test ebx, ebx
+jns short loc_00002031  ; jns 0x2031
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000201c  ; je 0x201c
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000201c:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x62
+push ref_00020d7b  ; push 0x20d7b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00002031:
+push ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+call fcn_00001de6  ; call 0x1de6
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000207e  ; je 0x207e
+test ebx, ebx
+jns short loc_0000207e  ; jns 0x207e
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00002069  ; je 0x2069
+push edx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00002069:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x68
+push ref_00020d7b  ; push 0x20d7b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000207e:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00002088:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 8]
+push 0x20
+lea eax, [ebx + 0x88]
+add ebx, 0x8a
+push eax
+call fcn_00018730  ; call 0x18730
+add esp, 0x10
+
+loc_000020a9:
+sub esp, 0xc
+push ebx
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test ah, 8
+jne short loc_000020a9  ; jne 0x20a9
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000020bf:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 8
+mov ebx, dword [ebp + 0x10]
+push 0x20000000
+push 0xdfffffff
+lea eax, [ebx + 0x258]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0xc
+push 0x6b5
+push 0xfffff800
+lea eax, [ebx + 0x208]
+add ebx, 0x22c
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+mov dword [ebp + 8], ebx
+mov ebx, dword [ebp - 4]
+mov dword [ebp + 0x10], 0x2020
+mov dword [ebp + 0xc], 0xffff0000
+leave
+jmp near fcn_00018b68  ; jmp 0x18b68
+
+fcn_0000211b:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x30
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov ebx, eax
+lea eax, [eax + 0x48]
+add ebx, 0x68
+mov dword [esp], eax
+call fcn_00017ed8  ; call 0x17ed8
+mov dword [esp], ebx
+mov dword [ebp - 0x30], eax
+call fcn_00017ed8  ; call 0x17ed8
+mov ebx, eax
+lea eax, [ebp - 0x1c]
+push eax
+push 0
+push 0
+push ref_000291dc  ; push 0x291dc
+mov dword [ebp - 0x2c], edx
+call fcn_0001975d  ; call 0x1975d
+add esp, 0x20
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000021a8  ; je 0x21a8
+test esi, esi
+jns short loc_000021ca  ; jns 0x21ca
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00002190  ; je 0x2190
+push eax
+push esi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00002190:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x13f
+push ref_00020d7b  ; push 0x20d7b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000021a8:
+test esi, esi
+jns short loc_000021ca  ; jns 0x21ca
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_00002411  ; je 0x2411
+push edi
+push edi
+push ref_00020daa  ; push 0x20daa
+push 0x80000000
+jmp near loc_0000235c  ; jmp 0x235c
+
+loc_000021ca:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000021e4  ; je 0x21e4
+push esi
+push esi
+push ref_00020dd9  ; push 0x20dd9
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000021e4:
+and ebx, 0xfffffffe
+mov edi, dword [ebp - 0x2c]
+sub esp, 0xc
+mov esi, ebx
+mov dword [ebp - 0x2c], ebx
+mov ebx, dword [ebp - 0x30]
+push 0
+push 0
+push esi
+and ebx, 0xfffffffe
+push ebx
+push dword [ebp + 0xc]
+call fcn_00004257  ; call 0x4257
+add esp, 0x20
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00002223  ; je 0x2223
+push ecx
+push ecx
+push ref_00020de8  ; push 0x20de8
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00002223:
+push edx
+push dword [ebp - 0x2c]
+push ebx
+push dword [ebp + 0xc]
+call fcn_000020bf  ; call 0x20bf
+mov ecx, dword [ebp + 0xc]
+add esp, 0x10
+mov eax, dword [ecx + 0xd]
+cmp byte [eax + 3], 0
+mov eax, dword [ebp - 0x2c]
+lea eax, [eax + 0x84]
+mov dword [ebp - 0x30], eax
+jne short loc_0000226e  ; jne 0x226e
+
+loc_0000224b:
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_0000240a  ; je 0x240a
+push eax
+push eax
+push ref_00020e08  ; push 0x20e08
+push 2
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp near loc_0000240a  ; jmp 0x240a
+
+loc_0000226e:
+mov eax, dword [ebp - 0x1c]
+sub esp, 0xc
+mov eax, dword [eax + 4]
+add eax, 0x21a4
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+and eax, 0xf
+dec al
+je short loc_0000224b  ; je 0x224b
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xe4
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test eax, 0x400000
+jne short loc_0000224b  ; jne 0x224b
+lea eax, [ebp - 0x20]
+push eax
+push 0
+push 0
+push ref_000291ac  ; push 0x291ac
+call fcn_0001975d  ; call 0x1975d
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_000022d7  ; je 0x22d7
+test ebx, ebx
+js near loc_00002369  ; js 0x2369
+
+loc_000022d7:
+mov eax, dword [ebp - 0x20]
+mov bl, 1
+call dword [eax + 8]  ; ucall
+push eax
+push 2
+push 0xfffffffffffffff0
+push dword [ebp - 0x30]
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_000022ef:
+sub esp, 0xc
+push dword [ebp - 0x30]
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0xc
+and eax, 0xf
+push eax
+mov eax, dword [ebp - 0x2c]
+push 0xfffffffffffffff0
+add eax, 0x98
+push eax
+call fcn_00018b68  ; call 0x18b68
+pop ecx
+pop eax
+push edi
+push esi
+call fcn_00002088  ; call 0x2088
+mov eax, dword [ebp - 0x2c]
+add esp, 0x10
+test bl, bl
+lea ebx, [eax + 0x8a]
+jne short loc_000023a3  ; jne 0x23a3
+
+loc_0000232a:
+sub esp, 0xc
+xor esi, esi
+push ebx
+call fcn_00017dc2  ; call 0x17dc2
+mov ebx, eax
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je near loc_00002411  ; je 0x2411
+mov eax, ebx
+and eax, 0xf
+shr bx, 4
+push eax
+and ebx, 0x3f
+push ebx
+push ref_00020e5f  ; push 0x20e5f
+push 0x40
+
+loc_0000235c:
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp near loc_00002411  ; jmp 0x2411
+
+loc_00002369:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00002386  ; je 0x2386
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00002386:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x15f
+push ref_00020d7b  ; push 0x20d7b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+jmp near loc_000022d7  ; jmp 0x22d7
+
+loc_000023a3:
+sub esp, 0xc
+push ebx
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+and eax, 0xf
+cmp ax, 2
+je short loc_000023d4  ; je 0x23d4
+
+loc_000023b8:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000023f9  ; je 0x23f9
+push edx
+push edx
+push ref_00020e40  ; push 0x20e40
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp short loc_000023f9  ; jmp 0x23f9
+
+loc_000023d4:
+mov eax, dword [ebp - 0x1c]
+sub esp, 0xc
+mov eax, dword [eax + 4]
+add eax, 0x21aa
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+and eax, 0xf
+cmp ax, 2
+jne short loc_000023b8  ; jne 0x23b8
+jmp near loc_0000232a  ; jmp 0x232a
+
+loc_000023f9:
+push eax
+push eax
+push edi
+push esi
+call fcn_00002088  ; call 0x2088
+add esp, 0x10
+jmp near loc_0000232a  ; jmp 0x232a
+
+loc_0000240a:
+xor ebx, ebx
+jmp near loc_000022ef  ; jmp 0x22ef
+
+loc_00002411:
+lea esp, [ebp - 0xc]
+mov eax, esi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000241b:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov eax, dword [ebp + 8]
+push 0
+push 0
+push 0
+mov esi, eax
+mov eax, dword [ebp + 0xc]
+mov edi, eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp - 0x1c], eax
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x54
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov ebx, eax
+call fcn_00015479  ; call 0x15479
+shr ebx, 1
+add esp, 0x10
+and ebx, 7
+test al, al
+je short loc_00002480  ; je 0x2480
+movzx edx, byte [ebp - 0x1c]
+mov eax, edi
+push ecx
+movzx eax, al
+mov ecx, esi
+movzx ecx, cl
+push edx
+push eax
+push ecx
+push edx
+push eax
+push ref_00020e7c  ; push 0x20e7c
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_00002480:
+movzx edx, byte [ebp - 0x1c]
+mov eax, 2
+sub eax, edx
+bt ebx, eax
+jae near loc_00002524  ; jae 0x2524
+mov eax, edi
+push ecx
+movzx eax, al
+push edx
+push eax
+mov eax, esi
+movzx eax, al
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+mov esi, eax
+lea eax, [eax + 0xb2]
+add esi, 0x11a
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+mov dword [esp], esi
+mov ebx, eax
+call fcn_00017dc2  ; call 0x17dc2
+mov esi, eax
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_000024f2  ; je 0x24f2
+mov eax, ebx
+and eax, 0xf
+shr bx, 4
+push eax
+and ebx, 0x3f
+push ebx
+push ref_00020e92  ; push 0x20e92
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000024f2:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00002512  ; je 0x2512
+shr si, 1
+and esi, 1
+push eax
+push esi
+push ref_00020eab  ; push 0x20eab
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00002512:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00002547  ; je 0x2547
+mov dword [ebp + 0xc], ref_00021f21  ; mov dword [ebp + 0xc], 0x21f21
+jmp short loc_00002534  ; jmp 0x2534
+
+loc_00002524:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00002547  ; je 0x2547
+mov dword [ebp + 0xc], ref_00021751  ; mov dword [ebp + 0xc], 0x21751
+
+loc_00002534:
+mov dword [ebp + 8], 0x40
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00015487  ; jmp 0x15487
+
+loc_00002547:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000254f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov eax, dword [ebp + 0x10]
+movzx ebx, byte [ebp + 0x18]
+mov ecx, eax
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x14]
+push ebx
+mov dword [ebp - 0x20], eax
+movzx eax, al
+push eax
+movzx eax, cl
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0
+push 0
+mov edi, eax
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x54
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, 2
+add esp, 0x10
+sub edx, ebx
+shr eax, 1
+and eax, 7
+bt eax, edx
+jae near loc_0000262c  ; jae 0x262c
+sub esp, 0xc
+add edi, 0x11a
+push edi
+xor esi, esi
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+mov edx, eax
+shr dx, 1
+and edx, 1
+
+loc_000025c7:
+cmp esi, 0x63
+ja short loc_000025f9  ; ja 0x25f9
+test dx, dx
+je short loc_000025f9  ; je 0x25f9
+push eax
+mov eax, dword [ebp + 0xc]
+inc esi
+push 0x3e8
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call dword [eax + 4]  ; ucall
+mov dword [esp], edi
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+mov edx, eax
+shr dx, 1
+and edx, 1
+jmp short loc_000025c7  ; jmp 0x25c7
+
+loc_000025f9:
+mov dword [ebp - 0x24], edx
+call fcn_00015479  ; call 0x15479
+mov edx, dword [ebp - 0x24]
+test al, al
+je short loc_0000262c  ; je 0x262c
+sub esp, 0xc
+movzx eax, byte [ebp - 0x20]
+movzx edx, dx
+push esi
+push edx
+movzx edx, byte [ebp - 0x1c]
+push ebx
+push eax
+push edx
+push ebx
+push eax
+push ref_00020eca  ; push 0x20eca
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x30
+
+loc_0000262c:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00002634:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x38
+mov esi, dword [ebp + 0x14]
+lea eax, [ebp - 0x1c]
+mov ebx, dword [ebp + 0x18]
+push eax
+call fcn_00019797  ; call 0x19797
+mov edi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00002693  ; je 0x2693
+test edi, edi
+jns short loc_00002693  ; jns 0x2693
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000267b  ; je 0x267b
+push ecx
+push edi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000267b:
+push edx
+push ref_000206f4  ; push 0x206f4
+push 0xa0
+push ref_00020f0c  ; push 0x20f0c
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00002693:
+cmp dword [ebp - 0x1c], 0x11
+jne short loc_0000269f  ; jne 0x269f
+
+loc_00002699:
+test esi, esi
+jne short loc_000026b6  ; jne 0x26b6
+jmp short loc_000026b0  ; jmp 0x26b0
+
+loc_0000269f:
+sub esp, 0xc
+push 1
+call fcn_0001c321  ; call 0x1c321
+add esp, 0x10
+dec al
+je short loc_00002699  ; je 0x2699
+
+loc_000026b0:
+mov byte [ebp - 0x2a], 0xf8
+jmp short loc_000026e4  ; jmp 0x26e4
+
+loc_000026b6:
+cmp byte [esi + 0x28], 0
+je short loc_000026b0  ; je 0x26b0
+mov al, byte [esi + 0x46]
+mov byte [ebp - 0x2a], al
+test al, al
+je short loc_000026b0  ; je 0x26b0
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000026e4  ; je 0x26e4
+push eax
+movzx eax, byte [esi + 0x46]
+push eax
+push ref_00020f40  ; push 0x20f40
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000026e4:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00002702  ; je 0x2702
+push eax
+movzx eax, byte [ebp - 0x2a]
+push eax
+push ref_00020f6a  ; push 0x20f6a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00002702:
+cmp bl, 2
+je short loc_00002713  ; je 0x2713
+xor edi, edi
+mov al, 6
+cmp bl, 3
+cmove edi, eax
+jmp short loc_00002718  ; jmp 0x2718
+
+loc_00002713:
+mov edi, 4
+
+loc_00002718:
+mov al, byte [ebp - 0x2a]
+mov byte [ebp - 0x2b], 0
+mov byte [ebp - 0x29], 0
+or eax, edi
+mov byte [ebp - 0x2d], al
+
+loc_00002728:
+xor ebx, ebx
+mov byte [ebp - 0x2c], 1
+
+loc_0000272e:
+mov dl, byte [ebp - 0x2c]
+mov al, dl
+and eax, edi
+cmp dl, al
+jne short loc_0000276a  ; jne 0x276a
+cmp byte [ebp - 0x2b], 0
+jne near loc_000027d9  ; jne 0x27d9
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_000027d9  ; je 0x27d9
+push eax
+push ebx
+push 1
+push 0
+push ebx
+push 1
+push ref_00020f8f  ; push 0x20f8f
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+jmp short loc_000027d9  ; jmp 0x27d9
+
+loc_0000276a:
+mov al, byte [ebp - 0x29]
+mov cl, byte [ebp - 0x2c]
+or al, byte [ebp - 0x2a]
+and eax, ecx
+cmp cl, al
+je short loc_000027d9  ; je 0x27d9
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000279a  ; je 0x279a
+push eax
+push ebx
+push 1
+push 0
+push ebx
+push 1
+push ref_00020fc0  ; push 0x20fc0
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_0000279a:
+push eax
+push ebx
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x11a
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test al, 2
+jne short loc_000027d9  ; jne 0x27d9
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000027d3  ; je 0x27d3
+push eax
+push eax
+push ref_00020fe0  ; push 0x20fe0
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000027d3:
+mov al, byte [ebp - 0x2c]
+or byte [ebp - 0x29], al
+
+loc_000027d9:
+inc ebx
+shl byte [ebp - 0x2c], 1
+cmp ebx, 3
+jne near loc_0000272e  ; jne 0x272e
+mov al, byte [ebp - 0x2d]
+or al, byte [ebp - 0x29]
+inc al
+je short loc_00002812  ; je 0x2812
+push ecx
+mov eax, dword [ebp + 0xc]
+push 0x3e8
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call dword [eax + 4]  ; ucall
+inc byte [ebp - 0x2b]
+add esp, 0x10
+cmp byte [ebp - 0x2b], 0x64
+jne near loc_00002728  ; jne 0x2728
+
+loc_00002812:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00002830  ; je 0x2830
+movzx eax, byte [ebp - 0x2b]
+push edx
+push eax
+push ref_00020ffe  ; push 0x20ffe
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00002830:
+test esi, esi
+je short loc_0000285a  ; je 0x285a
+mov al, byte [ebp - 0x29]
+not eax
+mov byte [esi + 0x46], al
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000285a  ; je 0x285a
+push eax
+movzx eax, byte [esi + 0x46]
+push eax
+push ref_00021014  ; push 0x21014
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000285a:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00002862:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov al, byte [ebp + 0x14]
+mov byte [ebp - 0x19], al
+movzx eax, byte [ebp + 0x10]
+push eax
+movzx eax, byte [ebp + 0xc]
+push eax
+movzx eax, byte [ebp + 8]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+mov esi, eax
+lea eax, [eax + 0x34]
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+cmp al, 0xff
+jne short loc_000028c8  ; jne 0x28c8
+
+loc_00002899:
+xor eax, eax
+jmp short loc_000028d0  ; jmp 0x28d0
+
+loc_0000289d:
+mov edi, eax
+sub esp, 0xc
+and edi, 0xfc
+lea ebx, [edi + esi]
+push ebx
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+cmp al, byte [ebp - 0x19]
+je short loc_000028ce  ; je 0x28ce
+sub esp, 0xc
+lea edx, [ebx + 1]
+push edx
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+
+loc_000028c8:
+test al, al
+jne short loc_0000289d  ; jne 0x289d
+jmp short loc_00002899  ; jmp 0x2899
+
+loc_000028ce:
+mov eax, edi
+
+loc_000028d0:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000028d8:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x30
+mov eax, dword [ebp + 0xc]
+mov edi, dword [ebp + 8]
+mov dword [ebp - 0x2c], eax
+mov ebx, eax
+movzx eax, byte [ebp + 0x14]
+push eax
+movzx eax, byte [ebp + 0x10]
+push eax
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0x10
+test bl, bl
+je near loc_000029da  ; je 0x29da
+mov esi, eax
+lea eax, [ebp - 0x1c]
+push eax
+push 0
+push 0
+push ref_000290cc  ; push 0x290cc
+call fcn_0001975d  ; call 0x1975d
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00002963  ; je 0x2963
+test ebx, ebx
+jns short loc_00002963  ; jns 0x2963
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000294b  ; je 0x294b
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000294b:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x146
+push ref_00020f0c  ; push 0x20f0c
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00002963:
+push eax
+push eax
+push 0x10
+lea ebx, [esi + 0xb0]
+push ebx
+call fcn_00018927  ; call 0x18927
+mov eax, dword [ebp - 0x1c]
+add esp, 0xc
+push 0x3e8
+push eax
+push edi
+call dword [eax + 4]  ; ucall
+mov al, byte [ebp - 0x2c]
+add esp, 0x10
+xor edx, edx
+dec eax
+cmp al, 7
+ja short loc_0000299a  ; ja 0x299a
+movzx eax, al
+movzx edx, byte [eax + ref_000203c8]  ; movzx edx, byte [eax + 0x203c8]
+
+loc_0000299a:
+push eax
+add esi, 0x224
+push edx
+push 0xffffffffffffffe0
+push esi
+call fcn_00018b68  ; call 0x18b68
+mov eax, dword [ebp - 0x1c]
+add esp, 0xc
+push 0x3e8
+push eax
+push edi
+call dword [eax + 4]  ; ucall
+pop edx
+pop ecx
+push 0xffef
+push ebx
+call fcn_00018954  ; call 0x18954
+mov eax, dword [ebp - 0x1c]
+add esp, 0xc
+push 0x186a0
+push eax
+push edi
+call dword [eax + 4]  ; ucall
+add esp, 0x10
+
+loc_000029da:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000029e2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov edx, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0x18]
+mov eax, dword [ebp + 0x14]
+mov ecx, dword [ebp + 0xc]
+mov esi, edx
+and edx, 1
+mov edi, dword [ebp + 8]
+shr esi, 1
+shl esi, 5
+add esi, 0x914
+cmp edx, 1
+sbb edx, edx
+add ebx, ebx
+and ebx, 0x7fff
+and eax, 0x3f
+and edx, 0xfff80000
+or ebx, 0x70000000
+shl eax, 0x15
+add edx, 0x100000
+or ebx, eax
+or ebx, edx
+test ecx, ecx
+jne short loc_00002a3e  ; jne 0x2a3e
+mov dword [ebp + 0xc], ebx
+add esi, edi
+jmp short loc_00002a51  ; jmp 0x2a51
+
+loc_00002a3e:
+push eax
+push 0
+push ecx
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0x10
+mov dword [ebp + 0xc], ebx
+add esi, eax
+
+loc_00002a51:
+mov dword [ebp + 8], esi
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f  ; jmp 0x17e8f
+
+fcn_00002a60:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0xc]
+shr ebx, 1
+shl ebx, 5
+add ebx, 0x914
+test esi, esi
+jne short loc_00002a89  ; jne 0x2a89
+mov eax, dword [ebp + 8]
+sub esp, 0xc
+add eax, ebx
+push eax
+jmp short loc_00002a99  ; jmp 0x2a99
+
+loc_00002a89:
+push edi
+push 0
+push esi
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, ebx
+mov dword [esp], eax
+
+loc_00002a99:
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, dword [ebp + 0x10]
+add esp, 0x10
+mov edi, dword [ebp + 0x14]
+and edx, 1
+and eax, 0x7ffe
+cmp edx, 1
+sbb ecx, ecx
+and edi, 0x3f
+shl edi, 0x15
+and ecx, 0xfff80000
+or edi, 0x68008000
+add ecx, 0x100000
+or edi, eax
+or edi, ecx
+test esi, esi
+jne short loc_00002adb  ; jne 0x2adb
+push esi
+add ebx, dword [ebp + 8]
+push esi
+jmp short loc_00002aea  ; jmp 0x2aea
+
+loc_00002adb:
+push eax
+push 0
+push esi
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+add ebx, eax
+
+loc_00002aea:
+push edi
+push ebx
+call fcn_00017e8f  ; call 0x17e8f
+mov dword [esp], ebx
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+shr eax, 1
+and eax, 0x3fff
+ret
+
+fcn_00002b0b:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov edx, dword [ebp + 0x10]
+mov eax, dword [ebp + 0xc]
+mov esi, dword [ebp + 8]
+mov ebx, dword [ebp + 0x14]
+mov dword [ebp - 0x24], edx
+mov dword [ebp - 0x20], eax
+call fcn_0001c651  ; call 0x1c651
+mov dword [ebp - 0x1c], eax
+call fcn_0001c678  ; call 0x1c678
+mov edx, dword [ebp - 0x24]
+cmp dl, 1
+je short loc_00002b42  ; je 0x2b42
+cmp dl, 2
+je short loc_00002b66  ; je 0x2b66
+jmp short loc_00002ba2  ; jmp 0x2ba2
+
+loc_00002b42:
+lea edi, [ebx - 8]
+cmp bl, 7
+ja short loc_00002ba4  ; ja 0x2ba4
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_00002c2f  ; je 0x2c2f
+movzx ebx, bl
+mov dword [ebp + 0x14], ebx
+mov dword [ebp + 0x10], 1
+jmp short loc_00002b88  ; jmp 0x2b88
+
+loc_00002b66:
+lea edi, [ebx - 0xc]
+cmp bl, 0xb
+ja short loc_00002ba4  ; ja 0x2ba4
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_00002c2f  ; je 0x2c2f
+movzx ebx, bl
+mov dword [ebp + 0x14], ebx
+mov dword [ebp + 0x10], 2
+
+loc_00002b88:
+mov dword [ebp + 0xc], ref_00021036  ; mov dword [ebp + 0xc], 0x21036
+mov dword [ebp + 8], 2
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00015487  ; jmp 0x15487
+
+loc_00002ba2:
+mov edi, ebx
+
+loc_00002ba4:
+mov ecx, esi
+movzx esi, byte [ebp - 0x20]
+test cl, cl
+je short loc_00002bca  ; je 0x2bca
+test edi, 1
+jne short loc_00002bc0  ; jne 0x2bc0
+shl esi, 8
+mov ebx, 0xfffff0ff
+jmp short loc_00002bfb  ; jmp 0x2bfb
+
+loc_00002bc0:
+shl esi, 0x18
+mov ebx, 0xf0ffffff
+jmp short loc_00002bfb  ; jmp 0x2bfb
+
+loc_00002bca:
+test eax, eax
+je short loc_00002be6  ; je 0x2be6
+cmp dword [ebp - 0x1c], 0x40670
+jne short loc_00002be6  ; jne 0x2be6
+
+loc_00002bd7:
+test edi, 1
+jne short loc_00002bf3  ; jne 0x2bf3
+
+loc_00002bdf:
+mov ebx, 0xfffffff0
+jmp short loc_00002bfb  ; jmp 0x2bfb
+
+loc_00002be6:
+cmp bl, 7
+jbe short loc_00002bd7  ; jbe 0x2bd7
+test edi, 1
+jne short loc_00002bdf  ; jne 0x2bdf
+
+loc_00002bf3:
+shl esi, 0x10
+mov ebx, 0xfff0ffff
+
+loc_00002bfb:
+movzx edx, dl
+push eax
+push edx
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov edx, edi
+add esp, 0x10
+shr dl, 1
+movzx edx, dl
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], ebx
+lea eax, [eax + edx*4 + 0xda0]
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018b68  ; jmp 0x18b68
+
+loc_00002c2f:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00002c37:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0x14]
+call fcn_0001c651  ; call 0x1c651
+mov dword [ebp - 0x1c], eax
+call fcn_0001c678  ; call 0x1c678
+mov dword [ebp - 0x20], eax
+xor eax, eax
+
+loc_00002c58:
+cmp byte [ebx + eax], 9
+jbe short loc_00002c62  ; jbe 0x2c62
+mov byte [ebx + eax], 8
+
+loc_00002c62:
+mov edi, dword [ebp + 0xc]
+cmp byte [edi + eax], 9
+jbe short loc_00002c6f  ; jbe 0x2c6f
+mov byte [edi + eax], 7
+
+loc_00002c6f:
+mov edi, dword [ebp + 0x10]
+cmp byte [edi + eax], 6
+jbe short loc_00002c7c  ; jbe 0x2c7c
+mov byte [edi + eax], 2
+
+loc_00002c7c:
+inc eax
+cmp eax, 0x10
+jne short loc_00002c58  ; jne 0x2c58
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 1
+push 1
+push 0
+mov edi, eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 2
+push 1
+push 0
+mov dword [ebp - 0x28], eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0x10
+cmp esi, 2
+mov ecx, dword [ebp - 0x28]
+mov dword [ebp - 0x24], eax
+je near loc_00002e17  ; je 0x2e17
+cmp esi, 3
+je short loc_00002cdb  ; je 0x2cdb
+test esi, esi
+jne near loc_000031b8  ; jne 0x31b8
+add edi, 0xda0
+xor esi, esi
+jmp near loc_00002fba  ; jmp 0x2fba
+
+loc_00002cdb:
+cmp dword [ebp - 0x20], 0
+lea ecx, [edi + 0xda0]
+je short loc_00002d52  ; je 0x2d52
+cmp dword [ebp - 0x1c], 0x40670
+jne short loc_00002d52  ; jne 0x2d52
+mov edi, ecx
+xor esi, esi
+
+loc_00002cf4:
+mov ecx, dword [ebp + 0x10]
+push eax
+mov eax, dword [ebp + 0xc]
+movzx edx, byte [ecx + esi*2]
+movzx eax, byte [eax + esi*2]
+mov ecx, dword [ebp + 0xc]
+shl edx, 0xc
+shl eax, 8
+or eax, edx
+movzx edx, byte [ebx + esi*2]
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 1]
+shl edx, 0x10
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 1]
+mov ecx, dword [ebp + 0x10]
+shl edx, 0x18
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 1]
+inc esi
+shl edx, 0x1c
+or eax, edx
+push eax
+push 0x80f080f0
+push edi
+add edi, 4
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp esi, 8
+jne short loc_00002cf4  ; jne 0x2cf4
+jmp near loc_000031b8  ; jmp 0x31b8
+
+loc_00002d52:
+xor esi, esi
+
+loc_00002d54:
+push eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x1c], ecx
+movzx edx, byte [eax + esi*2]
+mov eax, dword [ebp + 0x10]
+shl edx, 8
+movzx eax, byte [eax + esi*2]
+shl eax, 0xc
+or edx, eax
+movzx eax, byte [ebx + esi*2]
+or edx, eax
+movzx eax, byte [ebx + esi*2 + 1]
+shl eax, 0x10
+or edx, eax
+mov eax, dword [ebp + 0xc]
+movzx eax, byte [eax + esi*2 + 1]
+shl eax, 0x18
+or edx, eax
+mov eax, dword [ebp + 0x10]
+movzx eax, byte [eax + esi*2 + 1]
+inc esi
+shl eax, 0x1c
+or edx, eax
+push edx
+push 0x80f080f0
+push ecx
+call fcn_00018b68  ; call 0x18b68
+mov ecx, dword [ebp - 0x1c]
+add esp, 0x10
+add ecx, 4
+cmp esi, 4
+jne short loc_00002d54  ; jne 0x2d54
+add edi, 0xdb0
+
+loc_00002db9:
+mov ecx, dword [ebp + 0x10]
+push eax
+mov eax, dword [ebp + 0xc]
+movzx edx, byte [ecx + esi*2]
+movzx eax, byte [eax + esi*2]
+mov ecx, dword [ebp + 0xc]
+shl edx, 0xc
+shl eax, 8
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 1]
+or eax, edx
+movzx edx, byte [ebx + esi*2]
+shl edx, 0x10
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 1]
+mov ecx, dword [ebp + 0x10]
+shl edx, 0x18
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 1]
+inc esi
+shl edx, 0x1c
+or eax, edx
+push eax
+push 0x80f080f0
+push edi
+add edi, 4
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp esi, 8
+jne short loc_00002db9  ; jne 0x2db9
+jmp near loc_000031b8  ; jmp 0x31b8
+
+loc_00002e17:
+sub ecx, edi
+xor esi, esi
+cmp dword [ebp - 0x20], 0
+lea edx, [edi + 0xda0]
+mov edi, ecx
+je near loc_00002efa  ; je 0x2efa
+cmp dword [ebp - 0x1c], 0x40670
+jne near loc_00002efa  ; jne 0x2efa
+
+loc_00002e3a:
+mov ecx, dword [ebp + 0x10]
+push eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x1c], edx
+movzx ecx, byte [ecx + esi*2]
+movzx eax, byte [eax + esi*2]
+shl ecx, 0xc
+shl eax, 8
+or eax, ecx
+movzx ecx, byte [ebx + esi*2]
+or eax, ecx
+movzx ecx, byte [ebx + esi*2 + 1]
+shl ecx, 0x10
+or eax, ecx
+mov ecx, dword [ebp + 0xc]
+movzx ecx, byte [ecx + esi*2 + 1]
+shl ecx, 0x18
+or eax, ecx
+mov ecx, dword [ebp + 0x10]
+movzx ecx, byte [ecx + esi*2 + 1]
+shl ecx, 0x1c
+or eax, ecx
+push eax
+push 0x80f080f0
+push edx
+call fcn_00018b68  ; call 0x18b68
+mov eax, dword [ebp + 0xc]
+add esp, 0xc
+mov ecx, dword [ebp + 0x10]
+mov edx, dword [ebp - 0x1c]
+movzx eax, byte [eax + esi*2 + 8]
+movzx ecx, byte [ecx + esi*2 + 8]
+shl eax, 8
+shl ecx, 0xc
+or eax, ecx
+movzx ecx, byte [ebx + esi*2 + 8]
+or eax, ecx
+movzx ecx, byte [ebx + esi*2 + 9]
+shl ecx, 0x10
+or eax, ecx
+mov ecx, dword [ebp + 0xc]
+movzx ecx, byte [ecx + esi*2 + 9]
+shl ecx, 0x18
+or eax, ecx
+mov ecx, dword [ebp + 0x10]
+movzx ecx, byte [ecx + esi*2 + 9]
+inc esi
+shl ecx, 0x1c
+or eax, ecx
+push eax
+push 0x80f080f0
+lea eax, [edi + edx]
+push eax
+call fcn_00018b68  ; call 0x18b68
+mov edx, dword [ebp - 0x1c]
+add esp, 0x10
+add edx, 4
+cmp esi, 4
+jne near loc_00002e3a  ; jne 0x2e3a
+jmp near loc_000031b8  ; jmp 0x31b8
+
+loc_00002efa:
+mov ecx, dword [ebp + 0x10]
+push eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x1c], edx
+movzx ecx, byte [ecx + esi*2]
+movzx eax, byte [eax + esi*2]
+shl ecx, 0xc
+shl eax, 8
+or eax, ecx
+movzx ecx, byte [ebx + esi*2]
+or eax, ecx
+movzx ecx, byte [ebx + esi*2 + 1]
+shl ecx, 0x10
+or eax, ecx
+mov ecx, dword [ebp + 0xc]
+movzx ecx, byte [ecx + esi*2 + 1]
+shl ecx, 0x18
+or eax, ecx
+mov ecx, dword [ebp + 0x10]
+movzx ecx, byte [ecx + esi*2 + 1]
+shl ecx, 0x1c
+or eax, ecx
+push eax
+push 0x80f080f0
+push edx
+call fcn_00018b68  ; call 0x18b68
+mov eax, dword [ebp + 0xc]
+add esp, 0xc
+mov ecx, dword [ebp + 0x10]
+mov edx, dword [ebp - 0x1c]
+movzx eax, byte [eax + esi*2 + 8]
+movzx ecx, byte [ecx + esi*2 + 8]
+shl eax, 8
+shl ecx, 0xc
+or eax, ecx
+movzx ecx, byte [ebx + esi*2 + 9]
+or eax, ecx
+movzx ecx, byte [ebx + esi*2 + 8]
+shl ecx, 0x10
+or eax, ecx
+mov ecx, dword [ebp + 0xc]
+movzx ecx, byte [ecx + esi*2 + 9]
+shl ecx, 0x18
+or eax, ecx
+mov ecx, dword [ebp + 0x10]
+movzx ecx, byte [ecx + esi*2 + 9]
+inc esi
+shl ecx, 0x1c
+or eax, ecx
+push eax
+push 0x80f080f0
+lea eax, [edi + edx]
+push eax
+call fcn_00018b68  ; call 0x18b68
+mov edx, dword [ebp - 0x1c]
+add esp, 0x10
+add edx, 4
+cmp esi, 4
+jne near loc_00002efa  ; jne 0x2efa
+jmp near loc_000031b8  ; jmp 0x31b8
+
+loc_00002fba:
+mov dword [ebp - 0x28], ecx
+mov eax, dword [ebp + 0xc]
+push ecx
+mov ecx, dword [ebp + 0x10]
+movzx eax, byte [eax + esi*2]
+movzx edx, byte [ecx + esi*2]
+mov ecx, dword [ebp + 0xc]
+shl eax, 8
+shl edx, 0xc
+or eax, edx
+movzx edx, byte [ebx + esi*2]
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 1]
+shl edx, 0x10
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 1]
+mov ecx, dword [ebp + 0x10]
+shl edx, 0x18
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 1]
+inc esi
+shl edx, 0x1c
+or eax, edx
+push eax
+push 0x80f080f0
+push edi
+add edi, 4
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp esi, 4
+mov ecx, dword [ebp - 0x28]
+jne short loc_00002fba  ; jne 0x2fba
+cmp dword [ebp - 0x20], 0
+lea edi, [ecx + 0xda0]
+je near loc_000030fa  ; je 0x30fa
+cmp dword [ebp - 0x1c], 0x40670
+jne near loc_000030fa  ; jne 0x30fa
+mov eax, dword [ebp - 0x24]
+xor si, si
+sub eax, ecx
+mov dword [ebp - 0x1c], eax
+
+loc_00003041:
+mov eax, dword [ebp + 0xc]
+push edx
+mov edx, dword [ebp + 0x10]
+mov ecx, dword [ebp + 0xc]
+movzx eax, byte [eax + esi*2 + 8]
+movzx edx, byte [edx + esi*2 + 8]
+shl eax, 8
+shl edx, 0xc
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 8]
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 9]
+shl edx, 0x10
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 9]
+shl edx, 0x18
+or eax, edx
+mov edx, dword [ebp + 0x10]
+movzx edx, byte [edx + esi*2 + 9]
+shl edx, 0x1c
+or eax, edx
+push eax
+push 0x80f080f0
+push edi
+call fcn_00018b68  ; call 0x18b68
+mov ecx, dword [ebp + 0x10]
+add esp, 0xc
+mov eax, dword [ebp + 0xc]
+movzx edx, byte [ecx + esi*2 + 0xc]
+movzx eax, byte [eax + esi*2 + 0xc]
+shl edx, 0xc
+shl eax, 8
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 0xc]
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 0xd]
+shl edx, 0x10
+or eax, edx
+mov edx, dword [ebp + 0xc]
+movzx edx, byte [edx + esi*2 + 0xd]
+shl edx, 0x18
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 0xd]
+inc esi
+shl edx, 0x1c
+or eax, edx
+push eax
+mov eax, dword [ebp - 0x1c]
+push 0x80f080f0
+add eax, edi
+add edi, 4
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp esi, 2
+je near loc_000031b8  ; je 0x31b8
+jmp near loc_00003041  ; jmp 0x3041
+
+loc_000030fa:
+mov eax, dword [ebp - 0x24]
+xor esi, esi
+sub eax, ecx
+mov dword [ebp - 0x1c], eax
+
+loc_00003104:
+mov edx, dword [ebp + 0x10]
+push eax
+mov eax, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0xc]
+movzx edx, byte [edx + esi*2 + 8]
+movzx eax, byte [eax + esi*2 + 8]
+shl edx, 0xc
+shl eax, 8
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 9]
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 8]
+shl edx, 0x10
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 9]
+shl edx, 0x18
+or eax, edx
+mov edx, dword [ebp + 0x10]
+movzx edx, byte [edx + esi*2 + 9]
+shl edx, 0x1c
+or eax, edx
+push eax
+push 0x80f080f0
+push edi
+call fcn_00018b68  ; call 0x18b68
+mov ecx, dword [ebp + 0x10]
+add esp, 0xc
+mov eax, dword [ebp + 0xc]
+movzx edx, byte [ecx + esi*2 + 0xc]
+movzx eax, byte [eax + esi*2 + 0xc]
+shl edx, 0xc
+shl eax, 8
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 0xd]
+or eax, edx
+movzx edx, byte [ebx + esi*2 + 0xc]
+shl edx, 0x10
+or eax, edx
+mov edx, dword [ebp + 0xc]
+movzx edx, byte [edx + esi*2 + 0xd]
+shl edx, 0x18
+or eax, edx
+movzx edx, byte [ecx + esi*2 + 0xd]
+inc esi
+shl edx, 0x1c
+or eax, edx
+push eax
+mov eax, dword [ebp - 0x1c]
+push 0x80f080f0
+add eax, edi
+add edi, 4
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp esi, 2
+jne near loc_00003104  ; jne 0x3104
+
+loc_000031b8:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000031c0:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov eax, dword [eax + 0xd]
+push dword [ebp + 0x10]
+lea edx, [eax + 0x29]
+push edx
+lea edx, [eax + 0x19]
+add eax, 9
+push edx
+push eax
+call fcn_00002c37  ; call 0x2c37
+add esp, 0x10
+leave
+ret
+
+fcn_000031e5:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov dword [ebp - 0x10], 1
+movzx edx, word [eax + 1]
+lea ecx, [eax + 3]
+lea edi, [edx + edx*2]
+mov dword [ebp - 0x14], edx
+add edi, eax
+
+loc_00003207:
+mov eax, dword [ebp - 0x14]
+cmp dword [ebp - 0x10], eax
+ja short loc_00003240  ; ja 0x3240
+mov eax, edi
+
+loc_00003211:
+cmp eax, ecx
+je short loc_00003238  ; je 0x3238
+mov bl, byte [eax - 3]
+cmp bl, byte [eax]
+jbe short loc_00003233  ; jbe 0x3233
+mov dx, word [eax]
+mov si, word [eax - 2]
+mov byte [eax], bl
+mov word [eax - 3], dx
+mov dl, byte [eax + 2]
+mov word [eax + 1], si
+mov byte [eax - 1], dl
+
+loc_00003233:
+sub eax, 3
+jmp short loc_00003211  ; jmp 0x3211
+
+loc_00003238:
+inc dword [ebp - 0x10]
+add ecx, 3
+jmp short loc_00003207  ; jmp 0x3207
+
+loc_00003240:
+pop eax
+pop edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00003247:
+push ebp
+mov ebp, esp
+mov edx, dword [ebp + 8]
+pop ebp
+movzx eax, word [edx + 1]
+shr eax, 1
+inc eax
+lea eax, [eax + eax*2]
+movzx eax, byte [edx + eax]
+ret
+
+fcn_0000325d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xca0
+mov ebx, dword [ebp + 0x1c]
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 1
+push dword [ebp + 0x14]
+push 0
+mov esi, eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 2
+push dword [ebp + 0x14]
+push 0
+mov dword [ebp - 0xc88], eax
+call fcn_00016c9a  ; call 0x16c9a
+mov ecx, 0xa
+cmp dword [ebp + 0x18], 0x10
+pop edi
+mov dword [ebp - 0xc8c], eax
+pop eax
+mov eax, 0x14
+cmove eax, ecx
+mov dword [ebp - 0xc98], eax
+lea eax, [ebp - 0xc78]
+push 0xc60
+push eax
+call fcn_00016fff  ; call 0x16fff
+add esp, 0x10
+cmp ebx, 2
+je short loc_000032e9  ; je 0x32e9
+cmp ebx, 1
+setb byte [ebp - 0xc7a]
+setb byte [ebp - 0xc79]
+jmp short loc_000032f7  ; jmp 0x32f7
+
+loc_000032e9:
+mov byte [ebp - 0xc7a], 0
+mov byte [ebp - 0xc79], 1
+
+loc_000032f7:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00003311  ; je 0x3311
+push ecx
+push ecx
+push ref_00021077  ; push 0x21077
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00003311:
+push edx
+push edx
+lea eax, [esi + 0xb0]
+push 0x10
+push eax
+mov dword [ebp - 0xc9c], eax
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+cmp byte [ebp - 0xc79], 0
+je short loc_0000334b  ; je 0x334b
+push eax
+push eax
+mov eax, dword [ebp - 0xc88]
+push 0x10
+add eax, 0xb0
+push eax
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+
+loc_0000334b:
+cmp byte [ebp - 0xc7a], 0
+je short loc_0000336c  ; je 0x336c
+mov eax, dword [ebp - 0xc8c]
+push edi
+push edi
+push 0x10
+add eax, 0xb0
+push eax
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+
+loc_0000336c:
+mov eax, dword [ebp + 0xc]
+push ecx
+push 0x2710
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call dword [eax + 4]  ; ucall
+lea eax, [esi + 0xc20]
+pop ebx
+pop esi
+mov dword [ebp - 0xca0], eax
+push 0xa800
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+cmp byte [ebp - 0xc79], 0
+je short loc_000033be  ; je 0x33be
+mov eax, dword [ebp - 0xc88]
+push edx
+push edx
+push 0xa800
+add eax, 0xc20
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+
+loc_000033be:
+cmp byte [ebp - 0xc7a], 0
+je short loc_000033e2  ; je 0x33e2
+push eax
+push eax
+mov eax, dword [ebp - 0xc8c]
+push 0xa800
+add eax, 0xc20
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+
+loc_000033e2:
+mov dword [ebp - 0xc80], 0
+
+loc_000033ec:
+mov eax, dword [ebp - 0xc80]
+mov ecx, 0x64
+xor edx, edx
+sub esp, 0xc
+xor ebx, ebx
+div ecx
+push eax
+call fcn_0001a831  ; call 0x1a831
+add esp, 0x10
+
+loc_00003409:
+cmp ebx, dword [ebp + 0x18]
+je short loc_00003438  ; je 0x3438
+sub esp, 0xc
+push 1
+push 0x39
+push ebx
+push dword [ebp + 0x14]
+push 0
+call fcn_000029e2  ; call 0x29e2
+add esp, 0x14
+push 0xc
+push 0x3a
+push ebx
+inc ebx
+push dword [ebp + 0x14]
+push 0
+call fcn_000029e2  ; call 0x29e2
+add esp, 0x20
+jmp short loc_00003409  ; jmp 0x3409
+
+loc_00003438:
+push eax
+mov eax, dword [ebp + 0xc]
+push dword [ebp - 0xc98]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call dword [eax + 4]  ; ucall
+lea eax, [ebp - 0xc78]
+mov dword [ebp - 0xc90], eax
+mov dword [ebp - 0xc84], 0
+add esp, 0x10
+
+loc_00003464:
+mov eax, dword [ebp - 0xc84]
+cmp eax, dword [ebp + 0x18]
+je near loc_00003577  ; je 0x3577
+imul eax, eax, 0xc6
+mov edi, dword [ebp - 0xc90]
+xor ebx, ebx
+mov dword [ebp - 0xc94], eax
+
+loc_00003487:
+lea eax, [ebx + 0x31]
+mov esi, 1
+push eax
+push dword [ebp - 0xc84]
+push dword [ebp + 0x14]
+push 0
+call fcn_00002a60  ; call 0x2a60
+movzx edx, word [edi + 1]
+add esp, 0x10
+and eax, 0x3f
+mov byte [ebp - 0xc7b], al
+
+loc_000034b0:
+cmp esi, edx
+ja short loc_000034da  ; ja 0x34da
+lea eax, [esi + esi*2]
+mov cl, byte [ebp - 0xc7b]
+cmp byte [edi + eax], cl
+jne short loc_000034d7  ; jne 0x34d7
+imul edx, ebx, 0x21
+add eax, dword [ebp - 0xc94]
+add eax, edx
+inc word [ebp + eax - 0xc77]
+jmp short loc_00003555  ; jmp 0x3555
+
+loc_000034d7:
+inc esi
+jmp short loc_000034b0  ; jmp 0x34b0
+
+loc_000034da:
+cmp esi, 0xb
+jne short loc_0000352c  ; jne 0x352c
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000350d  ; je 0x350d
+push eax
+push 0xa
+push dword [ebp - 0xc80]
+push ebx
+push dword [ebp - 0xc84]
+push dword [ebp + 0x14]
+push ref_000210a2  ; push 0x210a2
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_0000350d:
+cmp dword [ebp + 0x18], 0x10
+jne near loc_000036ff  ; jne 0x36ff
+sub esp, 0xc
+push 0xee
+
+loc_0000351f:
+call fcn_0001a831  ; call 0x1a831
+add esp, 0x10
+call fcn_00017239  ; call 0x17239
+
+loc_0000352c:
+imul eax, ebx, 0x21
+lea esi, [esi + esi*2]
+add esi, dword [ebp - 0xc94]
+inc word [edi + 1]
+add esi, eax
+mov al, byte [ebp - 0xc7b]
+mov word [ebp + esi - 0xc77], 1
+mov byte [ebp + esi - 0xc78], al
+
+loc_00003555:
+inc ebx
+add edi, 0x21
+cmp ebx, 6
+jne near loc_00003487  ; jne 0x3487
+inc dword [ebp - 0xc84]
+add dword [ebp - 0xc90], 0xc6
+jmp near loc_00003464  ; jmp 0x3464
+
+loc_00003577:
+cmp dword [ebp - 0xc80], 0x64
+jbe short loc_000035b4  ; jbe 0x35b4
+lea ecx, [ebp - 0xc78]
+xor edx, edx
+
+loc_00003588:
+cmp edx, dword [ebp + 0x18]
+jne short loc_00003591  ; jne 0x3591
+
+loc_0000358d:
+xor edi, edi
+jmp short loc_0000360b  ; jmp 0x360b
+
+loc_00003591:
+xor eax, eax
+
+loc_00003593:
+mov di, word [ecx + eax + 1]
+lea ebx, [edi - 2]
+cmp bx, 2
+jbe short loc_000035b4  ; jbe 0x35b4
+add eax, 0x21
+cmp eax, 0xc6
+jne short loc_00003593  ; jne 0x3593
+inc edx
+add ecx, 0xc6
+jmp short loc_00003588  ; jmp 0x3588
+
+loc_000035b4:
+inc dword [ebp - 0xc80]
+cmp dword [ebp - 0xc80], 0x1f4
+jne near loc_000033ec  ; jne 0x33ec
+jmp short loc_0000358d  ; jmp 0x358d
+
+loc_000035cc:
+imul eax, esi, 0x21
+sub esp, 0xc
+add eax, dword [ebp - 0xc80]
+lea edx, [ebp - 0xc78]
+lea ebx, [edx + eax]
+push ebx
+call fcn_000031e5  ; call 0x31e5
+mov dword [esp], ebx
+call fcn_00003247  ; call 0x3247
+mov dword [esp], eax
+lea eax, [esi + 0x31]
+inc esi
+push eax
+push edi
+push dword [ebp + 0x14]
+push 0
+call fcn_000029e2  ; call 0x29e2
+add esp, 0x20
+cmp esi, 6
+jne short loc_000035cc  ; jne 0x35cc
+inc edi
+
+loc_0000360b:
+cmp edi, dword [ebp + 0x18]
+je short loc_00003620  ; je 0x3620
+imul eax, edi, 0xc6
+xor esi, esi
+mov dword [ebp - 0xc80], eax
+jmp short loc_000035cc  ; jmp 0x35cc
+
+loc_00003620:
+push eax
+push eax
+push 0
+push dword [ebp - 0xca0]
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+cmp byte [ebp - 0xc79], 0
+je short loc_00003653  ; je 0x3653
+push eax
+push eax
+mov eax, dword [ebp - 0xc88]
+push 0
+add eax, 0xc20
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+
+loc_00003653:
+cmp byte [ebp - 0xc7a], 0
+je short loc_00003674  ; je 0x3674
+push eax
+push eax
+mov eax, dword [ebp - 0xc8c]
+push 0
+add eax, 0xc20
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+
+loc_00003674:
+mov eax, dword [ebp + 0xc]
+push ebx
+push 0x3e8
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call dword [eax + 4]  ; ucall
+pop esi
+pop edi
+push 0xffef
+push dword [ebp - 0xc9c]
+call fcn_00018954  ; call 0x18954
+add esp, 0x10
+cmp byte [ebp - 0xc79], 0
+je short loc_000036bf  ; je 0x36bf
+mov eax, dword [ebp - 0xc88]
+push ecx
+push ecx
+push 0xffef
+add eax, 0xb0
+push eax
+call fcn_00018954  ; call 0x18954
+add esp, 0x10
+
+loc_000036bf:
+cmp byte [ebp - 0xc7a], 0
+je short loc_000036e3  ; je 0x36e3
+mov eax, dword [ebp - 0xc8c]
+push edx
+push edx
+push 0xffef
+add eax, 0xb0
+push eax
+call fcn_00018954  ; call 0x18954
+add esp, 0x10
+
+loc_000036e3:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000370c  ; je 0x370c
+push eax
+push eax
+push ref_000210fe  ; push 0x210fe
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp short loc_0000370c  ; jmp 0x370c
+
+loc_000036ff:
+sub esp, 0xc
+push 0xed
+jmp near loc_0000351f  ; jmp 0x351f
+
+loc_0000370c:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00003714:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 0x14]
+push 0
+mov esi, dword [ebp + 0x18]
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+mov edi, eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_0000377f  ; je 0x377f
+sub esp, 0xc
+add edi, 0x214
+push edi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test ax, ax
+je short loc_0000377f  ; je 0x377f
+shr eax, 0x10
+and eax, 0xf
+cmp eax, 6
+jbe short loc_0000377f  ; jbe 0x377f
+push eax
+movzx ebx, bl
+push eax
+mov eax, esi
+movzx esi, al
+push esi
+push 0x10
+push 1
+push ebx
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+call fcn_0000325d  ; call 0x325d
+add esp, 0x20
+
+loc_0000377f:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00003787:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x38
+mov eax, dword [ebp + 0x20]
+mov edi, dword [ebp + 0x14]
+mov dword [ebp - 0x38], eax
+lea eax, [ebp - 0x1c]
+push eax
+call fcn_00019797  ; call 0x19797
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_000037e9  ; je 0x37e9
+test ebx, ebx
+jns short loc_000037e9  ; jns 0x37e9
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000037d1  ; je 0x37d1
+push esi
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000037d1:
+push ecx
+push ref_000206f4  ; push 0x206f4
+push 0x5bc
+push ref_00020f0c  ; push 0x20f0c
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000037e9:
+imul eax, dword [ebp + 0x1c], 7
+add eax, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0x18]
+mov byte [ebp - 0x29], 0
+mov dword [ebp - 0x30], eax
+
+loc_000037fa:
+cmp ebx, dword [ebp - 0x30]
+je near loc_000038a5  ; je 0x38a5
+movzx eax, byte [ebx + 2]
+push edx
+push eax
+mov byte [ebp - 0x34], al
+movzx eax, byte [ebx + 1]
+push eax
+movzx eax, byte [ebx]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+mov esi, eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_0000389d  ; je 0x389d
+sub esp, 0xc
+lea eax, [esi + 0x11a]
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test al, 2
+je short loc_0000389d  ; je 0x389d
+sub esp, 0xc
+lea eax, [esi + 0xba]
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test al, 0x40
+je short loc_0000389d  ; je 0x389d
+mov cl, byte [ebp - 0x34]
+mov eax, 1
+lea edx, [esi + 0xb0]
+add esi, 0x25c
+mov dword [ebp - 0x34], edx
+shl eax, cl
+or byte [ebp - 0x29], al
+push eax
+push eax
+push 0x10
+push edx
+call fcn_00018927  ; call 0x18927
+pop eax
+pop edx
+push 0x200
+push esi
+call fcn_00018b14  ; call 0x18b14
+mov edx, dword [ebp - 0x34]
+pop ecx
+pop esi
+push 0xffef
+push edx
+call fcn_00018954  ; call 0x18954
+add esp, 0x10
+
+loc_0000389d:
+add ebx, 7
+jmp near loc_000037fa  ; jmp 0x37fa
+
+loc_000038a5:
+cmp byte [ebp - 0x29], 0
+je near loc_000039cb  ; je 0x39cb
+cmp dword [ebp - 0x1c], 0x11
+jne short loc_000038bb  ; jne 0x38bb
+
+loc_000038b5:
+test edi, edi
+jne short loc_000038ce  ; jne 0x38ce
+jmp short loc_000038de  ; jmp 0x38de
+
+loc_000038bb:
+sub esp, 0xc
+push 1
+call fcn_0001c321  ; call 0x1c321
+add esp, 0x10
+dec al
+jne short loc_000038de  ; jne 0x38de
+jmp short loc_000038b5  ; jmp 0x38b5
+
+loc_000038ce:
+cmp byte [edi + 0x28], 0
+je short loc_000038de  ; je 0x38de
+cmp byte [edi + 0x46], 0
+je short loc_000038de  ; je 0x38de
+mov byte [edi + 0x46], 0
+
+loc_000038de:
+movzx esi, byte [ebp - 0x38]
+sub esp, 0xc
+push esi
+push edi
+push dword [ebp + 0xc]
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+call fcn_00002634  ; call 0x2634
+movzx eax, byte [ebp - 0x29]
+add esp, 0x20
+mov ebx, dword [ebp + 0x18]
+mov dword [ebp - 0x38], eax
+
+loc_00003902:
+cmp ebx, dword [ebp - 0x30]
+je short loc_00003947  ; je 0x3947
+mov al, byte [ebx]
+movzx ecx, byte [ebx + 1]
+mov byte [ebp - 0x29], al
+mov al, byte [ebx + 2]
+movzx edx, al
+mov dword [ebp - 0x34], edx
+mov edx, dword [ebp - 0x38]
+bt edx, eax
+jae short loc_00003942  ; jae 0x3942
+push eax
+movzx edx, byte [ebp - 0x29]
+push dword [ebp - 0x34]
+push ecx
+push edx
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+push 0x20
+add eax, 0xb0
+push eax
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+
+loc_00003942:
+add ebx, 7
+jmp short loc_00003902  ; jmp 0x3902
+
+loc_00003947:
+cmp dword [ebp - 0x1c], 0x11
+jne short loc_00003953  ; jne 0x3953
+
+loc_0000394d:
+test edi, edi
+jne short loc_00003966  ; jne 0x3966
+jmp short loc_00003976  ; jmp 0x3976
+
+loc_00003953:
+sub esp, 0xc
+push 1
+call fcn_0001c321  ; call 0x1c321
+add esp, 0x10
+dec al
+jne short loc_00003976  ; jne 0x3976
+jmp short loc_0000394d  ; jmp 0x394d
+
+loc_00003966:
+cmp byte [edi + 0x28], 0
+je short loc_00003976  ; je 0x3976
+cmp byte [edi + 0x46], 0
+je short loc_00003976  ; je 0x3976
+mov byte [edi + 0x46], 0
+
+loc_00003976:
+sub esp, 0xc
+push esi
+push edi
+push dword [ebp + 0xc]
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+call fcn_00002634  ; call 0x2634
+add esp, 0x20
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000039a6  ; je 0x39a6
+push edx
+push edx
+push ref_00021128  ; push 0x21128
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000039a6:
+mov ebx, dword [ebp + 0x18]
+
+loc_000039a9:
+cmp ebx, dword [ebp - 0x30]
+je short loc_000039cb  ; je 0x39cb
+push eax
+movzx eax, byte [ebx + 2]
+add ebx, 7
+push eax
+movzx eax, byte [ebx - 6]
+push eax
+movzx eax, byte [ebx - 7]
+push eax
+call fcn_0000241b  ; call 0x241b
+add esp, 0x10
+jmp short loc_000039a9  ; jmp 0x39a9
+
+loc_000039cb:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000039d3:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov eax, dword [ebp + 0x20]
+mov ebx, dword [ebp + 0x10]
+mov dword [ebp - 0x24], eax
+imul eax, dword [ebp + 0x18], 7
+add eax, dword [ebp + 0x14]
+mov dl, byte [eax + 3]
+movzx edi, byte [eax + 2]
+mov cl, byte [eax]
+mov byte [ebp - 0x20], dl
+mov dl, byte [eax + 5]
+mov dword [ebp - 0x28], edi
+push edi
+movzx edi, byte [eax + 1]
+movzx eax, cl
+mov byte [ebp - 0x19], cl
+mov byte [ebp - 0x1a], dl
+push edi
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+mov esi, eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+je near loc_00003b0b  ; je 0x3b0b
+mov eax, dword [ebx + 0xd]
+movzx ebx, byte [ebp - 0x20]
+mov dl, byte [eax + ebx + 5]
+test dl, dl
+jne short loc_00003a6a  ; jne 0x3a6a
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00003a54  ; je 0x3a54
+push ebx
+push ebx
+push ref_00021153  ; push 0x21153
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00003a54:
+sub esp, 0xc
+lea eax, [esi + 0xac]
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+mov ebx, eax
+and ebx, 0xf
+jmp short loc_00003a90  ; jmp 0x3a90
+
+loc_00003a6a:
+movzx ebx, dl
+mov dword [ebp - 0x20], edx
+call fcn_00015479  ; call 0x15479
+mov edx, dword [ebp - 0x20]
+test al, al
+je short loc_00003a93  ; je 0x3a93
+movzx edx, dl
+push ecx
+push edx
+push ref_00021159  ; push 0x21159
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+
+loc_00003a90:
+add esp, 0x10
+
+loc_00003a93:
+cmp byte [ebp - 0x24], 0
+jne short loc_00003aa5  ; jne 0x3aa5
+cmp bx, 2
+mov eax, 2
+cmova ebx, eax
+
+loc_00003aa5:
+call fcn_00015479  ; call 0x15479
+movzx ebx, bx
+test al, al
+je short loc_00003acd  ; je 0x3acd
+mov ecx, dword [ebp - 0x28]
+movzx eax, byte [ebp - 0x19]
+push ebx
+push ecx
+push edi
+push eax
+push ecx
+push edi
+push ref_0002116e  ; push 0x2116e
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_00003acd:
+push eax
+movzx eax, byte [ebp - 0x1a]
+shl eax, 4
+or eax, ebx
+push eax
+push 0xfffffc00
+lea eax, [esi + 0xac]
+add esi, 0xd0
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 8], esi
+mov dword [ebp + 0xc], 0xfff0
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018981  ; jmp 0x18981
+
+loc_00003b0b:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00003b13:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 8
+movzx eax, byte [ebp + 0x14]
+push eax
+movzx eax, byte [ebp + 0x10]
+push eax
+movzx eax, byte [ebp + 0xc]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 0x2020
+push 0xffff0000
+mov ebx, eax
+lea eax, [eax + 0x22c]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0xc
+push 0x20000000
+push 0xdfffffff
+lea eax, [ebx + 0x258]
+push eax
+call fcn_00018b68  ; call 0x18b68
+lea eax, [ebx + 0x11a]
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test al, 2
+jne short loc_00003ba1  ; jne 0x3ba1
+push eax
+push eax
+push 0x20
+lea eax, [ebx + 0xb0]
+add ebx, 0xb2
+push eax
+call fcn_00018730  ; call 0x18730
+add esp, 0x10
+
+loc_00003b90:
+sub esp, 0xc
+push ebx
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test ah, 8
+jne short loc_00003b90  ; jne 0x3b90
+
+loc_00003ba1:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00003ba6:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017ed8  ; call 0x17ed8
+mov ebx, eax
+and ebx, 0xfffffffe
+lea eax, [ebx + 0x7400]
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [ebp - 0x1c], eax
+lea eax, [ebx + 0x7404]
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov edi, eax
+lea eax, [ebx + 0x7408]
+add ebx, 0x740c
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [esp], ebx
+xor ebx, ebx
+mov esi, eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+xor ecx, ecx
+
+loc_00003c10:
+mov eax, dword [ebp - 0x1c]
+mov edx, edi
+shr edx, cl
+and edx, 7
+shr eax, cl
+add ecx, 3
+and eax, 7
+add eax, edx
+add ebx, eax
+cmp ecx, 0x18
+jne short loc_00003c10  ; jne 0x3c10
+cmp bl, 0x28
+jbe short loc_00003c53  ; jbe 0x3c53
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00003c7e  ; je 0x3c7e
+movzx ebx, bl
+push ebx
+push 0x28
+push ref_0002119b  ; push 0x2119b
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp short loc_00003c7e  ; jmp 0x3c7e
+
+loc_00003c53:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00003c7e  ; je 0x3c7e
+mov al, 0x28
+movzx edx, bl
+sub eax, ebx
+sub esp, 0xc
+movzx eax, al
+lea ecx, [edx + eax]
+push ecx
+push eax
+push edx
+push ref_000211e9  ; push 0x211e9
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_00003c7e:
+xor ecx, ecx
+xor eax, eax
+
+loc_00003c82:
+mov edx, esi
+shr edx, cl
+add ecx, 3
+and edx, 7
+add eax, edx
+cmp ecx, 0x18
+jne short loc_00003c82  ; jne 0x3c82
+shr esi, 0x18
+and esi, 0x3f
+lea ebx, [eax + esi]
+cmp bl, 0x47
+jbe short loc_00003cc4  ; jbe 0x3cc4
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00003cef  ; je 0x3cef
+movzx ebx, bl
+push ebx
+push 0x47
+push ref_00021219  ; push 0x21219
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp short loc_00003cef  ; jmp 0x3cef
+
+loc_00003cc4:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00003cef  ; je 0x3cef
+mov al, 0x47
+movzx edx, bl
+sub eax, ebx
+sub esp, 0xc
+movzx eax, al
+lea ecx, [edx + eax]
+push ecx
+push eax
+push edx
+push ref_00021267  ; push 0x21267
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_00003cef:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00003cf7:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x60
+mov eax, dword [ebp + 8]
+push 0
+push 0
+push 0
+mov dword [ebp - 0x3c], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x40], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp - 0x44], eax
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017ed8  ; call 0x17ed8
+mov ebx, eax
+and ebx, 0xfffffffe
+lea eax, [ebx + 0x7410]
+mov dword [esp], eax
+mov dword [ebp - 0x48], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov edi, eax
+lea eax, [ebx + 0x7418]
+mov dword [esp], eax
+mov dword [ebp - 0x5c], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov esi, eax
+lea eax, [ebx + 0x7454]
+mov dword [esp], eax
+mov dword [ebp - 0x60], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov ebx, eax
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00003d87  ; je 0x3d87
+sub esp, 0xc
+push ebx
+push esi
+push edi
+push ref_00021297  ; push 0x21297
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_00003d87:
+cmp byte [ebp - 0x3c], 0
+mov word [ebp - 0x28], 0
+jne short loc_00003dba  ; jne 0x3dba
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xb2
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+and eax, 0x3f0
+shr eax, 4
+mov dword [ebp - 0x28], eax
+
+loc_00003dba:
+cmp byte [ebp - 0x40], 0
+mov word [ebp - 0x38], 0
+jne short loc_00003ded  ; jne 0x3ded
+push ecx
+push 1
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xb2
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+and eax, 0x3f0
+shr eax, 4
+mov dword [ebp - 0x38], eax
+
+loc_00003ded:
+cmp byte [ebp - 0x44], 0
+mov word [ebp - 0x58], 0
+jne short loc_00003e20  ; jne 0x3e20
+push edx
+push 2
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xb2
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+and eax, 0x3f0
+shr eax, 4
+mov dword [ebp - 0x58], eax
+
+loc_00003e20:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00003e42  ; je 0x3e42
+movzx eax, word [ebp - 0x28]
+push eax
+movzx eax, byte [ebp - 0x3c]
+push eax
+push ref_000212c5  ; push 0x212c5
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00003e42:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00003e64  ; je 0x3e64
+movzx eax, word [ebp - 0x38]
+push eax
+movzx eax, byte [ebp - 0x40]
+push eax
+push ref_000212eb  ; push 0x212eb
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00003e64:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00003e86  ; je 0x3e86
+movzx eax, word [ebp - 0x58]
+push eax
+movzx eax, byte [ebp - 0x44]
+push eax
+push ref_00021311  ; push 0x21311
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00003e86:
+mov al, byte [ebp - 0x40]
+or al, byte [ebp - 0x3c]
+jne short loc_00003ed2  ; jne 0x3ed2
+cmp word [ebp - 0x28], 8
+jne short loc_00003ed2  ; jne 0x3ed2
+cmp word [ebp - 0x38], 8
+jne short loc_00003ed2  ; jne 0x3ed2
+mov eax, edi
+and edi, 0x7c00
+and eax, 0xfffffc1f
+shr edi, 5
+or edi, eax
+mov eax, esi
+and esi, 0x7c00
+and eax, 0xfffffc1f
+shr esi, 5
+or esi, eax
+mov eax, ebx
+and ebx, 0x3f000
+and eax, 0xfffff03f
+shr ebx, 6
+or ebx, eax
+
+loc_00003ed2:
+cmp word [ebp - 0x58], 4
+jne near loc_00003f69  ; jne 0x3f69
+cmp byte [ebp - 0x44], 0
+jne near loc_00003f69  ; jne 0x3f69
+cmp word [ebp - 0x28], 4
+jne short loc_00003f2a  ; jne 0x3f2a
+cmp byte [ebp - 0x3c], 0
+jne short loc_00003f2a  ; jne 0x3f2a
+mov eax, edi
+and edi, 0xf8000
+and eax, 0xfffffc1f
+shr edi, 0xa
+or edi, eax
+mov eax, esi
+and esi, 0xf8000
+and eax, 0xfffffc1f
+shr esi, 0xa
+or esi, eax
+mov eax, ebx
+and ebx, 0xfc0000
+and eax, 0xfffff03f
+shr ebx, 0xc
+or ebx, eax
+
+loc_00003f2a:
+cmp word [ebp - 0x38], 4
+jne short loc_00003f69  ; jne 0x3f69
+cmp byte [ebp - 0x40], 0
+jne short loc_00003f69  ; jne 0x3f69
+mov eax, edi
+and edi, 0xf8000
+and ah, 0x83
+shr edi, 5
+or edi, eax
+mov eax, esi
+and esi, 0xf8000
+and ah, 0x83
+shr esi, 5
+or esi, eax
+mov eax, ebx
+and ebx, 0xfc0000
+and eax, 0xfffc0fff
+shr ebx, 6
+or ebx, eax
+
+loc_00003f69:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00003f87  ; je 0x3f87
+sub esp, 0xc
+push ebx
+push esi
+push edi
+push ref_00021337  ; push 0x21337
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_00003f87:
+push eax
+push edi
+push 0xfe000000
+push dword [ebp - 0x48]
+call fcn_00018b68  ; call 0x18b68
+add esp, 0xc
+push esi
+push 0xfe000000
+push dword [ebp - 0x5c]
+call fcn_00018b68  ; call 0x18b68
+mov eax, dword [ebp - 0x60]
+add esp, 0x10
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 0xc], 0xc0000000
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018b68  ; jmp 0x18b68
+
+fcn_00003fc6:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0xc]
+mov esi, dword [ebp + 0x10]
+mov ebx, dword [ebp + 8]
+mov dword [ebp - 0x1c], eax
+call fcn_0001c651  ; call 0x1c651
+movzx ebx, bl
+mov edi, eax
+push eax
+mov eax, esi
+movzx eax, al
+push eax
+movzx eax, byte [ebp - 0x1c]
+push eax
+push ebx
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 0x1f
+push 0xfffffeff
+mov ebx, eax
+lea eax, [eax + 0x224]
+push eax
+call fcn_00018b68  ; call 0x18b68
+mov eax, esi
+add esp, 0x10
+test al, al
+jne short loc_0000401e  ; jne 0x401e
+cmp byte [ebp - 0x1c], 1
+je short loc_00004030  ; je 0x4030
+
+loc_0000401e:
+cmp edi, 0x40660
+je short loc_0000406e  ; je 0x406e
+cmp edi, 0x306c0
+jne short loc_00004082  ; jne 0x4082
+jmp short loc_0000406e  ; jmp 0x406e
+
+loc_00004030:
+push eax
+push 0
+push 0xefffffff
+lea eax, [ebx + 0x490]
+push eax
+call fcn_00018b68  ; call 0x18b68
+lea eax, [ebx + 0xa18]
+add esp, 0x10
+lea esi, [ebx + 0x918]
+mov dword [ebp - 0x1c], eax
+
+loc_00004056:
+push eax
+push 0
+push 0xfffffffffffffff3
+push esi
+add esi, 0x20
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jne short loc_00004056  ; jne 0x4056
+jmp short loc_0000401e  ; jmp 0x401e
+
+loc_0000406e:
+push eax
+push 0x10
+push 0xffffffffffffffef
+lea eax, [ebx + 0xd14]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_00004082:
+sub esp, 0xc
+lea esi, [ebx + 0x308]
+push esi
+call fcn_00017e4e  ; call 0x17e4e
+pop edx
+pop ecx
+push eax
+push esi
+lea esi, [ebx + 0x314]
+call fcn_00017e8f  ; call 0x17e8f
+mov dword [esp], esi
+call fcn_00017e4e  ; call 0x17e4e
+pop edi
+pop edx
+push eax
+push esi
+lea esi, [ebx + 0x32c]
+add ebx, 0x330
+call fcn_00017e8f  ; call 0x17e8f
+mov dword [esp], esi
+call fcn_00017e4e  ; call 0x17e4e
+pop ecx
+pop edi
+push eax
+push esi
+call fcn_00017e8f  ; call 0x17e8f
+mov dword [esp], ebx
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f  ; jmp 0x17e8f
+
+fcn_000040eb:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+movzx eax, byte [ebp + 0x10]
+mov esi, dword [ebp + 8]
+movzx ebx, word [ebp + 0xc]
+mov dword [ebp - 0x1c], 0xa
+shl eax, 0x10
+lea edi, [esi + 0x6c00]
+or ebx, eax
+lea eax, [esi + 0x6c04]
+or ebx, 0x80000000
+mov dword [ebp - 0x20], eax
+
+loc_00004120:
+push ecx
+push ecx
+push dword [ebp + 0x14]
+push dword [ebp - 0x20]
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+pop edx
+push ebx
+push edi
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+mov edx, 0x64
+
+loc_0000413e:
+sub esp, 0xc
+push edi
+mov dword [ebp - 0x24], edx
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test eax, eax
+jns short loc_0000417a  ; jns 0x417a
+mov edx, dword [ebp - 0x24]
+dec edx
+jne short loc_0000413e  ; jne 0x413e
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000417a  ; je 0x417a
+push edx
+push edx
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push esi
+push 0x64
+push ref_00021364  ; push 0x21364
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_0000417a:
+sub esp, 0xc
+push edi
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+mov edx, eax
+cmp ax, 0x40
+je short loc_000041c2  ; je 0x41c2
+dec dword [ebp - 0x1c]
+jne short loc_00004120  ; jne 0x4120
+mov dword [ebp - 0x1c], edx
+call fcn_00015479  ; call 0x15479
+mov edx, dword [ebp - 0x1c]
+test al, al
+je short loc_000041c2  ; je 0x41c2
+movzx edx, dx
+push eax
+push edx
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push esi
+push 0xa
+push ref_000213b1  ; push 0x213b1
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_000041c2:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000041ca:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov edx, dword [ebp + 0x10]
+mov edi, dword [ebp + 8]
+mov eax, edx
+and eax, 0xfffffffd
+cmp ax, 0x14
+sete al
+cmp al, 1
+lea ecx, [edx - 0x13]
+sbb ebx, ebx
+cmp cx, 1
+jbe short loc_000041f7  ; jbe 0x41f7
+add ebx, 4
+jmp short loc_000041fa  ; jmp 0x41fa
+
+loc_000041f7:
+add ebx, 2
+
+loc_000041fa:
+push ebx
+cmp al, 1
+push 0
+sbb esi, esi
+push 2
+add esi, 8
+push edi
+mov dword [ebp - 0x1c], edx
+call fcn_000040eb  ; call 0x40eb
+mov edx, dword [ebp - 0x1c]
+push dword [ebp + 0xc]
+movzx edx, dx
+push 0
+push edx
+push edi
+call fcn_000040eb  ; call 0x40eb
+add esp, 0x20
+push dword [ebp + 0x14]
+push 0
+push esi
+push edi
+call fcn_000040eb  ; call 0x40eb
+lea eax, [edi + 0x6c04]
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+push ebx
+push 0
+push 3
+push edi
+mov dword [ebp - 0x1c], eax
+call fcn_000040eb  ; call 0x40eb
+mov eax, dword [ebp - 0x1c]
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00004257:
+push ebp
+mov ebp, esp
+push edi
+mov edi, 0x10
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0x10]
+mov dword [ebp - 0x28], eax
+call fcn_0001c651  ; call 0x1c651
+cmp dword [ebp + 0x14], 1
+mov dword [ebp - 0x20], eax
+mov eax, 4
+cmovne edi, eax
+xor esi, esi
+mov eax, edi
+shr eax, 1
+mov dword [ebp - 0x1c], eax
+lea eax, [ebx + 0xa00]
+mov dword [ebp - 0x24], eax
+
+loc_00004294:
+test ebx, ebx
+je short loc_000042a8  ; je 0x42a8
+push eax
+mov eax, esi
+shl eax, 4
+add eax, dword [ebp - 0x24]
+push 0xc
+push 0xffffffffffffffe0
+push eax
+jmp short loc_000042c8  ; jmp 0x42c8
+
+loc_000042a8:
+push eax
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+lea edx, [esi + 0xa0]
+push 0xc
+shl edx, 4
+push 0xffffffffffffffe0
+add edx, eax
+push edx
+
+loc_000042c8:
+inc esi
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp esi, edi
+jb short loc_00004294  ; jb 0x4294
+test ebx, ebx
+jne near loc_00004365  ; jne 0x4365
+cmp byte [ebp - 0x28], 1
+mov edi, 2
+mov eax, 0xc
+cmove edi, eax
+xor esi, esi
+
+loc_000042f0:
+push eax
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+mov edx, esi
+push edi
+inc esi
+shl edx, 5
+push 0xffffffffffffffe0
+lea eax, [eax + edx + 0x904]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jb short loc_000042f0  ; jb 0x42f0
+cmp byte [ebp - 0x28], 1
+mov edi, 3
+mov eax, 0xe
+cmove edi, eax
+xor esi, esi
+shl edi, 5
+
+loc_00004334:
+push eax
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+mov edx, esi
+push edi
+inc esi
+shl edx, 5
+push 0xfffffc1f
+lea eax, [eax + edx + 0x904]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jb short loc_00004334  ; jb 0x4334
+
+loc_00004365:
+xor esi, esi
+lea edi, [ebx + 0x90c]
+
+loc_0000436d:
+test ebx, ebx
+je short loc_00004385  ; je 0x4385
+mov eax, esi
+push ecx
+push 0x120
+shl eax, 5
+push 0xfffff81f
+add eax, edi
+jmp short loc_000043ab  ; jmp 0x43ab
+
+loc_00004385:
+push edx
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+mov edx, esi
+push 0x120
+shl edx, 5
+push 0xfffff81f
+lea eax, [eax + edx + 0x90c]
+
+loc_000043ab:
+push eax
+inc esi
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jb short loc_0000436d  ; jb 0x436d
+test ebx, ebx
+jne near loc_00004444  ; jne 0x4444
+xor esi, esi
+
+loc_000043c4:
+push eax
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+mov edx, esi
+push 0xa00000
+inc esi
+shl edx, 5
+push 0xfe1fffff
+lea eax, [eax + edx + 0x90c]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jb short loc_000043c4  ; jb 0x43c4
+xor esi, esi
+
+loc_000043fb:
+mov eax, dword [ebp + 8]
+mov edi, 0x200
+cmp byte [eax], 2
+jbe short loc_00004413  ; jbe 0x4413
+mov eax, dword [eax + 0xd]
+movzx edi, byte [eax + esi + 0x54]
+shl edi, 6
+
+loc_00004413:
+push eax
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+mov edx, esi
+push edi
+inc esi
+shl edx, 5
+push 0xfffffc3f
+lea eax, [eax + edx + 0x910]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jb short loc_000043fb  ; jb 0x43fb
+
+loc_00004444:
+xor esi, esi
+lea edi, [ebx + 0x910]
+jmp short loc_00004480  ; jmp 0x4480
+
+loc_0000444e:
+push eax
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+mov edx, esi
+push 0
+shl edx, 5
+push 0xffffc3ff
+lea eax, [eax + edx + 0x910]
+
+loc_00004471:
+push eax
+inc esi
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jae short loc_00004495  ; jae 0x4495
+
+loc_00004480:
+test ebx, ebx
+je short loc_0000444e  ; je 0x444e
+push eax
+mov eax, esi
+push 0
+shl eax, 5
+push 0xffffc3ff
+add eax, edi
+jmp short loc_00004471  ; jmp 0x4471
+
+loc_00004495:
+mov eax, dword [ebp - 0x20]
+cmp eax, 0x40660
+sete dl
+cmp eax, 0x306c0
+sete al
+or dl, al
+mov byte [ebp - 0x24], dl
+je short loc_00004503  ; je 0x4503
+xor esi, esi
+lea edi, [ebx + 0x80c]
+
+loc_000044b7:
+test ebx, ebx
+je short loc_000044cc  ; je 0x44cc
+push eax
+mov eax, esi
+push 0
+shl eax, 5
+push 0xffe3ffff
+add eax, edi
+jmp short loc_000044ef  ; jmp 0x44ef
+
+loc_000044cc:
+push eax
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+mov edx, esi
+push 0
+shl edx, 5
+push 0xffe3ffff
+lea eax, [eax + edx + 0x80c]
+
+loc_000044ef:
+push eax
+inc esi
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jb short loc_000044b7  ; jb 0x44b7
+jmp near loc_000045df  ; jmp 0x45df
+
+loc_00004503:
+cmp dword [ebp - 0x20], 0x40670
+jne near loc_000045ec  ; jne 0x45ec
+push ecx
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+je short loc_00004565  ; je 0x4565
+
+loc_0000452e:
+test ebx, ebx
+je near loc_0000461d  ; je 0x461d
+cmp byte [ebp - 0x28], 1
+mov edx, 0x1c000000
+mov eax, 0x6000000
+cmove eax, edx
+push edx
+push eax
+push 0xc1ffffff
+lea eax, [ebx + 0xc00]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp byte [ebp - 0x24], 0
+je short loc_0000456d  ; je 0x456d
+jmp short loc_0000458b  ; jmp 0x458b
+
+loc_00004565:
+test ebx, ebx
+je near loc_000048c0  ; je 0x48c0
+
+loc_0000456d:
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+je short loc_000045a8  ; je 0x45a8
+
+loc_0000458b:
+push eax
+push 0x40
+push 0xfffffc0f
+lea eax, [ebx + 0xc08]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp byte [ebp - 0x24], 0
+jne short loc_000045c6  ; jne 0x45c6
+
+loc_000045a8:
+push edi
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+je short loc_000045f4  ; je 0x45f4
+
+loc_000045c6:
+push esi
+push 0
+push 0xe07fffff
+lea eax, [ebx + 0xc0c]
+push eax
+call fcn_00018b68  ; call 0x18b68
+
+loc_000045da:
+add esp, 0x10
+jmp short loc_0000461d  ; jmp 0x461d
+
+loc_000045df:
+cmp dword [ebp - 0x20], 0x40670
+je near loc_0000452e  ; je 0x452e
+
+loc_000045ec:
+test ebx, ebx
+je near loc_000048c0  ; je 0x48c0
+
+loc_000045f4:
+push 0
+push 0x15
+push 0xc0c8001
+push dword [ebp + 0xc]
+call fcn_000041ca  ; call 0x41ca
+and eax, 0xe07fffff
+push eax
+push 0x16
+push 0xc0c8001
+push dword [ebp + 0xc]
+call fcn_000041ca  ; call 0x41ca
+add esp, 0x20
+
+loc_0000461d:
+cmp byte [ebp - 0x24], 0
+je short loc_00004664  ; je 0x4664
+test ebx, ebx
+je short loc_00004640  ; je 0x4640
+push ecx
+push 0x13
+push 0xffffffffffffffe0
+lea eax, [ebx + 0xc28]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+jmp near loc_0000473e  ; jmp 0x473e
+
+loc_00004640:
+push edx
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 0x13
+push 0xffffffffffffffe0
+add eax, 0xc28
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+jmp short loc_0000466c  ; jmp 0x466c
+
+loc_00004664:
+test ebx, ebx
+jne near loc_0000473e  ; jne 0x473e
+
+loc_0000466c:
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0xffbf
+add eax, 0xc38
+push eax
+call fcn_00018981  ; call 0x18981
+add esp, 0xc
+push 1
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0xffbf
+add eax, 0xc38
+push eax
+call fcn_00018981  ; call 0x18981
+add esp, 0xc
+push 2
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0xffbf
+add eax, 0xc38
+push eax
+call fcn_00018981  ; call 0x18981
+add esp, 0xc
+push 0
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 2
+push 0xfffc
+add eax, 0x260
+push eax
+call fcn_00018981  ; call 0x18981
+add esp, 0xc
+push 1
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 2
+push 0xfffc
+add eax, 0x260
+push eax
+call fcn_00018981  ; call 0x18981
+add esp, 0xc
+push 2
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 2
+push 0xfffc
+add eax, 0x260
+push eax
+call fcn_00018981  ; call 0x18981
+jmp short loc_00004762  ; jmp 0x4762
+
+loc_0000473e:
+push eax
+push 0
+push 0xffffffffffffffbf
+lea eax, [ebx + 0xc38]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0xc
+push 2
+push 0xfffffffffffffffc
+lea eax, [ebx + 0x260]
+push eax
+call fcn_00018b68  ; call 0x18b68
+
+loc_00004762:
+add esp, 0x10
+xor esi, esi
+lea edi, [ebx + 0x900]
+
+loc_0000476d:
+test ebx, ebx
+je short loc_00004783  ; je 0x4783
+push eax
+mov eax, esi
+push 0
+shl eax, 5
+push 0xf3ffffff
+add eax, edi
+push eax
+jmp short loc_000047a3  ; jmp 0x47a3
+
+loc_00004783:
+push eax
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+lea edx, [esi + 0x48]
+push 0
+shl edx, 5
+push 0xf3ffffff
+add edx, eax
+push edx
+
+loc_000047a3:
+call fcn_00018b68  ; call 0x18b68
+inc esi
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jb short loc_0000476d  ; jb 0x476d
+xor esi, esi
+lea edi, [ebx + 0x904]
+
+loc_000047b9:
+test ebx, ebx
+je short loc_000047d1  ; je 0x47d1
+push eax
+mov eax, esi
+push 0xc00
+shl eax, 5
+push 0xfffff3ff
+add eax, edi
+jmp short loc_000047f7  ; jmp 0x47f7
+
+loc_000047d1:
+push eax
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+mov edx, esi
+push 0xc00
+shl edx, 5
+push 0xfffff3ff
+lea eax, [eax + edx + 0x904]
+
+loc_000047f7:
+push eax
+inc esi
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp esi, dword [ebp - 0x1c]
+jb short loc_000047b9  ; jb 0x47b9
+test ebx, ebx
+jne near loc_00004902  ; jne 0x4902
+
+loc_0000480e:
+push esi
+push 0
+push dword [ebp + 0x14]
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+mov edx, ebx
+push 0xe000000
+inc ebx
+shl edx, 5
+push 0xc1ffffff
+lea eax, [eax + edx + 0x90c]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp ebx, dword [ebp - 0x1c]
+jb short loc_0000480e  ; jb 0x480e
+cmp dword [ebp - 0x20], 0x40670
+jne short loc_00004870  ; jne 0x4870
+cmp byte [ebp - 0x24], 0
+jne short loc_00004877  ; jne 0x4877
+push ecx
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+jne short loc_00004877  ; jne 0x4877
+
+loc_00004870:
+xor esi, esi
+or ebx, 0xffffffff
+jmp short loc_00004881  ; jmp 0x4881
+
+loc_00004877:
+mov esi, 0x124
+mov ebx, 0xfffffedb
+
+loc_00004881:
+push edx
+and ebx, 0xc7ffffff
+push 0
+or esi, 0x28000000
+push 1
+xor edi, edi
+push 0
+mov dword [ebp - 0x20], ebx
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0x10
+lea ebx, [eax + 0x91c]
+
+loc_000048a7:
+push eax
+inc edi
+push esi
+push dword [ebp - 0x20]
+push ebx
+add ebx, 0x20
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp edi, dword [ebp - 0x1c]
+jb short loc_000048a7  ; jb 0x48a7
+jmp short loc_00004902  ; jmp 0x4902
+
+loc_000048c0:
+push 0
+push 0x15
+push 0xc008001
+push dword [ebp + 0xc]
+call fcn_000041ca  ; call 0x41ca
+add esp, 0x10
+and eax, 0xc1ffffff
+mov edx, eax
+or eax, 0x1c000000
+or edx, 0x6000000
+cmp byte [ebp - 0x28], 1
+cmove edx, eax
+push edx
+push 0x16
+push 0xc008001
+push dword [ebp + 0xc]
+call fcn_000041ca  ; call 0x41ca
+jmp near loc_000045da  ; jmp 0x45da
+
+loc_00004902:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000490a:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x10
+mov eax, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0xc]
+mov dword [ebp - 0xc], eax
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00004935  ; je 0x4935
+push edx
+push edx
+push ref_0002141a  ; push 0x2141a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00004935:
+test bl, bl
+jne short loc_00004949  ; jne 0x4949
+cmp byte [ebp - 0xc], 3
+sete al
+lea esi, [eax*4 + 4]
+jmp short loc_0000496b  ; jmp 0x496b
+
+loc_00004949:
+cmp bl, 1
+jne short loc_00004964  ; jne 0x4964
+cmp byte [ebp - 0xc], 2
+mov esi, 4
+je short loc_0000496b  ; je 0x496b
+
+loc_00004959:
+cmp byte [ebp - 0xc], 1
+sbb esi, esi
+and esi, 2
+jmp short loc_0000496b  ; jmp 0x496b
+
+loc_00004964:
+cmp bl, 2
+je short loc_00004959  ; je 0x4959
+xor esi, esi
+
+loc_0000496b:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000498a  ; je 0x498a
+push eax
+mov eax, esi
+movzx eax, al
+push eax
+push ref_00021436  ; push 0x21436
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000498a:
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00004993:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov eax, dword [ebp + 0xc]
+push 0
+mov ebx, dword [ebp + 0x14]
+push 1
+push 0
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x10]
+mov edi, ebx
+mov dword [ebp - 0x20], eax
+call fcn_00016c9a  ; call 0x16c9a
+mov esi, eax
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_000049d7  ; je 0x49d7
+push eax
+push eax
+push ref_0002144e  ; push 0x2144e
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000049d7:
+test bl, bl
+jne short loc_00004a02  ; jne 0x4a02
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_00004b00  ; je 0x4b00
+mov dword [ebp + 0xc], ref_00021472  ; mov dword [ebp + 0xc], 0x21472
+mov dword [ebp + 8], 0x40
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00015487  ; jmp 0x15487
+
+loc_00004a02:
+sub esp, 0xc
+lea eax, [esi + 0xd0c]
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+xor ecx, ecx
+test eax, 0x100000
+je short loc_00004a3f  ; je 0x4a3f
+call fcn_00015479  ; call 0x15479
+mov cl, 1
+test al, al
+je short loc_00004a3f  ; je 0x4a3f
+push eax
+push eax
+push ref_00021493  ; push 0x21493
+push 0x40
+mov dword [ebp - 0x24], ecx
+call fcn_00015487  ; call 0x15487
+mov ecx, dword [ebp - 0x24]
+add esp, 0x10
+
+loc_00004a3f:
+cmp byte [ebp - 0x1c], 0
+jne short loc_00004a62  ; jne 0x4a62
+cmp byte [ebp - 0x20], 3
+jne short loc_00004a55  ; jne 0x4a55
+xor edx, edx
+
+loc_00004a4d:
+test cl, cl
+jne short loc_00004a98  ; jne 0x4a98
+
+loc_00004a51:
+mov dl, 8
+jmp short loc_00004a86  ; jmp 0x4a86
+
+loc_00004a55:
+mov dl, 4
+mov al, dl
+sub eax, ebx
+test cl, cl
+cmove edx, eax
+jmp short loc_00004a98  ; jmp 0x4a98
+
+loc_00004a62:
+cmp byte [ebp - 0x1c], 1
+jne short loc_00004a8a  ; jne 0x4a8a
+cmp byte [ebp - 0x20], 2
+jne short loc_00004a76  ; jne 0x4a76
+xor edx, edx
+test cl, cl
+jne short loc_00004a98  ; jne 0x4a98
+jmp short loc_00004a51  ; jmp 0x4a51
+
+loc_00004a76:
+xor edx, edx
+cmp byte [ebp - 0x20], 0
+jne short loc_00004a98  ; jne 0x4a98
+mov dl, 2
+test cl, cl
+jne short loc_00004a98  ; jne 0x4a98
+mov dl, 6
+
+loc_00004a86:
+sub edx, ebx
+jmp short loc_00004a98  ; jmp 0x4a98
+
+loc_00004a8a:
+xor edx, edx
+cmp byte [ebp - 0x1c], 2
+jne short loc_00004a98  ; jne 0x4a98
+cmp byte [ebp - 0x20], 0
+je short loc_00004a4d  ; je 0x4a4d
+
+loc_00004a98:
+mov dword [ebp - 0x20], edx
+call fcn_00015479  ; call 0x15479
+mov edx, dword [ebp - 0x20]
+test al, al
+je short loc_00004ace  ; je 0x4ace
+movzx eax, dl
+movzx ebx, bl
+push ecx
+push ecx
+lea ecx, [eax + ebx - 1]
+push ecx
+push eax
+movzx eax, byte [ebp - 0x1c]
+push eax
+push 0
+push ref_000214ac  ; push 0x214ac
+push 0x40
+call fcn_00015487  ; call 0x15487
+mov edx, dword [ebp - 0x20]
+add esp, 0x20
+
+loc_00004ace:
+xor ebx, ebx
+add esi, 0x91c
+
+loc_00004ad6:
+lea eax, [edx + ebx]
+mov ecx, edi
+inc ebx
+cmp cl, bl
+jb short loc_00004b00  ; jb 0x4b00
+mov dword [ebp - 0x1c], edx
+movzx eax, al
+push edx
+push edx
+shl eax, 5
+push 0x80000000
+add eax, esi
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+mov edx, dword [ebp - 0x1c]
+jmp short loc_00004ad6  ; jmp 0x4ad6
+
+loc_00004b00:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00004b08:
+push ebp
+mov ecx, 0x15
+mov ebp, esp
+push edi
+push esi
+mov esi, ref_000203b0  ; mov esi, 0x203b0
+push ebx
+add esp, 0xffffff80
+lea edi, [ebp - 0x2d]
+rep movsb  ; rep movsb byte es:[edi], byte ptr [esi]
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 0
+push 1
+push 0
+mov edi, eax
+mov dword [ebp - 0x78], eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 1
+push 1
+push 0
+mov ebx, eax
+mov dword [ebp - 0x40], eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 2
+push 1
+push 0
+mov dword [ebp - 0x50], eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0
+push 1
+mov dword [ebp - 0x54], eax
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [ebp - 0x64], eax
+lea eax, [edi + 0x48]
+mov dword [esp], eax
+call fcn_00017ed8  ; call 0x17ed8
+mov esi, eax
+lea eax, [edi + 0x68]
+mov dword [esp], eax
+call fcn_00017ed8  ; call 0x17ed8
+mov eax, dword [ebp + 0xc]
+mov byte [ebp - 0x38], 0
+mov eax, dword [eax + 0xd]
+mov cl, byte [eax + 0x40]
+mov dword [esp], ebx
+mov byte [ebp - 0x4a], cl
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_00004bcd  ; jne 0x4bcd
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_00005d48  ; je 0x5d48
+push eax
+push eax
+push ref_000214c7  ; push 0x214c7
+push 0x40
+call fcn_00015487  ; call 0x15487
+jmp near loc_00005d01  ; jmp 0x5d01
+
+loc_00004bcd:
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x504
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+shr eax, 0x10
+and eax, 3
+mov byte [ebp - 0x48], al
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00004c10  ; je 0x4c10
+push eax
+movzx eax, byte [ebp - 0x48]
+push eax
+push ref_000214e4  ; push 0x214e4
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00004c10:
+lea eax, [ebp - 0x34]
+push eax
+push 0
+push 0
+push ref_000290cc  ; push 0x290cc
+call fcn_0001975d  ; call 0x1975d
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00004c69  ; je 0x4c69
+test ebx, ebx
+jns short loc_00004c69  ; jns 0x4c69
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00004c51  ; je 0x4c51
+push edi
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00004c51:
+push ebx
+push ref_000206f4  ; push 0x206f4
+push 0x67c
+push ref_00020f0c  ; push 0x20f0c
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00004c69:
+mov al, byte [ebp - 0x48]
+test al, al
+je short loc_00004c7a  ; je 0x4c7a
+cmp al, 2
+jne short loc_00004c82  ; jne 0x4c82
+mov byte [ebp - 0x28], 8
+jmp short loc_00004c82  ; jmp 0x4c82
+
+loc_00004c7a:
+mov byte [ebp - 0x28], 8
+mov byte [ebp - 0x21], 4
+
+loc_00004c82:
+call fcn_0001c651  ; call 0x1c651
+mov ebx, 1
+mov dword [ebp - 0x58], eax
+call fcn_0001c678  ; call 0x1c678
+push ecx
+push 0
+push 0
+push 0
+mov dword [ebp - 0x44], eax
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xe8
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test eax, 0x100000
+je short loc_00004cd6  ; je 0x4cd6
+call fcn_00015479  ; call 0x15479
+xor ebx, ebx
+test al, al
+je short loc_00004cd6  ; je 0x4cd6
+push edx
+push edx
+push ref_000214fb  ; push 0x214fb
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00004cd6:
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 0x3b], 2
+jne short loc_00004ce6  ; jne 0x4ce6
+mov byte [eax + 0x3b], 1
+
+loc_00004ce6:
+mov eax, dword [ebp + 0xc]
+cmp byte [eax], 1
+ja short loc_00004cfa  ; ja 0x4cfa
+
+loc_00004cee:
+mov dword [ebp - 0x3c], 0
+jmp near loc_00004dc3  ; jmp 0x4dc3
+
+loc_00004cfa:
+sub esp, 0xc
+push ref_0002955c  ; push 0x2955c
+call fcn_000190fd  ; call 0x190fd
+add esp, 0x10
+mov dword [ebp - 0x3c], eax
+test eax, eax
+je short loc_00004cee  ; je 0x4cee
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp dword [eax + 0x44], 0
+jne short loc_00004d31  ; jne 0x4d31
+
+loc_00004d1d:
+mov eax, dword [ebp + 0xc]
+mov ecx, dword [ebp - 0x3c]
+mov eax, dword [eax + 0xd]
+mov al, byte [eax + 0x3b]
+mov byte [ecx + 0x45], al
+jmp near loc_00004dc3  ; jmp 0x4dc3
+
+loc_00004d31:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00004d4c  ; je 0x4d4c
+push eax
+push 0x21
+push ref_0002150f  ; push 0x2150f
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00004d4c:
+push eax
+mov eax, dword [ebp + 0xc]
+push 0x21
+mov edi, dword [ebp - 0x3c]
+mov eax, dword [eax + 0xd]
+push dword [eax + 0x44]
+mov eax, edi
+add eax, 0x29
+push eax
+call fcn_0001713e  ; call 0x1713e
+mov eax, dword [ebp + 0xc]
+add esp, 0x10
+mov byte [edi + 0x28], 1
+mov eax, dword [eax + 0xd]
+mov al, byte [eax + 0x3b]
+cmp byte [edi + 0x45], al
+je short loc_00004d1d  ; je 0x4d1d
+dec al
+je short loc_00004d1d  ; je 0x4d1d
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00004d99  ; je 0x4d99
+push eax
+push eax
+push ref_00021541  ; push 0x21541
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00004d99:
+xor eax, eax
+
+loc_00004d9b:
+mov ecx, dword [ebp - 0x3c]
+xor edx, edx
+mov dword [ecx + eax + 0x29], 0
+
+loc_00004da8:
+mov ecx, dword [ebp - 0x3c]
+mov byte [ecx + edx + 0x35], 0
+inc edx
+cmp edx, 0x10
+jne short loc_00004da8  ; jne 0x4da8
+add eax, 4
+cmp eax, 0xc
+jne short loc_00004d9b  ; jne 0x4d9b
+jmp near loc_00004d1d  ; jmp 0x4d1d
+
+loc_00004dc3:
+lea edi, [ebp - 0x2d]
+
+loc_00004dc6:
+push dword [ebp + 0xc]
+add edi, 7
+movzx eax, byte [edi - 5]
+push eax
+movzx eax, byte [edi - 6]
+push eax
+movzx eax, byte [edi - 7]
+push eax
+call fcn_00003fc6  ; call 0x3fc6
+lea eax, [ebp - 0x18]
+add esp, 0x10
+cmp edi, eax
+jne short loc_00004dc6  ; jne 0x4dc6
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00004e04  ; je 0x4e04
+push eax
+push eax
+push ref_0002157a  ; push 0x2157a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00004e04:
+movzx eax, byte [ebp - 0x4a]
+sub esp, 0xc
+and esi, 0xfffffffe
+push eax
+push 1
+push 0
+push esi
+push dword [ebp + 0xc]
+call fcn_00004257  ; call 0x4257
+add esp, 0x20
+cmp bl, 1
+jne short loc_00004e60  ; jne 0x4e60
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 8], 0
+je short loc_00004e60  ; je 0x4e60
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00004e4a  ; je 0x4e4a
+push eax
+push eax
+push ref_00021589  ; push 0x21589
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00004e4a:
+push eax
+movzx eax, byte [ebp - 0x48]
+push eax
+movzx eax, byte [ebp - 0x44]
+push eax
+push dword [ebp + 0xc]
+call fcn_000031c0  ; call 0x31c0
+add esp, 0x10
+
+loc_00004e60:
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 0x39], 2
+jne short loc_00004e70  ; jne 0x4e70
+mov byte [eax + 0x39], 0
+
+loc_00004e70:
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 0x39], 1
+jne near loc_00004f0a  ; jne 0x4f0a
+mov eax, dword [ebp - 0x40]
+sub esp, 0xc
+lea edx, [eax + 0xd0]
+push edx
+mov dword [ebp - 0x60], edx
+call fcn_00017dc2  ; call 0x17dc2
+mov word [ebp - 0x4a], ax
+mov eax, dword [ebp - 0x50]
+and word [ebp - 0x4a], 0xf
+lea edi, [eax + 0xd0]
+mov dword [esp], edi
+call fcn_00017dc2  ; call 0x17dc2
+mov word [ebp - 0x4c], ax
+mov eax, dword [ebp - 0x54]
+and word [ebp - 0x4c], 0xf
+lea esi, [eax + 0xd0]
+mov dword [esp], esi
+call fcn_00017dc2  ; call 0x17dc2
+mov edx, dword [ebp - 0x60]
+add esp, 0xc
+push 1
+push 0xfff0
+push edx
+mov word [ebp - 0x5a], ax
+and word [ebp - 0x5a], 0xf
+call fcn_00018981  ; call 0x18981
+add esp, 0xc
+push 1
+push 0xfff0
+push edi
+call fcn_00018981  ; call 0x18981
+add esp, 0xc
+push 1
+push 0xfff0
+push esi
+call fcn_00018981  ; call 0x18981
+add esp, 0x10
+jmp short loc_00004f1c  ; jmp 0x4f1c
+
+loc_00004f0a:
+mov word [ebp - 0x5a], 0
+mov word [ebp - 0x4c], 0
+mov word [ebp - 0x4a], 0
+
+loc_00004f1c:
+movzx eax, byte [ebp - 0x44]
+xor esi, esi
+mov dword [ebp - 0x6c], eax
+
+loc_00004f25:
+push edi
+push ebx
+push dword [ebp - 0x6c]
+lea eax, [ebp - 0x2d]
+push esi
+inc esi
+push eax
+push dword [ebp + 0xc]
+push dword [ebp - 0x34]
+push dword [ebp + 8]
+call fcn_000039d3  ; call 0x39d3
+add esp, 0x20
+cmp esi, 3
+jne short loc_00004f25  ; jne 0x4f25
+mov eax, dword [ebp + 0xc]
+cmp byte [eax], 2
+ja near loc_00005003  ; ja 0x5003
+
+loc_00004f52:
+mov esi, dword [ebp - 0x40]
+sub esp, 0xc
+mov eax, esi
+add eax, 0xdd8
+push eax
+mov edi, eax
+mov dword [ebp - 0x60], eax
+call fcn_00017e4e  ; call 0x17e4e
+pop ecx
+pop ebx
+or eax, 0x8002
+push eax
+push edi
+call fcn_00017e8f  ; call 0x17e8f
+pop edi
+pop eax
+mov eax, esi
+add eax, 0xc24
+push 0xfffeffff
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+pop eax
+mov eax, dword [ebp - 0x50]
+pop edx
+add eax, 0xc24
+push 0xfffeffff
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+mov eax, dword [ebp - 0x54]
+pop ecx
+pop ebx
+lea ebx, [ebp - 0x2d]
+add eax, 0xc24
+push 0xfffeffff
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+movzx eax, byte [ebp - 0x48]
+mov esi, dword [ebp - 0x3c]
+mov dword [esp], eax
+mov edi, eax
+push esi
+push dword [ebp + 0xc]
+push dword [ebp - 0x34]
+push dword [ebp + 8]
+mov dword [ebp - 0x68], eax
+call fcn_00002634  ; call 0x2634
+add esp, 0x1c
+push edi
+push 3
+lea eax, [ebp - 0x2d]
+push eax
+push esi
+xor esi, esi
+push dword [ebp - 0x34]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00003787  ; call 0x3787
+mov eax, dword [ebp - 0x64]
+add esp, 0x20
+add eax, 0xc
+mov dword [ebp - 0x70], eax
+jmp near loc_0000509a  ; jmp 0x509a
+
+loc_00005003:
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 0x52], 1
+jne near loc_00004f52  ; jne 0x4f52
+push edx
+mov al, byte [eax + 0x53]
+xor ebx, ebx
+mov edi, dword [ebp - 0x40]
+and eax, 0xf
+shl eax, 0x10
+push eax
+mov eax, edi
+push 0xfff0ffff
+add eax, 0xd0c
+push eax
+call fcn_00018b68  ; call 0x18b68
+lea esi, [edi + 0xa00]
+add esp, 0x10
+
+loc_0000503e:
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp bl, byte [eax + 0x53]
+jne short loc_00005058  ; jne 0x5058
+push eax
+push eax
+push 0xfffffdff
+push esi
+call fcn_00018b3e  ; call 0x18b3e
+jmp short loc_00005065  ; jmp 0x5065
+
+loc_00005058:
+push edi
+push edi
+push 0x200
+push esi
+call fcn_00018b14  ; call 0x18b14
+
+loc_00005065:
+inc ebx
+add esp, 0x10
+add esi, 0x10
+cmp bl, 0x10
+jne short loc_0000503e  ; jne 0x503e
+jmp near loc_00004f52  ; jmp 0x4f52
+
+loc_00005076:
+sub esp, 0xc
+lea eax, [edi + 0xba]
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test al, 0x40
+jne short loc_000050c1  ; jne 0x50c1
+
+loc_0000508c:
+add ebx, 7
+lea eax, [ebp - 0x18]
+cmp ebx, eax
+je near loc_0000512a  ; je 0x512a
+
+loc_0000509a:
+push ecx
+movzx eax, byte [ebx + 2]
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+movzx eax, byte [ebx]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+mov edi, eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_00005076  ; jne 0x5076
+jmp short loc_0000508c  ; jmp 0x508c
+
+loc_000050c1:
+mov byte [ebx + 4], 1
+add edi, 0x18
+push ecx
+push 0x10100
+push 0xff0000ff
+push edi
+call fcn_00018b68  ; call 0x18b68
+pop eax
+pop edx
+push 0
+push dword [ebp - 0x64]
+call fcn_00017e04  ; call 0x17e04
+push 0x10
+push 0
+push 0
+push 1
+call fcn_00002862  ; call 0x2862
+add esp, 0x20
+test eax, eax
+je short loc_00005115  ; je 0x5115
+add eax, dword [ebp - 0x70]
+sub esp, 0xc
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+and eax, 0xf
+cmp al, 3
+mov byte [ebx + 6], al
+mov al, 1
+cmovae esi, eax
+
+loc_00005115:
+push edx
+push edx
+push 0xff0000ff
+push edi
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+jmp near loc_0000508c  ; jmp 0x508c
+
+loc_0000512a:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00005144  ; je 0x5144
+push eax
+push eax
+push ref_000215a3  ; push 0x215a3
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00005144:
+lea ebx, [ebp - 0x2d]
+
+loc_00005147:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00005175  ; je 0x5175
+push eax
+push eax
+movzx eax, byte [ebx + 6]
+push eax
+movzx eax, byte [ebx + 4]
+push eax
+movzx eax, byte [ebx + 2]
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+push ref_000215bd  ; push 0x215bd
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_00005175:
+add ebx, 7
+lea eax, [ebp - 0x18]
+cmp ebx, eax
+jne short loc_00005147  ; jne 0x5147
+mov eax, esi
+test al, al
+jne short loc_0000519a  ; jne 0x519a
+
+loc_00005185:
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 0x39], 1
+jne near loc_0000538f  ; jne 0x538f
+jmp near loc_000052f8  ; jmp 0x52f8
+
+loc_0000519a:
+mov eax, dword [ebp - 0x58]
+cmp eax, 0x40660
+je short loc_000051ab  ; je 0x51ab
+cmp eax, 0x306c0
+jne short loc_000051b8  ; jne 0x51b8
+
+loc_000051ab:
+xor ebx, ebx
+lea esi, [ebp - 0x38]
+lea edi, [ebp - 0x35]
+jmp near loc_0000523a  ; jmp 0x523a
+
+loc_000051b8:
+cmp dword [ebp - 0x58], 0x40670
+jne short loc_00005185  ; jne 0x5185
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+jne short loc_000051ab  ; jne 0x51ab
+jmp short loc_00005185  ; jmp 0x5185
+
+loc_000051e1:
+cmp bl, 0xc
+je short loc_0000524c  ; je 0x524c
+test bl, bl
+jne short loc_000051f7  ; jne 0x51f7
+push eax
+push eax
+push esi
+push 0
+
+loc_000051ef:
+call fcn_0000937d  ; call 0x937d
+add esp, 0x10
+
+loc_000051f7:
+sub esp, 0xc
+movzx ecx, byte [ebp - 0x38]
+push edi
+lea edx, [ebp - 0x36]
+push edx
+lea eax, [ebp - 0x37]
+push eax
+push ecx
+mov dword [ebp - 0x70], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x74], edx
+mov ecx, dword [eax + 0xd]
+movzx ecx, byte [ecx + ebx + 0x19]
+push ecx
+call fcn_000093d9  ; call 0x93d9
+mov edx, dword [ebp - 0x74]
+add esp, 0x20
+mov eax, dword [ebp - 0x70]
+push edi
+push edx
+push eax
+push ebx
+inc ebx
+call fcn_000094be  ; call 0x94be
+add esp, 0x10
+cmp ebx, 0x10
+je short loc_00005259  ; je 0x5259
+
+loc_0000523a:
+cmp bl, 8
+jne short loc_000051e1  ; jne 0x51e1
+cmp byte [ebp - 0x22], 0
+je short loc_000051f7  ; je 0x51f7
+push eax
+push eax
+push esi
+push 8
+jmp short loc_000051ef  ; jmp 0x51ef
+
+loc_0000524c:
+cmp byte [ebp - 0x1b], 0
+je short loc_000051f7  ; je 0x51f7
+push eax
+push eax
+push esi
+push 0xc
+jmp short loc_000051ef  ; jmp 0x51ef
+
+loc_00005259:
+cmp dword [ebp - 0x44], 0
+je short loc_00005283  ; je 0x5283
+cmp dword [ebp - 0x58], 0x40670
+jne short loc_00005283  ; jne 0x5283
+mov edi, dword [ebp - 0x60]
+sub esp, 0xc
+push edi
+call fcn_00017e4e  ; call 0x17e4e
+pop edx
+pop ecx
+and ah, 0x7f
+push eax
+push edi
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+
+loc_00005283:
+lea ebx, [ebp - 0x2d]
+
+loc_00005286:
+cmp byte [ebx + 4], 0
+je short loc_000052c5  ; je 0x52c5
+push eax
+movzx eax, byte [ebx + 2]
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+movzx eax, byte [ebx]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+mov esi, eax
+pop eax
+pop edx
+lea eax, [esi + 0xd98]
+add esi, 0xb0
+push 1
+push eax
+call fcn_00018b14  ; call 0x18b14
+pop ecx
+pop edi
+push 0x20
+push esi
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+
+loc_000052c5:
+add ebx, 7
+lea eax, [ebp - 0x18]
+cmp ebx, eax
+jne short loc_00005286  ; jne 0x5286
+lea ebx, [ebp - 0x2d]
+
+loc_000052d2:
+cmp byte [ebx + 4], 0
+je short loc_000052e9  ; je 0x52e9
+push 0
+push ebx
+push dword [ebp - 0x34]
+push dword [ebp + 8]
+call fcn_00005d50  ; call 0x5d50
+add esp, 0x10
+
+loc_000052e9:
+add ebx, 7
+lea eax, [ebp - 0x18]
+cmp ebx, eax
+jne short loc_000052d2  ; jne 0x52d2
+jmp near loc_00005185  ; jmp 0x5185
+
+loc_000052f8:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00005312  ; je 0x5312
+push eax
+push eax
+push ref_000215f5  ; push 0x215f5
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00005312:
+sub esp, 0xc
+push dword [ebp - 0x68]
+push dword [ebp - 0x6c]
+push dword [ebp - 0x34]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00003714  ; call 0x3714
+movzx eax, word [ebp - 0x4a]
+add esp, 0x1c
+push eax
+mov eax, dword [ebp - 0x40]
+push 0xfff0
+add eax, 0xd0
+push eax
+call fcn_00018981  ; call 0x18981
+movzx eax, word [ebp - 0x4c]
+add esp, 0xc
+push eax
+mov eax, dword [ebp - 0x50]
+push 0xfff0
+add eax, 0xd0
+push eax
+call fcn_00018981  ; call 0x18981
+movzx eax, word [ebp - 0x5a]
+add esp, 0xc
+push eax
+mov eax, dword [ebp - 0x54]
+push 0xfff0
+add eax, 0xd0
+push eax
+call fcn_00018981  ; call 0x18981
+mov eax, dword [ebp - 0x34]
+add esp, 0xc
+push 0x186a0
+push eax
+push dword [ebp + 8]
+call dword [eax + 4]  ; ucall
+add esp, 0x10
+
+loc_0000538f:
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 0x3b], 2
+jne short loc_0000539f  ; jne 0x539f
+mov byte [eax + 0x3b], 1
+
+loc_0000539f:
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 0x3b], 1
+jne short loc_000053bf  ; jne 0x53bf
+push dword [ebp - 0x3c]
+push dword [ebp - 0x34]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_000082e3  ; call 0x82e3
+add esp, 0x10
+
+loc_000053bf:
+cmp dword [ebp - 0x58], 0x40670
+sete al
+cmp dword [ebp - 0x44], 0
+mov byte [ebp - 0x74], al
+je short loc_000053df  ; je 0x53df
+test al, al
+je short loc_000053df  ; je 0x53df
+push edi
+push edi
+push 0x4000
+jmp short loc_000053e6  ; jmp 0x53e6
+
+loc_000053df:
+push esi
+push esi
+push 0xc000
+
+loc_000053e6:
+push dword [ebp - 0x60]
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000540b  ; je 0x540b
+push ebx
+push ebx
+push ref_00021610  ; push 0x21610
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000540b:
+mov eax, dword [ebp - 0x64]
+lea edi, [ebp - 0x2d]
+mov byte [ebp - 0x60], 0
+mov byte [ebp - 0x70], 0
+mov byte [ebp - 0x44], 0
+add eax, 0xc
+mov byte [ebp - 0x5a], 0
+mov byte [ebp - 0x4a], 0
+mov dword [ebp - 0x80], eax
+
+loc_0000542b:
+mov al, byte [edi]
+mov ecx, dword [ebp - 0x3c]
+mov byte [ebp - 0x5c], al
+mov al, byte [edi + 1]
+mov byte [ebp - 0x5b], al
+mov al, byte [edi + 2]
+mov byte [ebp - 0x6c], al
+movzx eax, byte [edi + 3]
+mov byte [ebp - 0x4c], al
+test ecx, ecx
+je short loc_00005458  ; je 0x5458
+mov edx, dword [ebp + 0xc]
+mov edx, dword [edx + 0xd]
+mov dl, byte [edx + eax + 0x5c]
+mov byte [ecx + eax + 0x47], dl
+
+loc_00005458:
+movzx eax, byte [ebp - 0x6c]
+push ecx
+push eax
+movzx eax, byte [ebp - 0x5b]
+push eax
+movzx eax, byte [ebp - 0x5c]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+mov esi, eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+je short loc_0000548a  ; je 0x548a
+cmp byte [edi + 4], 0
+jne short loc_00005499  ; jne 0x5499
+
+loc_0000548a:
+cmp byte [eax + 4], 0
+je near loc_0000578e  ; je 0x578e
+jmp near loc_00005768  ; jmp 0x5768
+
+loc_00005499:
+cmp byte [eax + 4], 0
+jne short loc_000054e8  ; jne 0x54e8
+push eax
+push 0x10100
+push 0xff0000ff
+lea ebx, [esi + 0x18]
+push ebx
+call fcn_00018b68  ; call 0x18b68
+pop eax
+pop edx
+push 0
+push dword [ebp - 0x64]
+call fcn_00017e04  ; call 0x17e04
+lea eax, [esi + 0x11a]
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test al, 2
+jne near loc_0000578e  ; jne 0x578e
+push eax
+push eax
+push 0xff0000ff
+push ebx
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+
+loc_000054e8:
+mov eax, dword [ebp + 0xc]
+cmp byte [eax], 0xf
+jbe short loc_0000553d  ; jbe 0x553d
+movzx ebx, byte [ebp - 0x4c]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + ebx + 0x61], 0
+je short loc_0000553d  ; je 0x553d
+sub esp, 0xc
+lea eax, [esi + 0xb2]
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+mov ecx, dword [ebp + 0xc]
+add esp, 0x10
+mov edx, dword [ecx + 0xd]
+and eax, 0x3f0
+sar eax, 4
+movzx edx, byte [edx + ebx + 0x61]
+cmp dl, al
+je short loc_0000553d  ; je 0x553d
+movzx eax, byte [ebp - 0x6c]
+push eax
+movzx eax, byte [ebp - 0x5b]
+push eax
+push edx
+push dword [ebp + 8]
+call fcn_000028d8  ; call 0x28d8
+add esp, 0x10
+
+loc_0000553d:
+mov eax, dword [ebp + 0xc]
+cmp byte [eax], 7
+jbe short loc_00005559  ; jbe 0x5559
+mov edx, dword [eax + 0xd]
+movzx eax, byte [ebp - 0x4c]
+mov bl, byte [edx + eax + 0x5c]
+cmp bl, 0xff
+jne near loc_0000567d  ; jne 0x567d
+
+loc_00005559:
+sub esp, 0xc
+lea eax, [esi + 0xac]
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0xc
+push 0x10100
+push 0xff0000ff
+lea ebx, [esi + 0x18]
+push ebx
+shr eax, 4
+and eax, 0x3f
+mov byte [ebp - 0x79], al
+call fcn_00018b68  ; call 0x18b68
+pop edx
+pop ecx
+push 0
+push dword [ebp - 0x64]
+call fcn_00017e04  ; call 0x17e04
+pop eax
+push dword [ebp - 0x64]
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+inc eax
+jne short loc_000055ec  ; jne 0x55ec
+sub esp, 0xc
+add esi, 0xb2
+push esi
+call fcn_00017dc2  ; call 0x17dc2
+mov esi, eax
+and esi, 0x3f0
+sar esi, 4
+mov eax, esi
+mov byte [ebp - 0x70], al
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00005618  ; je 0x5618
+movzx eax, byte [ebp - 0x6c]
+sub esp, 0xc
+push esi
+push eax
+movzx eax, byte [ebp - 0x5b]
+push eax
+push ref_0002162c  ; push 0x2162c
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+jmp short loc_00005618  ; jmp 0x5618
+
+loc_000055ec:
+push 0x10
+push 0
+push 0
+push 1
+call fcn_00002862  ; call 0x2862
+add esp, 0x10
+test eax, eax
+je short loc_00005618  ; je 0x5618
+add eax, dword [ebp - 0x80]
+sub esp, 0xc
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+shr eax, 4
+and eax, 0x3f
+mov byte [ebp - 0x70], al
+
+loc_00005618:
+push eax
+push eax
+push 0xff0000ff
+push ebx
+call fcn_00018b3e  ; call 0x18b3e
+mov cl, byte [ebp - 0x79]
+add esp, 0x10
+mov bl, byte [ebp - 0x70]
+xor edx, edx
+mov al, cl
+sub eax, ebx
+cmp cl, bl
+cmova edx, eax
+mov bl, 0xff
+mov al, dl
+shr al, 1
+mov dword [ebp - 0x84], edx
+mov byte [ebp - 0x60], al
+call fcn_00015479  ; call 0x15479
+mov edx, dword [ebp - 0x84]
+test al, al
+je short loc_000056a1  ; je 0x56a1
+push eax
+movzx edx, dl
+push eax
+movzx eax, byte [ebp - 0x60]
+push eax
+movzx eax, byte [ebp - 0x70]
+push edx
+push eax
+movzx eax, byte [ebp - 0x79]
+push eax
+push ref_00021698  ; push 0x21698
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+jmp short loc_000056a1  ; jmp 0x56a1
+
+loc_0000567d:
+test bl, bl
+je short loc_000056a1  ; je 0x56a1
+call fcn_00015479  ; call 0x15479
+mov byte [ebp - 0x60], bl
+test al, al
+je short loc_000056a1  ; je 0x56a1
+push eax
+movzx eax, bl
+push eax
+push ref_0002170b  ; push 0x2170b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000056a1:
+mov eax, dword [ebp - 0x58]
+cmp eax, 0x40660
+je short loc_000056b2  ; je 0x56b2
+cmp eax, 0x306c0
+jne short loc_000056b8  ; jne 0x56b8
+
+loc_000056b2:
+test bl, bl
+je short loc_00005734  ; je 0x5734
+jmp short loc_000056de  ; jmp 0x56de
+
+loc_000056b8:
+cmp byte [ebp - 0x74], 0
+je short loc_00005734  ; je 0x5734
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+jne short loc_000056b2  ; jne 0x56b2
+jmp short loc_00005734  ; jmp 0x5734
+
+loc_000056de:
+movzx esi, byte [ebp - 0x6c]
+push eax
+push dword [ebp - 0x68]
+push esi
+push dword [ebp + 8]
+call fcn_0000490a  ; call 0x490a
+add esp, 0x10
+mov bl, al
+cmp byte [ebp - 0x60], al
+jbe short loc_0000571b  ; jbe 0x571b
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000571e  ; je 0x571e
+push eax
+movzx eax, bl
+push eax
+push ref_000216d6  ; push 0x216d6
+push 0x80000040
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp short loc_0000571e  ; jmp 0x571e
+
+loc_0000571b:
+mov bl, byte [ebp - 0x60]
+
+loc_0000571e:
+movzx eax, bl
+push eax
+push dword [ebp - 0x68]
+push esi
+push dword [ebp + 8]
+call fcn_00004993  ; call 0x4993
+add esp, 0x10
+mov byte [ebp - 0x60], bl
+
+loc_00005734:
+call fcn_00015479  ; call 0x15479
+movzx esi, byte [ebp - 0x6c]
+movzx ebx, byte [ebp - 0x5b]
+test al, al
+je short loc_00005756  ; je 0x5756
+push esi
+push ebx
+push ref_00021720  ; push 0x21720
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00005756:
+movzx eax, byte [ebp - 0x5c]
+push esi
+push ebx
+push eax
+push dword [ebp + 0xc]
+call fcn_00003b13  ; call 0x3b13
+add esp, 0x10
+
+loc_00005768:
+cmp byte [ebp - 0x4c], 0
+jne short loc_00005774  ; jne 0x5774
+cmp byte [ebp - 0x48], 3
+je short loc_000057d1  ; je 0x57d1
+
+loc_00005774:
+cmp byte [ebp - 0x4c], 1
+jne short loc_00005780  ; jne 0x5780
+cmp byte [ebp - 0x48], 2
+je short loc_000057e9  ; je 0x57e9
+
+loc_00005780:
+cmp byte [ebp - 0x4c], 2
+jne short loc_000057c1  ; jne 0x57c1
+cmp byte [ebp - 0x48], 0
+je short loc_000057ed  ; je 0x57ed
+jmp short loc_000057c1  ; jmp 0x57c1
+
+loc_0000578e:
+mov al, byte [ebp - 0x48]
+cmp al, 3
+je short loc_000057db  ; je 0x57db
+cmp al, 2
+jne short loc_000057a5  ; jne 0x57a5
+cmp byte [ebp - 0x4c], 0
+mov byte [ebp - 0x44], 1
+je short loc_000057bd  ; je 0x57bd
+jmp short loc_000057d5  ; jmp 0x57d5
+
+loc_000057a5:
+cmp byte [ebp - 0x48], 0
+jne short loc_000057c1  ; jne 0x57c1
+cmp byte [ebp - 0x4c], 0
+je short loc_000057bd  ; je 0x57bd
+cmp byte [ebp - 0x4c], 1
+jne short loc_000057e9  ; jne 0x57e9
+mov byte [ebp - 0x5a], 1
+jmp short loc_000057c1  ; jmp 0x57c1
+
+loc_000057bd:
+mov byte [ebp - 0x4a], 1
+
+loc_000057c1:
+add edi, 7
+lea eax, [ebp - 0x18]
+cmp edi, eax
+jne near loc_0000542b  ; jne 0x542b
+jmp short loc_000057ed  ; jmp 0x57ed
+
+loc_000057d1:
+mov byte [ebp - 0x44], 1
+
+loc_000057d5:
+mov byte [ebp - 0x5a], 1
+jmp short loc_000057ed  ; jmp 0x57ed
+
+loc_000057db:
+mov byte [ebp - 0x44], 1
+mov byte [ebp - 0x5a], 1
+mov byte [ebp - 0x4a], 1
+jmp short loc_000057ed  ; jmp 0x57ed
+
+loc_000057e9:
+mov byte [ebp - 0x44], 1
+
+loc_000057ed:
+mov dl, byte [ebp - 0x44]
+xor ebx, ebx
+mov al, byte [ebp - 0x5a]
+xor edx, 1
+xor eax, 1
+or dl, al
+je short loc_00005806  ; je 0x5806
+mov bl, byte [ebp - 0x4a]
+mov byte [ebp - 0x4a], 0
+
+loc_00005806:
+sub esp, 0xc
+mov esi, 1
+push dword [ebp - 0x40]
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_00005839  ; jne 0x5839
+call fcn_00015479  ; call 0x15479
+xor esi, esi
+test al, al
+je short loc_00005839  ; je 0x5839
+push ecx
+push ecx
+push ref_0002174b  ; push 0x2174b
+push 2
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00005839:
+or bl, byte [ebp - 0x4a]
+je near loc_00005968  ; je 0x5968
+mov eax, esi
+test al, al
+je near loc_00005968  ; je 0x5968
+mov edi, dword [ebp - 0x40]
+mov ebx, 0x3e9
+push eax
+push eax
+push 0x100
+mov eax, edi
+add eax, 0x224
+push eax
+call fcn_00018b14  ; call 0x18b14
+lea esi, [edi + 0x464]
+pop eax
+mov eax, edi
+pop edx
+add eax, 0xb0
+push 0x10
+push eax
+call fcn_00018730  ; call 0x18730
+add esp, 0x10
+
+loc_00005882:
+sub esp, 0xc
+push esi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+and eax, 0x3f
+cmp eax, 2
+je short loc_000058ac  ; je 0x58ac
+dec bx
+je short loc_000058ac  ; je 0x58ac
+mov eax, dword [ebp - 0x34]
+push edi
+push 0x64
+push eax
+push dword [ebp + 8]
+call dword [eax + 4]  ; ucall
+add esp, 0x10
+jmp short loc_00005882  ; jmp 0x5882
+
+loc_000058ac:
+mov eax, dword [ebp - 0x40]
+push esi
+push 0x20
+push 0xcf
+add eax, 0xc20
+push eax
+call fcn_0001878a  ; call 0x1878a
+mov eax, dword [ebp - 0x58]
+add esp, 0x10
+cmp eax, 0x40660
+je short loc_000058d6  ; je 0x58d6
+cmp eax, 0x306c0
+jne short loc_000058f9  ; jne 0x58f9
+
+loc_000058d6:
+mov edi, dword [ebp - 0x68]
+push ebx
+push edi
+push 0
+push dword [ebp + 8]
+call fcn_0000490a  ; call 0x490a
+movzx eax, al
+push eax
+push edi
+push 0
+push dword [ebp + 8]
+call fcn_00004993  ; call 0x4993
+add esp, 0x20
+jmp short loc_0000591d  ; jmp 0x591d
+
+loc_000058f9:
+cmp byte [ebp - 0x74], 0
+je short loc_0000591d  ; je 0x591d
+push ecx
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+jne short loc_000058d6  ; jne 0x58d6
+
+loc_0000591d:
+cmp byte [ebp - 0x4a], 0
+je short loc_00005968  ; je 0x5968
+push eax
+push eax
+mov eax, dword [ebp - 0x40]
+push 0x40000000
+add eax, 0xd20
+push eax
+call fcn_00018b14  ; call 0x18b14
+pop eax
+mov eax, dword [ebp - 0x78]
+pop edx
+add eax, 0x54
+push 0xf7
+push eax
+call fcn_0001875d  ; call 0x1875d
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00005968  ; je 0x5968
+push eax
+push eax
+push ref_0002174b  ; push 0x2174b
+push 2
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00005968:
+sub esp, 0xc
+mov bl, 1
+push dword [ebp - 0x50]
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_00005998  ; jne 0x5998
+call fcn_00015479  ; call 0x15479
+xor ebx, ebx
+test al, al
+je short loc_00005998  ; je 0x5998
+push edi
+push edi
+push ref_0002175c  ; push 0x2175c
+push 2
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00005998:
+test byte [ebp - 0x5a], bl
+je near loc_00005abd  ; je 0x5abd
+mov edi, dword [ebp - 0x50]
+push ecx
+push ecx
+push 0x100
+mov eax, edi
+add eax, 0x224
+push eax
+call fcn_00018b14  ; call 0x18b14
+mov eax, edi
+pop ebx
+add eax, 0xb0
+pop esi
+mov ebx, 0x3e9
+push 0x10
+push eax
+call fcn_00018730  ; call 0x18730
+mov eax, dword [ebp - 0x40]
+add esp, 0x10
+lea esi, [eax + 0x464]
+
+loc_000059da:
+sub esp, 0xc
+push esi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+shr eax, 8
+and eax, 0x3f
+cmp eax, 2
+je short loc_00005a07  ; je 0x5a07
+dec bx
+je short loc_00005a07  ; je 0x5a07
+mov eax, dword [ebp - 0x34]
+push edx
+push 0x64
+push eax
+push dword [ebp + 8]
+call dword [eax + 4]  ; ucall
+add esp, 0x10
+jmp short loc_000059da  ; jmp 0x59da
+
+loc_00005a07:
+push eax
+mov eax, dword [ebp - 0x50]
+push 0x20
+push 0xcf
+add eax, 0xc20
+push eax
+call fcn_0001878a  ; call 0x1878a
+mov eax, dword [ebp - 0x58]
+add esp, 0x10
+cmp eax, 0x40660
+je short loc_00005a31  ; je 0x5a31
+cmp eax, 0x306c0
+jne short loc_00005a54  ; jne 0x5a54
+
+loc_00005a31:
+mov esi, dword [ebp - 0x68]
+push eax
+push esi
+push 1
+push dword [ebp + 8]
+call fcn_0000490a  ; call 0x490a
+movzx eax, al
+push eax
+push esi
+push 1
+push dword [ebp + 8]
+call fcn_00004993  ; call 0x4993
+add esp, 0x20
+jmp short loc_00005a78  ; jmp 0x5a78
+
+loc_00005a54:
+cmp byte [ebp - 0x74], 0
+je short loc_00005a78  ; je 0x5a78
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+jne short loc_00005a31  ; jne 0x5a31
+
+loc_00005a78:
+mov eax, dword [ebp - 0x50]
+push esi
+push esi
+push 0x40000000
+add eax, 0xd20
+push eax
+call fcn_00018b14  ; call 0x18b14
+pop edi
+pop eax
+mov eax, dword [ebp - 0x78]
+push 0xfb
+add eax, 0x54
+push eax
+call fcn_0001875d  ; call 0x1875d
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00005abd  ; je 0x5abd
+push ebx
+push ebx
+push ref_0002175c  ; push 0x2175c
+push 2
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00005abd:
+sub esp, 0xc
+mov bl, 1
+push dword [ebp - 0x54]
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_00005aed  ; jne 0x5aed
+call fcn_00015479  ; call 0x15479
+xor ebx, ebx
+test al, al
+je short loc_00005aed  ; je 0x5aed
+push ecx
+push ecx
+push ref_0002176d  ; push 0x2176d
+push 2
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00005aed:
+test byte [ebp - 0x44], bl
+je near loc_00005c12  ; je 0x5c12
+mov edi, dword [ebp - 0x54]
+mov ebx, 0x3e9
+push eax
+push eax
+push 0x100
+mov eax, edi
+add eax, 0x224
+push eax
+call fcn_00018b14  ; call 0x18b14
+pop eax
+mov eax, edi
+pop edx
+add eax, 0xb0
+push 0x10
+push eax
+call fcn_00018730  ; call 0x18730
+mov eax, dword [ebp - 0x40]
+add esp, 0x10
+lea esi, [eax + 0x464]
+
+loc_00005b2f:
+sub esp, 0xc
+push esi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+shr eax, 0x10
+and eax, 0x3f
+cmp eax, 2
+je short loc_00005b5c  ; je 0x5b5c
+dec bx
+je short loc_00005b5c  ; je 0x5b5c
+mov eax, dword [ebp - 0x34]
+push edi
+push 0x64
+push eax
+push dword [ebp + 8]
+call dword [eax + 4]  ; ucall
+add esp, 0x10
+jmp short loc_00005b2f  ; jmp 0x5b2f
+
+loc_00005b5c:
+mov eax, dword [ebp - 0x54]
+push esi
+push 0x20
+push 0xcf
+add eax, 0xc20
+push eax
+call fcn_0001878a  ; call 0x1878a
+mov eax, dword [ebp - 0x58]
+add esp, 0x10
+cmp eax, 0x40660
+je short loc_00005b86  ; je 0x5b86
+cmp eax, 0x306c0
+jne short loc_00005ba9  ; jne 0x5ba9
+
+loc_00005b86:
+mov edi, dword [ebp - 0x68]
+push ebx
+push edi
+push 2
+push dword [ebp + 8]
+call fcn_0000490a  ; call 0x490a
+movzx eax, al
+push eax
+push edi
+push 2
+push dword [ebp + 8]
+call fcn_00004993  ; call 0x4993
+add esp, 0x20
+jmp short loc_00005bcd  ; jmp 0x5bcd
+
+loc_00005ba9:
+cmp byte [ebp - 0x74], 0
+je short loc_00005bcd  ; je 0x5bcd
+push ecx
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+jne short loc_00005b86  ; jne 0x5b86
+
+loc_00005bcd:
+mov eax, dword [ebp - 0x54]
+push edi
+push edi
+push 0x40000000
+add eax, 0xd20
+push eax
+call fcn_00018b14  ; call 0x18b14
+pop eax
+mov eax, dword [ebp - 0x78]
+pop edx
+add eax, 0x54
+push 0xfd
+push eax
+call fcn_0001875d  ; call 0x1875d
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00005c12  ; je 0x5c12
+push esi
+push esi
+push ref_0002176d  ; push 0x2176d
+push 2
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00005c12:
+lea ebx, [ebp - 0x2d]
+
+loc_00005c15:
+movzx eax, byte [ebx + 2]
+sub esp, 0xc
+add ebx, 7
+movzx edi, byte [ebx - 6]
+movzx esi, byte [ebx - 7]
+push eax
+push edi
+push esi
+push dword [ebp - 0x34]
+push dword [ebp + 8]
+mov dword [ebp - 0x48], eax
+call fcn_0000254f  ; call 0x254f
+mov eax, dword [ebp - 0x48]
+add esp, 0x1c
+push eax
+push edi
+push esi
+call fcn_0000241b  ; call 0x241b
+lea eax, [ebp - 0x18]
+add esp, 0x10
+cmp ebx, eax
+jne short loc_00005c15  ; jne 0x5c15
+mov edi, dword [ebp - 0x3c]
+test edi, edi
+je near loc_00005cdf  ; je 0x5cdf
+mov eax, dword [ebp - 0x40]
+sub esp, 0xc
+add eax, 0x11a
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+shr ax, 1
+xor eax, 1
+mov bl, al
+mov eax, dword [ebp - 0x50]
+and ebx, 1
+add eax, 0x11a
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+mov dl, bl
+or edx, 2
+test al, 2
+mov eax, dword [ebp - 0x54]
+cmove ebx, edx
+add eax, 0x11a
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+mov dl, bl
+add esp, 0x10
+or edx, 4
+test al, 2
+cmove ebx, edx
+not ebx
+cmp byte [edi + 0x46], bl
+je short loc_00005cdf  ; je 0x5cdf
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00005cd9  ; je 0x5cd9
+movzx eax, bl
+push eax
+mov eax, dword [ebp - 0x3c]
+movzx eax, byte [eax + 0x46]
+push eax
+push ref_0002177e  ; push 0x2177e
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00005cd9:
+mov eax, dword [ebp - 0x3c]
+mov byte [eax + 0x46], bl
+
+loc_00005cdf:
+mov eax, dword [ebp + 0xc]
+cmp byte [eax], 0xa
+ja short loc_00005d06  ; ja 0x5d06
+
+loc_00005ce7:
+call fcn_00003ba6  ; call 0x3ba6
+movzx eax, byte [ebp - 0x44]
+push ebx
+push eax
+movzx eax, byte [ebp - 0x5a]
+push eax
+movzx eax, byte [ebp - 0x4a]
+push eax
+call fcn_00003cf7  ; call 0x3cf7
+
+loc_00005d01:
+add esp, 0x10
+jmp short loc_00005d48  ; jmp 0x5d48
+
+loc_00005d06:
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 0x5f], 1
+jne short loc_00005ce7  ; jne 0x5ce7
+lea ebx, [ebp - 0x2d]
+
+loc_00005d15:
+push eax
+movzx eax, byte [ebx + 2]
+add ebx, 7
+push eax
+movzx eax, byte [ebx - 6]
+push eax
+movzx eax, byte [ebx - 7]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+push 1
+add eax, 0x25c
+push eax
+call fcn_00018b14  ; call 0x18b14
+lea eax, [ebp - 0x18]
+add esp, 0x10
+cmp ebx, eax
+jne short loc_00005d15  ; jne 0x5d15
+jmp short loc_00005ce7  ; jmp 0x5ce7
+
+loc_00005d48:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00005d50:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov esi, dword [ebp + 0x10]
+mov eax, dword [ebp + 0x14]
+cmp byte [esi + 6], 2
+push 0
+mov edi, eax
+push 0
+push 0
+seta bl
+mov dword [ebp - 0x20], eax
+mov byte [ebp - 0x19], al
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017ed8  ; call 0x17ed8
+add esp, 0x10
+mov dword [ebp - 0x24], eax
+mov eax, edi
+test al, al
+jne short loc_00005ddd  ; jne 0x5ddd
+test bl, bl
+je short loc_00005ddd  ; je 0x5ddd
+xor edi, edi
+
+loc_00005d96:
+push eax
+movzx eax, byte [esi + 2]
+push eax
+movzx eax, byte [esi + 1]
+push eax
+movzx eax, byte [esi]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xd2
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test al, 2
+jne short loc_00005de3  ; jne 0x5de3
+push ecx
+mov eax, dword [ebp + 0xc]
+inc edi
+push 0x3e8
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call dword [eax + 4]  ; ucall
+add esp, 0x10
+cmp edi, 0x64
+jne short loc_00005d96  ; jne 0x5d96
+xor eax, eax
+jmp short loc_00005de5  ; jmp 0x5de5
+
+loc_00005ddd:
+xor eax, eax
+xor edi, edi
+jmp short loc_00005de5  ; jmp 0x5de5
+
+loc_00005de3:
+mov al, 1
+
+loc_00005de5:
+test al, al
+je short loc_00005df5  ; je 0x5df5
+test bl, bl
+je short loc_00005df5  ; je 0x5df5
+
+loc_00005ded:
+mov ebx, dword [ebp - 0x24]
+and ebx, 0xfffffffe
+jmp short loc_00005e1c  ; jmp 0x5e1c
+
+loc_00005df5:
+test bl, bl
+je short loc_00005ded  ; je 0x5ded
+cmp byte [ebp - 0x20], 0
+jne short loc_00005ded  ; jne 0x5ded
+
+loc_00005dff:
+mov eax, 0x80000012
+jmp short loc_00005e7d  ; jmp 0x5e7d
+
+loc_00005e06:
+push eax
+mov eax, dword [ebp + 0xc]
+inc edi
+push 0x3e8
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call dword [eax + 4]  ; ucall
+add esp, 0x10
+
+loc_00005e1c:
+cmp edi, 0x63
+ja short loc_00005dff  ; ja 0x5dff
+cmp byte [ebp - 0x19], 0
+je short loc_00005e4e  ; je 0x5e4e
+push 0
+push 0x13
+push 0x4648080
+push ebx
+call fcn_000041ca  ; call 0x41ca
+movzx ecx, byte [esi + 2]
+add esp, 0x10
+shl ecx, 3
+shr eax, cl
+and eax, 0x3f
+cmp eax, 0x10
+
+loc_00005e48:
+jne short loc_00005e06  ; jne 0x5e06
+xor eax, eax
+jmp short loc_00005e7d  ; jmp 0x5e7d
+
+loc_00005e4e:
+push edx
+movzx eax, byte [esi + 2]
+push eax
+movzx eax, byte [esi + 1]
+push eax
+movzx eax, byte [esi]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x214
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+shr eax, 0x10
+and eax, 0xf
+cmp eax, 7
+jmp short loc_00005e48  ; jmp 0x5e48
+
+loc_00005e7d:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00005e85:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov ebx, dword [ebp + 8]
+push 0
+mov edi, dword [ebp + 0xc]
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov esi, eax
+lea eax, [eax + 2]
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+mov edx, eax
+and eax, 0xfffffffd
+cmp ax, 0x8c44
+je short loc_00005f1c  ; je 0x5f1c
+lea eax, [edx + 0x73b2]
+cmp ax, 2
+jbe short loc_00005f1c  ; jbe 0x5f1c
+lea eax, [edx + 0x73b7]
+cmp ax, 3
+jbe short loc_00005f1c  ; jbe 0x5f1c
+lea eax, [edx + 0x73bf]
+cmp ax, 1
+jbe short loc_00005f1c  ; jbe 0x5f1c
+cmp dx, 0x8c58
+je short loc_00005f1c  ; je 0x5f1c
+mov eax, edx
+and eax, 0xfffffffb
+cmp ax, 0x8c52
+je short loc_00005f1c  ; je 0x5f1c
+mov eax, edx
+and eax, 0xfffffff7
+cmp ax, 0x8c54
+je short loc_00005f1c  ; je 0x5f1c
+lea eax, [edx + 0x63bf]
+cmp ax, 6
+jbe short loc_00005f1c  ; jbe 0x5f1c
+add dx, 0x733f
+cmp dx, 5
+jbe short loc_00005f1c  ; jbe 0x5f1c
+
+loc_00005f12:
+mov eax, 0x80000003
+jmp near loc_0000600e  ; jmp 0x600e
+
+loc_00005f1c:
+sub esp, 0xc
+add esi, 0x48
+push esi
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+and ax, 0xfffc
+mov word [ebp - 0x20], ax
+je short loc_00005f12  ; je 0x5f12
+cmp bl, 0x1f
+jbe short loc_00005f79  ; jbe 0x5f79
+cmp bl, 0x3f
+ja short loc_00005f55  ; ja 0x5f55
+lea ecx, [ebx - 0x20]
+mov esi, 0x30
+mov word [ebp - 0x1c], 0x38
+mov word [ebp - 0x1a], 0x34
+jmp short loc_00005f89  ; jmp 0x5f89
+
+loc_00005f55:
+mov eax, 0x80000002
+cmp bl, 0x5f
+ja near loc_0000600e  ; ja 0x600e
+lea ecx, [ebx - 0x40]
+mov esi, 0x40
+mov word [ebp - 0x1c], 0x48
+mov word [ebp - 0x1a], 0x44
+jmp short loc_00005f89  ; jmp 0x5f89
+
+loc_00005f79:
+mov cl, bl
+xor esi, esi
+mov word [ebp - 0x1c], 0xc
+mov word [ebp - 0x1a], 4
+
+loc_00005f89:
+mov dword [ebp - 0x24], ecx
+and edi, 1
+call fcn_00015479  ; call 0x15479
+mov ecx, dword [ebp - 0x24]
+test al, al
+mov eax, edi
+movzx edi, al
+je short loc_00005fb7  ; je 0x5fb7
+push edi
+movzx ebx, bl
+push ebx
+push ref_000217b5  ; push 0x217b5
+push 0x40
+call fcn_00015487  ; call 0x15487
+mov ecx, dword [ebp - 0x24]
+add esp, 0x10
+
+loc_00005fb7:
+movzx ebx, word [ebp - 0x20]
+mov edx, 1
+push eax
+push eax
+shl edx, cl
+push edx
+add esi, ebx
+push esi
+mov dword [ebp - 0x24], ecx
+mov dword [ebp - 0x20], edx
+call fcn_00018363  ; call 0x18363
+mov edx, dword [ebp - 0x20]
+movzx eax, word [ebp - 0x1a]
+mov esi, edx
+pop edx
+not esi
+pop ecx
+add eax, ebx
+push esi
+push eax
+call fcn_0001838d  ; call 0x1838d
+movzx eax, word [ebp - 0x1c]
+add ebx, eax
+mov dword [esp], ebx
+call fcn_00018f64  ; call 0x18f64
+mov ecx, dword [ebp - 0x24]
+shl edi, cl
+and eax, esi
+pop esi
+or eax, edi
+pop edx
+push eax
+push ebx
+call fcn_00018f97  ; call 0x18f97
+add esp, 0x10
+xor eax, eax
+
+loc_0000600e:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00006016:
+push ebp
+mov ebp, esp
+push ebx
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00006038  ; je 0x6038
+push ecx
+push ecx
+push ref_000217cb  ; push 0x217cb
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00006038:
+cmp byte [ebx], 2
+mov eax, 0x80000003
+jbe short loc_00006065  ; jbe 0x6065
+mov edx, dword [ebx + 0xd]
+mov edx, dword [edx + 0x4c]
+cmp byte [edx], 1
+jne short loc_00006065  ; jne 0x6065
+mov eax, dword [edx + 1]
+push edx
+push edx
+mov dl, byte [eax + 1]
+and edx, 1
+push edx
+movzx eax, byte [eax]
+push eax
+call fcn_00005e85  ; call 0x5e85
+add esp, 0x10
+
+loc_00006065:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000606a:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000608c  ; je 0x608c
+push ecx
+push ecx
+push ref_000217e6  ; push 0x217e6
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000608c:
+cmp byte [ebx], 2
+mov esi, 0x80000003
+jbe short loc_000060bd  ; jbe 0x60bd
+mov eax, dword [ebx + 0xd]
+mov eax, dword [eax + 0x4c]
+cmp byte [eax], 1
+jne short loc_000060bd  ; jne 0x60bd
+mov eax, dword [eax + 1]
+xor esi, esi
+push edx
+push edx
+mov dl, byte [eax + 1]
+not edx
+and edx, 1
+push edx
+movzx eax, byte [eax]
+push eax
+call fcn_00005e85  ; call 0x5e85
+add esp, 0x10
+
+loc_000060bd:
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_000060c6:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov edi, dword [ebp + 8]
+mov ebx, dword [ebp + 0xc]
+mov esi, dword [ebp + 0x10]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000060f2  ; je 0x60f2
+push eax
+push eax
+push ref_00021803  ; push 0x21803
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000060f2:
+xor edx, edx
+
+loc_000060f4:
+push eax
+push edx
+push 1
+push 0
+mov dword [ebp - 0x1c], edx
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+push 0x10
+add eax, 0xb0
+push eax
+call fcn_00018927  ; call 0x18927
+mov edx, dword [ebp - 0x1c]
+add esp, 0x10
+inc edx
+cmp edx, 3
+jne short loc_000060f4  ; jne 0x60f4
+sub esp, 0xc
+push esi
+call fcn_00006016  ; call 0x6016
+add esp, 0x10
+mov edx, eax
+test eax, eax
+js short loc_00006171  ; js 0x6171
+push eax
+push 0x64
+push ebx
+push edi
+call dword [ebx + 4]  ; ucall
+add esp, 0x10
+xor ebx, ebx
+
+loc_0000613c:
+push edi
+push ebx
+inc ebx
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+push 0xffef
+add eax, 0xb0
+push eax
+call fcn_00018954  ; call 0x18954
+add esp, 0x10
+cmp ebx, 3
+jne short loc_0000613c  ; jne 0x613c
+mov dword [ebp + 8], esi
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0000606a  ; jmp 0x606a
+
+loc_00006171:
+xor ebx, ebx
+
+loc_00006173:
+push eax
+push ebx
+inc ebx
+push 1
+push 0
+mov dword [ebp - 0x1c], edx
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+push 0xffef
+add eax, 0xb0
+push eax
+call fcn_00018954  ; call 0x18954
+add esp, 0x10
+cmp ebx, 3
+mov edx, dword [ebp - 0x1c]
+jne short loc_00006173  ; jne 0x6173
+lea esp, [ebp - 0xc]
+mov eax, edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000061a9:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+mov ebx, dword [ebp + 0x10]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000061cb  ; je 0x61cb
+push ecx
+push ecx
+push ref_0002181d  ; push 0x2181d
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000061cb:
+push edx
+movzx eax, byte [ebx + 2]
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+movzx eax, byte [ebx]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+pop ecx
+lea esi, [eax + 0x3e]
+pop eax
+push 0x40
+push esi
+call fcn_00018927  ; call 0x18927
+pop eax
+pop edx
+push 0xffbf
+push esi
+call fcn_00018954  ; call 0x18954
+push 0
+push ebx
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00005d50  ; call 0x5d50
+add esp, 0x20
+mov ebx, eax
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00006226  ; je 0x6226
+push eax
+push eax
+push ref_00021833  ; push 0x21833
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00006226:
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000622f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov esi, dword [ebp + 0x10]
+call fcn_0001c651  ; call 0x1c651
+mov edi, eax
+push eax
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017ed8  ; call 0x17ed8
+add esp, 0x10
+cmp edi, 0x40660
+sete byte [ebp - 0x19]
+cmp edi, 0x306c0
+mov ebx, eax
+sete al
+or byte [ebp - 0x19], al
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000628e  ; je 0x628e
+push eax
+push eax
+push ref_00021843  ; push 0x21843
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000628e:
+cmp edi, 0x40670
+jne short loc_000062bc  ; jne 0x62bc
+push eax
+movzx eax, byte [esi + 2]
+push eax
+movzx eax, byte [esi + 1]
+push eax
+movzx eax, byte [esi]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+push 0x10
+add eax, 0xc24
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+
+loc_000062bc:
+cmp byte [ebp - 0x19], 0
+je near loc_00006357  ; je 0x6357
+push 0
+and ebx, 0xfffffffe
+push 0x13
+push 0x4448080
+push ebx
+call fcn_000041ca  ; call 0x41ca
+and eax, 0xfffffffd
+push eax
+push 0x14
+push 0x4448080
+push ebx
+call fcn_000041ca  ; call 0x41ca
+add esp, 0x20
+push 0
+push 0x13
+push 0x4448080
+push ebx
+call fcn_000041ca  ; call 0x41ca
+or eax, 1
+push eax
+push 0x14
+push 0x4448080
+push ebx
+call fcn_000041ca  ; call 0x41ca
+add esp, 0x20
+push 0
+push 0x13
+push 0x4448080
+push ebx
+call fcn_000041ca  ; call 0x41ca
+or ah, 0x20
+push eax
+push 0x14
+push 0x4448080
+push ebx
+call fcn_000041ca  ; call 0x41ca
+add esp, 0x20
+push 0
+push 0x13
+push 0x4448080
+push ebx
+call fcn_000041ca  ; call 0x41ca
+and eax, 0xfffffffe
+push eax
+push 0x14
+push 0x4448080
+push ebx
+call fcn_000041ca  ; call 0x41ca
+add esp, 0x20
+jmp short loc_000063cf  ; jmp 0x63cf
+
+loc_00006357:
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+push 0xfffffffffffffffd
+add eax, 0x444
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0xc
+push 0
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+pop ebx
+pop edx
+push 1
+add eax, 0x444
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0xc
+push 0
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+pop ecx
+pop ebx
+push 0x2000
+add eax, 0x444
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0xc
+push 0
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+push 0xfffffffffffffffe
+add eax, 0x444
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+
+loc_000063cf:
+movzx eax, byte [ebp - 0x19]
+push eax
+push esi
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00005d50  ; call 0x5d50
+add esp, 0x10
+mov ebx, eax
+cmp edi, 0x40670
+jne short loc_00006413  ; jne 0x6413
+push edx
+movzx eax, byte [esi + 2]
+push eax
+movzx eax, byte [esi + 1]
+push eax
+movzx eax, byte [esi]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+pop ecx
+pop esi
+push 0xffffffffffffffef
+add eax, 0xc24
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+
+loc_00006413:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000642d  ; je 0x642d
+push eax
+push eax
+push ref_00021833  ; push 0x21833
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000642d:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00006437:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 8
+mov ebx, dword [ebp + 0x10]
+movzx eax, byte [ebx + 2]
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+movzx eax, byte [ebx]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+pop ecx
+pop edx
+push 0x20
+add eax, 0xb0
+push eax
+call fcn_00018927  ; call 0x18927
+push 0
+push ebx
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00005d50  ; call 0x5d50
+add esp, 0x20
+mov ebx, eax
+test eax, eax
+jns short loc_00006494  ; jns 0x6494
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00006494  ; je 0x6494
+push eax
+push eax
+push ref_00021855  ; push 0x21855
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00006494:
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000649b:
+push ebp
+mov ebp, esp
+sub esp, 0xc
+mov eax, dword [ebp + 8]
+movzx edx, byte [eax + 2]
+push edx
+movzx edx, byte [eax + 1]
+push edx
+movzx eax, byte [eax]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xb2
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+leave
+shr ax, 4
+and eax, 0x3f
+ret
+
+fcn_000064cd:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov esi, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0x14]
+movzx eax, byte [esi + 2]
+push eax
+movzx eax, byte [esi + 1]
+push eax
+movzx eax, byte [esi]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], esi
+mov edi, eax
+call fcn_0000649b  ; call 0x649b
+add esp, 0x10
+mov dl, al
+cmp al, bl
+jae near loc_000065bf  ; jae 0x65bf
+mov dword [ebp - 0x1c], edx
+call fcn_00015479  ; call 0x15479
+mov edx, dword [ebp - 0x1c]
+test al, al
+je short loc_0000652c  ; je 0x652c
+movzx edx, dl
+movzx eax, bl
+push edx
+push eax
+push ref_0002186d  ; push 0x2186d
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000652c:
+movzx eax, bl
+push ecx
+push eax
+push 0xffffffffffffffe0
+lea edx, [edi + 0x224]
+add edi, 0xb0
+push edx
+mov dword [ebp - 0x1c], edx
+call fcn_00018b68  ; call 0x18b68
+pop eax
+pop edx
+push 0x10
+push edi
+call fcn_00018927  ; call 0x18927
+mov eax, dword [ebp + 0xc]
+add esp, 0xc
+push 1
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call dword [eax + 4]  ; ucall
+pop ecx
+pop eax
+push 0xffef
+push edi
+call fcn_00018954  ; call 0x18954
+push 0
+push esi
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00005d50  ; call 0x5d50
+mov edx, dword [ebp - 0x1c]
+add esp, 0x18
+push 0x1f
+push edx
+mov edi, eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+test edi, edi
+js short loc_000065e4  ; js 0x65e4
+sub esp, 0xc
+push esi
+call fcn_0000649b  ; call 0x649b
+add esp, 0x10
+cmp al, bl
+jne short loc_000065c3  ; jne 0x65c3
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000065bf  ; je 0x65bf
+push edx
+push edx
+push ref_00021891  ; push 0x21891
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000065bf:
+xor ebx, ebx
+jmp short loc_000065e6  ; jmp 0x65e6
+
+loc_000065c3:
+call fcn_00015479  ; call 0x15479
+mov ebx, 0x80000007
+test al, al
+je short loc_000065e6  ; je 0x65e6
+push eax
+push eax
+push ref_000218ac  ; push 0x218ac
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp short loc_000065e6  ; jmp 0x65e6
+
+loc_000065e4:
+mov ebx, edi
+
+loc_000065e6:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000065f0:
+push ebp
+mov ebp, esp
+sub esp, 0xc
+mov eax, dword [ebp + 8]
+movzx edx, byte [eax + 2]
+push edx
+movzx edx, byte [eax + 1]
+push edx
+movzx eax, byte [eax]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xb2
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+leave
+and eax, 0xf
+ret
+
+fcn_0000661e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x2c
+mov eax, dword [ebp + 0x1c]
+mov ebx, dword [ebp + 0xc]
+mov esi, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov dword [ebp - 0x2c], eax
+mov eax, dword [ebp + 0x20]
+mov dword [ebp - 0x30], eax
+call fcn_0001c651  ; call 0x1c651
+mov dword [ebp - 0x1c], eax
+call fcn_0001c678  ; call 0x1c678
+mov dword [ebp - 0x20], eax
+test esi, esi
+je short loc_00006662  ; je 0x6662
+cmp byte [ebx], 1
+jbe short loc_0000665e  ; jbe 0x665e
+mov eax, dword [ebx + 0xd]
+cmp byte [eax + 0x48], 0
+jne short loc_00006662  ; jne 0x6662
+
+loc_0000665e:
+mov byte [esi + 0x71], 1
+
+loc_00006662:
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+push 0x8000
+add eax, 0xdd8
+push eax
+mov dword [ebp - 0x24], eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0xc
+push ebx
+push dword [ebp + 0x14]
+push dword [ebp + 8]
+call fcn_000060c6  ; call 0x60c6
+add esp, 0x10
+mov esi, eax
+test eax, eax
+jns short loc_000066ad  ; jns 0x66ad
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000066c7  ; je 0x66c7
+push eax
+push esi
+push ref_000218c4  ; push 0x218c4
+jmp short loc_000066bd  ; jmp 0x66bd
+
+loc_000066ad:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000066c7  ; je 0x66c7
+push eax
+push eax
+push ref_000218d1  ; push 0x218d1
+
+loc_000066bd:
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000066c7:
+mov al, byte [edi]
+movzx ecx, byte [edi + 2]
+movzx edx, byte [edi + 1]
+mov byte [ebp - 0x25], al
+
+loc_000066d4:
+push ebx
+movzx ebx, byte [ebp - 0x25]
+push ecx
+push edx
+push ebx
+mov dword [ebp - 0x38], ecx
+mov dword [ebp - 0x34], edx
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xd2
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+mov edx, dword [ebp - 0x34]
+mov ecx, dword [ebp - 0x38]
+test al, 2
+je short loc_000066d4  ; je 0x66d4
+sub esp, 0xc
+push ecx
+push edx
+push ebx
+push dword [ebp + 0x14]
+push dword [ebp + 8]
+call fcn_0000254f  ; call 0x254f
+add esp, 0x20
+cmp dword [ebp - 0x20], 0
+je short loc_00006736  ; je 0x6736
+cmp dword [ebp - 0x1c], 0x40670
+jne short loc_00006736  ; jne 0x6736
+push ecx
+push ecx
+push 0xffff7fff
+push dword [ebp - 0x24]
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+
+loc_00006736:
+sub esp, 0xc
+push edi
+call fcn_0000649b  ; call 0x649b
+add esp, 0x10
+cmp al, byte [ebp - 0x30]
+jae short loc_00006769  ; jae 0x6769
+call fcn_00015479  ; call 0x15479
+mov esi, 0x80000012
+test al, al
+je short loc_00006769  ; je 0x6769
+push edx
+push edx
+push ref_000218db  ; push 0x218db
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00006769:
+sub esp, 0xc
+push edi
+call fcn_000065f0  ; call 0x65f0
+add esp, 0x10
+cmp al, byte [ebp - 0x2c]
+jae short loc_0000679c  ; jae 0x679c
+call fcn_00015479  ; call 0x15479
+mov esi, 0x80000012
+test al, al
+je short loc_0000679c  ; je 0x679c
+push eax
+push eax
+push ref_000218f3  ; push 0x218f3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000679c:
+lea esp, [ebp - 0xc]
+mov eax, esi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000067a6:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+xor ebx, ebx
+sub esp, 0x28
+mov esi, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0xc]
+push esi
+mov dword [ebp - 0x1c], eax
+call fcn_000065f0  ; call 0x65f0
+mov edx, edi
+add esp, 0x10
+cmp dl, al
+je short loc_000067e8  ; je 0x67e8
+call fcn_00015479  ; call 0x15479
+mov bl, 1
+test al, al
+je short loc_000067e8  ; je 0x67e8
+push edx
+push edx
+push ref_0002190b  ; push 0x2190b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000067e8:
+sub esp, 0xc
+push esi
+call fcn_0000649b  ; call 0x649b
+add esp, 0x10
+cmp byte [ebp - 0x1c], al
+je short loc_00006815  ; je 0x6815
+call fcn_00015479  ; call 0x15479
+mov bl, 1
+test al, al
+je short loc_00006815  ; je 0x6815
+push eax
+push eax
+push ref_0002192a  ; push 0x2192a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00006815:
+lea esp, [ebp - 0xc]
+mov al, bl
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000681f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+xor esi, esi
+push ebx
+sub esp, 0x28
+mov edi, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0x14]
+push edi
+call fcn_000065f0  ; call 0x65f0
+add esp, 0x10
+mov dl, al
+cmp al, bl
+jae near loc_000068c7  ; jae 0x68c7
+mov dword [ebp - 0x1c], edx
+call fcn_00015479  ; call 0x15479
+mov edx, dword [ebp - 0x1c]
+test al, al
+je short loc_00006869  ; je 0x6869
+movzx edx, dl
+movzx eax, bl
+push edx
+push eax
+push ref_00021949  ; push 0x21949
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00006869:
+push ecx
+push edi
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00006437  ; call 0x6437
+add esp, 0x10
+mov esi, eax
+test eax, eax
+jns short loc_00006886  ; jns 0x6886
+call fcn_00015479  ; call 0x15479
+jmp short loc_000068a0  ; jmp 0x68a0
+
+loc_00006886:
+sub esp, 0xc
+push edi
+call fcn_000065f0  ; call 0x65f0
+add esp, 0x10
+cmp al, bl
+jae short loc_000068ad  ; jae 0x68ad
+call fcn_00015479  ; call 0x15479
+mov esi, 0x80000007
+
+loc_000068a0:
+test al, al
+je short loc_000068c7  ; je 0x68c7
+push edx
+push edx
+push ref_00021973  ; push 0x21973
+jmp short loc_000068bd  ; jmp 0x68bd
+
+loc_000068ad:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000068c7  ; je 0x68c7
+push eax
+push eax
+push ref_00021990  ; push 0x21990
+
+loc_000068bd:
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000068c7:
+lea esp, [ebp - 0xc]
+mov eax, esi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000068d1:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0xc]
+mov esi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0x14]
+mov edi, dword [ebp + 8]
+mov dword [ebp - 0x24], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp - 0x28], eax
+mov eax, dword [ebp + 0x1c]
+mov dword [ebp - 0x1c], eax
+movzx eax, byte [ebp + 0x20]
+push eax
+push esi
+push ebx
+push edi
+mov dword [ebp - 0x20], eax
+call fcn_000064cd  ; call 0x64cd
+add esp, 0x10
+test eax, eax
+movzx eax, byte [ebp - 0x1c]
+mov dword [ebp - 0x1c], eax
+js short loc_00006927  ; js 0x6927
+
+loc_00006913:
+push dword [ebp - 0x1c]
+push esi
+push ebx
+push edi
+call fcn_0000681f  ; call 0x681f
+add esp, 0x10
+test eax, eax
+jns short loc_00006964  ; jns 0x6964
+jmp short loc_00006948  ; jmp 0x6948
+
+loc_00006927:
+push eax
+push dword [ebp - 0x20]
+push dword [ebp - 0x1c]
+push esi
+push ebx
+push dword [ebp - 0x28]
+push dword [ebp - 0x24]
+push edi
+call fcn_0000661e  ; call 0x661e
+add esp, 0x20
+test eax, eax
+jns short loc_00006913  ; jns 0x6913
+jmp near loc_000069cc  ; jmp 0x69cc
+
+loc_00006948:
+push ecx
+push dword [ebp - 0x20]
+push dword [ebp - 0x1c]
+push esi
+push ebx
+push dword [ebp - 0x28]
+push dword [ebp - 0x24]
+push edi
+call fcn_0000661e  ; call 0x661e
+add esp, 0x20
+test eax, eax
+js short loc_000069cc  ; js 0x69cc
+
+loc_00006964:
+push 0
+push esi
+push ebx
+push edi
+call fcn_00005d50  ; call 0x5d50
+add esp, 0x10
+test eax, eax
+jns short loc_000069cc  ; jns 0x69cc
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000698f  ; je 0x698f
+push edx
+push edx
+push ref_000219b0  ; push 0x219b0
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000698f:
+push eax
+push esi
+push ebx
+push edi
+call fcn_00006437  ; call 0x6437
+add esp, 0x10
+test eax, eax
+jns short loc_000069cc  ; jns 0x69cc
+mov eax, dword [ebp - 0x20]
+mov dword [ebp + 0x18], esi
+mov dword [ebp + 0x14], ebx
+mov dword [ebp + 8], edi
+mov dword [ebp + 0x20], eax
+mov eax, dword [ebp - 0x1c]
+mov dword [ebp + 0x1c], eax
+mov eax, dword [ebp - 0x28]
+mov dword [ebp + 0x10], eax
+mov eax, dword [ebp - 0x24]
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0000661e  ; jmp 0x661e
+
+loc_000069cc:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000069d4:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x14
+lea eax, [ebp - 0xc]
+push eax
+push 0
+push 0
+push ref_0002913c  ; push 0x2913c
+call fcn_0001975d  ; call 0x1975d
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00006a34  ; je 0x6a34
+test ebx, ebx
+jns short loc_00006a34  ; jns 0x6a34
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00006a1c  ; je 0x6a1c
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00006a1c:
+push ecx
+push ref_000206f4  ; push 0x206f4
+push 0x2de
+push ref_000219ce  ; push 0x219ce
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00006a34:
+mov eax, dword [ebp - 0xc]
+push edx
+push edx
+push 1
+push eax
+call dword [eax]  ; ucall
+add esp, 0x10
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00006a46:
+push ebp
+mov eax, 1
+mov ebp, esp
+mov edx, dword [ebp + 8]
+cmp byte [edx], 2
+jbe short loc_00006a68  ; jbe 0x6a68
+mov eax, dword [edx + 0xd]
+mov edx, 1
+mov ax, word [eax + 0x50]
+test ax, ax
+cmove eax, edx
+
+loc_00006a68:
+pop ebp
+ret
+
+fcn_00006a6a:
+push ebp
+mov eax, 2
+mov ebp, esp
+mov edx, dword [ebp + 8]
+cmp byte [edx], 0x12
+jbe short loc_00006a8c  ; jbe 0x6a8c
+mov eax, dword [edx + 0xd]
+mov edx, 2
+mov ax, word [eax + 0x67]
+test ax, ax
+cmove eax, edx
+
+loc_00006a8c:
+pop ebp
+ret
+
+fcn_00006a8e:
+push ebp
+mov eax, 0x2710
+mov ebp, esp
+mov edx, dword [ebp + 8]
+cmp byte [edx], 0x12
+jbe short loc_00006ab0  ; jbe 0x6ab0
+mov eax, dword [edx + 0xd]
+mov edx, 0x2710
+mov ax, word [eax + 0x65]
+test ax, ax
+cmove eax, edx
+
+loc_00006ab0:
+pop ebp
+ret
+
+fcn_00006ab2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x30
+push 0
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov esi, eax
+lea eax, [eax + 0x504]
+add esi, 0xd0c
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [esp], esi
+mov ebx, eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0xc
+push 0
+push 0
+push 1
+shr ebx, 0x10
+shr eax, 0x14
+and eax, 1
+mov byte [ebp - 0x2b], al
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0x10
+mov dword [ebp - 0x34], eax
+and ebx, 3
+je short loc_00006b1f  ; je 0x6b1f
+cmp ebx, 2
+jne short loc_00006b32  ; jne 0x6b32
+mov byte [ebp - 0x1e], 8
+mov esi, 2
+mov byte [ebp - 0x1d], 8
+jmp short loc_00006b3b  ; jmp 0x6b3b
+
+loc_00006b1f:
+mov byte [ebp - 0x1e], 8
+mov esi, 3
+mov byte [ebp - 0x1d], 4
+mov byte [ebp - 0x1c], 4
+jmp short loc_00006b3b  ; jmp 0x6b3b
+
+loc_00006b32:
+mov byte [ebp - 0x1e], 0x10
+mov esi, 1
+
+loc_00006b3b:
+mov eax, dword [ebp + 0xc]
+xor ebx, ebx
+mov byte [eax], 0
+
+loc_00006b43:
+cmp byte [ebp + ebx - 0x1e], 0
+je short loc_00006b76  ; je 0x6b76
+push eax
+push ebx
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_00006b76  ; je 0x6b76
+mov eax, dword [ebp + 0xc]
+mov dl, byte [eax]
+movzx eax, dl
+inc edx
+mov byte [ebp + eax - 0x1b], bl
+mov eax, dword [ebp + 0xc]
+mov byte [eax], dl
+
+loc_00006b76:
+inc ebx
+mov eax, esi
+cmp al, bl
+ja short loc_00006b43  ; ja 0x6b43
+mov eax, dword [ebp + 0xc]
+cmp byte [eax], 3
+jbe short loc_00006baa  ; jbe 0x6baa
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00006ba4  ; je 0x6ba4
+push eax
+push dword [ebp + 0xc]
+push ref_00021a0c  ; push 0x21a0c
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00006ba4:
+mov eax, dword [ebp + 0xc]
+mov byte [eax], 3
+
+loc_00006baa:
+mov eax, dword [ebp + 0x10]
+mov byte [ebp - 0x2a], 0
+mov byte [eax], 0
+mov al, byte [ebp - 0x2b]
+neg eax
+mov byte [ebp - 0x29], al
+mov eax, dword [ebp - 0x34]
+and byte [ebp - 0x29], 0xf
+add eax, 0xc
+mov dword [ebp - 0x38], eax
+
+loc_00006bc9:
+mov edi, dword [ebp + 0xc]
+mov al, byte [ebp - 0x2a]
+cmp al, byte [edi]
+jae near loc_00006e4c  ; jae 0x6e4c
+movzx ebx, byte [ebp - 0x2a]
+movzx eax, byte [ebp + ebx - 0x1b]
+shl ebx, 5
+add ebx, dword [ebp + 8]
+mov edi, eax
+mov byte [ebx + 2], al
+mov byte [ebx + 3], al
+mov byte [ebx + 0x1d], 1
+mov byte [ebx + 0x1e], 0
+mov byte [ebx + 0x1f], 0
+mov byte [ebx], 0
+mov byte [ebx + 1], 1
+mov byte [ebx + 6], 0
+push eax
+push edi
+push 1
+push 0
+call fcn_0000241b  ; call 0x241b
+mov dword [esp], ebx
+call fcn_0000649b  ; call 0x649b
+add esp, 0x10
+xor edx, edx
+xor ecx, ecx
+mov byte [ebp - 0x2c], al
+mov byte [ebx + 0x1c], al
+
+loc_00006c25:
+mov byte [ebp - 0x30], dl
+cmp dl, byte [ebp - 0x2c]
+jae short loc_00006c64  ; jae 0x6c64
+mov eax, dword [ebp + 0x10]
+cmp byte [eax], 0
+je short loc_00006c40  ; je 0x6c40
+cmp byte [ebp - 0x30], 1
+ja short loc_00006c40  ; ja 0x6c40
+dec byte [ebx + 0x1c]
+jmp short loc_00006c61  ; jmp 0x6c61
+
+loc_00006c40:
+cmp cl, 0xf
+ja short loc_00006c60  ; ja 0x6c60
+cmp byte [ebp - 0x2b], 0
+movzx esi, cl
+jne short loc_00006c56  ; jne 0x6c56
+mov al, byte [ebp - 0x30]
+add al, byte [ebp - 0x29]
+jmp short loc_00006c5c  ; jmp 0x6c5c
+
+loc_00006c56:
+mov al, byte [ebp - 0x29]
+sub eax, dword [ebp - 0x30]
+
+loc_00006c5c:
+mov byte [ebx + esi + 0xc], al
+
+loc_00006c60:
+inc ecx
+
+loc_00006c61:
+inc edx
+jmp short loc_00006c25  ; jmp 0x6c25
+
+loc_00006c64:
+cmp byte [ebx + 0x1c], 0x10
+jbe short loc_00006c8f  ; jbe 0x6c8f
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00006c8b  ; je 0x6c8b
+push eax
+movzx eax, byte [ebx + 0x1c]
+push eax
+push ref_00021a53  ; push 0x21a53
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00006c8b:
+mov byte [ebx + 0x1c], 0x10
+
+loc_00006c8f:
+push eax
+push edi
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov esi, eax
+lea eax, [eax + 0xac]
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov edx, eax
+and edx, 0xf
+cmp edx, 3
+mov dword [ebp - 0x30], edx
+je short loc_00006ce7  ; je 0x6ce7
+call fcn_00015479  ; call 0x15479
+mov edx, dword [ebp - 0x30]
+test al, al
+je short loc_00006cde  ; je 0x6cde
+push edx
+push edi
+push 1
+push 0
+push edi
+push 1
+push ref_00021a89  ; push 0x21a89
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_00006cde:
+mov byte [ebx + 0xb], 0
+jmp near loc_00006e2c  ; jmp 0x6e2c
+
+loc_00006ce7:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00006d08  ; je 0x6d08
+push eax
+push edi
+push 1
+push 0
+push edi
+push 1
+push ref_00021ad4  ; push 0x21ad4
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_00006d08:
+push ecx
+push 0x10100
+push 0xff0000ff
+lea eax, [esi + 0x18]
+add esi, 0x11a
+push eax
+mov dword [ebp - 0x30], eax
+call fcn_00018b68  ; call 0x18b68
+pop eax
+pop edx
+push 0
+push dword [ebp - 0x34]
+call fcn_00017e04  ; call 0x17e04
+pop ecx
+push dword [ebp - 0x34]
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [ebx + 7], eax
+mov dword [esp], esi
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test al, 2
+je short loc_00006d85  ; je 0x6d85
+mov byte [ebx + 0xb], 0
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00006d72  ; je 0x6d72
+push 3
+push edi
+push 1
+push 0
+push edi
+push 1
+push ref_00021b06  ; push 0x21b06
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_00006d72:
+push edx
+push edi
+push 1
+push 0
+call fcn_0000241b  ; call 0x241b
+add esp, 0x10
+jmp near loc_00006e1a  ; jmp 0x6e1a
+
+loc_00006d85:
+push 0x10
+push 0
+push 0
+push 1
+call fcn_00002862  ; call 0x2862
+add esp, 0x10
+test eax, eax
+jne short loc_00006db7  ; jne 0x6db7
+mov byte [ebx + 0xb], 0
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00006e1a  ; je 0x6e1a
+push 3
+push edi
+push 1
+push 0
+push edi
+push 1
+push ref_00021b4c  ; push 0x21b4c
+jmp short loc_00006e10  ; jmp 0x6e10
+
+loc_00006db7:
+add eax, dword [ebp - 0x38]
+sub esp, 0xc
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov dl, al
+and eax, 0xf
+and edx, 0xf
+mov esi, eax
+mov byte [ebx + 6], dl
+cmp eax, 2
+ja short loc_00006df5  ; ja 0x6df5
+mov byte [ebx + 0xb], 0
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00006e1a  ; je 0x6e1a
+push esi
+push edi
+push 1
+push 0
+push edi
+push 1
+push ref_00021b9b  ; push 0x21b9b
+jmp short loc_00006e10  ; jmp 0x6e10
+
+loc_00006df5:
+mov byte [ebx + 0xb], 1
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00006e1a  ; je 0x6e1a
+push esi
+push edi
+push 1
+push 0
+push edi
+push 1
+push ref_00021be5  ; push 0x21be5
+
+loc_00006e10:
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_00006e1a:
+push eax
+push eax
+push 0xff0000ff
+push dword [ebp - 0x30]
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+
+loc_00006e2c:
+mov al, byte [ebp + edi - 0x1e]
+mov cl, byte [ebp - 0x29]
+lea edx, [ecx + eax]
+sub ecx, eax
+cmp byte [ebp - 0x2b], 0
+mov al, cl
+cmovne edx, eax
+mov byte [ebp - 0x29], dl
+inc byte [ebp - 0x2a]
+jmp near loc_00006bc9  ; jmp 0x6bc9
+
+loc_00006e4c:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00006e54:
+push ebp
+mov ebp, esp
+mov edx, dword [ebp + 8]
+cmp byte [ebp + 0xc], 0
+mov al, dl
+je short loc_00006e66  ; je 0x6e66
+mov al, 0xf
+sub eax, edx
+
+loc_00006e66:
+pop ebp
+ret
+
+fcn_00006e68:
+push ebp
+mov ebp, esp
+sub esp, 0xc
+push dword [ebp + 0x14]
+mov eax, dword [ebp + 0x10]
+push eax
+push dword [ebp + 8]
+call dword [eax + 4]  ; ucall
+pop eax
+mov eax, dword [ebp + 0x1c]
+pop edx
+movzx eax, byte [eax + 2]
+push eax
+push dword [ebp + 0x18]
+call fcn_00007c07  ; call 0x7c07
+sub eax, dword [ebp + 0x20]
+leave
+ret
+
+fcn_00006e92:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x5c
+mov al, byte [ebp + 0x24]
+push dword [ebp + 0xc]
+mov edi, dword [ebp + 0x28]
+mov bl, byte [ebp + 0x30]
+mov byte [ebp - 0x53], al
+mov al, byte [ebp + 0x2c]
+mov byte [ebp - 0x52], al
+call fcn_00006a6a  ; call 0x6a6a
+push esi
+push esi
+push 1
+mov esi, eax
+call fcn_0000968c  ; call 0x968c
+add esp, 0x10
+test eax, eax
+js near loc_000070f3  ; js 0x70f3
+mov eax, dword [ebp + 0x20]
+mov dword [ebp - 0x4c], eax
+movzx eax, si
+mov dword [ebp - 0x58], eax
+movzx eax, bl
+mov dword [ebp - 0x50], eax
+
+loc_00006edd:
+mov al, byte [ebp - 0x4c]
+sub eax, dword [ebp + 0x20]
+cmp al, byte [ebp - 0x53]
+jae near loc_000070e6  ; jae 0x70e6
+push ecx
+push ecx
+lea eax, [ebp - 0x39]
+push eax
+mov eax, dword [ebp - 0x4c]
+movzx ebx, byte [eax]
+push ebx
+call fcn_0000996b  ; call 0x996b
+mov eax, dword [ebp + 0x34]
+add esp, 0x10
+mov byte [ebp - 0x51], 0
+lea eax, [eax + ebx*4]
+xor ebx, ebx
+mov dword [ebp - 0x60], eax
+
+loc_00006f10:
+test bl, bl
+jne near loc_000070de  ; jne 0x70de
+cmp byte [ebp - 0x51], 2
+ja near loc_000070de  ; ja 0x70de
+push eax
+push eax
+movzx eax, byte [edi + 2]
+push eax
+push dword [ebp + 0x1c]
+call fcn_00007c07  ; call 0x7c07
+mov esi, eax
+pop eax
+pop edx
+lea eax, [ebp - 0x39]
+push eax
+push 5
+call fcn_00009a23  ; call 0x9a23
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00006f87  ; je 0x6f87
+test ebx, ebx
+jns short loc_00006f87  ; jns 0x6f87
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00006f6f  ; je 0x6f6f
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00006f6f:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x350
+push ref_00021c15  ; push 0x21c15
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00006f87:
+push ebx
+push esi
+push edi
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00006e68  ; call 0x6e68
+add esp, 0x20
+cmp eax, dword [ebp - 0x58]
+jb short loc_00006fad  ; jb 0x6fad
+
+loc_00006fa6:
+xor ebx, ebx
+jmp near loc_0000706f  ; jmp 0x706f
+
+loc_00006fad:
+movzx ebx, byte [ebp - 0x52]
+push ecx
+push dword [ebp - 0x50]
+push ebx
+push edi
+call fcn_000067a6  ; call 0x67a6
+add esp, 0x10
+test al, al
+jne short loc_00006fa6  ; jne 0x6fa6
+push eax
+push eax
+movzx eax, byte [edi + 2]
+push eax
+push dword [ebp + 0x1c]
+call fcn_00007c07  ; call 0x7c07
+mov dword [ebp - 0x5c], eax
+pop eax
+pop edx
+lea eax, [ebp - 0x39]
+push eax
+push 0xfffffffffffffffa
+call fcn_00009a23  ; call 0x9a23
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00007029  ; je 0x7029
+test esi, esi
+jns short loc_00007029  ; jns 0x7029
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00007011  ; je 0x7011
+push eax
+push esi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00007011:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x35f
+push ref_00021c15  ; push 0x21c15
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00007029:
+push esi
+push dword [ebp - 0x5c]
+push edi
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00006e68  ; call 0x6e68
+add esp, 0x20
+cmp eax, dword [ebp - 0x58]
+jae near loc_00006fa6  ; jae 0x6fa6
+push ecx
+push dword [ebp - 0x50]
+push ebx
+push edi
+call fcn_000067a6  ; call 0x67a6
+add esp, 0x10
+test al, al
+jne near loc_00006fa6  ; jne 0x6fa6
+mov eax, dword [ebp - 0x60]
+mov bl, 1
+mov dword [eax], 0xbb8
+
+loc_0000706f:
+sub esp, 0xc
+lea eax, [ebp - 0x39]
+push eax
+call fcn_00009a00  ; call 0x9a00
+movzx eax, byte [ebp - 0x52]
+add esp, 0x10
+mov byte [ebp - 0x5c], 3
+mov dword [ebp - 0x64], eax
+
+loc_00007089:
+push edx
+push dword [ebp - 0x50]
+push dword [ebp - 0x64]
+push edi
+push dword [ebp + 0x14]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_000068d1  ; call 0x68d1
+add esp, 0x20
+mov esi, eax
+test eax, eax
+jns short loc_000070d6  ; jns 0x70d6
+push eax
+mov eax, dword [ebp + 0x14]
+push 0x2710
+push dword [ebp + 0x14]
+push dword [ebp + 8]
+call dword [eax + 4]  ; ucall
+add esp, 0x10
+dec byte [ebp - 0x5c]
+jne short loc_00007089  ; jne 0x7089
+sub esp, 0xc
+push 0
+call fcn_0000968c  ; call 0x968c
+add esp, 0x10
+mov eax, esi
+jmp short loc_000070f3  ; jmp 0x70f3
+
+loc_000070d6:
+inc byte [ebp - 0x51]
+jmp near loc_00006f10  ; jmp 0x6f10
+
+loc_000070de:
+inc dword [ebp - 0x4c]
+jmp near loc_00006edd  ; jmp 0x6edd
+
+loc_000070e6:
+sub esp, 0xc
+push 0
+call fcn_0000968c  ; call 0x968c
+add esp, 0x10
+
+loc_000070f3:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000070fb:
+push ebp
+mov ebp, esp
+mov ecx, dword [ebp + 8]
+mov edx, dword [ebp + 0xc]
+push ebx
+mov ebx, ecx
+mov eax, edx
+sub ebx, edx
+sub eax, ecx
+cmp ecx, edx
+cmovge eax, ebx
+pop ebx
+pop ebp
+ret
+
+fcn_00007115:
+push ebp
+xor eax, eax
+mov ebp, esp
+mov ecx, dword [ebp + 8]
+push esi
+push ebx
+test ecx, ecx
+je short loc_0000715e  ; je 0x715e
+xor ebx, ebx
+mov esi, 0xa9e
+
+loc_0000712a:
+cmp ecx, 0x10f
+jbe short loc_00007143  ; jbe 0x7143
+imul eax, ecx, 0x3e8
+xor edx, edx
+add ebx, 0x64
+div esi
+mov ecx, eax
+jmp short loc_0000712a  ; jmp 0x712a
+
+loc_00007143:
+imul eax, ecx, 0xfffffff0
+xor edx, edx
+add eax, 0x2d3a
+imul eax, ecx
+mov ecx, 0x2710
+sub eax, 0xeefac
+div ecx
+add eax, ebx
+
+loc_0000715e:
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00007162:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+mov ebx, 0x9c40
+push eax
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x14]
+cmp eax, 0x9c40
+cmova eax, ebx
+imul eax, eax, 0x64
+push eax
+call fcn_00007115  ; call 0x7115
+cmp esi, 0x9c40
+cmova esi, ebx
+imul esi, esi, 0x64
+mov dword [ebp - 0x10], eax
+mov dword [esp], esi
+call fcn_00007115  ; call 0x7115
+cmp dword [ebp + 0x10], 0x9c40
+cmovbe ebx, dword [ebp + 0x10]
+imul ebx, ebx, 0x64
+mov esi, eax
+mov dword [esp], ebx
+call fcn_00007115  ; call 0x7115
+test edi, edi
+pop edx
+mov edx, dword [ebp - 0x10]
+mov ebx, eax
+js short loc_000071e6  ; js 0x71e6
+cmp esi, eax
+lea ecx, [edi - 1]
+jne short loc_000071cd  ; jne 0x71cd
+imul eax, ecx, 0x64
+jmp short loc_000071dd  ; jmp 0x71dd
+
+loc_000071cd:
+sub edx, eax
+sub esi, ebx
+imul eax, edx, 0x64
+xor edx, edx
+imul ecx, ecx, 0x64
+div esi
+add eax, ecx
+
+loc_000071dd:
+xor ecx, ecx
+test eax, eax
+cmovns ecx, eax
+jmp short loc_0000720c  ; jmp 0x720c
+
+loc_000071e6:
+cmp esi, eax
+lea ecx, [edi + 1]
+jne short loc_000071f2  ; jne 0x71f2
+imul ecx, ecx, 0x64
+jmp short loc_0000720c  ; jmp 0x720c
+
+loc_000071f2:
+sub edx, eax
+sub esi, ebx
+imul eax, edx, 0x64
+xor edx, edx
+imul ecx, ecx, 0x64
+div esi
+sub ecx, eax
+mov eax, 0
+test ecx, ecx
+cmovg ecx, eax
+
+loc_0000720c:
+lea esp, [ebp - 0xc]
+mov eax, ecx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00007216:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x4c
+mov al, byte [ebp + 0x24]
+push dword [ebp + 0xc]
+movzx ebx, byte [ebp + 0x30]
+mov byte [ebp - 0x42], al
+mov al, byte [ebp + 0x2c]
+mov byte [ebp - 0x2c], al
+mov al, byte [ebp + 0x34]
+mov byte [ebp - 0x41], al
+call fcn_00006a46  ; call 0x6a46
+mov ecx, dword [ebp + 0x20]
+pop edi
+mov dword [ebp - 0x40], ebx
+mov dword [ebp - 0x38], ecx
+movzx eax, ax
+mov dword [ebp - 0x34], eax
+
+loc_0000724d:
+mov bl, byte [ebp - 0x38]
+sub ebx, dword [ebp + 0x20]
+cmp bl, byte [ebp - 0x42]
+jae near loc_00007694  ; jae 0x7694
+mov eax, dword [ebp - 0x38]
+mov ecx, dword [ebp + 0x38]
+cmp byte [ebp - 0x41], 0
+movzx eax, byte [eax]
+mov byte [ebp - 0x19], al
+mov dword [ecx + eax*4], 0
+je short loc_00007297  ; je 0x7297
+mov esi, dword [ebp + 0xc]
+push edx
+push edx
+mov edx, dword [esi + 1]
+push dword [edx + 4]
+push eax
+call fcn_00009584  ; call 0x9584
+movzx eax, byte [ebp - 0x19]
+pop ecx
+pop esi
+push 1
+push eax
+call fcn_00009521  ; call 0x9521
+add esp, 0x10
+
+loc_00007297:
+test bl, bl
+je short loc_000072b8  ; je 0x72b8
+mov eax, dword [ebp - 0x38]
+xor esi, esi
+mov ecx, dword [ebp + 0x38]
+movzx eax, byte [eax - 1]
+mov eax, dword [ecx + eax*4]
+mov ecx, 0x64
+cdq
+idiv ecx
+dec eax
+cmovns esi, eax
+jmp short loc_000072ba  ; jmp 0x72ba
+
+loc_000072b8:
+xor esi, esi
+
+loc_000072ba:
+mov byte [ebp - 0x2b], 0
+mov byte [ebp - 0x29], 1
+mov dword [ebp - 0x3c], 0xffffffff
+mov byte [ebp - 0x2a], 0
+
+loc_000072cd:
+cmp byte [ebp - 0x2b], 0x1d
+ja near loc_00007620  ; ja 0x7620
+cmp byte [ebp - 0x2a], 1
+ja near loc_00007620  ; ja 0x7620
+push eax
+push eax
+mov eax, dword [ebp + 0x28]
+inc byte [ebp - 0x2b]
+movzx eax, byte [eax + 2]
+push eax
+push dword [ebp + 0x1c]
+call fcn_00007c07  ; call 0x7c07
+add esp, 0xc
+mov edi, eax
+mov eax, esi
+movzx eax, al
+push eax
+push 1
+lea eax, [ebp - 0x19]
+push eax
+call fcn_00009c03  ; call 0x9c03
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00007353  ; je 0x7353
+test ebx, ebx
+jns short loc_00007353  ; jns 0x7353
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000733b  ; je 0x733b
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000733b:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x1f0
+push ref_00021c15  ; push 0x21c15
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00007353:
+push eax
+push edi
+push dword [ebp + 0x28]
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00006e68  ; call 0x6e68
+add esp, 0x20
+mov edi, eax
+cmp eax, dword [ebp - 0x34]
+jb short loc_0000738c  ; jb 0x738c
+test esi, esi
+jne short loc_00007392  ; jne 0x7392
+movzx eax, byte [ebp - 0x19]
+mov bl, 1
+mov ecx, dword [ebp + 0x38]
+mov dword [ecx + eax*4], 0
+jmp short loc_00007398  ; jmp 0x7398
+
+loc_0000738c:
+mov byte [ebp - 0x29], 1
+jmp short loc_00007396  ; jmp 0x7396
+
+loc_00007392:
+mov byte [ebp - 0x29], 0xff
+
+loc_00007396:
+xor ebx, ebx
+
+loc_00007398:
+mov al, byte [ebp - 0x29]
+add eax, esi
+mov byte [ebp - 0x30], al
+movzx eax, byte [ebp - 0x2c]
+mov dword [ebp - 0x4c], eax
+
+loc_000073a7:
+test bl, 1
+jne near loc_000074fc  ; jne 0x74fc
+cmp byte [ebp - 0x30], 0x18
+ja near loc_000074fc  ; ja 0x74fc
+push ebx
+push dword [ebp - 0x40]
+push dword [ebp - 0x4c]
+push dword [ebp + 0x28]
+call fcn_000067a6  ; call 0x67a6
+add esp, 0x10
+mov bl, al
+test al, al
+je short loc_00007408  ; je 0x7408
+cmp byte [ebp - 0x29], 0xff
+je near loc_0000751b  ; je 0x751b
+cmp byte [ebp - 0x30], 0
+movzx eax, byte [ebp - 0x19]
+jne short loc_000073f5  ; jne 0x73f5
+mov esi, dword [ebp + 0x38]
+mov dword [esi + eax*4], 0
+jmp near loc_0000752a  ; jmp 0x752a
+
+loc_000073f5:
+movsx edx, byte [ebp - 0x30]
+mov esi, dword [ebp + 0x38]
+dec edx
+imul edx, edx, 0x64
+mov dword [esi + eax*4], edx
+jmp near loc_0000752a  ; jmp 0x752a
+
+loc_00007408:
+mov eax, dword [ebp + 0x28]
+push ecx
+push ecx
+movzx eax, byte [eax + 2]
+push eax
+push dword [ebp + 0x1c]
+call fcn_00007c07  ; call 0x7c07
+add esp, 0xc
+mov dword [ebp - 0x48], eax
+movzx eax, byte [ebp - 0x30]
+push eax
+push 1
+lea eax, [ebp - 0x19]
+push eax
+call fcn_00009c03  ; call 0x9c03
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00007477  ; je 0x7477
+test esi, esi
+jns short loc_00007477  ; jns 0x7477
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000745f  ; je 0x745f
+push edx
+push esi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000745f:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x21b
+push ref_00021c15  ; push 0x21c15
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00007477:
+push eax
+push dword [ebp - 0x48]
+push dword [ebp + 0x28]
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00006e68  ; call 0x6e68
+add esp, 0x20
+cmp byte [ebp - 0x29], 0xff
+mov esi, eax
+jne short loc_000074c2  ; jne 0x74c2
+cmp eax, dword [ebp - 0x34]
+jae short loc_000074ef  ; jae 0x74ef
+movzx eax, byte [ebp - 0x19]
+mov ecx, dword [ebp + 0x38]
+lea ebx, [ecx + eax*4]
+movsx eax, byte [ebp - 0x30]
+push eax
+push esi
+push edi
+push dword [ebp - 0x34]
+call fcn_00007162  ; call 0x7162
+add esp, 0x10
+mov dword [ebx], eax
+jmp short loc_00007541  ; jmp 0x7541
+
+loc_000074c2:
+cmp eax, dword [ebp - 0x34]
+jb short loc_000074ef  ; jb 0x74ef
+movzx eax, byte [ebp - 0x19]
+mov edx, dword [ebp + 0x38]
+lea edx, [edx + eax*4]
+movsx eax, byte [ebp - 0x30]
+mov dword [ebp - 0x48], edx
+push eax
+push edi
+mov edi, esi
+push esi
+push dword [ebp - 0x34]
+call fcn_00007162  ; call 0x7162
+mov edx, dword [ebp - 0x48]
+add esp, 0x10
+mov dword [edx], eax
+jmp short loc_0000752a  ; jmp 0x752a
+
+loc_000074ef:
+mov al, byte [ebp - 0x29]
+mov edi, esi
+add byte [ebp - 0x30], al
+jmp near loc_000073a7  ; jmp 0x73a7
+
+loc_000074fc:
+cmp byte [ebp - 0x29], 0xff
+jne short loc_0000752a  ; jne 0x752a
+cmp edi, dword [ebp - 0x34]
+jb short loc_00007541  ; jb 0x7541
+test bl, bl
+jne short loc_00007541  ; jne 0x7541
+movzx eax, byte [ebp - 0x19]
+mov esi, dword [ebp + 0x38]
+mov dword [esi + eax*4], 0
+jmp short loc_00007541  ; jmp 0x7541
+
+loc_0000751b:
+mov byte [ebp - 0x29], 1
+mov dword [ebp - 0x3c], 0xffffffff
+mov byte [ebp - 0x2a], 0
+
+loc_0000752a:
+cmp edi, dword [ebp - 0x34]
+jae short loc_00007541  ; jae 0x7541
+test bl, bl
+jne short loc_00007541  ; jne 0x7541
+movzx eax, byte [ebp - 0x19]
+mov ecx, dword [ebp + 0x38]
+mov dword [ecx + eax*4], 0x9c4
+
+loc_00007541:
+movzx eax, byte [ebp - 0x19]
+mov ecx, 0x64
+xor esi, esi
+mov edx, dword [ebp + 0x38]
+mov edi, dword [edx + eax*4]
+mov eax, edi
+cdq
+idiv ecx
+mov ecx, dword [ebp - 0x3c]
+mov dword [ebp - 0x30], edi
+dec eax
+cmovns esi, eax
+cmp ecx, 0xffffffff
+je short loc_00007584  ; je 0x7584
+mov edx, ecx
+mov eax, edi
+sub eax, ecx
+sub edx, edi
+cmp ecx, edi
+cmovge eax, edx
+mov dl, byte [ebp - 0x2a]
+xor ecx, ecx
+inc edx
+cmp eax, 0x64
+mov al, cl
+cmovle eax, edx
+mov byte [ebp - 0x2a], al
+
+loc_00007584:
+movzx ebx, byte [ebp - 0x2c]
+push eax
+push dword [ebp - 0x40]
+push ebx
+push dword [ebp + 0x28]
+call fcn_000067a6  ; call 0x67a6
+add esp, 0x10
+test al, al
+je short loc_000075f1  ; je 0x75f1
+push eax
+push 0
+push 1
+lea eax, [ebp - 0x19]
+push eax
+call fcn_00009c03  ; call 0x9c03
+mov edi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_000075f1  ; je 0x75f1
+test edi, edi
+jns short loc_000075f1  ; jns 0x75f1
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000075d9  ; je 0x75d9
+push eax
+push edi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000075d9:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x252
+push ref_00021c15  ; push 0x21c15
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000075f1:
+push edi
+push dword [ebp - 0x40]
+push ebx
+push dword [ebp + 0x28]
+push dword [ebp + 0x14]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_000068d1  ; call 0x68d1
+add esp, 0x20
+test eax, eax
+js near loc_00007696  ; js 0x7696
+mov eax, dword [ebp - 0x30]
+mov dword [ebp - 0x3c], eax
+jmp near loc_000072cd  ; jmp 0x72cd
+
+loc_00007620:
+push ebx
+push 0
+push 1
+lea eax, [ebp - 0x19]
+push eax
+call fcn_00009c03  ; call 0x9c03
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00007675  ; je 0x7675
+test ebx, ebx
+jns short loc_00007675  ; jns 0x7675
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000765d  ; je 0x765d
+push ecx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000765d:
+push edx
+push ref_000206f4  ; push 0x206f4
+push 0x262
+push ref_00021c15  ; push 0x21c15
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00007675:
+cmp byte [ebp - 0x41], 0
+je short loc_0000768c  ; je 0x768c
+push eax
+push eax
+movzx eax, byte [ebp - 0x19]
+push 0
+push eax
+call fcn_00009521  ; call 0x9521
+add esp, 0x10
+
+loc_0000768c:
+inc dword [ebp - 0x38]
+jmp near loc_0000724d  ; jmp 0x724d
+
+loc_00007694:
+xor eax, eax
+
+loc_00007696:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000769e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x3c
+mov eax, dword [ebp + 0x24]
+push dword [ebp + 0xc]
+mov edi, dword [ebp + 0x28]
+mov dword [ebp - 0x3c], eax
+mov bl, al
+mov al, byte [ebp + 0x2c]
+mov byte [ebp - 0x1c], al
+mov al, byte [ebp + 0x30]
+mov byte [ebp - 0x31], al
+call fcn_00006a46  ; call 0x6a46
+movzx ecx, bl
+pop edx
+mov byte [ebp - 0x1b], 0
+mov byte [ebp - 0x19], 1
+mov dword [ebp - 0x2c], 0xffffffff
+mov dword [ebp - 0x20], 0
+movzx eax, ax
+mov byte [ebp - 0x1a], 0
+mov dword [ebp - 0x30], ecx
+mov dword [ebp - 0x24], eax
+
+loc_000076ed:
+cmp byte [ebp - 0x1b], 0x1d
+ja near loc_00007a4d  ; ja 0x7a4d
+cmp byte [ebp - 0x1a], 1
+ja near loc_00007a4d  ; ja 0x7a4d
+push eax
+push eax
+movzx eax, byte [edi + 2]
+inc byte [ebp - 0x1b]
+push eax
+push dword [ebp + 0x1c]
+call fcn_00007c07  ; call 0x7c07
+add esp, 0xc
+mov esi, eax
+movzx eax, byte [ebp - 0x20]
+push eax
+push dword [ebp - 0x30]
+push dword [ebp + 0x20]
+call fcn_00009c03  ; call 0x9c03
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000776f  ; je 0x776f
+test ebx, ebx
+jns short loc_0000776f  ; jns 0x776f
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00007757  ; je 0x7757
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00007757:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x29f
+push ref_00021c15  ; push 0x21c15
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000776f:
+push eax
+push esi
+push edi
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00006e68  ; call 0x6e68
+mov ecx, dword [ebp - 0x24]
+add esp, 0x20
+mov dword [ebp - 0x28], eax
+cmp eax, ecx
+jb short loc_000077ab  ; jb 0x77ab
+cmp dword [ebp - 0x20], 0
+jne short loc_000077b1  ; jne 0x77b1
+movzx eax, byte [edi + 2]
+mov bl, 1
+mov ecx, dword [ebp + 0x34]
+mov dword [ecx + eax*4], 0
+jmp short loc_000077b7  ; jmp 0x77b7
+
+loc_000077ab:
+mov byte [ebp - 0x19], 1
+jmp short loc_000077b5  ; jmp 0x77b5
+
+loc_000077b1:
+mov byte [ebp - 0x19], 0xff
+
+loc_000077b5:
+xor ebx, ebx
+
+loc_000077b7:
+mov al, byte [ebp - 0x20]
+add al, byte [ebp - 0x19]
+mov byte [ebp - 0x20], al
+movzx eax, byte [ebp - 0x31]
+mov dword [ebp - 0x40], eax
+movzx eax, byte [ebp - 0x1c]
+mov dword [ebp - 0x44], eax
+
+loc_000077ce:
+test bl, 1
+jne near loc_00007921  ; jne 0x7921
+cmp byte [ebp - 0x20], 0x18
+ja near loc_00007921  ; ja 0x7921
+push eax
+push dword [ebp - 0x40]
+push dword [ebp - 0x44]
+push edi
+call fcn_000067a6  ; call 0x67a6
+add esp, 0x10
+test al, al
+mov bl, al
+movzx eax, byte [edi + 2]
+je short loc_0000782d  ; je 0x782d
+cmp byte [ebp - 0x19], 0
+js near loc_00007943  ; js 0x7943
+cmp byte [ebp - 0x20], 0
+jne short loc_0000781a  ; jne 0x781a
+mov ecx, dword [ebp + 0x34]
+mov dword [ecx + eax*4], 0
+jmp near loc_00007952  ; jmp 0x7952
+
+loc_0000781a:
+movsx edx, byte [ebp - 0x20]
+mov ecx, dword [ebp + 0x34]
+dec edx
+imul edx, edx, 0x64
+mov dword [ecx + eax*4], edx
+jmp near loc_00007952  ; jmp 0x7952
+
+loc_0000782d:
+push esi
+push esi
+push eax
+push dword [ebp + 0x1c]
+call fcn_00007c07  ; call 0x7c07
+add esp, 0xc
+mov dword [ebp - 0x38], eax
+movzx eax, byte [ebp - 0x20]
+push eax
+push dword [ebp - 0x30]
+push dword [ebp + 0x20]
+call fcn_00009c03  ; call 0x9c03
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00007895  ; je 0x7895
+test esi, esi
+jns short loc_00007895  ; jns 0x7895
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000787d  ; je 0x787d
+push ecx
+push esi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000787d:
+push edx
+push ref_000206f4  ; push 0x206f4
+push 0x2ca
+push ref_00021c15  ; push 0x21c15
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00007895:
+push eax
+push dword [ebp - 0x38]
+push edi
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00006e68  ; call 0x6e68
+add esp, 0x20
+cmp byte [ebp - 0x19], 0
+mov esi, eax
+jns short loc_000078e3  ; jns 0x78e3
+cmp eax, dword [ebp - 0x24]
+jae short loc_00007913  ; jae 0x7913
+movzx eax, byte [edi + 2]
+mov ebx, dword [ebp + 0x34]
+lea ebx, [ebx + eax*4]
+movsx eax, byte [ebp - 0x20]
+push eax
+push esi
+push dword [ebp - 0x28]
+push dword [ebp - 0x24]
+call fcn_00007162  ; call 0x7162
+add esp, 0x10
+mov dword [ebx], eax
+jmp near loc_0000796c  ; jmp 0x796c
+
+loc_000078e3:
+cmp eax, dword [ebp - 0x24]
+jb short loc_00007913  ; jb 0x7913
+movzx eax, byte [edi + 2]
+mov edx, dword [ebp + 0x34]
+lea edx, [edx + eax*4]
+movsx eax, byte [ebp - 0x20]
+mov dword [ebp - 0x38], edx
+push eax
+push dword [ebp - 0x28]
+push esi
+push dword [ebp - 0x24]
+call fcn_00007162  ; call 0x7162
+mov edx, dword [ebp - 0x38]
+add esp, 0x10
+mov dword [ebp - 0x28], esi
+mov dword [edx], eax
+jmp short loc_00007952  ; jmp 0x7952
+
+loc_00007913:
+mov al, byte [ebp - 0x19]
+add byte [ebp - 0x20], al
+mov dword [ebp - 0x28], esi
+jmp near loc_000077ce  ; jmp 0x77ce
+
+loc_00007921:
+cmp byte [ebp - 0x19], 0
+jns short loc_00007952  ; jns 0x7952
+mov eax, dword [ebp - 0x24]
+cmp dword [ebp - 0x28], eax
+jb short loc_0000796c  ; jb 0x796c
+test bl, bl
+jne short loc_0000796c  ; jne 0x796c
+movzx eax, byte [edi + 2]
+mov ebx, dword [ebp + 0x34]
+mov dword [ebx + eax*4], 0
+jmp short loc_0000796c  ; jmp 0x796c
+
+loc_00007943:
+mov byte [ebp - 0x19], 1
+mov dword [ebp - 0x2c], 0xffffffff
+mov byte [ebp - 0x1a], 0
+
+loc_00007952:
+mov eax, dword [ebp - 0x24]
+cmp dword [ebp - 0x28], eax
+jae short loc_0000796c  ; jae 0x796c
+test bl, bl
+jne short loc_0000796c  ; jne 0x796c
+movzx eax, byte [edi + 2]
+mov ebx, dword [ebp + 0x34]
+mov dword [ebx + eax*4], 0x9c4
+
+loc_0000796c:
+movzx eax, byte [edi + 2]
+mov ecx, dword [ebp + 0x34]
+mov esi, dword [ecx + eax*4]
+mov ecx, 0x64
+mov eax, esi
+cdq
+idiv ecx
+xor edx, edx
+mov dword [ebp - 0x28], esi
+dec eax
+mov ecx, eax
+cmovs ecx, edx
+mov dword [ebp - 0x20], ecx
+mov ecx, dword [ebp - 0x2c]
+cmp ecx, 0xffffffff
+je short loc_000079b4  ; je 0x79b4
+mov edx, ecx
+mov eax, esi
+sub eax, ecx
+sub edx, esi
+cmp ecx, esi
+cmovge eax, edx
+mov dl, byte [ebp - 0x1a]
+xor ecx, ecx
+inc edx
+cmp eax, 0x64
+mov al, cl
+cmovle eax, edx
+mov byte [ebp - 0x1a], al
+
+loc_000079b4:
+movzx esi, byte [ebp - 0x31]
+movzx ebx, byte [ebp - 0x1c]
+push eax
+push esi
+push ebx
+push edi
+call fcn_000067a6  ; call 0x67a6
+add esp, 0x10
+test al, al
+je short loc_00007a26  ; je 0x7a26
+push eax
+push 0
+push dword [ebp - 0x30]
+push dword [ebp + 0x20]
+call fcn_00009c03  ; call 0x9c03
+mov dword [ebp - 0x2c], eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00007a26  ; je 0x7a26
+cmp dword [ebp - 0x2c], 0
+jns short loc_00007a26  ; jns 0x7a26
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00007a0e  ; je 0x7a0e
+push eax
+push dword [ebp - 0x2c]
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00007a0e:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x301
+push ref_00021c15  ; push 0x21c15
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00007a26:
+push eax
+push esi
+push ebx
+push edi
+push dword [ebp + 0x14]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_000068d1  ; call 0x68d1
+add esp, 0x20
+test eax, eax
+js short loc_00007aaa  ; js 0x7aaa
+mov eax, dword [ebp - 0x28]
+mov dword [ebp - 0x2c], eax
+jmp near loc_000076ed  ; jmp 0x76ed
+
+loc_00007a4d:
+movzx eax, byte [ebp - 0x3c]
+push ecx
+push 0
+push eax
+push dword [ebp + 0x20]
+call fcn_00009c03  ; call 0x9c03
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+xor edx, edx
+test al, al
+je short loc_00007aac  ; je 0x7aac
+test ebx, ebx
+jns short loc_00007aac  ; jns 0x7aac
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00007a8e  ; je 0x7a8e
+push edx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00007a8e:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x311
+push ref_00021c15  ; push 0x21c15
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+xor edx, edx
+jmp short loc_00007aac  ; jmp 0x7aac
+
+loc_00007aaa:
+mov edx, eax
+
+loc_00007aac:
+lea esp, [ebp - 0xc]
+mov eax, edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00007ab6:
+push ebp
+xor eax, eax
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov edx, dword [ebp + 0x20]
+mov ecx, dword [ebp + 0x24]
+
+loc_00007ac7:
+mov edi, dword [ebp + 0x2c]
+mov dword [edi + eax], 0xffffffff
+add eax, 4
+cmp eax, 0x40
+jne short loc_00007ac7  ; jne 0x7ac7
+movzx eax, cl
+xor edi, edi
+shl eax, 5
+lea eax, [edx + eax + 0xc]
+lea esi, [edx + 0xc]
+mov dword [ebp - 0x20], eax
+
+loc_00007aeb:
+cmp esi, dword [ebp - 0x20]
+je near loc_00007bfd  ; je 0x7bfd
+mov al, byte [esi + 0x10]
+cmp byte [esi + 0x11], 0
+mov byte [ebp - 0x19], al
+je near loc_00007bf5  ; je 0x7bf5
+cmp byte [esi + 0x12], 1
+je near loc_00007bf5  ; je 0x7bf5
+cmp byte [esi - 1], 0
+mov cl, 3
+lea ebx, [esi - 0xc]
+jne short loc_00007b27  ; jne 0x7b27
+sub esp, 0xc
+push ebx
+call fcn_000065f0  ; call 0x65f0
+add esp, 0x10
+mov cl, al
+
+loc_00007b27:
+sub esp, 0xc
+push ebx
+mov dword [ebp - 0x24], ecx
+call fcn_0000649b  ; call 0x649b
+add esp, 0x10
+mov ecx, dword [ebp - 0x24]
+cmp dword [ebp + 0x28], 1
+je short loc_00007bab  ; je 0x7bab
+jb short loc_00007b76  ; jb 0x7b76
+cmp dword [ebp + 0x28], 2
+jne near loc_00007bdb  ; jne 0x7bdb
+push dword [ebp + 0x2c]
+movzx eax, al
+movzx ecx, cl
+push eax
+push ecx
+push ebx
+movzx ebx, byte [ebp - 0x19]
+push ebx
+push esi
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00006e92  ; call 0x6e92
+jmp short loc_00007bd4  ; jmp 0x7bd4
+
+loc_00007b76:
+sub esp, 0xc
+movzx eax, al
+push dword [ebp + 0x2c]
+movzx ecx, cl
+push 0
+push eax
+push ecx
+push ebx
+movzx ebx, byte [ebp - 0x19]
+push ebx
+push esi
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00007216  ; call 0x7216
+add esp, 0x40
+mov edi, eax
+jmp short loc_00007bf5  ; jmp 0x7bf5
+
+loc_00007bab:
+push dword [ebp + 0x2c]
+movzx eax, al
+movzx ecx, cl
+push eax
+push ecx
+push ebx
+movzx ebx, byte [ebp - 0x19]
+push ebx
+push esi
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_0000769e  ; call 0x769e
+
+loc_00007bd4:
+mov edi, eax
+add esp, 0x30
+jmp short loc_00007bf5  ; jmp 0x7bf5
+
+loc_00007bdb:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00007bf5  ; je 0x7bf5
+push eax
+push eax
+push ref_00021c47  ; push 0x21c47
+push 2
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00007bf5:
+add esi, 0x20
+jmp near loc_00007aeb  ; jmp 0x7aeb
+
+loc_00007bfd:
+lea esp, [ebp - 0xc]
+mov eax, edi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00007c07:
+push ebp
+mov ebp, esp
+movzx eax, byte [ebp + 0xc]
+mov edx, dword [ebp + 8]
+shl eax, 4
+lea eax, [edx + eax + 0xc]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00017e4e  ; jmp 0x17e4e
+
+fcn_00007c21:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov eax, dword [ebp + 0xc]
+push 0
+mov ebx, dword [ebp + 8]
+push 1
+push 0
+mov dword [ebp - 0x20], eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 1
+push 1
+push 0
+mov esi, eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 2
+push 1
+push 0
+mov edi, eax
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [ebp - 0x1c], eax
+pop eax
+pop edx
+lea eax, [ebx + 0x6430]
+push 3
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [ebx + 0x6434]
+add ebx, 0x6438
+push 0x76543210
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+pop edx
+lea eax, [esi + 0x630]
+push 0xb
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [esi + 0x600]
+add esi, 0x604
+push 0x60b
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+pop edx
+push 0x76543980
+push esi
+call fcn_00017e8f  ; call 0x17e8f
+lea eax, [edi + 0x600]
+add edi, 0x604
+pop ecx
+pop esi
+push 0x60b
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+pop edx
+push 0x76543280
+push edi
+call fcn_00017e8f  ; call 0x17e8f
+mov edi, dword [ebp - 0x1c]
+pop ecx
+pop esi
+mov eax, edi
+push 0xb
+add eax, 0x600
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+mov eax, edi
+pop edx
+add eax, 0x604
+push 0x76543210
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop ecx
+pop esi
+push 0x680000
+push ebx
+call fcn_00017e8f  ; call 0x17e8f
+mov eax, dword [ebp - 0x20]
+add esp, 0x10
+mov dword [ebp + 0xc], 0xa
+add eax, 0xa04
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f  ; jmp 0x17e8f
+
+fcn_00007d3c:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov eax, dword [ebp + 0xc]
+push 0
+mov ebx, dword [ebp + 8]
+push 1
+push 0
+mov dword [ebp - 0x20], eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 1
+push 1
+push 0
+mov esi, eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 2
+push 1
+push 0
+mov edi, eax
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [ebp - 0x1c], eax
+pop eax
+pop edx
+lea eax, [ebx + 0x6430]
+push 0
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [ebx + 0x6434]
+add ebx, 0x6438
+push 0
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+pop edx
+lea eax, [esi + 0x630]
+push 0
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [esi + 0x600]
+add esi, 0x604
+push 0
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+pop edx
+push 0
+push esi
+call fcn_00017e8f  ; call 0x17e8f
+lea eax, [edi + 0x600]
+add edi, 0x604
+pop ecx
+pop esi
+push 0
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+pop edx
+push 0
+push edi
+call fcn_00017e8f  ; call 0x17e8f
+mov edi, dword [ebp - 0x1c]
+pop ecx
+pop esi
+mov eax, edi
+push 0
+add eax, 0x600
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+mov eax, edi
+pop edx
+add eax, 0x604
+push 0
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop ecx
+pop esi
+push 0
+push ebx
+call fcn_00017e8f  ; call 0x17e8f
+mov eax, dword [ebp - 0x20]
+add esp, 0x10
+mov dword [ebp + 0xc], 0
+add eax, 0xa04
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f  ; jmp 0x17e8f
+
+fcn_00007e42:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 8
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x60
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+pop edx
+pop ecx
+push 0x4000
+mov ebx, eax
+and ebx, 0xfffffff8
+lea eax, [ebx + 0x54]
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0xc
+push 0
+push 0xfed85000
+lea eax, [ebx + 0x38010]
+add ebx, 0x38004
+push eax
+call fcn_00017f28  ; call 0x17f28
+pop eax
+pop edx
+push 2
+push ebx
+call fcn_00018927  ; call 0x18927
+mov eax, 0xfed85000
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00007ea4:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 8
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x60
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+pop edx
+pop ecx
+push 0xfffd
+mov ebx, eax
+and ebx, 0xfffffff8
+lea eax, [ebx + 0x38004]
+push eax
+call fcn_00018954  ; call 0x18954
+add esp, 0xc
+push 0
+push 0xfff
+lea eax, [ebx + 0x38010]
+add ebx, 0x54
+push eax
+call fcn_00018d02  ; call 0x18d02
+pop eax
+pop edx
+push 0xffffbfff
+push ebx
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00007f07:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 8]
+push 0x40000
+push ebx
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+pop edx
+lea eax, [ebx + 4]
+push 0
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [ebx + 0x10]
+push 0x40000
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+pop edx
+lea eax, [ebx + 0x14]
+push 0
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [ebx + 0x20]
+push 0x40000
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+pop edx
+lea eax, [ebx + 0x24]
+push 0
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [ebx + 8]
+push 0xff000000
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+pop edx
+lea eax, [ebx + 0x18]
+push 0xff000000
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [ebx + 0x28]
+push 0xff000000
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+pop edx
+lea eax, [ebx + 0xc]
+push 0
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [ebx + 0x1c]
+add ebx, 0x2c
+push 0
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+pop edx
+push 0
+push ebx
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00007fc2:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 8]
+push dword [ebp + 0xc]
+call fcn_00007f07  ; call 0x7f07
+call fcn_00007ea4  ; call 0x7ea4
+mov eax, dword [ebx + 1]
+add esp, 0x10
+mov ebx, dword [ebp - 4]
+mov edx, dword [eax + 0x18]
+mov dword [ebp + 0xc], edx
+mov eax, dword [eax + 4]
+mov dword [ebp + 8], eax
+leave
+jmp near fcn_00007d3c  ; jmp 0x7d3c
+
+fcn_00007ff4:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x14
+mov ebx, dword [ebp + 8]
+push 0xa100
+mov esi, dword [ebp + 0x10]
+mov edi, dword [ebp + 0xc]
+lea eax, [ebx + 4]
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+pop edx
+lea eax, [ebx + 0x14]
+push 0xa101
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [ebx + 0x24]
+push 0xa102
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+pop edx
+push 0x110000
+push ebx
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0xc
+push 0x3e8
+push esi
+push edi
+call dword [esi + 4]  ; ucall
+pop ecx
+pop esi
+push 0x22100
+push ebx
+call fcn_00017e8f  ; call 0x17e8f
+pop edi
+pop eax
+lea eax, [ebx + 0x10]
+add ebx, 0x20
+push 0x22101
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], 0x22102
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f  ; jmp 0x17e8f
+
+fcn_00008087:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 1]
+push dword [eax + 0x18]
+push dword [eax + 4]
+call fcn_00007c21  ; call 0x7c21
+call fcn_00007e42  ; call 0x7e42
+mov ebx, eax
+mov dword [esp], eax
+call fcn_00007f07  ; call 0x7f07
+add esp, 0xc
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+push ebx
+call fcn_00007ff4  ; call 0x7ff4
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000080c4:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+push ebx
+call fcn_00007f07  ; call 0x7f07
+add esp, 0x10
+mov dword [ebp + 0x10], edi
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], ebx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00007ff4  ; jmp 0x7ff4
+
+fcn_000080f4:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x14]
+mov dword [ebp - 0x1c], eax
+cmp bl, 0xf
+ja near loc_00008247  ; ja 0x8247
+mov esi, eax
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00008131  ; je 0x8131
+push eax
+movzx eax, bl
+push eax
+push ref_00021c67  ; push 0x21c67
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00008131:
+mov eax, dword [ebp + 8]
+mov al, byte [eax + 0x1d]
+test al, al
+je near loc_000081c9  ; je 0x81c9
+mov edx, dword [ebp + 8]
+cmp byte [edx + 0x1f], 0
+je short loc_00008190  ; je 0x8190
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00008166  ; je 0x8166
+push eax
+movzx eax, byte [ebp - 0x1c]
+push eax
+push ref_00021c7d  ; push 0x21c7d
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00008166:
+test edi, edi
+je near loc_00008233  ; je 0x8233
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00008188  ; je 0x8188
+push eax
+push eax
+push ref_00021caa  ; push 0x21caa
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00008188:
+movzx ebx, bl
+mov al, byte [ebp - 0x1c]
+jmp short loc_000081c3  ; jmp 0x81c3
+
+loc_00008190:
+test edi, edi
+je short loc_000081c9  ; je 0x81c9
+mov eax, dword [ebp + 0x10]
+movzx ebx, bl
+mov eax, dword [eax + 0xd]
+movzx esi, byte [eax + ebx + 0x19]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000081c1  ; je 0x81c1
+push eax
+mov eax, esi
+movzx eax, al
+push eax
+push ref_00021c90  ; push 0x21c90
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000081c1:
+mov eax, esi
+
+loc_000081c3:
+mov byte [edi + ebx + 0x35], al
+jmp short loc_00008233  ; jmp 0x8233
+
+loc_000081c9:
+mov ecx, dword [ebp + 8]
+cmp byte [ecx + 0x1f], 0
+jne short loc_000081ff  ; jne 0x81ff
+test edi, edi
+jne near loc_0000826e  ; jne 0x826e
+mov eax, dword [ebp + 0x10]
+movzx ebx, bl
+mov eax, dword [eax + 0xd]
+movzx esi, byte [eax + ebx + 0x19]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00008233  ; je 0x8233
+mov eax, esi
+movzx eax, al
+push ebx
+push eax
+push ref_00021cc8  ; push 0x21cc8
+jmp short loc_00008229  ; jmp 0x8229
+
+loc_000081ff:
+mov esi, 7
+test al, al
+jne short loc_00008233  ; jne 0x8233
+test edi, edi
+je short loc_00008233  ; je 0x8233
+
+loc_0000820c:
+movzx ebx, bl
+movzx esi, byte [edi + ebx + 0x35]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00008233  ; je 0x8233
+mov eax, esi
+movzx eax, al
+push ecx
+push eax
+push ref_00021ce3  ; push 0x21ce3
+
+loc_00008229:
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00008233:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00008279  ; je 0x8279
+push edx
+push edx
+push ref_00021f21  ; push 0x21f21
+push 0x40
+jmp short loc_00008264  ; jmp 0x8264
+
+loc_00008247:
+call fcn_00015479  ; call 0x15479
+mov esi, 7
+test al, al
+je short loc_00008279  ; je 0x8279
+movzx ebx, bl
+push eax
+push ebx
+push ref_00021d01  ; push 0x21d01
+push 0x80000000
+
+loc_00008264:
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp short loc_00008279  ; jmp 0x8279
+
+loc_0000826e:
+mov esi, 7
+test al, al
+jne short loc_00008233  ; jne 0x8233
+jmp short loc_0000820c  ; jmp 0x820c
+
+loc_00008279:
+lea esp, [ebp - 0xc]
+mov eax, esi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00008283:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov ecx, dword [eax + 0xd]
+xor eax, eax
+
+loc_0000828e:
+movzx edx, byte [ecx + eax + 5]
+cmp edx, 3
+je short loc_000082a6  ; je 0x82a6
+test edx, edx
+je short loc_000082a6  ; je 0x82a6
+inc eax
+cmp eax, 3
+jne short loc_0000828e  ; jne 0x828e
+xor eax, eax
+jmp short loc_000082a8  ; jmp 0x82a8
+
+loc_000082a6:
+mov al, 1
+
+loc_000082a8:
+pop ebp
+ret
+
+fcn_000082aa:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+cmp byte [eax], 0x12
+jbe short loc_000082c2  ; jbe 0x82c2
+mov eax, dword [eax + 0xd]
+mov al, byte [eax + 0x64]
+cmp al, 1
+jbe short loc_000082dd  ; jbe 0x82dd
+
+loc_000082c2:
+call fcn_0001c651  ; call 0x1c651
+cmp eax, 0x40660
+je short loc_000082d9  ; je 0x82d9
+cmp eax, 0x306c0
+
+loc_000082d3:
+je short loc_000082d9  ; je 0x82d9
+mov al, 1
+jmp short loc_000082e1  ; jmp 0x82e1
+
+loc_000082d9:
+xor eax, eax
+jmp short loc_000082e1  ; jmp 0x82e1
+
+loc_000082dd:
+test al, al
+jmp short loc_000082d3  ; jmp 0x82d3
+
+loc_000082e1:
+leave
+ret
+
+fcn_000082e3:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x41c
+call fcn_0001c651  ; call 0x1c651
+mov dword [ebp - 0x3ec], eax
+call fcn_0001c678  ; call 0x1c678
+push ebx
+push 0
+push 1
+push 0
+mov dword [ebp - 0x3f4], eax
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [ebp - 0x3f8], eax
+add eax, 0xd0c
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov byte [ebp - 0x3ee], 3
+mov ebx, eax
+mov eax, dword [ebp + 0xc]
+cmp byte [eax], 0x12
+jbe short loc_00008351  ; jbe 0x8351
+mov eax, dword [eax + 0xd]
+mov edi, 3
+cmp byte [eax + 0x69], 1
+mov al, 0xa
+cmove edi, eax
+mov eax, edi
+mov byte [ebp - 0x3ee], al
+
+loc_00008351:
+mov byte [ebp - 0x2a2], 7
+xor eax, eax
+mov byte [ebp - 0x261], 3
+mov byte [ebp - 0x220], 5
+mov byte [ebp - 0x1df], 8
+mov byte [ebp - 0x19e], 0
+mov byte [ebp - 0x15d], 1
+mov byte [ebp - 0x11c], 2
+mov byte [ebp - 0xdb], 6
+mov byte [ebp - 0x9a], 9
+mov byte [ebp - 0x59], 4
+
+loc_00008396:
+mov dword [ebp + eax*4 - 0x3c4], 0xffffffff
+mov dword [ebp + eax*4 - 0x384], 0xffffffff
+mov byte [ebp + eax - 0x3d4], 7
+inc eax
+cmp eax, 0x10
+jne short loc_00008396  ; jne 0x8396
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000083d4  ; je 0x83d4
+push ecx
+push ecx
+push ref_00021d12  ; push 0x21d12
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000083d4:
+sub esp, 0xc
+push dword [ebp + 0xc]
+call fcn_00008283  ; call 0x8283
+add esp, 0x10
+test al, al
+jne short loc_000083ff  ; jne 0x83ff
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_00009375  ; je 0x9375
+push edx
+push edx
+push ref_00021d2a  ; push 0x21d2a
+jmp near loc_00008e4c  ; jmp 0x8e4c
+
+loc_000083ff:
+shr ebx, 0x14
+sub esp, 0xc
+mov al, bl
+and eax, 1
+mov byte [ebp - 0x3ed], al
+mov bl, al
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+mov ax, word [eax + 0x3c]
+push dword [ebp + 0xc]
+mov word [ebp - 0x404], ax
+call fcn_00006a8e  ; call 0x6a8e
+add esp, 0x10
+mov word [ebp - 0x40c], ax
+test bl, bl
+jne short loc_0000844b  ; jne 0x844b
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00008465  ; je 0x8465
+push eax
+push eax
+push ref_00021d47  ; push 0x21d47
+jmp short loc_0000845b  ; jmp 0x845b
+
+loc_0000844b:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00008465  ; je 0x8465
+push eax
+push eax
+push ref_00021d62  ; push 0x21d62
+
+loc_0000845b:
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00008465:
+cmp dword [ebp + 0x14], 0
+mov byte [ebp - 0x3d9], 0
+je near loc_00008577  ; je 0x8577
+mov eax, dword [ebp + 0x14]
+cmp byte [eax + 0x28], 0
+je near loc_00008577  ; je 0x8577
+lea eax, [ebp - 0x3d8]
+push eax
+push 0
+push 0
+push ref_000291fc  ; push 0x291fc
+call fcn_0001975d  ; call 0x1975d
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_000084df  ; je 0x84df
+test ebx, ebx
+jns short loc_000084df  ; jns 0x84df
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000084c7  ; je 0x84c7
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000084c7:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0xd6
+push ref_00021d7c  ; push 0x21d7c
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000084df:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000084f9  ; je 0x84f9
+push eax
+push eax
+push ref_00021db4  ; push 0x21db4
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000084f9:
+push eax
+lea eax, [ebp - 0x3d9]
+push eax
+mov eax, dword [ebp - 0x3d8]
+push 0
+push dword [ebp + 8]
+call dword [eax + 5]  ; ucall
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00008556  ; je 0x8556
+test ebx, ebx
+jns short loc_00008556  ; jns 0x8556
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000853e  ; je 0x853e
+push edi
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000853e:
+push esi
+push ref_000206f4  ; push 0x206f4
+push 0xd9
+push ref_00021d7c  ; push 0x21d7c
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00008556:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00008577  ; je 0x8577
+movzx eax, byte [ebp - 0x3d9]
+push ebx
+push eax
+push ref_00021dd1  ; push 0x21dd1
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00008577:
+lea eax, [ebp - 0x3df]
+xor ebx, ebx
+push ecx
+push eax
+lea eax, [ebp - 0x3de]
+push eax
+lea eax, [ebp - 0x302]
+push eax
+call fcn_00006ab2  ; call 0x6ab2
+add esp, 0x10
+
+loc_00008597:
+cmp bl, byte [ebp - 0x3de]
+jae near loc_0000862d  ; jae 0x862d
+movzx eax, bl
+shl eax, 5
+lea esi, [ebp + eax - 0x302]
+movzx eax, byte [ebp + eax - 0x302]
+push edx
+movzx edx, byte [esi + 2]
+push edx
+movzx edx, byte [esi + 1]
+push edx
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xb2
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+and eax, 0xf
+cmp ax, 3
+je short loc_000085e8  ; je 0x85e8
+cmp byte [esi + 0xb], 0
+jne short loc_000085eb  ; jne 0x85eb
+
+loc_000085e8:
+inc ebx
+jmp short loc_00008597  ; jmp 0x8597
+
+loc_000085eb:
+mov eax, dword [ebp - 0x3f8]
+push ebx
+push ebx
+push 0x8000
+lea esi, [eax + 0xdd8]
+push esi
+call fcn_00018b14  ; call 0x18b14
+add esp, 0xc
+push dword [ebp + 0xc]
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+call fcn_000060c6  ; call 0x60c6
+add esp, 0x10
+test eax, eax
+jns near loc_00008e80  ; jns 0x8e80
+
+loc_00008620:
+cmp dword [ebp - 0x3f4], 0
+jne near loc_00008e5b  ; jne 0x8e5b
+
+loc_0000862d:
+mov byte [ebp - 0x3f4], 0
+mov byte [ebp - 0x3ec], 0
+
+loc_0000863b:
+mov cl, byte [ebp - 0x3de]
+cmp byte [ebp - 0x3ec], cl
+jae near loc_00008786  ; jae 0x8786
+movzx ebx, byte [ebp - 0x3ec]
+mov edx, ebx
+shl edx, 5
+mov cl, byte [ebp + edx - 0x302]
+lea eax, [ebp + edx - 0x302]
+cmp dword [ebp + 0x14], 0
+mov byte [ebp - 0x3fc], cl
+mov cl, byte [eax + 1]
+mov byte [ebp - 0x400], cl
+mov cl, byte [eax + 2]
+mov byte [ebp - 0x408], cl
+movzx edx, cl
+je short loc_000086ab  ; je 0x86ab
+mov esi, dword [ebp + 0x14]
+cmp byte [esi + 0x28], 0
+je near loc_00008f06  ; je 0x8f06
+mov eax, dword [eax + 7]
+mov edi, 1
+cmp dword [esi + edx*4 + 0x29], eax
+jne near loc_00008f08  ; jne 0x8f08
+xor esi, esi
+jmp short loc_000086b2  ; jmp 0x86b2
+
+loc_000086ab:
+mov esi, 1
+xor edi, edi
+
+loc_000086b2:
+mov dword [ebp - 0x410], edx
+call fcn_00015479  ; call 0x15479
+mov edx, dword [ebp - 0x410]
+test al, al
+je short loc_000086f8  ; je 0x86f8
+mov ecx, esi
+sub esp, 0xc
+movzx eax, byte [ebp - 0x400]
+movzx ecx, cl
+push ecx
+mov ecx, edi
+movzx ecx, cl
+push ecx
+movzx ecx, byte [ebp - 0x3fc]
+push edx
+push eax
+push ecx
+push edx
+push eax
+push ref_00021df9  ; push 0x21df9
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x30
+
+loc_000086f8:
+push eax
+movzx eax, byte [ebp - 0x408]
+push eax
+movzx eax, byte [ebp - 0x400]
+push eax
+movzx eax, byte [ebp - 0x3fc]
+push eax
+call fcn_0000241b  ; call 0x241b
+mov eax, edi
+mov ecx, esi
+xor eax, 1
+add esp, 0x10
+or cl, al
+jne short loc_0000873e  ; jne 0x873e
+cmp byte [ebp - 0x3d9], 0
+jne short loc_0000873e  ; jne 0x873e
+mov eax, dword [ebp + 0xc]
+cmp byte [eax], 1
+jbe short loc_0000874d  ; jbe 0x874d
+mov eax, dword [eax + 0xd]
+cmp byte [eax + 0x48], 1
+jne short loc_0000874d  ; jne 0x874d
+
+loc_0000873e:
+mov eax, ebx
+shl eax, 5
+mov byte [ebp + eax - 0x2e5], 1
+jmp short loc_0000875a  ; jmp 0x875a
+
+loc_0000874d:
+mov eax, ebx
+shl eax, 5
+mov byte [ebp + eax - 0x2e5], 0
+
+loc_0000875a:
+shl ebx, 5
+lea eax, [ebp - 0x18]
+add ebx, eax
+cmp byte [ebx - 0x2df], 0
+jne short loc_00008774  ; jne 0x8774
+mov byte [ebx - 0x2cd], 0
+jmp short loc_0000877b  ; jmp 0x877b
+
+loc_00008774:
+mov byte [ebp - 0x3f4], 1
+
+loc_0000877b:
+inc byte [ebp - 0x3ec]
+jmp near loc_0000863b  ; jmp 0x863b
+
+loc_00008786:
+cmp byte [ebp - 0x3f4], 0
+je short loc_00008799  ; je 0x8799
+lea edx, [ebp - 0x302]
+xor eax, eax
+jmp short loc_000087bc  ; jmp 0x87bc
+
+loc_00008799:
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_00009375  ; je 0x9375
+push ecx
+push ecx
+push ref_00021e44  ; push 0x21e44
+jmp near loc_00008e4c  ; jmp 0x8e4c
+
+loc_000087b2:
+add edx, 0x20
+cmp byte [edx - 3], 1
+je short loc_000087cc  ; je 0x87cc
+inc eax
+
+loc_000087bc:
+cmp al, cl
+jne short loc_000087b2  ; jne 0x87b2
+mov byte [ebp - 0x3ee], 0
+jmp near loc_0000896c  ; jmp 0x896c
+
+loc_000087cc:
+push eax
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00008087  ; call 0x8087
+pop edx
+pop ecx
+push 0x2000
+mov dword [ebp - 0x3f4], eax
+mov eax, dword [ebp - 0x3f8]
+add eax, 0x444
+push eax
+mov dword [ebp - 0x410], eax
+call fcn_00018b14  ; call 0x18b14
+lea eax, [ebp - 0x2a2]
+add esp, 0x10
+mov dword [ebp - 0x3ec], eax
+movzx eax, byte [ebp - 0x3ed]
+mov byte [ebp - 0x408], 0
+mov dword [ebp - 0x414], eax
+movzx eax, word [ebp - 0x404]
+mov dword [ebp - 0x418], eax
+
+loc_0000882f:
+xor eax, eax
+
+loc_00008831:
+mov edi, dword [ebp - 0x3ec]
+mov dword [edi + eax + 1], 0
+add eax, 4
+cmp eax, 0x40
+jne short loc_00008831  ; jne 0x8831
+mov byte [ebp - 0x3fc], 0
+
+loc_0000884e:
+movzx eax, byte [ebp - 0x3de]
+cmp byte [ebp - 0x3fc], al
+jb near loc_00008f25  ; jb 0x8f25
+mov esi, dword [ebp - 0x3ec]
+push ebx
+push ebx
+lea edx, [esi + 1]
+push edx
+push 0
+push eax
+lea eax, [ebp - 0x302]
+push eax
+push dword [ebp - 0x3f4]
+push dword [ebp - 0x418]
+push dword [ebp + 0x10]
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00007ab6  ; call 0x7ab6
+add esp, 0x30
+test eax, eax
+js near loc_000091e4  ; js 0x91e4
+
+loc_0000889f:
+sub esp, 0xc
+push dword [ebp + 0xc]
+call fcn_000082aa  ; call 0x82aa
+add esp, 0x10
+test al, al
+jne near loc_00009201  ; jne 0x9201
+
+loc_000088b5:
+inc byte [ebp - 0x408]
+mov al, byte [ebp - 0x3ee]
+add dword [ebp - 0x3ec], 0x41
+cmp byte [ebp - 0x408], al
+jb near loc_0000882f  ; jb 0x882f
+push eax
+xor edi, edi
+push eax
+push 0xffffdfff
+push dword [ebp - 0x410]
+lea ebx, [ebp - 0x384]
+call fcn_00018b3e  ; call 0x18b3e
+pop eax
+pop edx
+push dword [ebp - 0x3f4]
+push dword [ebp + 0xc]
+call fcn_00007fc2  ; call 0x7fc2
+add esp, 0x10
+lea edx, [ebp - 0x2a2]
+
+loc_00008907:
+lea eax, [ebp - 0x3c4]
+
+loc_0000890d:
+mov dword [eax], 0xffffffff
+add eax, 4
+cmp eax, ebx
+jne short loc_0000890d  ; jne 0x890d
+xor eax, eax
+
+loc_0000891c:
+mov esi, dword [edx + eax*4 + 1]
+cmp esi, 0xffffffff
+je short loc_0000892c  ; je 0x892c
+mov dword [ebp + eax*4 - 0x3c4], esi
+
+loc_0000892c:
+mov esi, dword [ebp + eax*4 - 0x3c4]
+cmp esi, dword [ebx + eax*4]
+jle short loc_00008944  ; jle 0x8944
+mov cl, byte [edx]
+mov dword [ebx + eax*4], esi
+mov byte [ebp + eax - 0x3d4], cl
+
+loc_00008944:
+inc eax
+cmp eax, 0x10
+jne short loc_0000891c  ; jne 0x891c
+inc edi
+add edx, 0x41
+mov eax, edi
+cmp al, byte [ebp - 0x3ee]
+jb short loc_00008907  ; jb 0x8907
+cmp byte [ebp - 0x3df], 0
+jne near loc_00009278  ; jne 0x9278
+
+loc_00008965:
+mov byte [ebp - 0x3ee], 1
+
+loc_0000896c:
+mov byte [ebp - 0x3ec], 0
+
+loc_00008973:
+mov al, byte [ebp - 0x3ec]
+cmp al, byte [ebp - 0x3de]
+jae near loc_00008ac0  ; jae 0x8ac0
+movzx edi, byte [ebp - 0x3ec]
+mov eax, edi
+shl eax, 5
+lea ecx, [ebp + eax - 0x302]
+cmp byte [ecx + 0xb], 0
+mov al, byte [ecx + 2]
+je near loc_00008ab5  ; je 0x8ab5
+cmp byte [ebp - 0x3df], 0
+jne short loc_000089c0  ; jne 0x89c0
+
+loc_000089ae:
+shl edi, 5
+xor ebx, ebx
+lea eax, [ebp - 0x18]
+mov edx, edi
+lea edi, [eax + edi]
+jmp near loc_00008a68  ; jmp 0x8a68
+
+loc_000089c0:
+cmp al, 1
+je short loc_000089e0  ; je 0x89e0
+cmp al, 2
+je short loc_000089fc  ; je 0x89fc
+mov bl, byte [ebp - 0x3ed]
+cmp bl, 1
+sbb esi, esi
+neg ebx
+and esi, 0xfffffff2
+and ebx, 0xe
+add esi, 0xf
+jmp short loc_00008a16  ; jmp 0x8a16
+
+loc_000089e0:
+mov al, byte [ebp - 0x3ed]
+cmp al, 1
+sbb esi, esi
+and esi, 2
+add esi, 7
+cmp al, 1
+sbb ebx, ebx
+and ebx, 2
+add ebx, 6
+jmp short loc_00008a16  ; jmp 0x8a16
+
+loc_000089fc:
+mov al, byte [ebp - 0x3ed]
+cmp al, 1
+sbb esi, esi
+and esi, 0xa
+add esi, 3
+cmp al, 1
+sbb ebx, ebx
+and ebx, 0xa
+add ebx, 2
+
+loc_00008a16:
+mov eax, edi
+shl eax, 5
+mov dword [ebp - 0x3f4], eax
+
+loc_00008a21:
+mov eax, esi
+cmp bl, al
+ja short loc_000089ae  ; ja 0x89ae
+movzx ecx, bl
+sub esp, 0xc
+movzx eax, byte [ebp + ecx - 0x3d4]
+inc ebx
+mov dword [ebp - 0x3f8], ecx
+push eax
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+lea eax, [ebp - 0x302]
+add eax, dword [ebp - 0x3f4]
+push ecx
+push eax
+call fcn_000080f4  ; call 0x80f4
+mov ecx, dword [ebp - 0x3f8]
+add esp, 0x20
+mov byte [ebp + ecx - 0x3d4], al
+jmp short loc_00008a21  ; jmp 0x8a21
+
+loc_00008a68:
+cmp bl, byte [edi - 0x2ce]
+jae short loc_00008ab5  ; jae 0x8ab5
+movzx eax, bl
+sub esp, 0xc
+movzx esi, byte [eax + edi - 0x2de]
+inc ebx
+mov dword [ebp - 0x3f4], edx
+movzx eax, byte [ebp + esi - 0x3d4]
+push eax
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+lea eax, [ebp - 0x302]
+add eax, edx
+push esi
+push eax
+call fcn_000080f4  ; call 0x80f4
+add esp, 0x20
+mov edx, dword [ebp - 0x3f4]
+mov byte [ebp + esi - 0x3d4], al
+jmp short loc_00008a68  ; jmp 0x8a68
+
+loc_00008ab5:
+inc byte [ebp - 0x3ec]
+jmp near loc_00008973  ; jmp 0x8973
+
+loc_00008ac0:
+cmp byte [ebp - 0x3ee], 0
+je short loc_00008afc  ; je 0x8afc
+xor ebx, ebx
+
+loc_00008acb:
+push ecx
+push ebx
+inc ebx
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+pop esi
+pop edi
+push 0x10
+add eax, 0xb0
+push eax
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+cmp ebx, 3
+jne short loc_00008acb  ; jne 0x8acb
+sub esp, 0xc
+push dword [ebp + 0xc]
+call fcn_00006016  ; call 0x6016
+add esp, 0x10
+
+loc_00008afc:
+movzx eax, byte [ebp - 0x3ed]
+mov byte [ebp - 0x3ec], 0
+mov dword [ebp - 0x3f8], eax
+
+loc_00008b10:
+mov al, byte [ebp - 0x3ec]
+cmp al, byte [ebp - 0x3de]
+jae near loc_00008d8d  ; jae 0x8d8d
+movzx eax, byte [ebp - 0x3ec]
+mov dword [ebp - 0x3fc], eax
+shl eax, 5
+lea edi, [ebp + eax - 0x302]
+movzx eax, byte [ebp + eax - 0x302]
+mov cl, byte [edi + 2]
+push edx
+movzx esi, cl
+push esi
+movzx ebx, byte [edi + 1]
+mov byte [ebp - 0x3ed], cl
+push ebx
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0x10
+cmp byte [edi + 0xb], 0
+mov dword [ebp - 0x400], eax
+jne short loc_00008b89  ; jne 0x8b89
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_00008d82  ; je 0x8d82
+push esi
+push ebx
+push ref_00021eca  ; push 0x21eca
+push 0x40
+call fcn_00015487  ; call 0x15487
+jmp near loc_00008d7f  ; jmp 0x8d7f
+
+loc_00008b89:
+mov cl, byte [ebp - 0x3ed]
+cmp cl, 1
+je short loc_00008ba7  ; je 0x8ba7
+cmp cl, 2
+mov al, 0xd
+mov bl, 1
+mov dl, 0
+cmove ebx, eax
+mov al, 0xc
+cmove edx, eax
+jmp short loc_00008bab  ; jmp 0x8bab
+
+loc_00008ba7:
+mov bl, 9
+mov dl, 8
+
+loc_00008bab:
+push eax
+push eax
+lea eax, [ebp - 0x3da]
+push eax
+movzx eax, dl
+push eax
+mov dword [ebp - 0x3f4], edx
+call fcn_0000937d  ; call 0x937d
+add esp, 0x10
+mov edx, dword [ebp - 0x3f4]
+cmp byte [ebp - 0x3df], 0
+je short loc_00008be4  ; je 0x8be4
+movzx eax, byte [ebp - 0x3ed]
+mov dword [ebp - 0x404], eax
+jmp short loc_00008bff  ; jmp 0x8bff
+
+loc_00008be4:
+mov eax, dword [ebp - 0x3fc]
+lea esi, [ebp - 0x18]
+xor edx, edx
+shl eax, 5
+add eax, esi
+mov dword [ebp - 0x3f4], eax
+jmp near loc_00008c93  ; jmp 0x8c93
+
+loc_00008bff:
+cmp dl, bl
+ja short loc_00008be4  ; ja 0x8be4
+push edi
+movzx esi, dl
+push edi
+push dword [ebp - 0x3f8]
+lea edi, [ebp - 0x3dd]
+mov dword [ebp - 0x40c], edx
+push esi
+call fcn_00006e54  ; call 0x6e54
+movzx ecx, byte [ebp - 0x3da]
+movzx eax, al
+movzx eax, byte [ebp + eax - 0x3d4]
+mov edx, eax
+lea eax, [ebp - 0x3db]
+mov dword [esp], eax
+lea eax, [ebp - 0x3dc]
+push eax
+push edi
+push ecx
+push edx
+mov dword [ebp - 0x3f4], edx
+mov dword [ebp - 0x408], eax
+call fcn_000093d9  ; call 0x93d9
+mov eax, dword [ebp - 0x408]
+add esp, 0x20
+lea ecx, [ebp - 0x3db]
+push ecx
+push eax
+push edi
+push esi
+call fcn_000094be  ; call 0x94be
+push esi
+push dword [ebp - 0x404]
+push dword [ebp - 0x3f4]
+push 1
+call fcn_00002b0b  ; call 0x2b0b
+mov edx, dword [ebp - 0x40c]
+add esp, 0x20
+inc edx
+jmp near loc_00008bff  ; jmp 0x8bff
+
+loc_00008c93:
+mov eax, dword [ebp - 0x3f4]
+cmp dl, byte [eax - 0x2ce]
+jae near loc_00008d57  ; jae 0x8d57
+mov edi, dword [ebp - 0x3f4]
+movzx eax, dl
+push ecx
+push ecx
+push dword [ebp - 0x3f8]
+lea ebx, [eax + edi - 0x2ea]
+movzx eax, byte [ebx + 0xc]
+lea edi, [ebp - 0x3dc]
+mov dword [ebp - 0x404], edx
+lea esi, [ebp - 0x3dd]
+push eax
+call fcn_00006e54  ; call 0x6e54
+movzx ecx, byte [ebp - 0x3da]
+mov dword [ebp - 0x3fc], eax
+lea eax, [ebp - 0x3db]
+mov dword [esp], eax
+push edi
+push esi
+push ecx
+movzx ecx, byte [ebx + 0xc]
+movzx ecx, byte [ebp + ecx - 0x3d4]
+push ecx
+call fcn_000093d9  ; call 0x93d9
+mov eax, dword [ebp - 0x3fc]
+add esp, 0x20
+lea ecx, [ebp - 0x3db]
+push ecx
+push edi
+push esi
+movzx eax, al
+push eax
+mov dword [ebp - 0x3fc], eax
+call fcn_000094be  ; call 0x94be
+mov eax, dword [ebp - 0x3fc]
+push eax
+movzx eax, byte [ebp - 0x3ed]
+push eax
+movzx eax, byte [ebx + 0xc]
+movzx eax, byte [ebp + eax - 0x3d4]
+push eax
+push 1
+call fcn_00002b0b  ; call 0x2b0b
+mov edx, dword [ebp - 0x404]
+add esp, 0x20
+inc edx
+jmp near loc_00008c93  ; jmp 0x8c93
+
+loc_00008d57:
+mov edi, dword [ebp - 0x400]
+push esi
+push esi
+push 1
+mov eax, edi
+add eax, 0xd98
+push eax
+call fcn_00018b14  ; call 0x18b14
+pop eax
+mov eax, edi
+pop edx
+add eax, 0xb0
+push 0x20
+push eax
+call fcn_00018927  ; call 0x18927
+
+loc_00008d7f:
+add esp, 0x10
+
+loc_00008d82:
+inc byte [ebp - 0x3ec]
+jmp near loc_00008b10  ; jmp 0x8b10
+
+loc_00008d8d:
+cmp byte [ebp - 0x3ee], 0
+je short loc_00008dde  ; je 0x8dde
+push ebx
+mov eax, dword [ebp + 0x10]
+xor ebx, ebx
+push 0x64
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+call dword [eax + 4]  ; ucall
+add esp, 0x10
+
+loc_00008daa:
+push edi
+push ebx
+inc ebx
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+push 0xffef
+add eax, 0xb0
+push eax
+call fcn_00018954  ; call 0x18954
+add esp, 0x10
+cmp ebx, 3
+jne short loc_00008daa  ; jne 0x8daa
+sub esp, 0xc
+push dword [ebp + 0xc]
+call fcn_0000606a  ; call 0x606a
+add esp, 0x10
+
+loc_00008dde:
+xor edx, edx
+
+loc_00008de0:
+cmp dl, byte [ebp - 0x3de]
+jae short loc_00008e38  ; jae 0x8e38
+movzx eax, dl
+shl eax, 5
+lea ecx, [ebp + eax - 0x302]
+movzx ebx, byte [ebp + eax - 0x302]
+movzx esi, byte [ecx + 1]
+movzx edi, byte [ecx + 2]
+lea ecx, [ebp - 0x302]
+push 0
+add eax, ecx
+push eax
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+mov dword [ebp - 0x3ec], edx
+call fcn_00005d50  ; call 0x5d50
+add esp, 0xc
+push edi
+push esi
+push ebx
+call fcn_0000241b  ; call 0x241b
+mov edx, dword [ebp - 0x3ec]
+add esp, 0x10
+inc edx
+jmp short loc_00008de0  ; jmp 0x8de0
+
+loc_00008e38:
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_00009375  ; je 0x9375
+push esi
+push esi
+push ref_00021f05  ; push 0x21f05
+
+loc_00008e4c:
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp near loc_00009375  ; jmp 0x9375
+
+loc_00008e5b:
+cmp dword [ebp - 0x3ec], 0x40670
+jne near loc_0000862d  ; jne 0x862d
+push eax
+push eax
+push 0xffff7fff
+push esi
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+jmp near loc_0000862d  ; jmp 0x862d
+
+loc_00008e80:
+xor ebx, ebx
+
+loc_00008e82:
+cmp bl, byte [ebp - 0x3de]
+jae near loc_00008620  ; jae 0x8620
+movzx eax, bl
+shl eax, 5
+lea edx, [ebp + eax - 0x302]
+mov al, byte [ebp + eax - 0x302]
+movzx ecx, byte [edx + 2]
+movzx edx, byte [edx + 1]
+mov byte [ebp - 0x3fc], al
+
+loc_00008eb0:
+movzx edi, byte [ebp - 0x3fc]
+push eax
+push ecx
+push edx
+push edi
+mov dword [ebp - 0x408], ecx
+mov dword [ebp - 0x400], edx
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xd2
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+mov edx, dword [ebp - 0x400]
+mov ecx, dword [ebp - 0x408]
+test al, 2
+je short loc_00008eb0  ; je 0x8eb0
+sub esp, 0xc
+inc ebx
+push ecx
+push edx
+push edi
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+call fcn_0000254f  ; call 0x254f
+add esp, 0x20
+jmp near loc_00008e82  ; jmp 0x8e82
+
+loc_00008f06:
+xor edi, edi
+
+loc_00008f08:
+mov eax, ebx
+mov esi, dword [ebp + 0x14]
+shl eax, 5
+mov eax, dword [ebp + eax - 0x2fb]
+mov dword [esi + edx*4 + 0x29], eax
+mov esi, 1
+jmp near loc_000086b2  ; jmp 0x86b2
+
+loc_00008f25:
+movzx eax, byte [ebp - 0x3fc]
+lea edi, [ebp - 0x18]
+mov dword [ebp - 0x400], eax
+shl eax, 5
+add edi, eax
+mov cl, byte [edi - 0x2e8]
+sub edi, 0x2ea
+mov byte [edi + 0x1e], 0
+movzx eax, byte [ebp + eax - 0x302]
+push edx
+movzx esi, cl
+push esi
+movzx ebx, byte [edi + 1]
+mov byte [ebp - 0x3f8], cl
+push ebx
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0x10
+cmp byte [edi + 0xb], 0
+mov dword [ebp - 0x404], eax
+jne short loc_00008f9a  ; jne 0x8f9a
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_000091d9  ; je 0x91d9
+push esi
+push ebx
+push ref_00021e74  ; push 0x21e74
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp near loc_000091d9  ; jmp 0x91d9
+
+loc_00008f9a:
+mov cl, byte [ebp - 0x3f8]
+cmp cl, 1
+je short loc_00008fbb  ; je 0x8fbb
+cmp cl, 2
+mov al, 0xd
+mov esi, 1
+mov bl, 0
+cmove esi, eax
+mov al, 0xc
+cmove ebx, eax
+jmp short loc_00008fc2  ; jmp 0x8fc2
+
+loc_00008fbb:
+mov esi, 9
+mov bl, 8
+
+loc_00008fc2:
+push edi
+push edi
+lea eax, [ebp - 0x3da]
+push eax
+movzx eax, bl
+push eax
+call fcn_0000937d  ; call 0x937d
+lea edi, [ebp - 0x3db]
+lea eax, [ebp - 0x3dc]
+mov dword [esp], edi
+push eax
+lea eax, [ebp - 0x3dd]
+push eax
+movzx eax, byte [ebp - 0x3da]
+push eax
+mov eax, dword [ebp - 0x3ec]
+movzx eax, byte [eax]
+push eax
+call fcn_000093d9  ; call 0x93d9
+add esp, 0x20
+cmp byte [ebp - 0x3df], 0
+je short loc_00009019  ; je 0x9019
+mov edx, edi
+movzx edi, byte [ebp - 0x3f8]
+jmp short loc_0000902c  ; jmp 0x902c
+
+loc_00009019:
+mov esi, dword [ebp - 0x400]
+lea eax, [ebp - 0x18]
+xor edx, edx
+shl esi, 5
+lea edi, [eax + esi]
+jmp short loc_0000907b  ; jmp 0x907b
+
+loc_0000902c:
+mov eax, esi
+cmp bl, al
+ja short loc_00009019  ; ja 0x9019
+push edx
+movzx eax, bl
+lea ecx, [ebp - 0x3dc]
+inc ebx
+push ecx
+lea ecx, [ebp - 0x3dd]
+push ecx
+push eax
+mov dword [ebp - 0x420], edx
+mov dword [ebp - 0x41c], eax
+call fcn_000094be  ; call 0x94be
+mov eax, dword [ebp - 0x41c]
+push eax
+mov eax, dword [ebp - 0x3ec]
+push edi
+movzx eax, byte [eax]
+push eax
+push 1
+call fcn_00002b0b  ; call 0x2b0b
+add esp, 0x20
+mov edx, dword [ebp - 0x420]
+jmp short loc_0000902c  ; jmp 0x902c
+
+loc_0000907b:
+lea ebx, [edi - 0x2da]
+cmp dl, byte [edi - 0x2ce]
+jae short loc_000090ef  ; jae 0x90ef
+push ebx
+movzx eax, dl
+push ebx
+push dword [ebp - 0x414]
+movzx eax, byte [eax + edi - 0x2de]
+mov dword [ebp - 0x41c], edx
+push eax
+call fcn_00006e54  ; call 0x6e54
+movzx ebx, al
+lea eax, [ebp - 0x3db]
+push eax
+lea eax, [ebp - 0x3dc]
+push eax
+lea eax, [ebp - 0x3dd]
+push eax
+push ebx
+call fcn_000094be  ; call 0x94be
+movzx eax, byte [ebp - 0x3f8]
+add esp, 0x20
+push ebx
+push eax
+mov eax, dword [ebp - 0x3ec]
+movzx eax, byte [eax]
+push eax
+push 1
+call fcn_00002b0b  ; call 0x2b0b
+mov edx, dword [ebp - 0x41c]
+add esp, 0x10
+inc edx
+jmp short loc_0000907b  ; jmp 0x907b
+
+loc_000090ef:
+mov eax, dword [ebp - 0x404]
+lea edi, [ebp + esi - 0x302]
+push ecx
+push ecx
+push 1
+add eax, 0xd98
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0xc
+push edi
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+call fcn_00006437  ; call 0x6437
+mov eax, dword [ebp - 0x404]
+lea esi, [eax + 0xb2]
+mov dword [esp], esi
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+and eax, 0xf
+cmp ax, 3
+je short loc_00009179  ; je 0x9179
+sub esp, 0xc
+push edi
+call fcn_0000649b  ; call 0x649b
+add esp, 0xc
+movzx eax, al
+push eax
+push 3
+push edi
+push dword [ebp + 0x10]
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_0000661e  ; call 0x661e
+add esp, 0x14
+push esi
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+and eax, 0xf
+cmp ax, 3
+je short loc_00009179  ; je 0x9179
+mov byte [ebx + 0xe], 1
+jmp short loc_000091d9  ; jmp 0x91d9
+
+loc_00009179:
+movzx esi, byte [ebp - 0x3f8]
+push edi
+push edi
+mov edi, dword [ebp - 0x3f4]
+push esi
+push edi
+call fcn_00007c07  ; call 0x7c07
+add esp, 0xc
+mov ebx, eax
+mov eax, dword [ebp + 0xc]
+mov eax, dword [eax + 0xd]
+movzx eax, word [eax + 0x3c]
+push eax
+mov eax, dword [ebp + 0x10]
+push dword [ebp + 0x10]
+push dword [ebp + 8]
+call dword [eax + 4]  ; ucall
+pop eax
+pop edx
+push esi
+push edi
+call fcn_00007c07  ; call 0x7c07
+add esp, 0x10
+cmp eax, ebx
+mov eax, dword [ebp - 0x400]
+je short loc_000091ce  ; je 0x91ce
+shl eax, 5
+mov byte [ebp + eax - 0x2e4], 1
+jmp short loc_000091d9  ; jmp 0x91d9
+
+loc_000091ce:
+shl eax, 5
+mov byte [ebp + eax - 0x2e3], 1
+
+loc_000091d9:
+inc byte [ebp - 0x3fc]
+jmp near loc_0000884e  ; jmp 0x884e
+
+loc_000091e4:
+xor eax, eax
+
+loc_000091e6:
+mov edi, dword [ebp - 0x3ec]
+mov dword [edi + eax + 1], 0
+add eax, 4
+cmp eax, 0x40
+jne short loc_000091e6  ; jne 0x91e6
+jmp near loc_0000889f  ; jmp 0x889f
+
+loc_00009201:
+push ecx
+push ecx
+lea eax, [ebp - 0x344]
+push eax
+movzx eax, byte [ebp - 0x3de]
+push 2
+push eax
+lea eax, [ebp - 0x302]
+push eax
+movzx eax, word [ebp - 0x40c]
+push dword [ebp - 0x3f4]
+push eax
+push dword [ebp + 0x10]
+push dword [ebp + 0x14]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_00007ab6  ; call 0x7ab6
+add esp, 0x30
+test eax, eax
+js near loc_000088b5  ; js 0x88b5
+xor eax, eax
+
+loc_00009247:
+mov edx, dword [ebp + eax - 0x344]
+cmp edx, 0xffffffff
+je short loc_0000926b  ; je 0x926b
+mov esi, dword [ebp - 0x3ec]
+mov ecx, dword [esi + eax + 1]
+cmp ecx, 0x18f
+jle short loc_0000926b  ; jle 0x926b
+add edx, ecx
+mov dword [esi + eax + 1], edx
+
+loc_0000926b:
+add eax, 4
+cmp eax, 0x40
+jne short loc_00009247  ; jne 0x9247
+jmp near loc_000088b5  ; jmp 0x88b5
+
+loc_00009278:
+mov byte [ebp - 0x3ec], 0
+
+loc_0000927f:
+mov al, byte [ebp - 0x3ec]
+cmp al, byte [ebp - 0x3de]
+jae near loc_00008965  ; jae 0x8965
+movzx eax, byte [ebp - 0x3ec]
+shl eax, 5
+mov al, byte [ebp + eax - 0x300]
+cmp al, 1
+je short loc_000092cd  ; je 0x92cd
+cmp al, 2
+mov al, byte [ebp - 0x3ed]
+je short loc_000092f3  ; je 0x92f3
+cmp al, 1
+mov bl, al
+sbb edi, edi
+neg ebx
+and edi, 0xfffffff2
+and ebx, 0xe
+add edi, 0xf
+cmp al, 1
+sbb edx, edx
+and edx, 0xfffffff5
+add edx, 0xd
+jmp short loc_0000930f  ; jmp 0x930f
+
+loc_000092cd:
+mov al, byte [ebp - 0x3ed]
+cmp al, 1
+sbb edi, edi
+and edi, 2
+add edi, 7
+cmp al, 1
+sbb ebx, ebx
+and ebx, 2
+add ebx, 6
+cmp al, 1
+sbb edx, edx
+and edx, 5
+add edx, 5
+jmp short loc_0000930f  ; jmp 0x930f
+
+loc_000092f3:
+cmp al, 1
+sbb edi, edi
+and edi, 0xa
+add edi, 3
+cmp al, 1
+sbb ebx, ebx
+and ebx, 0xa
+add ebx, 2
+cmp al, 1
+sbb edx, edx
+and edx, 0xd
+inc edx
+
+loc_0000930f:
+movzx esi, dl
+cmp dword [ebp + esi*4 - 0x384], 0xffffffff
+je short loc_0000936a  ; je 0x936a
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00009342  ; je 0x9342
+mov eax, edi
+sub esp, 0xc
+movzx eax, al
+push eax
+movzx eax, bl
+push eax
+push esi
+push ref_00021e99  ; push 0x21e99
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_00009342:
+mov eax, edi
+cmp bl, al
+ja short loc_0000936a  ; ja 0x936a
+mov ecx, dword [ebp + esi*4 - 0x384]
+movzx eax, bl
+inc ebx
+mov dword [ebp + eax*4 - 0x384], ecx
+mov cl, byte [ebp + esi - 0x3d4]
+mov byte [ebp + eax - 0x3d4], cl
+jmp short loc_00009342  ; jmp 0x9342
+
+loc_0000936a:
+inc byte [ebp - 0x3ec]
+jmp near loc_0000927f  ; jmp 0x927f
+
+loc_00009375:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000937d:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+lea ebx, [eax + 0x814]
+mov eax, esi
+movzx edx, al
+shl edx, 0x13
+or edx, 0x2840000
+push edx
+push ebx
+call fcn_00017e8f  ; call 0x17e8f
+mov dword [esp], ebx
+call fcn_00017e4e  ; call 0x17e4e
+mov esi, eax
+pop eax
+pop edx
+shr esi, 6
+push 0
+push ebx
+call fcn_00017e8f  ; call 0x17e8f
+mov eax, dword [ebp + 0xc]
+mov edx, esi
+and edx, 0x3f
+add esp, 0x10
+mov byte [eax], dl
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_000093d9:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+cmp bl, 9
+ja short loc_00009425  ; ja 0x9425
+movzx ebx, bl
+jmp dword [ebx*4 + ref_000203d0]  ; ujmp: jmp dword [ebx*4 + 0x203d0]
+
+loc_000093fa:
+mov ecx, 0xffffff38
+jmp near loc_000094ba  ; jmp 0x94ba
+
+loc_00009404:
+mov ecx, 0xffffff83
+jmp near loc_000094ba  ; jmp 0x94ba
+
+loc_0000940e:
+xor ecx, ecx
+jmp near loc_000094ba  ; jmp 0x94ba
+
+loc_00009415:
+mov ecx, 0xffffff83
+jmp short loc_0000944a  ; jmp 0x944a
+
+loc_0000941c:
+xor ecx, ecx
+mov eax, 0xffffff5a
+jmp short loc_0000945b  ; jmp 0x945b
+
+loc_00009425:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00009451  ; je 0x9451
+movzx ebx, bl
+push eax
+push ebx
+push ref_00021f23  ; push 0x21f23
+push 2
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp short loc_00009451  ; jmp 0x9451
+
+loc_00009444:
+xor ecx, ecx
+jmp short loc_00009456  ; jmp 0x9456
+
+loc_00009448:
+xor ecx, ecx
+
+loc_0000944a:
+mov eax, 0xffffff83
+jmp short loc_0000945b  ; jmp 0x945b
+
+loc_00009451:
+mov ecx, 0xffffff38
+
+loc_00009456:
+mov eax, 0xffffff9c
+
+loc_0000945b:
+neg eax
+
+loc_0000945d:
+mov ebx, ecx
+mov edx, esi
+movzx edx, dl
+neg ebx
+test ecx, ecx
+cmove ebx, ecx
+mov ecx, 0x3e8
+imul eax, edx
+imul ebx, edx
+cdq
+idiv ecx
+cmp edx, 0x1f4
+setge dl
+add eax, edx
+mov byte [edi], al
+mov eax, ebx
+cdq
+idiv ecx
+cmp edx, 0x1f4
+mov edx, esi
+setge bl
+add ebx, eax
+mov eax, dword [ebp + 0x18]
+mov byte [eax], bl
+mov eax, dword [ebp + 0x14]
+sub dl, byte [edi]
+sub edx, ebx
+mov byte [eax], dl
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+loc_000094ae:
+mov ecx, 0xffffff06
+jmp short loc_000094ba  ; jmp 0x94ba
+
+loc_000094b5:
+mov ecx, 0xffffff59
+
+loc_000094ba:
+xor eax, eax
+jmp short loc_0000945d  ; jmp 0x945d
+
+fcn_000094be:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x14]
+push esi
+push ebx
+movzx ebx, byte [eax]
+mov eax, dword [ebp + 0xc]
+or ebx, 0x40000
+movzx eax, byte [eax]
+shl eax, 6
+or ebx, eax
+mov eax, dword [ebp + 0x10]
+movzx eax, byte [eax]
+shl eax, 0xc
+or ebx, eax
+movzx eax, byte [ebp + 8]
+shl eax, 0x13
+or ebx, eax
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+push ebx
+lea esi, [eax + 0x814]
+push esi
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+mov dword [ebp + 8], esi
+mov dword [ebp + 0xc], 0
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00017e8f  ; jmp 0x17e8f
+
+fcn_00009521:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov bl, byte [ebp + 8]
+push ecx
+push 0
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov edx, esi
+add esp, 0x10
+shr bl, 1
+test dl, dl
+movzx ebx, bl
+je short loc_00009565  ; je 0x9565
+push edx
+push 6
+shl ebx, 5
+push 0xfffffffffffffff9
+lea eax, [eax + ebx + 0x900]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+loc_00009565:
+shl ebx, 5
+lea eax, [eax + ebx + 0x900]
+mov dword [ebp + 0xc], 0xfffffff9
+mov dword [ebp + 8], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00018b3e  ; jmp 0x18b3e
+
+fcn_00009584:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_0001c651  ; call 0x1c651
+cmp eax, 0x40660
+je short loc_0000961a  ; je 0x961a
+cmp eax, 0x306c0
+je short loc_0000961a  ; je 0x961a
+cmp eax, 0x40670
+je short loc_000095c2  ; je 0x95c2
+
+loc_000095a9:
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_00009685  ; je 0x9685
+mov dword [ebp + 0xc], ref_00021f6e  ; mov dword [ebp + 0xc], 0x21f6e
+jmp near loc_00009673  ; jmp 0x9673
+
+loc_000095c2:
+push edx
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+je short loc_000095a9  ; je 0x95a9
+
+loc_000095e0:
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov edx, ebx
+add esp, 0xc
+and edx, 1
+shl edx, 0x1e
+shr bl, 1
+or edx, 0x80000000
+movzx ebx, bl
+push edx
+shl ebx, 5
+push 0x3fffffff
+lea eax, [eax + ebx + 0x80c]
+push eax
+call fcn_00018b68  ; call 0x18b68
+jmp short loc_0000965e  ; jmp 0x965e
+
+loc_0000961a:
+cmp eax, 0x40670
+je short loc_000095e0  ; je 0x95e0
+cmp eax, 0x40660
+je short loc_0000962f  ; je 0x962f
+cmp eax, 0x306c0
+jne short loc_00009663  ; jne 0x9663
+
+loc_0000962f:
+push 0x1000c
+movzx ebx, bl
+push 0
+push 2
+push esi
+call fcn_000040eb  ; call 0x40eb
+push 0
+push ebx
+push 0x1011
+push esi
+call fcn_000040eb  ; call 0x40eb
+add esp, 0x20
+push 0
+push 0
+push 3
+push esi
+call fcn_000040eb  ; call 0x40eb
+
+loc_0000965e:
+add esp, 0x10
+jmp short loc_00009685  ; jmp 0x9685
+
+loc_00009663:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00009685  ; je 0x9685
+mov dword [ebp + 0xc], ref_00021fa1  ; mov dword [ebp + 0xc], 0x21fa1
+
+loc_00009673:
+mov dword [ebp + 8], 2
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00015487  ; jmp 0x15487
+
+loc_00009685:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000968c:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+call fcn_0001c651  ; call 0x1c651
+mov ebx, eax
+call fcn_0001c678  ; call 0x1c678
+cmp ebx, 0x40670
+je short loc_000096ac  ; je 0x96ac
+
+loc_000096a8:
+xor edx, edx
+jmp short loc_00009717  ; jmp 0x9717
+
+loc_000096ac:
+mov edx, 0x80000003
+test eax, eax
+je short loc_00009717  ; je 0x9717
+mov eax, esi
+xor ebx, ebx
+test al, al
+je short loc_000096ea  ; je 0x96ea
+
+loc_000096bd:
+push esi
+push 0
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+push 0x10
+lea eax, [eax + ebx + 0x90c]
+add ebx, 0x20
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+cmp ebx, 0x100
+jne short loc_000096bd  ; jne 0x96bd
+jmp short loc_000096a8  ; jmp 0x96a8
+
+loc_000096ea:
+push eax
+push 0
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+push 0xffffffffffffffef
+lea eax, [eax + ebx + 0x90c]
+add ebx, 0x20
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+cmp ebx, 0x100
+jne short loc_000096ea  ; jne 0x96ea
+jmp short loc_000096a8  ; jmp 0x96a8
+
+loc_00009717:
+lea esp, [ebp - 8]
+mov eax, edx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00009720:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0xc]
+push esi
+movzx esi, byte [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0x14]
+sub esp, 0xc
+shl eax, 6
+or eax, dword [ebp + 0x10]
+shl ebx, 6
+or ebx, dword [ebp + 0x18]
+push eax
+push 0x31
+push esi
+push 1
+push 0
+call fcn_000029e2  ; call 0x29e2
+add esp, 0x20
+mov dword [ebp + 0x18], ebx
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0x14], 0x32
+mov dword [ebp + 0xc], 1
+mov dword [ebp + 8], 0
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_000029e2  ; jmp 0x29e2
+
+fcn_00009774:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+movzx ebx, byte [ebp + 8]
+push 0x31
+push ebx
+push 1
+push 0
+call fcn_00002a60  ; call 0x2a60
+mov edx, dword [ebp + 0x10]
+mov ecx, eax
+and ecx, 0x3f
+mov dword [edx], ecx
+mov edx, dword [ebp + 0xc]
+shr eax, 6
+and eax, 3
+mov dword [edx], eax
+push 0x32
+push ebx
+push 1
+push 0
+call fcn_00002a60  ; call 0x2a60
+mov edx, dword [ebp + 0x18]
+add esp, 0x20
+mov ecx, eax
+and ecx, 0x3f
+mov dword [edx], ecx
+mov edx, dword [ebp + 0x14]
+shr eax, 6
+and eax, 3
+mov dword [edx], eax
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000097c7:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 8
+mov ecx, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov edx, dword [ebp + 0x14]
+cmp ecx, 0x20
+jne short loc_000097ec  ; jne 0x97ec
+mov dword [ebx], 0
+mov dword [edx], 0x20
+jmp short loc_0000983f  ; jmp 0x983f
+
+loc_000097ec:
+mov eax, 0
+jbe short loc_00009810  ; jbe 0x9810
+lea esi, [ecx - 0x20]
+
+loc_000097f6:
+mov ecx, dword [ebp + 8]
+mov edi, esi
+sub ecx, eax
+shl edi, cl
+mov ecx, edi
+add ecx, 0x20
+lea edi, [eax + 1]
+cmp ecx, 0x3f
+jle short loc_0000983b  ; jle 0x983b
+mov eax, edi
+jmp short loc_000097f6  ; jmp 0x97f6
+
+loc_00009810:
+mov esi, 0x20
+mov edi, esi
+sub edi, ecx
+mov dword [ebp - 0x14], edi
+
+loc_0000981c:
+mov ecx, dword [ebp + 8]
+mov edi, dword [ebp - 0x14]
+sub ecx, eax
+shl edi, cl
+mov ecx, edi
+lea edi, [eax + 1]
+mov dword [ebp - 0x10], edi
+mov edi, esi
+sub edi, ecx
+mov ecx, edi
+jns short loc_0000983b  ; jns 0x983b
+mov eax, dword [ebp - 0x10]
+jmp short loc_0000981c  ; jmp 0x981c
+
+loc_0000983b:
+mov dword [ebx], eax
+mov dword [edx], ecx
+
+loc_0000983f:
+pop eax
+pop edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00009846:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 0xc]
+lea eax, [ebp - 8]
+push eax
+lea eax, [ebp - 0xc]
+push eax
+push ebx
+push dword [ebp + 8]
+call fcn_000097c7  ; call 0x97c7
+add esp, 0x10
+cmp ebx, 0x20
+jbe short loc_00009889  ; jbe 0x9889
+mov eax, dword [ebp - 0xc]
+test eax, eax
+jne short loc_00009878  ; jne 0x9878
+
+loc_00009870:
+mov eax, dword [ebp - 8]
+sub eax, 0x20
+jmp short loc_000098a0  ; jmp 0x98a0
+
+loc_00009878:
+mov edx, dword [ebp - 8]
+add eax, 0xfffffff
+shl eax, 4
+lea eax, [edx + eax - 0x10]
+jmp short loc_000098a0  ; jmp 0x98a0
+
+loc_00009889:
+je short loc_0000989e  ; je 0x989e
+mov eax, dword [ebp - 0xc]
+test eax, eax
+je short loc_00009870  ; je 0x9870
+imul eax, eax, 0xffffffef
+mov edx, dword [ebp - 8]
+lea eax, [edx + eax - 0x20]
+jmp short loc_000098a0  ; jmp 0x98a0
+
+loc_0000989e:
+xor eax, eax
+
+loc_000098a0:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000098a5:
+push ebp
+mov eax, 0x80000002
+mov ebp, esp
+mov edx, dword [ebp + 8]
+push esi
+push ebx
+lea ecx, [edx + 0x53]
+cmp ecx, 0xa2
+ja near loc_00009964  ; ja 0x9964
+cmp edx, 0
+je near loc_00009951  ; je 0x9951
+lea eax, [edx + 0x20]
+mov ebx, 0
+mov edx, eax
+jle short loc_0000991f  ; jle 0x991f
+
+loc_000098d6:
+test ebx, ebx
+jne short loc_000098e3  ; jne 0x98e3
+mov esi, edx
+cmp edx, 0x3f
+jg short loc_00009905  ; jg 0x9905
+jmp short loc_00009958  ; jmp 0x9958
+
+loc_000098e3:
+mov esi, eax
+cmp eax, 0x3f
+jg short loc_00009905  ; jg 0x9905
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00009958  ; je 0x9958
+cmp esi, 0x2e
+jg short loc_00009958  ; jg 0x9958
+push edx
+push ref_00021fbc  ; push 0x21fbc
+push 0x1ad
+jmp short loc_00009942  ; jmp 0x9942
+
+loc_00009905:
+inc ebx
+sub eax, 0x10
+cmp ebx, 4
+jne short loc_000098d6  ; jne 0x98d6
+jmp short loc_00009958  ; jmp 0x9958
+
+loc_00009910:
+mov esi, edx
+test edx, edx
+jns short loc_00009958  ; jns 0x9958
+
+loc_00009916:
+inc ebx
+add eax, 0x11
+cmp ebx, 4
+je short loc_00009958  ; je 0x9958
+
+loc_0000991f:
+test ebx, ebx
+je short loc_00009910  ; je 0x9910
+mov esi, eax
+test eax, eax
+js short loc_00009916  ; js 0x9916
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00009958  ; je 0x9958
+cmp esi, 0x11
+jle short loc_00009958  ; jle 0x9958
+push eax
+push ref_00022007  ; push 0x22007
+push 0x1bc
+
+loc_00009942:
+push ref_00021fcc  ; push 0x21fcc
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+jmp short loc_00009958  ; jmp 0x9958
+
+loc_00009951:
+mov esi, 0x20
+xor ebx, ebx
+
+loc_00009958:
+mov eax, dword [ebp + 0xc]
+mov dword [eax], ebx
+mov eax, dword [ebp + 0x10]
+mov dword [eax], esi
+xor eax, eax
+
+loc_00009964:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000996b:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x2c
+mov eax, dword [ebp + 8]
+lea edx, [ebp - 0xc]
+mov ebx, dword [ebp + 0xc]
+push edx
+lea edx, [ebp - 0x10]
+push edx
+lea edx, [ebp - 0x14]
+push edx
+lea edx, [ebp - 0x18]
+push edx
+movzx edx, al
+push edx
+mov dword [ebp - 0x1c], eax
+call fcn_00009774  ; call 0x9774
+mov eax, dword [ebp - 0x1c]
+add esp, 0x18
+mov edx, dword [ebp - 0x14]
+mov byte [ebx], al
+mov eax, dword [ebp - 0x18]
+mov dword [ebx + 5], edx
+mov dword [ebx + 1], eax
+push edx
+push eax
+call fcn_00009846  ; call 0x9846
+mov edx, dword [ebp - 0xc]
+mov dword [ebx + 0x11], edx
+mov dword [ebx + 9], eax
+mov eax, dword [ebp - 0x10]
+mov dword [ebx + 0xd], eax
+pop ecx
+pop esi
+push edx
+push eax
+call fcn_00009846  ; call 0x9846
+mov edx, dword [ebx + 9]
+mov ecx, 0x4f
+mov esi, ecx
+add esp, 0x10
+sub esi, edx
+sub ecx, eax
+cmp esi, ecx
+cmovle ecx, esi
+mov dword [ebx + 0x19], ecx
+mov ecx, 0xffffffad
+mov esi, ecx
+sub ecx, eax
+sub esi, edx
+mov dword [ebx + 0x15], eax
+cmp esi, ecx
+mov eax, ecx
+cmovge eax, esi
+mov dword [ebx + 0x1d], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00009a00:
+push ebp
+mov ebp, esp
+sub esp, 0x14
+mov eax, dword [ebp + 8]
+push dword [eax + 0x11]
+push dword [eax + 0xd]
+push dword [eax + 5]
+push dword [eax + 1]
+movzx eax, byte [eax]
+push eax
+call fcn_00009720  ; call 0x9720
+add esp, 0x20
+leave
+ret
+
+fcn_00009a23:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x14
+mov ebx, dword [ebp + 0xc]
+lea eax, [ebp - 0x14]
+mov esi, dword [ebp + 8]
+push eax
+lea eax, [ebp - 0x18]
+push eax
+mov eax, dword [ebx + 9]
+add eax, esi
+push eax
+call fcn_000098a5  ; call 0x98a5
+add esp, 0x10
+test eax, eax
+js short loc_00009a81  ; js 0x9a81
+push eax
+lea eax, [ebp - 0xc]
+push eax
+lea eax, [ebp - 0x10]
+push eax
+add esi, dword [ebx + 0x15]
+push esi
+call fcn_000098a5  ; call 0x98a5
+add esp, 0x10
+test eax, eax
+js short loc_00009a81  ; js 0x9a81
+sub esp, 0xc
+push dword [ebp - 0xc]
+push dword [ebp - 0x10]
+push dword [ebp - 0x14]
+push dword [ebp - 0x18]
+movzx eax, byte [ebx]
+push eax
+call fcn_00009720  ; call 0x9720
+add esp, 0x20
+xor eax, eax
+
+loc_00009a81:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00009a88:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 1
+mov edx, dword [ebp + 0x14]
+mov al, byte [ebp + 0xc]
+mov esi, dword [ebp + 8]
+mov byte [edx], 0
+mov byte [ebp - 0xd], al
+
+loc_00009aa0:
+mov eax, esi
+sub eax, dword [ebp + 8]
+cmp al, byte [ebp - 0xd]
+jae short loc_00009ad0  ; jae 0x9ad0
+mov al, byte [esi]
+xor edi, edi
+movzx ecx, byte [edx]
+shr al, 1
+
+loc_00009ab3:
+mov ebx, edi
+cmp cl, bl
+jbe short loc_00009ac5  ; jbe 0x9ac5
+mov ebx, dword [ebp + 0x10]
+inc edi
+cmp byte [ebx + edi - 1], al
+jne short loc_00009ab3  ; jne 0x9ab3
+jmp short loc_00009acd  ; jmp 0x9acd
+
+loc_00009ac5:
+mov ebx, dword [ebp + 0x10]
+mov byte [ebx + ecx], al
+inc byte [edx]
+
+loc_00009acd:
+inc esi
+jmp short loc_00009aa0  ; jmp 0x9aa0
+
+loc_00009ad0:
+add esp, 1
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00009ada:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x3c
+mov eax, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+lea edx, [ebp - 0x21]
+push edx
+mov ebx, dword [ebp + 0x14]
+lea edx, [ebp - 0x20]
+mov esi, dword [ebp + 0x18]
+push edx
+mov byte [ebp - 0x29], al
+movzx eax, al
+push eax
+push dword [ebp + 8]
+mov dword [ebp - 0x34], edi
+mov edi, dword [ebp + 0x1c]
+mov dword [ebp - 0x38], ebx
+mov byte [ebp - 0x21], 0
+mov dword [ebp - 0x3c], edi
+call fcn_00009a88  ; call 0x9a88
+add esp, 0xc
+push 0
+push 1
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov edx, dword [ebp + 8]
+add esp, 0x10
+mov ebx, eax
+lea edi, [eax + 0xa00]
+
+loc_00009b32:
+mov al, byte [ebp + 8]
+mov byte [ebp - 0x30], al
+mov al, dl
+sub eax, dword [ebp + 8]
+cmp al, byte [ebp - 0x29]
+jae short loc_00009b63  ; jae 0x9b63
+push ecx
+push ecx
+push 0xfffffbff
+movzx eax, byte [edx]
+mov dword [ebp - 0x30], edx
+shl eax, 4
+add eax, edi
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+mov edx, dword [ebp - 0x30]
+add esp, 0x10
+inc edx
+jmp short loc_00009b32  ; jmp 0x9b32
+
+loc_00009b63:
+movzx eax, byte [ebp - 0x34]
+shl esi, 0x1c
+xor edx, edx
+movzx edi, byte [ebp - 0x38]
+shl eax, 0xa
+or esi, eax
+shl edi, 0xb
+
+loc_00009b78:
+cmp dl, byte [ebp - 0x21]
+jae short loc_00009bc4  ; jae 0x9bc4
+movzx eax, dl
+movzx ecx, byte [ebp + eax - 0x20]
+mov dword [ebp - 0x38], edx
+push edx
+push esi
+shl ecx, 5
+add ecx, ebx
+push 0xeffc03ff
+lea eax, [ecx + 0x900]
+push eax
+mov dword [ebp - 0x34], ecx
+call fcn_00018b68  ; call 0x18b68
+mov ecx, dword [ebp - 0x34]
+add esp, 0xc
+push edi
+push 0xfffe07ff
+add ecx, 0x90c
+push ecx
+call fcn_00018b68  ; call 0x18b68
+mov edx, dword [ebp - 0x38]
+add esp, 0x10
+inc edx
+jmp short loc_00009b78  ; jmp 0x9b78
+
+loc_00009bc4:
+add ebx, 0xa00
+mov esi, dword [ebp + 8]
+cmp byte [ebp - 0x3c], 0
+je short loc_00009bf9  ; je 0x9bf9
+
+loc_00009bd3:
+mov eax, esi
+sub eax, dword [ebp - 0x30]
+cmp al, byte [ebp - 0x29]
+jae short loc_00009bf9  ; jae 0x9bf9
+push eax
+inc esi
+push eax
+push 0x400
+movzx eax, byte [esi - 1]
+shl eax, 4
+add eax, ebx
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+jmp short loc_00009bd3  ; jmp 0x9bd3
+
+loc_00009bf9:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00009c03:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0xc]
+mov edi, dword [ebp + 8]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x10]
+test al, al
+je short loc_00009c48  ; je 0x9c48
+mov esi, eax
+mov eax, ref_00026efc  ; mov eax, 0x26efc
+
+loc_00009c23:
+mov dl, byte [eax + 1]
+movzx ecx, byte [eax]
+movzx ebx, byte [eax + 3]
+mov byte [ebp - 0x1d], dl
+mov edx, esi
+cmp byte [eax + 2], dl
+je short loc_00009c54  ; je 0x9c54
+add eax, 4
+cmp eax, ref_00026f5c  ; cmp eax, 0x26f5c
+jne short loc_00009c23  ; jne 0x9c23
+mov eax, 0x80000002
+jmp short loc_00009c6d  ; jmp 0x9c6d
+
+loc_00009c48:
+push edx
+push edx
+push 0
+push 0
+push 0
+push 0
+jmp short loc_00009c5f  ; jmp 0x9c5f
+
+loc_00009c54:
+push eax
+movzx edx, byte [ebp - 0x1d]
+push eax
+push 1
+push ebx
+push ecx
+push edx
+
+loc_00009c5f:
+movzx eax, byte [ebp - 0x1c]
+push eax
+push edi
+call fcn_00009ada  ; call 0x9ada
+add esp, 0x20
+
+loc_00009c6d:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00009c75:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+lea ebx, [esi + 0x2338]
+
+loc_00009c83:
+sub esp, 0xc
+push ebx
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 1
+jne short loc_00009c83  ; jne 0x9c83
+push eax
+push eax
+push dword [ebp + 0xc]
+lea eax, [esi + 0x2330]
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0xc
+push 0x700
+push 0xff
+push ebx
+call fcn_00018981  ; call 0x18981
+lea eax, [esi + 0x2334]
+add esi, 0x233a
+pop edx
+pop ecx
+push dword [ebp + 0x10]
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+pop edx
+push 0xf000
+push esi
+call fcn_00017e04  ; call 0x17e04
+pop ecx
+pop esi
+push 1
+push ebx
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+
+loc_00009ce8:
+sub esp, 0xc
+push ebx
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 1
+jne short loc_00009ce8  ; jne 0x9ce8
+sub esp, 0xc
+push ebx
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+and eax, 6
+cmp al, 1
+sbb eax, eax
+not eax
+lea esp, [ebp - 8]
+and eax, 0x80000007
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00009d19:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+lea ebx, [esi + 0x2338]
+
+loc_00009d27:
+sub esp, 0xc
+push ebx
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 1
+jne short loc_00009d27  ; jne 0x9d27
+push eax
+push eax
+push dword [ebp + 0xc]
+lea eax, [esi + 0x2330]
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0xc
+push 0x600
+push 0xff
+push ebx
+call fcn_00018981  ; call 0x18981
+lea eax, [esi + 0x233a]
+pop edx
+pop ecx
+push 0xf000
+push eax
+call fcn_00017e04  ; call 0x17e04
+pop eax
+pop edx
+push 1
+push ebx
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+
+loc_00009d7b:
+sub esp, 0xc
+push ebx
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 1
+jne short loc_00009d7b  ; jne 0x9d7b
+sub esp, 0xc
+push ebx
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov edx, 0x80000007
+test al, 6
+jne short loc_00009db9  ; jne 0x9db9
+sub esp, 0xc
+add esi, 0x2334
+push esi
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, dword [ebp + 0x10]
+add esp, 0x10
+mov dword [edx], eax
+xor edx, edx
+
+loc_00009db9:
+lea esp, [ebp - 8]
+mov eax, edx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00009dc2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov esi, dword [ebp + 0xc]
+lea eax, [ebp - 0x1c]
+mov edi, dword [ebp + 0x14]
+push eax
+push esi
+push dword [ebp + 8]
+call fcn_00009d19  ; call 0x9d19
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+jns short loc_00009e40  ; jns 0x9e40
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00009e0a  ; je 0x9e0a
+sub esp, 0xc
+push edi
+push dword [ebp + 0x10]
+push esi
+push ref_00022017  ; push 0x22017
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_00009e0a:
+call fcn_00015480  ; call 0x15480
+mov edx, ebx
+test al, al
+je near loc_00009ec3  ; je 0x9ec3
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00009e36  ; je 0x9e36
+push edi
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00009e36:
+push esi
+push ref_000206f4  ; push 0x206f4
+push 0x34
+jmp short loc_00009eb4  ; jmp 0x9eb4
+
+loc_00009e40:
+mov eax, dword [ebp + 0x10]
+and eax, dword [ebp - 0x1c]
+push ecx
+or eax, edi
+push eax
+push esi
+push dword [ebp + 8]
+mov dword [ebp - 0x1c], eax
+call fcn_00009c75  ; call 0x9c75
+add esp, 0x10
+mov ebx, eax
+mov edx, eax
+test eax, eax
+jns short loc_00009ec3  ; jns 0x9ec3
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00009e84  ; je 0x9e84
+sub esp, 0xc
+push edi
+push dword [ebp + 0x10]
+push esi
+push ref_00022084  ; push 0x22084
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_00009e84:
+call fcn_00015480  ; call 0x15480
+mov edx, ebx
+test al, al
+je short loc_00009ec3  ; je 0x9ec3
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00009eac  ; je 0x9eac
+push edx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00009eac:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x40
+
+loc_00009eb4:
+push ref_00022050  ; push 0x22050
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+mov edx, ebx
+
+loc_00009ec3:
+lea esp, [ebp - 0xc]
+mov eax, edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00009ecd:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 8]
+mov edi, dword [ebp + 0x14]
+lea esi, [ebx + 0x2338]
+
+loc_00009ee2:
+sub esp, 0xc
+push esi
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 1
+jne short loc_00009ee2  ; jne 0x9ee2
+push ecx
+push ecx
+push dword [ebp + 0xc]
+lea eax, [ebx + 0x2330]
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+mov eax, dword [ebp + 0x10]
+add esp, 0xc
+shl eax, 8
+movzx eax, ax
+push eax
+push 0xff
+push esi
+call fcn_00018981  ; call 0x18981
+pop eax
+mov eax, edi
+pop edx
+movzx edi, al
+or edi, 0xf000
+lea eax, [ebx + 0x233a]
+push edi
+push eax
+call fcn_00017e04  ; call 0x17e04
+mov eax, dword [ebp + 0x10]
+add esp, 0x10
+lea ecx, [eax - 1]
+cmp ecx, 6
+ja short loc_00009f64  ; ja 0x9f64
+mov eax, 1
+shl eax, cl
+test al, 0x55
+je short loc_00009f64  ; je 0x9f64
+mov eax, dword [ebp + 0x18]
+push edx
+push edx
+push dword [eax]
+lea eax, [ebx + 0x2334]
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+
+loc_00009f64:
+push eax
+push eax
+push 1
+push esi
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+
+loc_00009f71:
+sub esp, 0xc
+push esi
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 1
+jne short loc_00009f71  ; jne 0x9f71
+sub esp, 0xc
+push esi
+mov esi, 0x80000007
+call fcn_00017d8b  ; call 0x17d8b
+mov edx, dword [ebp + 0x1c]
+add esp, 0x10
+and eax, 6
+mov byte [edx], al
+test al, al
+jne short loc_00009fcb  ; jne 0x9fcb
+xor esi, esi
+cmp dword [ebp + 0x10], 6
+ja short loc_00009fcb  ; ja 0x9fcb
+mov cl, byte [ebp + 0x10]
+mov eax, 1
+shl eax, cl
+test al, 0x55
+je short loc_00009fcb  ; je 0x9fcb
+sub esp, 0xc
+add ebx, 0x2334
+push ebx
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, dword [ebp + 0x18]
+add esp, 0x10
+mov dword [edx], eax
+
+loc_00009fcb:
+lea esp, [ebp - 0xc]
+mov eax, esi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00009fd5:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov al, byte [ebp + 0x14]
+mov byte [ebp - 0x19], al
+movzx eax, byte [ebp + 0x10]
+push eax
+movzx eax, byte [ebp + 0xc]
+push eax
+movzx eax, byte [ebp + 8]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+mov esi, eax
+lea eax, [eax + 0xe]
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+mov edx, 0x14
+and eax, 0x7f
+cmp al, 2
+mov eax, 0x34
+cmovne edx, eax
+add edx, esi
+mov dword [esp], edx
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+xor ecx, ecx
+mov bl, al
+and ebx, 0xfffffffc
+
+loc_0000a02b:
+test bl, bl
+je short loc_0000a065  ; je 0xa065
+inc cl
+je short loc_0000a065  ; je 0xa065
+movzx edi, bl
+sub esp, 0xc
+add edi, esi
+push edi
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+cmp al, byte [ebp - 0x19]
+mov cl, al
+mov dword [ebp - 0x20], ecx
+je short loc_0000a069  ; je 0xa069
+sub esp, 0xc
+inc edi
+push edi
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov ecx, dword [ebp - 0x20]
+mov bl, al
+and ebx, 0xfffffffc
+jmp short loc_0000a02b  ; jmp 0xa02b
+
+loc_0000a065:
+xor eax, eax
+jmp short loc_0000a06b  ; jmp 0xa06b
+
+loc_0000a069:
+mov al, bl
+
+loc_0000a06b:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000a073:
+push ebp
+mov ebp, esp
+push edi
+push esi
+xor esi, esi
+push ebx
+mov ebx, 0x100
+sub esp, 0x20
+mov eax, dword [ebp + 0x14]
+mov word [ebp - 0x1e], ax
+movzx eax, byte [ebp + 0x10]
+push eax
+movzx eax, byte [ebp + 0xc]
+push eax
+movzx eax, byte [ebp + 8]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0x10
+mov dword [ebp - 0x1c], eax
+
+loc_0000a0a4:
+test bx, bx
+je short loc_0000a0e4  ; je 0xa0e4
+inc si
+je short loc_0000a0e4  ; je 0xa0e4
+mov eax, dword [ebp - 0x1c]
+movzx ecx, bx
+sub esp, 0xc
+lea edi, [ecx + eax]
+push edi
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+mov esi, eax
+cmp ax, word [ebp - 0x1e]
+je short loc_0000a0e8  ; je 0xa0e8
+sub esp, 0xc
+lea ecx, [edi + 2]
+push ecx
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+mov ebx, eax
+shr bx, 4
+and ebx, 0xfffffffc
+jmp short loc_0000a0a4  ; jmp 0xa0a4
+
+loc_0000a0e4:
+xor eax, eax
+jmp short loc_0000a0ea  ; jmp 0xa0ea
+
+loc_0000a0e8:
+mov eax, ebx
+
+loc_0000a0ea:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000a0f2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x30
+mov edi, dword [ebp + 0x1c]
+movzx edx, byte [ebp + 0x10]
+movzx esi, byte [ebp + 8]
+mov eax, dword [ebp + 0x14]
+mov dword [ebp - 0x20], edi
+movzx edi, byte [ebp + 0xc]
+mov ebx, dword [ebp + 0x18]
+push edx
+push edi
+push esi
+mov dword [ebp - 0x30], edx
+mov dword [ebp - 0x1c], eax
+mov byte [ebp - 0x24], al
+mov byte [ebp - 0x28], bl
+call fcn_00016c9a  ; call 0x16c9a
+mov edx, dword [ebp - 0x30]
+push 2
+push edx
+push edi
+push esi
+mov dword [ebp - 0x2c], eax
+call fcn_0000a073  ; call 0xa073
+add esp, 0x20
+mov edx, 0x80000003
+mov ecx, dword [ebp - 0x2c]
+test ax, ax
+je near loc_0000a216  ; je 0xa216
+movzx eax, ax
+lea esi, [ecx + eax + 0x14]
+push eax
+push 1
+push 0xf0
+push esi
+call fcn_0001878a  ; call 0x1878a
+mov cl, byte [ebp - 0x20]
+mov eax, 1
+pop edx
+shl eax, cl
+pop ecx
+movzx eax, al
+mov dword [ebp - 0x20], eax
+push eax
+push esi
+movzx esi, bl
+call fcn_00017da5  ; call 0x17da5
+movzx edi, byte [ebp - 0x1c]
+add esp, 0xc
+push 0
+push esi
+push edi
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xe
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x1c], 0
+mov bl, al
+movzx eax, byte [ebp - 0x28]
+sar bl, 7
+and ebx, 7
+mov dword [ebp - 0x28], eax
+movzx eax, byte [ebp - 0x24]
+mov dword [ebp - 0x24], eax
+
+loc_0000a1b4:
+movzx edx, byte [ebp - 0x1c]
+push eax
+push edx
+push esi
+push edi
+mov dword [ebp - 0x30], edx
+call fcn_00016c9a  ; call 0x16c9a
+mov edx, dword [ebp - 0x30]
+push 2
+push edx
+push dword [ebp - 0x28]
+push dword [ebp - 0x24]
+mov dword [ebp - 0x2c], eax
+call fcn_0000a073  ; call 0xa073
+add esp, 0x20
+mov ecx, dword [ebp - 0x2c]
+test ax, ax
+je short loc_0000a20c  ; je 0xa20c
+movzx eax, ax
+lea edx, [ecx + eax + 0x14]
+push eax
+push 1
+push 0xf0
+push edx
+mov dword [ebp - 0x2c], edx
+call fcn_0001878a  ; call 0x1878a
+pop edx
+mov edx, dword [ebp - 0x2c]
+pop ecx
+push dword [ebp - 0x20]
+push edx
+call fcn_00017da5  ; call 0x17da5
+add esp, 0x10
+
+loc_0000a20c:
+inc byte [ebp - 0x1c]
+cmp byte [ebp - 0x1c], bl
+jbe short loc_0000a1b4  ; jbe 0xa1b4
+xor edx, edx
+
+loc_0000a216:
+lea esp, [ebp - 0xc]
+mov eax, edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000a220:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x40
+mov eax, dword [ebp + 8]
+movzx ecx, byte [ebp + 0x10]
+movzx esi, byte [ebp + 0xc]
+mov ebx, dword [ebp + 0x14]
+mov edx, eax
+mov dword [ebp - 0x2c], eax
+mov eax, dword [ebp + 0x18]
+movzx edi, dl
+push ecx
+push esi
+push edi
+mov dword [ebp - 0x24], ecx
+mov dword [ebp - 0x1c], eax
+mov byte [ebp - 0x38], bl
+mov byte [ebp - 0x3c], al
+call fcn_00016c9a  ; call 0x16c9a
+mov ecx, dword [ebp - 0x24]
+push 0x10
+push ecx
+push esi
+push edi
+mov dword [ebp - 0x20], eax
+call fcn_00009fd5  ; call 0x9fd5
+add esp, 0x20
+test al, al
+jne short loc_0000a277  ; jne 0xa277
+
+loc_0000a26d:
+mov eax, 0x80000003
+jmp near loc_0000a3e2  ; jmp 0xa3e2
+
+loc_0000a277:
+movzx eax, al
+sub esp, 0xc
+add eax, dword [ebp - 0x20]
+lea esi, [eax + 0x12]
+push esi
+mov dword [ebp - 0x28], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test ah, 0x10
+je short loc_0000a26d  ; je 0xa26d
+movzx eax, byte [ebp - 0x1c]
+movzx edx, bl
+push ecx
+push 0
+push eax
+push edx
+mov dword [ebp - 0x34], edx
+mov dword [ebp - 0x30], eax
+call fcn_00016c9a  ; call 0x16c9a
+mov ebx, eax
+lea eax, [eax + 0xe]
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x1c], al
+sar byte [ebp - 0x1c], 7
+and byte [ebp - 0x1c], 7
+cmp byte [ebp - 0x2c], 0
+jne short loc_0000a306  ; jne 0xa306
+sub esp, 0xc
+push ebx
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+cmp ax, 0x8086
+jne short loc_0000a306  ; jne 0xa306
+sub esp, 0xc
+add ebx, 2
+push ebx
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+cmp ax, 0x93c
+jne short loc_0000a306  ; jne 0xa306
+push eax
+push eax
+mov eax, dword [ebp - 0x20]
+push 0x40
+add eax, 0x70
+push eax
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+
+loc_0000a306:
+movzx eax, byte [ebp - 0x3c]
+xor ebx, ebx
+mov byte [ebp - 0x24], 0
+mov dword [ebp - 0x3c], eax
+movzx eax, byte [ebp - 0x38]
+mov dword [ebp - 0x40], eax
+
+loc_0000a31a:
+push edi
+movzx edi, byte [ebp - 0x24]
+push edi
+push dword [ebp - 0x30]
+push dword [ebp - 0x34]
+call fcn_00016c9a  ; call 0x16c9a
+push 0x10
+push edi
+push dword [ebp - 0x3c]
+push dword [ebp - 0x40]
+mov dword [ebp - 0x38], eax
+call fcn_00009fd5  ; call 0x9fd5
+add esp, 0x20
+test al, al
+je short loc_0000a388  ; je 0xa388
+mov edi, dword [ebp - 0x38]
+movzx eax, al
+sub esp, 0xc
+add edi, eax
+lea eax, [edi + 0x12]
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test ah, 0x10
+je short loc_0000a388  ; je 0xa388
+test bl, bl
+jne short loc_0000a376  ; jne 0xa376
+mov eax, dword [ebp - 0x28]
+push ebx
+push ebx
+push 0x40
+add eax, 0x10
+push eax
+call fcn_00018730  ; call 0x18730
+add esp, 0x10
+
+loc_0000a376:
+push ecx
+add edi, 0x10
+push ecx
+mov bl, 1
+push 0x40
+push edi
+call fcn_00018730  ; call 0x18730
+add esp, 0x10
+
+loc_0000a388:
+inc byte [ebp - 0x24]
+mov al, byte [ebp - 0x1c]
+cmp byte [ebp - 0x24], al
+jbe short loc_0000a31a  ; jbe 0xa31a
+cmp bl, 1
+sbb ebx, ebx
+and ebx, 0x80000003
+cmp byte [ebp - 0x2c], 0
+jne short loc_0000a3bc  ; jne 0xa3bc
+mov eax, dword [ebp - 0x20]
+push edx
+push edx
+push 0x1040
+add eax, 0xd4
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+
+loc_0000a3bc:
+push eax
+push eax
+mov eax, dword [ebp - 0x28]
+push 0x20
+add eax, 0x10
+push eax
+call fcn_00018730  ; call 0x18730
+add esp, 0x10
+
+loc_0000a3cf:
+sub esp, 0xc
+push esi
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test ah, 8
+jne short loc_0000a3cf  ; jne 0xa3cf
+mov eax, ebx
+
+loc_0000a3e2:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000a3ea:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0xc]
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0x10]
+mov dword [ebp - 0x1c], eax
+mov byte [ebp - 0x24], bl
+mov dword [ebp - 0x28], esi
+mov byte [ebp - 0x20], al
+call fcn_0001bfbb  ; call 0x1bfbb
+cmp eax, 2
+je short loc_0000a44e  ; je 0xa44e
+
+loc_0000a412:
+movzx edi, byte [ebp - 0x1c]
+movzx esi, bl
+xor ebx, ebx
+push ecx
+push 0
+push edi
+push esi
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xe
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x1c], al
+movzx eax, byte [ebp - 0x20]
+sar byte [ebp - 0x1c], 7
+and byte [ebp - 0x1c], 7
+mov dword [ebp - 0x20], eax
+movzx eax, byte [ebp - 0x24]
+mov dword [ebp - 0x24], eax
+jmp short loc_0000a4b5  ; jmp 0xa4b5
+
+loc_0000a44e:
+push eax
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov edi, eax
+lea eax, [eax + 0xf0]
+add edi, 0x48
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [esp], edi
+mov esi, eax
+call fcn_00017dc2  ; call 0x17dc2
+mov edi, eax
+pop eax
+and edi, 0xfffc
+movzx eax, byte [ebp - 0x28]
+pop edx
+push eax
+mov eax, esi
+and eax, 0xffffc000
+push eax
+call fcn_0001c3cb  ; call 0x1c3cb
+movzx eax, al
+lea eax, [edi + eax*8 + 0x190]
+mov dword [esp], eax
+call fcn_00018f64  ; call 0x18f64
+add esp, 0x10
+test al, 1
+je near loc_0000a412  ; je 0xa412
+jmp near loc_0000a557  ; jmp 0xa557
+
+loc_0000a4b5:
+push 0x10
+movzx ecx, bl
+push ecx
+push dword [ebp - 0x20]
+push dword [ebp - 0x24]
+mov dword [ebp - 0x28], ecx
+call fcn_00009fd5  ; call 0x9fd5
+add esp, 0x10
+mov ecx, dword [ebp - 0x28]
+test al, al
+mov dl, al
+jne short loc_0000a4df  ; jne 0xa4df
+
+loc_0000a4d5:
+inc ebx
+cmp bl, byte [ebp - 0x1c]
+jbe short loc_0000a4b5  ; jbe 0xa4b5
+xor ebx, ebx
+jmp short loc_0000a50f  ; jmp 0xa50f
+
+loc_0000a4df:
+push eax
+push ecx
+push edi
+push esi
+mov dword [ebp - 0x28], edx
+call fcn_00016c9a  ; call 0x16c9a
+mov edx, dword [ebp - 0x28]
+movzx edx, dl
+lea eax, [eax + edx + 0xc]
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test eax, 0x40000
+jne short loc_0000a4d5  ; jne 0xa4d5
+jmp short loc_0000a557  ; jmp 0xa557
+
+loc_0000a509:
+inc ebx
+cmp bl, byte [ebp - 0x1c]
+ja short loc_0000a557  ; ja 0xa557
+
+loc_0000a50f:
+push 0x10
+movzx ecx, bl
+push ecx
+push dword [ebp - 0x20]
+push dword [ebp - 0x24]
+mov dword [ebp - 0x28], ecx
+call fcn_00009fd5  ; call 0x9fd5
+add esp, 0x10
+mov ecx, dword [ebp - 0x28]
+test al, al
+mov dl, al
+je short loc_0000a509  ; je 0xa509
+push eax
+push ecx
+push edi
+push esi
+mov dword [ebp - 0x28], edx
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+mov edx, dword [ebp - 0x28]
+pop ecx
+movzx edx, dl
+push 0x100
+lea eax, [eax + edx + 0x10]
+push eax
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+jmp short loc_0000a509  ; jmp 0xa509
+
+loc_0000a557:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000a55f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x30
+mov edx, dword [ebp + 0xc]
+mov eax, dword [ebp + 8]
+mov bl, byte [ebp + 0x14]
+push 0
+mov byte [ebp - 0x24], dl
+movzx edx, dl
+movzx edi, al
+push edx
+push edi
+mov byte [ebp - 0x1a], bl
+mov dword [ebp - 0x20], edx
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xe
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x19], 0
+mov dword [ebp - 0x28], edi
+mov bl, al
+movzx eax, byte [ebp - 0x24]
+sar bl, 7
+and ebx, 7
+mov dword [ebp - 0x24], eax
+
+loc_0000a5ad:
+push ecx
+movzx ecx, byte [ebp - 0x19]
+push ecx
+push dword [ebp - 0x20]
+mov dword [ebp - 0x2c], ecx
+push edi
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+mov esi, eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_0000a631  ; je 0xa631
+mov ecx, dword [ebp - 0x2c]
+push 0x10
+push ecx
+push dword [ebp - 0x24]
+push dword [ebp - 0x28]
+call fcn_00009fd5  ; call 0x9fd5
+add esp, 0x10
+test al, al
+je short loc_0000a631  ; je 0xa631
+cmp byte [ebp - 0x1a], 1
+movzx eax, al
+jne short loc_0000a613  ; jne 0xa613
+push edx
+mov edx, dword [ebp + 0x10]
+lea eax, [esi + eax + 8]
+mov cx, word [edx]
+shl ecx, 5
+movzx ecx, cx
+push ecx
+push 0xff1f
+push eax
+call fcn_00018981  ; call 0x18981
+add esp, 0x10
+jmp short loc_0000a631  ; jmp 0xa631
+
+loc_0000a613:
+sub esp, 0xc
+lea eax, [esi + eax + 4]
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+mov esi, dword [ebp + 0x10]
+add esp, 0x10
+and eax, 7
+cmp word [esi], ax
+jbe short loc_0000a631  ; jbe 0xa631
+mov word [esi], ax
+
+loc_0000a631:
+inc byte [ebp - 0x19]
+cmp byte [ebp - 0x19], bl
+jbe near loc_0000a5ad  ; jbe 0xa5ad
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000a647:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+movzx eax, byte [ebp + 0x10]
+mov esi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0x14]
+push eax
+movzx eax, byte [ebp + 0xc]
+movzx edi, bl
+push eax
+movzx eax, byte [ebp + 8]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 0
+mov dword [ebp - 0x20], eax
+mov eax, esi
+movzx esi, al
+push esi
+push edi
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xe
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+xor ecx, ecx
+mov byte [ebp - 0x19], 0
+mov dl, al
+sar dl, 7
+and edx, 7
+
+loc_0000a69d:
+movzx eax, byte [ebp - 0x19]
+mov dword [ebp - 0x28], edx
+push edx
+push eax
+push esi
+push edi
+mov dword [ebp - 0x24], ecx
+call fcn_00016c9a  ; call 0x16c9a
+mov ebx, eax
+lea eax, [eax + 0xb]
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+mov byte [ebp - 0x1a], al
+lea eax, [ebx + 0xa]
+add ebx, 9
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+mov dword [esp], ebx
+mov byte [ebp - 0x1b], al
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov ecx, dword [ebp - 0x24]
+cmp byte [ebp - 0x1b], 0
+mov edx, dword [ebp - 0x28]
+jne short loc_0000a6f8  ; jne 0xa6f8
+cmp byte [ebp - 0x1a], 8
+jne short loc_0000a6f8  ; jne 0xa6f8
+cmp al, 0x20
+je short loc_0000a6f6  ; je 0xa6f6
+cmp al, 0x10
+jne short loc_0000a6f8  ; jne 0xa6f8
+
+loc_0000a6f6:
+mov cl, 1
+
+loc_0000a6f8:
+inc byte [ebp - 0x19]
+cmp byte [ebp - 0x19], dl
+jbe short loc_0000a69d  ; jbe 0xa69d
+test cl, cl
+jne short loc_0000a719  ; jne 0xa719
+push eax
+push eax
+mov eax, dword [ebp - 0x20]
+push 2
+add eax, 0xd4
+push eax
+call fcn_00018730  ; call 0x18730
+add esp, 0x10
+
+loc_0000a719:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000a723:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0000a75e  ; je 0xa75e
+mov ax, word [esi]
+and eax, 0x1c00
+cmp eax, 0x1400
+jbe short loc_0000a75e  ; jbe 0xa75e
+push edx
+push ref_000220be  ; push 0x220be
+push 0x275
+push ref_00022106  ; push 0x22106
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000a75e:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0000a78d  ; je 0xa78d
+mov eax, ebx
+and eax, 0x1c00
+cmp eax, 0x1400
+jbe short loc_0000a78d  ; jbe 0xa78d
+push eax
+push ref_00022154  ; push 0x22154
+push 0x276
+push ref_00022106  ; push 0x22106
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000a78d:
+mov cx, word [esi]
+mov eax, ecx
+and ecx, 0x1c00
+sar ecx, 0xa
+and eax, 0x3ff
+lea ecx, [ecx + ecx*4]
+shl eax, cl
+test eax, eax
+je short loc_0000a7c5  ; je 0xa7c5
+mov ecx, ebx
+mov edx, ebx
+and ecx, 0x1c00
+and edx, 0x3ff
+sar ecx, 0xa
+lea ecx, [ecx + ecx*4]
+shl edx, cl
+cmp eax, edx
+jle short loc_0000a7c8  ; jle 0xa7c8
+
+loc_0000a7c5:
+mov word [esi], bx
+
+loc_0000a7c8:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000a7cf:
+push ebp
+mov ecx, 4
+mov ebp, esp
+push edi
+push esi
+mov esi, ref_000203f8  ; mov esi, 0x203f8
+push ebx
+sub esp, 0x6c
+mov eax, dword [ebp + 0x28]
+mov ebx, dword [ebp + 0x10]
+lea edi, [ebp - 0x28]
+rep movsd  ; rep movsd dword es:[edi], dword ptr [esi]
+mov word [ebp - 0x6a], ax
+mov al, byte [ebp + 0x4c]
+mov byte [ebp - 0x58], bl
+mov byte [ebp - 0x6c], al
+call fcn_0001bfbb  ; call 0x1bfbb
+mov dword [ebp - 0x3c], 0
+mov dword [ebp - 0x5c], eax
+movzx eax, bl
+lea edi, [eax + 1]
+mov dword [ebp - 0x64], edi
+shl dword [ebp - 0x64], 8
+or dword [ebp - 0x64], eax
+mov dword [ebp - 0x54], eax
+movzx eax, word [ebp - 0x6a]
+mov dword [ebp - 0x70], eax
+add eax, 4
+mov dword [ebp - 0x74], eax
+
+loc_0000a829:
+push eax
+push 0
+push dword [ebp - 0x3c]
+push dword [ebp - 0x54]
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+mov ebx, eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_0000a858  ; jne 0xa858
+
+loc_0000a848:
+inc dword [ebp - 0x3c]
+cmp dword [ebp - 0x3c], 0x20
+jne short loc_0000a829  ; jne 0xa829
+xor eax, eax
+jmp near loc_0000b012  ; jmp 0xb012
+
+loc_0000a858:
+sub esp, 0xc
+add ebx, 0xe
+push ebx
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x57], 0
+mov byte [ebp - 0x55], al
+sar byte [ebp - 0x55], 7
+and byte [ebp - 0x55], 7
+
+loc_0000a876:
+movzx ebx, byte [ebp - 0x57]
+push edi
+mov esi, dword [ebp - 0x54]
+push ebx
+push dword [ebp - 0x3c]
+push esi
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+mov edi, eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+je near loc_0000aff2  ; je 0xaff2
+push 0x10
+push ebx
+push dword [ebp - 0x3c]
+push esi
+call fcn_00009fd5  ; call 0x9fd5
+add esp, 0x10
+mov byte [ebp - 0x60], al
+test al, al
+je near loc_0000b006  ; je 0xb006
+sub esp, 0xc
+push edi
+call fcn_00017dc2  ; call 0x17dc2
+mov word [ebp - 0x46], ax
+lea eax, [edi + 2]
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+mov word [ebp - 0x48], ax
+lea eax, [edi + 8]
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+cmp dword [ebp - 0x5c], 2
+mov byte [ebp - 0x56], al
+jne near loc_0000aa0c  ; jne 0xaa0c
+call fcn_0001c0bd  ; call 0x1c0bd
+cmp eax, 2
+jne short loc_0000a92d  ; jne 0xa92d
+cmp word [ebp - 0x46], 0x8086
+jne short loc_0000a92d  ; jne 0xa92d
+sub esp, 0xc
+lea eax, [edi + 0xa]
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+cmp ax, 0x280
+jne short loc_0000a92d  ; jne 0xa92d
+mov eax, dword [ebp + 8]
+push esi
+push esi
+push 0xfc
+add eax, 0x418
+push eax
+call fcn_0001875d  ; call 0x1875d
+add esp, 0x10
+
+loc_0000a92d:
+mov eax, dword [ebp - 0x48]
+xor ecx, ecx
+sub ax, 0x8b1
+mov word [ebp - 0x40], ax
+
+loc_0000a93a:
+movzx edx, cl
+cmp edx, dword [ebp + 0x14]
+jae short loc_0000a9b3  ; jae 0xa9b3
+imul edx, edx, 0x18
+add edx, dword [ebp + 0x18]
+mov esi, edx
+test byte [edx + 8], 2
+je short loc_0000a9b0  ; je 0xa9b0
+mov ax, word [ebp - 0x46]
+cmp ax, word [edx]
+jne short loc_0000a9b0  ; jne 0xa9b0
+mov eax, dword [ebp - 0x48]
+cmp ax, word [edx + 2]
+jne short loc_0000a9b0  ; jne 0xa9b0
+mov al, byte [edx + 4]
+cmp byte [ebp - 0x56], al
+je short loc_0000a96e  ; je 0xa96e
+inc al
+jne short loc_0000a9b0  ; jne 0xa9b0
+
+loc_0000a96e:
+cmp word [ebp - 0x46], 0x8086
+je short loc_0000a98b  ; je 0xa98b
+
+loc_0000a976:
+mov ax, word [esi + 0xa]
+mov ecx, dword [esi + 0xc]
+mov word [ebp - 0x40], ax
+mov dword [ebp - 0x50], ecx
+test ax, ax
+jne short loc_0000a9e2  ; jne 0xa9e2
+jmp short loc_0000a9ba  ; jmp 0xa9ba
+
+loc_0000a98b:
+cmp word [ebp - 0x40], 3
+mov dword [ebp - 0x44], ecx
+ja short loc_0000a976  ; ja 0xa976
+movzx eax, word [esi + 0xa]
+sub esp, 0xc
+add eax, edi
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov ecx, dword [ebp - 0x44]
+cmp ax, 0xcafe
+je short loc_0000a976  ; je 0xa976
+
+loc_0000a9b0:
+inc ecx
+jmp short loc_0000a93a  ; jmp 0xa93a
+
+loc_0000a9b3:
+mov dword [ebp - 0x50], 0x1f
+
+loc_0000a9ba:
+push 0x1e
+push ebx
+push dword [ebp - 0x3c]
+push dword [ebp - 0x54]
+call fcn_0000a073  ; call 0xa073
+add esp, 0x10
+mov dword [ebp - 0x44], 0
+mov dword [ebp - 0x4c], 0
+mov word [ebp - 0x40], ax
+test ax, ax
+je short loc_0000aa27  ; je 0xaa27
+
+loc_0000a9e2:
+mov eax, dword [ebp - 0x74]
+sub esp, 0xc
+add eax, dword [ebp + 8]
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [ebp - 0x4c], eax
+movzx eax, word [ebp - 0x40]
+lea eax, [edi + eax + 4]
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov dword [ebp - 0x44], eax
+jmp short loc_0000aa27  ; jmp 0xaa27
+
+loc_0000aa0c:
+mov dword [ebp - 0x50], 0x1f
+mov dword [ebp - 0x44], 0
+mov dword [ebp - 0x4c], 0
+mov word [ebp - 0x40], 0
+
+loc_0000aa27:
+movzx esi, byte [ebp - 0x60]
+sub esp, 0xc
+add esi, edi
+lea eax, [esi + 0x24]
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+and eax, 0x800
+mov dword [ebp - 0x60], eax
+je short loc_0000aa4f  ; je 0xaa4f
+mov eax, dword [ebp + 0x3c]
+cmp byte [eax + 0x12], 1
+je short loc_0000aa55  ; je 0xaa55
+
+loc_0000aa4f:
+mov eax, dword [ebp + 0x48]
+mov byte [eax], 0
+
+loc_0000aa55:
+cmp dword [ebp + 0x20], 1
+ja near loc_0000ad5b  ; ja 0xad5b
+lea eax, [esi + 0xc]
+sub esp, 0xc
+push eax
+mov dword [ebp - 0x60], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test eax, 0x40000
+jne short loc_0000aa7e  ; jne 0xaa7e
+mov eax, dword [ebp + 0x44]
+mov byte [eax], 0
+
+loc_0000aa7e:
+sub esp, 0xc
+push dword [ebp - 0x60]
+call fcn_00017dc2  ; call 0x17dc2
+mov ebx, eax
+call fcn_00015479  ; call 0x15479
+shr bx, 0xa
+add esp, 0x10
+and ebx, 3
+test al, al
+je short loc_0000aab4  ; je 0xaab4
+movzx eax, bx
+push eax
+push dword [ebp - 0x3c]
+push ref_0002219b  ; push 0x2219b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000aab4:
+cmp dword [ebp + 0x20], 0
+jne near loc_0000ac13  ; jne 0xac13
+lea eax, [esi + 4]
+sub esp, 0xc
+push eax
+mov dword [ebp - 0x68], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test ax, ax
+js short loc_0000aaf5  ; js 0xaaf5
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000aaef  ; je 0xaaef
+push ecx
+push ecx
+push ref_000221c5  ; push 0x221c5
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000aaef:
+mov eax, dword [ebp + 0x40]
+mov byte [eax], 1
+
+loc_0000aaf5:
+sub esp, 0xc
+xor esi, esi
+lea eax, [edi + 0xb]
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+mov byte [ebp - 0x6b], al
+lea eax, [edi + 0xa]
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+
+loc_0000ab14:
+mov ecx, esi
+movzx edx, cl
+cmp edx, dword [ebp + 0x14]
+jae short loc_0000ab71  ; jae 0xab71
+imul edx, edx, 0x18
+add edx, dword [ebp + 0x18]
+test byte [edx + 8], 1
+je short loc_0000ab6e  ; je 0xab6e
+mov cx, word [edx]
+cmp cx, word [ebp - 0x46]
+je short loc_0000ab37  ; je 0xab37
+inc cx
+jne short loc_0000ab6e  ; jne 0xab6e
+
+loc_0000ab37:
+mov cx, word [edx + 2]
+cmp cx, word [ebp - 0x48]
+je short loc_0000ab45  ; je 0xab45
+inc cx
+jne short loc_0000ab6e  ; jne 0xab6e
+
+loc_0000ab45:
+mov cl, byte [edx + 4]
+cmp cl, byte [ebp - 0x56]
+je short loc_0000ab51  ; je 0xab51
+inc cl
+jne short loc_0000ab6e  ; jne 0xab6e
+
+loc_0000ab51:
+mov cl, byte [edx + 5]
+cmp cl, byte [ebp - 0x6b]
+je short loc_0000ab5d  ; je 0xab5d
+inc cl
+jne short loc_0000ab6e  ; jne 0xab6e
+
+loc_0000ab5d:
+mov cl, byte [edx + 6]
+cmp cl, al
+jne short loc_0000ab6a  ; jne 0xab6a
+
+loc_0000ab64:
+movzx ebx, byte [edx + 7]
+jmp short loc_0000ab71  ; jmp 0xab71
+
+loc_0000ab6a:
+inc cl
+je short loc_0000ab64  ; je 0xab64
+
+loc_0000ab6e:
+inc esi
+jmp short loc_0000ab14  ; jmp 0xab14
+
+loc_0000ab71:
+test bl, 2
+je short loc_0000abc2  ; je 0xabc2
+mov ecx, dword [ebp + 0xc]
+sub esp, 0xc
+mov eax, dword [ebp + 8]
+lea eax, [eax + ecx + 0xc]
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+pop ecx
+push dword [ebp - 0x60]
+mov esi, eax
+call fcn_00017e4e  ; call 0x17e4e
+and esi, 0x38000
+pop edx
+push dword [ebp - 0x68]
+and eax, 0x38000
+cmp eax, esi
+cmovae esi, eax
+call fcn_00017e4e  ; call 0x17e4e
+shr esi, 6
+mov edx, ebx
+and edx, 0xfffffffd
+add esp, 0x10
+and eax, 0xe00
+cmp esi, eax
+cmova ebx, edx
+
+loc_0000abc2:
+test bl, 1
+je short loc_0000ac13  ; je 0xac13
+mov ecx, dword [ebp + 0xc]
+sub esp, 0xc
+mov eax, dword [ebp + 8]
+lea eax, [eax + ecx + 0xc]
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+mov esi, eax
+pop eax
+and esi, 0x7000
+push dword [ebp - 0x60]
+call fcn_00017e4e  ; call 0x17e4e
+pop edx
+push dword [ebp - 0x68]
+and eax, 0x7000
+cmp eax, esi
+cmovae esi, eax
+call fcn_00017e4e  ; call 0x17e4e
+shr esi, 6
+mov edx, ebx
+and edx, 0xfffffffe
+add esp, 0x10
+and eax, 0x1c0
+cmp esi, eax
+cmova ebx, edx
+
+loc_0000ac13:
+mov eax, dword [ebp + 0x1c]
+and word [eax], bx
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ac38  ; je 0xac38
+movzx ebx, bx
+push ebx
+push dword [ebp - 0x3c]
+push ref_000221f8  ; push 0x221f8
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ac38:
+cmp dword [ebp - 0x5c], 2
+jne short loc_0000acb8  ; jne 0xacb8
+cmp word [ebp - 0x40], 0
+je short loc_0000acb8  ; je 0xacb8
+cmp word [ebp - 0x6a], 0
+je short loc_0000acb8  ; je 0xacb8
+mov eax, dword [ebp - 0x4c]
+and eax, 0x1f
+cmp eax, 0x1f
+jne short loc_0000acb8  ; jne 0xacb8
+mov ecx, dword [ebp - 0x50]
+mov eax, dword [ebp - 0x44]
+and eax, ecx
+cmp eax, ecx
+jne short loc_0000acb8  ; jne 0xacb8
+mov eax, dword [ebp + 0x3c]
+cmp byte [eax + 0x11], 0
+je short loc_0000acb8  ; je 0xacb8
+mov eax, dword [ebp + 0x2c]
+mov ebx, dword [ebp + 0x30]
+mov byte [eax], 1
+mov eax, dword [ebp - 0x44]
+mov edx, eax
+mov ecx, eax
+shr edx, 0x10
+movzx eax, ah
+shr ecx, 0x13
+and edx, 3
+and ecx, 0x1f
+cmp eax, dword [ebx]
+jbe short loc_0000ac91  ; jbe 0xac91
+mov dword [ebx], eax
+
+loc_0000ac91:
+mov eax, dword [ebp + 0x38]
+movzx edx, dl
+movzx ecx, cl
+mov ebx, dword [ebp + edx*4 - 0x28]
+mov esi, dword [ebp + 0x34]
+mov eax, dword [eax]
+imul ebx, ecx
+mov eax, dword [ebp + eax*4 - 0x28]
+imul eax, dword [esi]
+cmp ebx, eax
+jbe short loc_0000acb8  ; jbe 0xacb8
+mov eax, dword [ebp + 0x38]
+mov dword [esi], ecx
+mov dword [eax], edx
+
+loc_0000acb8:
+mov eax, dword [ebp + 0x24]
+xor edx, edx
+mov ebx, dword [eax]
+
+loc_0000acbf:
+movzx esi, dl
+cmp esi, dword [ebp + 0x14]
+jae near loc_0000af08  ; jae 0xaf08
+imul esi, esi, 0x18
+add esi, dword [ebp + 0x18]
+test byte [esi + 8], 4
+je short loc_0000ad55  ; je 0xad55
+mov ax, word [ebp - 0x46]
+cmp word [esi], ax
+jne short loc_0000ad55  ; jne 0xad55
+mov ax, word [esi + 2]
+cmp ax, word [ebp - 0x48]
+je short loc_0000acee  ; je 0xacee
+inc ax
+jne short loc_0000ad55  ; jne 0xad55
+
+loc_0000acee:
+mov al, byte [esi + 4]
+cmp al, byte [ebp - 0x56]
+jne short loc_0000ad25  ; jne 0xad25
+
+loc_0000acf6:
+movzx eax, word [esi + 0x12]
+test ax, ax
+jns short loc_0000ad2b  ; jns 0xad2b
+push ecx
+mov edx, ebx
+push ecx
+movzx ebx, bx
+push eax
+lea eax, [ebp - 0x2a]
+push eax
+shr edx, 0x10
+mov word [ebp - 0x2a], dx
+call fcn_0000a723  ; call 0xa723
+movzx eax, word [ebp - 0x2a]
+add esp, 0x10
+shl eax, 0x10
+or ebx, eax
+jmp short loc_0000ad2b  ; jmp 0xad2b
+
+loc_0000ad25:
+inc al
+jne short loc_0000ad55  ; jne 0xad55
+jmp short loc_0000acf6  ; jmp 0xacf6
+
+loc_0000ad2b:
+movzx eax, word [esi + 0x10]
+test ax, ax
+jns short loc_0000ad4b  ; jns 0xad4b
+push edx
+push edx
+push eax
+lea eax, [ebp - 0x2a]
+push eax
+mov word [ebp - 0x2a], bx
+call fcn_0000a723  ; call 0xa723
+mov bx, word [ebp - 0x2a]
+add esp, 0x10
+
+loc_0000ad4b:
+mov eax, dword [ebp + 0x24]
+mov dword [eax], ebx
+jmp near loc_0000af08  ; jmp 0xaf08
+
+loc_0000ad55:
+inc edx
+jmp near loc_0000acbf  ; jmp 0xacbf
+
+loc_0000ad5b:
+cmp dword [ebp + 0x20], 2
+jne near loc_0000af08  ; jne 0xaf08
+cmp dword [ebp - 0x5c], 2
+jne near loc_0000ae28  ; jne 0xae28
+cmp word [ebp - 0x40], 0
+je near loc_0000ae28  ; je 0xae28
+mov eax, dword [ebp + 0x2c]
+cmp byte [eax], 0
+je near loc_0000ae28  ; je 0xae28
+mov eax, dword [ebp - 0x4c]
+and eax, 0x1f
+cmp eax, 0x1f
+jne near loc_0000ae28  ; jne 0xae28
+mov eax, dword [ebp - 0x44]
+mov ecx, dword [ebp - 0x50]
+and eax, ecx
+cmp eax, ecx
+jne near loc_0000ae28  ; jne 0xae28
+push eax
+mov eax, dword [ebp + 0x34]
+movzx edx, word [ebp - 0x40]
+mov eax, dword [eax]
+add edx, edi
+lea ecx, [edx + 0xc]
+mov dword [ebp - 0x44], edx
+shl eax, 3
+push eax
+push 0xffffff07
+push ecx
+mov dword [ebp - 0x40], ecx
+call fcn_00018b68  ; call 0x18b68
+mov eax, dword [ebp + 0x38]
+add esp, 0xc
+mov ecx, dword [ebp - 0x40]
+push dword [eax]
+push 0xfffffffffffffffc
+push ecx
+call fcn_00018b68  ; call 0x18b68
+mov edx, dword [ebp - 0x44]
+add esp, 0xc
+push 0x40a00000
+push 0x1c00ffff
+add edx, 8
+push edx
+mov dword [ebp - 0x40], edx
+call fcn_00018b68  ; call 0x18b68
+mov eax, dword [ebp + 0x3c]
+add esp, 0x10
+mov edx, dword [ebp - 0x40]
+mov al, byte [eax + 0x11]
+cmp al, 1
+je short loc_0000ae16  ; je 0xae16
+cmp al, 2
+setne al
+movzx eax, al
+lea eax, [eax + eax + 0xd]
+jmp short loc_0000ae1b  ; jmp 0xae1b
+
+loc_0000ae16:
+mov eax, 0xe
+
+loc_0000ae1b:
+push ecx
+push eax
+push 0xffffffffffffffe0
+push edx
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_0000ae28:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ae4a  ; je 0xae4a
+mov eax, dword [ebp + 0x1c]
+movzx eax, word [eax]
+push eax
+push dword [ebp - 0x3c]
+push ref_00022227  ; push 0x22227
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ae4a:
+push eax
+mov eax, dword [ebp + 0x1c]
+movzx eax, word [eax]
+push eax
+push 0xfffc
+lea eax, [esi + 0x10]
+push eax
+call fcn_00018981  ; call 0x18981
+add esp, 0x10
+cmp dword [ebp - 0x60], 0
+je short loc_0000ae85  ; je 0xae85
+mov eax, dword [ebp + 0x3c]
+cmp byte [eax + 0x12], 1
+jne short loc_0000ae85  ; jne 0xae85
+push ecx
+add esi, 0x28
+push ecx
+push 0x400
+push esi
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+
+loc_0000ae85:
+push 0x18
+push ebx
+push dword [ebp - 0x3c]
+push dword [ebp - 0x54]
+call fcn_0000a073  ; call 0xa073
+add esp, 0x10
+movzx ebx, ax
+test bx, bx
+je short loc_0000af08  ; je 0xaf08
+mov eax, dword [ebp + 0x24]
+lea esi, [ebp - 0x2a]
+add ebx, edi
+mov edx, dword [eax]
+mov eax, dword [ebp + 0x3c]
+mov word [ebp - 0x2a], dx
+movzx eax, word [eax + 0x14]
+mov dword [ebp - 0x40], edx
+push edx
+push edx
+push eax
+push esi
+call fcn_0000a723  ; call 0xa723
+movzx eax, word [ebp - 0x2a]
+add esp, 0xc
+push eax
+push 0xe000
+lea eax, [ebx + 4]
+add ebx, 6
+push eax
+call fcn_00018981  ; call 0x18981
+mov eax, dword [ebp + 0x3c]
+mov edx, dword [ebp - 0x40]
+pop ecx
+movzx eax, word [eax + 0x16]
+shr edx, 0x10
+mov word [ebp - 0x2a], dx
+pop edx
+push eax
+push esi
+call fcn_0000a723  ; call 0xa723
+movzx eax, word [ebp - 0x2a]
+add esp, 0xc
+push eax
+push 0xe000
+push ebx
+call fcn_00018981  ; call 0x18981
+add esp, 0x10
+
+loc_0000af08:
+sub esp, 0xc
+lea eax, [edi + 0xb]
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+cmp al, 6
+jne near loc_0000aff2  ; jne 0xaff2
+sub esp, 0xc
+mov bl, 1
+lea eax, [edi + 0x19]
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, al
+jne short loc_0000af72  ; jne 0xaf72
+mov eax, dword [ebp + 8]
+sub esp, 0xc
+add eax, 0x1a
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+mov bl, byte [ebp - 0x58]
+add esp, 0x10
+cmp al, bl
+jbe near loc_0000b00d  ; jbe 0xb00d
+movzx eax, al
+shl eax, 0x10
+or eax, dword [ebp - 0x64]
+push esi
+push eax
+push 0xff000000
+lea eax, [edi + 0x18]
+push eax
+call fcn_00018b68  ; call 0x18b68
+mov al, bl
+add esp, 0x10
+inc eax
+xor ebx, ebx
+
+loc_0000af72:
+cmp al, byte [ebp - 0x58]
+jbe short loc_0000aff2  ; jbe 0xaff2
+movzx esi, al
+movzx eax, byte [ebp - 0x6c]
+push ecx
+push ecx
+push eax
+push dword [ebp + 0x48]
+push dword [ebp + 0x44]
+push dword [ebp + 0x40]
+push dword [ebp + 0x3c]
+push dword [ebp + 0x38]
+push dword [ebp + 0x34]
+push dword [ebp + 0x30]
+push dword [ebp + 0x2c]
+push dword [ebp - 0x70]
+push dword [ebp + 0x24]
+push dword [ebp + 0x20]
+push dword [ebp + 0x1c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push esi
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_0000a7cf  ; call 0xa7cf
+add esp, 0x50
+cmp eax, 0x8000000e
+jne short loc_0000afdb  ; jne 0xafdb
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000afdb  ; je 0xafdb
+push edx
+push esi
+push ref_00022254  ; push 0x22254
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000afdb:
+test bl, bl
+jne short loc_0000aff2  ; jne 0xaff2
+push eax
+push eax
+push 0xff000000
+lea eax, [edi + 0x18]
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+
+loc_0000aff2:
+inc byte [ebp - 0x57]
+mov al, byte [ebp - 0x55]
+cmp byte [ebp - 0x57], al
+jbe near loc_0000a876  ; jbe 0xa876
+jmp near loc_0000a848  ; jmp 0xa848
+
+loc_0000b006:
+mov eax, 0x8000000e
+jmp short loc_0000b012  ; jmp 0xb012
+
+loc_0000b00d:
+mov eax, 0x80000009
+
+loc_0000b012:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000b01a:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x60
+mov edx, dword [ebp + 0x1c]
+mov ecx, dword [ebp + 0x20]
+mov eax, dword [ebp + 0xc]
+push 0
+mov ebx, dword [ebp + 8]
+push 0x1f
+mov edi, dword [ebp + 0x10]
+push 0
+mov dword [ebp - 0x58], edx
+mov edx, dword [ebp + 0x2c]
+mov dword [ebp - 0x5c], ecx
+mov dword [ebp - 0x40], eax
+mov dword [ebp - 0x60], edx
+call fcn_00016c9a  ; call 0x16c9a
+mov esi, eax
+call fcn_0001bfbb  ; call 0x1bfbb
+mov ecx, edi
+add esp, 0xc
+movzx ecx, cl
+movzx edi, bl
+push ecx
+mov ebx, 0x8000000e
+mov dword [ebp - 0x3c], ecx
+movzx ecx, byte [ebp - 0x40]
+mov dword [ebp - 0x54], edi
+mov dword [ebp - 0x48], eax
+push ecx
+push edi
+mov dword [ebp - 0x50], ecx
+call fcn_00016c9a  ; call 0x16c9a
+mov edi, eax
+lea eax, [esi + 0xf0]
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov ecx, dword [ebp + 0x28]
+mov edx, dword [ebp + 0x34]
+mov dword [ebp - 0x24], 0
+mov dword [ebp - 0x20], 0
+mov byte [ecx], 0
+mov byte [edx], 0
+mov dword [ebp - 0x40], eax
+mov dword [esp], edi
+mov dword [ebp - 0x1c], 0
+mov byte [ebp - 0x29], 0
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+je near loc_0000b2d9  ; je 0xb2d9
+cmp dword [ebp - 0x48], 2
+jne short loc_0000b113  ; jne 0xb113
+sub esp, 0xc
+lea eax, [esi + 0x48]
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+mov esi, dword [ebp - 0x40]
+and esi, 0xffffc000
+mov ebx, eax
+pop eax
+and ebx, 0xfffc
+pop edx
+push dword [ebp - 0x3c]
+push esi
+call fcn_0001c3cb  ; call 0x1c3cb
+movzx eax, al
+lea eax, [ebx + eax*8 + 0x190]
+mov dword [esp], eax
+call fcn_00018f64  ; call 0x18f64
+add esp, 0x10
+test al, 1
+jne short loc_0000b113  ; jne 0xb113
+mov eax, dword [ebp + 0x34]
+mov byte [eax], 1
+
+loc_0000b113:
+push 0x10
+push dword [ebp - 0x3c]
+push dword [ebp - 0x50]
+push dword [ebp - 0x54]
+call fcn_00009fd5  ; call 0x9fd5
+add esp, 0x10
+movzx eax, al
+mov dword [ebp - 0x4c], eax
+test eax, eax
+jne short loc_0000b15c  ; jne 0xb15c
+call fcn_00015480  ; call 0x15480
+mov ebx, 0x80000003
+test al, al
+je near loc_0000b2d9  ; je 0xb2d9
+push esi
+push ref_00022281  ; push 0x22281
+push 0x4f7
+push ref_00022106  ; push 0x22106
+call fcn_0001548c  ; call 0x1548c
+jmp near loc_0000b2d6  ; jmp 0xb2d6
+
+loc_0000b15c:
+mov eax, dword [ebp - 0x4c]
+sub esp, 0xc
+lea esi, [eax + edi]
+lea eax, [esi + 0x24]
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+lea eax, [esi + 0xc]
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+mov ecx, dword [ebp + 0x30]
+add esp, 0x10
+mov edx, dword [ebp + 0x24]
+shr ax, 0xa
+and eax, 3
+mov word [ecx], ax
+mov dl, byte [edx + 0x10]
+cmp dl, 4
+je short loc_0000b1a2  ; je 0xb1a2
+and eax, edx
+mov word [ecx], ax
+mov dword [ebp - 0x40], 1
+jmp short loc_0000b1a9  ; jmp 0xb1a9
+
+loc_0000b1a2:
+mov dword [ebp - 0x40], 0
+
+loc_0000b1a9:
+sub esp, 0xc
+lea eax, [edi + 0x19]
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x41], 1
+mov bl, al
+test al, al
+jne short loc_0000b1eb  ; jne 0xb1eb
+mov ebx, dword [ebp - 0x58]
+movzx edx, byte [ebp - 0x5c]
+push ecx
+movzx eax, bl
+shl edx, 0x10
+shl eax, 8
+or eax, edx
+push eax
+push 0xff0000ff
+lea eax, [edi + 0x18]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+mov byte [ebp - 0x41], 0
+
+loc_0000b1eb:
+sub esp, 0xc
+add esi, 0x1a
+push esi
+xor esi, esi
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+cmp dword [ebp - 0x48], 2
+mov dword [ebp - 0x28], 0
+mov word [ebp - 0x58], ax
+jne short loc_0000b26b  ; jne 0xb26b
+push 0x1e
+push dword [ebp - 0x3c]
+push dword [ebp - 0x50]
+push dword [ebp - 0x54]
+call fcn_0000a073  ; call 0xa073
+add esp, 0x10
+mov esi, eax
+test ax, ax
+je short loc_0000b26b  ; je 0xb26b
+movzx eax, ax
+sub esp, 0xc
+lea edx, [edi + eax + 4]
+push edx
+mov dword [ebp - 0x3c], edx
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, dword [ebp - 0x3c]
+mov dword [esp], edx
+movzx eax, ah
+mov dword [ebp - 0x24], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, dword [ebp - 0x3c]
+mov dword [esp], edx
+shr eax, 0x10
+and eax, 3
+mov dword [ebp - 0x1c], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+shr eax, 0x13
+and eax, 0x1f
+mov dword [ebp - 0x20], eax
+
+loc_0000b26b:
+xor eax, eax
+test bl, bl
+je short loc_0000b2be  ; je 0xb2be
+test byte [ebp - 0x58], 0x40
+je short loc_0000b2be  ; je 0xb2be
+movzx eax, byte [ebp - 0x60]
+movzx ecx, si
+movzx ebx, bl
+push edx
+push edx
+push eax
+push dword [ebp + 0x38]
+push dword [ebp + 0x34]
+lea eax, [ebp - 0x29]
+push eax
+push dword [ebp + 0x24]
+lea eax, [ebp - 0x1c]
+push eax
+lea eax, [ebp - 0x20]
+push eax
+lea eax, [ebp - 0x24]
+push eax
+push dword [ebp + 0x28]
+lea eax, [ebp - 0x28]
+push ecx
+push eax
+push dword [ebp - 0x40]
+push dword [ebp + 0x30]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push ebx
+push dword [ebp - 0x4c]
+push edi
+call fcn_0000a7cf  ; call 0xa7cf
+add esp, 0x50
+
+loc_0000b2be:
+cmp byte [ebp - 0x41], 0
+mov ebx, eax
+jne short loc_0000b2d9  ; jne 0xb2d9
+push eax
+add edi, 0x18
+push eax
+push 0xff0000ff
+push edi
+call fcn_00018b3e  ; call 0x18b3e
+
+loc_0000b2d6:
+add esp, 0x10
+
+loc_0000b2d9:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000b2e3:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x70
+mov ecx, dword [ebp + 0x1c]
+mov eax, dword [ebp + 8]
+push 0
+mov esi, dword [ebp + 0xc]
+push 0x1f
+mov edi, dword [ebp + 0x10]
+push 0
+mov dword [ebp - 0x40], ecx
+mov ecx, dword [ebp + 0x20]
+mov dword [ebp - 0x3c], eax
+mov dword [ebp - 0x58], ecx
+mov ecx, dword [ebp + 0x2c]
+mov dword [ebp - 0x5c], ecx
+mov ecx, dword [ebp + 0x30]
+mov dword [ebp - 0x68], ecx
+mov ecx, dword [ebp + 0x34]
+mov dword [ebp - 0x6c], ecx
+mov ecx, dword [ebp + 0x3c]
+mov dword [ebp - 0x70], ecx
+call fcn_00016c9a  ; call 0x16c9a
+mov ebx, eax
+call fcn_0001bfbb  ; call 0x1bfbb
+add esp, 0xc
+mov dword [ebp - 0x44], eax
+mov eax, edi
+movzx edi, al
+mov eax, esi
+push edi
+movzx eax, al
+push eax
+mov dword [ebp - 0x60], eax
+movzx eax, byte [ebp - 0x3c]
+push eax
+mov dword [ebp - 0x64], eax
+call fcn_00016c9a  ; call 0x16c9a
+mov esi, eax
+lea eax, [ebx + 0xf0]
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [ebp - 0x28], 0
+mov dword [ebp - 0x24], 0
+mov dword [ebp - 0x20], 0
+mov byte [ebp - 0x30], 0
+mov byte [ebp - 0x31], 0
+mov dword [ebp - 0x48], eax
+mov eax, dword [ebp + 0x28]
+and dword [ebp - 0x48], 0xffffc000
+mov byte [eax], 0
+mov dword [esp], esi
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_0000b3bb  ; jne 0xb3bb
+call fcn_00015480  ; call 0x15480
+mov ebx, 0x8000000e
+test al, al
+je near loc_0000b969  ; je 0xb969
+push ecx
+push ref_00022281  ; push 0x22281
+push 0x5ca
+jmp short loc_0000b435  ; jmp 0xb435
+
+loc_0000b3bb:
+cmp dword [ebp - 0x44], 2
+jne short loc_0000b3fd  ; jne 0xb3fd
+sub esp, 0xc
+add ebx, 0x48
+push ebx
+call fcn_00017dc2  ; call 0x17dc2
+mov ebx, eax
+pop eax
+and ebx, 0xfffc
+pop edx
+push edi
+push dword [ebp - 0x48]
+call fcn_0001c3cb  ; call 0x1c3cb
+movzx eax, al
+lea eax, [ebx + eax*8 + 0x190]
+mov dword [esp], eax
+call fcn_00018f64  ; call 0x18f64
+add esp, 0x10
+test al, 1
+jne short loc_0000b3fd  ; jne 0xb3fd
+mov byte [ebp - 0x31], 1
+
+loc_0000b3fd:
+push 0x10
+push edi
+push dword [ebp - 0x60]
+push dword [ebp - 0x64]
+call fcn_00009fd5  ; call 0x9fd5
+add esp, 0x10
+movzx eax, al
+mov dword [ebp - 0x50], eax
+test eax, eax
+jne short loc_0000b447  ; jne 0xb447
+call fcn_00015480  ; call 0x15480
+mov ebx, 0x80000003
+test al, al
+je near loc_0000b969  ; je 0xb969
+push eax
+push ref_00022281  ; push 0x22281
+push 0x5dc
+
+loc_0000b435:
+push ref_00022106  ; push 0x22106
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+jmp near loc_0000b969  ; jmp 0xb969
+
+loc_0000b447:
+mov eax, dword [ebp - 0x50]
+sub esp, 0xc
+add eax, esi
+mov dword [ebp - 0x4c], eax
+add eax, 0x24
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test ah, 8
+je short loc_0000b482  ; je 0xb482
+mov eax, dword [ebp + 0x24]
+cmp byte [eax + 0x12], 1
+jne short loc_0000b482  ; jne 0xb482
+push eax
+push eax
+mov eax, dword [ebp - 0x4c]
+push 0x400
+add eax, 0x28
+push eax
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+
+loc_0000b482:
+mov eax, dword [ebp - 0x4c]
+sub esp, 0xc
+add eax, 0xc
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+mov ecx, dword [ebp + 0x24]
+add esp, 0x10
+mov dl, byte [ecx + 0x10]
+shr ax, 0xa
+and eax, 3
+mov word [ebp - 0x2e], ax
+cmp dl, 4
+je short loc_0000b4b7  ; je 0xb4b7
+and eax, edx
+mov ebx, 1
+mov word [ebp - 0x2e], ax
+jmp short loc_0000b4b9  ; jmp 0xb4b9
+
+loc_0000b4b7:
+xor ebx, ebx
+
+loc_0000b4b9:
+sub esp, 0xc
+lea eax, [esi + 0x19]
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x51], 1
+mov byte [ebp - 0x3c], al
+test al, al
+jne short loc_0000b500  ; jne 0xb500
+movzx edx, byte [ebp - 0x58]
+push eax
+movzx eax, byte [ebp - 0x40]
+shl edx, 0x10
+shl eax, 8
+or eax, edx
+push eax
+push 0xff0000ff
+lea eax, [esi + 0x18]
+push eax
+call fcn_00018b68  ; call 0x18b68
+mov al, byte [ebp - 0x40]
+add esp, 0x10
+mov byte [ebp - 0x51], 0
+mov byte [ebp - 0x3c], al
+
+loc_0000b500:
+mov eax, dword [ebp - 0x4c]
+sub esp, 0xc
+add eax, 0x1a
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+cmp dword [ebp - 0x44], 2
+mov dword [ebp - 0x2c], 0
+mov word [ebp - 0x40], 0
+mov word [ebp - 0x58], ax
+jne short loc_0000b57e  ; jne 0xb57e
+push 0x1e
+push edi
+push dword [ebp - 0x60]
+push dword [ebp - 0x64]
+call fcn_0000a073  ; call 0xa073
+add esp, 0x10
+mov word [ebp - 0x40], ax
+test ax, ax
+je short loc_0000b57e  ; je 0xb57e
+movzx eax, ax
+sub esp, 0xc
+lea edi, [esi + eax + 4]
+push edi
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [esp], edi
+movzx eax, ah
+mov dword [ebp - 0x28], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [esp], edi
+shr eax, 0x10
+and eax, 3
+mov dword [ebp - 0x20], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+shr eax, 0x13
+and eax, 0x1f
+mov dword [ebp - 0x24], eax
+
+loc_0000b57e:
+xor edi, edi
+cmp byte [ebp - 0x3c], 0
+je near loc_0000b689  ; je 0xb689
+test byte [ebp - 0x58], 0x40
+je near loc_0000b689  ; je 0xb689
+movzx eax, byte [ebp - 0x5c]
+push edi
+push edi
+push eax
+push dword [ebp + 0x38]
+lea eax, [ebp - 0x31]
+push eax
+lea eax, [ebp - 0x30]
+push eax
+push dword [ebp + 0x24]
+lea eax, [ebp - 0x20]
+push eax
+lea eax, [ebp - 0x24]
+push eax
+lea eax, [ebp - 0x28]
+push eax
+movzx eax, word [ebp - 0x40]
+push dword [ebp + 0x28]
+push eax
+lea eax, [ebp - 0x2c]
+push eax
+push ebx
+lea eax, [ebp - 0x2e]
+push eax
+movzx eax, byte [ebp - 0x3c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push eax
+push dword [ebp - 0x50]
+push esi
+call fcn_0000a7cf  ; call 0xa7cf
+add esp, 0x50
+mov edi, eax
+mov eax, dword [ebp + 0x24]
+cmp byte [eax + 0x12], 1
+jne near loc_0000b689  ; jne 0xb689
+cmp byte [eax + 0x18], 1
+jne short loc_0000b610  ; jne 0xb610
+mov ecx, dword [ebp + 0x24]
+mov eax, dword [ebp - 0x2c]
+movzx edx, word [ecx + 0x1a]
+xor ax, ax
+or eax, edx
+movzx edx, byte [ecx + 0x19]
+or ah, 0x80
+shl edx, 0xa
+or eax, edx
+mov dword [ebp - 0x2c], eax
+
+loc_0000b610:
+mov eax, dword [ebp + 0x24]
+cmp byte [eax + 0x1c], 1
+jne short loc_0000b63a  ; jne 0xb63a
+mov ecx, dword [ebp + 0x24]
+movzx eax, word [ebp - 0x2c]
+movzx edx, byte [ecx + 0x1d]
+or eax, 0x80000000
+shl edx, 0x1a
+or eax, edx
+movzx edx, word [ecx + 0x1e]
+shl edx, 0x10
+or eax, edx
+mov dword [ebp - 0x2c], eax
+
+loc_0000b63a:
+mov eax, dword [ebp - 0x2c]
+test eax, eax
+je short loc_0000b689  ; je 0xb689
+push edx
+push edx
+push eax
+lea eax, [esi + 0x400]
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+mov eax, dword [ebp + 0x24]
+pop ecx
+mov ecx, dword [ebp + 0x24]
+pop ebx
+cmp byte [eax + 0x18], 1
+sbb eax, eax
+add eax, 3
+mov edx, eax
+and edx, 0xfffffffd
+cmp byte [ecx + 0x1c], 0
+cmove eax, edx
+mov edx, eax
+or edx, 4
+cmp byte [ecx + 0x13], 1
+cmove eax, edx
+push eax
+lea eax, [esi + 0x404]
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+
+loc_0000b689:
+cmp dword [ebp - 0x44], 2
+jne near loc_0000b882  ; jne 0xb882
+mov eax, dword [ebp + 0x28]
+cmp byte [eax], 0
+je near loc_0000b73b  ; je 0xb73b
+push eax
+mov eax, dword [ebp - 0x28]
+movzx edx, word [ebp - 0x40]
+shl eax, 8
+add edx, esi
+push eax
+lea ebx, [edx + 8]
+push 0xffff00ff
+push ebx
+mov dword [ebp - 0x60], edx
+call fcn_00018b68  ; call 0x18b68
+mov eax, dword [ebp - 0x24]
+add esp, 0xc
+mov edx, dword [ebp - 0x60]
+shl eax, 3
+or eax, dword [ebp - 0x20]
+add edx, 0xc
+push eax
+push 0xffffff04
+push edx
+call fcn_00018b68  ; call 0x18b68
+add esp, 0xc
+push 0x40a00000
+push 0x1c00ffff
+push ebx
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+test byte [ebp - 0x2e], 2
+je short loc_0000b711  ; je 0xb711
+cmp byte [ebp - 0x31], 0
+je short loc_0000b711  ; je 0xb711
+push ecx
+push ecx
+push 1
+lea eax, [esi + 0x420]
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+
+loc_0000b711:
+mov eax, dword [ebp + 0x24]
+mov al, byte [eax + 0x11]
+cmp al, 1
+je short loc_0000b729  ; je 0xb729
+cmp al, 2
+setne al
+movzx eax, al
+lea eax, [eax + eax + 0xd]
+jmp short loc_0000b72e  ; jmp 0xb72e
+
+loc_0000b729:
+mov eax, 0xe
+
+loc_0000b72e:
+push edx
+push eax
+push 0xffffffffffffffe0
+push ebx
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_0000b73b:
+test byte [ebp - 0x2e], 2
+je near loc_0000b882  ; je 0xb882
+cmp byte [ebp - 0x31], 0
+je near loc_0000b882  ; je 0xb882
+mov eax, dword [ebp + 0x28]
+cmp byte [eax], 0
+je short loc_0000b76d  ; je 0xb76d
+push eax
+push eax
+push 0xfffdffff
+lea eax, [esi + 0x420]
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+
+loc_0000b76d:
+push ebx
+push ebx
+push 0x20000000
+lea eax, [esi + 0x420]
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+cmp byte [ebp - 0x68], 0
+je near loc_0000b882  ; je 0xb882
+cmp byte [ebp - 0x6c], 0
+je near loc_0000b882  ; je 0xb882
+mov edi, dword [ebp - 0x48]
+push eax
+push eax
+push 0
+push edi
+call fcn_0001c39f  ; call 0x1c39f
+pop edx
+pop ecx
+lea edx, [ebp - 0x2f]
+push edx
+sub eax, 0x20
+lea edx, [ebp - 0x1c]
+movzx eax, al
+push edx
+push eax
+push 4
+push 0xe00000e0
+push edi
+call fcn_00009ecd  ; call 0x9ecd
+add esp, 0x20
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0000b809  ; je 0xb809
+test ebx, ebx
+jns short loc_0000b809  ; jns 0xb809
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000b7f1  ; je 0xb7f1
+push edi
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000b7f1:
+push ebx
+push ref_000206f4  ; push 0x206f4
+push 0x6b4
+push ref_00022106  ; push 0x22106
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000b809:
+mov edi, dword [ebp - 0x48]
+push eax
+push eax
+push 0
+push edi
+or dword [ebp - 0x1c], 0x4000
+call fcn_0001c39f  ; call 0x1c39f
+pop edx
+pop ecx
+lea edx, [ebp - 0x2f]
+push edx
+sub eax, 0x20
+lea edx, [ebp - 0x1c]
+movzx eax, al
+push edx
+push eax
+push 5
+push 0xe00000e0
+push edi
+call fcn_00009ecd  ; call 0x9ecd
+add esp, 0x20
+mov edi, eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0000b882  ; je 0xb882
+test edi, edi
+jns short loc_0000b882  ; jns 0xb882
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000b86a  ; je 0xb86a
+push eax
+push edi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000b86a:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x6be
+push ref_00022106  ; push 0x22106
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000b882:
+cmp byte [ebp - 0x70], 1
+jne short loc_0000b8a2  ; jne 0xb8a2
+push eax
+movzx eax, word [ebp - 0x2e]
+push eax
+mov eax, dword [ebp - 0x4c]
+push 0xfffc
+add eax, 0x10
+push eax
+call fcn_00018981  ; call 0x18981
+add esp, 0x10
+
+loc_0000b8a2:
+cmp byte [ebp - 0x30], 0
+je short loc_0000b8bf  ; je 0xb8bf
+push eax
+push 0x18
+push 0xe3
+lea eax, [esi + 0xd4]
+push eax
+call fcn_0001878a  ; call 0x1878a
+add esp, 0x10
+
+loc_0000b8bf:
+cmp byte [ebp - 0x3c], 0
+je short loc_0000b917  ; je 0xb917
+test byte [ebp - 0x58], 0x40
+je short loc_0000b917  ; je 0xb917
+movzx eax, byte [ebp - 0x5c]
+push ebx
+push ebx
+push eax
+push dword [ebp + 0x38]
+lea eax, [ebp - 0x31]
+push eax
+lea eax, [ebp - 0x30]
+push eax
+push dword [ebp + 0x24]
+lea eax, [ebp - 0x20]
+push eax
+lea eax, [ebp - 0x24]
+push eax
+lea eax, [ebp - 0x28]
+push eax
+movzx eax, word [ebp - 0x40]
+push dword [ebp + 0x28]
+push eax
+lea eax, [ebp - 0x2c]
+push eax
+push 2
+lea eax, [ebp - 0x2e]
+push eax
+movzx eax, byte [ebp - 0x3c]
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push eax
+push dword [ebp - 0x50]
+push esi
+call fcn_0000a7cf  ; call 0xa7cf
+add esp, 0x50
+mov edi, eax
+
+loc_0000b917:
+cmp byte [ebp - 0x51], 0
+jne short loc_0000b930  ; jne 0xb930
+push ecx
+push ecx
+push 0xff0000ff
+lea eax, [esi + 0x18]
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+
+loc_0000b930:
+mov ebx, edi
+test edi, edi
+js short loc_0000b969  ; js 0xb969
+cmp word [ebp - 0x2e], 3
+jne short loc_0000b969  ; jne 0xb969
+cmp dword [ebp - 0x44], 2
+lea ebx, [esi + 0xe8]
+jne short loc_0000b95a  ; jne 0xb95a
+push edx
+push 8
+push 0xf3
+push ebx
+call fcn_0001878a  ; call 0x1878a
+add esp, 0x10
+
+loc_0000b95a:
+push eax
+push eax
+push 2
+push ebx
+mov ebx, edi
+call fcn_00018730  ; call 0x18730
+add esp, 0x10
+
+loc_0000b969:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000b973:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x50
+movzx edi, byte [ebp + 0x10]
+movzx edx, byte [ebp + 0xc]
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0x14]
+mov ebx, dword [ebp + 0x18]
+push edi
+push edx
+mov ecx, esi
+mov byte [ebp - 0x2d], al
+movzx eax, al
+push eax
+mov byte [ebp - 0x1d], cl
+mov dword [ebp - 0x24], edi
+mov dword [ebp - 0x28], edx
+mov byte [ebp - 0x1f], bl
+mov dword [ebp - 0x1c], eax
+call fcn_00016c9a  ; call 0x16c9a
+mov edi, eax
+lea eax, [eax + 0x19]
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x1e], al
+test al, al
+jne short loc_0000b9eb  ; jne 0xb9eb
+mov eax, esi
+movzx edx, bl
+movzx eax, al
+shl eax, 8
+or eax, dword [ebp - 0x1c]
+shl edx, 0x10
+push ecx
+or eax, edx
+push eax
+push 0xff000000
+lea eax, [edi + 0x18]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+jmp short loc_0000ba03  ; jmp 0xba03
+
+loc_0000b9eb:
+sub esp, 0xc
+lea eax, [edi + 0x1a]
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x1f], al
+mov al, byte [ebp - 0x1e]
+mov byte [ebp - 0x1d], al
+
+loc_0000ba03:
+push 0x10
+push dword [ebp - 0x24]
+push dword [ebp - 0x28]
+push dword [ebp - 0x1c]
+call fcn_00009fd5  ; call 0x9fd5
+movzx eax, al
+lea eax, [edi + eax + 2]
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+and eax, 0xf0
+sar eax, 4
+cmp al, 5
+jne short loc_0000ba55  ; jne 0xba55
+sub esp, 0xc
+lea eax, [edi + 0xe]
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0x7f
+je short loc_0000ba55  ; je 0xba55
+
+loc_0000ba44:
+mov al, byte [ebp - 0x1d]
+xor ebx, ebx
+inc eax
+movzx eax, al
+mov dword [ebp - 0x34], eax
+jmp near loc_0000bb58  ; jmp 0xbb58
+
+loc_0000ba55:
+push eax
+movzx eax, byte [ebp - 0x1d]
+mov ebx, 0x186a0
+push 0
+push 0
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+mov esi, eax
+pop eax
+pop edx
+push 0
+push esi
+call fcn_00017da5  ; call 0x17da5
+add esp, 0x10
+
+loc_0000ba78:
+sub esp, 0xc
+push esi
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_0000ba44  ; jne 0xba44
+sub esp, 0xc
+push 0xa
+call fcn_0001bb03  ; call 0x1bb03
+add esp, 0x10
+dec ebx
+jne short loc_0000ba78  ; jne 0xba78
+jmp near loc_0000bc26  ; jmp 0xbc26
+
+loc_0000ba9d:
+push 0
+push dword [ebp + 0x1c]
+push ebx
+push esi
+call fcn_0000a55f  ; call 0xa55f
+add esp, 0x10
+cmp byte [ebp - 0x2d], 0
+jne short loc_0000bac8  ; jne 0xbac8
+sub esp, 0xc
+push ebx
+push esi
+push dword [ebp - 0x24]
+push dword [ebp - 0x28]
+push dword [ebp - 0x1c]
+call fcn_0000a647  ; call 0xa647
+add esp, 0x20
+
+loc_0000bac8:
+push 0x10
+push 0
+push ebx
+push esi
+call fcn_00009fd5  ; call 0x9fd5
+movzx edx, al
+mov cl, al
+add edx, dword [ebp - 0x2c]
+mov dword [ebp - 0x4c], ecx
+lea eax, [edx + 2]
+mov dword [ebp - 0x38], edx
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+mov word [ebp - 0x48], ax
+mov eax, dword [ebp - 0x2c]
+add eax, 0xb
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov edx, dword [ebp - 0x38]
+mov ecx, dword [ebp - 0x4c]
+cmp al, 6
+je short loc_0000bb7e  ; je 0xbb7e
+
+loc_0000bb0b:
+push edx
+push edx
+push 0
+push ebx
+push esi
+push dword [ebp - 0x24]
+push dword [ebp - 0x28]
+push dword [ebp - 0x1c]
+call fcn_0000a0f2  ; call 0xa0f2
+add esp, 0x14
+push ebx
+push esi
+push dword [ebp - 0x24]
+push dword [ebp - 0x28]
+push dword [ebp - 0x1c]
+call fcn_0000a220  ; call 0xa220
+add esp, 0x1c
+push dword [ebp - 0x24]
+push ebx
+push esi
+call fcn_0000a3ea  ; call 0xa3ea
+push 1
+push dword [ebp + 0x1c]
+push ebx
+push esi
+call fcn_0000a55f  ; call 0xa55f
+add esp, 0x20
+
+loc_0000bb4e:
+inc ebx
+cmp ebx, 0x20
+je near loc_0000bc09  ; je 0xbc09
+
+loc_0000bb58:
+movzx esi, byte [ebp - 0x1d]
+push eax
+push 0
+push ebx
+push esi
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+mov dword [ebp - 0x2c], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne near loc_0000ba9d  ; jne 0xba9d
+jmp short loc_0000bb4e  ; jmp 0xbb4e
+
+loc_0000bb7e:
+test cl, cl
+je short loc_0000bb0b  ; je 0xbb0b
+mov ecx, dword [ebp - 0x48]
+sub esp, 0xc
+add edx, 0x1a
+push edx
+and ecx, 0xf0
+sar ecx, 4
+mov dword [ebp - 0x2c], ecx
+call fcn_00017dc2  ; call 0x17dc2
+mov ecx, dword [ebp - 0x2c]
+add esp, 0x10
+cmp cl, 5
+je short loc_0000bbb9  ; je 0xbbb9
+cmp cl, 6
+jne near loc_0000bb0b  ; jne 0xbb0b
+test al, 0x40
+je near loc_0000bb0b  ; je 0xbb0b
+
+loc_0000bbb9:
+mov al, byte [ebp - 0x1d]
+cmp byte [ebp - 0x1f], al
+jbe short loc_0000bbdf  ; jbe 0xbbdf
+push eax
+push eax
+movzx eax, byte [ebp - 0x1f]
+push dword [ebp + 0x1c]
+push eax
+push dword [ebp - 0x34]
+push 0
+push ebx
+push esi
+call fcn_0000b973  ; call 0xb973
+add esp, 0x20
+jmp near loc_0000bb0b  ; jmp 0xbb0b
+
+loc_0000bbdf:
+call fcn_00015480  ; call 0x15480
+test al, al
+je near loc_0000bb0b  ; je 0xbb0b
+push ecx
+push ref_00022281  ; push 0x22281
+push 0x7aa
+push ref_00022106  ; push 0x22106
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+jmp near loc_0000bb0b  ; jmp 0xbb0b
+
+loc_0000bc09:
+xor bl, bl
+cmp byte [ebp - 0x1e], 0
+jne short loc_0000bc44  ; jne 0xbc44
+push eax
+push eax
+push 0xff000000
+lea eax, [edi + 0x18]
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+jmp short loc_0000bc44  ; jmp 0xbc44
+
+loc_0000bc26:
+cmp byte [ebp - 0x1e], 0
+jne short loc_0000bc3f  ; jne 0xbc3f
+push eax
+push eax
+push 0xff000000
+lea eax, [edi + 0x18]
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+
+loc_0000bc3f:
+mov ebx, 0x8000000e
+
+loc_0000bc44:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000bc4e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x30
+mov eax, dword [ebp + 0x14]
+movzx edi, byte [ebp + 0x10]
+movzx esi, byte [ebp + 0xc]
+movzx ebx, byte [ebp + 8]
+mov dword [ebp - 0x30], eax
+mov eax, dword [ebp + 0x18]
+push edi
+push esi
+push ebx
+mov dword [ebp - 0x34], eax
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [ebp - 0x2c], eax
+add eax, 0x5a
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+mov edx, 0x8000000e
+test al, 0x40
+je near loc_0000bd2e  ; je 0xbd2e
+push 0x10
+push edi
+push esi
+push ebx
+call fcn_00009fd5  ; call 0x9fd5
+add esp, 0x10
+test al, al
+jne short loc_0000bcd4  ; jne 0xbcd4
+call fcn_00015480  ; call 0x15480
+mov edx, 0x80000003
+test al, al
+je short loc_0000bd2e  ; je 0xbd2e
+push ecx
+push ref_00022281  ; push 0x22281
+push 0x81d
+push ref_00022106  ; push 0x22106
+mov dword [ebp - 0x2c], edx
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+mov edx, dword [ebp - 0x2c]
+jmp short loc_0000bd2e  ; jmp 0xbd2e
+
+loc_0000bcd4:
+movzx eax, al
+sub esp, 0xc
+add eax, dword [ebp - 0x2c]
+mov dword [ebp - 0x2c], eax
+add eax, 4
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+and eax, 7
+mov word [ebp - 0x1a], ax
+pop eax
+pop edx
+lea eax, [ebp - 0x1a]
+push eax
+movzx eax, byte [ebp - 0x34]
+push eax
+movzx eax, byte [ebp - 0x30]
+push eax
+push edi
+push esi
+push ebx
+call fcn_0000b973  ; call 0xb973
+mov cx, word [ebp - 0x1a]
+add esp, 0x1c
+shl ecx, 5
+movzx ecx, cx
+mov ebx, eax
+mov eax, dword [ebp - 0x2c]
+push ecx
+push 0xff1f
+add eax, 8
+push eax
+call fcn_00018981  ; call 0x18981
+add esp, 0x10
+mov edx, ebx
+
+loc_0000bd2e:
+lea esp, [ebp - 0xc]
+mov eax, edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000bd38:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000bd5a  ; je 0xbd5a
+push ebx
+push ebx
+push ref_00022293  ; push 0x22293
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000bd5a:
+push ecx
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov ebx, eax
+and ebx, 0xffffc000
+cmp dword [ebp + 8], 1
+je short loc_0000bdc1  ; je 0xbdc1
+jb short loc_0000bd90  ; jb 0xbd90
+cmp dword [ebp + 8], 2
+jne short loc_0000bdf6  ; jne 0xbdf6
+push edx
+push edx
+jmp short loc_0000bde5  ; jmp 0xbde5
+
+loc_0000bd90:
+sub esp, 0xc
+lea eax, [ebx + 0x38f4]
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 1
+jne short loc_0000bdad  ; jne 0xbdad
+mov word [esi], 0
+jmp short loc_0000be10  ; jmp 0xbe10
+
+loc_0000bdad:
+sub esp, 0xc
+add ebx, 0x38f8
+push ebx
+call fcn_00017dc2  ; call 0x17dc2
+mov word [esi], ax
+jmp short loc_0000bdf3  ; jmp 0xbdf3
+
+loc_0000bdc1:
+push ecx
+push ecx
+movzx eax, word [esi]
+push eax
+lea eax, [ebx + 0x38f8]
+push eax
+call fcn_00017e04  ; call 0x17e04
+pop esi
+pop eax
+lea eax, [ebx + 0x38f4]
+push 1
+push eax
+call fcn_00018730  ; call 0x18730
+pop eax
+pop edx
+
+loc_0000bde5:
+push 1
+add ebx, 0x38f0
+push ebx
+call fcn_00018730  ; call 0x18730
+
+loc_0000bdf3:
+add esp, 0x10
+
+loc_0000bdf6:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000be10  ; je 0xbe10
+push eax
+push eax
+push ref_000222ad  ; push 0x222ad
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000be10:
+lea esp, [ebp - 8]
+xor eax, eax
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000be19:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0xc
+mov eax, dword [ebp + 8]
+push dword [ebp + 0xc]
+lea ebx, [eax + 0x3418]
+push ebx
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+mov dword [ebp + 8], ebx
+mov ebx, dword [ebp - 4]
+leave
+jmp near fcn_00017e4e  ; jmp 0x17e4e
+
+fcn_0000be41:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000be67  ; je 0xbe67
+push eax
+push eax
+push ref_000222c5  ; push 0x222c5
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000be67:
+lea eax, [ebp - 0x1c]
+push eax
+push 0
+push 0
+push ref_0002911c  ; push 0x2911c
+call fcn_0001975d  ; call 0x1975d
+add esp, 0x10
+test eax, eax
+jne short loc_0000beea  ; jne 0xbeea
+mov edx, dword [ebp - 0x1c]
+xor ebx, ebx
+xor esi, esi
+
+loc_0000be87:
+lea eax, [ebx + 0x18]
+cmp word [edx + eax - 0x16], 0
+je short loc_0000be97  ; je 0xbe97
+inc esi
+mov ebx, eax
+jmp short loc_0000be87  ; jmp 0xbe87
+
+loc_0000be97:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000beb1  ; je 0xbeb1
+push eax
+push esi
+push ref_000222e3  ; push 0x222e3
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000beb1:
+push eax
+push ebx
+push dword [ebp - 0x1c]
+push ref_00028ff8  ; push 0x28ff8
+call fcn_0001936c  ; call 0x1936c
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000beea  ; je 0xbeea
+test ebx, ebx
+jne short loc_0000beea  ; jne 0xbeea
+push eax
+push ref_00022314  ; push 0x22314
+push 0x8f5
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000beea:
+xor ebx, ebx
+
+loc_0000beec:
+lea eax, [ebp - 0x20]
+push eax
+push 0
+push ebx
+push ref_000291dc  ; push 0x291dc
+call fcn_0001975d  ; call 0x1975d
+add esp, 0x10
+test eax, eax
+je short loc_0000bf36  ; je 0xbf36
+call fcn_00015480  ; call 0x15480
+test al, al
+je near loc_0000c0a1  ; je 0xc0a1
+test ebx, ebx
+jne near loc_0000c0a1  ; jne 0xc0a1
+push eax
+push ref_0002234a  ; push 0x2234a
+push 0x908
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+jmp near loc_0000c0a1  ; jmp 0xc0a1
+
+loc_0000bf36:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000bf57  ; je 0xbf57
+mov eax, dword [ebp - 0x20]
+push edi
+movzx eax, byte [eax + 1]
+push eax
+push ref_00022355  ; push 0x22355
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000bf57:
+push esi
+push 0x5ac
+push dword [ebp - 0x20]
+push ref_00029008  ; push 0x29008
+call fcn_0001936c  ; call 0x1936c
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000bf94  ; je 0xbf94
+test esi, esi
+jne short loc_0000bf94  ; jne 0xbf94
+push ecx
+push ref_00022314  ; push 0x22314
+push 0x90e
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000bf94:
+push eax
+mov eax, dword [ebp - 0x20]
+push 0
+push 0x1f
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov esi, eax
+and esi, 0xffffc000
+lea eax, [esi + 0x3418]
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [ebp - 0x24], eax
+pop eax
+pop edx
+lea eax, [ebp - 0x24]
+push eax
+push dword [ebp - 0x20]
+call fcn_0001227f  ; call 0x1227f
+mov edi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000c021  ; je 0xc021
+test edi, edi
+jns short loc_0000c021  ; jns 0xc021
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000c009  ; je 0xc009
+push eax
+push edi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000c009:
+push edi
+push ref_000206f4  ; push 0x206f4
+push 0x91d
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000c021:
+mov eax, dword [ebp - 0x20]
+cmp byte [eax + 0x370], 0
+je short loc_0000c079  ; je 0xc079
+push edx
+push edx
+push 0
+push eax
+call fcn_00012e28  ; call 0x12e28
+pop ecx
+push dword [ebp - 0x20]
+call fcn_00012eb2  ; call 0x12eb2
+add esp, 0x10
+test eax, eax
+jns short loc_0000c08d  ; jns 0xc08d
+mov eax, dword [ebp - 0x20]
+cmp byte [eax + 0x370], 2
+jne short loc_0000c08d  ; jne 0xc08d
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000c06d  ; je 0xc06d
+push eax
+push eax
+push ref_0002238a  ; push 0x2238a
+push 2
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000c06d:
+push edi
+push edi
+push 0xc0
+push dword [ebp - 0x20]
+jmp short loc_0000c081  ; jmp 0xc081
+
+loc_0000c079:
+push ecx
+push ecx
+push 0xc0
+push eax
+
+loc_0000c081:
+call fcn_00012e28  ; call 0x12e28
+add esp, 0x10
+or dword [ebp - 0x24], 0x10
+
+loc_0000c08d:
+push edx
+inc ebx
+push edx
+push dword [ebp - 0x24]
+push esi
+call fcn_0000be19  ; call 0xbe19
+add esp, 0x10
+jmp near loc_0000beec  ; jmp 0xbeec
+
+loc_0000c0a1:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000c0be  ; je 0xc0be
+push eax
+push eax
+push ref_000223be  ; push 0x223be
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000c0be:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000c0c8:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x2c
+mov eax, dword [ebp + 0x18]
+mov dword [ebp - 0x28], eax
+call fcn_0001bbfd  ; call 0x1bbfd
+sub esp, 0xc
+mov edi, eax
+mov dword [ebp - 0x20], eax
+mov eax, dword [ebp + 0x10]
+add eax, 0x410
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x19], al
+mov eax, edi
+dec eax
+mov dword [ebp - 0x24], eax
+cmp eax, 0xf
+ja short loc_0000c128  ; ja 0xc128
+mov cl, byte [ebp - 0x24]
+mov eax, 1
+xor esi, esi
+mov edx, ref_0002793c  ; mov edx, 0x2793c
+shl eax, cl
+and eax, 0x8007
+cmovne esi, edx
+cmp eax, 1
+sbb ebx, ebx
+not ebx
+and ebx, 0x49
+jmp short loc_0000c12c  ; jmp 0xc12c
+
+loc_0000c128:
+xor esi, esi
+xor ebx, ebx
+
+loc_0000c12c:
+add esi, 8
+mov word [ebp - 0x2c], 0
+
+loc_0000c135:
+cmp word [ebp - 0x2c], bx
+je short loc_0000c19b  ; je 0xc19b
+push dword [esi]
+push dword [esi - 4]
+push dword [esi - 8]
+push dword [ebp + 0x14]
+call fcn_00009dc2  ; call 0x9dc2
+mov edi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000c192  ; je 0xc192
+test edi, edi
+jns short loc_0000c192  ; jns 0xc192
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000c17a  ; je 0xc17a
+push eax
+push edi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000c17a:
+push ecx
+push ref_000206f4  ; push 0x206f4
+push 0x147
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000c192:
+inc word [ebp - 0x2c]
+add esi, 0xc
+jmp short loc_0000c135  ; jmp 0xc135
+
+loc_0000c19b:
+mov eax, dword [ebp - 0x20]
+cmp eax, 0x22
+ja short loc_0000c1b9  ; ja 0xc1b9
+cmp eax, 0x20
+jae short loc_0000c1c6  ; jae 0xc1c6
+cmp eax, 1
+jb short loc_0000c1de  ; jb 0xc1de
+cmp eax, 3
+jbe short loc_0000c1d2  ; jbe 0xc1d2
+cmp eax, 0x10
+je short loc_0000c1d2  ; je 0xc1d2
+jmp short loc_0000c1de  ; jmp 0xc1de
+
+loc_0000c1b9:
+mov eax, dword [ebp - 0x20]
+sub eax, 0x41
+cmp eax, 2
+jbe short loc_0000c1e4  ; jbe 0xc1e4
+jmp short loc_0000c1de  ; jmp 0xc1de
+
+loc_0000c1c6:
+mov edx, ref_00028114  ; mov edx, 0x28114
+mov eax, 0x49
+jmp short loc_0000c1ee  ; jmp 0xc1ee
+
+loc_0000c1d2:
+mov edx, ref_00027ca8  ; mov edx, 0x27ca8
+mov eax, 0x24
+jmp short loc_0000c1ee  ; jmp 0xc1ee
+
+loc_0000c1de:
+xor edx, edx
+xor eax, eax
+jmp short loc_0000c1ee  ; jmp 0xc1ee
+
+loc_0000c1e4:
+mov edx, ref_00028898  ; mov edx, 0x28898
+mov eax, 0x4d
+
+loc_0000c1ee:
+imul eax, eax, 0xc
+mov esi, edx
+add eax, edx
+mov dword [ebp - 0x30], eax
+mov al, byte [ebp - 0x19]
+mov bl, al
+and eax, 0x10
+and ebx, 0x20
+mov byte [ebp - 0x2c], al
+
+loc_0000c206:
+cmp esi, dword [ebp - 0x30]
+je near loc_0000c2ca  ; je 0xc2ca
+cmp dword [ebp + 0xc], 2
+jne short loc_0000c246  ; jne 0xc246
+mov eax, dword [esi]
+and eax, 0xfe00
+cmp eax, 0x2000
+je short loc_0000c25a  ; je 0xc25a
+cmp eax, 0x2200
+je short loc_0000c267  ; je 0xc267
+cmp eax, 0x2400
+jne short loc_0000c237  ; jne 0xc237
+test byte [ebp - 0x19], 0x40
+jmp short loc_0000c269  ; jmp 0xc269
+
+loc_0000c237:
+cmp eax, 0x2600
+jne short loc_0000c26b  ; jne 0xc26b
+cmp byte [ebp - 0x19], 0
+jns short loc_0000c26b  ; jns 0xc26b
+jmp short loc_0000c2c2  ; jmp 0xc2c2
+
+loc_0000c246:
+cmp dword [ebp + 0xc], 1
+jne short loc_0000c26b  ; jne 0xc26b
+mov eax, dword [esi]
+and eax, 0xfe00
+cmp eax, 0x2000
+jne short loc_0000c260  ; jne 0xc260
+
+loc_0000c25a:
+cmp byte [ebp - 0x2c], 0
+jmp short loc_0000c269  ; jmp 0xc269
+
+loc_0000c260:
+cmp eax, 0x2200
+jne short loc_0000c26b  ; jne 0xc26b
+
+loc_0000c267:
+test bl, bl
+
+loc_0000c269:
+jne short loc_0000c2c2  ; jne 0xc2c2
+
+loc_0000c26b:
+push dword [esi + 8]
+push dword [esi + 4]
+push dword [esi]
+push dword [ebp + 0x14]
+call fcn_00009dc2  ; call 0x9dc2
+mov edi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000c2c2  ; je 0xc2c2
+test edi, edi
+jns short loc_0000c2c2  ; jns 0xc2c2
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000c2aa  ; je 0xc2aa
+push edx
+push edi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000c2aa:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x178
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000c2c2:
+add esi, 0xc
+jmp near loc_0000c206  ; jmp 0xc206
+
+loc_0000c2ca:
+mov ecx, dword [ebp - 0x28]
+mov eax, ecx
+and eax, 0xfffffffb
+cmp ax, 0x8c4b
+je short loc_0000c312  ; je 0xc312
+mov eax, ecx
+and eax, 0xfffffff7
+cmp ax, 0x8c41
+je short loc_0000c312  ; je 0xc312
+mov eax, ecx
+add ax, 0x63bf
+cmp ax, 6
+jbe short loc_0000c312  ; jbe 0xc312
+cmp word [ebp - 0x28], 0x8cc5
+je short loc_0000c312  ; je 0xc312
+mov eax, ecx
+and eax, 0xfffffffd
+cmp ax, 0x8cc1
+je short loc_0000c312  ; je 0xc312
+mov eax, ecx
+add ax, 0x633f
+cmp ax, 0xa
+ja near loc_0000c4df  ; ja 0xc4df
+
+loc_0000c312:
+cmp dword [ebp - 0x24], 0xf
+ja short loc_0000c33d  ; ja 0xc33d
+mov cl, byte [ebp - 0x24]
+mov eax, 1
+xor esi, esi
+mov edx, ref_000275f4  ; mov edx, 0x275f4
+shl eax, cl
+and eax, 0x8007
+cmovne esi, edx
+cmp eax, 1
+sbb ebx, ebx
+not ebx
+and ebx, 4
+jmp short loc_0000c341  ; jmp 0xc341
+
+loc_0000c33d:
+xor esi, esi
+xor ebx, ebx
+
+loc_0000c341:
+add esi, 8
+mov word [ebp - 0x28], 0
+
+loc_0000c34a:
+cmp word [ebp - 0x28], bx
+je short loc_0000c3b0  ; je 0xc3b0
+push dword [esi]
+push dword [esi - 4]
+push dword [esi - 8]
+push dword [ebp + 0x14]
+call fcn_00009dc2  ; call 0x9dc2
+mov edi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000c3a7  ; je 0xc3a7
+test edi, edi
+jns short loc_0000c3a7  ; jns 0xc3a7
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000c38f  ; je 0xc38f
+push eax
+push edi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000c38f:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x19b
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000c3a7:
+inc word [ebp - 0x28]
+add esi, 0xc
+jmp short loc_0000c34a  ; jmp 0xc34a
+
+loc_0000c3b0:
+mov eax, dword [ebp - 0x20]
+cmp eax, 0x22
+ja short loc_0000c3ce  ; ja 0xc3ce
+cmp eax, 0x20
+jae short loc_0000c3db  ; jae 0xc3db
+cmp eax, 1
+jb short loc_0000c3f3  ; jb 0xc3f3
+cmp eax, 3
+jbe short loc_0000c3e7  ; jbe 0xc3e7
+cmp eax, 0x10
+je short loc_0000c3e7  ; je 0xc3e7
+jmp short loc_0000c3f3  ; jmp 0xc3f3
+
+loc_0000c3ce:
+mov eax, dword [ebp - 0x20]
+sub eax, 0x41
+cmp eax, 2
+jbe short loc_0000c3f9  ; jbe 0xc3f9
+jmp short loc_0000c3f3  ; jmp 0xc3f3
+
+loc_0000c3db:
+mov edx, ref_0002809c  ; mov edx, 0x2809c
+mov eax, 4
+jmp short loc_0000c403  ; jmp 0xc403
+
+loc_0000c3e7:
+mov edx, ref_00027624  ; mov edx, 0x27624
+mov eax, 2
+jmp short loc_0000c403  ; jmp 0xc403
+
+loc_0000c3f3:
+xor edx, edx
+xor eax, eax
+jmp short loc_0000c403  ; jmp 0xc403
+
+loc_0000c3f9:
+mov edx, ref_00028898  ; mov edx, 0x28898
+mov eax, 0x4d
+
+loc_0000c403:
+imul eax, eax, 0xc
+mov esi, edx
+add eax, edx
+mov dword [ebp - 0x2c], eax
+mov al, byte [ebp - 0x19]
+mov bl, al
+and eax, 0x10
+and ebx, 0x20
+mov byte [ebp - 0x28], al
+
+loc_0000c41b:
+cmp esi, dword [ebp - 0x2c]
+je near loc_0000c569  ; je 0xc569
+cmp dword [ebp + 0xc], 2
+jne short loc_0000c45b  ; jne 0xc45b
+mov eax, dword [esi]
+and eax, 0xfe00
+cmp eax, 0x2000
+je short loc_0000c46f  ; je 0xc46f
+cmp eax, 0x2200
+je short loc_0000c47c  ; je 0xc47c
+cmp eax, 0x2400
+jne short loc_0000c44c  ; jne 0xc44c
+test byte [ebp - 0x19], 0x40
+jmp short loc_0000c47e  ; jmp 0xc47e
+
+loc_0000c44c:
+cmp eax, 0x2600
+jne short loc_0000c480  ; jne 0xc480
+cmp byte [ebp - 0x19], 0
+jns short loc_0000c480  ; jns 0xc480
+jmp short loc_0000c4d7  ; jmp 0xc4d7
+
+loc_0000c45b:
+cmp dword [ebp + 0xc], 1
+jne short loc_0000c480  ; jne 0xc480
+mov eax, dword [esi]
+and eax, 0xfe00
+cmp eax, 0x2000
+jne short loc_0000c475  ; jne 0xc475
+
+loc_0000c46f:
+cmp byte [ebp - 0x28], 0
+jmp short loc_0000c47e  ; jmp 0xc47e
+
+loc_0000c475:
+cmp eax, 0x2200
+jne short loc_0000c480  ; jne 0xc480
+
+loc_0000c47c:
+test bl, bl
+
+loc_0000c47e:
+jne short loc_0000c4d7  ; jne 0xc4d7
+
+loc_0000c480:
+push dword [esi + 8]
+push dword [esi + 4]
+push dword [esi]
+push dword [ebp + 0x14]
+call fcn_00009dc2  ; call 0x9dc2
+mov edi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000c4d7  ; je 0xc4d7
+test edi, edi
+jns short loc_0000c4d7  ; jns 0xc4d7
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000c4bf  ; je 0xc4bf
+push eax
+push edi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000c4bf:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x1cc
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000c4d7:
+add esi, 0xc
+jmp near loc_0000c41b  ; jmp 0xc41b
+
+loc_0000c4df:
+cmp dword [ebp - 0x24], 0xf
+ja near loc_0000c59b  ; ja 0xc59b
+mov cl, byte [ebp - 0x24]
+mov eax, 1
+xor esi, esi
+mov edx, ref_000275ac  ; mov edx, 0x275ac
+shl eax, cl
+and eax, 0x8007
+cmovne esi, edx
+cmp eax, 1
+sbb ebx, ebx
+not ebx
+and ebx, 4
+
+loc_0000c50c:
+add esi, 8
+mov word [ebp - 0x28], 0
+
+loc_0000c515:
+cmp word [ebp - 0x28], bx
+jne near loc_0000c5a4  ; jne 0xc5a4
+cmp dword [ebp - 0x20], 0x10
+je near loc_0000c616  ; je 0xc616
+mov eax, dword [ebp - 0x20]
+jbe near loc_0000c607  ; jbe 0xc607
+sub eax, 0x20
+cmp eax, 2
+ja near loc_0000c60d  ; ja 0xc60d
+mov edx, ref_0002806c  ; mov edx, 0x2806c
+mov eax, 4
+
+loc_0000c548:
+imul eax, eax, 0xc
+mov esi, edx
+add eax, edx
+mov dword [ebp - 0x2c], eax
+mov al, byte [ebp - 0x19]
+mov bl, al
+and eax, 0x10
+and ebx, 0x20
+mov byte [ebp - 0x28], al
+
+loc_0000c560:
+cmp esi, dword [ebp - 0x2c]
+jne near loc_0000c625  ; jne 0xc625
+
+loc_0000c569:
+cmp dword [ebp - 0x24], 0xf
+ja near loc_0000c6e0  ; ja 0xc6e0
+mov cl, byte [ebp - 0x24]
+mov eax, 1
+xor edi, edi
+mov edx, ref_00027444  ; mov edx, 0x27444
+shl eax, cl
+and eax, 0x8007
+cmovne edi, edx
+cmp eax, 1
+sbb eax, eax
+not eax
+and eax, 0x14
+jmp near loc_0000c6e4  ; jmp 0xc6e4
+
+loc_0000c59b:
+xor esi, esi
+xor ebx, ebx
+jmp near loc_0000c50c  ; jmp 0xc50c
+
+loc_0000c5a4:
+push dword [esi]
+push dword [esi - 4]
+push dword [esi - 8]
+push dword [ebp + 0x14]
+call fcn_00009dc2  ; call 0x9dc2
+mov edi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000c5fb  ; je 0xc5fb
+test edi, edi
+jns short loc_0000c5fb  ; jns 0xc5fb
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000c5e3  ; je 0xc5e3
+push eax
+push edi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000c5e3:
+push edi
+push ref_000206f4  ; push 0x206f4
+push 0x1e8
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000c5fb:
+inc word [ebp - 0x28]
+add esi, 0xc
+jmp near loc_0000c515  ; jmp 0xc515
+
+loc_0000c607:
+dec eax
+cmp eax, 2
+jbe short loc_0000c616  ; jbe 0xc616
+
+loc_0000c60d:
+xor edx, edx
+xor eax, eax
+jmp near loc_0000c548  ; jmp 0xc548
+
+loc_0000c616:
+mov edx, ref_000275dc  ; mov edx, 0x275dc
+mov eax, 2
+jmp near loc_0000c548  ; jmp 0xc548
+
+loc_0000c625:
+cmp dword [ebp + 0xc], 2
+jne short loc_0000c65c  ; jne 0xc65c
+mov eax, dword [esi]
+and eax, 0xfe00
+cmp eax, 0x2000
+je short loc_0000c670  ; je 0xc670
+cmp eax, 0x2200
+je short loc_0000c67d  ; je 0xc67d
+cmp eax, 0x2400
+jne short loc_0000c64d  ; jne 0xc64d
+test byte [ebp - 0x19], 0x40
+jmp short loc_0000c67f  ; jmp 0xc67f
+
+loc_0000c64d:
+cmp eax, 0x2600
+jne short loc_0000c681  ; jne 0xc681
+cmp byte [ebp - 0x19], 0
+jns short loc_0000c681  ; jns 0xc681
+jmp short loc_0000c6d8  ; jmp 0xc6d8
+
+loc_0000c65c:
+cmp dword [ebp + 0xc], 1
+jne short loc_0000c681  ; jne 0xc681
+mov eax, dword [esi]
+and eax, 0xfe00
+cmp eax, 0x2000
+jne short loc_0000c676  ; jne 0xc676
+
+loc_0000c670:
+cmp byte [ebp - 0x28], 0
+jmp short loc_0000c67f  ; jmp 0xc67f
+
+loc_0000c676:
+cmp eax, 0x2200
+jne short loc_0000c681  ; jne 0xc681
+
+loc_0000c67d:
+test bl, bl
+
+loc_0000c67f:
+jne short loc_0000c6d8  ; jne 0xc6d8
+
+loc_0000c681:
+push dword [esi + 8]
+push dword [esi + 4]
+push dword [esi]
+push dword [ebp + 0x14]
+call fcn_00009dc2  ; call 0x9dc2
+mov edi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000c6d8  ; je 0xc6d8
+test edi, edi
+jns short loc_0000c6d8  ; jns 0xc6d8
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000c6c0  ; je 0xc6c0
+push ecx
+push edi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000c6c0:
+push edx
+push ref_000206f4  ; push 0x206f4
+push 0x213
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000c6d8:
+add esi, 0xc
+jmp near loc_0000c560  ; jmp 0xc560
+
+loc_0000c6e0:
+xor edi, edi
+xor eax, eax
+
+loc_0000c6e4:
+movzx eax, ax
+imul eax, eax, 0xc
+mov word [ebp - 0x24], 0
+lea eax, [edi + eax + 8]
+mov dword [ebp - 0x30], eax
+
+loc_0000c6f7:
+call fcn_0001c1e1  ; call 0x1c1e1
+mov edx, dword [ebp - 0x24]
+movzx eax, al
+cmp dx, ax
+jae near loc_0000c7ca  ; jae 0xc7ca
+movzx eax, dx
+xor esi, esi
+imul eax, eax, 0x12
+add eax, dword [ebp + 8]
+mov dword [ebp - 0x28], eax
+
+loc_0000c719:
+mov eax, dword [ebp - 0x28]
+mov word [ebp - 0x34], si
+cmp byte [eax + esi*2 + 0x1e4], 1
+je short loc_0000c736  ; je 0xc736
+
+loc_0000c72a:
+inc esi
+cmp esi, 3
+jne short loc_0000c719  ; jne 0xc719
+inc word [ebp - 0x24]
+jmp short loc_0000c6f7  ; jmp 0xc6f7
+
+loc_0000c736:
+lea ebx, [edi + 8]
+
+loc_0000c739:
+cmp ebx, dword [ebp - 0x30]
+je short loc_0000c72a  ; je 0xc72a
+mov eax, dword [ebp - 0x24]
+cmp word [ebx - 8], ax
+jne short loc_0000c7c2  ; jne 0xc7c2
+mov eax, dword [ebp - 0x34]
+cmp word [ebx - 6], ax
+jne short loc_0000c7c2  ; jne 0xc7c2
+mov eax, dword [ebp - 0x28]
+mov edx, dword [ebx]
+movzx ecx, byte [eax + esi*2 + 0x1e3]
+mov eax, edx
+not eax
+imul ecx, ecx, 0x1010101
+and eax, ecx
+push eax
+push edx
+push dword [ebx - 4]
+push dword [ebp + 0x14]
+call fcn_00009dc2  ; call 0x9dc2
+mov dword [ebp - 0x2c], eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000c7c2  ; je 0xc7c2
+cmp dword [ebp - 0x2c], 0
+jns short loc_0000c7c2  ; jns 0xc7c2
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000c7aa  ; je 0xc7aa
+push eax
+push dword [ebp - 0x2c]
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000c7aa:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x234
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000c7c2:
+add ebx, 0xc
+jmp near loc_0000c739  ; jmp 0xc739
+
+loc_0000c7ca:
+mov eax, dword [ebp - 0x20]
+cmp eax, 0x22
+ja short loc_0000c7e8  ; ja 0xc7e8
+cmp eax, 0x20
+jae short loc_0000c7fa  ; jae 0xc7fa
+cmp eax, 1
+jb short loc_0000c80d  ; jb 0xc80d
+cmp eax, 3
+jbe short loc_0000c801  ; jbe 0xc801
+cmp eax, 0x10
+je short loc_0000c801  ; je 0xc801
+jmp short loc_0000c80d  ; jmp 0xc80d
+
+loc_0000c7e8:
+mov eax, dword [ebp - 0x20]
+mov esi, ref_00028760  ; mov esi, 0x28760
+sub eax, 0x41
+cmp eax, 2
+jbe short loc_0000c813  ; jbe 0xc813
+jmp short loc_0000c80d  ; jmp 0xc80d
+
+loc_0000c7fa:
+mov esi, ref_00027f7c  ; mov esi, 0x27f7c
+jmp short loc_0000c813  ; jmp 0xc813
+
+loc_0000c801:
+mov esi, ref_00027534  ; mov esi, 0x27534
+mov eax, 0xa
+jmp short loc_0000c818  ; jmp 0xc818
+
+loc_0000c80d:
+xor esi, esi
+xor eax, eax
+jmp short loc_0000c818  ; jmp 0xc818
+
+loc_0000c813:
+mov eax, 0x14
+
+loc_0000c818:
+imul eax, eax, 0xc
+mov cl, byte [ebp - 0x19]
+mov word [ebp - 0x24], 0
+lea eax, [esi + eax + 4]
+mov dword [ebp - 0x34], eax
+mov al, cl
+and eax, 0x20
+mov byte [ebp - 0x2c], al
+mov al, cl
+and eax, 0x10
+mov byte [ebp - 0x30], al
+
+loc_0000c83b:
+call fcn_0001c1e1  ; call 0x1c1e1
+mov ecx, dword [ebp - 0x24]
+movzx eax, al
+cmp cx, ax
+jae near loc_0000c980  ; jae 0xc980
+movzx eax, cx
+imul eax, eax, 0x12
+add eax, dword [ebp + 8]
+mov dword [ebp - 0x20], 0
+mov dword [ebp - 0x28], eax
+
+loc_0000c862:
+mov eax, dword [ebp - 0x20]
+mov edx, dword [ebp - 0x28]
+mov word [ebp - 0x1c], ax
+cmp byte [edx + eax*2 + 0x1e4], 1
+je short loc_0000c885  ; je 0xc885
+
+loc_0000c876:
+inc dword [ebp - 0x20]
+cmp dword [ebp - 0x20], 3
+jne short loc_0000c862  ; jne 0xc862
+inc word [ebp - 0x24]
+jmp short loc_0000c83b  ; jmp 0xc83b
+
+loc_0000c885:
+lea ebx, [esi + 4]
+
+loc_0000c888:
+cmp ebx, dword [ebp - 0x34]
+je short loc_0000c876  ; je 0xc876
+mov eax, dword [ebp - 0x24]
+cmp word [ebx - 4], ax
+jne near loc_0000c978  ; jne 0xc978
+mov eax, dword [ebp - 0x1c]
+cmp word [ebx - 2], ax
+jne near loc_0000c978  ; jne 0xc978
+cmp dword [ebp + 0xc], 2
+jne short loc_0000c8e1  ; jne 0xc8e1
+mov eax, dword [ebx]
+and eax, 0xfe00
+cmp eax, 0x2000
+je short loc_0000c8f5  ; je 0xc8f5
+cmp eax, 0x2200
+je short loc_0000c902  ; je 0xc902
+cmp eax, 0x2400
+jne short loc_0000c8cf  ; jne 0xc8cf
+test byte [ebp - 0x19], 0x40
+jmp short loc_0000c906  ; jmp 0xc906
+
+loc_0000c8cf:
+cmp eax, 0x2600
+jne short loc_0000c908  ; jne 0xc908
+cmp byte [ebp - 0x19], 0
+jns short loc_0000c908  ; jns 0xc908
+jmp near loc_0000c978  ; jmp 0xc978
+
+loc_0000c8e1:
+cmp dword [ebp + 0xc], 1
+jne short loc_0000c908  ; jne 0xc908
+mov eax, dword [ebx]
+and eax, 0xfe00
+cmp eax, 0x2000
+jne short loc_0000c8fb  ; jne 0xc8fb
+
+loc_0000c8f5:
+cmp byte [ebp - 0x30], 0
+jmp short loc_0000c906  ; jmp 0xc906
+
+loc_0000c8fb:
+cmp eax, 0x2200
+jne short loc_0000c908  ; jne 0xc908
+
+loc_0000c902:
+cmp byte [ebp - 0x2c], 0
+
+loc_0000c906:
+jne short loc_0000c978  ; jne 0xc978
+
+loc_0000c908:
+mov eax, dword [ebp - 0x28]
+mov ecx, dword [ebp - 0x20]
+movzx edi, byte [eax + ecx*2 + 0x1e3]
+mov ecx, dword [ebx + 4]
+imul edi, edi, 0x1010101
+mov eax, ecx
+not eax
+and eax, edi
+push eax
+push ecx
+push dword [ebx]
+push dword [ebp + 0x14]
+call fcn_00009dc2  ; call 0x9dc2
+mov edi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000c978  ; je 0xc978
+test edi, edi
+jns short loc_0000c978  ; jns 0xc978
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000c960  ; je 0xc960
+push eax
+push edi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000c960:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x271
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000c978:
+add ebx, 0xc
+jmp near loc_0000c888  ; jmp 0xc888
+
+loc_0000c980:
+mov eax, dword [ebp + 8]
+xor ebx, ebx
+cmp byte [eax], 8
+ja short loc_0000c991  ; ja 0xc991
+
+loc_0000c98a:
+xor eax, eax
+jmp near loc_0000cbf4  ; jmp 0xcbf4
+
+loc_0000c991:
+mov cl, byte [ebp - 0x19]
+mov al, cl
+and eax, 0x10
+mov byte [ebp - 0x20], al
+mov al, cl
+shr al, 7
+mov byte [ebp - 0x28], al
+
+loc_0000c9a4:
+call fcn_0001c1e1  ; call 0x1c1e1
+movzx eax, al
+cmp bx, ax
+jae short loc_0000c98a  ; jae 0xc98a
+cmp dword [ebp + 0xc], 1
+jne short loc_0000c9df  ; jne 0xc9df
+cmp bx, 4
+jne short loc_0000c9c3  ; jne 0xc9c3
+cmp byte [ebp - 0x20], 0
+jmp short loc_0000c9cd  ; jmp 0xc9cd
+
+loc_0000c9c3:
+cmp bx, 5
+jne short loc_0000c9d3  ; jne 0xc9d3
+test byte [ebp - 0x19], 0x20
+
+loc_0000c9cd:
+jne near loc_0000cbee  ; jne 0xcbee
+
+loc_0000c9d3:
+movzx eax, bx
+mov edi, dword [eax*4 + ref_00020420]  ; mov edi, dword [eax*4 + 0x20420]
+jmp short loc_0000ca20  ; jmp 0xca20
+
+loc_0000c9df:
+test bx, bx
+jne short loc_0000c9ee  ; jne 0xc9ee
+cmp byte [ebp - 0x28], 0
+jne near loc_0000cbee  ; jne 0xcbee
+
+loc_0000c9ee:
+cmp bx, 1
+jne short loc_0000c9fa  ; jne 0xc9fa
+test byte [ebp - 0x19], 0x40
+jmp short loc_0000ca10  ; jmp 0xca10
+
+loc_0000c9fa:
+cmp bx, 2
+jne short loc_0000ca06  ; jne 0xca06
+test byte [ebp - 0x19], 0x20
+jmp short loc_0000ca10  ; jmp 0xca10
+
+loc_0000ca06:
+cmp bx, 3
+jne short loc_0000ca16  ; jne 0xca16
+cmp byte [ebp - 0x20], 0
+
+loc_0000ca10:
+jne near loc_0000cbee  ; jne 0xcbee
+
+loc_0000ca16:
+movzx eax, bx
+mov edi, dword [eax*4 + ref_00020408]  ; mov edi, dword [eax*4 + 0x20408]
+
+loc_0000ca20:
+movzx esi, bx
+imul eax, esi, 0x12
+add eax, dword [ebp + 8]
+test byte [eax + 0x1ed], 1
+je short loc_0000caa0  ; je 0xcaa0
+movzx eax, byte [eax + 0x1e9]
+cmp al, 0x80
+jbe short loc_0000ca85  ; jbe 0xca85
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ca5a  ; je 0xca5a
+push eax
+push eax
+push ref_000223da  ; push 0x223da
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ca5a:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0000ca7b  ; je 0xca7b
+push eax
+push ref_00022281  ; push 0x22281
+push 0x295
+
+loc_0000ca6e:
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000ca7b:
+mov eax, 0x80000002
+jmp near loc_0000cbf4  ; jmp 0xcbf4
+
+loc_0000ca85:
+shl eax, 0x10
+push eax
+push 0xff00ffff
+lea eax, [edi + 0x88]
+push eax
+push dword [ebp + 0x14]
+call fcn_00009dc2  ; call 0x9dc2
+add esp, 0x10
+
+loc_0000caa0:
+imul eax, esi, 0x12
+add eax, dword [ebp + 8]
+test byte [eax + 0x1ed], 2
+je short loc_0000cb08  ; je 0xcb08
+movzx eax, byte [eax + 0x1ea]
+cmp al, 0x80
+jbe short loc_0000caed  ; jbe 0xcaed
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000cad7  ; je 0xcad7
+push edi
+push edi
+push ref_00022408  ; push 0x22408
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000cad7:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0000ca7b  ; je 0xca7b
+push esi
+push ref_00022281  ; push 0x22281
+push 0x2a5
+jmp short loc_0000ca6e  ; jmp 0xca6e
+
+loc_0000caed:
+shl eax, 0x10
+push eax
+push 0xff00ffff
+lea eax, [edi + 0x8c]
+push eax
+push dword [ebp + 0x14]
+call fcn_00009dc2  ; call 0x9dc2
+add esp, 0x10
+
+loc_0000cb08:
+imul eax, esi, 0x12
+add eax, dword [ebp + 8]
+test byte [eax + 0x1ed], 4
+je short loc_0000cb6a  ; je 0xcb6a
+movzx eax, byte [eax + 0x1eb]
+lea edx, [eax - 0x39]
+cmp dl, 0x47
+jbe short loc_0000cb60  ; jbe 0xcb60
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000cb43  ; je 0xcb43
+push ebx
+push ebx
+push ref_00022437  ; push 0x22437
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000cb43:
+call fcn_00015480  ; call 0x15480
+test al, al
+je near loc_0000ca7b  ; je 0xca7b
+push ecx
+push ref_00022281  ; push 0x22281
+push 0x2b9
+jmp near loc_0000ca6e  ; jmp 0xca6e
+
+loc_0000cb60:
+shl eax, 8
+mov edx, 0xffff00ff
+jmp short loc_0000cb6f  ; jmp 0xcb6f
+
+loc_0000cb6a:
+xor eax, eax
+or edx, 0xffffffff
+
+loc_0000cb6f:
+imul esi, esi, 0x12
+add esi, dword [ebp + 8]
+test byte [esi + 0x1ed], 8
+je short loc_0000cbd5  ; je 0xcbd5
+mov cl, byte [esi + 0x1ec]
+lea esi, [ecx - 0x45]
+mov byte [ebp - 0x24], cl
+mov ecx, esi
+cmp cl, 0x3b
+jbe short loc_0000cbcb  ; jbe 0xcbcb
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000cbae  ; je 0xcbae
+push edx
+push edx
+push ref_00022460  ; push 0x22460
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000cbae:
+call fcn_00015480  ; call 0x15480
+test al, al
+je near loc_0000ca7b  ; je 0xca7b
+push eax
+push ref_00022281  ; push 0x22281
+push 0x2c6
+jmp near loc_0000ca6e  ; jmp 0xca6e
+
+loc_0000cbcb:
+movzx ecx, byte [ebp - 0x24]
+xor dl, dl
+or eax, ecx
+jmp short loc_0000cbda  ; jmp 0xcbda
+
+loc_0000cbd5:
+cmp edx, 0xffffffff
+je short loc_0000cbee  ; je 0xcbee
+
+loc_0000cbda:
+push eax
+add edi, 0x90
+push edx
+push edi
+push dword [ebp + 0x14]
+call fcn_00009dc2  ; call 0x9dc2
+add esp, 0x10
+
+loc_0000cbee:
+inc ebx
+jmp near loc_0000c9a4  ; jmp 0xc9a4
+
+loc_0000cbf4:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000cbfc:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x2c
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000cc1f  ; je 0xcc1f
+push eax
+push eax
+push ref_0002248a  ; push 0x2248a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000cc1f:
+call fcn_0001bfbb  ; call 0x1bfbb
+mov dword [ebp - 0x2c], eax
+push eax
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov ebx, eax
+lea eax, [eax + 0xf0]
+add ebx, 2
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [esp], ebx
+mov dword [ebp - 0x30], eax
+and dword [ebp - 0x30], 0xffffc000
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0xc
+push 2
+push 0x1f
+push 0
+mov ebx, eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0x1c
+push 0
+mov esi, eax
+call fcn_00016c9a  ; call 0x16c9a
+lea edi, [esi + 0x92]
+mov dword [esp], edi
+mov dword [ebp - 0x34], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0xf
+setne byte [ebp - 0x35]
+cmp dword [ebp - 0x2c], 1
+jne near loc_0000cedf  ; jne 0xcedf
+sub esp, 0xc
+push edi
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0x30
+je short loc_0000cd14  ; je 0xcd14
+
+loc_0000ccac:
+push eax
+lea eax, [ebp - 0x1c]
+push eax
+push 0xea000aac
+push dword [ebp - 0x30]
+call fcn_00009d19  ; call 0x9d19
+mov eax, dword [ebp - 0x1c]
+add esp, 0x10
+and eax, 0x30
+cmp eax, 0x20
+je near loc_0000ce82  ; je 0xce82
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000cced  ; je 0xcced
+push eax
+push eax
+push ref_000224a1  ; push 0x224a1
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000cced:
+call fcn_00015480  ; call 0x15480
+test al, al
+je near loc_0000ce82  ; je 0xce82
+push eax
+push ref_00024be5  ; push 0x24be5
+push 0x32e
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+jmp near loc_0000ce7f  ; jmp 0xce7f
+
+loc_0000cd14:
+cmp byte [ebp - 0x35], 1
+je short loc_0000ccac  ; je 0xccac
+push eax
+push 0x60
+
+loc_0000cd1d:
+push 0x3f
+lea eax, [esi + 0x90]
+push eax
+call fcn_0001878a  ; call 0x1878a
+add esp, 0x10
+
+loc_0000cd2e:
+push eax
+push 0x183
+push 0xfffffe00
+lea eax, [esi + 0x94]
+push eax
+lea esi, [esi + 0x98]
+mov dword [ebp - 0x1c], 0xfffffe00
+call fcn_00018b68  ; call 0x18b68
+pop eax
+pop edx
+push 0x8000
+push edi
+call fcn_00018927  ; call 0x18927
+movzx eax, bx
+mov dword [esp], eax
+push dword [ebp - 0x30]
+push dword [ebp - 0x34]
+push dword [ebp - 0x2c]
+push dword [ebp + 8]
+call fcn_0000c0c8  ; call 0xc0c8
+mov eax, ebx
+add esp, 0x20
+and eax, 0xfffffffd
+cmp ax, 0x8c44
+je near loc_0000ce9e  ; je 0xce9e
+lea eax, [ebx + 0x73b2]
+cmp ax, 2
+jbe near loc_0000ce9e  ; jbe 0xce9e
+cmp bx, 0x8c5c
+je near loc_0000ce9e  ; je 0xce9e
+lea eax, [ebx + 0x73b7]
+cmp ax, 3
+jbe near loc_0000ce9e  ; jbe 0xce9e
+lea eax, [ebx + 0x73bf]
+cmp ax, 1
+jbe near loc_0000ce9e  ; jbe 0xce9e
+lea eax, [ebx + 0x63bf]
+cmp ax, 6
+jbe near loc_0000ce9e  ; jbe 0xce9e
+lea eax, [ebx + 0x733f]
+cmp ax, 5
+jbe near loc_0000ce9e  ; jbe 0xce9e
+add bx, 0x633f
+cmp bx, 0xa
+jbe near loc_0000ce9e  ; jbe 0xce9e
+
+loc_0000cdf2:
+push ebx
+push ebx
+push 0x80000
+push esi
+call fcn_00018b14  ; call 0x18b14
+add esp, 0xc
+push 0x200
+push 0xffffe27f
+push esi
+mov dword [ebp - 0x1c], 0xffffe27f
+call fcn_00018b68  ; call 0x18b68
+pop eax
+pop edx
+push 0x100000
+push esi
+call fcn_00018b14  ; call 0x18b14
+add esp, 0xc
+push 0x20
+push 0xffffffffffffff9f
+push esi
+call fcn_00018b68  ; call 0x18b68
+pop ecx
+pop ebx
+push 0x40000
+push esi
+call fcn_00018b14  ; call 0x18b14
+mov eax, dword [ebp - 0x34]
+add eax, 0x410
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+cmp dword [ebp - 0x2c], 1
+jne short loc_0000ceb3  ; jne 0xceb3
+mov dl, al
+and edx, 0x10
+cmp dl, 1
+sbb edx, edx
+and edx, 0x10
+add edx, 0xf
+mov cl, dl
+or ecx, 0x20
+test al, 0x20
+
+loc_0000ce70:
+cmove edx, ecx
+
+loc_0000ce73:
+push ecx
+movzx edx, dl
+push ecx
+push edx
+push edi
+call fcn_00018730  ; call 0x18730
+
+loc_0000ce7f:
+add esp, 0x10
+
+loc_0000ce82:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000cef7  ; je 0xcef7
+push eax
+push eax
+push ref_000224ef  ; push 0x224ef
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp short loc_0000cef7  ; jmp 0xcef7
+
+loc_0000ce9e:
+push eax
+push eax
+push 0x400000
+push esi
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+jmp near loc_0000cdf2  ; jmp 0xcdf2
+
+loc_0000ceb3:
+xor edx, edx
+cmp dword [ebp - 0x2c], 2
+jne short loc_0000ce73  ; jne 0xce73
+mov dl, al
+not edx
+shr dl, 7
+mov cl, dl
+or ecx, 2
+test al, 0x40
+cmove edx, ecx
+mov cl, dl
+or ecx, 4
+test al, 0x20
+cmove edx, ecx
+mov cl, dl
+or ecx, 8
+test al, 0x10
+jmp short loc_0000ce70  ; jmp 0xce70
+
+loc_0000cedf:
+cmp byte [ebp - 0x35], 1
+je short loc_0000ce82  ; je 0xce82
+cmp dword [ebp - 0x2c], 2
+jne near loc_0000cd2e  ; jne 0xcd2e
+push ecx
+push 0x40
+jmp near loc_0000cd1d  ; jmp 0xcd1d
+
+loc_0000cef7:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000cf01:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x38
+mov ebx, dword [ebp + 8]
+mov eax, dword [ebx + 4]
+add eax, 0x3414
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+mov esi, eax
+pop eax
+push dword [ebx + 4]
+call fcn_0001be90  ; call 0x1be90
+movzx edx, byte [ebx + 0x37e]
+add esp, 0x10
+mov edi, eax
+mov eax, esi
+shr al, 5
+xor eax, 1
+and eax, 1
+cmp edx, eax
+je near loc_0000d125  ; je 0xd125
+lea eax, [ebp - 0x1c]
+push eax
+push 0
+push 0
+push ref_0002913c  ; push 0x2913c
+call fcn_0001975d  ; call 0x1975d
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000cf9e  ; je 0xcf9e
+test esi, esi
+jns short loc_0000cf9e  ; jns 0xcf9e
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000cf86  ; je 0xcf86
+push eax
+push esi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000cf86:
+push esi
+push ref_000206f4  ; push 0x206f4
+push 0x467
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000cf9e:
+mov eax, dword [ebx + 4]
+sub esp, 0xc
+add eax, 0x3420
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, al
+jns short loc_0000cfdf  ; jns 0xcfdf
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000cfd3  ; je 0xcfd3
+push ecx
+push ecx
+push ref_00022504  ; push 0x22504
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000cfd3:
+push edx
+mov eax, dword [ebp - 0x1c]
+push edx
+push 4
+jmp near loc_0000d11f  ; jmp 0xd11f
+
+loc_0000cfdf:
+xor esi, esi
+mov eax, edi
+cmp byte [ebx + 0x37e], 0
+je short loc_0000d016  ; je 0xd016
+dec al
+jne near loc_0000d0bc  ; jne 0xd0bc
+push eax
+mov esi, 1
+push eax
+push 0xdf
+mov eax, dword [ebx + 4]
+add eax, 0x3414
+push eax
+call fcn_0001875d  ; call 0x1875d
+add esp, 0x10
+jmp near loc_0000d0bc  ; jmp 0xd0bc
+
+loc_0000d016:
+dec al
+jne near loc_0000d0a7  ; jne 0xd0a7
+push eax
+push 0
+push 0x19
+movzx eax, byte [ebx + 1]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+lea edi, [eax + 0x10]
+mov esi, eax
+mov dword [esp], edi
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [ebp - 0x34], eax
+pop eax
+pop edx
+push dword [ebx + 0x1a]
+push edi
+call fcn_00017e8f  ; call 0x17e8f
+lea eax, [esi + 4]
+mov dword [esp], eax
+mov esi, eax
+call fcn_00017dc2  ; call 0x17dc2
+pop ecx
+mov dword [ebp - 0x2c], esi
+mov word [ebp - 0x2e], ax
+pop eax
+push 2
+push esi
+call fcn_00018927  ; call 0x18927
+mov dword [esp], edi
+call fcn_00017e4e  ; call 0x17e4e
+and eax, 0xffff8000
+lea edx, [eax + 0x5b54]
+mov dword [esp], edx
+call fcn_00017dc2  ; call 0x17dc2
+mov ecx, eax
+pop eax
+movzx eax, word [ebp - 0x2e]
+shr cx, 0xf
+pop edx
+mov esi, ecx
+push eax
+push dword [ebp - 0x2c]
+call fcn_00017e04  ; call 0x17e04
+pop ecx
+mov ecx, dword [ebp - 0x34]
+pop eax
+push ecx
+push edi
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+
+loc_0000d0a7:
+push edi
+push edi
+push 0x20
+mov eax, dword [ebx + 4]
+add eax, 0x3414
+push eax
+call fcn_00018730  ; call 0x18730
+add esp, 0x10
+
+loc_0000d0bc:
+mov eax, dword [ebx + 4]
+sub esp, 0xc
+add eax, 0x3414
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+mov eax, esi
+add esp, 0x10
+test al, al
+je short loc_0000d125  ; je 0xd125
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000d0f3  ; je 0xd0f3
+push esi
+push esi
+push ref_00022558  ; push 0x22558
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000d0f3:
+mov eax, dword [ebx + 4]
+sub esp, 0xc
+add eax, 0x3428
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov edx, 3
+test al, 2
+jne short loc_0000d119  ; jne 0xd119
+cmp byte [ebx + 0x11], 1
+sbb edx, edx
+add edx, 5
+
+loc_0000d119:
+mov eax, dword [ebp - 0x1c]
+push ecx
+push ecx
+push edx
+
+loc_0000d11f:
+push eax
+call dword [eax]  ; ucall
+add esp, 0x10
+
+loc_0000d125:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000d12f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x3c
+mov ebx, dword [ebp + 8]
+mov byte [ebp - 0x1c], 0x1d
+mov byte [ebp - 0x1b], 0
+mov byte [ebp - 0x1a], 0x1a
+mov byte [ebp - 0x19], 0
+call fcn_0001bfbb  ; call 0x1bfbb
+push edi
+push 0
+push 0x1f
+push 0
+mov esi, eax
+mov dword [ebp - 0x34], eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 2
+push 0x1f
+mov dword [ebp - 0x38], eax
+movzx eax, byte [ebx + 1]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0x10
+dec esi
+mov dword [ebp - 0x30], 0
+mov edi, eax
+jne short loc_0000d196  ; jne 0xd196
+push ecx
+push 5
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0x10
+mov dword [ebp - 0x30], eax
+
+loc_0000d196:
+push eax
+push 0
+push 0x1c
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov esi, eax
+mov eax, dword [ebp - 0x38]
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [ebp - 0x40], eax
+pop eax
+mov eax, dword [ebp - 0x38]
+pop edx
+add eax, 0xac
+push 0xffefffff
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+mov byte [ebp - 0x3c], 0
+mov byte [ebp - 0x29], 0
+
+loc_0000d1d7:
+call fcn_0001c1bf  ; call 0x1c1bf
+cmp byte [ebp - 0x29], al
+jae short loc_0000d25e  ; jae 0xd25e
+movzx edx, byte [ebp - 0x29]
+push eax
+push edx
+push 0x1c
+movzx eax, byte [ebx + 1]
+mov dword [ebp - 0x48], edx
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+mov dword [ebp - 0x44], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_0000d256  ; je 0xd256
+mov edx, dword [ebp - 0x48]
+mov ecx, dword [ebp - 0x44]
+imul edx, edx, 0x2c
+cmp byte [ebx + edx + 0x4e], 1
+setne dl
+add ecx, 0x70
+sub esp, 0xc
+movzx edx, dl
+inc edx
+push ecx
+mov dword [ebp - 0x48], edx
+mov dword [ebp - 0x44], ecx
+call fcn_00017dc2  ; call 0x17dc2
+mov edx, dword [ebp - 0x48]
+add esp, 0x10
+movzx edx, dx
+and eax, 0xf
+cmp eax, edx
+je short loc_0000d256  ; je 0xd256
+mov ecx, dword [ebp - 0x44]
+push eax
+push edx
+push 0xfff0
+push ecx
+call fcn_00018981  ; call 0x18981
+add esp, 0x10
+mov byte [ebp - 0x3c], 1
+
+loc_0000d256:
+inc byte [ebp - 0x29]
+jmp near loc_0000d1d7  ; jmp 0xd1d7
+
+loc_0000d25e:
+cmp byte [ebp - 0x3c], 0
+je short loc_0000d274  ; je 0xd274
+sub esp, 0xc
+push 0x186a0
+call fcn_0001bb03  ; call 0x1bb03
+add esp, 0x10
+
+loc_0000d274:
+push eax
+push 0x80
+push 0x9f
+lea eax, [esi + 0xf4]
+push eax
+call fcn_0001878a  ; call 0x1878a
+add esp, 0x10
+mov byte [ebp - 0x29], 0
+
+loc_0000d292:
+call fcn_0001c245  ; call 0x1c245
+cmp byte [ebp - 0x29], al
+jae short loc_0000d2e2  ; jae 0xd2e2
+movzx eax, byte [ebp - 0x29]
+push ecx
+movzx edx, byte [ebp + eax*2 - 0x1b]
+movzx eax, byte [ebp + eax*2 - 0x1c]
+push edx
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+lea edx, [eax + 0x88]
+mov dword [esp], edx
+mov dword [ebp - 0x3c], edx
+call fcn_00017e4e  ; call 0x17e4e
+pop edx
+mov edx, dword [ebp - 0x3c]
+pop ecx
+and eax, 0xfffffffb
+push eax
+push edx
+mov dword [ebp - 0x20], eax
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+inc byte [ebp - 0x29]
+jmp short loc_0000d292  ; jmp 0xd292
+
+loc_0000d2e2:
+cmp byte [ebx + 0x364], 1
+jne short loc_0000d331  ; jne 0xd331
+push eax
+mov eax, dword [ebx + 0x368]
+shr eax, 0xc
+and eax, 3
+or al, 0x80
+push eax
+push 0xfffffffffffffffc
+mov eax, dword [ebx + 4]
+add eax, 0x3404
+push eax
+call fcn_00018b68  ; call 0x18b68
+mov eax, dword [ebx + 4]
+add eax, 0x3404
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+pop eax
+pop edx
+push 1
+mov eax, dword [ebx + 0x368]
+add eax, 0x10
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+
+loc_0000d331:
+cmp byte [ebx + 0xc], 0
+mov eax, dword [ebx + 4]
+jne short loc_0000d34b  ; jne 0xd34b
+push ecx
+add eax, 0x3410
+push ecx
+push 0xfffffffffffffffb
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+jmp short loc_0000d35a  ; jmp 0xd35a
+
+loc_0000d34b:
+push edx
+add eax, 0x3410
+push edx
+push 4
+push eax
+call fcn_00018b14  ; call 0x18b14
+
+loc_0000d35a:
+mov eax, dword [ebx + 4]
+add esp, 0x10
+sub esp, 0xc
+add eax, 0x3410
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+cmp dword [ebp - 0x34], 1
+jne near loc_0000d445  ; jne 0xd445
+cmp dword [ebx + 0x1db], 0
+jne near loc_0000d41e  ; jne 0xd41e
+push eax
+add esi, 0x410
+push 0x70
+push 0xffffff00
+lea eax, [edi + 0x34]
+push eax
+call fcn_00018b68  ; call 0x18b68
+pop eax
+pop edx
+lea eax, [edi + 0x70]
+push 0xffff00ff
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+pop ecx
+pop eax
+lea eax, [edi + 0x90]
+push 0x1f
+push eax
+call fcn_0001875d  ; call 0x1875d
+mov dword [esp], esi
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+and eax, 0x30
+cmp al, 0x30
+je short loc_0000d41e  ; je 0xd41e
+sub esp, 0xc
+push esi
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0x10
+jne short loc_0000d3f6  ; jne 0xd3f6
+push eax
+push eax
+mov eax, dword [ebp - 0x30]
+push 1
+add eax, 0x92
+push eax
+call fcn_00018730  ; call 0x18730
+add esp, 0x10
+
+loc_0000d3f6:
+sub esp, 0xc
+push esi
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0x20
+jne near loc_0000d490  ; jne 0xd490
+mov eax, dword [ebp - 0x30]
+push esi
+push esi
+push 2
+add eax, 0x92
+push eax
+call fcn_00018730  ; call 0x18730
+jmp short loc_0000d48d  ; jmp 0xd48d
+
+loc_0000d41e:
+push ecx
+push ecx
+push 0x2000000
+mov eax, dword [ebx + 4]
+add eax, 0x3418
+push eax
+call fcn_00018b14  ; call 0x18b14
+mov eax, dword [ebx + 4]
+add eax, 0x3418
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+jmp short loc_0000d48d  ; jmp 0xd48d
+
+loc_0000d445:
+cmp dword [ebp - 0x34], 2
+jne short loc_0000d490  ; jne 0xd490
+cmp dword [ebx + 0x1db], 3
+jne short loc_0000d490  ; jne 0xd490
+push eax
+push eax
+push 0x3f
+lea eax, [edi + 0x90]
+push eax
+call fcn_0001875d  ; call 0x1875d
+pop eax
+pop edx
+lea eax, [edi + 0xa0]
+push 0
+push eax
+call fcn_00017da5  ; call 0x17da5
+add esp, 0xc
+push 0x8000
+push 0xffff7fff
+lea eax, [edi + 0xa4]
+push eax
+call fcn_00018b68  ; call 0x18b68
+
+loc_0000d48d:
+add esp, 0x10
+
+loc_0000d490:
+cmp dword [ebx + 0x1db], 2
+jne short loc_0000d4c1  ; jne 0xd4c1
+mov eax, dword [ebp - 0x38]
+sub esp, 0xc
+add eax, 2
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0xc
+push 0x80
+push 0x3f
+lea eax, [edi + 0x90]
+push eax
+call fcn_0001878a  ; call 0x1878a
+add esp, 0x10
+
+loc_0000d4c1:
+cmp dword [ebp - 0x34], 2
+jne near loc_0000d5bf  ; jne 0xd5bf
+mov ebx, dword [ebp - 0x40]
+push esi
+lea esi, [ebp - 0x20]
+push esi
+push 0xed00015c
+and ebx, 0xffffc000
+push ebx
+call fcn_00009d19  ; call 0x9d19
+add esp, 0x10
+mov edi, eax
+test eax, eax
+jns short loc_0000d509  ; jns 0xd509
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000d525  ; je 0xd525
+push ecx
+push edi
+push ref_0002258d  ; push 0x2258d
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+jmp short loc_0000d522  ; jmp 0xd522
+
+loc_0000d509:
+mov eax, dword [ebp - 0x20]
+push edx
+and ah, 0xf7
+or ah, 0x37
+push eax
+push 0xed00015c
+push ebx
+mov dword [ebp - 0x20], eax
+call fcn_00009c75  ; call 0x9c75
+
+loc_0000d522:
+add esp, 0x10
+
+loc_0000d525:
+push edi
+push esi
+push 0xed000118
+push ebx
+call fcn_00009d19  ; call 0x9d19
+add esp, 0x10
+mov edi, eax
+test eax, eax
+jns short loc_0000d557  ; jns 0xd557
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000d572  ; je 0xd572
+push ecx
+push edi
+push ref_000225b0  ; push 0x225b0
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+jmp short loc_0000d56f  ; jmp 0xd56f
+
+loc_0000d557:
+mov eax, dword [ebp - 0x20]
+push edx
+or eax, 0xc00000
+push eax
+push 0xed000118
+push ebx
+mov dword [ebp - 0x20], eax
+call fcn_00009c75  ; call 0x9c75
+
+loc_0000d56f:
+add esp, 0x10
+
+loc_0000d572:
+push edi
+push esi
+push 0xed000120
+push ebx
+call fcn_00009d19  ; call 0x9d19
+add esp, 0x10
+mov esi, eax
+test eax, eax
+jns short loc_0000d5a4  ; jns 0xd5a4
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000d5bf  ; je 0xd5bf
+push ecx
+push esi
+push ref_000225d3  ; push 0x225d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+jmp short loc_0000d5bc  ; jmp 0xd5bc
+
+loc_0000d5a4:
+mov eax, dword [ebp - 0x20]
+push edx
+or eax, 0x240000
+push eax
+push 0xed000120
+push ebx
+mov dword [ebp - 0x20], eax
+call fcn_00009c75  ; call 0x9c75
+
+loc_0000d5bc:
+add esp, 0x10
+
+loc_0000d5bf:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000d5c9:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov ebx, dword [ebp + 8]
+push 6
+push 0x1f
+movzx eax, byte [ebx + 1]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0
+push 0
+mov edi, eax
+call fcn_00016c9a  ; call 0x16c9a
+mov esi, dword [ebx + 0x1a]
+pop ecx
+pop eax
+mov dword [ebp - 0x1c], edi
+lea edi, [edi + 0x40]
+push esi
+push edi
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+mov eax, dword [ebp - 0x1c]
+pop edx
+add eax, 0x44
+push 0
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop ecx
+pop eax
+push 1
+push edi
+call fcn_00018b14  ; call 0x18b14
+call fcn_0001bfbb  ; call 0x1bfbb
+add esp, 0x10
+cmp eax, 2
+lea eax, [esi + 0x10]
+jne short loc_0000d638  ; jne 0xd638
+push edx
+push edx
+push 0x14a
+jmp short loc_0000d63f  ; jmp 0xd63f
+
+loc_0000d638:
+push ecx
+push ecx
+push 0x154
+
+loc_0000d63f:
+push eax
+call fcn_00017e04  ; call 0x17e04
+add esp, 0x10
+push eax
+push eax
+push 0xff
+lea eax, [esi + 6]
+push eax
+call fcn_00017da5  ; call 0x17da5
+pop eax
+pop edx
+lea eax, [esi + 0x80]
+push 0xff
+push eax
+call fcn_00017da5  ; call 0x17da5
+pop ecx
+pop eax
+lea eax, [esi + 0x84]
+push 0
+push eax
+call fcn_00017da5  ; call 0x17da5
+pop eax
+pop edx
+lea eax, [esi + 0x82]
+push 0
+push eax
+call fcn_00017da5  ; call 0x17da5
+add esp, 0xc
+push 0x403c
+push 0xffff8003
+mov eax, dword [ebx + 4]
+add eax, 0x38b0
+push eax
+call fcn_00018b68  ; call 0x18b68
+mov eax, dword [ebx + 4]
+add eax, 0x38b4
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test ah, 0x40
+je short loc_0000d6ce  ; je 0xd6ce
+push eax
+add esi, 0xa
+push eax
+push 1
+push esi
+call fcn_00017da5  ; call 0x17da5
+add esp, 0x10
+
+loc_0000d6ce:
+push ecx
+push ecx
+push 0xfffffffffffffffe
+push edi
+call fcn_00018b3e  ; call 0x18b3e
+pop esi
+pop eax
+push 0
+push edi
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+test byte [ebx + 0x426], 1
+je near loc_0000d77b  ; je 0xd77b
+mov cl, byte [ebx + 0x432]
+mov dl, byte [ebx + 0x436]
+mov eax, ecx
+shl eax, 0x1e
+and eax, 0x40000000
+mov esi, eax
+or esi, 0x80000000
+test dl, 1
+cmovne eax, esi
+mov esi, eax
+or esi, 0x4000
+and cl, 2
+cmovne eax, esi
+mov ecx, eax
+or ch, 0x80
+and dl, 2
+cmovne eax, ecx
+push edx
+push eax
+push 0xfff0fff
+mov eax, dword [ebx + 4]
+add eax, 0x33d4
+push eax
+call fcn_00018b68  ; call 0x18b68
+mov al, byte [ebx + 0x432]
+add esp, 0xc
+shl eax, 8
+and eax, 0x400
+mov edx, eax
+or dh, 8
+test byte [ebx + 0x436], 4
+cmovne eax, edx
+push eax
+push 0xfffff0ff
+mov eax, dword [ebx + 4]
+add eax, 0x33c8
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_0000d77b:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000d785:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov edi, dword [ebp + 8]
+mov eax, dword [edi + 4]
+mov bl, byte [edi + 0x361]
+lea esi, [eax + 0x31fe]
+push esi
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+cmp bl, al
+je short loc_0000d7d3  ; je 0xd7d3
+push ebx
+push ebx
+push 0xfeff
+push esi
+call fcn_00018954  ; call 0x18954
+movzx eax, byte [edi + 0x361]
+add esp, 0xc
+push eax
+push 0xff00
+push esi
+call fcn_00018981  ; call 0x18981
+add esp, 0x10
+
+loc_0000d7d3:
+push eax
+push eax
+push 0x100
+push esi
+call fcn_00018927  ; call 0x18927
+mov dword [esp], esi
+call fcn_00017dc2  ; call 0x17dc2
+mov dword [esp], esi
+call fcn_00017d8b  ; call 0x17d8b
+pop edx
+pop ecx
+push 0
+movzx ebx, al
+shl ebx, 0xc
+mov eax, ebx
+or ebx, 0xfec00010
+or eax, 0xfec00000
+push eax
+mov dword [ebp - 0x1c], eax
+call fcn_00017da5  ; call 0x17da5
+mov dword [esp], ebx
+call fcn_00017e4e  ; call 0x17e4e
+mov dl, byte [edi + 0x360]
+add esp, 0x10
+movzx ecx, dl
+shr eax, 0x18
+cmp ecx, eax
+je short loc_0000d852  ; je 0xd852
+cmp dl, 0xf
+ja short loc_0000d852  ; ja 0xd852
+push edx
+push edx
+push 0
+push dword [ebp - 0x1c]
+call fcn_00017da5  ; call 0x17da5
+pop ecx
+pop eax
+movzx eax, byte [edi + 0x360]
+shl eax, 0x18
+push eax
+push ebx
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+
+loc_0000d852:
+call fcn_0001bfbb  ; call 0x1bfbb
+cmp eax, 2
+jne short loc_0000d875  ; jne 0xd875
+cmp byte [edi + 0x362], 0
+jne short loc_0000d875  ; jne 0xd875
+push eax
+push eax
+push 0x800
+push esi
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+
+loc_0000d875:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000d87f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000d8a2  ; je 0xd8a2
+push eax
+push eax
+push ref_000225f6  ; push 0x225f6
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000d8a2:
+push eax
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+lea esi, [eax + 0xf0]
+mov ebx, eax
+mov dword [esp], esi
+call fcn_00017e4e  ; call 0x17e4e
+lea eax, [ebp - 0x20]
+push eax
+push 0
+push 0
+push ref_000291dc  ; push 0x291dc
+call fcn_0001975d  ; call 0x1975d
+add esp, 0x20
+mov edi, eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0000d917  ; je 0xd917
+test edi, edi
+jns short loc_0000d917  ; jns 0xd917
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000d8ff  ; je 0xd8ff
+push eax
+push edi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000d8ff:
+push edi
+push ref_000206f4  ; push 0x206f4
+push 0x7c4
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000d917:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0000d943  ; je 0xd943
+mov eax, dword [ebp - 0x20]
+test word [eax + 4], 0x3fff
+je short loc_0000d943  ; je 0xd943
+push ecx
+push ref_0002260f  ; push 0x2260f
+push 0x7d5
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000d943:
+push eax
+mov eax, dword [ebp - 0x20]
+mov eax, dword [eax + 4]
+or eax, 1
+push eax
+push 0x3fff
+push esi
+call fcn_00018b68  ; call 0x18b68
+lea esi, [ebx + 0x40]
+pop eax
+mov eax, dword [ebp - 0x20]
+pop edx
+movzx eax, word [eax + 8]
+push eax
+push esi
+call fcn_00017e8f  ; call 0x17e8f
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000d9ac  ; je 0xd9ac
+sub esp, 0xc
+push esi
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, dword [ebp - 0x20]
+add esp, 0x10
+movzx edx, word [edx + 8]
+and eax, 0xfffc
+cmp eax, edx
+je short loc_0000d9ac  ; je 0xd9ac
+push edi
+push ref_0002264a  ; push 0x2264a
+push 0x7e1
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000d9ac:
+mov eax, dword [ebp - 0x20]
+cmp word [eax + 8], 0
+lea eax, [ebx + 0x44]
+je short loc_0000d9c8  ; je 0xd9c8
+push esi
+push esi
+push 0x80
+push eax
+call fcn_00018730  ; call 0x18730
+jmp short loc_0000d9d2  ; jmp 0xd9d2
+
+loc_0000d9c8:
+push ecx
+push ecx
+push 0x7f
+push eax
+call fcn_0001875d  ; call 0x1875d
+
+loc_0000d9d2:
+add esp, 0x10
+push eax
+push eax
+push 2
+lea eax, [ebx + 0xa6]
+push eax
+call fcn_00018730  ; call 0x18730
+lea esi, [ebx + 0x48]
+pop eax
+mov eax, dword [ebp - 0x20]
+pop edx
+movzx eax, word [eax + 0xa]
+push eax
+push esi
+call fcn_00017e8f  ; call 0x17e8f
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000da38  ; je 0xda38
+sub esp, 0xc
+push esi
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, dword [ebp - 0x20]
+add esp, 0x10
+movzx edx, word [edx + 0xa]
+and eax, 0xfffc
+cmp eax, edx
+je short loc_0000da38  ; je 0xda38
+push eax
+push ref_00022691  ; push 0x22691
+push 0x800
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000da38:
+mov eax, dword [ebp - 0x20]
+cmp word [eax + 0xa], 0
+lea eax, [ebx + 0x4c]
+je short loc_0000da51  ; je 0xda51
+push edi
+push edi
+push 0x10
+push eax
+call fcn_00018730  ; call 0x18730
+jmp short loc_0000da5e  ; jmp 0xda5e
+
+loc_0000da51:
+push esi
+push esi
+push 0xef
+push eax
+call fcn_0001875d  ; call 0x1875d
+
+loc_0000da5e:
+mov eax, dword [ebp - 0x20]
+add esp, 0x10
+mov dl, byte [eax + 0x40e]
+push ecx
+and edx, 0x20
+cmp dl, 1
+sbb eax, eax
+and eax, 0xffffffe0
+dec eax
+cmp dl, 1
+sbb edx, edx
+movzx eax, al
+not edx
+add ebx, 0xdc
+and edx, 0x22
+push edx
+push eax
+push ebx
+call fcn_0001878a  ; call 0x1878a
+pop ebx
+push dword [ebp - 0x20]
+call fcn_0000cbfc  ; call 0xcbfc
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000dae2  ; je 0xdae2
+test ebx, ebx
+jns short loc_0000dae2  ; jns 0xdae2
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000daca  ; je 0xdaca
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000daca:
+push edi
+push ref_000206f4  ; push 0x206f4
+push 0x828
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000dae2:
+sub esp, 0xc
+push dword [ebp - 0x20]
+call fcn_0001146f  ; call 0x1146f
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000db34  ; je 0xdb34
+test ebx, ebx
+jns short loc_0000db34  ; jns 0xdb34
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000db1c  ; je 0xdb1c
+push esi
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000db1c:
+push ecx
+push ref_000206f4  ; push 0x206f4
+push 0x82a
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000db34:
+sub esp, 0xc
+push dword [ebp - 0x20]
+call fcn_0000cf01  ; call 0xcf01
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000db86  ; je 0xdb86
+test ebx, ebx
+jns short loc_0000db86  ; jns 0xdb86
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000db6e  ; je 0xdb6e
+push edx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000db6e:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x82d
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000db86:
+sub esp, 0xc
+push dword [ebp - 0x20]
+call fcn_0000d12f  ; call 0xd12f
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000dbd8  ; je 0xdbd8
+test ebx, ebx
+jns short loc_0000dbd8  ; jns 0xdbd8
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000dbc0  ; je 0xdbc0
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000dbc0:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x830
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000dbd8:
+sub esp, 0xc
+push dword [ebp - 0x20]
+call fcn_0000d5c9  ; call 0xd5c9
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000dc2a  ; je 0xdc2a
+test ebx, ebx
+jns short loc_0000dc2a  ; jns 0xdc2a
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000dc12  ; je 0xdc12
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000dc12:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x832
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000dc2a:
+sub esp, 0xc
+push dword [ebp - 0x20]
+call fcn_0000d785  ; call 0xd785
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000dc7c  ; je 0xdc7c
+test ebx, ebx
+jns short loc_0000dc7c  ; jns 0xdc7c
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000dc64  ; je 0xdc64
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000dc64:
+push edi
+push ref_000206f4  ; push 0x206f4
+push 0x834
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000dc7c:
+sub esp, 0xc
+lea eax, [ebp - 0x1c]
+push eax
+call fcn_00019797  ; call 0x19797
+add esp, 0x10
+test eax, eax
+js short loc_0000dd06  ; js 0xdd06
+mov eax, dword [ebp - 0x1c]
+cmp eax, 0x11
+je short loc_0000dd06  ; je 0xdd06
+cmp eax, 0x20
+je short loc_0000dd06  ; je 0xdd06
+mov eax, dword [ebp - 0x20]
+cmp byte [eax + 0x339], 0
+je short loc_0000dd06  ; je 0xdd06
+movzx ecx, byte [eax]
+add eax, 0x284
+mov edx, dword [eax - 0x26a]
+push ecx
+push edx
+push edx
+push eax
+call fcn_00011751  ; call 0x11751
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000dd06  ; je 0xdd06
+test ebx, ebx
+jns short loc_0000dd06  ; jns 0xdd06
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000dcee  ; je 0xdcee
+push esi
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000dcee:
+push ebx
+push ref_000206f4  ; push 0x206f4
+push 0x848
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000dd06:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000dd20  ; je 0xdd20
+push ecx
+push ecx
+push ref_000226da  ; push 0x226da
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000dd20:
+sub esp, 0xc
+push ref_00026f74  ; push 0x26f74
+call fcn_0001972b  ; call 0x1972b
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000dd74  ; je 0xdd74
+test ebx, ebx
+jns short loc_0000dd74  ; jns 0xdd74
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000dd5c  ; je 0xdd5c
+push edx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000dd5c:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x853
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000dd74:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000dd7e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov ebx, dword [ebp + 0xc]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000dda4  ; je 0xdda4
+push eax
+push eax
+push ref_000226f1  ; push 0x226f1
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000dda4:
+cmp byte [ebx], 5
+jbe near loc_0000de39  ; jbe 0xde39
+xor edx, edx
+
+loc_0000ddaf:
+cmp dl, byte [ebx + 0x526]
+jae short loc_0000dde0  ; jae 0xdde0
+movzx eax, dl
+mov esi, dword [ebp + 8]
+push edi
+lea eax, [ebx + eax*8]
+push edi
+push dword [eax + 0x4e2]
+add esi, dword [eax + 0x4de]
+mov dword [ebp - 0x1c], edx
+push esi
+call fcn_00017e8f  ; call 0x17e8f
+mov edx, dword [ebp - 0x1c]
+add esp, 0x10
+inc edx
+jmp short loc_0000ddaf  ; jmp 0xddaf
+
+loc_0000dde0:
+xor edx, edx
+
+loc_0000dde2:
+cmp dl, byte [ebx + 0x553]
+jae short loc_0000de16  ; jae 0xde16
+movzx eax, dl
+lea eax, [ebx + eax*4]
+push esi
+push esi
+movzx ecx, word [eax + 0x529]
+mov dword [ebp - 0x1c], edx
+push ecx
+movzx eax, word [eax + 0x527]
+add eax, dword [ebp + 8]
+push eax
+call fcn_00017e04  ; call 0x17e04
+mov edx, dword [ebp - 0x1c]
+add esp, 0x10
+inc edx
+jmp short loc_0000dde2  ; jmp 0xdde2
+
+loc_0000de16:
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_0000dec7  ; je 0xdec7
+push eax
+push eax
+push ref_00022718  ; push 0x22718
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp near loc_0000dec7  ; jmp 0xdec7
+
+loc_0000de39:
+call fcn_0001bfbb  ; call 0x1bfbb
+mov esi, ref_00026f9c  ; mov esi, 0x26f9c
+mov edx, ref_00026fc0  ; mov edx, 0x26fc0
+mov edi, ref_00026fd8  ; mov edi, 0x26fd8
+cmp eax, 2
+sete bl
+setne cl
+cmovne esi, edx
+movzx ebx, bl
+mov edx, ref_00027000  ; mov edx, 0x27000
+movzx ecx, cl
+cmovne edi, edx
+add ecx, 5
+lea ebx, [ebx + ebx*2 + 6]
+xor edx, edx
+
+loc_0000de70:
+movzx eax, dl
+cmp eax, ecx
+jae short loc_0000de9c  ; jae 0xde9c
+mov dword [ebp - 0x20], ecx
+lea eax, [edi + eax*8]
+push ecx
+push ecx
+mov ecx, dword [ebp + 8]
+push dword [eax + 4]
+add ecx, dword [eax]
+mov dword [ebp - 0x1c], edx
+push ecx
+call fcn_00017e8f  ; call 0x17e8f
+mov edx, dword [ebp - 0x1c]
+add esp, 0x10
+mov ecx, dword [ebp - 0x20]
+inc edx
+jmp short loc_0000de70  ; jmp 0xde70
+
+loc_0000de9c:
+xor edi, edi
+
+loc_0000de9e:
+mov eax, edi
+movzx eax, al
+cmp eax, ebx
+jae near loc_0000de16  ; jae 0xde16
+lea eax, [esi + eax*4]
+inc edi
+push edx
+push edx
+movzx edx, word [eax + 2]
+push edx
+movzx eax, word [eax]
+add eax, dword [ebp + 8]
+push eax
+call fcn_00017e04  ; call 0x17e04
+add esp, 0x10
+jmp short loc_0000de9e  ; jmp 0xde9e
+
+loc_0000dec7:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000ded1:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000def4  ; je 0xdef4
+push ebx
+push ebx
+push ref_0002273d  ; push 0x2273d
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000def4:
+push ecx
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov edi, eax
+lea eax, [eax + 0xa4]
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test al, 4
+je near loc_0000dfd2  ; je 0xdfd2
+push ecx
+push ecx
+push 1
+push dword [ebp + 8]
+call fcn_0001be4f  ; call 0x1be4f
+mov dword [esp], 0x70
+call fcn_00018ee1  ; call 0x18ee1
+pop esi
+mov bl, al
+pop eax
+and ebx, 0xffffff80
+push 0
+push dword [ebp + 8]
+call fcn_0001be4f  ; call 0x1be4f
+mov dl, bl
+or ebx, 0xb
+or edx, 0xa
+movzx ebx, bl
+pop eax
+movzx esi, dl
+pop edx
+push esi
+push 0x70
+call fcn_00018eea  ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1  ; call 0x18ee1
+pop ecx
+pop edx
+and eax, 0x8f
+or eax, 0x60
+push eax
+push 0x71
+call fcn_00018eea  ; call 0x18eea
+pop ecx
+pop eax
+push ebx
+push 0x70
+call fcn_00018eea  ; call 0x18eea
+pop eax
+pop edx
+push 0x80
+push 0x71
+call fcn_00017f7f  ; call 0x17f7f
+pop ecx
+pop eax
+push esi
+push 0x70
+call fcn_00018eea  ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1  ; call 0x18ee1
+pop edx
+pop ecx
+and eax, 0x8f
+or eax, 0x20
+push eax
+push 0x71
+call fcn_00018eea  ; call 0x18eea
+pop esi
+pop eax
+push ebx
+push 0x70
+call fcn_00018eea  ; call 0x18eea
+pop eax
+pop edx
+push 0x7f
+push 0x71
+call fcn_00017fac  ; call 0x17fac
+add esp, 0x10
+
+loc_0000dfd2:
+mov eax, dword [ebp + 8]
+add edi, 0xdc
+push edx
+push edx
+push 0x10
+lea esi, [eax + 0x3310]
+push esi
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0xc
+push 8
+push 0xf3
+push edi
+call fcn_0001878a  ; call 0x1878a
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_0000e018  ; je 0xe018
+push eax
+push eax
+push ref_00022755  ; push 0x22755
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e018:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000e020:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e03f  ; je 0xe03f
+push esi
+push esi
+push ref_0002276b  ; push 0x2276b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e03f:
+call fcn_0001bd75  ; call 0x1bd75
+test al, al
+jne short loc_0000e086  ; jne 0xe086
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e065  ; je 0xe065
+push ebx
+push ebx
+push ref_00022788  ; push 0x22788
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e065:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0000e086  ; je 0xe086
+push ecx
+push ref_00022281  ; push 0x22281
+push 0x974
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000e086:
+push edx
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov ebx, eax
+call fcn_00015479  ; call 0x15479
+and ebx, 0xffffc000
+add esp, 0x10
+test al, al
+je short loc_0000e0c4  ; je 0xe0c4
+push eax
+push eax
+push ref_000227c2  ; push 0x227c2
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e0c4:
+call fcn_00015480  ; call 0x15480
+sub esp, 0xc
+push ebx
+call fcn_0000ded1  ; call 0xded1
+mov dword [esp], 0xc
+call fcn_00019db6  ; call 0x19db6
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+jne short loc_0000e10e  ; jne 0xe10e
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e104  ; je 0xe104
+push eax
+push eax
+push ref_000227eb  ; push 0x227eb
+
+loc_0000e0f7:
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e104:
+mov ebx, 0x80000009
+jmp near loc_0000e262  ; jmp 0xe262
+
+loc_0000e10e:
+sub esp, 0xc
+push 0x28
+call fcn_00019db6  ; call 0x19db6
+add esp, 0x10
+mov esi, eax
+test eax, eax
+jne short loc_0000e133  ; jne 0xe133
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e104  ; je 0xe104
+push eax
+push eax
+push ref_00022821  ; push 0x22821
+jmp short loc_0000e0f7  ; jmp 0xe0f7
+
+loc_0000e133:
+push eax
+push 0x28
+push ref_00027030  ; push 0x27030
+push esi
+call fcn_0001713e  ; call 0x1713e
+mov dword [ebx], 0x80000010
+mov dword [ebx + 4], ref_0002917c  ; mov dword [ebx + 4], 0x2917c
+mov dword [ebx + 8], esi
+mov dword [esp], ebx
+call fcn_0001972b  ; call 0x1972b
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000e1a0  ; je 0xe1a0
+test ebx, ebx
+jns short loc_0000e1a0  ; jns 0xe1a0
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e188  ; je 0xe188
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e188:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x99d
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000e1a0:
+sub esp, 0xc
+push ref_00026f80  ; push 0x26f80
+call fcn_0001972b  ; call 0x1972b
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000e1f4  ; je 0xe1f4
+test ebx, ebx
+jns short loc_0000e1f4  ; jns 0xe1f4
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e1dc  ; je 0xe1dc
+push esi
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e1dc:
+push ebx
+push ref_000206f4  ; push 0x206f4
+push 0x9a3
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000e1f4:
+sub esp, 0xc
+push ref_00026f5c  ; push 0x26f5c
+call fcn_0001977f  ; call 0x1977f
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0000e248  ; je 0xe248
+test ebx, ebx
+jns short loc_0000e248  ; jns 0xe248
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e230  ; je 0xe230
+push ecx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e230:
+push edx
+push ref_000206f4  ; push 0x206f4
+push 0x9a9
+push ref_00022320  ; push 0x22320
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0000e248:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e262  ; je 0xe262
+push eax
+push eax
+push ref_00022853  ; push 0x22853
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e262:
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000e26b:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e28d  ; je 0xe28d
+push edx
+push edx
+push ref_0002286e  ; push 0x2286e
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e28d:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e2ae  ; je 0xe2ae
+push eax
+movzx eax, byte [ebx + 0xb4]
+push eax
+push ref_000228a4  ; push 0x228a4
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e2ae:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e2cf  ; je 0xe2cf
+push eax
+movzx eax, byte [ebx + 0xb5]
+push eax
+push ref_000228a4  ; push 0x228a4
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e2cf:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e2ed  ; je 0xe2ed
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+push ref_000228b8  ; push 0x228b8
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e2ed:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e30b  ; je 0xe30b
+push eax
+movzx eax, byte [ebx + 9]
+push eax
+push ref_000228c8  ; push 0x228c8
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e30b:
+xor esi, esi
+
+loc_0000e30d:
+call fcn_0001c261  ; call 0x1c261
+movzx eax, al
+cmp esi, eax
+jae short loc_0000e35a  ; jae 0xe35a
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e338  ; je 0xe338
+movzx eax, byte [ebx + esi*8 + 0x2c]
+push eax
+push esi
+push ref_000228d8  ; push 0x228d8
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e338:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e357  ; je 0xe357
+movzx eax, byte [ebx + esi*8 + 0x32]
+push eax
+push esi
+push ref_000228f7  ; push 0x228f7
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e357:
+inc esi
+jmp short loc_0000e30d  ; jmp 0xe30d
+
+loc_0000e35a:
+xor esi, esi
+
+loc_0000e35c:
+call fcn_0001c2f8  ; call 0x1c2f8
+movzx eax, al
+cmp esi, eax
+jae short loc_0000e38d  ; jae 0xe38d
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e38a  ; je 0xe38a
+movzx eax, byte [ebx + esi*4 + 0x9c]
+push eax
+push esi
+push ref_00022918  ; push 0x22918
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e38a:
+inc esi
+jmp short loc_0000e35c  ; jmp 0xe35c
+
+loc_0000e38d:
+xor esi, esi
+
+loc_0000e38f:
+call fcn_0001c245  ; call 0x1c245
+movzx eax, al
+cmp esi, eax
+jae short loc_0000e3bc  ; jae 0xe3bc
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e3b9  ; je 0xe3b9
+movzx eax, byte [ebx + esi*8]
+push eax
+push esi
+push ref_00022939  ; push 0x22939
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e3b9:
+inc esi
+jmp short loc_0000e38f  ; jmp 0xe38f
+
+loc_0000e3bc:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e3da  ; je 0xe3da
+push eax
+movzx eax, byte [ebx + 0x10]
+push eax
+push ref_00022959  ; push 0x22959
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e3da:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e3f8  ; je 0xe3f8
+push eax
+movzx eax, byte [ebx + 0x11]
+push eax
+push ref_00022972  ; push 0x22972
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e3f8:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e416  ; je 0xe416
+push esi
+movzx eax, byte [ebx + 0x12]
+push eax
+push ref_00022995  ; push 0x22995
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e416:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e434  ; je 0xe434
+push ecx
+movzx eax, byte [ebx + 0x13]
+push eax
+push ref_000229ae  ; push 0x229ae
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e434:
+xor esi, esi
+
+loc_0000e436:
+call fcn_0001c298  ; call 0x1c298
+movzx eax, al
+cmp esi, eax
+jae short loc_0000e478  ; jae 0xe478
+cmp byte [ebx + esi + 0x14], 0
+jne short loc_0000e45b  ; jne 0xe45b
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e475  ; je 0xe475
+push edx
+push esi
+push ref_000229cd  ; push 0x229cd
+jmp short loc_0000e46b  ; jmp 0xe46b
+
+loc_0000e45b:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e475  ; je 0xe475
+push eax
+push esi
+push ref_00022a02  ; push 0x22a02
+
+loc_0000e46b:
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e475:
+inc esi
+jmp short loc_0000e436  ; jmp 0xe436
+
+loc_0000e478:
+xor esi, esi
+
+loc_0000e47a:
+call fcn_0001c2f8  ; call 0x1c2f8
+movzx eax, al
+cmp esi, eax
+jae short loc_0000e4a8  ; jae 0xe4a8
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e4a5  ; je 0xe4a5
+movzx eax, byte [ebx + esi + 0x22]
+push eax
+push esi
+push ref_00022a37  ; push 0x22a37
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e4a5:
+inc esi
+jmp short loc_0000e47a  ; jmp 0xe47a
+
+loc_0000e4a8:
+xor esi, esi
+
+loc_0000e4aa:
+call fcn_0001c261  ; call 0x1c261
+movzx eax, al
+cmp esi, eax
+jae short loc_0000e516  ; jae 0xe516
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e4d5  ; je 0xe4d5
+movzx eax, byte [ebx + esi*8 + 0x2d]
+push eax
+push esi
+push ref_00022a6b  ; push 0x22a6b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e4d5:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e4f4  ; je 0xe4f4
+movzx eax, byte [ebx + esi*8 + 0x2e]
+push eax
+push esi
+push ref_00022a90  ; push 0x22a90
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e4f4:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e513  ; je 0xe513
+movzx eax, byte [ebx + esi*8 + 0x2f]
+push eax
+push esi
+push ref_00022ac0  ; push 0x22ac0
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e513:
+inc esi
+jmp short loc_0000e4aa  ; jmp 0xe4aa
+
+loc_0000e516:
+xor esi, esi
+
+loc_0000e518:
+call fcn_0001c2f8  ; call 0x1c2f8
+movzx eax, al
+cmp esi, eax
+jae short loc_0000e56b  ; jae 0xe56b
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e546  ; je 0xe546
+movzx eax, byte [ebx + esi*4 + 0x9d]
+push eax
+push esi
+push ref_00022af0  ; push 0x22af0
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e546:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e568  ; je 0xe568
+movzx eax, byte [ebx + esi*4 + 0x9e]
+push eax
+push esi
+push ref_00022b15  ; push 0x22b15
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e568:
+inc esi
+jmp short loc_0000e518  ; jmp 0xe518
+
+loc_0000e56b:
+xor esi, esi
+
+loc_0000e56d:
+call fcn_0001c21c  ; call 0x1c21c
+movzx eax, al
+cmp esi, eax
+jae short loc_0000e5ab  ; jae 0xe5ab
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e5a8  ; je 0xe5a8
+mov ax, word [ebx + esi*8 + 0x30]
+sub esp, 0xc
+mov edx, eax
+and edx, 0xf
+shr ax, 4
+push edx
+movzx eax, ax
+push eax
+push esi
+push ref_00022b3c  ; push 0x22b3c
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_0000e5a8:
+inc esi
+jmp short loc_0000e56d  ; jmp 0xe56d
+
+loc_0000e5ab:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000e5b2:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e5d4  ; je 0xe5d4
+push eax
+push eax
+push ref_00022b5a  ; push 0x22b5a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e5d4:
+xor ebx, ebx
+
+loc_0000e5d6:
+call fcn_0001c2f8  ; call 0x1c2f8
+movzx eax, al
+cmp ebx, eax
+jae near loc_0000e718  ; jae 0xe718
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e604  ; je 0xe604
+movzx eax, byte [esi + ebx*8]
+push eax
+push ebx
+push ref_00022b99  ; push 0x22b99
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e604:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e623  ; je 0xe623
+movzx eax, byte [esi + ebx*8 + 1]
+push eax
+push ebx
+push ref_00022bca  ; push 0x22bca
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e623:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e642  ; je 0xe642
+movzx eax, byte [esi + ebx*8 + 2]
+push eax
+push ebx
+push ref_00022bfe  ; push 0x22bfe
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e642:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e663  ; je 0xe663
+mov al, byte [esi + ebx*8 + 3]
+and eax, 1
+push eax
+push ebx
+push ref_00022c2b  ; push 0x22c2b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e663:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e686  ; je 0xe686
+mov al, byte [esi + ebx*8 + 3]
+shr al, 1
+movzx eax, al
+push eax
+push ebx
+push ref_00022c55  ; push 0x22c55
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e686:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e6a7  ; je 0xe6a7
+mov al, byte [esi + ebx*8 + 4]
+and eax, 1
+push eax
+push ebx
+push ref_00022c87  ; push 0x22c87
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e6a7:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e6ca  ; je 0xe6ca
+mov al, byte [esi + ebx*8 + 4]
+shr al, 1
+and eax, 1
+push eax
+push ebx
+push ref_00022cbe  ; push 0x22cbe
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e6ca:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e6ee  ; je 0xe6ee
+mov al, byte [esi + ebx*8 + 4]
+shr al, 2
+and eax, 1
+push eax
+push ebx
+push ref_00022cf8  ; push 0x22cf8
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e6ee:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e712  ; je 0xe712
+mov al, byte [esi + ebx*8 + 4]
+shr al, 3
+and eax, 1
+push eax
+push ebx
+push ref_00022d2b  ; push 0x22d2b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e712:
+inc ebx
+jmp near loc_0000e5d6  ; jmp 0xe5d6
+
+loc_0000e718:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000e71f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e745  ; je 0xe745
+push eax
+push eax
+push ref_00022d57  ; push 0x22d57
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e745:
+lea edi, [esi + 0x1e]
+xor ebx, ebx
+
+loc_0000e74a:
+call fcn_0001c1bf  ; call 0x1c1bf
+movzx eax, al
+cmp ebx, eax
+jae near loc_0000eba0  ; jae 0xeba0
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e77d  ; je 0xe77d
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax]
+and eax, 1
+push eax
+push ebx
+push ref_00022d8e  ; push 0x22d8e
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e77d:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e7a2  ; je 0xe7a2
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax]
+shr al, 1
+and eax, 1
+push eax
+push ebx
+push ref_00022da9  ; push 0x22da9
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e7a2:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e7c8  ; je 0xe7c8
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax]
+shr al, 2
+and eax, 1
+push eax
+push ebx
+push ref_00022dc1  ; push 0x22dc1
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e7c8:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e7ee  ; je 0xe7ee
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax]
+shr al, 3
+and eax, 1
+push eax
+push ebx
+push ref_00022de4  ; push 0x22de4
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e7ee:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e814  ; je 0xe814
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax]
+shr al, 4
+and eax, 1
+push eax
+push ebx
+push ref_00022dff  ; push 0x22dff
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e814:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e83a  ; je 0xe83a
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax]
+shr al, 5
+and eax, 1
+push eax
+push ebx
+push ref_00022e18  ; push 0x22e18
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e83a:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e860  ; je 0xe860
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax + 4]
+shr al, 1
+and eax, 1
+push eax
+push ebx
+push ref_00022e33  ; push 0x22e33
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e860:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e887  ; je 0xe887
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax + 4]
+shr al, 2
+and eax, 1
+push eax
+push ebx
+push ref_00022e5f  ; push 0x22e5f
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e887:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e8ae  ; je 0xe8ae
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax + 4]
+shr al, 3
+and eax, 1
+push eax
+push ebx
+push ref_00022e83  ; push 0x22e83
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e8ae:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e8d5  ; je 0xe8d5
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax + 4]
+shr al, 4
+and eax, 1
+push eax
+push ebx
+push ref_00022ea9  ; push 0x22ea9
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e8d5:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e8fc  ; je 0xe8fc
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax + 4]
+shr al, 5
+and eax, 1
+push eax
+push ebx
+push ref_00022ed3  ; push 0x22ed3
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e8fc:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e923  ; je 0xe923
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax + 4]
+shr al, 6
+and eax, 1
+push eax
+push ebx
+push ref_00022ef3  ; push 0x22ef3
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e923:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e94a  ; je 0xe94a
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax + 4]
+shr al, 7
+movzx eax, al
+push eax
+push ebx
+push ref_00022f1e  ; push 0x22f1e
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e94a:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e96e  ; je 0xe96e
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax + 5]
+and eax, 1
+push eax
+push ebx
+push ref_00022f4c  ; push 0x22f4c
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e96e:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e992  ; je 0xe992
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax + 4]
+and eax, 1
+push eax
+push ebx
+push ref_00022f7d  ; push 0x22f7d
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e992:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e9b8  ; je 0xe9b8
+imul eax, ebx, 0x2c
+mov al, byte [esi + eax]
+shr al, 6
+and eax, 1
+push eax
+push ebx
+push ref_00022fa7  ; push 0x22fa7
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e9b8:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e9d6  ; je 0xe9d6
+movzx eax, byte [edi - 0x16]
+push eax
+push ebx
+push ref_00022fcf  ; push 0x22fcf
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e9d6:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000e9f4  ; je 0xe9f4
+movzx eax, byte [edi - 0x15]
+push eax
+push ebx
+push ref_00022fec  ; push 0x22fec
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000e9f4:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ea12  ; je 0xea12
+movzx eax, byte [edi - 0x14]
+push eax
+push ebx
+push ref_0002300e  ; push 0x2300e
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ea12:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ea30  ; je 0xea30
+movzx eax, byte [edi - 0x13]
+push eax
+push ebx
+push ref_00023034  ; push 0x23034
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ea30:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ea4e  ; je 0xea4e
+movzx eax, byte [edi - 0xe]
+push eax
+push ebx
+push ref_00023059  ; push 0x23059
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ea4e:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ea6c  ; je 0xea6c
+movzx eax, byte [edi - 0xd]
+push eax
+push ebx
+push ref_00023071  ; push 0x23071
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ea6c:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ea8a  ; je 0xea8a
+movzx eax, byte [edi - 0xc]
+push eax
+push ebx
+push ref_00023090  ; push 0x23090
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ea8a:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000eaa8  ; je 0xeaa8
+movzx eax, byte [edi - 0xb]
+push eax
+push ebx
+push ref_000230ad  ; push 0x230ad
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000eaa8:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000eac6  ; je 0xeac6
+movzx eax, word [edi - 0xa]
+push eax
+push ebx
+push ref_000230ce  ; push 0x230ce
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000eac6:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000eae4  ; je 0xeae4
+movzx eax, word [edi - 8]
+push eax
+push ebx
+push ref_000230f4  ; push 0x230f4
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000eae4:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000eb02  ; je 0xeb02
+movzx eax, byte [edi - 6]
+push eax
+push ebx
+push ref_0002311c  ; push 0x2311c
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000eb02:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000eb20  ; je 0xeb20
+movzx eax, byte [edi - 5]
+push eax
+push ebx
+push ref_00023148  ; push 0x23148
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000eb20:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000eb3e  ; je 0xeb3e
+movzx eax, word [edi - 4]
+push eax
+push ebx
+push ref_0002317a  ; push 0x2317a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000eb3e:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000eb5c  ; je 0xeb5c
+movzx eax, byte [edi - 2]
+push eax
+push ebx
+push ref_000231a7  ; push 0x231a7
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000eb5c:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000eb7a  ; je 0xeb7a
+movzx eax, byte [edi - 1]
+push eax
+push ebx
+push ref_000231d6  ; push 0x231d6
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000eb7a:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000eb97  ; je 0xeb97
+movzx eax, word [edi]
+push eax
+push ebx
+push ref_0002320b  ; push 0x2320b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000eb97:
+inc ebx
+add edi, 0x2c
+jmp near loc_0000e74a  ; jmp 0xe74a
+
+loc_0000eba0:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ebc1  ; je 0xebc1
+push edi
+movzx eax, byte [esi + 0x160]
+push eax
+push ref_0002323b  ; push 0x2323b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ebc1:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ebe2  ; je 0xebe2
+push ebx
+movzx eax, byte [esi + 0x161]
+push eax
+push ref_00023251  ; push 0x23251
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ebe2:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ec03  ; je 0xec03
+push ecx
+movzx eax, byte [esi + 0x162]
+push eax
+push ref_00023267  ; push 0x23267
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ec03:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ec24  ; je 0xec24
+push edx
+movzx eax, byte [esi + 0x163]
+push eax
+push ref_00023281  ; push 0x23281
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ec24:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ec47  ; je 0xec47
+push eax
+mov al, byte [esi + 0x164]
+and eax, 1
+push eax
+push ref_000232a0  ; push 0x232a0
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ec47:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000ec4f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ec75  ; je 0xec75
+push edi
+push edi
+push ref_000232bf  ; push 0x232bf
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ec75:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ec92  ; je 0xec92
+push ebx
+movzx eax, byte [esi]
+push eax
+push ref_00023454  ; push 0x23454
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ec92:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ecae  ; je 0xecae
+push ecx
+push dword [esi + 1]
+push ref_000232f6  ; push 0x232f6
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ecae:
+lea edi, [esi + 0xd]
+xor ebx, ebx
+
+loc_0000ecb3:
+call fcn_0001c1e1  ; call 0x1c1e1
+movzx eax, al
+cmp ebx, eax
+jae near loc_0000f052  ; jae 0xf052
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ece7  ; je 0xece7
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 5]
+and eax, 1
+push eax
+push ebx
+push ref_000228d8  ; push 0x228d8
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ece7:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ed0d  ; je 0xed0d
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 5]
+shr al, 1
+and eax, 1
+push eax
+push ebx
+push ref_00023305  ; push 0x23305
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ed0d:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ed34  ; je 0xed34
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 5]
+shr al, 2
+and eax, 1
+push eax
+push ebx
+push ref_00023324  ; push 0x23324
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ed34:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ed5b  ; je 0xed5b
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 5]
+shr al, 3
+and eax, 1
+push eax
+push ebx
+push ref_00023347  ; push 0x23347
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ed5b:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ed82  ; je 0xed82
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 5]
+shr al, 4
+and eax, 1
+push eax
+push ebx
+push ref_00023367  ; push 0x23367
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ed82:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000eda9  ; je 0xeda9
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 5]
+shr al, 5
+and eax, 1
+push eax
+push ebx
+push ref_00023385  ; push 0x23385
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000eda9:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000edd0  ; je 0xedd0
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 5]
+shr al, 6
+and eax, 1
+push eax
+push ebx
+push ref_000233ac  ; push 0x233ac
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000edd0:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000edf7  ; je 0xedf7
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 5]
+shr al, 7
+movzx eax, al
+push eax
+push ebx
+push ref_000233ca  ; push 0x233ca
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000edf7:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ee1b  ; je 0xee1b
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 6]
+and eax, 0xf
+push eax
+push ebx
+push ref_000233f2  ; push 0x233f2
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ee1b:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ee4f  ; je 0xee4f
+imul edx, ebx, 0x12
+add edx, esi
+mov al, byte [edx + 6]
+shr al, 4
+movzx ecx, al
+movzx eax, byte [edx + 7]
+and eax, 0x3f
+shl eax, 4
+or eax, ecx
+push eax
+push ebx
+push ref_0002340f  ; push 0x2340f
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ee4f:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ee6d  ; je 0xee6d
+movzx eax, byte [edi - 3]
+push eax
+push ebx
+push ref_0002342e  ; push 0x2342e
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ee6d:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ee8b  ; je 0xee8b
+movzx eax, byte [edi - 4]
+push eax
+push ebx
+push ref_00023461  ; push 0x23461
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ee8b:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000eea9  ; je 0xeea9
+movzx eax, byte [edi - 1]
+push eax
+push ebx
+push ref_00023492  ; push 0x23492
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000eea9:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000eec7  ; je 0xeec7
+movzx eax, byte [edi - 2]
+push eax
+push ebx
+push ref_000234c5  ; push 0x234c5
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000eec7:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000eee5  ; je 0xeee5
+movzx eax, byte [edi + 1]
+push eax
+push ebx
+push ref_000234f6  ; push 0x234f6
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000eee5:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ef02  ; je 0xef02
+movzx eax, byte [edi]
+push eax
+push ebx
+push ref_00023529  ; push 0x23529
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ef02:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ef24  ; je 0xef24
+imul eax, ebx, 0x12
+movzx eax, byte [esi + eax + 0xf]
+push eax
+push ebx
+push ref_0002355a  ; push 0x2355a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ef24:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ef46  ; je 0xef46
+imul eax, ebx, 0x12
+movzx eax, byte [esi + eax + 0x10]
+push eax
+push ebx
+push ref_00023590  ; push 0x23590
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ef46:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ef68  ; je 0xef68
+imul eax, ebx, 0x12
+movzx eax, byte [esi + eax + 0x11]
+push eax
+push ebx
+push ref_000235c7  ; push 0x235c7
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ef68:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ef8a  ; je 0xef8a
+imul eax, ebx, 0x12
+movzx eax, byte [esi + eax + 0x12]
+push eax
+push ebx
+push ref_000235f8  ; push 0x235f8
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ef8a:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000efae  ; je 0xefae
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 0x13]
+and eax, 1
+push eax
+push ebx
+push ref_0002362a  ; push 0x2362a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000efae:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000efd4  ; je 0xefd4
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 0x13]
+shr al, 1
+and eax, 1
+push eax
+push ebx
+push ref_00023666  ; push 0x23666
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000efd4:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000effb  ; je 0xeffb
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 0x13]
+shr al, 2
+and eax, 1
+push eax
+push ebx
+push ref_000236a3  ; push 0x236a3
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000effb:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f022  ; je 0xf022
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 0x13]
+shr al, 3
+and eax, 1
+push eax
+push ebx
+push ref_000236da  ; push 0x236da
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f022:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f049  ; je 0xf049
+imul eax, ebx, 0x12
+mov al, byte [esi + eax + 7]
+shr al, 6
+and eax, 1
+push eax
+push ebx
+push ref_00023712  ; push 0x23712
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f049:
+inc ebx
+add edi, 0x12
+jmp near loc_0000ecb3  ; jmp 0xecb3
+
+loc_0000f052:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f072  ; je 0xf072
+push edx
+mov al, byte [esi + 0x71]
+and eax, 1
+push eax
+push ref_00023749  ; push 0x23749
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f072:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f094  ; je 0xf094
+push eax
+mov al, byte [esi + 0x71]
+shr al, 1
+and eax, 1
+push eax
+push ref_0002375f  ; push 0x2375f
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f094:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f0b7  ; je 0xf0b7
+push eax
+mov al, byte [esi + 0x71]
+shr al, 2
+and eax, 1
+push eax
+push ref_0002376b  ; push 0x2376b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f0b7:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f0da  ; je 0xf0da
+push eax
+mov al, byte [esi + 0x71]
+shr al, 3
+and eax, 1
+push eax
+push ref_00023777  ; push 0x23777
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f0da:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f0fd  ; je 0xf0fd
+push eax
+mov al, byte [esi + 0x71]
+shr al, 4
+and eax, 1
+push eax
+push ref_00023784  ; push 0x23784
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f0fd:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f120  ; je 0xf120
+push eax
+mov al, byte [esi + 0x71]
+shr al, 5
+and eax, 1
+push eax
+push ref_00023790  ; push 0x23790
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f120:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f143  ; je 0xf143
+push eax
+mov al, byte [esi + 0x71]
+shr al, 6
+and eax, 1
+push eax
+push ref_0002379b  ; push 0x2379b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f143:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f171  ; je 0xf171
+push edi
+mov al, byte [esi + 0x71]
+shr al, 7
+movzx edx, al
+movzx eax, byte [esi + 0x72]
+and eax, 1
+add eax, eax
+or eax, edx
+push eax
+push ref_000237ae  ; push 0x237ae
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f171:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f193  ; je 0xf193
+push ebx
+mov al, byte [esi + 0x72]
+shr al, 1
+and eax, 1
+push eax
+push ref_000237c0  ; push 0x237c0
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f193:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f1b6  ; je 0xf1b6
+push ecx
+mov al, byte [esi + 0x72]
+shr al, 2
+and eax, 1
+push eax
+push ref_000237d0  ; push 0x237d0
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f1b6:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f1d9  ; je 0xf1d9
+push edx
+mov al, byte [esi + 0x72]
+shr al, 3
+and eax, 1
+push eax
+push ref_000237e0  ; push 0x237e0
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f1d9:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f1fc  ; je 0xf1fc
+push eax
+mov al, byte [esi + 0x72]
+shr al, 4
+and eax, 1
+push eax
+push ref_000237ef  ; push 0x237ef
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f1fc:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f218  ; je 0xf218
+push eax
+push dword [esi + 0x75]
+push ref_00023802  ; push 0x23802
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f218:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f236  ; je 0xf236
+push eax
+movzx eax, byte [esi + 0x7d]
+push eax
+push ref_00023815  ; push 0x23815
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f236:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f254  ; je 0xf254
+push eax
+movzx eax, byte [esi + 0x79]
+push eax
+push ref_0002382b  ; push 0x2382b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f254:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f272  ; je 0xf272
+push eax
+movzx eax, byte [esi + 0x7a]
+push eax
+push ref_0002383a  ; push 0x2383a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f272:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f290  ; je 0xf290
+push eax
+movzx eax, byte [esi + 0x7b]
+push eax
+push ref_0002384b  ; push 0x2384b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f290:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f2ae  ; je 0xf2ae
+push edi
+movzx eax, byte [esi + 0x7c]
+push eax
+push ref_0002385d  ; push 0x2385d
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f2ae:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f2cc  ; je 0xf2cc
+push ebx
+movzx eax, byte [esi + 0x7e]
+push eax
+push ref_00023870  ; push 0x23870
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f2cc:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f2ea  ; je 0xf2ea
+push ecx
+movzx eax, byte [esi + 0x7f]
+push eax
+push ref_0002388b  ; push 0x2388b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f2ea:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f30b  ; je 0xf30b
+push edx
+movzx eax, byte [esi + 0x80]
+push eax
+push ref_000238ac  ; push 0x238ac
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f30b:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f32c  ; je 0xf32c
+push eax
+movzx eax, byte [esi + 0x81]
+push eax
+push ref_000238d5  ; push 0x238d5
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f32c:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0000f334:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f356  ; je 0xf356
+push eax
+push eax
+push ref_000238fa  ; push 0x238fa
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f356:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f373  ; je 0xf373
+push eax
+movzx eax, byte [ebx]
+push eax
+push ref_00023933  ; push 0x23933
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f373:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f391  ; je 0xf391
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+push ref_00023942  ; push 0x23942
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f391:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f3af  ; je 0xf3af
+push eax
+movzx eax, byte [ebx + 2]
+push eax
+push ref_00023952  ; push 0x23952
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f3af:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f3cd  ; je 0xf3cd
+push eax
+movzx eax, byte [ebx + 3]
+push eax
+push ref_00022ff9  ; push 0x22ff9
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f3cd:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f3eb  ; je 0xf3eb
+push ecx
+movzx eax, byte [ebx + 4]
+push eax
+push ref_00023965  ; push 0x23965
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f3eb:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f409  ; je 0xf409
+push edx
+movzx eax, byte [ebx + 5]
+push eax
+push ref_00023974  ; push 0x23974
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f409:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f427  ; je 0xf427
+push eax
+movzx eax, byte [ebx + 6]
+push eax
+push ref_0002398a  ; push 0x2398a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f427:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000f42c:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f44e  ; je 0xf44e
+push eax
+push eax
+push ref_000239a1  ; push 0x239a1
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f44e:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f46b  ; je 0xf46b
+push eax
+movzx eax, byte [ebx]
+push eax
+push ref_000239d8  ; push 0x239d8
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f46b:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f489  ; je 0xf489
+push eax
+movzx eax, byte [ebx + 8]
+push eax
+push ref_000239e4  ; push 0x239e4
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f489:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f4a7  ; je 0xf4a7
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+push ref_000239f2  ; push 0x239f2
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f4a7:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f4c5  ; je 0xf4c5
+push ecx
+movzx eax, byte [ebx + 2]
+push eax
+push ref_00023a01  ; push 0x23a01
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f4c5:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f4e3  ; je 0xf4e3
+push edx
+movzx eax, byte [ebx + 3]
+push eax
+push ref_00023a13  ; push 0x23a13
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f4e3:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f4ff  ; je 0xf4ff
+push eax
+push dword [ebx + 4]
+push ref_00023a27  ; push 0x23a27
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f4ff:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000f504:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f526  ; je 0xf526
+push eax
+push eax
+push ref_00023a31  ; push 0x23a31
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f526:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f545  ; je 0xf545
+push eax
+mov al, byte [ebx]
+and eax, 1
+push eax
+push ref_00023a6d  ; push 0x23a6d
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f545:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f566  ; je 0xf566
+push eax
+mov al, byte [ebx]
+shr al, 1
+and eax, 1
+push eax
+push ref_00023a7d  ; push 0x23a7d
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f566:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f588  ; je 0xf588
+push eax
+mov al, byte [ebx]
+shr al, 2
+and eax, 1
+push eax
+push ref_00023a91  ; push 0x23a91
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f588:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f5aa  ; je 0xf5aa
+push ecx
+mov al, byte [ebx]
+shr al, 3
+and eax, 1
+push eax
+push ref_00023aa4  ; push 0x23aa4
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f5aa:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f5cc  ; je 0xf5cc
+push edx
+mov al, byte [ebx]
+shr al, 4
+and eax, 1
+push eax
+push ref_00023ab2  ; push 0x23ab2
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f5cc:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f5ee  ; je 0xf5ee
+push eax
+mov al, byte [ebx]
+shr al, 5
+and eax, 1
+push eax
+push ref_00023ac1  ; push 0x23ac1
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f5ee:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000f5f3:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f615  ; je 0xf615
+push eax
+push eax
+push ref_00023ace  ; push 0x23ace
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f615:
+xor ebx, ebx
+
+loc_0000f617:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f637  ; je 0xf637
+mov al, byte [esi + ebx*8]
+and eax, 1
+push eax
+push ebx
+push ref_00023b11  ; push 0x23b11
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f637:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f659  ; je 0xf659
+mov al, byte [esi + ebx*8]
+shr al, 1
+and eax, 1
+push eax
+push ebx
+push ref_00023b31  ; push 0x23b31
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f659:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f678  ; je 0xf678
+movzx eax, word [esi + ebx*8 + 4]
+push eax
+push ebx
+push ref_00023b50  ; push 0x23b50
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f678:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f697  ; je 0xf697
+movzx eax, word [esi + ebx*8 + 6]
+push eax
+push ebx
+push ref_00023b6e  ; push 0x23b6e
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f697:
+inc ebx
+cmp ebx, 5
+jne near loc_0000f617  ; jne 0xf617
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000f6a8:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f6ca  ; je 0xf6ca
+push eax
+push eax
+push ref_00023b8b  ; push 0x23b8b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f6ca:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f6e7  ; je 0xf6e7
+push eax
+movzx eax, byte [ebx]
+push eax
+push ref_00023454  ; push 0x23454
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f6e7:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f705  ; je 0xf705
+push eax
+movzx eax, word [ebx + 2]
+push eax
+push ref_00023bc3  ; push 0x23bc3
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f705:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f723  ; je 0xf723
+push esi
+movzx eax, byte [ebx + 7]
+push eax
+push ref_00023bd5  ; push 0x23bd5
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f723:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f73d  ; je 0xf73d
+push ecx
+push ecx
+push ref_00023bf1  ; push 0x23bf1
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f73d:
+xor esi, esi
+
+loc_0000f73f:
+movzx eax, byte [ebx + 7]
+cmp esi, eax
+jae short loc_0000f769  ; jae 0xf769
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f766  ; je 0xf766
+push edx
+movzx eax, byte [ebx + esi + 8]
+push eax
+push ref_00023c0b  ; push 0x23c0b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f766:
+inc esi
+jmp short loc_0000f73f  ; jmp 0xf73f
+
+loc_0000f769:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f783  ; je 0xf783
+push eax
+push eax
+push ref_00023c12  ; push 0x23c12
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f783:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0000f78a:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f7ac  ; je 0xf7ac
+push eax
+push eax
+push ref_00023c16  ; push 0x23c16
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f7ac:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f7c9  ; je 0xf7c9
+push eax
+movzx eax, byte [ebx]
+push eax
+push ref_00023454  ; push 0x23454
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f7c9:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f7e7  ; je 0xf7e7
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+push ref_00023c4f  ; push 0x23c4f
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f7e7:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f805  ; je 0xf805
+push ecx
+movzx eax, byte [ebx + 2]
+push eax
+push ref_00023c59  ; push 0x23c59
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f805:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f823  ; je 0xf823
+push edx
+movzx eax, byte [ebx + 2]
+push eax
+push ref_00023c59  ; push 0x23c59
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f823:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f841  ; je 0xf841
+push eax
+movzx eax, word [ebx + 4]
+push eax
+push ref_00023c6b  ; push 0x23c6b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f841:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000f846:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f868  ; je 0xf868
+push eax
+push eax
+push ref_00023c80  ; push 0x23c80
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f868:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f887  ; je 0xf887
+push eax
+mov al, byte [ebx]
+and eax, 1
+push eax
+push ref_00023cb5  ; push 0x23cb5
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f887:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f8a8  ; je 0xf8a8
+push eax
+mov al, byte [ebx]
+shr al, 1
+and eax, 1
+push eax
+push ref_00023cdb  ; push 0x23cdb
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f8a8:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f8ca  ; je 0xf8ca
+push ecx
+mov al, byte [ebx]
+shr al, 2
+and eax, 1
+push eax
+push ref_00023d05  ; push 0x23d05
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f8ca:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f8ec  ; je 0xf8ec
+push edx
+mov al, byte [ebx]
+shr al, 3
+and eax, 1
+push eax
+push ref_00023d2f  ; push 0x23d2f
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f8ec:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f90e  ; je 0xf90e
+push eax
+mov al, byte [ebx]
+shr al, 4
+and eax, 1
+push eax
+push ref_00023d59  ; push 0x23d59
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f90e:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f92e  ; je 0xf92e
+push eax
+mov al, byte [ebx + 4]
+and eax, 1
+push eax
+push ref_00023d81  ; push 0x23d81
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f92e:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f950  ; je 0xf950
+push eax
+mov al, byte [ebx + 4]
+shr al, 1
+and eax, 1
+push eax
+push ref_00023d9d  ; push 0x23d9d
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f950:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f973  ; je 0xf973
+push eax
+mov al, byte [ebx + 4]
+shr al, 2
+and eax, 1
+push eax
+push ref_00023dc0  ; push 0x23dc0
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f973:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f996  ; je 0xf996
+push eax
+mov al, byte [ebx + 4]
+shr al, 3
+and eax, 1
+push eax
+push ref_00023de4  ; push 0x23de4
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f996:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f9b9  ; je 0xf9b9
+push eax
+mov al, byte [ebx + 4]
+shr al, 4
+and eax, 1
+push eax
+push ref_00023e08  ; push 0x23e08
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f9b9:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f9dc  ; je 0xf9dc
+push ecx
+mov al, byte [ebx + 4]
+shr al, 5
+and eax, 1
+push eax
+push ref_00023e26  ; push 0x23e26
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f9dc:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000f9f8  ; je 0xf9f8
+push edx
+push dword [ebx + 8]
+push ref_00023e4a  ; push 0x23e4a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000f9f8:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fa14  ; je 0xfa14
+push eax
+push dword [ebx + 0xc]
+push ref_00023e5d  ; push 0x23e5d
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fa14:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fa30  ; je 0xfa30
+push eax
+push dword [ebx + 0x10]
+push ref_00023e75  ; push 0x23e75
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fa30:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fa4c  ; je 0xfa4c
+push eax
+push dword [ebx + 0x14]
+push ref_00023e8d  ; push 0x23e8d
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fa4c:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fa68  ; je 0xfa68
+push eax
+push dword [ebx + 0x18]
+push ref_00023ea6  ; push 0x23ea6
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fa68:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fa88  ; je 0xfa88
+push eax
+mov al, byte [ebx + 0x1c]
+and eax, 1
+push eax
+push ref_00023ebd  ; push 0x23ebd
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fa88:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000faaa  ; je 0xfaaa
+push eax
+mov al, byte [ebx + 0x1c]
+shr al, 1
+and eax, 1
+push eax
+push ref_00023ecf  ; push 0x23ecf
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000faaa:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000facd  ; je 0xfacd
+push ecx
+mov al, byte [ebx + 0x1c]
+shr al, 2
+and eax, 1
+push eax
+push ref_00023ee3  ; push 0x23ee3
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000facd:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000faf0  ; je 0xfaf0
+push edx
+mov al, byte [ebx + 0x1c]
+shr al, 3
+and eax, 1
+push eax
+push ref_00023ef5  ; push 0x23ef5
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000faf0:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fb0e  ; je 0xfb0e
+push eax
+movzx eax, byte [ebx + 0x20]
+push eax
+push ref_00023f0c  ; push 0x23f0c
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fb0e:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000fb13:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fb35  ; je 0xfb35
+push eax
+push eax
+push ref_00023f1f  ; push 0x23f1f
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fb35:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fb54  ; je 0xfb54
+push eax
+mov al, byte [ebx]
+and eax, 1
+push eax
+push ref_00023f55  ; push 0x23f55
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fb54:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fb75  ; je 0xfb75
+push eax
+mov al, byte [ebx]
+shr al, 1
+and eax, 1
+push eax
+push ref_00023f63  ; push 0x23f63
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fb75:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fb97  ; je 0xfb97
+push eax
+mov al, byte [ebx]
+shr al, 2
+and eax, 1
+push eax
+push ref_00023f74  ; push 0x23f74
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fb97:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fbb9  ; je 0xfbb9
+push ecx
+mov al, byte [ebx]
+shr al, 3
+and eax, 1
+push eax
+push ref_0002385d  ; push 0x2385d
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fbb9:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fbdb  ; je 0xfbdb
+push edx
+mov al, byte [ebx]
+shr al, 4
+and eax, 1
+push eax
+push ref_00023f81  ; push 0x23f81
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fbdb:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fbfd  ; je 0xfbfd
+push eax
+mov al, byte [ebx]
+shr al, 5
+and eax, 1
+push eax
+push ref_00023f97  ; push 0x23f97
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fbfd:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000fc02:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fc24  ; je 0xfc24
+push eax
+push eax
+push ref_00023fac  ; push 0x23fac
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fc24:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fc41  ; je 0xfc41
+push ecx
+movzx eax, byte [ebx]
+push eax
+push ref_00023fe7  ; push 0x23fe7
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fc41:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fc5d  ; je 0xfc5d
+push edx
+push dword [ebx + 4]
+push ref_00023ff8  ; push 0x23ff8
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fc5d:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fc79  ; je 0xfc79
+push eax
+push dword [ebx + 8]
+push ref_00024007  ; push 0x24007
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fc79:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0000fc7e:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fca0  ; je 0xfca0
+push ecx
+push ecx
+push ref_0002401d  ; push 0x2401d
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fca0:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fcbf  ; je 0xfcbf
+push edx
+mov al, byte [ebx]
+and eax, 1
+push eax
+push ref_00024057  ; push 0x24057
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fcbf:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fce0  ; je 0xfce0
+push eax
+mov al, byte [ebx]
+shr al, 1
+and eax, 1
+push eax
+push ref_00024078  ; push 0x24078
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fce0:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fd02  ; je 0xfd02
+push eax
+mov al, byte [ebx]
+shr al, 2
+and eax, 1
+push eax
+push ref_00024098  ; push 0x24098
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fd02:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fd24  ; je 0xfd24
+push eax
+mov al, byte [ebx]
+shr al, 3
+and eax, 1
+push eax
+push ref_000240bb  ; push 0x240bb
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fd24:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fd4e  ; je 0xfd4e
+push eax
+movzx eax, byte [ebx + 5]
+movzx edx, byte [ebx + 4]
+and eax, 1
+shl eax, 8
+or eax, edx
+push eax
+push ref_000240dd  ; push 0x240dd
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fd4e:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fd7c  ; je 0xfd7c
+push eax
+mov al, byte [ebx + 5]
+shr al, 1
+movzx edx, al
+movzx eax, byte [ebx + 6]
+and eax, 3
+shl eax, 7
+or eax, edx
+push eax
+push ref_00024117  ; push 0x24117
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fd7c:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fdab  ; je 0xfdab
+push eax
+mov al, byte [ebx + 6]
+shr al, 2
+movzx edx, al
+movzx eax, byte [ebx + 7]
+and eax, 7
+shl eax, 6
+or eax, edx
+push eax
+push ref_00024151  ; push 0x24151
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fdab:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fdce  ; je 0xfdce
+push esi
+mov al, byte [ebx + 7]
+shr al, 3
+and eax, 1
+push eax
+push ref_0002418b  ; push 0x2418b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fdce:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fdf1  ; je 0xfdf1
+push ecx
+mov al, byte [ebx + 7]
+shr al, 4
+and eax, 1
+push eax
+push ref_000241b4  ; push 0x241b4
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fdf1:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fe14  ; je 0xfe14
+push edx
+mov al, byte [ebx + 7]
+shr al, 5
+and eax, 1
+push eax
+push ref_000241e4  ; push 0x241e4
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fe14:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fe37  ; je 0xfe37
+push eax
+mov al, byte [ebx + 7]
+shr al, 6
+and eax, 1
+push eax
+push ref_0002420b  ; push 0x2420b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fe37:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fe5a  ; je 0xfe5a
+push eax
+mov al, byte [ebx + 7]
+shr al, 7
+movzx eax, al
+push eax
+push ref_0002423c  ; push 0x2423c
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fe5a:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fe7a  ; je 0xfe7a
+push eax
+mov al, byte [ebx + 0xc]
+and eax, 1
+push eax
+push ref_0002426f  ; push 0x2426f
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fe7a:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fe9a  ; je 0xfe9a
+push eax
+mov al, byte [ebx + 0xd]
+and eax, 3
+push eax
+push ref_00024299  ; push 0x24299
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fe9a:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000febd  ; je 0xfebd
+push eax
+mov al, byte [ebx + 0xd]
+shr al, 2
+and eax, 3
+push eax
+push ref_000242bf  ; push 0x242bf
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000febd:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fee0  ; je 0xfee0
+push eax
+mov al, byte [ebx + 0xd]
+shr al, 4
+and eax, 3
+push eax
+push ref_000242e5  ; push 0x242e5
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fee0:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ff03  ; je 0xff03
+push esi
+mov al, byte [ebx + 0xd]
+shr al, 6
+movzx eax, al
+push eax
+push ref_0002430b  ; push 0x2430b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ff03:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ff25  ; je 0xff25
+push ecx
+mov al, byte [ebx + 0xc]
+shr al, 1
+and eax, 1
+push eax
+push ref_00024331  ; push 0x24331
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ff25:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ff45  ; je 0xff45
+push edx
+mov al, byte [ebx + 0x10]
+and eax, 3
+push eax
+push ref_00024362  ; push 0x24362
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ff45:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ff68  ; je 0xff68
+push eax
+mov al, byte [ebx + 0x10]
+shr al, 2
+and eax, 3
+push eax
+push ref_00024386  ; push 0x24386
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ff68:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ff8b  ; je 0xff8b
+push eax
+mov al, byte [ebx + 0x10]
+shr al, 4
+and eax, 3
+push eax
+push ref_000243aa  ; push 0x243aa
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ff8b:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ffae  ; je 0xffae
+push eax
+mov al, byte [ebx + 0x10]
+shr al, 6
+movzx eax, al
+push eax
+push ref_000243ce  ; push 0x243ce
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ffae:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000ffce  ; je 0xffce
+push eax
+mov al, byte [ebx + 0x12]
+and eax, 3
+push eax
+push ref_000243f4  ; push 0x243f4
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000ffce:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0000fff1  ; je 0xfff1
+push eax
+mov al, byte [ebx + 0x12]
+shr al, 2
+and eax, 1
+push eax
+push ref_0002441b  ; push 0x2441b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0000fff1:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010011  ; je 0x10011
+push eax
+mov al, byte [ebx + 0x11]
+and eax, 3
+push eax
+push ref_00024446  ; push 0x24446
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010011:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010034  ; je 0x10034
+push esi
+mov al, byte [ebx + 0x11]
+shr al, 2
+and eax, 3
+push eax
+push ref_0002446a  ; push 0x2446a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010034:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010057  ; je 0x10057
+push ecx
+mov al, byte [ebx + 0x11]
+shr al, 4
+and eax, 3
+push eax
+push ref_0002448e  ; push 0x2448e
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010057:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001007a  ; je 0x1007a
+push edx
+mov al, byte [ebx + 0x11]
+shr al, 6
+movzx eax, al
+push eax
+push ref_000244b2  ; push 0x244b2
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001007a:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001009d  ; je 0x1009d
+push eax
+mov al, byte [ebx + 0x12]
+shr al, 3
+and eax, 3
+push eax
+push ref_000244d8  ; push 0x244d8
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001009d:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000100c0  ; je 0x100c0
+push eax
+mov al, byte [ebx + 0x12]
+shr al, 5
+and eax, 1
+push eax
+push ref_000244ff  ; push 0x244ff
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000100c0:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000100e3  ; je 0x100e3
+push eax
+mov al, byte [ebx + 0x12]
+shr al, 6
+and eax, 1
+push eax
+push ref_0002452a  ; push 0x2452a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000100e3:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010103  ; je 0x10103
+push eax
+mov al, byte [ebx + 0x14]
+and eax, 1
+push eax
+push ref_00024559  ; push 0x24559
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010103:
+mov esi, 2
+
+loc_00010108:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010129  ; je 0x10129
+push eax
+mov al, byte [ebx + esi*4 + 0x18]
+and eax, 1
+push eax
+push ref_00024577  ; push 0x24577
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010129:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001014c  ; je 0x1014c
+push eax
+mov al, byte [ebx + esi*4 + 0x18]
+shr al, 1
+and eax, 1
+push eax
+push ref_000245ac  ; push 0x245ac
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001014c:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010170  ; je 0x10170
+push ecx
+mov al, byte [ebx + esi*4 + 0x18]
+shr al, 2
+and eax, 1
+push eax
+push ref_000245e5  ; push 0x245e5
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010170:
+inc esi
+cmp esi, 4
+jne short loc_00010108  ; jne 0x10108
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010194  ; je 0x10194
+push edx
+movzx eax, word [ebx + 0x28]
+push eax
+push ref_0002461a  ; push 0x2461a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010194:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000101b2  ; je 0x101b2
+push eax
+movzx eax, byte [ebx + 0x2a]
+push eax
+push ref_0002462d  ; push 0x2462d
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000101b2:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_000101b9:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000101db  ; je 0x101db
+push eax
+push eax
+push ref_0002464f  ; push 0x2464f
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000101db:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000101f8  ; je 0x101f8
+push eax
+movzx eax, word [ebx]
+push eax
+push ref_00024689  ; push 0x24689
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000101f8:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010216  ; je 0x10216
+push ecx
+movzx eax, word [ebx + 2]
+push eax
+push ref_000246a1  ; push 0x246a1
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010216:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010234  ; je 0x10234
+push edx
+movzx eax, byte [ebx + 4]
+push eax
+push ref_000246b3  ; push 0x246b3
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010234:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010252  ; je 0x10252
+push eax
+movzx eax, byte [ebx + 5]
+push eax
+push ref_000246be  ; push 0x246be
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010252:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00010257:
+push ebp
+mov ebp, esp
+push ebx
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010279  ; je 0x10279
+push ecx
+push ecx
+push ref_000246ca  ; push 0x246ca
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010279:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010296  ; je 0x10296
+push edx
+movzx eax, byte [ebx]
+push eax
+push ref_00023454  ; push 0x23454
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010296:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000102b4  ; je 0x102b4
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+push ref_0002309d  ; push 0x2309d
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000102b4:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000102b9:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000102db  ; je 0x102db
+push eax
+push eax
+push ref_00024700  ; push 0x24700
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000102db:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000102fe  ; je 0x102fe
+push eax
+mov al, byte [ebx + 8]
+shr al, 7
+movzx eax, al
+push eax
+push ref_0002473c  ; push 0x2473c
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000102fe:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001031b  ; je 0x1031b
+push eax
+movzx eax, byte [ebx]
+push eax
+push ref_0002474f  ; push 0x2474f
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001031b:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010339  ; je 0x10339
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+push ref_00024761  ; push 0x24761
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010339:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010357  ; je 0x10357
+push eax
+movzx eax, byte [ebx + 2]
+push eax
+push ref_00024774  ; push 0x24774
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010357:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010375  ; je 0x10375
+push eax
+movzx eax, byte [ebx + 3]
+push eax
+push ref_00024787  ; push 0x24787
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010375:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010393  ; je 0x10393
+push ecx
+movzx eax, byte [ebx + 4]
+push eax
+push ref_0002479a  ; push 0x2479a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010393:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000103b1  ; je 0x103b1
+push edx
+movzx eax, byte [ebx + 5]
+push eax
+push ref_000247ad  ; push 0x247ad
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000103b1:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000103cf  ; je 0x103cf
+push eax
+movzx eax, byte [ebx + 6]
+push eax
+push ref_000247c1  ; push 0x247c1
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000103cf:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000103ed  ; je 0x103ed
+push eax
+movzx eax, byte [ebx + 7]
+push eax
+push ref_000247d5  ; push 0x247d5
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000103ed:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001040d  ; je 0x1040d
+push eax
+mov al, byte [ebx + 8]
+and eax, 1
+push eax
+push ref_000247e8  ; push 0x247e8
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001040d:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001042f  ; je 0x1042f
+push eax
+mov al, byte [ebx + 8]
+shr al, 1
+and eax, 1
+push eax
+push ref_00024800  ; push 0x24800
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001042f:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010452  ; je 0x10452
+push eax
+mov al, byte [ebx + 8]
+shr al, 2
+and eax, 1
+push eax
+push ref_00024818  ; push 0x24818
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010452:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010475  ; je 0x10475
+push eax
+mov al, byte [ebx + 8]
+shr al, 3
+and eax, 1
+push eax
+push ref_0002482b  ; push 0x2482b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010475:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010498  ; je 0x10498
+push ecx
+mov al, byte [ebx + 8]
+shr al, 4
+and eax, 1
+push eax
+push ref_00024846  ; push 0x24846
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010498:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000104bb  ; je 0x104bb
+push edx
+mov al, byte [ebx + 8]
+shr al, 5
+and eax, 1
+push eax
+push ref_0002485f  ; push 0x2485f
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000104bb:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000104de  ; je 0x104de
+push eax
+mov al, byte [ebx + 8]
+shr al, 6
+and eax, 1
+push eax
+push ref_00024879  ; push 0x24879
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000104de:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000104e3:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010505  ; je 0x10505
+push eax
+push eax
+push ref_0002488c  ; push 0x2488c
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010505:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010524  ; je 0x10524
+push eax
+mov al, byte [ebx]
+and eax, 1
+push eax
+push ref_00023454  ; push 0x23454
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010524:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010545  ; je 0x10545
+push eax
+mov al, byte [ebx]
+shr al, 1
+and eax, 1
+push eax
+push ref_000248c8  ; push 0x248c8
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010545:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010567  ; je 0x10567
+push eax
+mov al, byte [ebx]
+shr al, 2
+and eax, 1
+push eax
+push ref_000248df  ; push 0x248df
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010567:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010589  ; je 0x10589
+push eax
+mov al, byte [ebx]
+shr al, 5
+and eax, 1
+push eax
+push ref_000248fb  ; push 0x248fb
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010589:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000105ab  ; je 0x105ab
+push eax
+mov al, byte [ebx]
+shr al, 3
+and eax, 1
+push eax
+push ref_00024919  ; push 0x24919
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000105ab:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000105cd  ; je 0x105cd
+push ecx
+mov al, byte [ebx]
+shr al, 4
+and eax, 1
+push eax
+push ref_00024938  ; push 0x24938
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000105cd:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000105ef  ; je 0x105ef
+push edx
+mov al, byte [ebx]
+shr al, 6
+movzx eax, al
+push eax
+push ref_00024958  ; push 0x24958
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000105ef:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001060b  ; je 0x1060b
+push eax
+push dword [ebx + 4]
+push ref_00024977  ; push 0x24977
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001060b:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00010610:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010632  ; je 0x10632
+push eax
+push eax
+push ref_00024991  ; push 0x24991
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010632:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001064f  ; je 0x1064f
+push eax
+movzx eax, byte [ebx]
+push eax
+push ref_000249ca  ; push 0x249ca
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001064f:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001066d  ; je 0x1066d
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+push ref_000249de  ; push 0x249de
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001066d:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001068b  ; je 0x1068b
+push eax
+movzx eax, byte [ebx + 8]
+push eax
+push ref_000249ee  ; push 0x249ee
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001068b:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000106a9  ; je 0x106a9
+push ecx
+movzx eax, byte [ebx + 9]
+push eax
+push ref_00024a02  ; push 0x24a02
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000106a9:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000106c5  ; je 0x106c5
+push edx
+push dword [ebx + 0xa]
+push ref_00024a16  ; push 0x24a16
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000106c5:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000106e1  ; je 0x106e1
+push eax
+push dword [ebx + 0xe]
+push ref_00024a2c  ; push 0x24a2c
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000106e1:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000106e6:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010708  ; je 0x10708
+push eax
+push eax
+push ref_00024a3e  ; push 0x24a3e
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010708:
+xor esi, esi
+
+loc_0001070a:
+mov eax, esi
+cmp al, byte [ebx + 0x48]
+jae short loc_00010757  ; jae 0x10757
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010732  ; je 0x10732
+mov eax, esi
+movzx eax, al
+push dword [ebx + eax*8]
+push eax
+push ref_00024a7a  ; push 0x24a7a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010732:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010754  ; je 0x10754
+mov eax, esi
+movzx eax, al
+push dword [ebx + eax*8 + 4]
+push eax
+push ref_00024a92  ; push 0x24a92
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010754:
+inc esi
+jmp short loc_0001070a  ; jmp 0x1070a
+
+loc_00010757:
+xor esi, esi
+
+loc_00010759:
+mov eax, esi
+cmp al, byte [ebx + 0x75]
+jae short loc_000107ab  ; jae 0x107ab
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010784  ; je 0x10784
+mov eax, esi
+movzx eax, al
+movzx edx, word [ebx + eax*4 + 0x49]
+push edx
+push eax
+push ref_00024aac  ; push 0x24aac
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010784:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000107a8  ; je 0x107a8
+mov eax, esi
+movzx eax, al
+movzx edx, word [ebx + eax*4 + 0x4b]
+push edx
+push eax
+push ref_00024ac4  ; push 0x24ac4
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000107a8:
+inc esi
+jmp short loc_00010759  ; jmp 0x10759
+
+loc_000107ab:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_000107b2:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000107d4  ; je 0x107d4
+push eax
+push eax
+push ref_00024ade  ; push 0x24ade
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000107d4:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000107f1  ; je 0x107f1
+push eax
+movzx eax, byte [ebx]
+push eax
+push ref_00024b30  ; push 0x24b30
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000107f1:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001080f  ; je 0x1080f
+push eax
+movzx eax, byte [ebx + 1]
+push eax
+push ref_00023942  ; push 0x23942
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001080f:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001082b  ; je 0x1082b
+push eax
+push dword [ebx + 4]
+push ref_00024b3f  ; push 0x24b3f
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001082b:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010849  ; je 0x10849
+push eax
+movzx eax, word [ebx + 8]
+push eax
+push ref_00024b4a  ; push 0x24b4a
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010849:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010867  ; je 0x10867
+push ecx
+movzx eax, word [ebx + 0xa]
+push eax
+push ref_00024b57  ; push 0x24b57
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010867:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010885  ; je 0x10885
+push edx
+movzx eax, byte [ebx + 0xc]
+push eax
+push ref_00024b66  ; push 0x24b66
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010885:
+sub esp, 0xc
+lea eax, [ebx + 0x10]
+push eax
+call fcn_00010610  ; call 0x10610
+lea eax, [ebx + 0x36]
+mov dword [esp], eax
+call fcn_000101b9  ; call 0x101b9
+lea eax, [ebx + 0x46]
+mov dword [esp], eax
+call fcn_0000e71f  ; call 0xe71f
+lea eax, [ebx + 0x1da]
+mov dword [esp], eax
+call fcn_0000ec4f  ; call 0xec4f
+lea eax, [ebx + 0x284]
+mov dword [esp], eax
+call fcn_0000e26b  ; call 0xe26b
+lea eax, [ebx + 0x57c]
+mov dword [esp], eax
+call fcn_0000e5b2  ; call 0xe5b2
+lea eax, [ebx + 0x35c]
+mov dword [esp], eax
+call fcn_0000f334  ; call 0xf334
+lea eax, [ebx + 0x364]
+mov dword [esp], eax
+call fcn_0000f42c  ; call 0xf42c
+lea eax, [ebx + 0x370]
+mov dword [esp], eax
+call fcn_0000f78a  ; call 0xf78a
+lea eax, [ebx + 0x37e]
+mov dword [esp], eax
+call fcn_00010257  ; call 0x10257
+lea eax, [ebx + 0x386]
+mov dword [esp], eax
+call fcn_0000f6a8  ; call 0xf6a8
+lea eax, [ebx + 0x40e]
+mov dword [esp], eax
+call fcn_0000f504  ; call 0xf504
+lea eax, [ebx + 0x554]
+mov dword [esp], eax
+call fcn_0000f5f3  ; call 0xf5f3
+lea eax, [ebx + 0x412]
+mov dword [esp], eax
+call fcn_0000fc7e  ; call 0xfc7e
+lea eax, [ebx + 0x442]
+mov dword [esp], eax
+call fcn_0000f846  ; call 0xf846
+lea eax, [ebx + 0x46a]
+mov dword [esp], eax
+call fcn_0000fb13  ; call 0xfb13
+lea eax, [ebx + 0x476]
+mov dword [esp], eax
+call fcn_0000fc02  ; call 0xfc02
+lea eax, [ebx + 0x486]
+mov dword [esp], eax
+call fcn_000104e3  ; call 0x104e3
+lea eax, [ebx + 0x496]
+add ebx, 0x4de
+mov dword [esp], eax
+call fcn_000102b9  ; call 0x102b9
+mov dword [esp], ebx
+call fcn_000106e6  ; call 0x106e6
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_000109b2  ; je 0x109b2
+push eax
+push eax
+push ref_00024b78  ; push 0x24b78
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000109b2:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000109b7:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000109e6  ; je 0x109e6
+cmp dword [ebx + 4], 0
+jne short loc_000109e6  ; jne 0x109e6
+push eax
+push ref_00024bca  ; push 0x24bca
+push 0x2c0
+push ref_00024be7  ; push 0x24be7
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000109e6:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00010a0e  ; je 0x10a0e
+cmp word [ebx + 8], 0
+jne short loc_00010a0e  ; jne 0x10a0e
+push eax
+push ref_00024c12  ; push 0x24c12
+push 0x2c1
+push ref_00024be7  ; push 0x24be7
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00010a0e:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00010a36  ; je 0x10a36
+cmp word [ebx + 0xa], 0
+jne short loc_00010a36  ; jne 0x10a36
+push eax
+push ref_00024c31  ; push 0x24c31
+push 0x2c2
+push ref_00024be7  ; push 0x24be7
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00010a36:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00010a5d  ; je 0x10a5d
+cmp dword [ebx + 0x1a], 0
+jne short loc_00010a5d  ; jne 0x10a5d
+push eax
+push ref_00024c52  ; push 0x24c52
+push 0x2c3
+push ref_00024be7  ; push 0x24be7
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00010a5d:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00010a87  ; je 0x10a87
+cmp dword [ebx + 0x1e], 0xffff
+ja short loc_00010a87  ; ja 0x10a87
+push ecx
+push ref_00024c87  ; push 0x24c87
+push 0x2c4
+push ref_00024be7  ; push 0x24be7
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00010a87:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00010aaf  ; je 0x10aaf
+cmp word [ebx + 0x22], 0
+jne short loc_00010aaf  ; jne 0x10aaf
+push edx
+push ref_00024cbe  ; push 0x24cbe
+push 0x2c5
+push ref_00024be7  ; push 0x24be7
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00010aaf:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00010ad7  ; je 0x10ad7
+cmp word [ebx + 0x24], 0xf
+ja short loc_00010ad7  ; ja 0x10ad7
+push eax
+push ref_00024cf2  ; push 0x24cf2
+push 0x2c6
+push ref_00024be7  ; push 0x24be7
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00010ad7:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00010adc:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x10
+movzx edx, byte [ebp + 0x10]
+movzx eax, byte [ebp + 0x14]
+mov ecx, dword [ebp + 0xc]
+mov ebx, dword [ebp + 8]
+shl edx, 0x18
+and edx, 0xf000000
+or eax, 0x80000000
+or eax, edx
+cmp cl, 1
+je short loc_00010b23  ; je 0x10b23
+jb short loc_00010b1b  ; jb 0x10b1b
+cmp cl, 2
+je short loc_00010b2b  ; je 0x10b2b
+cmp cl, 3
+jne short loc_00010b5d  ; jne 0x10b5d
+add ebx, 0x2040
+jmp short loc_00010b31  ; jmp 0x10b31
+
+loc_00010b1b:
+add ebx, 0x2014
+jmp short loc_00010b31  ; jmp 0x10b31
+
+loc_00010b23:
+add ebx, 0x2020
+jmp short loc_00010b31  ; jmp 0x10b31
+
+loc_00010b2b:
+add ebx, 0x2030
+
+loc_00010b31:
+push edx
+xor esi, esi
+push eax
+push 0xf0ffff01
+push ebx
+mov dword [ebp - 0xc], ecx
+call fcn_00018b68  ; call 0x18b68
+mov ecx, dword [ebp - 0xc]
+add esp, 0x10
+dec ecx
+cmp cl, 1
+ja short loc_00010b62  ; ja 0x10b62
+sub esp, 0xc
+push ebx
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+jmp short loc_00010b62  ; jmp 0x10b62
+
+loc_00010b5d:
+mov esi, 0x80000002
+
+loc_00010b62:
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00010b6b:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov eax, dword [ebp + 0xc]
+mov ebx, dword [ebp + 8]
+cmp al, 1
+je short loc_00010b94  ; je 0x10b94
+jb short loc_00010b8c  ; jb 0x10b8c
+cmp al, 2
+je short loc_00010b9c  ; je 0x10b9c
+cmp al, 3
+jne short loc_00010bb4  ; jne 0x10bb4
+add ebx, 0x2046
+jmp short loc_00010ba2  ; jmp 0x10ba2
+
+loc_00010b8c:
+add ebx, 0x201a
+jmp short loc_00010ba2  ; jmp 0x10ba2
+
+loc_00010b94:
+add ebx, 0x2026
+jmp short loc_00010ba2  ; jmp 0x10ba2
+
+loc_00010b9c:
+add ebx, 0x2036
+
+loc_00010ba2:
+sub esp, 0xc
+push ebx
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test al, 2
+jne short loc_00010ba2  ; jne 0x10ba2
+jmp short loc_00010bbb  ; jmp 0x10bbb
+
+loc_00010bb4:
+mov eax, 0x80000002
+jmp short loc_00010bbd  ; jmp 0x10bbd
+
+loc_00010bbb:
+xor eax, eax
+
+loc_00010bbd:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00010bc2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x2c
+lea eax, [ebp - 0x20]
+push eax
+push 0
+push 0
+push ref_0002917c  ; push 0x2917c
+mov dword [ebp - 0x1c], 0
+call fcn_0001975d  ; call 0x1975d
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00010c2b  ; je 0x10c2b
+test ebx, ebx
+jns short loc_00010c2b  ; jns 0x10c2b
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010c13  ; je 0x10c13
+push edi
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010c13:
+push esi
+push ref_000206f4  ; push 0x206f4
+push 0xa7
+push ref_00024d25  ; push 0x24d25
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00010c2b:
+push ebx
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0xc
+push 0x200000
+push 0xff0fffff
+mov esi, eax
+and esi, 0xffffc000
+lea edi, [esi + 0x50]
+push edi
+call fcn_00018b68  ; call 0x18b68
+mov eax, dword [ebp - 0x20]
+add esp, 0x10
+cmp byte [eax + 0x24], 1
+jne short loc_00010c7e  ; jne 0x10c7e
+push ecx
+push ecx
+push 0xa0000
+push edi
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+
+loc_00010c7e:
+sub esp, 0xc
+xor ebx, ebx
+push edi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+
+loc_00010c8c:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010cab  ; je 0x10cab
+mov eax, dword [ebp - 0x20]
+push dword [eax + ebx*4]
+push ebx
+push ref_00024d4e  ; push 0x24d4e
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010cab:
+mov eax, dword [ebp - 0x20]
+mov cl, bl
+mov edx, dword [eax + ebx*4]
+mov eax, 1
+inc ebx
+shl eax, cl
+or byte [ebp + edx - 0x1c], al
+cmp ebx, 8
+jne short loc_00010c8c  ; jne 0x10c8c
+xor bl, bl
+
+loc_00010cc6:
+call fcn_00015479  ; call 0x15479
+test al, al
+lea eax, [ebx + ebx]
+je short loc_00010cfa  ; je 0x10cfa
+mov edx, eax
+sub esp, 0xc
+add edx, dword [ebp - 0x20]
+mov dword [ebp - 0x2c], eax
+movzx ecx, byte [edx + 0x20]
+push ecx
+movzx edx, byte [edx + 0x21]
+push edx
+push ebx
+push ref_00024d5e  ; push 0x24d5e
+push 0x40
+call fcn_00015487  ; call 0x15487
+mov eax, dword [ebp - 0x2c]
+add esp, 0x20
+
+loc_00010cfa:
+add eax, dword [ebp - 0x20]
+cmp byte [eax + 0x20], 1
+jne short loc_00010d18  ; jne 0x10d18
+movzx edx, byte [ebp + ebx - 0x1c]
+push edx
+movzx eax, byte [eax + 0x21]
+push eax
+push ebx
+push esi
+call fcn_00010adc  ; call 0x10adc
+add esp, 0x10
+
+loc_00010d18:
+inc ebx
+cmp ebx, 4
+jne short loc_00010cc6  ; jne 0x10cc6
+push edx
+xor bl, bl
+push edx
+push 0x80000000
+push edi
+call fcn_00018b14  ; call 0x18b14
+mov dword [esp], edi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+
+loc_00010d38:
+mov eax, dword [ebp - 0x20]
+cmp byte [eax + ebx*2 + 0x20], 1
+jne short loc_00010d4e  ; jne 0x10d4e
+push eax
+push eax
+push ebx
+push esi
+call fcn_00010b6b  ; call 0x10b6b
+add esp, 0x10
+
+loc_00010d4e:
+inc ebx
+cmp ebx, 4
+jne short loc_00010d38  ; jne 0x10d38
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00010d5e:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+call fcn_0001bfbb  ; call 0x1bfbb
+dec eax
+jne near loc_00010df4  ; jne 0x10df4
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010d89  ; je 0x10d89
+push ebx
+push ebx
+push ref_00024d7b  ; push 0x24d7b
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010d89:
+push ecx
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov ebx, eax
+and ebx, 0xffffc000
+lea eax, [ebx + 0x21a4]
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+and eax, 0xf
+cmp eax, 2
+jne short loc_00010dda  ; jne 0x10dda
+push edx
+add ebx, 0x21b0
+push 2
+push 0xf0
+push ebx
+call fcn_0001878a  ; call 0x1878a
+add esp, 0x10
+
+loc_00010dda:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010df4  ; je 0x10df4
+push eax
+push eax
+push ref_00024d93  ; push 0x24d93
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010df4:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00010df9:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov eax, dword [ebp + 0x14]
+mov ebx, dword [ebp + 0x10]
+add eax, 0x410
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov byte [ebp - 0x1b], al
+cmp ebx, 0x22
+ja short loc_00010e34  ; ja 0x10e34
+cmp ebx, 0x20
+jae short loc_00010e3e  ; jae 0x10e3e
+cmp ebx, 1
+jb short loc_00010e56  ; jb 0x10e56
+cmp ebx, 3
+jbe short loc_00010e4a  ; jbe 0x10e4a
+cmp ebx, 0x10
+je short loc_00010e4a  ; je 0x10e4a
+jmp short loc_00010e56  ; jmp 0x10e56
+
+loc_00010e34:
+lea eax, [ebx - 0x41]
+cmp eax, 2
+jbe short loc_00010e5c  ; jbe 0x10e5c
+jmp short loc_00010e56  ; jmp 0x10e56
+
+loc_00010e3e:
+mov esi, ref_00028588  ; mov esi, 0x28588
+mov edi, 0x14
+jmp short loc_00010e66  ; jmp 0x10e66
+
+loc_00010e4a:
+mov esi, ref_0002769c  ; mov esi, 0x2769c
+mov edi, 0x24
+jmp short loc_00010e66  ; jmp 0x10e66
+
+loc_00010e56:
+xor esi, esi
+xor edi, edi
+jmp short loc_00010e66  ; jmp 0x10e66
+
+loc_00010e5c:
+mov esi, ref_00028d54  ; mov esi, 0x28d54
+mov edi, 0x16
+
+loc_00010e66:
+add esi, 8
+mov word [ebp - 0x1a], 0
+
+loc_00010e6f:
+cmp word [ebp - 0x1a], di
+je short loc_00010eda  ; je 0x10eda
+push dword [esi]
+push dword [esi - 4]
+push dword [esi - 8]
+push dword [ebp + 0x18]
+call fcn_00009dc2  ; call 0x9dc2
+mov dword [ebp - 0x20], eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00010ed1  ; je 0x10ed1
+cmp dword [ebp - 0x20], 0
+jns short loc_00010ed1  ; jns 0x10ed1
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010eb9  ; je 0x10eb9
+push eax
+push dword [ebp - 0x20]
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010eb9:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x173
+push ref_00024d25  ; push 0x24d25
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00010ed1:
+inc word [ebp - 0x1a]
+add esi, 0xc
+jmp short loc_00010e6f  ; jmp 0x10e6f
+
+loc_00010eda:
+cmp ebx, 0x22
+ja short loc_00010ef5  ; ja 0x10ef5
+cmp ebx, 0x20
+jae short loc_00010eff  ; jae 0x10eff
+cmp ebx, 1
+jb short loc_00010f17  ; jb 0x10f17
+cmp ebx, 3
+jbe short loc_00010f0b  ; jbe 0x10f0b
+cmp ebx, 0x10
+je short loc_00010f0b  ; je 0x10f0b
+jmp short loc_00010f17  ; jmp 0x10f17
+
+loc_00010ef5:
+sub ebx, 0x41
+cmp ebx, 2
+jbe short loc_00010f1d  ; jbe 0x10f1d
+jmp short loc_00010f17  ; jmp 0x10f17
+
+loc_00010eff:
+mov edi, ref_00028480  ; mov edi, 0x28480
+mov esi, 0x16
+jmp short loc_00010f27  ; jmp 0x10f27
+
+loc_00010f0b:
+mov edi, ref_0002784c  ; mov edi, 0x2784c
+mov esi, 0x14
+jmp short loc_00010f27  ; jmp 0x10f27
+
+loc_00010f17:
+xor edi, edi
+xor esi, esi
+jmp short loc_00010f27  ; jmp 0x10f27
+
+loc_00010f1d:
+mov edi, ref_00028c34  ; mov edi, 0x28c34
+mov esi, 0x18
+
+loc_00010f27:
+mov dl, byte [ebp - 0x1b]
+imul esi, esi, 0xc
+mov al, dl
+add esi, edi
+and eax, 3
+mov byte [ebp - 0x1a], al
+mov al, dl
+and eax, 0xc
+mov byte [ebp - 0x20], al
+
+loc_00010f3f:
+cmp edi, esi
+je near loc_00010fea  ; je 0x10fea
+cmp dword [ebp + 0xc], 2
+jne short loc_00010f64  ; jne 0x10f64
+mov eax, dword [edi]
+and eax, 0xfe00
+cmp eax, 0x2400
+je short loc_00010f85  ; je 0x10f85
+cmp eax, 0x2600
+jne short loc_00010f8b  ; jne 0x10f8b
+jmp short loc_00010f78  ; jmp 0x10f78
+
+loc_00010f64:
+cmp dword [ebp + 0xc], 1
+jne short loc_00010f8b  ; jne 0x10f8b
+mov eax, dword [edi]
+and eax, 0xfe00
+cmp eax, 0x2c00
+jne short loc_00010f7e  ; jne 0x10f7e
+
+loc_00010f78:
+cmp byte [ebp - 0x20], 8
+jmp short loc_00010f89  ; jmp 0x10f89
+
+loc_00010f7e:
+cmp eax, 0x2e00
+jne short loc_00010f8b  ; jne 0x10f8b
+
+loc_00010f85:
+cmp byte [ebp - 0x1a], 2
+
+loc_00010f89:
+jne short loc_00010fe2  ; jne 0x10fe2
+
+loc_00010f8b:
+push dword [edi + 8]
+push dword [edi + 4]
+push dword [edi]
+push dword [ebp + 0x18]
+call fcn_00009dc2  ; call 0x9dc2
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00010fe2  ; je 0x10fe2
+test ebx, ebx
+jns short loc_00010fe2  ; jns 0x10fe2
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00010fca  ; je 0x10fca
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00010fca:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x1a4
+push ref_00024d25  ; push 0x24d25
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00010fe2:
+add edi, 0xc
+jmp near loc_00010f3f  ; jmp 0x10f3f
+
+loc_00010fea:
+mov eax, dword [ebp + 8]
+xor ebx, ebx
+cmp byte [eax], 8
+ja short loc_00010ffb  ; ja 0x10ffb
+
+loc_00010ff4:
+xor eax, eax
+jmp near loc_0001122f  ; jmp 0x1122f
+
+loc_00010ffb:
+mov cl, byte [ebp - 0x1b]
+mov al, cl
+and eax, 0xc
+mov byte [ebp - 0x1b], al
+mov al, cl
+and eax, 3
+mov byte [ebp - 0x20], al
+
+loc_0001100e:
+call fcn_0001c2f8  ; call 0x1c2f8
+movzx eax, al
+cmp ebx, eax
+jae short loc_00010ff4  ; jae 0x10ff4
+cmp ebx, 2
+jne short loc_00011025  ; jne 0x11025
+cmp byte [ebp - 0x20], 2
+jmp short loc_0001102e  ; jmp 0x1102e
+
+loc_00011025:
+cmp ebx, 3
+jne short loc_00011034  ; jne 0x11034
+cmp byte [ebp - 0x1b], 8
+
+loc_0001102e:
+jne near loc_00011229  ; jne 0x11229
+
+loc_00011034:
+cmp dword [ebp + 0xc], 1
+jne short loc_00011043  ; jne 0x11043
+mov esi, dword [ebx*4 + ref_00020450]  ; mov esi, dword [ebx*4 + 0x20450]
+jmp short loc_0001104a  ; jmp 0x1104a
+
+loc_00011043:
+mov esi, dword [ebx*4 + ref_00020438]  ; mov esi, dword [ebx*4 + 0x20438]
+
+loc_0001104a:
+mov ecx, dword [ebp + 8]
+lea eax, [ebx + 0xae]
+test byte [ecx + eax*8 + 0x10], 1
+je short loc_000110b9  ; je 0x110b9
+movzx eax, byte [ecx + eax*8 + 0xc]
+lea edx, [eax - 0x69]
+cmp dl, 0x17
+jbe short loc_000110af  ; jbe 0x110af
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00011084  ; je 0x11084
+push eax
+push eax
+push ref_00024da9  ; push 0x24da9
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00011084:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000110a5  ; je 0x110a5
+push eax
+push ref_00022281  ; push 0x22281
+push 0x1bd
+
+loc_00011098:
+push ref_00024d25  ; push 0x24d25
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000110a5:
+mov eax, 0x80000002
+jmp near loc_0001122f  ; jmp 0x1122f
+
+loc_000110af:
+shl eax, 0x10
+mov edx, 0xff00ffff
+jmp short loc_000110be  ; jmp 0x110be
+
+loc_000110b9:
+xor eax, eax
+or edx, 0xffffffff
+
+loc_000110be:
+mov edi, dword [ebp + 8]
+lea ecx, [ebx + 0xae]
+test byte [edi + ecx*8 + 0x10], 2
+je short loc_0001111f  ; je 0x1111f
+mov cl, byte [edi + ecx*8 + 0xd]
+lea edi, [ecx - 0x80]
+mov byte [ebp - 0x1a], cl
+mov ecx, edi
+cmp cl, 0x1c
+jbe short loc_00011112  ; jbe 0x11112
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000110fc  ; je 0x110fc
+push edi
+push edi
+push ref_00024dd8  ; push 0x24dd8
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000110fc:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000110a5  ; je 0x110a5
+push esi
+push ref_00022281  ; push 0x22281
+push 0x1ca
+jmp short loc_00011098  ; jmp 0x11098
+
+loc_00011112:
+movzx ecx, byte [ebp - 0x1a]
+xor dh, dh
+shl ecx, 8
+or eax, ecx
+jmp short loc_00011124  ; jmp 0x11124
+
+loc_0001111f:
+cmp edx, 0xffffffff
+je short loc_00011138  ; je 0x11138
+
+loc_00011124:
+push eax
+push edx
+lea eax, [esi + 0x88]
+push eax
+push dword [ebp + 0x18]
+call fcn_00009dc2  ; call 0x9dc2
+add esp, 0x10
+
+loc_00011138:
+mov ecx, dword [ebp + 8]
+lea eax, [ebx + 0xae]
+test byte [ecx + eax*8 + 0x10], 4
+je short loc_000111aa  ; je 0x111aa
+movzx eax, byte [ecx + eax*8 + 0xe]
+lea edx, [eax - 0x39]
+cmp dl, 0x47
+jbe short loc_0001118f  ; jbe 0x1118f
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00011172  ; je 0x11172
+push ebx
+push ebx
+push ref_00024e0a  ; push 0x24e0a
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00011172:
+call fcn_00015480  ; call 0x15480
+test al, al
+je near loc_000110a5  ; je 0x110a5
+push ecx
+push ref_00022281  ; push 0x22281
+push 0x1e2
+jmp near loc_00011098  ; jmp 0x11098
+
+loc_0001118f:
+shl eax, 8
+push eax
+push 0xffff00ff
+lea eax, [esi + 0x90]
+push eax
+push dword [ebp + 0x18]
+call fcn_00009dc2  ; call 0x9dc2
+add esp, 0x10
+
+loc_000111aa:
+mov ecx, dword [ebp + 8]
+lea eax, [ebx + 0xae]
+test byte [ecx + eax*8 + 0x10], 8
+je short loc_00011229  ; je 0x11229
+mov cl, byte [ecx + eax*8 + 0xf]
+mov dl, cl
+shr dl, 1
+lea eax, [edx + 0x43]
+and eax, 0x7f
+cmp al, 0xd
+jbe short loc_00011206  ; jbe 0x11206
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000111e9  ; je 0x111e9
+push edx
+push edx
+push ref_00024e35  ; push 0x24e35
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000111e9:
+call fcn_00015480  ; call 0x15480
+test al, al
+je near loc_000110a5  ; je 0x110a5
+push eax
+push ref_00022281  ; push 0x22281
+push 0x1f3
+jmp near loc_00011098  ; jmp 0x11098
+
+loc_00011206:
+and ecx, 1
+movzx edx, dl
+shl ecx, 7
+add esi, 0x98
+or ecx, edx
+push ecx
+push 0xffffff00
+push esi
+push dword [ebp + 0x18]
+call fcn_00009dc2  ; call 0x9dc2
+add esp, 0x10
+
+loc_00011229:
+inc ebx
+jmp near loc_0001100e  ; jmp 0x1100e
+
+loc_0001122f:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00011237:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov esi, dword [ebp + 0x14]
+mov ecx, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0x18]
+lea eax, [esi + 0x410]
+add esi, 0xfc
+push eax
+mov dword [ebp - 0x1c], ecx
+call fcn_00017d8b  ; call 0x17d8b
+mov dword [esp], esi
+mov edi, eax
+call fcn_00017e4e  ; call 0x17e4e
+mov ecx, dword [ebp - 0x1c]
+add esp, 0x10
+cmp ecx, 0x22
+ja short loc_00011290  ; ja 0x11290
+cmp ecx, 0x20
+jae short loc_000112aa  ; jae 0x112aa
+cmp ecx, 1
+jb near loc_00011465  ; jb 0x11465
+cmp ecx, 3
+jbe short loc_000112a3  ; jbe 0x112a3
+cmp ecx, 0x10
+je short loc_000112a3  ; je 0x112a3
+jmp near loc_00011465  ; jmp 0x11465
+
+loc_00011290:
+sub ecx, 0x41
+cmp ecx, 2
+ja near loc_00011465  ; ja 0x11465
+mov ecx, ref_00028850  ; mov ecx, 0x28850
+jmp short loc_000112af  ; jmp 0x112af
+
+loc_000112a3:
+mov ecx, ref_0002763c  ; mov ecx, 0x2763c
+jmp short loc_000112af  ; jmp 0x112af
+
+loc_000112aa:
+mov ecx, ref_000280cc  ; mov ecx, 0x280cc
+
+loc_000112af:
+test eax, 0x80000
+je near loc_00011465  ; je 0x11465
+and eax, 0x70000
+mov edx, eax
+shr edx, 0x10
+cmp dword [ebp + 0xc], 2
+jne short loc_0001132d  ; jne 0x1132d
+cmp dl, 5
+ja near loc_00011465  ; ja 0x11465
+imul edx, edx, 0xc
+add ecx, edx
+push dword [ecx + 8]
+push dword [ecx + 4]
+push dword [ecx]
+push ebx
+call fcn_00009dc2  ; call 0x9dc2
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je near loc_00011465  ; je 0x11465
+test ebx, ebx
+jns near loc_00011465  ; jns 0x11465
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001131d  ; je 0x1131d
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001131d:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x241
+jmp near loc_00011458  ; jmp 0x11458
+
+loc_0001132d:
+cmp dword [ebp + 0xc], 1
+jne near loc_00011465  ; jne 0x11465
+test dl, dl
+jne short loc_000113a2  ; jne 0x113a2
+mov eax, edi
+and eax, 3
+dec al
+jne near loc_00011465  ; jne 0x11465
+imul edx, edx, 0xc
+add ecx, edx
+push dword [ecx + 8]
+push dword [ecx + 4]
+push dword [ecx]
+push ebx
+call fcn_00009dc2  ; call 0x9dc2
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je near loc_00011465  ; je 0x11465
+test ebx, ebx
+jns near loc_00011465  ; jns 0x11465
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00011392  ; je 0x11392
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00011392:
+push edi
+push ref_000206f4  ; push 0x206f4
+push 0x24d
+jmp near loc_00011458  ; jmp 0x11458
+
+loc_000113a2:
+cmp dl, 1
+jne short loc_0001140b  ; jne 0x1140b
+mov eax, edi
+and eax, 0xc
+cmp al, 4
+jne near loc_00011465  ; jne 0x11465
+imul edx, edx, 0xc
+add ecx, edx
+push dword [ecx + 8]
+push dword [ecx + 4]
+push dword [ecx]
+push ebx
+call fcn_00009dc2  ; call 0x9dc2
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je near loc_00011465  ; je 0x11465
+test ebx, ebx
+jns near loc_00011465  ; jns 0x11465
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000113fe  ; je 0x113fe
+push esi
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000113fe:
+push ecx
+push ref_000206f4  ; push 0x206f4
+push 0x257
+jmp short loc_00011458  ; jmp 0x11458
+
+loc_0001140b:
+imul edx, edx, 0xc
+add ecx, edx
+push dword [ecx + 8]
+push dword [ecx + 4]
+push dword [ecx]
+push ebx
+call fcn_00009dc2  ; call 0x9dc2
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00011465  ; je 0x11465
+test ebx, ebx
+jns short loc_00011465  ; jns 0x11465
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001144d  ; je 0x1144d
+push edx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001144d:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x260
+
+loc_00011458:
+push ref_00024d25  ; push 0x24d25
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00011465:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001146f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+call fcn_0001bfbb  ; call 0x1bfbb
+mov esi, eax
+mov eax, dword [ebp + 8]
+mov ebx, dword [eax + 4]
+push edi
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0x1c
+push 0
+mov edi, eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+add edi, 2
+push 0
+push 0x14
+push 0
+mov dword [ebp - 0x20], eax
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], edi
+mov dword [ebp - 0x24], eax
+call fcn_00017dc2  ; call 0x17dc2
+call fcn_0001bbfd  ; call 0x1bbfd
+movzx eax, al
+mov dword [ebp - 0x1c], eax
+pop eax
+pop edx
+lea eax, [ebx + 0x2088]
+push 0x109000
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+lea eax, [ebx + 0x20ac]
+pop ecx
+pop edi
+push 0x40000000
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+cmp esi, 1
+jne short loc_00011532  ; jne 0x11532
+push eax
+push eax
+push 0x1b
+lea edi, [ebx + 0x2340]
+push edi
+call fcn_00017da5  ; call 0x17da5
+add esp, 0xc
+push 0x3a0000
+push 0xff00ffff
+push edi
+call fcn_00018b68  ; call 0x18b68
+lea eax, [ebx + 0x2324]
+pop edx
+pop ecx
+push 0x854c74
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+
+loc_00011532:
+sub esp, 0xc
+push ebx
+push dword [ebp - 0x20]
+push dword [ebp - 0x1c]
+push esi
+push dword [ebp + 8]
+call fcn_00010df9  ; call 0x10df9
+add esp, 0x20
+mov edi, eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001158c  ; je 0x1158c
+test edi, edi
+jns short loc_0001158c  ; jns 0x1158c
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00011574  ; je 0x11574
+push eax
+push edi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00011574:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x34e
+push ref_00024d25  ; push 0x24d25
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001158c:
+sub esp, 0xc
+push ebx
+push dword [ebp - 0x20]
+push dword [ebp - 0x1c]
+push esi
+push dword [ebp + 8]
+call fcn_00011237  ; call 0x11237
+add esp, 0x20
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000115e6  ; je 0x115e6
+test esi, esi
+jns short loc_000115e6  ; jns 0x115e6
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000115ce  ; je 0x115ce
+push eax
+push esi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000115ce:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x350
+push ref_00024d25  ; push 0x24d25
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000115e6:
+call fcn_0001bfbb  ; call 0x1bfbb
+cmp eax, 2
+je short loc_000115fe  ; je 0x115fe
+
+loc_000115f0:
+call fcn_0001bfbb  ; call 0x1bfbb
+dec eax
+jne near loc_000116a3  ; jne 0x116a3
+jmp short loc_0001164b  ; jmp 0x1164b
+
+loc_000115fe:
+mov byte [ebp - 0x1c], 0
+
+loc_00011602:
+call fcn_0001c1bf  ; call 0x1c1bf
+cmp byte [ebp - 0x1c], al
+jae short loc_000115f0  ; jae 0x115f0
+push eax
+movzx eax, byte [ebp - 0x1c]
+push eax
+push 0x1c
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov edi, eax
+pop eax
+pop edx
+lea eax, [edi + 0x110]
+push 0x31c1
+push eax
+call fcn_00018b14  ; call 0x18b14
+lea edx, [edi + 0x104]
+pop ecx
+pop eax
+push 0x17d010
+push edx
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+inc byte [ebp - 0x1c]
+jmp short loc_00011602  ; jmp 0x11602
+
+loc_0001164b:
+sub esp, 0xc
+lea eax, [ebx + 0x2320]
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov edx, 0x20000
+test al, 2
+jne short loc_0001168a  ; jne 0x1168a
+mov eax, dword [ebp - 0x20]
+sub esp, 0xc
+add eax, 0xf5
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+and eax, 1
+cmp al, 1
+sbb edx, edx
+xor dx, dx
+add edx, 0x20000
+
+loc_0001168a:
+or dh, 0x30
+push eax
+push edx
+push 0xfffc0fff
+lea eax, [ebx + 0x21a4]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_000116a3:
+push edi
+push edi
+push 0xfffffffffffffff0
+lea eax, [ebx + 0x2348]
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+mov eax, dword [ebp - 0x24]
+add esp, 0xc
+push 0x10000
+push 0xffffff7f
+add eax, 0xb0
+push eax
+call fcn_00018b68  ; call 0x18b68
+call fcn_0001bfbb  ; call 0x1bfbb
+add esp, 0x10
+cmp eax, 2
+jne short loc_00011747  ; jne 0x11747
+push ecx
+push ecx
+push 0x10
+lea eax, [ebx + 0x260c]
+push eax
+call fcn_00017e04  ; call 0x17e04
+push 0x3100
+push 0xffffceff
+push 0xec000106
+push ebx
+call fcn_00009dc2  ; call 0x9dc2
+add esp, 0x20
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00011747  ; je 0x11747
+test esi, esi
+jns short loc_00011747  ; jns 0x11747
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001172f  ; je 0x1172f
+push edx
+push esi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001172f:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x3b8
+push ref_00024d25  ; push 0x24d25
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00011747:
+lea esp, [ebp - 0xc]
+mov eax, esi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00011751:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov esi, dword [ebp + 0x14]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00011777  ; je 0x11777
+push eax
+push eax
+push ref_00024e65  ; push 0x24e65
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00011777:
+cmp dword [ebp + 8], 0
+mov ebx, 0x80000002
+je near loc_0001189f  ; je 0x1189f
+call fcn_00015479  ; call 0x15479
+test al, al
+mov eax, esi
+movzx ebx, al
+je short loc_000117a5  ; je 0x117a5
+push eax
+push ebx
+push ref_00024e80  ; push 0x24e80
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000117a5:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000117c1  ; je 0x117c1
+push eax
+push dword [ebp + 0xc]
+push ref_00024e91  ; push 0x24e91
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000117c1:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000117dd  ; je 0x117dd
+push eax
+push dword [ebp + 0x10]
+push ref_00024ea9  ; push 0x24ea9
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000117dd:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000117f7  ; je 0x117f7
+push eax
+push eax
+push ref_00021f21  ; push 0x21f21
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000117f7:
+push eax
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov edi, eax
+and edi, 0xffffc000
+lea esi, [edi + 0x3418]
+mov dword [esp], esi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0xc
+push ebx
+mov dword [ebp - 0x1c], eax
+lea eax, [ebp - 0x1c]
+push eax
+push edi
+push 0
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+call fcn_000151c7  ; call 0x151c7
+add esp, 0x20
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00011889  ; je 0x11889
+test ebx, ebx
+jns short loc_00011889  ; jns 0x11889
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00011871  ; je 0x11871
+push edi
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00011871:
+push ecx
+push ref_000206f4  ; push 0x206f4
+push 0x82
+push ref_00024ec1  ; push 0x24ec1
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00011889:
+push edx
+push edx
+push dword [ebp - 0x1c]
+push esi
+call fcn_00017e8f  ; call 0x17e8f
+mov dword [esp], esi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+
+loc_0001189f:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000118b9  ; je 0x118b9
+push eax
+push eax
+push ref_00024eea  ; push 0x24eea
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000118b9:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000118c3:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x14
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000118e4  ; je 0x118e4
+push edx
+push edx
+push ref_00024f03  ; push 0x24f03
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000118e4:
+lea eax, [ebp - 0xc]
+push eax
+push 0
+push 0
+push ref_000291bc  ; push 0x291bc
+call fcn_0001975d  ; call 0x1975d
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+jne short loc_00011919  ; jne 0x11919
+mov eax, dword [ebp - 0xc]
+movzx edx, byte [eax]
+push edx
+push dword [eax + 0xe]
+push dword [eax + 6]
+push dword [eax + 1]
+call fcn_00011751  ; call 0x11751
+add esp, 0x10
+mov ebx, eax
+
+loc_00011919:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00011933  ; je 0x11933
+push eax
+push eax
+push ref_00024f19  ; push 0x24f19
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00011933:
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001193a:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x3c
+mov eax, dword [ebp + 0x14]
+mov ebx, dword [ebp + 0xc]
+mov esi, dword [ebp + 8]
+mov dword [ebp - 0x28], eax
+call fcn_0001bfbb  ; call 0x1bfbb
+mov dword [ebp - 0x1c], eax
+call fcn_0001c0bd  ; call 0x1c0bd
+mov eax, dword [ebp + 0x10]
+movzx eax, byte [eax + 1]
+push ecx
+mov edi, eax
+mov dword [ebp - 0x34], eax
+movzx eax, bl
+push eax
+push 0x1c
+push edi
+mov dword [ebp - 0x2c], eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0x1f
+push edi
+mov ebx, eax
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [ebp - 0x38], eax
+pop eax
+pop edx
+push 0
+push dword [ebp + 0x18]
+call fcn_0001c39f  ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+push 0x1c
+push edi
+call fcn_00016c9a  ; call 0x16c9a
+push 0x10
+push dword [ebp - 0x2c]
+push 0x1c
+push edi
+mov dword [ebp - 0x20], eax
+call fcn_00009fd5  ; call 0x9fd5
+add esp, 0x20
+movzx eax, al
+mov ecx, eax
+mov dword [ebp - 0x3c], eax
+mov eax, 0x80000003
+test ecx, ecx
+je near loc_00011e6c  ; je 0x11e6c
+sub esp, 0xc
+mov eax, esi
+lea edx, [ebx + 0x64]
+movzx esi, al
+push edx
+imul esi, esi, 0x2c
+mov dword [ebp - 0x24], edx
+call fcn_00017e4e  ; call 0x17e4e
+mov edi, dword [ebp + 0x10]
+pop edx
+pop ecx
+mov edx, dword [ebp - 0x24]
+add edi, esi
+mov ecx, eax
+and ah, 0xf7
+or ch, 8
+cmp byte [edi + 0x58], 1
+cmovne ecx, eax
+and ecx, 0xfff3ffff
+push ecx
+push edx
+call fcn_00017e8f  ; call 0x17e8f
+lea eax, [ebx + 0x68]
+mov dword [esp], eax
+mov dword [ebp - 0x24], eax
+call fcn_00017dc2  ; call 0x17dc2
+pop edx
+pop ecx
+mov edx, eax
+and ah, 0xfb
+or dh, 4
+cmp byte [edi + 0x58], 1
+cmovne edx, eax
+movzx edx, dx
+push edx
+push dword [ebp - 0x24]
+call fcn_00017e04  ; call 0x17e04
+add esp, 0xc
+push 0x14140000
+push 0xffff
+lea eax, [ebx + 0x318]
+push eax
+call fcn_00018b68  ; call 0x18b68
+mov eax, dword [ebp - 0x20]
+add eax, 0xf5
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0xc
+mov edi, dword [ebp + 0x10]
+lea ecx, [ebx + 0x4c]
+mov dword [ebp - 0x30], ecx
+lea edi, [edi + esi + 0x40]
+lea esi, [edi + 6]
+and eax, 1
+cmp al, 1
+sbb eax, eax
+xor ax, ax
+add eax, 0x20000
+push eax
+push 0xfffc7fff
+push ecx
+call fcn_00018b68  ; call 0x18b68
+add esp, 0xc
+push 0x743a361b
+push 0
+lea eax, [ebx + 0x314]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0xc
+push 0x18000
+lea eax, [ebx + 0xd8]
+push 0xfffc7fff
+push eax
+mov dword [ebp - 0x20], eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0xc
+push 0x854c74
+push 0xff000000
+lea eax, [ebx + 0x33c]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0xc
+push 0x2000000
+push 0xfdffffff
+push dword [ebp - 0x20]
+call fcn_00018b68  ; call 0x18b68
+add esp, 0xc
+push 0x8000008
+push 0xf7fffff7
+push dword [ebp - 0x20]
+call fcn_00018b68  ; call 0x18b68
+pop eax
+pop edx
+lea eax, [ebx + 0xf5]
+push 0xf
+push eax
+call fcn_0001875d  ; call 0x1875d
+mov al, byte [esi + 4]
+pop ecx
+pop edx
+shl eax, 0x1f
+sar eax, 0x1f
+and eax, 0x10001
+mov edx, eax
+or edx, 0x20000000
+cmp dword [ebp - 0x1c], 2
+cmove eax, edx
+push eax
+lea eax, [ebx + 0x100]
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+mov dl, byte [edi + 6]
+add esp, 0xc
+and edx, 0x20
+cmp dl, 1
+sbb eax, eax
+and eax, 0xffffff80
+dec eax
+cmp dl, 1
+sbb edx, edx
+movzx eax, ax
+not edx
+and dx, 0x80
+movzx edx, dx
+push edx
+push eax
+lea eax, [ebx + 0x50]
+push eax
+call fcn_00018981  ; call 0x18981
+add esp, 0x10
+cmp dword [ebp - 0x1c], 2
+jne short loc_00011b8f  ; jne 0x11b8f
+push ecx
+push 0x1000c0
+push 0xffcffe3f
+lea eax, [ebx + 0x320]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_00011b8f:
+mov dl, byte [esi + 0xb]
+cmp dl, 9
+je short loc_00011bad  ; je 0x11bad
+sub edx, 3
+xor eax, eax
+cmp dl, 3
+ja short loc_00011bb2  ; ja 0x11bb2
+movzx edx, dl
+movzx eax, byte [edx + ref_00020468]  ; movzx eax, byte [edx + 0x20468]
+jmp short loc_00011bb2  ; jmp 0x11bb2
+
+loc_00011bad:
+mov eax, 0x10
+
+loc_00011bb2:
+push edx
+push eax
+push 0xffe0
+push dword [ebp - 0x24]
+call fcn_00018981  ; call 0x18981
+mov dl, byte [edi + 6]
+add esp, 0x10
+test dl, 4
+je short loc_00011c38  ; je 0x11c38
+sub esp, 0xc
+push dword [ebp - 0x30]
+shl edx, 0x1c
+sar edx, 0x1f
+and edx, 0x60
+mov dword [ebp - 0x24], edx
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov edx, dword [ebp - 0x24]
+and eax, 0x3f0
+cmp eax, 0x10
+jne short loc_00011bf8  ; jne 0x11bf8
+or dh, 0xb2
+jmp short loc_00011c1c  ; jmp 0x11c1c
+
+loc_00011bf8:
+sub esp, 0xc
+push dword [ebp - 0x30]
+mov dword [ebp - 0x24], edx
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, dword [ebp - 0x24]
+add esp, 0x10
+mov ecx, edx
+or ch, 0xfd
+and eax, 0x3f0
+cmp eax, 0x10
+cmova edx, ecx
+
+loc_00011c1c:
+push eax
+movzx eax, byte [esi + 0xa]
+shl eax, 0x13
+or eax, edx
+push eax
+push 0x6001f
+lea eax, [ebx + 0x54]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_00011c38:
+mov eax, dword [ebp + 0x10]
+sub esp, 0xc
+movzx eax, byte [eax + 0x19]
+push eax
+mov eax, dword [ebp + 0x10]
+movzx eax, byte [eax + 0x18]
+push eax
+push dword [ebp - 0x2c]
+push 0x1c
+push dword [ebp - 0x34]
+call fcn_0000bc4e  ; call 0xbc4e
+add esp, 0x20
+mov byte [ebp - 0x24], 1
+test eax, eax
+je short loc_00011c7a  ; je 0x11c7a
+push eax
+push eax
+push 2
+lea eax, [ebx + 0xd4]
+push eax
+call fcn_00018730  ; call 0x18730
+add esp, 0x10
+mov byte [ebp - 0x24], 0
+
+loc_00011c7a:
+test byte [edi + 6], 8
+jne short loc_00011c8e  ; jne 0x11c8e
+mov cl, byte [ebp - 0x24]
+mov al, cl
+lea eax, [eax + eax - 3]
+lea edx, [ecx + ecx]
+jmp short loc_00011c92  ; jmp 0x11c92
+
+loc_00011c8e:
+mov al, 0xfd
+xor edx, edx
+
+loc_00011c92:
+movzx edx, dl
+movzx eax, al
+push ecx
+push edx
+push eax
+lea eax, [ebx + 0xe0]
+push eax
+call fcn_0001878a  ; call 0x1878a
+mov dl, byte [esi + 4]
+add esp, 0xc
+mov al, dl
+and eax, 2
+cmp al, 1
+sbb eax, eax
+not eax
+and eax, 8
+mov ecx, eax
+or ecx, 4
+test dl, 4
+cmovne eax, ecx
+mov ecx, eax
+or ecx, 2
+test dl, 8
+cmovne eax, ecx
+mov ecx, eax
+or ecx, 1
+and dl, 0x10
+cmovne eax, ecx
+movzx eax, ax
+push eax
+push 0xfff0
+lea eax, [ebx + 0x48]
+push eax
+call fcn_00018981  ; call 0x18981
+mov dl, byte [esi + 4]
+add esp, 0xc
+mov al, dl
+and eax, 0x20
+cmp al, 1
+sbb eax, eax
+not eax
+and eax, 8
+mov ecx, eax
+or ecx, 4
+test dl, 0x40
+cmovne eax, ecx
+mov ecx, eax
+or ecx, 2
+test dl, dl
+cmovs eax, ecx
+mov edx, eax
+or edx, 1
+test byte [esi + 5], 1
+lea esi, [ebx + 0x5c]
+cmovne eax, edx
+movzx eax, ax
+push eax
+push 0xfff0
+push esi
+call fcn_00018981  ; call 0x18981
+add esp, 0x10
+test byte [edi + 6], 0x10
+je near loc_00011dce  ; je 0x11dce
+push eax
+push eax
+push 0xfff7
+push esi
+call fcn_00018954  ; call 0x18954
+add esp, 0xc
+push 0x80000000
+push 0xfffffffffffffffe
+push dword [ebp - 0x20]
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp dword [ebp - 0x1c], 2
+jne short loc_00011d76  ; jne 0x11d76
+movzx esi, word [ebp - 0x28]
+add esi, 0x8c
+jmp short loc_00011d83  ; jmp 0x11d83
+
+loc_00011d76:
+cmp dword [ebp - 0x1c], 1
+jne short loc_00011da4  ; jne 0x11da4
+movzx esi, word [ebp - 0x28]
+add esi, 0x20
+
+loc_00011d83:
+sub esp, 0xc
+push esi
+call fcn_00018f64  ; call 0x18f64
+add esp, 0x10
+test ah, 2
+je short loc_00011da4  ; je 0x11da4
+push eax
+push eax
+push 0x200
+push esi
+call fcn_00018f97  ; call 0x18f97
+add esp, 0x10
+
+loc_00011da4:
+mov esi, dword [ebp - 0x38]
+sub esp, 0xc
+add esi, 0xa0
+push esi
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test ah, 4
+jne short loc_00011dce  ; jne 0x11dce
+push eax
+push eax
+push 0x400
+push esi
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+
+loc_00011dce:
+test byte [edi + 6], 8
+je short loc_00011e53  ; je 0x11e53
+mov esi, dword [ebp - 0x3c]
+push eax
+push eax
+push 9
+add esi, ebx
+lea eax, [esi + 0x1a]
+add esi, 0x18
+push eax
+call fcn_00018927  ; call 0x18927
+add esp, 0xc
+push 9
+push 0xffdf
+push esi
+call fcn_00018981  ; call 0x18981
+add esp, 0xc
+push 0x40000000
+push 0xfffffffffffffffd
+push dword [ebp - 0x20]
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp dword [ebp - 0x1c], 2
+jne short loc_00011e23  ; jne 0x11e23
+movzx eax, word [ebp - 0x28]
+push ecx
+push ecx
+push 2
+add eax, 0x8c
+jmp short loc_00011e34  ; jmp 0x11e34
+
+loc_00011e23:
+cmp dword [ebp - 0x1c], 1
+jne short loc_00011e3d  ; jne 0x11e3d
+movzx eax, word [ebp - 0x28]
+push edx
+push edx
+push 2
+add eax, 0x20
+
+loc_00011e34:
+push eax
+call fcn_00018f97  ; call 0x18f97
+add esp, 0x10
+
+loc_00011e3d:
+push eax
+add ebx, 0x108
+push eax
+push 0x4000
+push ebx
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+
+loc_00011e53:
+cmp byte [ebp - 0x24], 1
+je short loc_00011e6a  ; je 0x11e6a
+mov al, byte [edi + 6]
+and eax, 8
+cmp al, 1
+sbb eax, eax
+and eax, 0x8000000e
+jmp short loc_00011e6c  ; jmp 0x11e6c
+
+loc_00011e6a:
+xor eax, eax
+
+loc_00011e6c:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00011e74:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+xor ebx, ebx
+sub esp, 0x2c
+mov eax, dword [ebp + 8]
+mov dword [ebp - 0x2c], eax
+mov byte [ebp - 0x20], al
+call fcn_0001bfbb  ; call 0x1bfbb
+mov dword [ebp - 0x1c], eax
+call fcn_0001c0bd  ; call 0x1c0bd
+movzx edi, byte [ebp - 0x20]
+mov dword [ebp - 0x28], eax
+
+loc_00011e9c:
+call fcn_0001c1bf  ; call 0x1c1bf
+movzx eax, al
+cmp ebx, eax
+jae near loc_00011fa1  ; jae 0x11fa1
+cmp dword [ebp - 0x1c], 2
+mov byte [ebp - 0x21], 0
+jne short loc_00011ef0  ; jne 0x11ef0
+push ecx
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+and eax, 0xfffc
+lea eax, [eax + ebx*8 + 0x190]
+mov dword [esp], eax
+call fcn_00018f64  ; call 0x18f64
+add esp, 0x10
+and eax, 1
+xor eax, 1
+and eax, 1
+mov byte [ebp - 0x21], al
+
+loc_00011ef0:
+mov eax, 1
+mov cl, bl
+shl eax, cl
+test dword [ebp + 0x10], eax
+je near loc_00012110  ; je 0x12110
+test dword [ebp + 0x14], eax
+jne near loc_00012193  ; jne 0x12193
+push esi
+push esi
+push ebx
+push dword [ebp + 0x18]
+call fcn_0001c39f  ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+push 0x1c
+push edi
+call fcn_00016c9a  ; call 0x16c9a
+mov esi, eax
+pop eax
+pop edx
+lea eax, [esi + 0xe1]
+push 3
+push eax
+call fcn_00018730  ; call 0x18730
+add esp, 0x10
+cmp dword [ebp - 0x1c], 2
+jne short loc_00011f69  ; jne 0x11f69
+push ecx
+push ecx
+push 0x40
+lea eax, [esi + 0xe2]
+push eax
+call fcn_00018730  ; call 0x18730
+add esp, 0xc
+push 8
+push 0xf3
+lea eax, [esi + 0xe8]
+push eax
+call fcn_0001878a  ; call 0x1878a
+add esp, 0x10
+
+loc_00011f69:
+push eax
+push eax
+push 3
+lea eax, [esi + 0xe8]
+push eax
+call fcn_00018b14  ; call 0x18b14
+cmp dword [ebp - 0x28], 2
+pop eax
+mov eax, 0x20
+pop edx
+mov edx, 0x4020
+cmove eax, edx
+add esi, 0x324
+push eax
+push esi
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+jmp near loc_00012193  ; jmp 0x12193
+
+loc_00011fa1:
+xor ebx, ebx
+cmp dword [ebp - 0x1c], 2
+jne near loc_00012084  ; jne 0x12084
+mov eax, dword [ebp + 0x10]
+movzx edi, byte [ebp - 0x20]
+and eax, 0xf
+mov dword [ebp - 0x1c], eax
+
+loc_00011fba:
+call fcn_0001c1bf  ; call 0x1c1bf
+movzx eax, al
+cmp ebx, eax
+jae short loc_00012044  ; jae 0x12044
+push esi
+push esi
+push ebx
+push dword [ebp + 0x18]
+call fcn_0001c39f  ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+push 0x1c
+push edi
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0x10
+mov edx, eax
+lea eax, [ebx - 4]
+cmp eax, 1
+jbe short loc_00011ff1  ; jbe 0x11ff1
+test ebx, ebx
+jne short loc_0001203e  ; jne 0x1203e
+
+loc_00011ff1:
+push ecx
+push ecx
+lea esi, [edx + 0xe1]
+push 0x3c
+push esi
+mov dword [ebp - 0x20], edx
+call fcn_00018730  ; call 0x18730
+mov eax, dword [ebp - 0x1c]
+add esp, 0x10
+mov edx, dword [ebp - 0x20]
+or eax, ebx
+je short loc_0001201e  ; je 0x1201e
+mov eax, dword [ebp + 0x10]
+bt eax, ebx
+jb short loc_0001203e  ; jb 0x1203e
+cmp ebx, 3
+jbe short loc_0001203e  ; jbe 0x1203e
+
+loc_0001201e:
+push eax
+add edx, 0xe2
+push eax
+push 1
+push edx
+call fcn_00018730  ; call 0x18730
+pop eax
+pop edx
+push 0x80
+push esi
+call fcn_00018730  ; call 0x18730
+add esp, 0x10
+
+loc_0001203e:
+inc ebx
+jmp near loc_00011fba  ; jmp 0x11fba
+
+loc_00012044:
+test byte [ebp + 0x10], 0x3f
+jne near loc_0001219b  ; jne 0x1219b
+push ecx
+push ecx
+push 0
+push dword [ebp + 0x18]
+call fcn_0001c39f  ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+movzx eax, byte [ebp - 0x2c]
+push 0x1c
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+pop ebx
+pop esi
+push 0x40
+add eax, 0xe1
+push eax
+call fcn_00018730  ; call 0x18730
+add esp, 0x10
+jmp near loc_0001219b  ; jmp 0x1219b
+
+loc_00012084:
+cmp dword [ebp - 0x1c], 1
+jne near loc_0001219b  ; jne 0x1219b
+movzx edi, byte [ebp - 0x20]
+
+loc_00012092:
+call fcn_0001c1bf  ; call 0x1c1bf
+movzx eax, al
+cmp ebx, eax
+jae near loc_0001219b  ; jae 0x1219b
+mov eax, dword [ebp + 0x14]
+bt eax, ebx
+jb short loc_0001210b  ; jb 0x1210b
+push esi
+push esi
+push ebx
+push dword [ebp + 0x18]
+call fcn_0001c39f  ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+push 0x1c
+push edi
+call fcn_00016c9a  ; call 0x16c9a
+lea esi, [eax + 0xe1]
+mov dword [ebp - 0x1c], eax
+pop eax
+pop edx
+push 0x3c
+push esi
+call fcn_00018730  ; call 0x18730
+mov eax, 0xf
+mov cl, bl
+shl eax, cl
+add esp, 0x10
+mov edx, dword [ebp - 0x1c]
+test dword [ebp + 0x10], eax
+jne short loc_0001210b  ; jne 0x1210b
+push eax
+add edx, 0xe2
+push eax
+push 1
+push edx
+call fcn_00018730  ; call 0x18730
+pop edx
+pop ecx
+push 0x80
+push esi
+call fcn_00018730  ; call 0x18730
+add esp, 0x10
+
+loc_0001210b:
+add ebx, 4
+jmp short loc_00012092  ; jmp 0x12092
+
+loc_00012110:
+cmp dword [ebp - 0x1c], 2
+jne short loc_0001218d  ; jne 0x1218d
+push esi
+push esi
+push ebx
+push dword [ebp + 0x18]
+call fcn_0001c39f  ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+push 0x1c
+push edi
+call fcn_00016c9a  ; call 0x16c9a
+mov esi, eax
+pop eax
+pop edx
+lea eax, [esi + 0xe2]
+add esi, 0x420
+push 0x30
+push eax
+call fcn_00018730  ; call 0x18730
+pop ecx
+pop eax
+push 0x80000000
+push esi
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+
+loc_00012158:
+cmp byte [ebp - 0x21], 0
+je short loc_0001218d  ; je 0x1218d
+push eax
+push eax
+push ebx
+push dword [ebp + 0x18]
+call fcn_0001c39f  ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+push 0x1c
+push edi
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+push 0x60000000
+add eax, 0x420
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+
+loc_0001218d:
+inc ebx
+jmp near loc_00011e9c  ; jmp 0x11e9c
+
+loc_00012193:
+cmp dword [ebp - 0x1c], 2
+jne short loc_0001218d  ; jne 0x1218d
+jmp short loc_00012158  ; jmp 0x12158
+
+loc_0001219b:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000121a5:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov ebx, dword [ebp + 0xc]
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0x10]
+push ebx
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+jne short loc_000121e1  ; jne 0x121e1
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000121e1  ; je 0x121e1
+push edx
+push ebx
+push ref_00024f2d  ; push 0x24f2d
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000121e1:
+sub esp, 0xc
+add ebx, 0xfc
+push ebx
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+and ax, 0xc000
+cmp ax, 0x8000
+je short loc_00012212  ; je 0x12212
+cmp ax, 0xc000
+je short loc_0001220b  ; je 0x1220b
+xor ebx, ebx
+cmp ax, 0x4000
+jne short loc_00012217  ; jne 0x12217
+
+loc_0001220b:
+mov ebx, 2
+jmp short loc_00012217  ; jmp 0x12217
+
+loc_00012212:
+mov ebx, 0x22
+
+loc_00012217:
+call fcn_0001bfbb  ; call 0x1bfbb
+dec eax
+jne short loc_00012264  ; jne 0x12264
+push eax
+push 4
+push 0x1c
+movzx eax, byte [edi + 1]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xfc
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+and ax, 0xc000
+cmp ax, 0x8000
+je short loc_0001225c  ; je 0x1225c
+cmp ax, 0xc000
+je short loc_00012261  ; je 0x12261
+mov edx, ebx
+or dh, 2
+cmp ax, 0x4000
+cmove ebx, edx
+jmp short loc_00012264  ; jmp 0x12264
+
+loc_0001225c:
+or bh, 0x22
+jmp short loc_00012264  ; jmp 0x12264
+
+loc_00012261:
+or bh, 2
+
+loc_00012264:
+movzx ebx, bx
+add esi, 0x103c
+mov dword [ebp + 0xc], ebx
+mov dword [ebp + 8], esi
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e04  ; jmp 0x17e04
+
+fcn_0001227f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x4c
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000122a2  ; je 0x122a2
+push esi
+push esi
+push ref_00024f42  ; push 0x24f42
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000122a2:
+call fcn_0001bfbb  ; call 0x1bfbb
+mov dword [ebp - 0x2c], eax
+push eax
+mov eax, dword [ebp + 8]
+push 0
+push 0x1f
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+mov ebx, eax
+lea eax, [eax + 0xf0]
+add ebx, 0x40
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [esp], ebx
+mov dword [ebp - 0x30], eax
+and dword [ebp - 0x30], 0xffffc000
+call fcn_00017dc2  ; call 0x17dc2
+mov edi, dword [ebp - 0x30]
+mov word [ebp - 0x3e], ax
+pop eax
+pop edx
+and word [ebp - 0x3e], 0xfffc
+push 0
+push edi
+call fcn_0001c39f  ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+mov eax, dword [ebp + 8]
+push 0x1c
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+pop ecx
+pop ebx
+push 4
+push edi
+mov esi, eax
+mov dword [ebp - 0x34], eax
+call fcn_0001c39f  ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+mov eax, dword [ebp + 8]
+push 0x1c
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+mov ebx, eax
+call fcn_0001c1bf  ; call 0x1c1bf
+add esp, 0xc
+push 5
+push 0xf5
+mov byte [ebp - 0x39], al
+mov eax, esi
+add eax, 0xf5
+push eax
+call fcn_0001878a  ; call 0x1878a
+add esp, 0xc
+push dword [ebp + 8]
+push esi
+push edi
+call fcn_000121a5  ; call 0x121a5
+mov eax, esi
+add eax, 0xfc
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov esi, eax
+and eax, 0xc000
+cmp eax, 0x8000
+je short loc_00012398  ; je 0x12398
+cmp eax, 0xc000
+je short loc_0001239f  ; je 0x1239f
+cmp eax, 0x4000
+sete al
+movzx eax, al
+mov edi, eax
+add edi, eax
+jmp short loc_000123a4  ; jmp 0x123a4
+
+loc_00012398:
+mov edi, 0xa
+jmp short loc_000123a4  ; jmp 0x123a4
+
+loc_0001239f:
+mov edi, 0xe
+
+loc_000123a4:
+cmp dword [ebp - 0x2c], 1
+jne short loc_000123ec  ; jne 0x123ec
+sub esp, 0xc
+add ebx, 0xfc
+push ebx
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+and eax, 0xc000
+cmp eax, 0x8000
+je short loc_000123de  ; je 0x123de
+cmp eax, 0xc000
+je short loc_000123e6  ; je 0x123e6
+mov edx, edi
+or edx, 0x20
+cmp eax, 0x4000
+cmove edi, edx
+jmp short loc_000123ec  ; jmp 0x123ec
+
+loc_000123de:
+or edi, 0xa0
+jmp short loc_000123ec  ; jmp 0x123ec
+
+loc_000123e6:
+or edi, 0xe0
+
+loc_000123ec:
+mov eax, dword [ebp - 0x30]
+sub esp, 0xc
+mov bl, 0xff
+add eax, 0x3414
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test esi, 0x80000
+je short loc_00012419  ; je 0x12419
+test al, 0x20
+jne short loc_00012419  ; jne 0x12419
+and esi, 0x70000
+mov ebx, esi
+shr ebx, 0x10
+
+loc_00012419:
+cmp dword [ebp - 0x2c], 1
+jne short loc_00012444  ; jne 0x12444
+mov eax, dword [ebp - 0x34]
+sub esp, 0xc
+add eax, 0x410
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 0x11
+je short loc_0001243f  ; je 0x1243f
+test bl, bl
+jne short loc_00012485  ; jne 0x12485
+test al, 0x10
+jne short loc_00012485  ; jne 0x12485
+
+loc_0001243f:
+or edi, 1
+jmp short loc_00012485  ; jmp 0x12485
+
+loc_00012444:
+cmp dword [ebp - 0x2c], 2
+jne short loc_00012495  ; jne 0x12495
+mov eax, dword [ebp - 0x34]
+sub esp, 0xc
+lea esi, [eax + 0x410]
+push esi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test al, 3
+jne short loc_0001246b  ; jne 0x1246b
+
+loc_00012463:
+or edi, 1
+jmp near loc_00012c21  ; jmp 0x12c21
+
+loc_0001246b:
+sub esp, 0xc
+push esi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+and eax, 3
+cmp eax, 2
+jne near loc_00012c21  ; jne 0x12c21
+jmp short loc_00012463  ; jmp 0x12463
+
+loc_00012485:
+test al, 0x24
+je short loc_00012492  ; je 0x12492
+cmp bl, 1
+jne short loc_00012495  ; jne 0x12495
+test al, 0x20
+
+loc_00012490:
+jne short loc_00012495  ; jne 0x12495
+
+loc_00012492:
+or edi, 2
+
+loc_00012495:
+cmp dword [ebp - 0x2c], 1
+sete dl
+mov byte [ebp - 0x3b], dl
+cmp bl, 2
+jne short loc_000124ae  ; jne 0x124ae
+mov eax, edi
+or eax, 4
+test dl, dl
+cmovne edi, eax
+
+loc_000124ae:
+cmp dword [ebp - 0x2c], 2
+sete cl
+mov byte [ebp - 0x3c], cl
+test bl, bl
+jne short loc_000124c6  ; jne 0x124c6
+mov eax, edi
+or eax, 4
+test cl, cl
+cmovne edi, eax
+
+loc_000124c6:
+cmp bl, 3
+jne short loc_000124d7  ; jne 0x124d7
+mov eax, edi
+or eax, 8
+cmp byte [ebp - 0x3b], 0
+cmovne edi, eax
+
+loc_000124d7:
+cmp bl, 1
+jne short loc_000124e8  ; jne 0x124e8
+mov eax, edi
+or eax, 8
+cmp byte [ebp - 0x3c], 0
+cmovne edi, eax
+
+loc_000124e8:
+cmp bl, 4
+jne short loc_000124f8  ; jne 0x124f8
+cmp byte [ebp - 0x3b], 0
+je short loc_000124f8  ; je 0x124f8
+or edi, 0x10
+jmp short loc_0001250c  ; jmp 0x1250c
+
+loc_000124f8:
+cmp byte [ebp - 0x3c], 0
+je short loc_0001250c  ; je 0x1250c
+mov eax, edi
+lea edx, [ebx - 2]
+or eax, 0x10
+cmp dl, 3
+cmovbe edi, eax
+
+loc_0001250c:
+cmp bl, 5
+jne short loc_0001251c  ; jne 0x1251c
+cmp byte [ebp - 0x3b], 0
+je short loc_0001251c  ; je 0x1251c
+or edi, 0x20
+jmp short loc_00012548  ; jmp 0x12548
+
+loc_0001251c:
+cmp byte [ebp - 0x3c], 0
+je short loc_00012542  ; je 0x12542
+mov eax, dword [ebp - 0x34]
+sub esp, 0xc
+add eax, 0x410
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, edi
+add esp, 0x10
+or edx, 0x20
+test al, 0xf0
+cmove edi, edx
+jmp short loc_0001255c  ; jmp 0x1255c
+
+loc_00012542:
+cmp byte [ebp - 0x3b], 0
+je short loc_0001255c  ; je 0x1255c
+
+loc_00012548:
+cmp bl, 6
+jne short loc_00012552  ; jne 0x12552
+or edi, 0x40
+jmp short loc_0001255c  ; jmp 0x1255c
+
+loc_00012552:
+mov eax, edi
+or al, 0x80
+cmp bl, 7
+cmove edi, eax
+
+loc_0001255c:
+mov eax, dword [ebp - 0x30]
+sub esp, 0xc
+add eax, 0x1030
+push eax
+mov dword [ebp - 0x4c], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov dword [ebp - 0x48], 0xff
+test eax, 0x400000
+je short loc_0001259f  ; je 0x1259f
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0x1a6], 0
+je short loc_0001259f  ; je 0x1259f
+call fcn_00015480  ; call 0x15480
+mov eax, dword [ebp + 8]
+movzx eax, byte [eax + 0x1a7]
+mov dword [ebp - 0x48], eax
+
+loc_0001259f:
+xor ecx, ecx
+mov eax, 0x10000
+mov dword [ebp - 0x34], 0
+mov edx, 1
+
+loc_000125b2:
+cmp byte [ebp - 0x39], cl
+jbe short loc_000125d9  ; jbe 0x125d9
+imul ebx, ecx, 0x2c
+mov esi, dword [ebp + 8]
+test byte [esi + ebx + 0x46], 1
+je short loc_000125d6  ; je 0x125d6
+mov esi, dword [ebp + 0xc]
+mov ebx, eax
+shl ebx, cl
+test dword [esi], ebx
+jne short loc_000125d6  ; jne 0x125d6
+mov ebx, edx
+shl ebx, cl
+or dword [ebp - 0x34], ebx
+
+loc_000125d6:
+inc ecx
+jmp short loc_000125b2  ; jmp 0x125b2
+
+loc_000125d9:
+cmp dword [ebp - 0x34], 0
+je short loc_000125e6  ; je 0x125e6
+mov eax, edi
+not eax
+and dword [ebp - 0x34], eax
+
+loc_000125e6:
+mov eax, dword [ebp + 8]
+mov byte [ebp - 0x3a], 0xff
+cmp byte [eax + 0x1a9], 0
+jne short loc_0001264c  ; jne 0x1264c
+xor eax, eax
+
+loc_000125f8:
+mov dl, al
+cmp al, byte [ebp - 0x39]
+jae short loc_00012616  ; jae 0x12616
+imul ecx, eax, 0x2c
+mov esi, dword [ebp + 8]
+cmp byte [esi + ecx + 0x4f], 0
+mov cl, byte [ebp - 0x3a]
+cmove ecx, edx
+inc eax
+mov byte [ebp - 0x3a], cl
+jmp short loc_000125f8  ; jmp 0x125f8
+
+loc_00012616:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001263f  ; je 0x1263f
+mov al, byte [ebp - 0x39]
+cmp byte [ebp - 0x3a], al
+jbe short loc_0001263f  ; jbe 0x1263f
+push eax
+push ref_00024f5c  ; push 0x24f5c
+push 0x173
+push ref_00024f7b  ; push 0x24f7b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001263f:
+mov cl, byte [ebp - 0x3a]
+mov eax, 1
+shl eax, cl
+or dword [ebp - 0x34], eax
+
+loc_0001264c:
+sub esp, 0xc
+lea eax, [ebp - 0x20]
+push eax
+call fcn_00019797  ; call 0x19797
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001269f  ; je 0x1269f
+test ebx, ebx
+jns short loc_0001269f  ; jns 0x1269f
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00012687  ; je 0x12687
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00012687:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x181
+push ref_00024f7b  ; push 0x24f7b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001269f:
+cmp dword [ebp - 0x20], 0x11
+je short loc_000126d9  ; je 0x126d9
+mov eax, dword [ebp + 8]
+mov dword [ebp - 0x38], 0
+cmp byte [eax], 9
+jbe short loc_000126e0  ; jbe 0x126e0
+mov edx, dword [ebp + 8]
+mov al, byte [eax + 0x1aa]
+movzx ecx, byte [edx + 0x1ab]
+shr al, 1
+movzx eax, al
+mov dword [ebp - 0x38], ecx
+and dword [ebp - 0x38], 7
+shl dword [ebp - 0x38], 7
+or dword [ebp - 0x38], eax
+jmp short loc_000126e0  ; jmp 0x126e0
+
+loc_000126d9:
+mov dword [ebp - 0x38], 0x3e8
+
+loc_000126e0:
+movzx eax, word [ebp - 0x3e]
+mov dword [ebp - 0x2c], 0
+mov dword [ebp - 0x44], 0
+mov dword [ebp - 0x58], eax
+
+loc_000126f5:
+mov edx, dword [ebp - 0x2c]
+mov al, byte [ebp - 0x39]
+mov byte [ebp - 0x3e], dl
+cmp dl, al
+jae near loc_00012ac0  ; jae 0x12ac0
+push eax
+push eax
+push dword [ebp - 0x2c]
+push dword [ebp - 0x30]
+call fcn_0001c39f  ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+mov eax, dword [ebp + 8]
+push 0x1c
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+mov ebx, eax
+call fcn_0001c0bd  ; call 0x1c0bd
+add esp, 0x10
+cmp eax, 2
+jne short loc_00012774  ; jne 0x12774
+cmp byte [ebp - 0x3c], 0
+je short loc_00012774  ; je 0x12774
+mov edx, dword [ebp + 8]
+mov eax, 0x2000430
+cmp byte [edx], 7
+jbe short loc_00012762  ; jbe 0x12762
+imul eax, dword [ebp - 0x2c], 0x2c
+mov al, byte [edx + eax + 0x46]
+shr al, 7
+cmp al, 1
+sbb eax, eax
+and eax, 0xfffffffd
+add eax, 0x2000433
+
+loc_00012762:
+push esi
+push esi
+push eax
+lea eax, [ebx + 0x418]
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+
+loc_00012774:
+cmp byte [ebp - 0x3e], 0
+jne near loc_00012869  ; jne 0x12869
+mov esi, dword [ebp - 0x30]
+push eax
+push eax
+push 0
+push esi
+call fcn_0001c39f  ; call 0x1c39f
+pop edx
+pop ecx
+lea edx, [ebp - 0x21]
+push edx
+sub eax, 0x20
+lea edx, [ebp - 0x1c]
+movzx eax, al
+push edx
+push eax
+push 4
+push 0xe00000e0
+push esi
+call fcn_00009ecd  ; call 0x9ecd
+add esp, 0x20
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000127f0  ; je 0x127f0
+test esi, esi
+jns short loc_000127f0  ; jns 0x127f0
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000127d8  ; je 0x127d8
+push eax
+push esi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000127d8:
+push esi
+push ref_000206f4  ; push 0x206f4
+push 0x1ab
+push ref_00024f7b  ; push 0x24f7b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000127f0:
+mov esi, dword [ebp - 0x30]
+push ecx
+push ecx
+push 0
+push esi
+or dword [ebp - 0x1c], 0x300000
+call fcn_0001c39f  ; call 0x1c39f
+pop edx
+pop ecx
+lea ecx, [ebp - 0x21]
+lea edx, [ebp - 0x1c]
+push ecx
+sub eax, 0x20
+push edx
+movzx eax, al
+push eax
+push 5
+push 0xe00000e0
+push esi
+call fcn_00009ecd  ; call 0x9ecd
+add esp, 0x20
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00012869  ; je 0x12869
+test esi, esi
+jns short loc_00012869  ; jns 0x12869
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00012851  ; je 0x12851
+push edx
+push esi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00012851:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x1b5
+push ref_00024f7b  ; push 0x24f7b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00012869:
+mov cl, byte [ebp - 0x2c]
+mov esi, 1
+shl esi, cl
+mov eax, esi
+and eax, edi
+mov dword [ebp - 0x50], eax
+jne near loc_00012c4c  ; jne 0x12c4c
+push eax
+push eax
+push 0x100
+lea eax, [ebx + 0x42]
+push eax
+call fcn_00018927  ; call 0x18927
+lea edx, [ebx + 0x5a]
+mov dword [esp], edx
+mov dword [ebp - 0x54], edx
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+mov edx, dword [ebp - 0x54]
+test al, 0x40
+jne near loc_00012939  ; jne 0x12939
+imul eax, dword [ebp - 0x2c], 0x2c
+mov ecx, dword [ebp + 8]
+test byte [ecx + eax + 0x46], 8
+jne short loc_00012939  ; jne 0x12939
+mov eax, dword [ebp - 0x48]
+cmp dword [ebp - 0x2c], eax
+je short loc_00012939  ; je 0x12939
+push eax
+mov esi, 0x1f4
+push eax
+push 0x4000000
+lea eax, [ebx + 0x338]
+push eax
+call fcn_00018b14  ; call 0x18b14
+lea eax, [ebx + 0x328]
+add esp, 0x10
+mov dword [ebp - 0x54], eax
+
+loc_000128e6:
+sub esp, 0xc
+push dword [ebp - 0x54]
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+and eax, 0xff000000
+cmp eax, 0x1000000
+jne short loc_00012927  ; jne 0x12927
+
+loc_00012900:
+push eax
+push eax
+push 0x8000000
+lea eax, [ebx + 0x408]
+push eax
+call fcn_00018b14  ; call 0x18b14
+mov cl, byte [ebp - 0x2c]
+mov eax, 0x10000
+mov edx, dword [ebp + 0xc]
+shl eax, cl
+or dword [edx], eax
+jmp near loc_00012a55  ; jmp 0x12a55
+
+loc_00012927:
+sub esp, 0xc
+push 0x64
+call fcn_0001bb03  ; call 0x1bb03
+add esp, 0x10
+dec esi
+jne short loc_000128e6  ; jne 0x128e6
+jmp short loc_00012900  ; jmp 0x12900
+
+loc_00012939:
+test dword [ebp - 0x34], esi
+jne short loc_00012972  ; jne 0x12972
+sub esp, 0xc
+push edx
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test al, 0x40
+je short loc_0001295e  ; je 0x1295e
+push eax
+push eax
+push 0x10
+lea eax, [ebx + 0x50]
+push eax
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+
+loc_0001295e:
+mov cl, byte [ebp - 0x2c]
+mov eax, 0x10000
+mov edx, dword [ebp + 0xc]
+shl eax, cl
+or dword [edx], eax
+jmp near loc_00012a58  ; jmp 0x12a58
+
+loc_00012972:
+sub esp, 0xc
+lea eax, [ebx + 0xe0]
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+cmp dword [ebp - 0x20], 0x11
+jne short loc_0001298e  ; jne 0x1298e
+test al, 2
+je short loc_000129bc  ; je 0x129bc
+
+loc_0001298e:
+lea esi, [ebx + 0x52]
+
+loc_00012991:
+mov eax, dword [ebp - 0x38]
+cmp dword [ebp - 0x44], eax
+jae short loc_000129bc  ; jae 0x129bc
+sub esp, 0xc
+push esi
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test ah, 0x20
+jne short loc_000129bc  ; jne 0x129bc
+sub esp, 0xc
+push 0x64
+call fcn_0001bb03  ; call 0x1bb03
+add esp, 0x10
+inc dword [ebp - 0x44]
+jmp short loc_00012991  ; jmp 0x12991
+
+loc_000129bc:
+sub esp, 0xc
+mov eax, dword [ebp - 0x2c]
+push dword [ebp - 0x30]
+push dword [ebp - 0x58]
+push dword [ebp + 8]
+push eax
+push eax
+call fcn_0001193a  ; call 0x1193a
+add esp, 0x20
+test eax, eax
+js short loc_000129fc  ; js 0x129fc
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000129fc  ; je 0x129fc
+mov eax, dword [ebp - 0x2c]
+push dword [ebp - 0x34]
+inc eax
+push eax
+push ref_00024fa9  ; push 0x24fa9
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000129fc:
+imul eax, dword [ebp - 0x2c], 0x2c
+mov ecx, dword [ebp + 8]
+test byte [ecx + eax + 0x46], 0x40
+je short loc_00012a58  ; je 0x12a58
+sub esp, 0xc
+lea eax, [ebx + 0x328]
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+and eax, 0x780000
+cmp eax, 0x380000
+jne short loc_00012a58  ; jne 0x12a58
+push eax
+push eax
+push 0x10
+lea esi, [ebx + 0x50]
+push esi
+call fcn_00018730  ; call 0x18730
+pop eax
+pop edx
+lea eax, [ebx + 0xe8]
+push 0x2000
+push eax
+call fcn_00018927  ; call 0x18927
+pop ecx
+pop eax
+push 0xef
+push esi
+call fcn_0001875d  ; call 0x1875d
+
+loc_00012a55:
+add esp, 0x10
+
+loc_00012a58:
+sub esp, 0xc
+push ebx
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+inc eax
+je short loc_00012ab8  ; je 0x12ab8
+cmp byte [ebp - 0x3b], 0
+je short loc_00012a73  ; je 0x12a73
+test byte [ebp - 0x3e], 0xfb
+jmp short loc_00012a87  ; jmp 0x12a87
+
+loc_00012a73:
+cmp byte [ebp - 0x3c], 0
+je short loc_00012a9f  ; je 0x12a9f
+mov cl, byte [ebp - 0x3e]
+mov al, cl
+sub eax, 4
+cmp al, 1
+jbe short loc_00012a89  ; jbe 0x12a89
+test cl, cl
+
+loc_00012a87:
+jne short loc_00012a9f  ; jne 0x12a9f
+
+loc_00012a89:
+push eax
+push eax
+push 0xf3
+lea eax, [ebx + 0xf7]
+push eax
+call fcn_0001875d  ; call 0x1875d
+add esp, 0x10
+
+loc_00012a9f:
+cmp dword [ebp - 0x50], 0
+jne short loc_00012ab8  ; jne 0x12ab8
+push esi
+add ebx, 0xd4
+push esi
+push 2
+push ebx
+call fcn_00018730  ; call 0x18730
+add esp, 0x10
+
+loc_00012ab8:
+inc dword [ebp - 0x2c]
+jmp near loc_000126f5  ; jmp 0x126f5
+
+loc_00012ac0:
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0x1a9], 0
+jne short loc_00012afe  ; jne 0x12afe
+mov eax, dword [ebp + 0xc]
+mov ecx, 8
+sub cl, byte [ebp - 0x39]
+mov edx, dword [eax]
+mov eax, 0xff
+sar eax, cl
+mov ecx, edx
+shr ecx, 0x10
+and ecx, eax
+cmp ecx, eax
+je short loc_00012afe  ; je 0x12afe
+mov cl, byte [ebp - 0x3a]
+mov eax, 0x10000
+shl eax, cl
+not eax
+and eax, edx
+mov edx, dword [ebp + 0xc]
+mov dword [edx], eax
+
+loc_00012afe:
+sub esp, 0xc
+push dword [ebp - 0x4c]
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test eax, 0x400000
+je short loc_00012b66  ; je 0x12b66
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0x1a6], 0
+je short loc_00012b66  ; je 0x12b66
+movzx eax, byte [eax + 0x1a7]
+mov ecx, dword [ebp + 8]
+imul edx, eax, 0x2c
+test byte [ecx + edx + 0x46], 1
+je short loc_00012b66  ; je 0x12b66
+push edx
+push edx
+push eax
+push dword [ebp - 0x30]
+call fcn_0001c39f  ; call 0x1c39f
+add esp, 0xc
+movzx eax, al
+push eax
+mov eax, dword [ebp + 8]
+push 0x1c
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+pop ecx
+pop ebx
+push 3
+add eax, 0xec
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+
+loc_00012b66:
+mov edx, dword [ebp + 8]
+mov eax, dword [ebp + 0xc]
+cmp byte [edx + 0x1a8], 0
+mov eax, dword [eax]
+je short loc_00012b95  ; je 0x12b95
+sub esp, 0xc
+push dword [ebp - 0x30]
+shr eax, 0x10
+not eax
+movzx eax, al
+push edi
+push eax
+push edx
+movzx eax, byte [edx + 1]
+push eax
+call fcn_00011e74  ; call 0x11e74
+add esp, 0x20
+
+loc_00012b95:
+xor ebx, ebx
+
+loc_00012b97:
+cmp byte [ebp - 0x39], bl
+jbe short loc_00012bd7  ; jbe 0x12bd7
+push eax
+mov eax, dword [ebp + 8]
+push ebx
+push 0x1c
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [esp], eax
+mov esi, eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+inc ax
+je short loc_00012bd4  ; je 0x12bd4
+push edi
+add esi, 0x320
+push edi
+push 0x1800000
+push esi
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+
+loc_00012bd4:
+inc ebx
+jmp short loc_00012b97  ; jmp 0x12b97
+
+loc_00012bd7:
+mov edi, dword [ebp - 0x30]
+push edx
+push edx
+push 0x80000080
+mov eax, edi
+add eax, 0x2314
+push eax
+call fcn_00018b14  ; call 0x18b14
+mov eax, edi
+pop ecx
+add eax, 0x1114
+pop ebx
+push 0xc000
+push eax
+call fcn_00018927  ; call 0x18927
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00012c60  ; je 0x12c60
+push eax
+push eax
+push ref_00024fdb  ; push 0x24fdb
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp short loc_00012c60  ; jmp 0x12c60
+
+loc_00012c21:
+sub esp, 0xc
+push esi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test al, 0xc
+je near loc_00012492  ; je 0x12492
+sub esp, 0xc
+push esi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+and eax, 0xc
+cmp eax, 8
+jmp near loc_00012490  ; jmp 0x12490
+
+loc_00012c4c:
+mov cl, byte [ebp - 0x2c]
+mov eax, 0x10000
+shl eax, cl
+mov ecx, dword [ebp + 0xc]
+or dword [ecx], eax
+jmp near loc_00012a58  ; jmp 0x12a58
+
+loc_00012c60:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00012c6a:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+mov ebx, 0xa
+sub esp, 0xc
+mov edi, dword [ebp + 0xc]
+mov esi, dword [ebp + 0x10]
+
+loc_00012c7e:
+sub esp, 0xc
+push dword [ebp + 8]
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+and eax, edi
+cmp ax, si
+je short loc_00012caa  ; je 0x12caa
+sub esp, 0xc
+push 0x64
+call fcn_0001bb03  ; call 0x1bb03
+add esp, 0x10
+dec ebx
+jne short loc_00012c7e  ; jne 0x12c7e
+mov eax, 0x80000012
+jmp short loc_00012cac  ; jmp 0x12cac
+
+loc_00012caa:
+xor eax, eax
+
+loc_00012cac:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00012cb4:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x20
+mov esi, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+push 0
+push 1
+lea ebx, [esi + 0x68]
+push ebx
+mov dword [ebp - 0x1c], eax
+call fcn_00012c6a  ; call 0x12c6a
+add esp, 0x10
+test eax, eax
+jns short loc_00012cf0  ; jns 0x12cf0
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_00012d7a  ; je 0x12d7a
+push eax
+push eax
+push ref_00024ff3  ; push 0x24ff3
+jmp short loc_00012d6d  ; jmp 0x12d6d
+
+loc_00012cf0:
+mov eax, dword [ebp + 0xc]
+push ecx
+push ecx
+push dword [eax]
+lea eax, [esi + 0x60]
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop edi
+pop eax
+push 3
+push ebx
+call fcn_00018927  ; call 0x18927
+add esp, 0xc
+push 0
+push 1
+push ebx
+call fcn_00012c6a  ; call 0x12c6a
+add esp, 0x10
+mov edi, eax
+test eax, eax
+jns short loc_00012d2f  ; jns 0x12d2f
+push edx
+push edx
+push 0xfffe
+push ebx
+call fcn_00018954  ; call 0x18954
+jmp short loc_00012d58  ; jmp 0x12d58
+
+loc_00012d2f:
+xor edi, edi
+cmp byte [ebp - 0x1c], 1
+jne short loc_00012d7f  ; jne 0x12d7f
+sub esp, 0xc
+push ebx
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test al, 2
+je short loc_00012d5d  ; je 0x12d5d
+sub esp, 0xc
+add esi, 0x64
+push esi
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, dword [ebp + 0xc]
+mov dword [edx], eax
+
+loc_00012d58:
+add esp, 0x10
+jmp short loc_00012d7f  ; jmp 0x12d7f
+
+loc_00012d5d:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00012d7a  ; je 0x12d7a
+push eax
+push eax
+push ref_00025022  ; push 0x25022
+
+loc_00012d6d:
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00012d7a:
+mov edi, 0x80000007
+
+loc_00012d7f:
+lea esp, [ebp - 0xc]
+mov eax, edi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00012d89:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x2c
+mov al, byte [ebp + 0xc]
+mov byte [ebp - 0x29], al
+mov al, byte [ebp + 0x10]
+mov byte [ebp - 0x2a], al
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00012dc5  ; je 0x12dc5
+cmp dword [ebp + 8], 0
+jne short loc_00012dc5  ; jne 0x12dc5
+push eax
+push ref_00025045  ; push 0x25045
+push 0x96
+push ref_00025059  ; push 0x25059
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00012dc5:
+xor ebx, ebx
+lea esi, [ebp - 0x1c]
+
+loc_00012dca:
+push esi
+push 0
+push ebx
+push ref_0002912c  ; push 0x2912c
+mov dword [ebp - 0x1c], 0
+call fcn_0001975d  ; call 0x1975d
+add esp, 0x10
+test eax, eax
+jne short loc_00012e18  ; jne 0x12e18
+mov edx, dword [ebp - 0x1c]
+test edx, edx
+je short loc_00012e18  ; je 0x12e18
+movzx ecx, word [edx]
+movzx edi, word [edx + 2]
+shl ecx, 0x10
+or ecx, edi
+cmp ecx, dword [ebp + 8]
+jne short loc_00012e18  ; jne 0x12e18
+mov cl, byte [edx + 4]
+cmp cl, 0xff
+je short loc_00012e0b  ; je 0x12e0b
+cmp cl, byte [ebp - 0x29]
+jne short loc_00012e18  ; jne 0x12e18
+
+loc_00012e0b:
+mov dl, byte [edx + 5]
+cmp dl, 0xff
+je short loc_00012e1d  ; je 0x12e1d
+cmp dl, byte [ebp - 0x2a]
+je short loc_00012e1d  ; je 0x12e1d
+
+loc_00012e18:
+inc ebx
+test eax, eax
+je short loc_00012dca  ; je 0x12dca
+
+loc_00012e1d:
+mov eax, dword [ebp - 0x1c]
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00012e28:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+push eax
+push 0
+push 0x1f
+movzx eax, byte [ebx + 1]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+lea edx, [eax + 0x63bf]
+cmp dx, 6
+jbe short loc_00012e66  ; jbe 0x12e66
+add ax, 0x633f
+cmp ax, 0xa
+ja short loc_00012ea9  ; ja 0x12ea9
+
+loc_00012e66:
+push ecx
+push 0
+push 0x1b
+movzx eax, byte [ebx + 1]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+mov ebx, eax
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00012e94  ; je 0x12e94
+push edx
+push edx
+push ref_00025081  ; push 0x25081
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00012e94:
+push eax
+mov eax, esi
+movzx esi, al
+add ebx, 0x42
+push esi
+push 0x3f
+push ebx
+call fcn_0001878a  ; call 0x1878a
+add esp, 0x10
+
+loc_00012ea9:
+lea esp, [ebp - 8]
+xor eax, eax
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00012eb2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x4c
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00012ed5  ; je 0x12ed5
+push eax
+push eax
+push ref_000250c6  ; push 0x250c6
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00012ed5:
+mov eax, dword [ebp + 8]
+mov esi, dword [eax + 4]
+call fcn_0001bfbb  ; call 0x1bfbb
+lea edi, [esi + 0x2030]
+mov dword [ebp - 0x2c], eax
+push eax
+mov eax, dword [ebp + 8]
+push 0
+push 0x1b
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0x1f
+mov ebx, eax
+mov eax, dword [ebp + 8]
+lea esi, [ebx + 0x120]
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+mov dword [esp], edi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test eax, eax
+jns short loc_00012f6f  ; jns 0x12f6f
+sub esp, 0xc
+push edi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0xc
+and eax, 0xfe
+or eax, 0x2000000
+push eax
+push 0xf8ffff01
+push esi
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp dword [ebp - 0x2c], 1
+jne short loc_00012f6f  ; jne 0x12f6f
+push eax
+push eax
+push 0xf7ff
+lea eax, [ebx + 0x78]
+push eax
+call fcn_00018954  ; call 0x18954
+add esp, 0x10
+
+loc_00012f6f:
+sub esp, 0xc
+push esi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test eax, 0x7000000
+je short loc_00012fc3  ; je 0x12fc3
+push eax
+push eax
+push 0xffffff01
+lea eax, [ebx + 0x114]
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+cmp dword [ebp - 0x2c], 1
+jne short loc_00012fad  ; jne 0x12fad
+push edi
+push edi
+push 0x80000000
+push esi
+call fcn_00018b14  ; call 0x18b14
+jmp short loc_00012fc0  ; jmp 0x12fc0
+
+loc_00012fad:
+cmp dword [ebp - 0x2c], 2
+jne short loc_00012fc3  ; jne 0x12fc3
+push ecx
+push ecx
+push 0x7fffffff
+push esi
+call fcn_00018b3e  ; call 0x18b3e
+
+loc_00012fc0:
+add esp, 0x10
+
+loc_00012fc3:
+mov eax, dword [ebp + 8]
+lea ecx, [ebx + 0x10]
+mov dword [ebp - 0x40], ecx
+mov eax, dword [eax + 0x1a]
+push edx
+push edx
+push eax
+push ecx
+mov dword [ebp - 0x34], eax
+call fcn_00017e8f  ; call 0x17e8f
+lea eax, [ebx + 0x14]
+pop ecx
+pop esi
+mov dword [ebp - 0x44], eax
+push 0
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+lea eax, [ebx + 4]
+pop edi
+pop edx
+mov dword [ebp - 0x48], eax
+push 2
+push eax
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+cmp dword [ebp - 0x2c], 1
+jne short loc_0001302e  ; jne 0x1302e
+push esi
+push esi
+push 0x10
+lea eax, [ebx + 0x43]
+push eax
+call fcn_00018730  ; call 0x18730
+pop edi
+pop eax
+lea eax, [ebx + 0xc0]
+push 0x20000
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+mov eax, 0x4000
+jmp short loc_0001304e  ; jmp 0x1304e
+
+loc_0001302e:
+xor eax, eax
+cmp dword [ebp - 0x2c], 2
+jne short loc_0001304e  ; jne 0x1304e
+push ecx
+push ecx
+push 0xbf
+lea eax, [ebx + 0x43]
+push eax
+call fcn_0001875d  ; call 0x1875d
+add esp, 0x10
+mov eax, 0x1000000
+
+loc_0001304e:
+push edx
+push edx
+push eax
+lea eax, [ebx + 0xc4]
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+cmp dword [ebp - 0x2c], 1
+jne short loc_0001307c  ; jne 0x1307c
+push eax
+push eax
+push 0x7fffffff
+lea eax, [ebx + 0xd0]
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+
+loc_0001307c:
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0x372], 0
+jne short loc_00013097  ; jne 0x13097
+push eax
+push eax
+push 0x7f
+lea eax, [ebx + 0x4d]
+push eax
+call fcn_0001875d  ; call 0x1875d
+jmp short loc_000130c3  ; jmp 0x130c3
+
+loc_00013097:
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0x373], 0
+je short loc_000130c6  ; je 0x130c6
+sub esp, 0xc
+lea eax, [ebx + 0x4d]
+push eax
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+test al, 1
+jne short loc_000130c6  ; jne 0x130c6
+push edi
+push edi
+push 1
+lea eax, [ebx + 0x4c]
+push eax
+call fcn_00018730  ; call 0x18730
+
+loc_000130c3:
+add esp, 0x10
+
+loc_000130c6:
+cmp dword [ebp - 0x2c], 2
+jne short loc_000130f9  ; jne 0x130f9
+push eax
+push eax
+mov eax, dword [ebp - 0x34]
+push 1
+add eax, 0x12
+push eax
+call fcn_00018927  ; call 0x18927
+pop eax
+pop edx
+lea eax, [ebx + 0x41]
+push 1
+push eax
+call fcn_00018730  ; call 0x18730
+lea eax, [ebx + 0x42]
+pop ecx
+pop esi
+push 4
+push eax
+call fcn_00018730  ; call 0x18730
+add esp, 0x10
+
+loc_000130f9:
+mov edi, dword [ebp - 0x34]
+push eax
+push eax
+push 1
+lea esi, [edi + 8]
+push esi
+call fcn_00018b14  ; call 0x18b14
+add esp, 0xc
+push 1
+push 1
+push esi
+call fcn_00012c6a  ; call 0x12c6a
+mov dword [esp], edi
+call fcn_00017dc2  ; call 0x17dc2
+pop edx
+pop ecx
+movzx eax, ax
+push eax
+push edi
+call fcn_00017e04  ; call 0x17e04
+mov ecx, 3
+cmp dword [ebp - 0x2c], 2
+pop eax
+mov eax, 0xf
+pop edx
+cmove eax, ecx
+lea edx, [edi + 0xe]
+push eax
+push edx
+mov dword [ebp - 0x3c], edx
+call fcn_00018730  ; call 0x18730
+pop ecx
+pop edi
+push 0xfffffffffffffffe
+push esi
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0xc
+push 0
+push 1
+push esi
+call fcn_00012c6a  ; call 0x12c6a
+add esp, 0x10
+mov edi, eax
+test eax, eax
+jns short loc_00013180  ; jns 0x13180
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_00013497  ; je 0x13497
+push eax
+push eax
+push ref_000250dd  ; push 0x250dd
+jmp short loc_000131c6  ; jmp 0x131c6
+
+loc_00013180:
+push edi
+push edi
+push 1
+push esi
+call fcn_00018b14  ; call 0x18b14
+mov eax, dword [ebp + 8]
+movzx eax, word [eax + 0x374]
+mov dword [esp], eax
+call fcn_0001bb03  ; call 0x1bb03
+add esp, 0xc
+push 1
+push 1
+push esi
+call fcn_00012c6a  ; call 0x12c6a
+add esp, 0x10
+mov edi, eax
+test eax, eax
+jns short loc_000131d8  ; jns 0x131d8
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_00013497  ; je 0x13497
+push ecx
+push ecx
+push ref_00025118  ; push 0x25118
+
+loc_000131c6:
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp near loc_00013497  ; jmp 0x13497
+
+loc_000131d8:
+cmp dword [ebp - 0x2c], 2
+mov edx, 3
+mov eax, 0xf
+mov edi, 0xa
+cmove eax, edx
+xor edx, edx
+mov word [ebp - 0x38], ax
+
+loc_000131f4:
+sub esp, 0xc
+push dword [ebp - 0x3c]
+mov dword [ebp - 0x4c], edx
+call fcn_00017d8b  ; call 0x17d8b
+mov edx, dword [ebp - 0x4c]
+add esp, 0x10
+mov byte [ebp - 0x2d], al
+mov al, byte [ebp - 0x38]
+and byte [ebp - 0x2d], al
+mov al, byte [ebp - 0x2d]
+cmp al, dl
+jne short loc_0001321c  ; jne 0x1321c
+test al, al
+jne short loc_0001326b  ; jne 0x1326b
+
+loc_0001321c:
+sub esp, 0xc
+push 0x64
+call fcn_0001bb03  ; call 0x1bb03
+add esp, 0x10
+dec edi
+je short loc_00013231  ; je 0x13231
+mov dl, byte [ebp - 0x2d]
+jmp short loc_000131f4  ; jmp 0x131f4
+
+loc_00013231:
+cmp byte [ebp - 0x2d], 0
+jne short loc_0001326b  ; jne 0x1326b
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00013254  ; je 0x13254
+push edx
+push edx
+push ref_00025153  ; push 0x25153
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00013254:
+push eax
+mov edi, 0x80000007
+push eax
+push 0xfffffffffffffffe
+push esi
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+jmp near loc_00013497  ; jmp 0x13497
+
+loc_0001326b:
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0x371], 1
+jne short loc_0001328a  ; jne 0x1328a
+push eax
+add ebx, 0x54
+push eax
+push 0x100
+push ebx
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+
+loc_0001328a:
+xor eax, eax
+cmp dword [ebp - 0x2c], 2
+mov byte [ebp - 0x2c], 0
+setne al
+lea eax, [eax + eax + 2]
+mov word [ebp - 0x3c], ax
+
+loc_0001329f:
+movzx eax, byte [ebp - 0x2c]
+cmp ax, word [ebp - 0x3c]
+jae near loc_00013495  ; jae 0x13495
+test byte [ebp - 0x2d], 1
+jne short loc_000132d0  ; jne 0x132d0
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_0001348a  ; je 0x1348a
+push eax
+movzx eax, byte [ebp - 0x2c]
+push eax
+push ref_00025172  ; push 0x25172
+jmp near loc_000133d5  ; jmp 0x133d5
+
+loc_000132d0:
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0x371], 0
+je short loc_000132fb  ; je 0x132fb
+mov cl, byte [ebp - 0x2c]
+push eax
+push eax
+mov eax, 1
+shl eax, cl
+movzx eax, ax
+push eax
+mov eax, dword [ebp - 0x34]
+add eax, 0xc
+push eax
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+
+loc_000132fb:
+movzx ebx, byte [ebp - 0x2c]
+mov eax, ebx
+shl eax, 0x1c
+mov dword [ebp - 0x38], eax
+or eax, 0xf0000
+mov dword [ebp - 0x24], eax
+push eax
+push 1
+lea eax, [ebp - 0x24]
+push eax
+push dword [ebp - 0x34]
+call fcn_00012cb4  ; call 0x12cb4
+add esp, 0x10
+mov edi, eax
+test eax, eax
+jns short loc_00013340  ; jns 0x13340
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_00013497  ; je 0x13497
+push eax
+push eax
+push ref_0002518f  ; push 0x2518f
+jmp near loc_000131c6  ; jmp 0x131c6
+
+loc_00013340:
+mov eax, dword [ebp - 0x38]
+push esi
+push 1
+or eax, 0xf0002
+mov dword [ebp - 0x20], eax
+lea eax, [ebp - 0x20]
+push eax
+push dword [ebp - 0x34]
+call fcn_00012cb4  ; call 0x12cb4
+add esp, 0x10
+mov edi, eax
+test eax, eax
+jns short loc_0001337c  ; jns 0x1337c
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_00013497  ; je 0x13497
+push ecx
+push ecx
+push ref_000251c3  ; push 0x251c3
+jmp near loc_000131c6  ; jmp 0x131c6
+
+loc_0001337c:
+mov eax, dword [ebp - 0x20]
+movzx eax, ah
+mov dword [ebp - 0x20], eax
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000133a7  ; je 0x133a7
+sub esp, 0xc
+push dword [ebp - 0x20]
+push dword [ebp - 0x24]
+push ebx
+push ref_000251ef  ; push 0x251ef
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_000133a7:
+movzx eax, byte [ebp - 0x20]
+push edx
+push ebx
+push eax
+push dword [ebp - 0x24]
+call fcn_00012d89  ; call 0x12d89
+add esp, 0x10
+mov esi, eax
+test eax, eax
+jne short loc_000133e7  ; jne 0x133e7
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_0001348a  ; je 0x1348a
+push eax
+push dword [ebp - 0x24]
+push ref_0002521f  ; push 0x2521f
+
+loc_000133d5:
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp near loc_0001348a  ; jmp 0x1348a
+
+loc_000133e7:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00013418  ; je 0x13418
+push eax
+movzx eax, word [esi + 6]
+push eax
+movzx eax, byte [esi + 5]
+push eax
+movzx eax, byte [esi + 4]
+push eax
+movzx eax, word [esi + 2]
+push eax
+movzx eax, word [esi]
+push eax
+push ref_00025265  ; push 0x25265
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_00013418:
+xor ebx, ebx
+
+loc_0001341a:
+movzx eax, word [esi + 6]
+cmp ebx, eax
+jae short loc_0001348a  ; jae 0x1348a
+mov eax, dword [esi + ebx*4 + 0xc]
+mov dword [ebp - 0x1c], eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00013452  ; je 0x13452
+mov eax, dword [ebp - 0x1c]
+shr eax, 0x1c
+je short loc_00013452  ; je 0x13452
+push eax
+push ref_000252bb  ; push 0x252bb
+push 0x26a
+push ref_00025059  ; push 0x25059
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00013452:
+mov eax, dword [ebp - 0x38]
+or dword [ebp - 0x1c], eax
+push eax
+push 0
+lea eax, [ebp - 0x1c]
+push eax
+push dword [ebp - 0x34]
+call fcn_00012cb4  ; call 0x12cb4
+add esp, 0x10
+mov edi, eax
+test eax, eax
+jns short loc_00013487  ; jns 0x13487
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00013497  ; je 0x13497
+push eax
+push dword [ebp - 0x24]
+push ref_000252d5  ; push 0x252d5
+jmp near loc_000131c6  ; jmp 0x131c6
+
+loc_00013487:
+inc ebx
+jmp short loc_0001341a  ; jmp 0x1341a
+
+loc_0001348a:
+inc byte [ebp - 0x2c]
+shr byte [ebp - 0x2d], 1
+jmp near loc_0001329f  ; jmp 0x1329f
+
+loc_00013495:
+xor edi, edi
+
+loc_00013497:
+push edx
+push edx
+push 0xfffd
+push dword [ebp - 0x48]
+call fcn_00018954  ; call 0x18954
+pop ecx
+pop ebx
+push 0
+push dword [ebp - 0x40]
+call fcn_00017e8f  ; call 0x17e8f
+pop esi
+pop eax
+push 0
+push dword [ebp - 0x44]
+call fcn_00017e8f  ; call 0x17e8f
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_000134db  ; je 0x134db
+push eax
+push eax
+push ref_00025309  ; push 0x25309
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000134db:
+lea esp, [ebp - 0xc]
+mov eax, edi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000134e5:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+mov ebx, 0xc8
+sub esp, 0xc
+mov esi, dword [ebp + 0xc]
+lea edi, [esi + 0x20]
+
+loc_000134f9:
+sub esp, 0xc
+push edi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test al, 2
+je short loc_00013519  ; je 0x13519
+sub esp, 0xc
+push 0x64
+call fcn_0001bb03  ; call 0x1bb03
+add esp, 0x10
+dec ebx
+jne short loc_000134f9  ; jne 0x134f9
+
+loc_00013519:
+sub esp, 0xc
+push edi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test al, 2
+jne short loc_00013542  ; jne 0x13542
+add esi, 0x60
+mov dword [ebp + 8], esi
+mov dword [ebp + 0xc], 1
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f  ; jmp 0x17e8f
+
+loc_00013542:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001354a:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov ebx, dword [ebp + 0x14]
+lea esi, [ebx + 0x84]
+push esi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test al, 1
+je short loc_00013592  ; je 0x13592
+
+loc_00013569:
+sub esp, 0xc
+push esi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test al, 1
+je short loc_000135d7  ; je 0x135d7
+sub ebx, 0xffffff80
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], 2
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018927  ; jmp 0x18927
+
+loc_00013592:
+sub esp, 0xc
+lea edi, [ebx + 0x80]
+push edi
+call fcn_00017e4e  ; call 0x17e4e
+pop edx
+pop ecx
+and eax, 0xfffffffe
+push eax
+push edi
+mov edi, 0xc8
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+
+loc_000135b5:
+sub esp, 0xc
+push esi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test al, 1
+jne short loc_00013569  ; jne 0x13569
+sub esp, 0xc
+push 0x64
+call fcn_0001bb03  ; call 0x1bb03
+add esp, 0x10
+dec edi
+jne short loc_000135b5  ; jne 0x135b5
+jmp short loc_00013569  ; jmp 0x13569
+
+loc_000135d7:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000135df:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x2c
+movzx eax, byte [ebp + 0x10]
+mov byte [ebp - 0x19], 0
+mov dword [ebp - 0x2c], eax
+
+loc_000135f3:
+call fcn_0001c245  ; call 0x1c245
+cmp byte [ebp - 0x19], al
+jae near loc_000137f4  ; jae 0x137f4
+movzx esi, byte [ebp - 0x19]
+push ecx
+movzx eax, byte [esi + esi + ref_000204f1]  ; movzx eax, byte [esi + esi + 0x204f1]
+push eax
+movzx eax, byte [esi + esi + ref_000204f0]  ; movzx eax, byte [esi + esi + 0x204f0]
+push eax
+push dword [ebp - 0x2c]
+mov dword [ebp - 0x28], eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0x10
+mov ebx, eax
+mov eax, dword [ebp + 8]
+lea eax, [eax + esi*8]
+cmp byte [eax], 0
+mov dword [ebp - 0x24], eax
+jne short loc_00013650  ; jne 0x13650
+push edi
+push edi
+push 0
+lea eax, [ebx + 0x10]
+add ebx, 4
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+pop edx
+push 0
+push ebx
+jmp near loc_000137af  ; jmp 0x137af
+
+loc_00013650:
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0x13], 1
+jne short loc_0001366c  ; jne 0x1366c
+push esi
+push esi
+push 0xfffc
+lea eax, [ebx + 0x78]
+push eax
+call fcn_00018954  ; call 0x18954
+add esp, 0x10
+
+loc_0001366c:
+sub esp, 0xc
+lea edi, [ebx + 0x10]
+push edi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test eax, eax
+jne short loc_000136af  ; jne 0x136af
+sub esp, 0xc
+lea eax, [ebx + 4]
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test al, 2
+jne short loc_000136af  ; jne 0x136af
+push ecx
+push ecx
+push dword [ebp + 0xc]
+push edi
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+mov esi, dword [ebp + 0xc]
+mov byte [ebp - 0x1a], 0
+mov word [ebp - 0x1c], 0
+jmp short loc_000136d0  ; jmp 0x136d0
+
+loc_000136af:
+sub esp, 0xc
+push edi
+call fcn_00017e4e  ; call 0x17e4e
+mov esi, eax
+lea eax, [ebx + 4]
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+mov byte [ebp - 0x1a], 1
+mov word [ebp - 0x1c], ax
+
+loc_000136d0:
+push edx
+push edx
+lea eax, [ebx + 4]
+push 6
+push eax
+mov dword [ebp - 0x20], eax
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+cmp byte [ebp - 0x1a], 0
+jne short loc_000136f9  ; jne 0x136f9
+push eax
+push eax
+push 2
+lea eax, [esi + 0x20]
+push eax
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+
+loc_000136f9:
+push eax
+push eax
+push 1
+lea edx, [ebx + 0x80]
+push edx
+mov dword [ebp - 0x34], edx
+call fcn_00018927  ; call 0x18927
+lea ecx, [esi + 4]
+push 0
+push 0xf
+push 0xc
+push ecx
+mov dword [ebp - 0x30], ecx
+call fcn_00018bc6  ; call 0x18bc6
+mov eax, dword [ebp - 0x24]
+add esp, 0x20
+mov ecx, dword [ebp - 0x30]
+cmp byte [eax + 1], 1
+sbb eax, eax
+add eax, 3
+movzx eax, al
+push eax
+push 3
+push 0
+push ecx
+call fcn_00018bc6  ; call 0x18bc6
+pop eax
+pop edx
+mov edx, dword [ebp - 0x34]
+push 0xfffe
+push edx
+call fcn_00018954  ; call 0x18954
+lea edx, [ebx + 0x78]
+mov dword [esp], edx
+mov dword [ebp - 0x24], edx
+call fcn_00017e4e  ; call 0x17e4e
+pop ecx
+pop edx
+mov edx, dword [ebp - 0x24]
+or eax, 4
+push eax
+push edx
+call fcn_00017e8f  ; call 0x17e8f
+pop ecx
+pop eax
+lea eax, [ebx + 0x7c]
+add ebx, 0x8c
+push 0x4080
+push eax
+call fcn_00018b14  ; call 0x18b14
+mov dword [esp], ebx
+call fcn_00017e4e  ; call 0x17e4e
+pop edx
+pop ecx
+and eax, 0xfbfff4ff
+or eax, 0x20400
+push eax
+push ebx
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+cmp byte [ebp - 0x1a], 0
+je short loc_000137b6  ; je 0x137b6
+movzx eax, word [ebp - 0x1c]
+push esi
+push esi
+push eax
+push dword [ebp - 0x20]
+
+loc_000137af:
+call fcn_00017e04  ; call 0x17e04
+jmp short loc_000137e9  ; jmp 0x137e9
+
+loc_000137b6:
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0xb5], 0
+je short loc_000137d0  ; je 0x137d0
+push ebx
+push ebx
+push esi
+push dword [ebp - 0x28]
+call fcn_000134e5  ; call 0x134e5
+add esp, 0x10
+
+loc_000137d0:
+push eax
+push eax
+push 0xfff9
+push dword [ebp - 0x20]
+call fcn_00018954  ; call 0x18954
+pop edx
+pop ecx
+push 0
+push edi
+call fcn_00017e8f  ; call 0x17e8f
+
+loc_000137e9:
+add esp, 0x10
+inc byte [ebp - 0x19]
+jmp near loc_000135f3  ; jmp 0x135f3
+
+loc_000137f4:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000137fe:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov ecx, dword [ebp + 0x10]
+mov eax, dword [ebp + 8]
+mov ebx, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x18]
+mov dword [ebp - 0x24], ecx
+mov dword [ebp - 0x20], eax
+call fcn_0001bfbb  ; call 0x1bfbb
+mov esi, eax
+call fcn_0001c0bd  ; call 0x1c0bd
+mov dword [ebp - 0x1c], eax
+call fcn_0001bbfd  ; call 0x1bbfd
+mov eax, dword [ebp - 0x20]
+cmp byte [eax + 0x10], 0
+je near loc_00013c36  ; je 0x13c36
+cmp esi, 1
+jne short loc_0001386c  ; jne 0x1386c
+sub esp, 0xc
+lea eax, [edi + 0xe0]
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov edx, 0x15000000
+and eax, 0x18
+sub eax, 8
+cmp eax, 0x10
+ja short loc_00013868  ; ja 0x13868
+mov edx, dword [eax*4 + ref_0002046c]  ; mov edx, dword [eax*4 + 0x2046c]
+
+loc_00013868:
+push eax
+push edx
+jmp short loc_00013878  ; jmp 0x13878
+
+loc_0001386c:
+cmp dword [ebp - 0x1c], 2
+jne short loc_00013889  ; jne 0x13889
+push ecx
+push 0xf000000
+
+loc_00013878:
+push 0xffffff
+lea eax, [ebx + 4]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_00013889:
+push eax
+push eax
+push 0xc401
+lea eax, [edi + 0x44]
+push eax
+call fcn_00018927  ; call 0x18927
+pop eax
+pop edx
+lea eax, [edi + 0x46]
+push 0xf
+push eax
+call fcn_00018730  ; call 0x18730
+add esp, 0xc
+mov edx, 0xe0000000
+cmp esi, 1
+mov eax, 0xf8000000
+cmovne eax, edx
+mov ecx, 0xfce2e5f
+mov edx, 0x7886e9f
+cmovne edx, ecx
+push edx
+push eax
+lea eax, [edi + 0x50]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0xc
+push 0x200000a
+push 0xff00
+lea eax, [ebx + 0xc]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0xc
+push 0x600
+push 0xffffffffffffffdf
+lea eax, [ebx + 0x10]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+cmp esi, 2
+jne short loc_00013946  ; jne 0x13946
+cmp dword [ebp - 0x1c], 1
+jne short loc_00013921  ; jne 0x13921
+push eax
+add edi, 0xb0
+push 0x20000
+push 0xffff9fff
+push edi
+call fcn_00018b68  ; call 0x18b68
+jmp short loc_0001393e  ; jmp 0x1393e
+
+loc_00013921:
+cmp dword [ebp - 0x1c], 2
+jne near loc_00013a5a  ; jne 0x13a5a
+push eax
+add edi, 0xa8
+push eax
+push 0x22000
+push edi
+call fcn_00018b14  ; call 0x18b14
+
+loc_0001393e:
+add esp, 0x10
+jmp near loc_00013a5a  ; jmp 0x13a5a
+
+loc_00013946:
+cmp esi, 1
+jne short loc_0001397a  ; jne 0x1397a
+push eax
+push eax
+push 0xfff7ffff
+lea eax, [ebx + 0x8008]
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0xc
+push 0x110000
+
+loc_00013966:
+push 0xfffffeff
+lea eax, [ebx + 0x8058]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_0001397a:
+push ecx
+push ecx
+push 0x2040000
+lea eax, [ebx + 0x8060]
+push eax
+call fcn_00018b14  ; call 0x18b14
+pop edi
+pop eax
+lea eax, [ebx + 0x8090]
+push 0x4100
+push eax
+call fcn_00018b14  ; call 0x18b14
+pop eax
+pop edx
+lea eax, [ebx + 0x8094]
+push 0xa04000
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0xc
+push 0x40
+push 0xfffeffff
+lea eax, [ebx + 0x80e0]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0xc
+push 0xc00
+push 0xffff8dff
+lea eax, [ebx + 0x80ec]
+push eax
+call fcn_00018b68  ; call 0x18b68
+lea eax, [ebx + 0x80f0]
+pop ecx
+pop edi
+push 0xffefffff
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+cmp esi, 2
+jne short loc_00013a65  ; jne 0x13a65
+push edi
+push edi
+push 0x2000000
+lea eax, [ebx + 0x80fc]
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0xc
+push 0x100800
+push 0xfffffefb
+lea eax, [ebx + 0x8110]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0xc
+push 0xff00f03c
+push 0
+lea eax, [ebx + 0x8140]
+push eax
+call fcn_00018b68  ; call 0x18b68
+pop eax
+pop edx
+lea eax, [ebx + 0x8144]
+push 0x1c0
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+jmp near loc_00013c27  ; jmp 0x13c27
+
+loc_00013a5a:
+push eax
+push 0x10000
+jmp near loc_00013966  ; jmp 0x13966
+
+loc_00013a65:
+cmp esi, 1
+jne near loc_00013c27  ; jne 0x13c27
+push ecx
+xor edi, edi
+push 0x100800
+push 0xfffffffffffffffb
+lea eax, [ebx + 0x8110]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0xc
+push 0xff03c132
+push 0
+lea eax, [ebx + 0x8140]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0xc
+push 0x100
+push 0xffffff3f
+lea eax, [ebx + 0x8144]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+mov eax, 0x202000
+
+loc_00013abb:
+push ecx
+not eax
+push edi
+push eax
+lea edx, [ebx + 0x8154]
+push edx
+mov dword [ebp - 0x28], edx
+call fcn_00018b68  ; call 0x18b68
+pop eax
+pop edx
+mov edx, dword [ebp - 0x28]
+push 0xfffffffffffffff7
+push edx
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+cmp esi, 2
+jne near loc_00013b80  ; jne 0x13b80
+push ecx
+push ecx
+push 3
+lea eax, [ebx + 0x8164]
+push eax
+call fcn_00018b14  ; call 0x18b14
+mov eax, dword [ebp - 0x1c]
+add esp, 0x10
+cmp eax, 1
+je short loc_00013b10  ; je 0x13b10
+cmp eax, 2
+mov eax, 0xe403f
+cmove edi, eax
+jmp short loc_00013b15  ; jmp 0x13b15
+
+loc_00013b10:
+mov edi, 0xe0038
+
+loc_00013b15:
+push eax
+push edi
+push 0xfff00000
+lea eax, [ebx + 0x816c]
+push eax
+call fcn_00018b68  ; call 0x18b68
+pop eax
+pop edx
+lea eax, [ebx + 0x8174]
+push 0x1400c0a
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0xc
+push 0x33200a3
+push 0
+lea eax, [ebx + 0x817c]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0xc
+push 0xcb0028
+push 0
+lea eax, [ebx + 0x8180]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0xc
+push 0x64001e
+push 0
+lea eax, [ebx + 0x8184]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_00013b80:
+cmp esi, 2
+sete dl
+cmp dword [ebp - 0x1c], 1
+jne short loc_00013b95  ; jne 0x13b95
+mov eax, 0x5000000
+test dl, dl
+jne short loc_00013ba6  ; jne 0x13ba6
+
+loc_00013b95:
+cmp dword [ebp - 0x1c], 2
+mov eax, 0x1000000
+mov ecx, 0x5000000
+cmove eax, ecx
+
+loc_00013ba6:
+push ecx
+push ecx
+push eax
+lea eax, [ebx + 0x8188]
+push eax
+mov dword [ebp - 0x28], edx
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+cmp dword [ebp - 0x1c], 2
+jne short loc_00013c36  ; jne 0x13c36
+mov edx, dword [ebp - 0x28]
+test dl, dl
+je short loc_00013c36  ; je 0x13c36
+cmp byte [ebp - 0x24], 7
+jbe short loc_00013c36  ; jbe 0x13c36
+push edx
+push 2
+push 0xfffffffffffffff9
+lea eax, [ebx + 0x8098]
+push eax
+call fcn_00018b68  ; call 0x18b68
+mov ecx, dword [ebp - 0x20]
+add esp, 0xc
+mov edx, 0x1737d
+mov eax, 0x3737d
+cmp byte [ecx + 0x28], 1
+cmove eax, edx
+push eax
+push 0xfffd8000
+lea eax, [ebx + 0x8198]
+add ebx, 0x819c
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], 0xfffffff0
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018b3e  ; jmp 0x18b3e
+
+loc_00013c27:
+mov eax, 0x200000
+mov edi, 0x2000
+jmp near loc_00013abb  ; jmp 0x13abb
+
+loc_00013c36:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00013c3e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+call fcn_0001bfbb  ; call 0x1bfbb
+mov esi, eax
+call fcn_0001c0bd  ; call 0x1c0bd
+mov edi, eax
+call fcn_0001bbfd  ; call 0x1bbfd
+mov eax, dword [ebp + 8]
+push ebx
+push 0
+push 0x14
+movzx eax, byte [eax + 1]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+push 0xc0
+push 0xffffffffffffffff
+push 0xe5004001
+push dword [ebp + 0xc]
+mov ebx, eax
+call fcn_00009dc2  ; call 0x9dc2
+add esp, 0x14
+lea edx, [ebx + 0x40]
+push edx
+mov dword [ebp - 0x20], edx
+call fcn_00017e4e  ; call 0x17e4e
+pop edx
+mov edx, dword [ebp - 0x20]
+mov ecx, eax
+movzx eax, ax
+and ecx, 0xff7fffff
+or ah, 1
+mov dword [ebp - 0x1c], ecx
+pop ecx
+push eax
+push edx
+call fcn_00017e04  ; call 0x17e04
+pop eax
+mov eax, dword [ebp - 0x1c]
+pop edx
+or eax, 0x360100
+shr eax, 0x10
+movzx eax, al
+push eax
+lea eax, [ebx + 0x42]
+push eax
+call fcn_00017da5  ; call 0x17da5
+pop ecx
+pop eax
+lea eax, [ebx + 0x44]
+push 0x288
+push eax
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+cmp esi, 1
+je short loc_00013cfc  ; je 0x13cfc
+mov eax, 0xc0
+cmp esi, 2
+jne short loc_00013d01  ; jne 0x13d01
+mov eax, 0x40040
+cmp edi, 2
+mov edx, 0x40000
+cmovne eax, edx
+jmp short loc_00013d01  ; jmp 0x13d01
+
+loc_00013cfc:
+mov eax, 0x40
+
+loc_00013d01:
+push ecx
+push ecx
+push eax
+lea eax, [ebx + 0xa0]
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+cmp edi, 2
+jne short loc_00013d22  ; jne 0x13d22
+mov eax, 0x1800
+cmp esi, 2
+je short loc_00013d24  ; je 0x13d24
+
+loc_00013d22:
+xor eax, eax
+
+loc_00013d24:
+push edx
+add ebx, 0xa4
+push eax
+push 0xffffdfff
+push ebx
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00013d42:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov edx, dword [ebp + 0xc]
+mov esi, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0x18]
+mov dword [ebp - 0x1c], edx
+call fcn_0001bfbb  ; call 0x1bfbb
+mov edi, eax
+call fcn_0001c0bd  ; call 0x1c0bd
+mov edx, dword [ebp - 0x1c]
+cmp eax, 1
+sete cl
+cmp edi, 1
+jne near loc_00013e6d  ; jne 0x13e6d
+test cl, cl
+je near loc_00013e6d  ; je 0x13e6d
+mov eax, dword [ebp + 8]
+sub esp, 0xc
+lea edi, [eax + 0xe0]
+push edi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov edx, dword [ebp - 0x1c]
+and eax, 6
+cmp eax, 4
+je short loc_00013dbd  ; je 0x13dbd
+cmp eax, 6
+je short loc_00013db2  ; je 0x13db2
+cmp eax, 2
+jne short loc_00013dc8  ; jne 0x13dc8
+mov byte [edx], 0xc
+mov dword [ebx], 0x3f3f
+jmp short loc_00013dd1  ; jmp 0x13dd1
+
+loc_00013db2:
+mov byte [edx], 8
+mov dword [ebx], 0xf0f
+jmp short loc_00013dd1  ; jmp 0x13dd1
+
+loc_00013dbd:
+mov byte [edx], 0xa
+mov dword [ebx], 0xf3f
+jmp short loc_00013dd1  ; jmp 0x13dd1
+
+loc_00013dc8:
+mov byte [edx], 0xe
+mov dword [ebx], 0x3fff
+
+loc_00013dd1:
+or dword [ebx], 0xf0
+sub esp, 0xc
+push edi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+and eax, 0x18
+cmp eax, 0x10
+je short loc_00013e17  ; je 0x13e17
+cmp eax, 0x18
+je short loc_00013e06  ; je 0x13e06
+cmp eax, 8
+jne short loc_00013e28  ; jne 0x13e28
+mov eax, dword [ebp + 0x14]
+mov byte [eax], 4
+mov eax, dword [ebp + 0x1c]
+mov dword [eax], 0xf
+jmp short loc_00013e37  ; jmp 0x13e37
+
+loc_00013e06:
+mov eax, dword [ebp + 0x14]
+mov byte [eax], 0
+mov eax, dword [ebp + 0x1c]
+mov dword [eax], 0
+jmp short loc_00013e37  ; jmp 0x13e37
+
+loc_00013e17:
+mov eax, dword [ebp + 0x14]
+mov byte [eax], 2
+mov eax, dword [ebp + 0x1c]
+mov dword [eax], 3
+jmp short loc_00013e37  ; jmp 0x13e37
+
+loc_00013e28:
+mov eax, dword [ebp + 0x14]
+mov byte [eax], 6
+mov eax, dword [ebp + 0x1c]
+mov dword [eax], 0x3f
+
+loc_00013e37:
+sub esp, 0xc
+push edi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+and eax, 0x20
+je short loc_00013e5f  ; je 0x13e5f
+cmp eax, 0x20
+jne near loc_00013f35  ; jne 0x13f35
+mov byte [esi], 0
+and dword [ebx], 0xffffbfff
+jmp near loc_00013f35  ; jmp 0x13f35
+
+loc_00013e5f:
+mov byte [esi], 1
+or dword [ebx], 0x4000
+jmp near loc_00013f35  ; jmp 0x13f35
+
+loc_00013e6d:
+cmp edi, 2
+jne short loc_00013ec7  ; jne 0x13ec7
+test cl, cl
+je short loc_00013ec7  ; je 0x13ec7
+mov eax, dword [ebp + 0x14]
+sub esp, 0xc
+mov byte [edx], 8
+mov dword [ebx], 0xff
+mov byte [eax], 4
+mov eax, dword [ebp + 0x1c]
+mov dword [eax], 0xf
+mov eax, dword [ebp + 8]
+lea edi, [eax + 0xe0]
+push edi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+and eax, 0x20
+je short loc_00013ebc  ; je 0x13ebc
+cmp eax, 0x20
+jne near loc_00013f35  ; jne 0x13f35
+mov byte [esi], 0
+and dword [ebx], 0xfffffeff
+jmp short loc_00013f35  ; jmp 0x13f35
+
+loc_00013ebc:
+mov byte [esi], 1
+or dword [ebx], 0x100
+jmp short loc_00013f35  ; jmp 0x13f35
+
+loc_00013ec7:
+cmp eax, 2
+jne short loc_00013f35  ; jne 0x13f35
+mov eax, dword [ebp + 8]
+sub esp, 0xc
+mov dword [ebp - 0x1c], edx
+lea edi, [eax + 0xe0]
+push edi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov edx, dword [ebp - 0x1c]
+test al, 2
+je short loc_00013ef9  ; je 0x13ef9
+mov byte [edx], 8
+mov dword [ebx], 0xff
+mov byte [esi], 0
+jmp short loc_00013f26  ; jmp 0x13f26
+
+loc_00013ef9:
+sub esp, 0xc
+mov byte [edx], 0xa
+mov dword [ebx], 0xff
+push edi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test al, 0x20
+jne short loc_00013f1d  ; jne 0x13f1d
+mov byte [esi], 1
+or dword [ebx], 0x400
+jmp short loc_00013f26  ; jmp 0x13f26
+
+loc_00013f1d:
+mov byte [esi], 0
+and dword [ebx], 0xfffffbff
+
+loc_00013f26:
+mov eax, dword [ebp + 0x14]
+mov byte [eax], 4
+mov eax, dword [ebp + 0x1c]
+mov dword [eax], 0xf
+
+loc_00013f35:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00013f3d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x3c
+call fcn_0001c0bd  ; call 0x1c0bd
+mov ebx, eax
+call fcn_0001bfbb  ; call 0x1bfbb
+cmp ebx, 1
+jne short loc_00013f76  ; jne 0x13f76
+cmp eax, 2
+je short loc_00013f92  ; je 0x13f92
+mov ecx, ref_000273cc  ; mov ecx, 0x273cc
+xor edx, edx
+mov edi, ecx
+dec eax
+mov eax, ref_00027408  ; mov eax, 0x27408
+cmovne edi, edx
+cmove edx, eax
+mov dword [ebp - 0x34], edx
+jmp short loc_00013f9e  ; jmp 0x13f9e
+
+loc_00013f76:
+mov edx, ref_00027380  ; mov edx, 0x27380
+xor eax, eax
+mov edi, edx
+cmp ebx, 2
+mov edx, ref_00027390  ; mov edx, 0x27390
+cmovne edi, eax
+cmove eax, edx
+mov dword [ebp - 0x34], eax
+jmp short loc_00013f9e  ; jmp 0x13f9e
+
+loc_00013f92:
+mov edi, ref_000273bc  ; mov edi, 0x273bc
+mov dword [ebp - 0x34], ref_000273e4  ; mov dword [ebp - 0x34], 0x273e4
+
+loc_00013f9e:
+test edi, edi
+je short loc_00013fa8  ; je 0x13fa8
+cmp dword [ebp - 0x34], 0
+jne short loc_00013fd2  ; jne 0x13fd2
+
+loc_00013fa8:
+call fcn_00015480  ; call 0x15480
+test al, al
+je near loc_0001489b  ; je 0x1489b
+push eax
+push ref_00022281  ; push 0x22281
+push 0x601
+push ref_0002531e  ; push 0x2531e
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+jmp near loc_0001489b  ; jmp 0x1489b
+
+loc_00013fd2:
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0x10], 0
+je near loc_0001489b  ; je 0x1489b
+push eax
+push eax
+lea eax, [ebp - 0x20]
+push eax
+lea eax, [ebp - 0x24]
+push eax
+lea eax, [ebp - 0x25]
+push eax
+lea eax, [ebp - 0x26]
+push eax
+lea eax, [ebp - 0x27]
+push eax
+push dword [ebp + 0x18]
+call fcn_00013d42  ; call 0x13d42
+mov eax, dword [ebp + 0xc]
+add esp, 0x14
+add eax, 0x10
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+mov ecx, dword [ebp + 0xc]
+shr eax, 0x10
+lea ebx, [ecx + eax*4]
+mov dword [esp], ebx
+call fcn_00017e4e  ; call 0x17e4e
+mov esi, eax
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_0001403f  ; je 0x1403f
+push eax
+push ebx
+push ref_0002534c  ; push 0x2534c
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+
+loc_0001403c:
+add esp, 0x10
+
+loc_0001403f:
+mov eax, esi
+cmp al, 0xa
+jne short loc_000140c3  ; jne 0x140c3
+sub esp, 0xc
+lea eax, [ebx + 0x20]
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test al, 1
+je near loc_000140df  ; je 0x140df
+sub esp, 0xc
+add ebx, 0x24
+push ebx
+call fcn_00017e4e  ; call 0x17e4e
+movzx edx, byte [ebp - 0x25]
+add esp, 0x10
+mov dword [ebp - 0x2c], 0
+shr eax, 0x18
+add eax, 0x47
+shl eax, 4
+
+loc_0001407f:
+cmp dword [ebp - 0x2c], edx
+jae short loc_000140b6  ; jae 0x140b6
+mov ecx, dword [ebp - 0x2c]
+cmp eax, dword [edi + ecx*4]
+jne short loc_000140b1  ; jne 0x140b1
+call fcn_00015479  ; call 0x15479
+mov byte [ebp - 0x2d], 1
+test al, al
+je short loc_000140ea  ; je 0x140ea
+push esi
+push dword [ebp - 0x2c]
+push ref_00025379  ; push 0x25379
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp short loc_000140ea  ; jmp 0x140ea
+
+loc_000140b1:
+inc dword [ebp - 0x2c]
+jmp short loc_0001407f  ; jmp 0x1407f
+
+loc_000140b6:
+mov dword [ebp - 0x2c], 0xffffffff
+mov byte [ebp - 0x2d], 1
+jmp short loc_000140ea  ; jmp 0x140ea
+
+loc_000140c3:
+mov eax, esi
+movzx esi, ah
+test esi, esi
+je short loc_000140df  ; je 0x140df
+lea ebx, [ebx + esi*4]
+sub esp, 0xc
+push ebx
+call fcn_00017e4e  ; call 0x17e4e
+mov esi, eax
+jmp near loc_0001403c  ; jmp 0x1403c
+
+loc_000140df:
+mov dword [ebp - 0x2c], 0xffffffff
+mov byte [ebp - 0x2d], 0
+
+loc_000140ea:
+mov eax, dword [ebp + 0x18]
+push ebx
+push dword [ebp - 0x24]
+add eax, 0xd4
+mov dword [ebp - 0x38], eax
+push 0xffff8000
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0xc
+mov eax, dword [ebp + 0x18]
+push dword [ebp - 0x20]
+add eax, 0xdc
+push 0xffffffffffffffc0
+push eax
+mov dword [ebp - 0x3c], eax
+call fcn_00018b68  ; call 0x18b68
+lea eax, [ebp - 0x1c]
+mov dword [esp], eax
+call fcn_00019797  ; call 0x19797
+add esp, 0x10
+cmp dword [ebp - 0x1c], 0x11
+je near loc_0001489b  ; je 0x1489b
+mov eax, dword [ebp + 0x1c]
+sub esp, 0xc
+add eax, 0xa2
+push eax
+mov dword [ebp - 0x40], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test al, 0x20
+je short loc_000141c8  ; je 0x141c8
+mov eax, dword [ebp + 0x1c]
+sub esp, 0xc
+add eax, 0xac
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test eax, 0x10000
+je short loc_000141c8  ; je 0x141c8
+sub esp, 0xc
+push dword [ebp - 0x3c]
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+and eax, 0x3f
+cmp byte [ebp - 0x2d], 0
+je short loc_0001418e  ; je 0x1418e
+mov cl, byte [ebp - 0x2c]
+mov edx, 1
+shl edx, cl
+or eax, edx
+
+loc_0001418e:
+push edx
+push eax
+mov eax, dword [ebp + 0x18]
+push 0xffffffffffffffc0
+add eax, 0xd8
+push eax
+call fcn_00018b68  ; call 0x18b68
+pop ecx
+push dword [ebp - 0x38]
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0xc
+and eax, 0x7fff
+push eax
+mov eax, dword [ebp + 0x18]
+push 0xffff8000
+add eax, 0xd0
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_000141c8:
+mov eax, dword [ebp + 8]
+cmp byte [eax + 0xb5], 0
+jne short loc_000141ec  ; jne 0x141ec
+push eax
+push eax
+mov eax, dword [ebp + 0x1c]
+push 0xfffeffff
+add eax, 0xac
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+
+loc_000141ec:
+mov eax, dword [ebp + 8]
+mov esi, 1
+mov al, byte [eax + 0x11]
+test al, al
+je near loc_000142d0  ; je 0x142d0
+xor esi, esi
+dec al
+jne near loc_000142d0  ; jne 0x142d0
+mov eax, dword [ebp + 8]
+mov al, byte [eax + 0x10]
+cmp al, 2
+sete cl
+dec al
+mov esi, ecx
+jne near loc_000142d0  ; jne 0x142d0
+sub esp, 0xc
+push dword [ebp - 0x40]
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test al, 0x20
+jne short loc_0001423a  ; jne 0x1423a
+
+loc_00014230:
+mov esi, 2
+jmp near loc_000142d0  ; jmp 0x142d0
+
+loc_0001423a:
+mov bl, byte [ebp - 0x2d]
+xor esi, esi
+and ebx, 1
+
+loc_00014242:
+movzx eax, byte [ebp - 0x25]
+cmp esi, eax
+jae short loc_0001426d  ; jae 0x1426d
+cmp esi, dword [ebp - 0x2c]
+jne short loc_00014253  ; jne 0x14253
+test bl, bl
+jne short loc_0001426a  ; jne 0x1426a
+
+loc_00014253:
+push eax
+mov eax, dword [ebp + 0xc]
+push 0x80000000
+push 0xfffffffffffffffd
+add eax, dword [edi + esi*4]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_0001426a:
+inc esi
+jmp short loc_00014242  ; jmp 0x14242
+
+loc_0001426d:
+mov al, byte [ebp - 0x2d]
+mov ebx, 0xa
+and eax, 1
+mov byte [ebp - 0x2e], al
+
+loc_0001427b:
+xor esi, esi
+xor edx, edx
+
+loc_0001427f:
+movzx eax, byte [ebp - 0x25]
+cmp edx, eax
+jae short loc_000142af  ; jae 0x142af
+cmp edx, dword [ebp - 0x2c]
+jne short loc_00014292  ; jne 0x14292
+cmp byte [ebp - 0x2e], 0
+jne short loc_000142ac  ; jne 0x142ac
+
+loc_00014292:
+mov eax, dword [ebp + 0xc]
+sub esp, 0xc
+add eax, dword [edi + edx*4]
+mov dword [ebp - 0x44], edx
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, dword [ebp - 0x44]
+add esp, 0x10
+or esi, eax
+
+loc_000142ac:
+inc edx
+jmp short loc_0001427f  ; jmp 0x1427f
+
+loc_000142af:
+sub esp, 0xc
+push 0x2710
+call fcn_0001bb03  ; call 0x1bb03
+add esp, 0x10
+and esi, 0x10
+je near loc_00014230  ; je 0x14230
+dec ebx
+jne short loc_0001427b  ; jne 0x1427b
+jmp near loc_00014230  ; jmp 0x14230
+
+loc_000142d0:
+cmp byte [ebp - 0x25], 0
+je near loc_00014506  ; je 0x14506
+mov eax, esi
+dec al
+jne near loc_00014506  ; jne 0x14506
+mov eax, dword [ebp + 0x18]
+sub esp, 0xc
+lea ebx, [eax + 0xd0]
+push ebx
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test eax, eax
+je short loc_00014301  ; je 0x14301
+
+loc_000142fd:
+xor esi, esi
+jmp short loc_0001434f  ; jmp 0x1434f
+
+loc_00014301:
+mov eax, dword [ebp + 0x18]
+sub esp, 0xc
+add eax, 0xd8
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test eax, eax
+jne short loc_000142fd  ; jne 0x142fd
+jmp near loc_00014506  ; jmp 0x14506
+
+loc_0001431e:
+mov ecx, dword [ebp - 0x34]
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+add eax, dword [ecx + esi*4]
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test al, 1
+je short loc_0001434e  ; je 0x1434e
+mov ecx, dword [ebp - 0x34]
+push eax
+mov eax, dword [ebp + 0xc]
+push 0x10
+push 0xfffffffffffffffd
+add eax, dword [ecx + esi*4]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_0001434e:
+inc esi
+
+loc_0001434f:
+movzx eax, byte [ebp - 0x27]
+cmp esi, eax
+jb short loc_0001431e  ; jb 0x1431e
+mov dword [ebp - 0x38], 0xa
+
+loc_0001435e:
+xor esi, esi
+xor edx, edx
+
+loc_00014362:
+movzx eax, byte [ebp - 0x27]
+cmp edx, eax
+jae short loc_0001438a  ; jae 0x1438a
+mov ecx, dword [ebp - 0x34]
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x3c], edx
+add eax, dword [ecx + edx*4]
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, dword [ebp - 0x3c]
+add esp, 0x10
+inc edx
+or esi, eax
+jmp short loc_00014362  ; jmp 0x14362
+
+loc_0001438a:
+sub esp, 0xc
+push 0x2710
+call fcn_0001bb03  ; call 0x1bb03
+add esp, 0x10
+and esi, 0x10
+je short loc_000143a4  ; je 0x143a4
+dec dword [ebp - 0x38]
+jne short loc_0001435e  ; jne 0x1435e
+
+loc_000143a4:
+push esi
+push esi
+push 0xffff8000
+push ebx
+xor ebx, ebx
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+
+loc_000143b6:
+movzx eax, byte [ebp - 0x27]
+cmp ebx, eax
+jae short loc_000143db  ; jae 0x143db
+push ecx
+mov ecx, dword [ebp - 0x34]
+push 0xfe0000
+mov eax, dword [ebp + 0xc]
+push 0xfffffffffffffffd
+add eax, dword [ecx + ebx*4]
+inc ebx
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+jmp short loc_000143b6  ; jmp 0x143b6
+
+loc_000143db:
+cmp byte [ebp - 0x26], 0
+je short loc_000143fb  ; je 0x143fb
+push edx
+mov edx, dword [ebp - 0x34]
+push 0xfe0000
+mov ecx, dword [ebp + 0xc]
+push 0xfffffffffffffffd
+add ecx, dword [edx + eax*4]
+push ecx
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_000143fb:
+mov bl, byte [ebp - 0x2d]
+xor esi, esi
+and ebx, 1
+
+loc_00014403:
+movzx eax, byte [ebp - 0x25]
+cmp esi, eax
+jae short loc_0001442e  ; jae 0x1442e
+cmp esi, dword [ebp - 0x2c]
+jne short loc_00014414  ; jne 0x14414
+test bl, bl
+jne short loc_0001442b  ; jne 0x1442b
+
+loc_00014414:
+push eax
+mov eax, dword [ebp + 0xc]
+push 0x80000000
+push 0xfffffffffffffffd
+add eax, dword [edi + esi*4]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_0001442b:
+inc esi
+jmp short loc_00014403  ; jmp 0x14403
+
+loc_0001442e:
+cmp byte [ebp - 0x2d], 0
+mov eax, 0xffffffc0
+je short loc_00014446  ; je 0x14446
+mov cl, byte [ebp - 0x2c]
+mov eax, 1
+shl eax, cl
+or eax, 0xffffffc0
+
+loc_00014446:
+push ebx
+push ebx
+mov ebx, 0xa
+push eax
+mov eax, dword [ebp + 0x18]
+add eax, 0xd8
+push eax
+call fcn_00018b3e  ; call 0x18b3e
+mov al, byte [ebp - 0x2d]
+add esp, 0x10
+and eax, 1
+mov byte [ebp - 0x38], al
+
+loc_00014468:
+xor esi, esi
+xor edx, edx
+
+loc_0001446c:
+movzx eax, byte [ebp - 0x25]
+cmp edx, eax
+jae short loc_0001449c  ; jae 0x1449c
+cmp edx, dword [ebp - 0x2c]
+jne short loc_0001447f  ; jne 0x1447f
+cmp byte [ebp - 0x38], 0
+jne short loc_00014499  ; jne 0x14499
+
+loc_0001447f:
+mov eax, dword [ebp + 0xc]
+sub esp, 0xc
+add eax, dword [edi + edx*4]
+mov dword [ebp - 0x3c], edx
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, dword [ebp - 0x3c]
+add esp, 0x10
+or esi, eax
+
+loc_00014499:
+inc edx
+jmp short loc_0001446c  ; jmp 0x1446c
+
+loc_0001449c:
+sub esp, 0xc
+push 0x2710
+call fcn_0001bb03  ; call 0x1bb03
+add esp, 0x10
+and esi, 0x10
+je short loc_000144b4  ; je 0x144b4
+dec ebx
+jne short loc_00014468  ; jne 0x14468
+
+loc_000144b4:
+mov bl, byte [ebp - 0x2d]
+xor esi, esi
+and ebx, 1
+
+loc_000144bc:
+movzx eax, byte [ebp - 0x25]
+cmp esi, eax
+jae short loc_000144e7  ; jae 0x144e7
+cmp esi, dword [ebp - 0x2c]
+jne short loc_000144cd  ; jne 0x144cd
+test bl, bl
+jne short loc_000144e4  ; jne 0x144e4
+
+loc_000144cd:
+push ecx
+mov eax, dword [ebp + 0xc]
+push 0xfe0000
+push 0xfffffffffffffffd
+add eax, dword [edi + esi*4]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_000144e4:
+inc esi
+jmp short loc_000144bc  ; jmp 0x144bc
+
+loc_000144e7:
+mov eax, dword [ebp + 0xc]
+push esi
+push esi
+push 1
+lea ebx, [eax + 0x80]
+push ebx
+call fcn_00018b14  ; call 0x18b14
+pop eax
+pop edx
+push 0xfffffffffffffffe
+push ebx
+call fcn_00018b3e  ; call 0x18b3e
+jmp short loc_00014570  ; jmp 0x14570
+
+loc_00014506:
+cmp byte [ebp - 0x25], 0
+je near loc_0001461f  ; je 0x1461f
+mov eax, esi
+cmp al, 2
+jne short loc_00014578  ; jne 0x14578
+sub esp, 0xc
+push dword [ebp - 0x3c]
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+and eax, 0x3f
+cmp byte [ebp - 0x2d], 0
+je short loc_00014539  ; je 0x14539
+mov cl, byte [ebp - 0x2c]
+mov edx, 1
+shl edx, cl
+or eax, edx
+
+loc_00014539:
+push edx
+push eax
+mov eax, dword [ebp + 0x18]
+push 0xffffffffffffffc0
+add eax, 0xd8
+push eax
+call fcn_00018b68  ; call 0x18b68
+pop ecx
+push dword [ebp - 0x38]
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0xc
+and eax, 0x7fff
+push eax
+mov eax, dword [ebp + 0x18]
+push 0xffff8000
+add eax, 0xd0
+push eax
+call fcn_00018b68  ; call 0x18b68
+
+loc_00014570:
+add esp, 0x10
+jmp near loc_0001461f  ; jmp 0x1461f
+
+loc_00014578:
+sub esp, 0xc
+push dword [ebp - 0x40]
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+test al, 0x20
+je near loc_0001461f  ; je 0x1461f
+mov bl, byte [ebp - 0x2d]
+xor esi, esi
+and ebx, 1
+
+loc_00014596:
+movzx eax, byte [ebp - 0x25]
+cmp esi, eax
+jae short loc_000145c1  ; jae 0x145c1
+cmp esi, dword [ebp - 0x2c]
+jne short loc_000145a7  ; jne 0x145a7
+test bl, bl
+jne short loc_000145be  ; jne 0x145be
+
+loc_000145a7:
+push eax
+mov eax, dword [ebp + 0xc]
+push 0x80000000
+push 0xfffffffffffffffd
+add eax, dword [edi + esi*4]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_000145be:
+inc esi
+jmp short loc_00014596  ; jmp 0x14596
+
+loc_000145c1:
+mov al, byte [ebp - 0x2d]
+mov dword [ebp - 0x38], 0
+and eax, 1
+mov byte [ebp - 0x3c], al
+
+loc_000145d1:
+cmp esi, dword [ebp - 0x2c]
+jne short loc_000145de  ; jne 0x145de
+xor ebx, ebx
+cmp byte [ebp - 0x3c], 0
+jne short loc_00014614  ; jne 0x14614
+
+loc_000145de:
+xor ebx, ebx
+xor esi, esi
+
+loc_000145e2:
+movzx eax, byte [ebp - 0x25]
+cmp esi, eax
+jae short loc_00014601  ; jae 0x14601
+mov eax, dword [ebp + 0xc]
+sub esp, 0xc
+add eax, dword [edi + esi*4]
+inc esi
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+or ebx, eax
+jmp short loc_000145e2  ; jmp 0x145e2
+
+loc_00014601:
+sub esp, 0xc
+push 0x2710
+call fcn_0001bb03  ; call 0x1bb03
+add esp, 0x10
+inc dword [ebp - 0x38]
+
+loc_00014614:
+and bl, 0x10
+je short loc_0001461f  ; je 0x1461f
+cmp dword [ebp - 0x38], 9
+jbe short loc_000145d1  ; jbe 0x145d1
+
+loc_0001461f:
+mov eax, dword [ebp + 8]
+xor ebx, ebx
+cmp byte [eax + 0x13], 1
+jne near loc_0001485c  ; jne 0x1485c
+
+loc_0001462e:
+movzx eax, byte [ebp - 0x27]
+cmp ebx, eax
+jae short loc_00014669  ; jae 0x14669
+mov ecx, dword [ebp - 0x34]
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+add eax, dword [ecx + ebx*4]
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test al, 1
+je short loc_00014666  ; je 0x14666
+push ecx
+mov ecx, dword [ebp - 0x34]
+push 0x10
+mov eax, dword [ebp + 0xc]
+push 0xfffffffffffffffd
+add eax, dword [ecx + ebx*4]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_00014666:
+inc ebx
+jmp short loc_0001462e  ; jmp 0x1462e
+
+loc_00014669:
+mov ebx, 0xa
+
+loc_0001466e:
+xor esi, esi
+xor edx, edx
+
+loc_00014672:
+movzx eax, byte [ebp - 0x27]
+cmp edx, eax
+jae short loc_0001469a  ; jae 0x1469a
+mov ecx, dword [ebp - 0x34]
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x38], edx
+add eax, dword [ecx + edx*4]
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, dword [ebp - 0x38]
+add esp, 0x10
+inc edx
+or esi, eax
+jmp short loc_00014672  ; jmp 0x14672
+
+loc_0001469a:
+sub esp, 0xc
+push 0x2710
+call fcn_0001bb03  ; call 0x1bb03
+add esp, 0x10
+and esi, 0x10
+je short loc_000146b2  ; je 0x146b2
+dec ebx
+jne short loc_0001466e  ; jne 0x1466e
+
+loc_000146b2:
+movzx edx, byte [ebp - 0x27]
+xor eax, eax
+xor ecx, ecx
+mov ebx, 1
+
+loc_000146bf:
+cmp ecx, edx
+jae short loc_000146d6  ; jae 0x146d6
+mov esi, dword [ebp + 8]
+cmp byte [esi + ecx + 0x14], 1
+jne short loc_000146d3  ; jne 0x146d3
+mov esi, ebx
+shl esi, cl
+or eax, esi
+
+loc_000146d3:
+inc ecx
+jmp short loc_000146bf  ; jmp 0x146bf
+
+loc_000146d6:
+push edx
+xor ebx, ebx
+push eax
+mov eax, dword [ebp + 0x18]
+push 0xffff8000
+add eax, 0xd0
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_000146f0:
+movzx eax, byte [ebp - 0x27]
+cmp ebx, eax
+jae short loc_00014715  ; jae 0x14715
+mov ecx, dword [ebp - 0x34]
+push esi
+mov eax, dword [ebp + 0xc]
+push 0xfe0000
+push 0xfffffffffffffffd
+add eax, dword [ecx + ebx*4]
+inc ebx
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+jmp short loc_000146f0  ; jmp 0x146f0
+
+loc_00014715:
+cmp byte [ebp - 0x26], 0
+je short loc_00014735  ; je 0x14735
+mov edx, dword [ebp - 0x34]
+push ebx
+mov ecx, dword [ebp + 0xc]
+push 0xfe0000
+push 0xfffffffffffffffd
+add ecx, dword [edx + eax*4]
+push ecx
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_00014735:
+mov bl, byte [ebp - 0x2d]
+xor esi, esi
+and ebx, 1
+
+loc_0001473d:
+movzx edx, byte [ebp - 0x25]
+cmp esi, edx
+jae short loc_00014768  ; jae 0x14768
+cmp esi, dword [ebp - 0x2c]
+jne short loc_0001474e  ; jne 0x1474e
+test bl, bl
+jne short loc_00014765  ; jne 0x14765
+
+loc_0001474e:
+push ecx
+mov eax, dword [ebp + 0xc]
+push 0x80000000
+push 0xfffffffffffffffd
+add eax, dword [edi + esi*4]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_00014765:
+inc esi
+jmp short loc_0001473d  ; jmp 0x1473d
+
+loc_00014768:
+xor eax, eax
+xor ecx, ecx
+mov ebx, 1
+
+loc_00014771:
+cmp ecx, edx
+je short loc_00014788  ; je 0x14788
+mov esi, dword [ebp + 8]
+cmp byte [esi + ecx + 0x22], 1
+jne short loc_00014785  ; jne 0x14785
+mov esi, ebx
+shl esi, cl
+or eax, esi
+
+loc_00014785:
+inc ecx
+jmp short loc_00014771  ; jmp 0x14771
+
+loc_00014788:
+cmp byte [ebp - 0x2d], 0
+je short loc_0001479a  ; je 0x1479a
+mov cl, byte [ebp - 0x2c]
+mov edx, 1
+shl edx, cl
+or eax, edx
+
+loc_0001479a:
+push edx
+mov ebx, 0xa
+push eax
+mov eax, dword [ebp + 0x18]
+push 0xffffffffffffffc0
+add eax, 0xd8
+push eax
+call fcn_00018b68  ; call 0x18b68
+mov al, byte [ebp - 0x2d]
+add esp, 0x10
+and eax, 1
+mov byte [ebp - 0x38], al
+
+loc_000147bd:
+xor esi, esi
+xor edx, edx
+
+loc_000147c1:
+movzx eax, byte [ebp - 0x25]
+cmp edx, eax
+jae short loc_000147f1  ; jae 0x147f1
+cmp edx, dword [ebp - 0x2c]
+jne short loc_000147d4  ; jne 0x147d4
+cmp byte [ebp - 0x38], 0
+jne short loc_000147ee  ; jne 0x147ee
+
+loc_000147d4:
+mov eax, dword [ebp + 0xc]
+sub esp, 0xc
+add eax, dword [edi + edx*4]
+mov dword [ebp - 0x3c], edx
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, dword [ebp - 0x3c]
+add esp, 0x10
+or esi, eax
+
+loc_000147ee:
+inc edx
+jmp short loc_000147c1  ; jmp 0x147c1
+
+loc_000147f1:
+sub esp, 0xc
+push 0x2710
+call fcn_0001bb03  ; call 0x1bb03
+add esp, 0x10
+and esi, 0x10
+je short loc_00014809  ; je 0x14809
+dec ebx
+jne short loc_000147bd  ; jne 0x147bd
+
+loc_00014809:
+mov bl, byte [ebp - 0x2d]
+xor esi, esi
+and ebx, 1
+
+loc_00014811:
+movzx eax, byte [ebp - 0x25]
+cmp esi, eax
+jae short loc_0001483c  ; jae 0x1483c
+cmp esi, dword [ebp - 0x2c]
+jne short loc_00014822  ; jne 0x14822
+test bl, bl
+jne short loc_00014839  ; jne 0x14839
+
+loc_00014822:
+push eax
+mov eax, dword [ebp + 0xc]
+push 0xfe0000
+push 0xfffffffffffffffd
+add eax, dword [edi + esi*4]
+push eax
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+
+loc_00014839:
+inc esi
+jmp short loc_00014811  ; jmp 0x14811
+
+loc_0001483c:
+mov eax, dword [ebp + 0xc]
+lea ebx, [eax + 0x80]
+push eax
+push eax
+push 1
+push ebx
+call fcn_00018b14  ; call 0x18b14
+pop edx
+pop ecx
+push 0xfffffffffffffffe
+push ebx
+call fcn_00018b3e  ; call 0x18b3e
+add esp, 0x10
+
+loc_0001485c:
+mov eax, dword [ebp + 8]
+test byte [eax + 0x10], 0xfd
+je short loc_0001489b  ; je 0x1489b
+cmp byte [eax + 0x11], 0
+je short loc_0001489b  ; je 0x1489b
+cmp byte [eax + 0xb5], 0
+je short loc_0001489b  ; je 0x1489b
+movzx eax, byte [ebp - 0x25]
+push eax
+movzx eax, byte [ebp - 0x27]
+push edi
+push eax
+mov eax, dword [ebp + 0x18]
+push dword [ebp - 0x34]
+push dword [ebp + 0xc]
+shr eax, 0x14
+movzx eax, al
+push 0
+push 0x14
+push eax
+call fcn_0001354a  ; call 0x1354a
+add esp, 0x20
+
+loc_0001489b:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000148a3:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x44
+push 0x10
+lea eax, [ebp - 0x38]
+push eax
+call fcn_00016fff  ; call 0x16fff
+pop eax
+pop edx
+lea eax, [ebp - 0x28]
+push 0x10
+push eax
+call fcn_00016fff  ; call 0x16fff
+call fcn_0001bfbb  ; call 0x1bfbb
+mov dword [ebp - 0x40], eax
+call fcn_0001c0bd  ; call 0x1c0bd
+mov edx, dword [ebp + 8]
+add esp, 0x10
+cmp byte [edx + 0x10], 0
+je near loc_00014b50  ; je 0x14b50
+cmp eax, 1
+jne near loc_00014a1b  ; jne 0x14a1b
+mov dword [ebp - 0x3c], 0
+xor edi, edi
+xor ebx, ebx
+
+loc_000148f5:
+call fcn_0001c261  ; call 0x1c261
+movzx eax, al
+cmp ebx, eax
+jae short loc_0001497a  ; jae 0x1497a
+mov eax, dword [ebp + 8]
+movzx ecx, byte [eax + ebx*8 + 0x2d]
+cmp cl, 8
+je short loc_00014974  ; je 0x14974
+cmp ebx, 7
+ja short loc_0001493c  ; ja 0x1493c
+cmp cl, 3
+jbe short loc_0001492e  ; jbe 0x1492e
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00014974  ; je 0x14974
+push eax
+push ref_00022281  ; push 0x22281
+push 0x9c4
+jmp short loc_00014957  ; jmp 0x14957
+
+loc_0001492e:
+lea ecx, [ebx + ecx*8]
+mov eax, 1
+shl eax, cl
+or edi, eax
+jmp short loc_00014974  ; jmp 0x14974
+
+loc_0001493c:
+lea eax, [ecx - 4]
+cmp al, 3
+jbe short loc_00014966  ; jbe 0x14966
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00014974  ; je 0x14974
+push eax
+push ref_00022281  ; push 0x22281
+push 0x9d0
+
+loc_00014957:
+push ref_0002531e  ; push 0x2531e
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+jmp short loc_00014974  ; jmp 0x14974
+
+loc_00014966:
+lea ecx, [ebx + ecx*8 - 0x28]
+mov eax, 1
+shl eax, cl
+or dword [ebp - 0x3c], eax
+
+loc_00014974:
+inc ebx
+jmp near loc_000148f5  ; jmp 0x148f5
+
+loc_0001497a:
+xor ebx, ebx
+xor esi, esi
+xor edx, edx
+
+loc_00014980:
+mov dword [ebp - 0x44], edx
+call fcn_0001c2f8  ; call 0x1c2f8
+mov edx, dword [ebp - 0x44]
+movzx eax, al
+cmp edx, eax
+jae short loc_000149c3  ; jae 0x149c3
+mov eax, dword [ebp + 8]
+movzx eax, byte [eax + edx*4 + 0x9d]
+cmp al, 8
+je short loc_000149c0  ; je 0x149c0
+cmp al, 3
+ja short loc_000149b3  ; ja 0x149b3
+lea ecx, [edx + eax*8]
+mov eax, 1
+shl eax, cl
+or esi, eax
+jmp short loc_000149c0  ; jmp 0x149c0
+
+loc_000149b3:
+lea ecx, [edx + eax*8 - 0x20]
+mov eax, 1
+shl eax, cl
+or ebx, eax
+
+loc_000149c0:
+inc edx
+jmp short loc_00014980  ; jmp 0x14980
+
+loc_000149c3:
+mov eax, dword [ebp + 0xc]
+push ecx
+push ecx
+push edi
+add eax, 0xc0
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop edi
+pop eax
+mov eax, dword [ebp + 0xc]
+push esi
+add eax, 0xc8
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+cmp dword [ebp - 0x40], 1
+jne near loc_00014b50  ; jne 0x14b50
+push eax
+push eax
+mov eax, dword [ebp + 0xc]
+push dword [ebp - 0x3c]
+add eax, 0xc4
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+pop eax
+mov eax, dword [ebp + 0xc]
+pop edx
+add eax, 0xcc
+push ebx
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+jmp near loc_00014b4d  ; jmp 0x14b4d
+
+loc_00014a1b:
+xor ebx, ebx
+cmp eax, 2
+jne near loc_00014b2f  ; jne 0x14b2f
+
+loc_00014a26:
+call fcn_0001c2f8  ; call 0x1c2f8
+movzx eax, al
+cmp ebx, eax
+jae short loc_00014a79  ; jae 0x14a79
+mov eax, dword [ebp + 8]
+mov al, byte [eax + ebx*4 + 0x9d]
+cmp al, 8
+je short loc_00014a76  ; je 0x14a76
+movzx esi, al
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00014a69  ; je 0x14a69
+cmp esi, 3
+jbe short loc_00014a69  ; jbe 0x14a69
+push eax
+push ref_0002539d  ; push 0x2539d
+push 0x9fd
+push ref_0002531e  ; push 0x2531e
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00014a69:
+mov eax, 1
+mov cl, bl
+shl eax, cl
+or dword [ebp + esi*4 - 0x28], eax
+
+loc_00014a76:
+inc ebx
+jmp short loc_00014a26  ; jmp 0x14a26
+
+loc_00014a79:
+mov edx, dword [ebp + 0xc]
+mov eax, dword [ebp + 0xc]
+lea edi, [edx + 0xd0]
+mov dword [ebp - 0x3c], edi
+mov edi, edx
+add eax, 0xc0
+neg edi
+mov esi, eax
+mov dword [ebp - 0x40], eax
+lea ebx, [ebp + edi - 0x28]
+
+loc_00014a9a:
+push eax
+push eax
+push dword [ebx + esi - 0xc0]
+push esi
+add esi, 4
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+cmp esi, dword [ebp - 0x3c]
+jne short loc_00014a9a  ; jne 0x14a9a
+xor ebx, ebx
+
+loc_00014ab6:
+call fcn_0001c2c1  ; call 0x1c2c1
+movzx eax, al
+cmp ebx, eax
+jae short loc_00014b06  ; jae 0x14b06
+mov eax, dword [ebp + 8]
+mov al, byte [eax + ebx*8 + 0x2d]
+cmp al, 8
+je short loc_00014b03  ; je 0x14b03
+movzx esi, al
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00014af6  ; je 0x14af6
+cmp esi, 3
+jbe short loc_00014af6  ; jbe 0x14af6
+push ecx
+push ref_0002539d  ; push 0x2539d
+push 0xa0d
+push ref_0002531e  ; push 0x2531e
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00014af6:
+mov eax, 1
+mov cl, bl
+shl eax, cl
+or dword [ebp + esi*4 - 0x38], eax
+
+loc_00014b03:
+inc ebx
+jmp short loc_00014ab6  ; jmp 0x14ab6
+
+loc_00014b06:
+mov eax, dword [ebp + 0xc]
+lea esi, [ebp + edi - 0x38]
+lea ebx, [eax + 0xb0]
+
+loc_00014b13:
+push edx
+push edx
+push dword [esi + ebx - 0xb0]
+push ebx
+add ebx, 4
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+cmp ebx, dword [ebp - 0x40]
+jne short loc_00014b13  ; jne 0x14b13
+jmp short loc_00014b50  ; jmp 0x14b50
+
+loc_00014b2f:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00014b50  ; je 0x14b50
+push eax
+push ref_00022281  ; push 0x22281
+push 0xa16
+push ref_0002531e  ; push 0x2531e
+call fcn_0001548c  ; call 0x1548c
+
+loc_00014b4d:
+add esp, 0x10
+
+loc_00014b50:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00014b58:
+push ebp
+mov ebp, esp
+push edi
+xor edi, edi
+push esi
+push ebx
+xor ebx, ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0xc]
+mov esi, dword [ebp + 8]
+mov dword [ebp - 0x24], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp - 0x28], eax
+call fcn_0001bfbb  ; call 0x1bfbb
+mov dword [ebp - 0x20], 0
+mov dword [ebp - 0x1c], eax
+
+loc_00014b83:
+call fcn_0001c298  ; call 0x1c298
+movzx eax, al
+cmp ebx, eax
+jae short loc_00014c09  ; jae 0x14c09
+movzx ecx, byte [esi + ebx*8 + 0x2d]
+cmp cl, 8
+je short loc_00014c03  ; je 0x14c03
+cmp ebx, 7
+ja short loc_00014bc7  ; ja 0x14bc7
+cmp cl, 3
+jbe short loc_00014bb9  ; jbe 0x14bb9
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00014c03  ; je 0x14c03
+push ecx
+push ref_00022281  ; push 0x22281
+push 0xa69
+jmp short loc_00014be8  ; jmp 0x14be8
+
+loc_00014bb9:
+lea ecx, [ebx + ecx*8]
+mov eax, 1
+shl eax, cl
+or edi, eax
+jmp short loc_00014c03  ; jmp 0x14c03
+
+loc_00014bc7:
+cmp dword [ebp - 0x1c], 1
+jne short loc_00014c03  ; jne 0x14c03
+lea eax, [ecx - 4]
+cmp al, 3
+jbe short loc_00014bf7  ; jbe 0x14bf7
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00014c03  ; je 0x14c03
+push edx
+push ref_00022281  ; push 0x22281
+push 0xa76
+
+loc_00014be8:
+push ref_0002531e  ; push 0x2531e
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+jmp short loc_00014c03  ; jmp 0x14c03
+
+loc_00014bf7:
+mov eax, dword [ebp - 0x1c]
+lea ecx, [ebx + ecx*8 - 0x28]
+shl eax, cl
+or dword [ebp - 0x20], eax
+
+loc_00014c03:
+inc ebx
+jmp near loc_00014b83  ; jmp 0x14b83
+
+loc_00014c09:
+cmp byte [esi], 1
+jne short loc_00014c20  ; jne 0x14c20
+push eax
+push eax
+mov eax, dword [ebp - 0x24]
+push edi
+add eax, 0x74
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+
+loc_00014c20:
+cmp dword [ebp - 0x1c], 1
+jne short loc_00014c47  ; jne 0x14c47
+cmp byte [esi + 8], 1
+jne short loc_00014c47  ; jne 0x14c47
+mov eax, dword [ebp - 0x20]
+mov dword [ebp + 0xc], eax
+mov eax, dword [ebp - 0x28]
+add eax, 0x74
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f  ; jmp 0x17e8f
+
+loc_00014c47:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00014c4f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+xor ebx, ebx
+sub esp, 0x1c
+mov esi, dword [ebp + 8]
+call fcn_0001bfbb  ; call 0x1bfbb
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0xc]
+add eax, 0x64
+mov dword [ebp - 0x20], eax
+mov eax, dword [ebp + 0x10]
+lea edi, [eax + 0x64]
+
+loc_00014c74:
+call fcn_0001c298  ; call 0x1c298
+movzx eax, al
+cmp ebx, eax
+jae near loc_00014d11  ; jae 0x14d11
+cmp ebx, 7
+ja short loc_00014cc5  ; ja 0x14cc5
+cmp byte [esi], 1
+jne short loc_00014cc5  ; jne 0x14cc5
+cmp byte [esi + ebx*8 + 0x2c], 0
+jne short loc_00014cab  ; jne 0x14cab
+push eax
+mov cl, bl
+push eax
+mov eax, 1
+shl eax, cl
+push eax
+push dword [ebp - 0x20]
+call fcn_00018730  ; call 0x18730
+jmp short loc_00014cc2  ; jmp 0x14cc2
+
+loc_00014cab:
+push ecx
+mov eax, 0xfffffffe
+push ecx
+mov cl, bl
+rol eax, cl
+movzx eax, al
+push eax
+push dword [ebp - 0x20]
+call fcn_0001875d  ; call 0x1875d
+
+loc_00014cc2:
+add esp, 0x10
+
+loc_00014cc5:
+cmp dword [ebp - 0x1c], 1
+jne short loc_00014d0b  ; jne 0x14d0b
+cmp ebx, 0xd
+ja short loc_00014d0b  ; ja 0x14d0b
+cmp byte [esi + 8], 1
+jne short loc_00014d0b  ; jne 0x14d0b
+cmp byte [esi + ebx*8 + 0x2c], 0
+lea ecx, [ebx - 8]
+jne short loc_00014cf3  ; jne 0x14cf3
+mov eax, dword [ebp - 0x1c]
+push edx
+push edx
+shl eax, cl
+movzx ecx, al
+push ecx
+push edi
+call fcn_00018730  ; call 0x18730
+jmp short loc_00014d08  ; jmp 0x14d08
+
+loc_00014cf3:
+push eax
+push eax
+mov eax, dword [ebp - 0x1c]
+shl eax, cl
+mov ecx, eax
+not ecx
+movzx ecx, cl
+push ecx
+push edi
+call fcn_0001875d  ; call 0x1875d
+
+loc_00014d08:
+add esp, 0x10
+
+loc_00014d0b:
+inc ebx
+jmp near loc_00014c74  ; jmp 0x14c74
+
+loc_00014d11:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00014d19:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+call fcn_0001bfbb  ; call 0x1bfbb
+cmp byte [esi + 0x10], 0
+mov dword [ebp - 0x1c], eax
+je near loc_00014e0a  ; je 0x14e0a
+lea eax, [edi + 0xe4]
+sub esp, 0xc
+push eax
+mov dword [ebp - 0x20], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+xor edx, edx
+mov ebx, eax
+and ebx, 0x7fff
+
+loc_00014d59:
+mov dword [ebp - 0x24], edx
+call fcn_0001c261  ; call 0x1c261
+mov edx, dword [ebp - 0x24]
+movzx eax, al
+cmp edx, eax
+jae short loc_00014d98  ; jae 0x14d98
+cmp dword [ebp - 0x1c], 1
+mov ecx, edx
+jne short loc_00014d7a  ; jne 0x14d7a
+mov ecx, dword [edx*4 + ref_000204b0]  ; mov ecx, dword [edx*4 + 0x204b0]
+
+loc_00014d7a:
+cmp byte [esi + edx*8 + 0x2c], 0
+jne short loc_00014d8c  ; jne 0x14d8c
+mov eax, 1
+shl eax, cl
+or ebx, eax
+jmp short loc_00014d95  ; jmp 0x14d95
+
+loc_00014d8c:
+mov eax, 0xfffffffe
+rol eax, cl
+and ebx, eax
+
+loc_00014d95:
+inc edx
+jmp short loc_00014d59  ; jmp 0x14d59
+
+loc_00014d98:
+lea eax, [edi + 0xe8]
+sub esp, 0xc
+push eax
+mov dword [ebp - 0x1c], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+xor ecx, ecx
+mov edi, eax
+and edi, 0x3f
+
+loc_00014db4:
+mov dword [ebp - 0x24], ecx
+call fcn_0001c2f8  ; call 0x1c2f8
+mov ecx, dword [ebp - 0x24]
+movzx eax, al
+cmp ecx, eax
+jae short loc_00014de7  ; jae 0x14de7
+cmp byte [esi + ecx*4 + 0x9c], 0
+je short loc_00014ddb  ; je 0x14ddb
+mov eax, 0xfffffffe
+rol eax, cl
+and edi, eax
+jmp short loc_00014de4  ; jmp 0x14de4
+
+loc_00014ddb:
+mov eax, 1
+shl eax, cl
+or edi, eax
+
+loc_00014de4:
+inc ecx
+jmp short loc_00014db4  ; jmp 0x14db4
+
+loc_00014de7:
+push eax
+push eax
+push ebx
+push dword [ebp - 0x20]
+call fcn_00017e8f  ; call 0x17e8f
+mov eax, dword [ebp - 0x1c]
+add esp, 0x10
+mov dword [ebp + 0xc], edi
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f  ; jmp 0x17e8f
+
+loc_00014e0a:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00014e12:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+mov eax, dword [ebp + 8]
+push 0x100
+add eax, 0x7a
+push eax
+call fcn_00018927  ; call 0x18927
+add esp, 0x10
+leave
+ret
+
+fcn_00014e2e:
+push ebp
+mov ebp, esp
+push ebx
+push ecx
+mov edx, dword [ebp + 8]
+mov eax, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+cmp byte [edx + 0x10], 0
+je short loc_00014e67  ; je 0x14e67
+push edx
+push edx
+push eax
+lea eax, [ebx + 0x10]
+add ebx, 4
+push eax
+call fcn_00017e8f  ; call 0x17e8f
+add esp, 0x10
+mov dword [ebp + 8], ebx
+mov ebx, dword [ebp - 4]
+mov dword [ebp + 0xc], 6
+leave
+jmp near fcn_00018927  ; jmp 0x18927
+
+loc_00014e67:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00014e6c:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov eax, dword [ebp + 8]
+mov ebx, dword [ebp + 0x10]
+cmp byte [eax + 0x10], 0
+je short loc_00014ea6  ; je 0x14ea6
+push eax
+push eax
+push 0xfff9
+lea eax, [ebx + 4]
+add ebx, 0x10
+push eax
+call fcn_00018954  ; call 0x18954
+add esp, 0x10
+mov dword [ebp + 8], ebx
+mov ebx, dword [ebp - 4]
+mov dword [ebp + 0xc], 0
+leave
+jmp near fcn_00017e8f  ; jmp 0x17e8f
+
+loc_00014ea6:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00014eab:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov esi, dword [ebp + 0x10]
+mov edi, dword [ebp + 8]
+call fcn_0001bfbb  ; call 0x1bfbb
+mov dword [ebp - 0x24], eax
+call fcn_0001bbfd  ; call 0x1bbfd
+mov ebx, eax
+call fcn_0001c0bd  ; call 0x1c0bd
+cmp ebx, 0x40
+seta byte [ebp - 0x19]
+cmp eax, 2
+sete al
+and byte [ebp - 0x19], al
+cmp byte [ebp - 0x19], 1
+sbb eax, eax
+xor ebx, ebx
+and eax, 0x100
+add eax, 0x4381
+push eax
+push 0
+push 0xe5007f04
+push esi
+call fcn_00009dc2  ; call 0x9dc2
+add esp, 0x10
+
+loc_00014f01:
+call fcn_0001c261  ; call 0x1c261
+movzx eax, al
+cmp ebx, eax
+jae near loc_00014fc1  ; jae 0x14fc1
+inc ebx
+mov eax, ebx
+push 0
+shl eax, 8
+push 0xfffffffffffffffe
+mov dword [ebp - 0x28], eax
+sub eax, 0x1affbff1
+push eax
+push esi
+call fcn_00009dc2  ; call 0x9dc2
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00014f55  ; je 0x14f55
+cmp byte [edi + ebx*8 + 0x27], 7
+jbe short loc_00014f55  ; jbe 0x14f55
+push edx
+push ref_000253a7  ; push 0x253a7
+push 0xc0b
+push ref_0002531e  ; push 0x2531e
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00014f55:
+mov al, byte [edi + ebx*8 + 0x27]
+and eax, 7
+mov dword [ebp - 0x20], eax
+shl dword [ebp - 0x20], 0xb
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00014f8b  ; je 0x14f8b
+cmp byte [edi + ebx*8 + 0x26], 7
+jbe short loc_00014f8b  ; jbe 0x14f8b
+push eax
+push ref_000253e3  ; push 0x253e3
+push 0xc0d
+push ref_0002531e  ; push 0x2531e
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00014f8b:
+mov al, byte [edi + ebx*8 + 0x26]
+and eax, 7
+shl eax, 8
+or eax, dword [ebp - 0x20]
+mov edx, eax
+or edx, 0x30
+cmp byte [ebp - 0x19], 0
+cmovne eax, edx
+push eax
+mov eax, dword [ebp - 0x28]
+push 0xffff80ff
+sub eax, 0x1affc000
+push eax
+push esi
+call fcn_00009dc2  ; call 0x9dc2
+add esp, 0x10
+jmp near loc_00014f01  ; jmp 0x14f01
+
+loc_00014fc1:
+push 0x180000
+push 0xffffffffffffffff
+push 0xe5007f14
+push esi
+call fcn_00009dc2  ; call 0x9dc2
+add esp, 0x10
+cmp dword [ebp - 0x24], 2
+jne short loc_00014ff1  ; jne 0x14ff1
+push 0
+push 0xff3fffff
+push 0xe5007f02
+push esi
+call fcn_00009dc2  ; call 0x9dc2
+add esp, 0x10
+
+loc_00014ff1:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00014ff9:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov esi, dword [ebp + 8]
+mov ebx, dword [ebp + 0xc]
+call fcn_0001bfbb  ; call 0x1bfbb
+cmp eax, 2
+jne short loc_0001502e  ; jne 0x1502e
+cmp byte [esi + 0x284], 0
+jne short loc_0001502e  ; jne 0x1502e
+push ecx
+push ecx
+push 5
+lea eax, [ebx + 0x3a84]
+push eax
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+
+loc_0001502e:
+push 0xc0
+push 0xffffffffffffffff
+push 0xe5004001
+push ebx
+xor ebx, ebx
+call fcn_00009dc2  ; call 0x9dc2
+add esp, 0x10
+
+loc_00015045:
+call fcn_0001c245  ; call 0x1c245
+cmp bl, al
+jae short loc_000150a7  ; jae 0x150a7
+movzx edi, bl
+push eax
+movzx eax, byte [edi + edi + ref_000204f1]  ; movzx eax, byte [edi + edi + 0x204f1]
+push eax
+movzx eax, byte [edi + edi + ref_000204f0]  ; movzx eax, byte [edi + edi + 0x204f0]
+add edi, 0x50
+push eax
+movzx eax, byte [esi + 1]
+push eax
+call fcn_00016c9a  ; call 0x16c9a
+cmp byte [esi + edi*8 + 4], 1
+pop edx
+sbb edx, edx
+inc ebx
+not edx
+mov ecx, eax
+add edx, 0x27
+pop eax
+lea eax, [ecx + 0xdc]
+mov dword [ebp - 0x1c], ecx
+push edx
+push eax
+call fcn_00018b14  ; call 0x18b14
+mov ecx, dword [ebp - 0x1c]
+pop eax
+pop edx
+add ecx, 0x78
+push 3
+push ecx
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+jmp short loc_00015045  ; jmp 0x15045
+
+loc_000150a7:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000150af:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+push eax
+push eax
+push esi
+push ebx
+call fcn_00014ff9  ; call 0x14ff9
+add esp, 0x10
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], ebx
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00013c3e  ; jmp 0x13c3e
+
+fcn_000150d7:
+push ebp
+mov edx, 0x18
+mov ebp, esp
+push edi
+push esi
+mov esi, ref_000271d0  ; mov esi, 0x271d0
+push ebx
+mov ebx, 0x24
+sub esp, 0x1c
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 8]
+dec al
+mov eax, ref_000270b0  ; mov eax, 0x270b0
+cmovne ebx, edx
+cmovne esi, eax
+call fcn_0001c2f8  ; call 0x1c2f8
+mov dword [ebp - 0x20], 0
+movzx ecx, al
+mov eax, ebx
+cdq
+idiv ecx
+lea ebx, [edi + 0x9e]
+mov dword [ebp - 0x28], eax
+mov word [ebp - 0x1c], ax
+lea eax, [edi + ecx*4 + 0x9e]
+mov dword [ebp - 0x24], eax
+
+loc_0001512d:
+cmp ebx, dword [ebp - 0x24]
+je near loc_000151bf  ; je 0x151bf
+cmp byte [ebx], 1
+jne short loc_000151b1  ; jne 0x151b1
+mov byte [ebp - 0x19], 0
+
+loc_0001513f:
+movzx eax, byte [ebp - 0x19]
+cmp ax, word [ebp - 0x1c]
+jae short loc_000151b1  ; jae 0x151b1
+movzx eax, byte [ebp - 0x19]
+add eax, dword [ebp - 0x20]
+imul eax, eax, 0xc
+add eax, esi
+push dword [eax + 8]
+push dword [eax + 4]
+push dword [eax]
+push dword [ebp + 0xc]
+call fcn_00009dc2  ; call 0x9dc2
+mov edi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_000151ac  ; je 0x151ac
+test edi, edi
+jns short loc_000151ac  ; jns 0x151ac
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00015194  ; je 0x15194
+push edx
+push edi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00015194:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0xcbb
+push ref_0002531e  ; push 0x2531e
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000151ac:
+inc byte [ebp - 0x19]
+jmp short loc_0001513f  ; jmp 0x1513f
+
+loc_000151b1:
+mov eax, dword [ebp - 0x28]
+add ebx, 4
+add dword [ebp - 0x20], eax
+jmp near loc_0001512d  ; jmp 0x1512d
+
+loc_000151bf:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000151c7:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x3c
+mov eax, dword [ebp + 0x20]
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0x1c]
+mov dword [ebp - 0x34], eax
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000151f9  ; je 0x151f9
+push eax
+push eax
+push ref_0002541f  ; push 0x2541f
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000151f9:
+call fcn_0001bfbb  ; call 0x1bfbb
+mov edx, esi
+movzx esi, dl
+mov dword [ebp - 0x20], eax
+push eax
+push 0
+push 0x1f
+push esi
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0x14
+push esi
+mov dword [ebp - 0x2c], eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push 0
+push 0x1d
+push esi
+mov dword [ebp - 0x24], eax
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0x10
+cmp dword [ebp - 0x20], 1
+mov dword [ebp - 0x1c], 0
+mov dword [ebp - 0x30], eax
+jne short loc_00015255  ; jne 0x15255
+push ecx
+push 0
+push 0x1a
+push esi
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0x10
+mov dword [ebp - 0x1c], eax
+
+loc_00015255:
+mov eax, dword [ebp - 0x2c]
+sub esp, 0xc
+add eax, 0x40
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+mov word [ebp - 0x48], ax
+mov eax, dword [ebp - 0x2c]
+add eax, 2
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+cmp byte [ebx], 0
+jne short loc_00015284  ; jne 0x15284
+or dword [edi], 0x8000
+
+loc_00015284:
+cmp dword [ebp - 0x20], 1
+jne short loc_00015296  ; jne 0x15296
+cmp byte [ebx + 8], 0
+jne short loc_00015296  ; jne 0x15296
+or dword [edi], 0x2000
+
+loc_00015296:
+cmp byte [ebx + 0x10], 0
+jne short loc_000152a2  ; jne 0x152a2
+or dword [edi], 0x8000000
+
+loc_000152a2:
+push edx
+movzx edi, ax
+movzx eax, byte [ebp - 0x34]
+push edx
+push dword [ebp + 0x18]
+mov dword [ebp - 0x28], eax
+push edi
+push eax
+push esi
+push dword [ebp + 0xc]
+push ebx
+call fcn_000135df  ; call 0x135df
+mov esi, dword [ebp - 0x24]
+add esp, 0x1c
+push esi
+push dword [ebp + 0x10]
+push ebx
+call fcn_00014e2e  ; call 0x14e2e
+mov dword [esp], esi
+push edi
+push dword [ebp - 0x28]
+push dword [ebp + 0x10]
+push ebx
+call fcn_000137fe  ; call 0x137fe
+add esp, 0x20
+cmp byte [ebp - 0x34], 7
+jbe short loc_000152f8  ; jbe 0x152f8
+movzx eax, byte [ebp - 0x20]
+push ecx
+push eax
+push dword [ebp + 0x18]
+push ebx
+call fcn_000150d7  ; call 0x150d7
+add esp, 0x10
+
+loc_000152f8:
+push eax
+mov esi, dword [ebp - 0x24]
+push eax
+push dword [ebp - 0x2c]
+push esi
+push edi
+push dword [ebp - 0x28]
+push dword [ebp + 0x10]
+push ebx
+call fcn_00013f3d  ; call 0x13f3d
+add esp, 0x1c
+push dword [ebp - 0x1c]
+push dword [ebp - 0x30]
+push ebx
+call fcn_00014b58  ; call 0x14b58
+pop eax
+pop edx
+push esi
+push ebx
+call fcn_000148a3  ; call 0x148a3
+add esp, 0xc
+push dword [ebp + 0x18]
+push edi
+push ebx
+call fcn_00014eab  ; call 0x14eab
+add esp, 0x10
+cmp byte [ebx + 0xb4], 1
+jne short loc_00015393  ; jne 0x15393
+mov esi, dword [ebp - 0x48]
+sub esp, 0xc
+and esi, 0xfffc
+add esi, 0x3c
+push esi
+call fcn_00018ef6  ; call 0x18ef6
+pop ecx
+mov edi, eax
+pop eax
+mov eax, edi
+or eax, 2
+and edi, 0xfffd
+movzx eax, ax
+push eax
+push esi
+call fcn_00018f27  ; call 0x18f27
+add esp, 0xc
+push dword [ebp - 0x1c]
+push dword [ebp - 0x30]
+push ebx
+call fcn_00014c4f  ; call 0x14c4f
+pop eax
+pop edx
+push dword [ebp - 0x24]
+push ebx
+call fcn_00014d19  ; call 0x14d19
+pop ecx
+pop eax
+push edi
+push esi
+call fcn_00018f27  ; call 0x18f27
+add esp, 0x10
+
+loc_00015393:
+cmp byte [ebx + 1], 1
+jne short loc_000153ac  ; jne 0x153ac
+cmp byte [ebx], 1
+jne short loc_000153ac  ; jne 0x153ac
+sub esp, 0xc
+push dword [ebp - 0x30]
+call fcn_00014e12  ; call 0x14e12
+add esp, 0x10
+
+loc_000153ac:
+cmp dword [ebp - 0x20], 1
+jne short loc_000153cc  ; jne 0x153cc
+cmp byte [ebx + 9], 1
+jne short loc_000153cc  ; jne 0x153cc
+cmp byte [ebx + 8], 1
+jne short loc_000153cc  ; jne 0x153cc
+sub esp, 0xc
+push dword [ebp - 0x1c]
+call fcn_00014e12  ; call 0x14e12
+add esp, 0x10
+
+loc_000153cc:
+push edx
+push dword [ebp - 0x24]
+push dword [ebp + 0x10]
+push ebx
+call fcn_00014e6c  ; call 0x14e6c
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_000153f6  ; je 0x153f6
+push eax
+push eax
+push ref_00025438  ; push 0x25438
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000153f6:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00015400:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0x10]
+push ebx
+mov ebx, dword [ebp + 0xc]
+add esi, ebx
+
+loc_0001540d:
+cmp ebx, esi
+je short loc_00015424  ; je 0x15424
+inc ebx
+movzx eax, byte [ebx - 1]
+sub esp, 0xc
+push eax
+call fcn_0001641a  ; call 0x1641a
+add esp, 0x10
+jmp short loc_0001540d  ; jmp 0x1540d
+
+loc_00015424:
+lea esp, [ebp - 8]
+or eax, 0xffffffff
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001542e:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 8]
+push 0x80
+movzx eax, bx
+movzx ebx, bh
+push eax
+call fcn_00018eea  ; call 0x18eea
+pop eax
+pop edx
+push 0x90
+push ebx
+call fcn_00018eea  ; call 0x18eea
+add esp, 0x10
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001545e:
+push ebp
+mov ebp, esp
+sub esp, 8
+lea eax, [ebp + 0xc]
+push eax
+push dword [ebp + 8]
+push 0
+push fcn_00015400  ; push 0x15400
+call fcn_000155ac  ; call 0x155ac
+leave
+ret
+
+fcn_00015479:
+push ebp
+xor eax, eax
+mov ebp, esp
+pop ebp
+ret
+
+fcn_00015480:
+push ebp
+xor eax, eax
+mov ebp, esp
+pop ebp
+ret
+
+fcn_00015487:
+push ebp
+mov ebp, esp
+pop ebp
+ret
+
+fcn_0001548c:
+push ebp
+mov ebp, esp
+pop ebp
+ret
+
+fcn_00015491:
+push ebp
+mov ebp, esp
+push edi
+mov edi, eax
+push esi
+push ebx
+mov ebx, edx
+sub esp, 0x1c
+
+loc_0001549e:
+test ebx, ebx
+jle short loc_000154ce  ; jle 0x154ce
+push eax
+mov eax, dword [ebp + 8]
+cmp ebx, 0x10
+mov esi, 0x10
+cmovle esi, ebx
+push esi
+push edi
+push dword [eax]
+mov dword [ebp - 0x1c], ecx
+call ecx
+mov edx, dword [ebp + 8]
+add esp, 0x10
+mov ecx, dword [ebp - 0x1c]
+test eax, eax
+mov dword [edx], eax
+jne short loc_000154d2  ; jne 0x154d2
+or eax, 0xffffffff
+jmp short loc_000154d6  ; jmp 0x154d6
+
+loc_000154ce:
+xor eax, eax
+jmp short loc_000154d6  ; jmp 0x154d6
+
+loc_000154d2:
+sub ebx, esi
+jmp short loc_0001549e  ; jmp 0x1549e
+
+loc_000154d6:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000154de:
+push ebp
+mov ebp, esp
+push edi
+mov edi, ecx
+push esi
+mov esi, eax
+push ebx
+mov ebx, edx
+sub esp, 0xc
+test ecx, ecx
+jne short loc_000154ff  ; jne 0x154ff
+
+loc_000154f1:
+cmp dword [ebp + 8], 0
+je short loc_00015537  ; je 0x15537
+cmp dword [ebp + 0xc], 0
+je short loc_00015537  ; je 0x15537
+jmp short loc_00015520  ; jmp 0x15520
+
+loc_000154ff:
+sub esp, 0xc
+mov ecx, eax
+push edx
+mov eax, ref_00020558  ; mov eax, 0x20558
+mov edx, edi
+call fcn_00015491  ; call 0x15491
+add esp, 0x10
+test eax, eax
+jns short loc_000154f1  ; jns 0x154f1
+
+loc_00015518:
+or eax, 0xffffffff
+jmp near loc_000155a4  ; jmp 0x155a4
+
+loc_00015520:
+push edx
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push dword [ebx]
+call esi
+add esp, 0x10
+mov dword [ebx], eax
+test eax, eax
+je short loc_00015518  ; je 0x15518
+add edi, dword [ebp + 0xc]
+
+loc_00015537:
+cmp dword [ebp + 0x10], 0
+jne short loc_00015548  ; jne 0x15548
+
+loc_0001553d:
+add edi, dword [ebp + 0x10]
+cmp dword [ebp + 0x18], 0
+je short loc_00015578  ; je 0x15578
+jmp short loc_00015564  ; jmp 0x15564
+
+loc_00015548:
+mov edx, dword [ebp + 0x10]
+sub esp, 0xc
+mov ecx, esi
+push ebx
+mov eax, ref_00020544  ; mov eax, 0x20544
+call fcn_00015491  ; call 0x15491
+add esp, 0x10
+test eax, eax
+jns short loc_0001553d  ; jns 0x1553d
+jmp short loc_00015518  ; jmp 0x15518
+
+loc_00015564:
+push eax
+push dword [ebp + 0x18]
+push dword [ebp + 0x14]
+push dword [ebx]
+call esi
+add esp, 0x10
+mov dword [ebx], eax
+test eax, eax
+je short loc_00015518  ; je 0x15518
+
+loc_00015578:
+add edi, dword [ebp + 0x18]
+cmp dword [ebp + 0x1c], 0
+je short loc_0001559f  ; je 0x1559f
+mov edx, dword [ebp + 0x1c]
+sub esp, 0xc
+mov ecx, esi
+push ebx
+mov eax, ref_00020558  ; mov eax, 0x20558
+call fcn_00015491  ; call 0x15491
+add esp, 0x10
+test eax, eax
+js near loc_00015518  ; js 0x15518
+
+loc_0001559f:
+mov eax, dword [ebp + 0x1c]
+add eax, edi
+
+loc_000155a4:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000155ac:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xec
+mov eax, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0x14]
+test eax, eax
+je short loc_00015610  ; je 0x15610
+mov dword [ebp - 0xe0], 0
+mov dword [ebp - 0xd4], 0
+jmp short loc_00015631  ; jmp 0x15631
+
+loc_000155d8:
+cmp dl, 0x2a
+jne near loc_0001566c  ; jne 0x1566c
+mov ecx, dword [ebx]
+lea eax, [ebx + 4]
+mov dword [ebp - 0xc4], ecx
+test ecx, ecx
+jns short loc_000155fd  ; jns 0x155fd
+neg dword [ebp - 0xc4]
+or dword [ebp - 0xb4], 4
+
+loc_000155fd:
+inc edi
+mov ebx, eax
+
+loc_00015600:
+cmp dword [ebp - 0xc4], 0x1f4
+jle near loc_000156c4  ; jle 0x156c4
+
+loc_00015610:
+or eax, 0xffffffff
+jmp near loc_00016176  ; jmp 0x16176
+
+loc_00015618:
+test dl, dl
+je short loc_00015624  ; je 0x15624
+inc esi
+
+loc_0001561d:
+mov dl, byte [esi]
+cmp dl, 0x25
+jne short loc_00015618  ; jne 0x15618
+
+loc_00015624:
+mov edi, esi
+sub edi, eax
+jne short loc_0001563e  ; jne 0x1563e
+
+loc_0001562a:
+cmp byte [esi], 0
+jne short loc_00015659  ; jne 0x15659
+mov eax, esi
+
+loc_00015631:
+cmp byte [eax], 0
+je near loc_0001613b  ; je 0x1613b
+mov esi, eax
+jmp short loc_0001561d  ; jmp 0x1561d
+
+loc_0001563e:
+push edx
+push edi
+push eax
+push dword [ebp + 0xc]
+call dword [ebp + 8]  ; ucall
+add esp, 0x10
+mov dword [ebp + 0xc], eax
+test eax, eax
+je short loc_00015610  ; je 0x15610
+add dword [ebp - 0xd4], edi
+jmp short loc_0001562a  ; jmp 0x1562a
+
+loc_00015659:
+lea edi, [esi + 1]
+mov dword [ebp - 0xb4], 0
+
+loc_00015666:
+mov dl, byte [edi]
+test dl, dl
+jne short loc_00015678  ; jne 0x15678
+
+loc_0001566c:
+mov dword [ebp - 0xc4], 0
+jmp short loc_000156b4  ; jmp 0x156b4
+
+loc_00015678:
+mov eax, ref_0002053c  ; mov eax, 0x2053c
+
+loc_0001567d:
+mov cl, byte [eax]
+cmp cl, dl
+je near loc_00016143  ; je 0x16143
+test cl, cl
+je near loc_000155d8  ; je 0x155d8
+inc eax
+jmp short loc_0001567d  ; jmp 0x1567d
+
+loc_00015692:
+cmp dword [ebp - 0xc4], 0x1f3
+jg near loc_00015600  ; jg 0x15600
+imul edx, dword [ebp - 0xc4], 0xa
+inc edi
+lea eax, [edx + eax - 0x30]
+mov dword [ebp - 0xc4], eax
+
+loc_000156b4:
+movsx eax, byte [edi]
+lea edx, [eax - 0x30]
+cmp dl, 9
+jbe short loc_00015692  ; jbe 0x15692
+jmp near loc_00015600  ; jmp 0x15600
+
+loc_000156c4:
+cmp byte [edi], 0x2e
+mov dword [ebp - 0xc0], 0xffffffff
+jne short loc_0001573d  ; jne 0x1573d
+cmp byte [edi + 1], 0x2a
+je short loc_000156e6  ; je 0x156e6
+inc edi
+mov dword [ebp - 0xc0], 0
+jmp short loc_00015722  ; jmp 0x15722
+
+loc_000156e6:
+lea eax, [ebx + 4]
+mov ebx, dword [ebx]
+mov dword [ebp - 0xc0], ebx
+cmp ebx, 0x1f4
+jg near loc_00015610  ; jg 0x15610
+add edi, 2
+mov ebx, eax
+jmp short loc_0001573d  ; jmp 0x1573d
+
+loc_00015704:
+cmp dword [ebp - 0xc0], 0x1f3
+jg short loc_0001572d  ; jg 0x1572d
+imul edx, dword [ebp - 0xc0], 0xa
+inc edi
+lea eax, [edx + eax - 0x30]
+mov dword [ebp - 0xc0], eax
+
+loc_00015722:
+movsx eax, byte [edi]
+lea edx, [eax - 0x30]
+cmp dl, 9
+jbe short loc_00015704  ; jbe 0x15704
+
+loc_0001572d:
+cmp dword [ebp - 0xc0], 0x1f4
+jg near loc_00015610  ; jg 0x15610
+
+loc_0001573d:
+cmp byte [edi], 0x3a
+mov dword [ebp - 0xb0], 0
+jne short loc_000157af  ; jne 0x157af
+cmp byte [edi + 1], 0x2a
+jne short loc_00015796  ; jne 0x15796
+mov esi, dword [ebx]
+lea eax, [ebx + 4]
+mov dword [ebp - 0xb0], esi
+test esi, esi
+js short loc_0001576b  ; js 0x1576b
+cmp esi, 0x24
+jle short loc_00015775  ; jle 0x15775
+jmp near loc_00015610  ; jmp 0x15610
+
+loc_0001576b:
+mov dword [ebp - 0xb0], 0
+
+loc_00015775:
+add edi, 2
+mov ebx, eax
+jmp short loc_000157af  ; jmp 0x157af
+
+loc_0001577c:
+cmp dword [ebp - 0xb0], 0x23
+jg short loc_000157a2  ; jg 0x157a2
+imul ecx, dword [ebp - 0xb0], 0xa
+lea eax, [ecx + eax - 0x30]
+mov dword [ebp - 0xb0], eax
+
+loc_00015796:
+inc edi
+movsx eax, byte [edi]
+lea edx, [eax - 0x30]
+cmp dl, 9
+jbe short loc_0001577c  ; jbe 0x1577c
+
+loc_000157a2:
+cmp dword [ebp - 0xb0], 0x24
+jg near loc_00015610  ; jg 0x15610
+
+loc_000157af:
+cmp byte [edi], 0x5b
+mov dword [ebp - 0xcc], 0
+jne short loc_000157e8  ; jne 0x157e8
+lea eax, [edi + 1]
+not edi
+mov dword [ebp - 0xe0], eax
+mov esi, edi
+
+loc_000157cb:
+mov dl, byte [eax]
+lea edi, [eax + esi]
+mov dword [ebp - 0xcc], edi
+test dl, dl
+je near loc_00015610  ; je 0x15610
+cmp dl, 0x5d
+lea eax, [eax + 1]
+jne short loc_000157cb  ; jne 0x157cb
+mov edi, eax
+
+loc_000157e8:
+mov al, byte [edi]
+mov esi, ref_0002544f  ; mov esi, 0x2544f
+test al, al
+je short loc_00015820  ; je 0x15820
+
+loc_000157f3:
+mov dl, byte [esi]
+cmp dl, al
+je short loc_00015804  ; je 0x15804
+test dl, dl
+je short loc_00015800  ; je 0x15800
+inc esi
+jmp short loc_000157f3  ; jmp 0x157f3
+
+loc_00015800:
+xor eax, eax
+jmp short loc_00015820  ; jmp 0x15820
+
+loc_00015804:
+mov dl, byte [edi + 1]
+lea esi, [edi + 1]
+test dl, dl
+je near loc_0001615b  ; je 0x1615b
+cmp dl, al
+jne near loc_0001615b  ; jne 0x1615b
+or eax, 1
+add edi, 2
+
+loc_00015820:
+mov dl, byte [edi]
+test dl, dl
+jne short loc_00015830  ; jne 0x15830
+mov eax, dword [ebx]
+add ebx, 4
+jmp near loc_00015631  ; jmp 0x15631
+
+loc_00015830:
+mov byte [ebp - 0xb8], 0
+cmp dl, 0x43
+jne short loc_00015852  ; jne 0x15852
+mov cl, byte [edi + 1]
+lea esi, [edi + 1]
+mov byte [ebp - 0xb8], cl
+test cl, cl
+je near loc_00015610  ; je 0x15610
+mov edi, esi
+
+loc_00015852:
+mov byte [ebp - 0xa3], dl
+cmp dl, 0x6e
+jne short loc_000158b3  ; jne 0x158b3
+mov edx, dword [ebx]
+test edx, edx
+je near loc_0001616f  ; je 0x1616f
+cmp al, 0x68
+jne short loc_00015879  ; jne 0x15879
+mov eax, dword [ebp - 0xd4]
+mov word [edx], ax
+jmp near loc_0001616f  ; jmp 0x1616f
+
+loc_00015879:
+cmp al, 0x69
+jne short loc_0001588a  ; jne 0x1588a
+mov al, byte [ebp - 0xd4]
+mov byte [edx], al
+jmp near loc_0001616f  ; jmp 0x1616f
+
+loc_0001588a:
+cmp al, 0x6c
+je short loc_000158a6  ; je 0x158a6
+cmp al, 0x6a
+jne short loc_000158a6  ; jne 0x158a6
+mov eax, dword [ebp - 0xd4]
+mov dword [edx + 4], 0
+mov dword [edx], eax
+jmp near loc_0001616f  ; jmp 0x1616f
+
+loc_000158a6:
+mov eax, dword [ebp - 0xd4]
+mov dword [edx], eax
+jmp near loc_0001616f  ; jmp 0x1616f
+
+loc_000158b3:
+cmp dl, 0x25
+jne short loc_000158e0  ; jne 0x158e0
+push eax
+xor ecx, ecx
+push eax
+push 0
+push 1
+lea eax, [ebp - 0xa3]
+push eax
+mov eax, dword [ebp + 8]
+push 0
+push 0
+push 0
+lea edx, [ebp + 0xc]
+call fcn_000154de  ; call 0x154de
+add esp, 0x20
+jmp near loc_00016125  ; jmp 0x16125
+
+loc_000158e0:
+mov esi, edx
+and esi, 0xffffffdf
+mov ecx, esi
+cmp cl, 0x43
+jne short loc_00015964  ; jne 0x15964
+cmp dl, 0x63
+jne short loc_000158fe  ; jne 0x158fe
+mov eax, dword [ebx]
+add ebx, 4
+mov byte [ebp - 0x9a], al
+jmp short loc_0001590a  ; jmp 0x1590a
+
+loc_000158fe:
+mov al, byte [ebp - 0xb8]
+mov byte [ebp - 0x9a], al
+
+loc_0001590a:
+mov esi, dword [ebp - 0xc0]
+mov eax, 1
+test esi, esi
+cmovs esi, eax
+test esi, esi
+cmovg eax, esi
+xor esi, esi
+mov dword [ebp - 0xb0], eax
+
+loc_00015927:
+push eax
+xor ecx, ecx
+push eax
+push 0
+push 1
+lea eax, [ebp - 0x9a]
+push eax
+mov eax, dword [ebp + 8]
+push 0
+push 0
+push 0
+lea edx, [ebp + 0xc]
+call fcn_000154de  ; call 0x154de
+add esp, 0x20
+cmp eax, 0xffffffff
+je near loc_00015610  ; je 0x15610
+add esi, eax
+dec dword [ebp - 0xb0]
+jne short loc_00015927  ; jne 0x15927
+mov eax, esi
+jmp near loc_00016125  ; jmp 0x16125
+
+loc_00015964:
+cmp dl, 0x73
+jne near loc_000159fb  ; jne 0x159fb
+lea eax, [ebx + 4]
+mov edx, ref_00025456  ; mov edx, 0x25456
+mov dword [ebp - 0xb0], eax
+mov eax, dword [ebx]
+test eax, eax
+cmove eax, edx
+mov edx, eax
+
+loc_00015984:
+cmp byte [edx], 0
+je short loc_0001598c  ; je 0x1598c
+inc edx
+jmp short loc_00015984  ; jmp 0x15984
+
+loc_0001598c:
+mov ebx, dword [ebp - 0xc0]
+sub edx, eax
+test ebx, ebx
+js short loc_0001599d  ; js 0x1599d
+cmp edx, ebx
+cmovg edx, ebx
+
+loc_0001599d:
+mov esi, dword [ebp - 0xc4]
+xor ecx, ecx
+mov ebx, esi
+sub ebx, edx
+cmp edx, esi
+mov esi, dword [ebp - 0xb4]
+cmovl ecx, ebx
+xor ebx, ebx
+and esi, 4
+je short loc_000159bf  ; je 0x159bf
+mov ebx, ecx
+xor ecx, ecx
+
+loc_000159bf:
+test byte [ebp - 0xb4], 0x40
+je short loc_000159d7  ; je 0x159d7
+add ebx, ecx
+xor ecx, ecx
+test esi, esi
+sete cl
+add ecx, ebx
+sar ecx, 1
+sub ebx, ecx
+
+loc_000159d7:
+push esi
+push esi
+push ebx
+push edx
+push eax
+mov eax, dword [ebp + 8]
+push 0
+push 0
+push 0
+lea edx, [ebp + 0xc]
+call fcn_000154de  ; call 0x154de
+add esp, 0x20
+mov ebx, dword [ebp - 0xb0]
+jmp near loc_00016125  ; jmp 0x16125
+
+loc_000159fb:
+cmp dl, 0x70
+jne short loc_00015a27  ; jne 0x15a27
+mov byte [ebp - 0xa3], 0x58
+xor eax, eax
+mov dword [ebp - 0xc0], 8
+mov dword [ebp - 0xc4], 8
+mov dword [ebp - 0xb4], 0x28
+
+loc_00015a27:
+mov dl, byte [ebp - 0xa3]
+cmp dl, 0x69
+sete cl
+mov byte [ebp - 0xc8], dl
+mov byte [ebp - 0xd8], cl
+cmp dl, 0x64
+je short loc_00015a4f  ; je 0x15a4f
+test cl, cl
+jne short loc_00015a4f  ; jne 0x15a4f
+xor esi, esi
+cmp dl, 0x49
+jne short loc_00015a7e  ; jne 0x15a7e
+
+loc_00015a4f:
+mov dl, byte [ebp - 0xc8]
+mov esi, 0xa
+and dword [ebp - 0xb4], 0xfffffff7
+or dword [ebp - 0xb4], 0x80
+and edx, 0xffffffdf
+cmp dl, 0x49
+jne short loc_00015a7e  ; jne 0x15a7e
+mov ecx, dword [ebp - 0xb0]
+test ecx, ecx
+cmovne esi, ecx
+
+loc_00015a7e:
+mov dl, byte [ebp - 0xc8]
+and edx, 0xffffffdf
+cmp dl, 0x58
+sete cl
+test cl, cl
+mov byte [ebp - 0xbc], cl
+mov ecx, 0x10
+cmovne esi, ecx
+cmp dl, 0x55
+jne short loc_00015ab2  ; jne 0x15ab2
+mov ecx, dword [ebp - 0xb0]
+mov esi, 0xa
+test ecx, ecx
+cmovne esi, ecx
+
+loc_00015ab2:
+mov cl, byte [ebp - 0xc8]
+cmp cl, 0x6f
+je short loc_00015acc  ; je 0x15acc
+cmp cl, 0x62
+je short loc_00015ad3  ; je 0x15ad3
+cmp esi, 1
+ja short loc_00015ad8  ; ja 0x15ad8
+jmp near loc_00015610  ; jmp 0x15610
+
+loc_00015acc:
+mov esi, 8
+jmp short loc_00015ad8  ; jmp 0x15ad8
+
+loc_00015ad3:
+mov esi, 2
+
+loc_00015ad8:
+test byte [ebp - 0xb4], 0x80
+je near loc_00015b9d  ; je 0x15b9d
+cmp al, 0x6c
+jne short loc_00015aee  ; jne 0x15aee
+lea eax, [ebx + 4]
+jmp short loc_00015af5  ; jmp 0x15af5
+
+loc_00015aee:
+cmp al, 0x6a
+jne short loc_00015aff  ; jne 0x15aff
+lea eax, [ebx + 8]
+
+loc_00015af5:
+mov dword [ebp - 0xb8], eax
+
+loc_00015afb:
+mov edx, dword [ebx]
+jmp short loc_00015b23  ; jmp 0x15b23
+
+loc_00015aff:
+lea edx, [ebx + 4]
+cmp al, 0x7a
+mov dword [ebp - 0xb8], edx
+je short loc_00015afb  ; je 0x15afb
+mov edx, dword [ebx]
+cmp al, 0x74
+je short loc_00015b23  ; je 0x15b23
+cmp al, 0x68
+jne short loc_00015b1b  ; jne 0x15b1b
+movsx edx, dx
+jmp short loc_00015b23  ; jmp 0x15b23
+
+loc_00015b1b:
+movsx ecx, dl
+cmp al, 0x69
+cmove edx, ecx
+
+loc_00015b23:
+mov ecx, edx
+sar ecx, 0x1f
+mov eax, ecx
+xor eax, edx
+sub eax, ecx
+mov dword [ebp - 0xb0], eax
+sar eax, 0x1f
+mov dword [ebp - 0xac], eax
+test edx, edx
+jns short loc_00015b4a  ; jns 0x15b4a
+mov byte [ebp - 0xa2], 0x2d
+jmp short loc_00015b70  ; jmp 0x15b70
+
+loc_00015b4a:
+test byte [ebp - 0xb4], 2
+je short loc_00015b5c  ; je 0x15b5c
+mov byte [ebp - 0xa2], 0x2b
+jmp short loc_00015b70  ; jmp 0x15b70
+
+loc_00015b5c:
+mov eax, dword [ebp - 0xb4]
+and eax, 1
+neg eax
+and eax, 0x20
+mov byte [ebp - 0xa2], al
+
+loc_00015b70:
+cmp byte [ebp - 0xa2], 0
+mov dword [ebp - 0xd0], 0
+je near loc_00015c54  ; je 0x15c54
+or dword [ebp - 0xb4], 8
+mov dword [ebp - 0xd0], 1
+jmp near loc_00015c54  ; jmp 0x15c54
+
+loc_00015b9d:
+cmp al, 0x6c
+jne short loc_00015bb0  ; jne 0x15bb0
+lea eax, [ebx + 4]
+xor edx, edx
+mov dword [ebp - 0xb8], eax
+mov eax, dword [ebx]
+jmp short loc_00015bc2  ; jmp 0x15bc2
+
+loc_00015bb0:
+cmp al, 0x6a
+jne short loc_00015bd0  ; jne 0x15bd0
+lea eax, [ebx + 8]
+mov edx, dword [ebx + 4]
+mov dword [ebp - 0xb8], eax
+mov eax, dword [ebx]
+
+loc_00015bc2:
+mov dword [ebp - 0xb0], eax
+mov dword [ebp - 0xac], edx
+jmp short loc_00015c43  ; jmp 0x15c43
+
+loc_00015bd0:
+lea edx, [ebx + 4]
+cmp al, 0x7a
+mov dword [ebp - 0xb8], edx
+jne short loc_00015bf0  ; jne 0x15bf0
+mov eax, dword [ebx]
+mov dword [ebp - 0xb0], eax
+sar eax, 0x1f
+mov dword [ebp - 0xac], eax
+jmp short loc_00015c43  ; jmp 0x15c43
+
+loc_00015bf0:
+cmp al, 0x74
+jne short loc_00015c07  ; jne 0x15c07
+mov eax, dword [ebx]
+mov dword [ebp - 0xb0], eax
+sar eax, 0x1f
+mov dword [ebp - 0xac], eax
+jmp short loc_00015c43  ; jmp 0x15c43
+
+loc_00015c07:
+mov edx, dword [ebx]
+mov dword [ebp - 0xac], 0
+mov dword [ebp - 0xb0], edx
+cmp al, 0x68
+jne short loc_00015c28  ; jne 0x15c28
+movzx edx, dx
+mov dword [ebp - 0xb0], edx
+jmp short loc_00015c39  ; jmp 0x15c39
+
+loc_00015c28:
+cmp al, 0x69
+jne short loc_00015c43  ; jne 0x15c43
+movzx eax, byte [ebp - 0xb0]
+mov dword [ebp - 0xb0], eax
+
+loc_00015c39:
+mov dword [ebp - 0xac], 0
+
+loc_00015c43:
+mov byte [ebp - 0xa2], 0x30
+mov dword [ebp - 0xd0], 0
+
+loc_00015c54:
+mov eax, dword [ebp - 0xb0]
+mov edx, dword [ebp - 0xac]
+mov ebx, eax
+or ebx, edx
+setne al
+je short loc_00015c82  ; je 0x15c82
+cmp byte [ebp - 0xc8], 0x6f
+mov edx, 1
+cmovne edx, dword [ebp - 0xd0]
+mov dword [ebp - 0xd0], edx
+
+loc_00015c82:
+cmp byte [ebp - 0xbc], 0
+jne short loc_00015c94  ; jne 0x15c94
+cmp byte [ebp - 0xc8], 0x62
+jne short loc_00015cc2  ; jne 0x15cc2
+
+loc_00015c94:
+test byte [ebp - 0xb4], 0x20
+jne short loc_00015ca9  ; jne 0x15ca9
+test al, al
+je short loc_00015cc2  ; je 0x15cc2
+mov al, byte [ebp - 0xc8]
+jmp short loc_00015cb2  ; jmp 0x15cb2
+
+loc_00015ca9:
+mov al, byte [ebp - 0xc8]
+or eax, 0x20
+
+loc_00015cb2:
+mov byte [ebp - 0xa1], al
+mov dword [ebp - 0xd0], 2
+
+loc_00015cc2:
+test byte [ebp - 0xb4], 8
+je short loc_00015cd9  ; je 0x15cd9
+lea eax, [ebp - 0xa2]
+mov dword [ebp - 0xec], eax
+jmp short loc_00015ced  ; jmp 0x15ced
+
+loc_00015cd9:
+mov dword [ebp - 0xec], 0
+mov dword [ebp - 0xd0], 0
+
+loc_00015ced:
+cmp esi, 0xa
+jne short loc_00015d58  ; jne 0x15d58
+mov dword [ebp - 0xbc], 0
+lea esi, [ebp - 0xa0]
+
+loc_00015d02:
+mov edx, dword [ebp - 0xac]
+mov eax, dword [ebp - 0xb0]
+mov ebx, edx
+or ebx, eax
+je near loc_00015ea6  ; je 0x15ea6
+push esi
+push 0xa
+push dword [ebp - 0xac]
+push dword [ebp - 0xb0]
+call fcn_00017502  ; call 0x17502
+mov bl, byte [ebp - 0xa0]
+add esp, 0x10
+inc dword [ebp - 0xbc]
+mov dword [ebp - 0xb0], eax
+mov eax, dword [ebp - 0xbc]
+mov dword [ebp - 0xac], edx
+lea edx, [ebx + 0x30]
+neg eax
+mov byte [eax + ebp - 0x18], dl
+jmp short loc_00015d02  ; jmp 0x15d02
+
+loc_00015d58:
+cmp byte [ebp - 0xc8], 0x75
+sete byte [ebp - 0xdc]
+cmp esi, 8
+sete dl
+cmp esi, 2
+je short loc_00015d89  ; je 0x15d89
+test dl, dl
+jne short loc_00015d89  ; jne 0x15d89
+cmp esi, 0x10
+je short loc_00015d89  ; je 0x15d89
+mov dword [ebp - 0xbc], 0
+jmp near loc_00015e8d  ; jmp 0x15e8d
+
+loc_00015d89:
+lea eax, [esi - 1]
+cmp esi, 0x10
+je short loc_00015d9e  ; je 0x15d9e
+cmp dl, 1
+sbb ecx, ecx
+and ecx, 0xfffffffe
+add ecx, 3
+jmp short loc_00015da3  ; jmp 0x15da3
+
+loc_00015d9e:
+mov ecx, 4
+
+loc_00015da3:
+mov dword [ebp - 0xbc], 0
+
+loc_00015dad:
+mov esi, dword [ebp - 0xac]
+mov ebx, dword [ebp - 0xb0]
+mov edx, esi
+or edx, ebx
+je near loc_00015ea6  ; je 0x15ea6
+mov edx, dword [ebp - 0xb0]
+and edx, eax
+cmp byte [ebp - 0xc8], 0x78
+mov dl, byte [edx + ref_000204f4]  ; mov dl, byte [edx + 0x204f4]
+je short loc_00015dec  ; je 0x15dec
+cmp byte [ebp - 0xd8], 0
+jne short loc_00015dec  ; jne 0x15dec
+cmp byte [ebp - 0xdc], 0
+je short loc_00015def  ; je 0x15def
+
+loc_00015dec:
+or edx, 0x20
+
+loc_00015def:
+inc dword [ebp - 0xbc]
+mov esi, dword [ebp - 0xbc]
+mov ebx, dword [ebp - 0xb0]
+neg esi
+mov byte [esi + ebp - 0x18], dl
+mov esi, dword [ebp - 0xac]
+xor edx, edx
+shrd ebx, esi, cl
+shr esi, cl
+test cl, 0x20
+cmovne ebx, esi
+cmovne esi, edx
+mov dword [ebp - 0xb0], ebx
+mov dword [ebp - 0xac], esi
+jmp short loc_00015dad  ; jmp 0x15dad
+
+loc_00015e2b:
+push eax
+push esi
+push dword [ebp - 0xac]
+push dword [ebp - 0xb0]
+call fcn_00017470  ; call 0x17470
+add esp, 0x10
+cmp byte [ebp - 0xdc], 0
+mov al, byte [eax + ref_000204f4]  ; mov al, byte [eax + 0x204f4]
+jne short loc_00015ea1  ; jne 0x15ea1
+cmp byte [ebp - 0xd8], 0
+jne short loc_00015ea1  ; jne 0x15ea1
+
+loc_00015e59:
+inc dword [ebp - 0xbc]
+mov edx, dword [ebp - 0xbc]
+neg edx
+mov byte [edx + ebp - 0x18], al
+push eax
+push esi
+push dword [ebp - 0xac]
+push dword [ebp - 0xb0]
+call fcn_000174b9  ; call 0x174b9
+add esp, 0x10
+mov dword [ebp - 0xb0], eax
+mov dword [ebp - 0xac], edx
+
+loc_00015e8d:
+mov edx, dword [ebp - 0xac]
+mov eax, dword [ebp - 0xb0]
+mov ebx, edx
+or ebx, eax
+jne short loc_00015e2b  ; jne 0x15e2b
+jmp short loc_00015ea6  ; jmp 0x15ea6
+
+loc_00015ea1:
+or eax, 0x20
+jmp short loc_00015e59  ; jmp 0x15e59
+
+loc_00015ea6:
+cmp dword [ebp - 0xcc], 0
+mov dword [ebp - 0xe8], 0
+je near loc_00016060  ; je 0x16060
+mov eax, dword [ebp - 0xe0]
+mov ebx, dword [ebp - 0xcc]
+mov ecx, dword [ebp - 0xbc]
+mov dword [ebp - 0xc8], 0x82
+sub dword [ebp - 0xc8], ecx
+lea eax, [eax + ebx - 1]
+mov dword [ebp - 0xd8], eax
+xor eax, eax
+mov dword [ebp - 0xb0], ecx
+mov byte [ebp - 0xe4], 0
+
+loc_00015ef8:
+cmp dword [ebp - 0xb0], 0
+je near loc_00016060  ; je 0x16060
+cmp dword [ebp - 0xcc], 0
+je near loc_00016162  ; je 0x16162
+mov ebx, dword [ebp - 0xd8]
+mov al, byte [ebx]
+cmp al, 0x2d
+je near loc_00016060  ; je 0x16060
+cmp al, 0x2a
+je short loc_00015f43  ; je 0x15f43
+mov ecx, dword [ebp - 0xcc]
+mov edx, 1
+xor eax, eax
+sub ebx, ecx
+mov dword [ebp - 0xdc], ecx
+mov dword [ebp - 0xe4], ebx
+jmp short loc_00015f93  ; jmp 0x15f93
+
+loc_00015f43:
+mov eax, dword [ebp - 0xb8]
+lea esi, [eax + 4]
+mov eax, dword [eax]
+test eax, eax
+js near loc_0001605a  ; js 0x1605a
+mov ecx, dword [ebp - 0xd8]
+mov edx, dword [ebp - 0xcc]
+mov dword [ebp - 0xb8], esi
+dec ecx
+dec edx
+mov dword [ebp - 0xdc], edx
+jne short loc_00015fc9  ; jne 0x15fc9
+jmp near loc_00016060  ; jmp 0x16060
+
+loc_00015f77:
+movsx esi, bl
+sub esi, 0x30
+imul esi, edx
+imul ebx, edx, 0xa
+add eax, esi
+dec dword [ebp - 0xdc]
+mov edx, ebx
+je near loc_00016060  ; je 0x16060
+
+loc_00015f93:
+mov ebx, dword [ebp - 0xdc]
+mov esi, dword [ebp - 0xe4]
+mov dword [ebp - 0xf0], eax
+mov ecx, ebx
+mov al, byte [esi + ebx]
+sub ecx, dword [ebp - 0xcc]
+add ecx, dword [ebp - 0xd8]
+mov esi, eax
+mov bl, al
+sub esi, 0x30
+mov eax, esi
+cmp al, 9
+mov eax, dword [ebp - 0xf0]
+jbe short loc_00015f77  ; jbe 0x15f77
+
+loc_00015fc9:
+mov dl, byte [ecx]
+lea ebx, [ecx - 1]
+mov ecx, dword [ebp - 0xdc]
+mov dword [ebp - 0xd8], ebx
+mov byte [ebp - 0xe4], dl
+dec ecx
+mov dword [ebp - 0xcc], ecx
+test eax, eax
+je short loc_0001604b  ; je 0x1604b
+
+loc_00015feb:
+mov esi, dword [ebp - 0xb0]
+cmp esi, eax
+jle short loc_00016060  ; jle 0x16060
+lea ecx, [ebp - 0x9a]
+sub esi, eax
+add ecx, dword [ebp - 0xc8]
+xor edx, edx
+
+loc_00016005:
+cmp edx, esi
+je short loc_00016013  ; je 0x16013
+mov bl, byte [ecx + edx]
+mov byte [ecx + edx - 1], bl
+inc edx
+jmp short loc_00016005  ; jmp 0x16005
+
+loc_00016013:
+mov ecx, dword [ebp - 0xb0]
+dec dword [ebp - 0xc8]
+add ecx, dword [ebp - 0xc8]
+mov bl, byte [ebp - 0xe4]
+inc dword [ebp - 0xbc]
+sub ecx, eax
+inc dword [ebp - 0xe8]
+mov byte [ebp + ecx - 0x9a], bl
+mov dword [ebp - 0xb0], edx
+jmp near loc_00015ef8  ; jmp 0x15ef8
+
+loc_0001604b:
+cmp dword [ebp - 0xcc], 0
+jne near loc_00015ef8  ; jne 0x15ef8
+jmp short loc_00016060  ; jmp 0x16060
+
+loc_0001605a:
+mov dword [ebp - 0xb8], esi
+
+loc_00016060:
+cmp dword [ebp - 0xc0], 0
+js short loc_00016072  ; js 0x16072
+and dword [ebp - 0xb4], 0xffffffef
+jmp short loc_0001607c  ; jmp 0x1607c
+
+loc_00016072:
+mov dword [ebp - 0xc0], 1
+
+loc_0001607c:
+mov ebx, dword [ebp - 0xbc]
+mov eax, dword [ebp - 0xc0]
+add eax, dword [ebp - 0xe8]
+cmp eax, ebx
+cmovl eax, ebx
+mov ebx, dword [ebp - 0xc4]
+xor ecx, ecx
+mov esi, eax
+mov eax, dword [ebp - 0xd0]
+mov edx, ebx
+add eax, esi
+sub edx, eax
+cmp eax, ebx
+cmovl ecx, edx
+mov edx, dword [ebp - 0xb4]
+xor eax, eax
+and edx, 4
+je short loc_000160bf  ; je 0x160bf
+mov eax, ecx
+xor ecx, ecx
+
+loc_000160bf:
+test byte [ebp - 0xb4], 0x40
+je short loc_000160d7  ; je 0x160d7
+add eax, ecx
+xor ecx, ecx
+test edx, edx
+sete cl
+add ecx, eax
+sar ecx, 1
+sub eax, ecx
+
+loc_000160d7:
+sub esi, dword [ebp - 0xbc]
+mov edx, esi
+test byte [ebp - 0xb4], 0x10
+je short loc_000160ec  ; je 0x160ec
+add edx, ecx
+xor ecx, ecx
+
+loc_000160ec:
+mov esi, dword [ebp - 0xbc]
+push ebx
+push ebx
+push eax
+lea eax, [ebp - 0x9a]
+sub eax, esi
+push esi
+add eax, 0x82
+push eax
+mov eax, dword [ebp + 8]
+push edx
+push dword [ebp - 0xd0]
+push dword [ebp - 0xec]
+lea edx, [ebp + 0xc]
+call fcn_000154de  ; call 0x154de
+mov ebx, dword [ebp - 0xb8]
+add esp, 0x20
+
+loc_00016125:
+test eax, eax
+js near loc_00015610  ; js 0x15610
+
+loc_0001612d:
+add dword [ebp - 0xd4], eax
+lea eax, [edi + 1]
+jmp near loc_00015631  ; jmp 0x15631
+
+loc_0001613b:
+mov eax, dword [ebp - 0xd4]
+jmp short loc_00016176  ; jmp 0x16176
+
+loc_00016143:
+sub eax, ref_0002053c  ; sub eax, 0x2053c
+inc edi
+mov eax, dword [eax*4 + ref_0002051c]  ; mov eax, dword [eax*4 + 0x2051c]
+or dword [ebp - 0xb4], eax
+jmp near loc_00015666  ; jmp 0x15666
+
+loc_0001615b:
+mov edi, esi
+jmp near loc_00015820  ; jmp 0x15820
+
+loc_00016162:
+test eax, eax
+jne near loc_00015feb  ; jne 0x15feb
+jmp near loc_00016060  ; jmp 0x16060
+
+loc_0001616f:
+add ebx, 4
+xor eax, eax
+jmp short loc_0001612d  ; jmp 0x1612d
+
+loc_00016176:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001617e:
+push ebp
+mov edx, dword [ref_00029bb8]  ; mov edx, dword [0x29bb8]
+mov ebp, esp
+mov eax, dword [ebp + 0xc]
+mov dword [eax], edx
+xor eax, eax
+pop ebp
+ret
+
+fcn_00016190:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0xc]
+pop ebp
+mov dword [ref_00029bb8], eax  ; mov dword [0x29bb8], eax
+xor eax, eax
+ret
+
+fcn_0001619f:
+push ebp
+xor eax, eax
+mov ebp, esp
+pop ebp
+ret
+
+fcn_000161a6:
+push ebp
+mov ebp, esp
+pop ebp
+jmp near fcn_0001713e  ; jmp 0x1713e
+
+fcn_000161af:
+push ebp
+mov ebp, esp
+push ebx
+mov ebx, eax
+push edx
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00016205  ; je 0x16205
+movzx eax, byte [ebx + 0xf]
+sub esp, 0xc
+push eax
+movzx eax, byte [ebx + 0xe]
+push eax
+movzx eax, byte [ebx + 0xd]
+push eax
+movzx eax, byte [ebx + 0xc]
+push eax
+movzx eax, byte [ebx + 0xb]
+push eax
+movzx eax, byte [ebx + 0xa]
+push eax
+movzx eax, byte [ebx + 9]
+push eax
+movzx eax, byte [ebx + 8]
+push eax
+movzx eax, word [ebx + 6]
+push eax
+movzx eax, word [ebx + 4]
+push eax
+push dword [ebx]
+push ref_0002545d  ; push 0x2545d
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x40
+
+loc_00016205:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001620a:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 0xc]
+
+loc_00016216:
+mov esi, ref_00029b3c  ; mov esi, 0x29b3c
+xor edi, edi
+
+loc_0001621d:
+cmp edi, dword [ref_00029cb0]  ; cmp edi, dword [0x29cb0]
+jae short loc_00016267  ; jae 0x16267
+push eax
+add esi, 0xc
+push eax
+push dword [ebx + 4]
+push dword [esi + 0x7c]
+call fcn_00016ee8  ; call 0x16ee8
+add esp, 0x10
+test al, al
+je short loc_00016264  ; je 0x16264
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001625a  ; je 0x1625a
+push esi
+push ref_00020584  ; push 0x20584
+push ref_00025491  ; push 0x25491
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001625a:
+mov eax, dword [ebx + 4]
+call fcn_000161af  ; call 0x161af
+jmp short loc_00016267  ; jmp 0x16267
+
+loc_00016264:
+inc edi
+jmp short loc_0001621d  ; jmp 0x1621d
+
+loc_00016267:
+cmp edi, dword [ref_00029cb0]  ; cmp edi, dword [0x29cb0]
+jne short loc_000162a4  ; jne 0x162a4
+cmp edi, 0x13
+jbe short loc_0001629c  ; jbe 0x1629c
+call fcn_00015479  ; call 0x15479
+mov ebx, 0x80000009
+test al, al
+je short loc_000162fc  ; je 0x162fc
+push ecx
+push ref_00020584  ; push 0x20584
+push ref_000254a5  ; push 0x254a5
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp short loc_000162fc  ; jmp 0x162fc
+
+loc_0001629c:
+lea eax, [edi + 1]
+mov dword [ref_00029cb0], eax  ; mov dword [0x29cb0], eax
+
+loc_000162a4:
+imul edi, edi, 0xc
+mov ecx, 3
+mov esi, ebx
+add edi, ref_00029bc0  ; add edi, 0x29bc0
+rep movsd  ; rep movsd dword es:[edi], dword ptr [esi]
+mov edi, ref_00029cb4  ; mov edi, 0x29cb4
+xor esi, esi
+
+loc_000162bd:
+cmp esi, dword [ref_00029da4]  ; cmp esi, dword [0x29da4]
+jae short loc_000162ed  ; jae 0x162ed
+push edx
+push edx
+push dword [ebx + 4]
+push dword [edi + 4]
+call fcn_00016ee8  ; call 0x16ee8
+add esp, 0x10
+test al, al
+je short loc_000162e7  ; je 0x162e7
+push eax
+push dword [ebx + 8]
+push edi
+push dword [ebp + 8]
+call dword [edi + 8]  ; ucall
+add esp, 0x10
+
+loc_000162e7:
+inc esi
+add edi, 0xc
+jmp short loc_000162bd  ; jmp 0x162bd
+
+loc_000162ed:
+mov eax, dword [ebx]
+add ebx, 0xc
+test eax, eax
+jns near loc_00016216  ; jns 0x16216
+xor ebx, ebx
+
+loc_000162fc:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00016306:
+push ebp
+mov ebp, esp
+push edi
+push esi
+mov esi, ref_00029bc0  ; mov esi, 0x29bc0
+push ebx
+xor ebx, ebx
+sub esp, 0xc
+
+loc_00016316:
+cmp ebx, dword [ref_00029cb0]  ; cmp ebx, dword [0x29cb0]
+jae short loc_00016346  ; jae 0x16346
+push eax
+mov edi, esi
+push eax
+add esi, 0xc
+push dword [esi - 8]
+push dword [ebp + 0xc]
+call fcn_00016ee8  ; call 0x16ee8
+add esp, 0x10
+test al, al
+je short loc_00016343  ; je 0x16343
+mov eax, dword [ebp + 0x18]
+mov edx, dword [edi + 8]
+mov dword [eax], edx
+xor eax, eax
+jmp short loc_00016374  ; jmp 0x16374
+
+loc_00016343:
+inc ebx
+jmp short loc_00016316  ; jmp 0x16316
+
+loc_00016346:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00016367  ; je 0x16367
+push ebx
+push ref_0002056c  ; push 0x2056c
+push ref_000254c0  ; push 0x254c0
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00016367:
+mov eax, dword [ebp + 0xc]
+call fcn_000161af  ; call 0x161af
+mov eax, 0x8000000e
+
+loc_00016374:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001637c:
+push ebp
+xor eax, eax
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ref_00029da4]  ; mov ebx, dword [0x29da4]
+imul edx, ebx, 0xc
+
+loc_00016390:
+cmp ebx, 0x13
+jbe short loc_000163b5  ; jbe 0x163b5
+call fcn_00015479  ; call 0x15479
+mov esi, 0x80000009
+test al, al
+je short loc_000163fc  ; je 0x163fc
+push eax
+push ref_00020578  ; push 0x20578
+push ref_000254dd  ; push 0x254dd
+push 0x80000000
+jmp short loc_000163f4  ; jmp 0x163f4
+
+loc_000163b5:
+mov esi, dword [ebp + 0xc]
+inc ebx
+mov ecx, 3
+mov dword [ref_00029da4], ebx  ; mov dword [0x29da4], ebx
+lea edi, [eax + edx + ref_00029cb4]  ; lea edi, [eax + edx + 0x29cb4]
+add esi, eax
+rep movsd  ; rep movsd dword es:[edi], dword ptr [esi]
+mov edi, dword [ebp + 0xc]
+mov ecx, dword [edi + eax]
+add eax, 0xc
+test ecx, ecx
+jns short loc_00016390  ; jns 0x16390
+call fcn_00015479  ; call 0x15479
+xor esi, esi
+test al, al
+je short loc_000163fc  ; je 0x163fc
+push ebx
+push ref_00020578  ; push 0x20578
+push ref_000254fd  ; push 0x254fd
+push 0x40
+
+loc_000163f4:
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000163fc:
+lea esp, [ebp - 0xc]
+mov eax, esi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00016406:
+push ebp
+mov eax, ref_00029b3c  ; mov eax, 0x29b3c
+mov ebp, esp
+pop ebp
+ret
+
+fcn_00016410:
+push ebp
+mov eax, dword [ref_00029bbc]  ; mov eax, dword [0x29bbc]
+mov ebp, esp
+pop ebp
+ret
+
+fcn_0001641a:
+mov eax, dword [ref_00029dac]  ; mov eax, dword [0x29dac]
+push ebp
+mov ebp, esp
+mov edx, dword [ebp + 8]
+test eax, eax
+je short loc_00016432  ; je 0x16432
+movzx edx, dl
+mov dword [ebp + 8], edx
+pop ebp
+jmp eax
+
+loc_00016432:
+pop ebp
+ret
+
+fcn_00016434:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+mov eax, dword [ebx]
+cmp eax, 0x16
+je short loc_0001645b  ; je 0x1645b
+push ebx
+push 0x16
+push eax
+push ref_0002550e  ; push 0x2550e
+call fcn_0001545e  ; call 0x1545e
+add esp, 0x10
+xor eax, eax
+jmp near loc_000165b4  ; jmp 0x165b4
+
+loc_0001645b:
+mov eax, dword [ebx + 0xca]
+push ecx
+push ecx
+push 0x270
+push ref_00029b3c  ; push 0x29b3c
+mov dword [ref_00029dac], eax  ; mov dword [0x29dac], eax
+call fcn_00016fff  ; call 0x16fff
+add esp, 0x10
+mov dword [ref_00029bbc], ebx  ; mov dword [0x29bbc], ebx
+cmp dword [ebx + 8], 3
+mov dword [ref_00029b3c], 0xfeaddeaf  ; mov dword [0x29b3c], 0xfeaddeaf
+jne short loc_000164b5  ; jne 0x164b5
+cmp dword [ebx + 0x8f6], 0
+je short loc_000164b5  ; je 0x164b5
+sub esp, 0xc
+push ref_00025532  ; push 0x25532
+call fcn_0001545e  ; call 0x1545e
+add esp, 0x10
+mov dword [ref_00029bb8], 0x11  ; mov dword [0x29bb8], 0x11
+jmp short loc_000164bf  ; jmp 0x164bf
+
+loc_000164b5:
+mov dword [ref_00029bb8], 6  ; mov dword [0x29bb8], 6
+
+loc_000164bf:
+sub esp, 0xc
+push ref_00029b38  ; push 0x29b38
+mov dword [ref_00029bc4], ref_0002909c  ; mov dword [0x29bc4], 0x2909c
+mov dword [ref_00029cb0], 1  ; mov dword [0x29cb0], 1
+mov dword [ref_00029b60], fcn_00016306  ; mov dword [0x29b60], 0x16306
+mov dword [ref_00029b68], fcn_0001617e  ; mov dword [0x29b68], 0x1617e
+mov dword [ref_00029b6c], fcn_00016190  ; mov dword [0x29b6c], 0x16190
+mov dword [ref_00029b70], fcn_0001d569  ; mov dword [0x29b70], 0x1d569
+mov dword [ref_00029b74], fcn_0001d49f  ; mov dword [0x29b74], 0x1d49f
+mov dword [ref_00029b64], fcn_0001637c  ; mov dword [0x29b64], 0x1637c
+mov dword [ref_00029b58], fcn_0001620a  ; mov dword [0x29b58], 0x1620a
+mov dword [ref_00029b8c], fcn_0001d415  ; mov dword [0x29b8c], 0x1d415
+mov dword [ref_00029b90], fcn_000161a6  ; mov dword [0x29b90], 0x161a6
+mov dword [ref_00029bb4], fcn_0001619f  ; mov dword [0x29bb4], 0x1619f
+mov dword [ref_00029b38], ref_00029b40  ; mov dword [0x29b38], 0x29b40
+call fcn_00019afc  ; call 0x19afc
+pop eax
+pop edx
+push ref_00029b38  ; push 0x29b38
+push 0
+call fcn_0001ae82  ; call 0x1ae82
+mov dword [esp], ref_00025542  ; mov dword [esp], 0x25542
+call fcn_0001545e  ; call 0x1545e
+pop ecx
+pop ebx
+push ref_00029b38  ; push 0x29b38
+push 0
+call fcn_00016cfa  ; call 0x16cfa
+mov dword [esp], ref_00025557  ; mov dword [esp], 0x25557
+call fcn_0001545e  ; call 0x1545e
+pop eax
+pop edx
+push ref_00029b38  ; push 0x29b38
+push 0
+call fcn_000165cb  ; call 0x165cb
+pop ecx
+pop ebx
+push ref_00029b38  ; push 0x29b38
+push 0
+call fcn_0001b96b  ; call 0x1b96b
+pop eax
+pop edx
+push ref_00029b38  ; push 0x29b38
+push 0
+call fcn_0001b0c6  ; call 0x1b0c6
+add esp, 0x10
+mov eax, ref_00029b38  ; mov eax, 0x29b38
+
+loc_000165b4:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000165b9:
+push ebp
+mov ebp, esp
+sub esp, 0x14
+push dword [ebp + 0x10]
+call fcn_0001bb03  ; call 0x1bb03
+xor eax, eax
+leave
+ret
+
+fcn_000165cb:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x10
+push ref_00029028  ; push 0x29028
+call fcn_0001972b  ; call 0x1972b
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00016620  ; je 0x16620
+test ebx, ebx
+jns short loc_00016620  ; jns 0x16620
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001660b  ; je 0x1660b
+push edx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001660b:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x42
+push ref_0002556e  ; push 0x2556e
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00016620:
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00016627:
+push ebp
+xor eax, eax
+mov ebp, esp
+pop ebp
+ret
+
+fcn_0001662e:
+push ebp
+mov ebp, esp
+pop ebp
+ret
+
+fcn_00016633:
+push ebp
+mov ebp, esp
+pop ebp
+ret
+
+fcn_00016638:
+push ebp
+mov ebp, esp
+push edi
+push esi
+mov esi, edx
+push ebx
+sub esp, 0x2c
+mov edx, dword [ebp + 8]
+mov word [ebp - 0x2a], cx
+mov dword [ebp - 0x1c], 0x80000007
+test esi, esi
+je near loc_00016701  ; je 0x16701
+cmp cx, 0x1ff
+ja near loc_00016701  ; ja 0x16701
+mov edi, edx
+movzx edx, dx
+add edx, ecx
+cmp edx, 0x1ff
+jg near loc_00016701  ; jg 0x16701
+lea ecx, [edi + esi]
+movzx eax, al
+mov ebx, esi
+mov word [ebp - 0x2c], cx
+mov dword [ebp - 0x30], eax
+
+loc_00016686:
+cmp word [ebp - 0x2c], bx
+je short loc_000166fa  ; je 0x166fa
+mov dx, word [ebp - 0x2a]
+mov edi, dword [ebp + 0xc]
+sub edx, esi
+movzx ecx, byte [edi]
+add edx, ebx
+mov eax, edx
+shr ax, 8
+cmp ax, cx
+je short loc_000166ab  ; je 0x166ab
+mov byte [edi], al
+mov al, 1
+jmp short loc_000166ad  ; jmp 0x166ad
+
+loc_000166ab:
+xor eax, eax
+
+loc_000166ad:
+dec al
+movzx edi, dl
+jne short loc_000166d2  ; jne 0x166d2
+mov eax, dword [ebp + 0xc]
+cmp byte [eax], 1
+push edx
+lea edx, [ebp - 0x1c]
+sbb eax, eax
+push edx
+and eax, 0xfffffffe
+push 0
+add eax, 0x6e
+push eax
+call fcn_0001a2fa  ; call 0x1a2fa
+add esp, 0x10
+
+loc_000166d2:
+shl edi, 8
+push eax
+or edi, dword [ebp - 0x30]
+push eax
+lea eax, [ebp - 0x1c]
+push eax
+push edi
+mov dword [ebp - 0x34], ebx
+inc ebx
+call fcn_0001a282  ; call 0x1a282
+add esp, 0x10
+mov edx, dword [ebp - 0x34]
+mov byte [ebx - 1], al
+cmp dword [ebp - 0x1c], 0
+je short loc_00016686  ; je 0x16686
+mov byte [edx], 0
+
+loc_000166fa:
+mov dword [ebp - 0x1c], 0
+
+loc_00016701:
+mov eax, dword [ebp - 0x1c]
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001670c:
+push ebp
+mov ecx, 2
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x34
+mov esi, dword [ebp + 0x10]
+movzx eax, byte [ebp + 0xc]
+lea edi, [ebp - 0x19]
+push edi
+push 1
+lea edx, [esi + 2]
+mov byte [ebp - 0x19], 0xff
+mov dword [ebp - 0x30], eax
+call fcn_00016638  ; call 0x16638
+add esp, 0x10
+mov esi, eax
+test eax, eax
+jne short loc_000167a0  ; jne 0x167a0
+mov eax, dword [ebp + 0x18]
+xor edx, edx
+mov ecx, dword [ebp + 8]
+mov dword [ebp - 0x2c], 1
+mov ebx, dword [ebp + 0x14]
+shl dword [ebp - 0x2c], cl
+mov ecx, 5
+div ecx
+lea eax, [eax + eax*4]
+add eax, ebx
+mov dword [ebp - 0x34], eax
+
+loc_00016763:
+cmp ebx, dword [ebp - 0x34]
+je short loc_000167a0  ; je 0x167a0
+movzx eax, byte [ebx + 4]
+test dword [ebp - 0x2c], eax
+je short loc_0001679b  ; je 0x1679b
+push eax
+mov edx, dword [ebp + 0x10]
+push eax
+movzx ecx, word [ebx]
+push edi
+mov ax, word [ebx + 2]
+add edx, ecx
+inc eax
+sub ax, word [ebx]
+movzx eax, ax
+push eax
+mov eax, dword [ebp - 0x30]
+call fcn_00016638  ; call 0x16638
+add esp, 0x10
+test eax, eax
+je short loc_0001679b  ; je 0x1679b
+mov esi, eax
+jmp short loc_000167a0  ; jmp 0x167a0
+
+loc_0001679b:
+add ebx, 5
+jmp short loc_00016763  ; jmp 0x16763
+
+loc_000167a0:
+test esi, esi
+sete al
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000167ad:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000167ce  ; je 0x167ce
+push eax
+push eax
+push dword [ebp + 8]
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000167ce:
+leave
+ret
+
+fcn_000167d0:
+push ebp
+mov ebp, esp
+mov edx, dword [ebp + 0x10]
+movzx eax, byte [ebp + 0x14]
+and edx, 7
+shl edx, 8
+or eax, 0x80000000
+or eax, edx
+movzx edx, byte [ebp + 8]
+shl edx, 0x10
+or eax, edx
+movzx edx, byte [ebp + 0xc]
+pop ebp
+shl edx, 0xb
+movzx edx, dx
+or eax, edx
+ret
+
+fcn_000167fe:
+push ebp
+mov ebp, esp
+movzx eax, byte [ebp + 0x10]
+movzx edx, byte [ebp + 0x14]
+shl eax, 0xc
+add edx, eax
+movzx eax, byte [ebp + 0xc]
+shl eax, 0xf
+add edx, eax
+movzx eax, byte [ebp + 8]
+pop ebp
+shl eax, 0x14
+add eax, edx
+ret
+
+fcn_00016822:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0xc
+mov edx, dword [ebp + 8]
+mov al, dl
+mov bl, dl
+sar al, 7
+and edx, 0x7f
+and eax, 2
+add eax, 0x74
+push edx
+movzx eax, al
+sar bl, 7
+push eax
+and ebx, 2
+call fcn_00018eea  ; call 0x18eea
+add ebx, 0x75
+add esp, 0x10
+movzx ebx, bl
+mov dword [ebp + 8], ebx
+mov ebx, dword [ebp - 4]
+leave
+jmp near fcn_00018ee1  ; jmp 0x18ee1
+
+fcn_00016861:
+push ebp
+mov edx, 0xfffff
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+
+loc_00016878:
+push ecx
+push ecx
+push 0xa
+push 0x70
+mov dword [ebp - 0x1c], edx
+call fcn_00018eea  ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1  ; call 0x18ee1
+add esp, 0x10
+mov edx, dword [ebp - 0x1c]
+test al, al
+jns short loc_000168a1  ; jns 0x168a1
+dec edx
+jne short loc_00016878  ; jne 0x16878
+jmp short loc_000168a5  ; jmp 0x168a5
+
+loc_000168a1:
+test edx, edx
+jne short loc_0001691b  ; jne 0x1691b
+
+loc_000168a5:
+push eax
+push eax
+push 0xb
+push 0x70
+call fcn_00018eea  ; call 0x18eea
+pop eax
+pop edx
+push 0x82
+push 0x71
+call fcn_00018eea  ; call 0x18eea
+pop ecx
+pop eax
+push 0xa
+push 0x70
+call fcn_00018eea  ; call 0x18eea
+pop eax
+pop edx
+push 0x26
+push 0x71
+call fcn_00018eea  ; call 0x18eea
+pop ecx
+pop eax
+push 0xc
+push 0x70
+call fcn_00018eea  ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1  ; call 0x18ee1
+pop eax
+pop edx
+push 0xd
+push 0x70
+call fcn_00018eea  ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1  ; call 0x18ee1
+pop ecx
+pop eax
+push 0xb
+push 0x70
+call fcn_00018eea  ; call 0x18eea
+pop eax
+pop edx
+push 2
+push 0x71
+call fcn_00018eea  ; call 0x18eea
+add esp, 0x10
+
+loc_0001691b:
+push eax
+push eax
+push 0
+push 0x70
+call fcn_00018eea  ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1  ; call 0x18ee1
+mov byte [edi], al
+pop edx
+pop ecx
+push 2
+push 0x70
+call fcn_00018eea  ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1  ; call 0x18ee1
+mov byte [esi], al
+pop eax
+pop edx
+push 4
+push 0x70
+call fcn_00018eea  ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1  ; call 0x18ee1
+mov byte [ebx], al
+pop ecx
+pop eax
+push 7
+push 0x70
+call fcn_00018eea  ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1  ; call 0x18ee1
+mov edx, dword [ebp + 0x14]
+mov byte [edx], al
+pop eax
+pop edx
+push 8
+push 0x70
+call fcn_00018eea  ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1  ; call 0x18ee1
+mov edx, dword [ebp + 0x18]
+mov byte [edx], al
+pop ecx
+pop eax
+push 9
+push 0x70
+call fcn_00018eea  ; call 0x18eea
+mov dword [esp], 0x71
+call fcn_00018ee1  ; call 0x18ee1
+mov edx, dword [ebp + 0x1c]
+movzx eax, al
+mov word [edx], ax
+mov cl, byte [edi]
+mov dl, 0xa
+mov al, cl
+and ecx, 0xf
+shr al, 4
+imul eax, edx
+add eax, ecx
+mov byte [edi], al
+mov cl, byte [esi]
+mov edi, dword [ebp + 0x1c]
+mov al, cl
+and ecx, 0xf
+shr al, 4
+imul eax, edx
+add eax, ecx
+mov byte [esi], al
+mov cl, byte [ebx]
+mov esi, dword [ebp + 0x18]
+mov al, cl
+and ecx, 0xf
+shr al, 4
+imul eax, edx
+add eax, ecx
+mov byte [ebx], al
+mov eax, dword [ebp + 0x14]
+mov ebx, dword [ebp + 0x14]
+mov cl, byte [eax]
+mov al, cl
+and ecx, 0xf
+shr al, 4
+imul eax, edx
+add eax, ecx
+mov byte [ebx], al
+mov eax, dword [ebp + 0x18]
+mov cl, byte [eax]
+mov al, cl
+and ecx, 0xf
+shr al, 4
+imul eax, edx
+add eax, ecx
+mov byte [esi], al
+mov eax, dword [ebp + 0x1c]
+mov ax, word [eax]
+mov edx, eax
+and edx, 0xf
+shr ax, 4
+add esp, 0x10
+and eax, 0xf
+imul eax, eax, 0xa
+lea eax, [edx + eax + 0x7d0]
+mov word [edi], ax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00016a4e:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x10
+push 0xce
+call fcn_000175bc  ; call 0x175bc
+add esp, 0x10
+xor edx, edx
+movzx ebx, ah
+xor eax, eax
+imul ebx, ebx, 0x186a0
+test ebx, ebx
+je short loc_00016a84  ; je 0x16a84
+call fcn_00017876  ; call 0x17876
+push ecx
+push ebx
+push edx
+push eax
+call fcn_000174b9  ; call 0x174b9
+add esp, 0x10
+
+loc_00016a84:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00016a89:
+push ebp
+xor edx, edx
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov ecx, dword [ebp + 0x10]
+
+loc_00016a94:
+cmp edx, dword [ebp + 0xc]
+je short loc_00016aa0  ; je 0x16aa0
+mov word [eax + edx*2], cx
+inc edx
+jmp short loc_00016a94  ; jmp 0x16a94
+
+loc_00016aa0:
+pop ebp
+ret
+
+fcn_00016aa2:
+push ebp
+xor edx, edx
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov ecx, dword [ebp + 0x10]
+
+loc_00016aad:
+cmp edx, dword [ebp + 0xc]
+je short loc_00016ab8  ; je 0x16ab8
+mov dword [eax + edx*4], ecx
+inc edx
+jmp short loc_00016aad  ; jmp 0x16aad
+
+loc_00016ab8:
+pop ebp
+ret
+
+fcn_00016aba:
+push ebp
+mov ebp, esp
+push edi
+sub esp, 0x24
+mov eax, dword [ebp + 8]
+mov dword [ebp - 0x18], 0
+mov dword [ebp - 0x14], 0
+mov dword [ebp - 0x20], eax
+lea eax, [ebp - 0x10]
+mov dword [ebp - 0x1c], eax
+movq qword [ebp - 0x18], mm0
+mov edi, dword [ebp - 0x20]
+movq mm0, qword [edi]
+mov edi, dword [ebp - 0x1c]
+movq qword [edi], mm0
+movq mm0, qword [ebp - 0x18]
+emms
+mov eax, dword [ebp - 0x10]
+mov edx, dword [ebp - 0xc]
+add esp, 0x24
+pop edi
+pop ebp
+ret
+
+fcn_00016afd:
+push ebp
+mov ebp, esp
+push edi
+sub esp, 0x1c
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x10], 0
+mov dword [ebp - 0xc], 0
+mov dword [ebp - 0x20], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 8]
+mov dword [ebp - 0x14], eax
+movq qword [ebp - 0x10], mm0
+mov edi, dword [ebp - 0x14]
+movq mm0, qword [ebp - 0x20]
+movq qword [edi], mm0
+movq mm0, qword [ebp - 0x10]
+emms
+mov eax, dword [ebp - 0x20]
+mov edx, dword [ebp - 0x1c]
+add esp, 0x1c
+pop edi
+pop ebp
+ret
+
+fcn_00016b44:
+push ebp
+xor eax, eax
+mov ebp, esp
+push ebx
+mov ebx, 0x186a0
+sub esp, 0x14
+
+loc_00016b52:
+test eax, eax
+jne short loc_00016b9f  ; jne 0x16b9f
+test ebx, ebx
+je short loc_00016b9f  ; je 0x16b9f
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00016b74  ; je 0x16b74
+push edx
+push edx
+push ref_00025576  ; push 0x25576
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00016b74:
+clc
+
+loc_00016b75:
+rdrand eax
+mov dword [ebp - 0xc], eax
+jae short loc_00016b75  ; jae 0x16b75
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00016b99  ; je 0x16b99
+push eax
+push dword [ebp - 0xc]
+push ref_00025593  ; push 0x25593
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00016b99:
+mov eax, dword [ebp - 0xc]
+dec ebx
+jmp short loc_00016b52  ; jmp 0x16b52
+
+loc_00016b9f:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00016ba4:
+push ebp
+xor eax, eax
+mov ebp, esp
+pop ebp
+ret
+
+fcn_00016bab:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x14]
+pop ebp
+ret
+
+fcn_00016bb3:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+cmp dword [ebp + 0xc], 0x41
+mov edx, dword [eax + 0x241b]
+mov edx, dword [edx + 0x1e]
+jne short loc_00016bd8  ; jne 0x16bd8
+sub esp, 0xc
+push eax
+call dword [edx + 0xcc]  ; ucall
+add esp, 0x10
+
+loc_00016bd8:
+xor eax, eax
+leave
+ret
+
+fcn_00016bdc:
+push ebp
+mov ebp, esp
+mov edx, dword [ebp + 8]
+mov eax, dword [ebp + 0xc]
+push esi
+push ebx
+mov word [edx + 0x2468], ax
+movzx esi, ax
+mov ebx, eax
+push edx
+push edx
+push esi
+push 0x80
+call fcn_00018f27  ; call 0x18f27
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00016c1d  ; je 0x16c1d
+push eax
+push esi
+push ref_000255b1  ; push 0x255b1
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00016c1d:
+sub esp, 0xc
+push 0x48
+call fcn_00016822  ; call 0x16822
+mov dword [esp], 0x49
+mov esi, eax
+call fcn_00016822  ; call 0x16822
+add esp, 0x10
+mov edx, eax
+mov eax, esi
+shl edx, 8
+movzx esi, al
+or edx, esi
+cmp bx, dx
+je short loc_00016c1d  ; je 0x16c1d
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00016c50:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00016c72  ; je 0x16c72
+push eax
+push dword [ebp + 0xc]
+push ref_000255c3  ; push 0x255c3
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00016c72:
+push eax
+mov eax, 0x1000
+in al, 0x99
+pop eax
+leave
+ret
+
+fcn_00016c7d:
+push ebp
+mov ebp, esp
+push ebx
+mov edx, cr4
+mov eax, edx
+or eax, 0x4000
+mov cr4, eax
+xor eax, eax
+mov ebx, eax
+getsec
+mov cr4, edx
+pop ebx
+pop ebp
+ret
+
+fcn_00016c9a:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+call fcn_00016410  ; call 0x16410
+mov ebx, dword [eax + 0x14]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00016cdd  ; je 0x16cdd
+cmp dword [ebp + 8], 0xff
+ja short loc_00016cc5  ; ja 0x16cc5
+cmp dword [ebp + 0xc], 0x1f
+ja short loc_00016cc5  ; ja 0x16cc5
+cmp dword [ebp + 0x10], 7
+jbe short loc_00016cdd  ; jbe 0x16cdd
+
+loc_00016cc5:
+push eax
+push ref_00025603  ; push 0x25603
+push 0x31a
+push ref_0002563a  ; push 0x2563a
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00016cdd:
+mov eax, dword [ebp + 0x10]
+mov edx, dword [ebp + 0xc]
+shl eax, 0xc
+add eax, ebx
+mov ebx, dword [ebp - 4]
+shl edx, 0xf
+add eax, edx
+mov edx, dword [ebp + 8]
+leave
+shl edx, 0x14
+add eax, edx
+ret
+
+fcn_00016cfa:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+mov ebx, dword [ebp + 0xc]
+sub esp, 0xc
+push ebx
+call fcn_0001dfb2  ; call 0x1dfb2
+mov esi, eax
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00016d2a  ; je 0x16d2a
+push ecx
+push ecx
+push ref_00025655  ; push 0x25655
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00016d2a:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00016d69  ; je 0x16d69
+test esi, esi
+jns short loc_00016d69  ; jns 0x16d69
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00016d54  ; je 0x16d54
+push edx
+push esi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00016d54:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x33
+push ref_00025683  ; push 0x25683
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00016d69:
+sub esp, 0xc
+push ebx
+call fcn_0001ecfb  ; call 0x1ecfb
+mov esi, eax
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00016d91  ; je 0x16d91
+push eax
+push eax
+push ref_000256b9  ; push 0x256b9
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00016d91:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00016dd0  ; je 0x16dd0
+test esi, esi
+jns short loc_00016dd0  ; jns 0x16dd0
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00016dbb  ; je 0x16dbb
+push eax
+push esi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00016dbb:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x3a
+push ref_00025683  ; push 0x25683
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00016dd0:
+sub esp, 0xc
+push ebx
+call fcn_0001ef8b  ; call 0x1ef8b
+mov esi, eax
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00016df8  ; je 0x16df8
+push eax
+push eax
+push ref_000256e7  ; push 0x256e7
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00016df8:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00016e37  ; je 0x16e37
+test esi, esi
+jns short loc_00016e37  ; jns 0x16e37
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00016e22  ; je 0x16e22
+push eax
+push esi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00016e22:
+push esi
+push ref_000206f4  ; push 0x206f4
+push 0x43
+push ref_00025683  ; push 0x25683
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00016e37:
+sub esp, 0xc
+push ebx
+call fcn_0001d586  ; call 0x1d586
+mov ebx, eax
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_00016e5f  ; je 0x16e5f
+push ecx
+push ecx
+push ref_00025714  ; push 0x25714
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00016e5f:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00016e9e  ; je 0x16e9e
+test ebx, ebx
+jns short loc_00016e9e  ; jns 0x16e9e
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00016e89  ; je 0x16e89
+push edx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00016e89:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x4a
+push ref_00025683  ; push 0x25683
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00016e9e:
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00016ea7:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push esi
+add esi, 8
+call fcn_000173ed  ; call 0x173ed
+add esp, 0xc
+push edx
+push eax
+push ebx
+call fcn_00017424  ; call 0x17424
+mov dword [esp], esi
+call fcn_000173ed  ; call 0x173ed
+add esp, 0xc
+push edx
+push eax
+lea eax, [ebx + 8]
+push eax
+call fcn_00017424  ; call 0x17424
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00016ee8:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov esi, dword [ebp + 8]
+push esi
+add esi, 8
+call fcn_000173ed  ; call 0x173ed
+mov ebx, eax
+pop eax
+push dword [ebp + 0xc]
+mov dword [ebp - 0x1c], edx
+call fcn_000173ed  ; call 0x173ed
+mov dword [esp], esi
+mov dword [ebp - 0x20], eax
+mov dword [ebp - 0x24], edx
+call fcn_000173ed  ; call 0x173ed
+mov edi, eax
+mov eax, dword [ebp + 0xc]
+mov esi, edx
+add eax, 8
+mov dword [esp], eax
+call fcn_000173ed  ; call 0x173ed
+mov ecx, dword [ebp - 0x1c]
+add esp, 0x10
+xor eax, edi
+xor edx, esi
+or eax, edx
+sete al
+xor ebx, dword [ebp - 0x20]
+xor ecx, dword [ebp - 0x24]
+or ebx, ecx
+sete dl
+lea esp, [ebp - 0xc]
+and eax, edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00016f4f:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00016f80  ; je 0x16f80
+test bl, 3
+je short loc_00016f80  ; je 0x16f80
+push eax
+push ref_0002574a  ; push 0x2574a
+push 0x81
+push ref_0002577c  ; push 0x2577c
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00016f80:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00016fa9  ; je 0x16fa9
+mov eax, ebx
+neg eax
+cmp esi, eax
+jbe short loc_00016fa9  ; jbe 0x16fa9
+push ecx
+push ref_000257be  ; push 0x257be
+push 0x82
+push ref_0002577c  ; push 0x2577c
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00016fa9:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00016fd2  ; je 0x16fd2
+test esi, 0xf
+je short loc_00016fd2  ; je 0x16fd2
+push edx
+push ref_000257e9  ; push 0x257e9
+push 0x83
+push ref_0002577c  ; push 0x2577c
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00016fd2:
+and esi, 0xfffffff0
+add esi, ebx
+
+loc_00016fd7:
+cmp ebx, esi
+jae short loc_00016ff2  ; jae 0x16ff2
+push eax
+push eax
+push dword [ebp + 0x10]
+push ebx
+call fcn_00016ee8  ; call 0x16ee8
+add esp, 0x10
+test al, al
+jne short loc_00016ff6  ; jne 0x16ff6
+add ebx, 0x10
+jmp short loc_00016fd7  ; jmp 0x16fd7
+
+loc_00016ff2:
+xor eax, eax
+jmp short loc_00016ff8  ; jmp 0x16ff8
+
+loc_00016ff6:
+mov eax, ebx
+
+loc_00016ff8:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00016fff:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017030  ; je 0x17030
+test ebx, ebx
+jne short loc_00017030  ; jne 0x17030
+test esi, esi
+je short loc_00017030  ; je 0x17030
+push edx
+push ref_00025811  ; push 0x25811
+push 0x31
+push ref_00025839  ; push 0x25839
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017030:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017056  ; je 0x17056
+mov eax, ebx
+neg eax
+cmp esi, eax
+jbe short loc_00017056  ; jbe 0x17056
+push eax
+push ref_000257be  ; push 0x257be
+push 0x32
+push ref_00025839  ; push 0x25839
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017056:
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], ebx
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near loc_0001721c  ; jmp 0x1721c
+
+fcn_00017067:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov edi, dword [ebp + 0x10]
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+test edi, edi
+je near loc_00017134  ; je 0x17134
+cmp ebx, esi
+je near loc_00017134  ; je 0x17134
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000170ab  ; je 0x170ab
+test ebx, ebx
+jne short loc_000170ab  ; jne 0x170ab
+push eax
+push ref_0002587f  ; push 0x2587f
+push 0x3c
+push ref_000258a1  ; push 0x258a1
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000170ab:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000170cd  ; je 0x170cd
+test esi, esi
+jne short loc_000170cd  ; jne 0x170cd
+push ecx
+push ref_000258ea  ; push 0x258ea
+push 0x3d
+push ref_000258a1  ; push 0x258a1
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000170cd:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000170f6  ; je 0x170f6
+mov eax, ebx
+lea edx, [edi - 1]
+not eax
+cmp edx, eax
+jbe short loc_000170f6  ; jbe 0x170f6
+push edx
+push ref_00025907  ; push 0x25907
+push 0x3e
+push ref_000258a1  ; push 0x258a1
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000170f6:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001711f  ; je 0x1711f
+mov eax, esi
+lea edx, [edi - 1]
+not eax
+cmp edx, eax
+jbe short loc_0001711f  ; jbe 0x1711f
+push eax
+push ref_0002593f  ; push 0x2593f
+push 0x3f
+push ref_000258a1  ; push 0x258a1
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001711f:
+mov dword [ebp + 0x10], edi
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], ebx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_000171c9  ; jmp 0x171c9
+
+loc_00017134:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001713e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 0x10]
+mov ebx, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+test esi, esi
+je short loc_000171bf  ; je 0x171bf
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001717d  ; je 0x1717d
+mov eax, ebx
+lea edx, [esi - 1]
+not eax
+cmp edx, eax
+jbe short loc_0001717d  ; jbe 0x1717d
+push edx
+push ref_00025907  ; push 0x25907
+push 0x38
+push ref_00025972  ; push 0x25972
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001717d:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000171a6  ; je 0x171a6
+mov eax, edi
+lea edx, [esi - 1]
+not eax
+cmp edx, eax
+jbe short loc_000171a6  ; jbe 0x171a6
+push eax
+push ref_0002593f  ; push 0x2593f
+push 0x39
+push ref_00025972  ; push 0x25972
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000171a6:
+cmp ebx, edi
+je short loc_000171bf  ; je 0x171bf
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], edi
+mov dword [ebp + 8], ebx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_000171e6  ; jmp 0x171e6
+
+loc_000171bf:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+loc_000171c9:
+push esi
+push edi
+mov esi, dword [esp + 0xc]
+mov edi, dword [esp + 0x10]
+mov ecx, dword [esp + 0x14]
+repe cmpsb  ; repe cmpsb byte [esi], byte ptr es:[edi]
+movzx eax, byte [esi - 1]
+movzx edx, byte [edi - 1]
+sub eax, edx
+pop edi
+pop esi
+ret
+
+loc_000171e6:
+push esi
+push edi
+mov esi, dword [esp + 0x10]
+mov edi, dword [esp + 0xc]
+mov edx, dword [esp + 0x14]
+cmp edi, esi
+je short loc_00017215  ; je 0x17215
+cmp edx, 0
+je short loc_00017215  ; je 0x17215
+lea eax, [esi + edx - 1]
+cmp esi, edi
+jae short loc_00017210  ; jae 0x17210
+cmp eax, edi
+jb short loc_00017210  ; jb 0x17210
+mov esi, eax
+lea edi, [edi + edx - 1]
+std
+
+loc_00017210:
+mov ecx, edx
+rep movsb  ; rep movsb byte es:[edi], byte ptr [esi]
+cld
+
+loc_00017215:
+mov eax, dword [esp + 0xc]
+pop edi
+pop esi
+ret
+
+loc_0001721c:
+push edi
+xor eax, eax
+mov edi, dword [esp + 8]
+mov ecx, dword [esp + 0xc]
+mov edx, ecx
+shr ecx, 2
+and edx, 3
+push edi
+rep stosd  ; rep stosd dword es:[edi], eax
+mov ecx, edx
+rep stosb  ; rep stosb byte es:[edi], al
+pop eax
+pop edi
+ret
+
+fcn_00017239:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+mov dword [ebp - 4], 0
+
+loc_00017246:
+mov eax, dword [ebp - 4]
+test eax, eax
+je short loc_00017246  ; je 0x17246
+leave
+ret
+
+fcn_0001724f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017284  ; je 0x17284
+cmp ebx, 0x3f
+jbe short loc_00017284  ; jbe 0x17284
+push eax
+push ref_000259b8  ; push 0x259b8
+push 0x27
+push ref_000259c3  ; push 0x259c3
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017284:
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 8], esi
+mov dword [ebp + 0xc], edi
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_000178a0  ; jmp 0x178a0
+
+fcn_00017299:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000172c3  ; je 0x172c3
+test ebx, ebx
+jne short loc_000172c3  ; jne 0x172c3
+push eax
+push ref_0002619a  ; push 0x2619a
+push 0x26
+push ref_000259f8  ; push 0x259f8
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000172c3:
+mov ax, word [ebx]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000172cb:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000172f8  ; je 0x172f8
+test esi, esi
+jne short loc_000172f8  ; jne 0x172f8
+push eax
+push ref_0002619a  ; push 0x2619a
+push 0x41
+push ref_000259f8  ; push 0x259f8
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000172f8:
+mov word [esi], bx
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00017304:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001732e  ; je 0x1732e
+test ebx, ebx
+jne short loc_0001732e  ; jne 0x1732e
+push eax
+push ref_0002619a  ; push 0x2619a
+push 0x59
+push ref_000259f8  ; push 0x259f8
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001732e:
+mov eax, dword [ebx]
+mov ebx, dword [ebp - 4]
+leave
+and eax, 0xffffff
+ret
+
+fcn_0001733a:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017367  ; je 0x17367
+test ebx, ebx
+jne short loc_00017367  ; jne 0x17367
+push eax
+push ref_0002619a  ; push 0x2619a
+push 0x74
+push ref_000259f8  ; push 0x259f8
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017367:
+push esi
+push 0x17
+push 0
+push dword [ebx]
+call fcn_0001f9ae  ; call 0x1f9ae
+mov dword [ebx], eax
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001737e:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000173ab  ; je 0x173ab
+test ebx, ebx
+jne short loc_000173ab  ; jne 0x173ab
+push eax
+push ref_0002619a  ; push 0x2619a
+push 0x8d
+push ref_000259f8  ; push 0x259f8
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000173ab:
+mov eax, dword [ebx]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000173b2:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000173e2  ; je 0x173e2
+test esi, esi
+jne short loc_000173e2  ; jne 0x173e2
+push eax
+push ref_0002619a  ; push 0x2619a
+push 0xa8
+push ref_000259f8  ; push 0x259f8
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000173e2:
+mov dword [esi], ebx
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_000173ed:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001741a  ; je 0x1741a
+test ebx, ebx
+jne short loc_0001741a  ; jne 0x1741a
+push eax
+push ref_0002619a  ; push 0x2619a
+push 0xc0
+push ref_000259f8  ; push 0x259f8
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001741a:
+mov eax, dword [ebx]
+mov edx, dword [ebx + 4]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00017424:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+mov edx, dword [ebp + 0x10]
+mov ebx, dword [ebp + 8]
+mov esi, eax
+mov edi, edx
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001745f  ; je 0x1745f
+test ebx, ebx
+jne short loc_0001745f  ; jne 0x1745f
+push eax
+push ref_0002619a  ; push 0x2619a
+push 0xdb
+push ref_000259f8  ; push 0x259f8
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001745f:
+mov dword [ebx], esi
+mov eax, esi
+mov edx, edi
+mov dword [ebx + 4], edi
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00017470:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000174a4  ; je 0x174a4
+test ebx, ebx
+jne short loc_000174a4  ; jne 0x174a4
+push eax
+push ref_00025a2d  ; push 0x25a2d
+push 0x2b
+push ref_00025a3a  ; push 0x25a3a
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000174a4:
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 8], esi
+mov dword [ebp + 0xc], edi
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_00017557  ; jmp 0x17557
+
+fcn_000174b9:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000174ed  ; je 0x174ed
+test ebx, ebx
+jne short loc_000174ed  ; jne 0x174ed
+push eax
+push ref_00025a2d  ; push 0x25a2d
+push 0x2b
+push ref_00025a6f  ; push 0x25a6f
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000174ed:
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 8], esi
+mov dword [ebp + 0xc], edi
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_0001756c  ; jmp 0x1756c
+
+fcn_00017502:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0x14]
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov dword [ebp - 0x1c], eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001753c  ; je 0x1753c
+test ebx, ebx
+jne short loc_0001753c  ; jne 0x1753c
+push eax
+push ref_00025a2d  ; push 0x25a2d
+push 0x2f
+push ref_00025aa4  ; push 0x25aa4
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001753c:
+mov eax, dword [ebp - 0x1c]
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 8], esi
+mov dword [ebp + 0xc], edi
+mov dword [ebp + 0x14], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_00017581  ; jmp 0x17581
+
+loc_00017557:
+mov eax, dword [esp + 8]
+mov ecx, dword [esp + 0xc]
+xor edx, edx
+div ecx
+mov eax, dword [esp + 4]
+div ecx
+mov eax, edx
+ret
+
+loc_0001756c:
+mov eax, dword [esp + 8]
+mov ecx, dword [esp + 0xc]
+xor edx, edx
+div ecx
+push eax
+mov eax, dword [esp + 8]
+div ecx
+pop edx
+ret
+
+loc_00017581:
+mov ecx, dword [esp + 0xc]
+mov eax, dword [esp + 8]
+xor edx, edx
+div ecx
+push eax
+mov eax, dword [esp + 8]
+div ecx
+mov ecx, dword [esp + 0x14]
+jecxz loc_0001759c  ; jecxz 0x1759c
+mov dword [ecx], edx
+
+loc_0001759c:
+pop edx
+ret
+
+fcn_0001759e:
+push ebp
+mov ebp, esp
+pop ebp
+ret
+
+fcn_000175a3:
+push ebp
+mov ebp, esp
+sti
+pop ebp
+ret
+
+fcn_000175a9:
+push ebp
+mov ebp, esp
+cli
+pop ebp
+ret
+
+fcn_000175af:
+push ebp
+mov ebp, esp
+pause
+pop ebp
+ret
+
+fcn_000175b6:
+push ebp
+mov ebp, esp
+int3
+pop ebp
+ret
+
+fcn_000175bc:
+push ebp
+mov ebp, esp
+mov ecx, dword [ebp + 8]
+rdmsr
+pop ebp
+ret
+
+fcn_000175c6:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0xc]
+mov edx, dword [ebp + 0x10]
+mov ecx, dword [ebp + 8]
+wrmsr
+pop ebp
+ret
+
+fcn_000175d6:
+push ebp
+mov ebp, esp
+pushfd
+pop eax
+pop ebp
+ret
+
+fcn_000175dd:
+push ebp
+mov ebp, esp
+mov eax, cr0
+pop ebp
+ret
+
+fcn_000175e5:
+push ebp
+mov ebp, esp
+mov eax, cr2
+pop ebp
+ret
+
+fcn_000175ed:
+push ebp
+mov ebp, esp
+mov eax, cr3
+pop ebp
+ret
+
+fcn_000175f5:
+push ebp
+mov ebp, esp
+mov eax, cr4
+pop ebp
+ret
+
+fcn_000175fd:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov cr0, eax
+pop ebp
+ret
+
+fcn_00017608:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov cr2, eax
+pop ebp
+ret
+
+fcn_00017613:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov cr3, eax
+pop ebp
+ret
+
+fcn_0001761e:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov cr4, eax
+pop ebp
+ret
+
+fcn_00017629:
+push ebp
+mov ebp, esp
+mov eax, dr0
+pop ebp
+ret
+
+fcn_00017631:
+push ebp
+mov ebp, esp
+mov eax, dr1
+pop ebp
+ret
+
+fcn_00017639:
+push ebp
+mov ebp, esp
+mov eax, dr2
+pop ebp
+ret
+
+fcn_00017641:
+push ebp
+mov ebp, esp
+mov eax, dr3
+pop ebp
+ret
+
+fcn_00017649:
+push ebp
+mov ebp, esp
+mov eax, dr4
+pop ebp
+ret
+
+fcn_00017651:
+push ebp
+mov ebp, esp
+mov eax, dr5
+pop ebp
+ret
+
+fcn_00017659:
+push ebp
+mov ebp, esp
+mov eax, dr6
+pop ebp
+ret
+
+fcn_00017661:
+push ebp
+mov ebp, esp
+mov eax, dr7
+pop ebp
+ret
+
+fcn_00017669:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov dr0, eax
+pop ebp
+ret
+
+fcn_00017674:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov dr1, eax
+pop ebp
+ret
+
+fcn_0001767f:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov dr2, eax
+pop ebp
+ret
+
+fcn_0001768a:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov dr3, eax
+pop ebp
+ret
+
+fcn_00017695:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov dr4, eax
+pop ebp
+ret
+
+fcn_000176a0:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov dr5, eax
+pop ebp
+ret
+
+fcn_000176ab:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov dr6, eax
+pop ebp
+ret
+
+fcn_000176b6:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+mov dr7, eax
+pop ebp
+ret
+
+fcn_000176c1:
+push ebp
+mov ebp, esp
+mov ax, cs
+pop ebp
+ret
+
+fcn_000176c9:
+push ebp
+mov ebp, esp
+mov ax, ds
+pop ebp
+ret
+
+fcn_000176d1:
+push ebp
+mov ebp, esp
+mov ax, es
+pop ebp
+ret
+
+fcn_000176d9:
+push ebp
+mov ebp, esp
+mov ax, fs
+pop ebp
+ret
+
+fcn_000176e1:
+push ebp
+mov ebp, esp
+mov ax, gs
+pop ebp
+ret
+
+fcn_000176e9:
+push ebp
+mov ebp, esp
+mov ax, ds
+pop ebp
+ret
+
+fcn_000176f1:
+push ebp
+mov ebp, esp
+str ax
+pop ebp
+ret
+
+fcn_000176fa:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+sgdt [eax]
+pop ebp
+ret
+
+fcn_00017705:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+lgdt [eax]
+pop ebp
+ret
+
+fcn_00017710:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+sidt [eax]
+pop ebp
+ret
+
+fcn_0001771b:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+lidt [eax]
+pop ebp
+ret
+
+fcn_00017726:
+push ebp
+mov ebp, esp
+sldt ax
+pop ebp
+ret
+
+fcn_0001772f:
+push ebp
+mov ebp, esp
+lldt word [ebp + 8]
+pop ebp
+ret
+
+fcn_00017738:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+fxsave [eax]
+pop ebp
+ret
+
+fcn_00017743:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+fxrstor [eax]
+pop ebp
+ret
+
+fcn_0001774e:
+push ebp
+mov ebp, esp
+push eax
+push eax
+movq qword [esp], mm0
+pop eax
+pop edx
+pop ebp
+ret
+
+fcn_0001775b:
+push ebp
+mov ebp, esp
+push eax
+push eax
+movq qword [esp], mm1
+pop eax
+pop edx
+pop ebp
+ret
+
+fcn_00017768:
+push ebp
+mov ebp, esp
+push eax
+push eax
+movq qword [esp], mm2
+pop eax
+pop edx
+pop ebp
+ret
+
+fcn_00017775:
+push ebp
+mov ebp, esp
+push eax
+push eax
+movq qword [esp], mm3
+pop eax
+pop edx
+pop ebp
+ret
+
+fcn_00017782:
+push ebp
+mov ebp, esp
+push eax
+push eax
+movq qword [esp], mm4
+pop eax
+pop edx
+pop ebp
+ret
+
+fcn_0001778f:
+push ebp
+mov ebp, esp
+push eax
+push eax
+movq qword [esp], mm5
+pop eax
+pop edx
+pop ebp
+ret
+
+fcn_0001779c:
+push ebp
+mov ebp, esp
+push eax
+push eax
+movq qword [esp], mm6
+pop eax
+pop edx
+pop ebp
+ret
+
+fcn_000177a9:
+push ebp
+mov ebp, esp
+push eax
+push eax
+movq qword [esp], mm7
+pop eax
+pop edx
+pop ebp
+ret
+
+fcn_000177b6:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov dword [ebp - 8], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 4], eax
+movq mm0, qword [ebp - 8]
+leave
+ret
+
+fcn_000177ce:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov dword [ebp - 8], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 4], eax
+movq mm1, qword [ebp - 8]
+leave
+ret
+
+fcn_000177e6:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov dword [ebp - 8], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 4], eax
+movq mm2, qword [ebp - 8]
+leave
+ret
+
+fcn_000177fe:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov dword [ebp - 8], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 4], eax
+movq mm3, qword [ebp - 8]
+leave
+ret
+
+fcn_00017816:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov dword [ebp - 8], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 4], eax
+movq mm4, qword [ebp - 8]
+leave
+ret
+
+fcn_0001782e:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov dword [ebp - 8], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 4], eax
+movq mm5, qword [ebp - 8]
+leave
+ret
+
+fcn_00017846:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov dword [ebp - 8], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 4], eax
+movq mm6, qword [ebp - 8]
+leave
+ret
+
+fcn_0001785e:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov eax, dword [ebp + 8]
+mov dword [ebp - 8], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 4], eax
+movq mm7, qword [ebp - 8]
+leave
+ret
+
+fcn_00017876:
+push ebp
+mov ebp, esp
+rdtsc
+pop ebp
+ret
+
+fcn_0001787d:
+push ebp
+mov ebp, esp
+mov ecx, dword [ebp + 8]
+rdpmc
+pop ebp
+ret
+
+fcn_00017887:
+push ebp
+mov ebp, esp
+wbinvd
+pop ebp
+ret
+
+fcn_0001788e:
+push ebp
+mov ebp, esp
+invd
+pop ebp
+ret
+
+fcn_00017895:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+clflush  [eax]
+pop ebp
+ret
+
+loc_000178a0:
+mov cl, byte [esp + 0xc]
+xor edx, edx
+mov eax, dword [esp + 8]
+test cl, 0x20
+cmove edx, eax
+cmove eax, dword [esp + 4]
+shrd eax, edx, cl
+shr edx, cl
+ret
+
+fcn_000178bb:
+push ebp
+mov ebp, esp
+sub esp, 0x14
+push dword [ebp + 8]
+call fcn_000175bc  ; call 0x175bc
+leave
+ret
+
+fcn_000178cb:
+push ebp
+xor edx, edx
+mov ebp, esp
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+push edx
+push eax
+push dword [ebp + 8]
+call fcn_000175c6  ; call 0x175c6
+leave
+ret
+
+fcn_000178e2:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0x10]
+push ebx
+mov ebx, dword [ebp + 0xc]
+sub esp, 0xc
+push dword [ebp + 8]
+call fcn_000178bb  ; call 0x178bb
+add esp, 0x10
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], ebx
+mov dword [ebp + 8], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_0001f7b4  ; jmp 0x1f7b4
+
+fcn_0001790f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_000175bc  ; call 0x175bc
+add esp, 0x10
+mov dword [ebp + 8], edi
+or eax, esi
+or edx, ebx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_000175c6  ; jmp 0x175c6
+
+fcn_00017943:
+push ebp
+xor edx, edx
+mov ebp, esp
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+push edx
+push eax
+push dword [ebp + 8]
+call fcn_0001790f  ; call 0x1790f
+leave
+ret
+
+fcn_0001795a:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_000175bc  ; call 0x175bc
+add esp, 0x10
+mov dword [ebp + 8], edi
+and eax, esi
+and edx, ebx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_000175c6  ; jmp 0x175c6
+
+fcn_0001798e:
+push ebp
+xor edx, edx
+mov ebp, esp
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+push edx
+push eax
+push dword [ebp + 8]
+call fcn_0001795a  ; call 0x1795a
+leave
+ret
+
+fcn_000179a5:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov eax, dword [ebp + 0x14]
+mov ecx, dword [ebp + 0x18]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov esi, dword [ebp + 0x10]
+mov dword [ebp - 0x1c], eax
+mov dword [ebp - 0x20], ecx
+call fcn_000175bc  ; call 0x175bc
+add esp, 0x10
+mov dword [ebp + 8], ebx
+and eax, edi
+and edx, esi
+or eax, dword [ebp - 0x1c]
+or edx, dword [ebp - 0x20]
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_000175c6  ; jmp 0x175c6
+
+fcn_000179eb:
+push ebp
+xor edx, edx
+mov ebp, esp
+sub esp, 0x14
+mov eax, dword [ebp + 0x10]
+push edx
+xor edx, edx
+push eax
+mov eax, dword [ebp + 0xc]
+push edx
+push eax
+push dword [ebp + 8]
+call fcn_000179a5  ; call 0x179a5
+leave
+ret
+
+fcn_00017a09:
+push ebp
+mov ebp, esp
+sub esp, 0x14
+push dword [ebp + 8]
+call fcn_000175bc  ; call 0x175bc
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push edx
+push eax
+call fcn_0001fa1d  ; call 0x1fa1d
+leave
+ret
+
+fcn_00017a26:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ecx, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+push ecx
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x1c], eax
+call fcn_000175bc  ; call 0x175bc
+pop ecx
+pop ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001fd53  ; call 0x1fd53
+mov ecx, dword [ebp - 0x20]
+add esp, 0x20
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_000175c6  ; jmp 0x175c6
+
+fcn_00017a74:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017aa5  ; je 0x17aa5
+cmp ebx, 0x1f
+jbe short loc_00017aa5  ; jbe 0x17aa5
+push edx
+push ref_00025ae2  ; push 0x25ae2
+push 0xe3
+push ref_00025afe  ; push 0x25afe
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017aa5:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017aca  ; je 0x17aca
+cmp esi, ebx
+jbe short loc_00017aca  ; jbe 0x17aca
+push eax
+push ref_00025b30  ; push 0x25b30
+push 0xe4
+push ref_00025afe  ; push 0x25afe
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017aca:
+mov eax, dword [ebp + 0x14]
+sub esp, 0xc
+xor edx, edx
+push edx
+push eax
+push ebx
+push esi
+push dword [ebp + 8]
+call fcn_00017a26  ; call 0x17a26
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00017ae5:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ecx, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+push ecx
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x1c], eax
+call fcn_000175bc  ; call 0x175bc
+pop ecx
+pop ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001faac  ; call 0x1faac
+mov ecx, dword [ebp - 0x20]
+add esp, 0x20
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_000175c6  ; jmp 0x175c6
+
+fcn_00017b33:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017b64  ; je 0x17b64
+cmp ebx, 0x1f
+jbe short loc_00017b64  ; jbe 0x17b64
+push edx
+push ref_00025b43  ; push 0x25b43
+push 0x10c
+push ref_00025afe  ; push 0x25afe
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017b64:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017b89  ; je 0x17b89
+cmp esi, ebx
+jbe short loc_00017b89  ; jbe 0x17b89
+push eax
+push ref_00025b30  ; push 0x25b30
+push 0x10d
+push ref_00025afe  ; push 0x25afe
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017b89:
+mov eax, dword [ebp + 0x14]
+sub esp, 0xc
+xor edx, edx
+push edx
+push eax
+push ebx
+push esi
+push dword [ebp + 8]
+call fcn_00017ae5  ; call 0x17ae5
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00017ba4:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ecx, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+push ecx
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x1c], eax
+call fcn_000175bc  ; call 0x175bc
+pop ecx
+pop ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001fb9e  ; call 0x1fb9e
+mov ecx, dword [ebp - 0x20]
+add esp, 0x20
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_000175c6  ; jmp 0x175c6
+
+fcn_00017bf2:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017c23  ; je 0x17c23
+cmp ebx, 0x1f
+jbe short loc_00017c23  ; jbe 0x17c23
+push edx
+push ref_00025b60  ; push 0x25b60
+push 0x135
+push ref_00025afe  ; push 0x25afe
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017c23:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017c48  ; je 0x17c48
+cmp esi, ebx
+jbe short loc_00017c48  ; jbe 0x17c48
+push eax
+push ref_00025b30  ; push 0x25b30
+push 0x136
+push ref_00025afe  ; push 0x25afe
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017c48:
+mov eax, dword [ebp + 0x14]
+sub esp, 0xc
+xor edx, edx
+push edx
+push eax
+push ebx
+push esi
+push dword [ebp + 8]
+call fcn_00017ba4  ; call 0x17ba4
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00017c63:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov eax, dword [ebp + 0x10]
+mov ecx, dword [ebp + 8]
+mov edi, dword [ebp + 0x20]
+mov edx, dword [ebp + 0x18]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x14]
+mov esi, dword [ebp + 0x1c]
+push ecx
+mov ebx, dword [ebp + 0xc]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x28], eax
+mov dword [ebp - 0x24], edx
+call fcn_000175bc  ; call 0x175bc
+push edi
+push esi
+push dword [ebp - 0x24]
+push dword [ebp - 0x28]
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001fc9c  ; call 0x1fc9c
+mov ecx, dword [ebp - 0x20]
+add esp, 0x30
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_000175c6  ; jmp 0x175c6
+
+fcn_00017cc1:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017cf2  ; je 0x17cf2
+cmp ebx, 0x1f
+jbe short loc_00017cf2  ; jbe 0x17cf2
+push ecx
+push ref_00025b60  ; push 0x25b60
+push 0x163
+push ref_00025afe  ; push 0x25afe
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017cf2:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017d17  ; je 0x17d17
+cmp esi, ebx
+jbe short loc_00017d17  ; jbe 0x17d17
+push edx
+push ref_00025b30  ; push 0x25b30
+push 0x164
+push ref_00025afe  ; push 0x25afe
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017d17:
+push eax
+mov eax, dword [ebp + 0x18]
+xor edx, edx
+push edx
+xor edx, edx
+push eax
+mov eax, dword [ebp + 0x14]
+push edx
+push eax
+push ebx
+push esi
+push dword [ebp + 8]
+call fcn_00017c63  ; call 0x17c63
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00017d37:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017d5b  ; je 0x17d5b
+push eax
+push ref_00022281  ; push 0x22281
+push 0x26
+push ref_00025b7e  ; push 0x25b7e
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017d5b:
+xor eax, eax
+xor edx, edx
+leave
+ret
+
+fcn_00017d61:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017d85  ; je 0x17d85
+push eax
+push ref_00022281  ; push 0x22281
+push 0x41
+push ref_00025b7e  ; push 0x25b7e
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017d85:
+xor eax, eax
+xor edx, edx
+leave
+ret
+
+fcn_00017d8b:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+call fcn_0001759e  ; call 0x1759e
+mov eax, dword [ebp + 8]
+mov bl, byte [eax]
+call fcn_0001759e  ; call 0x1759e
+pop edx
+mov al, bl
+pop ebx
+pop ebp
+ret
+
+fcn_00017da5:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 0xc]
+call fcn_0001759e  ; call 0x1759e
+mov eax, dword [ebp + 8]
+mov byte [eax], bl
+call fcn_0001759e  ; call 0x1759e
+mov al, bl
+pop edx
+pop ebx
+pop ebp
+ret
+
+fcn_00017dc2:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017df0  ; je 0x17df0
+test bl, 1
+je short loc_00017df0  ; je 0x17df0
+push eax
+push ref_00025bba  ; push 0x25bba
+push 0x97
+push ref_00025b7e  ; push 0x25b7e
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017df0:
+call fcn_0001759e  ; call 0x1759e
+mov bx, word [ebx]
+call fcn_0001759e  ; call 0x1759e
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00017e04:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017e38  ; je 0x17e38
+test esi, 1
+je short loc_00017e38  ; je 0x17e38
+push eax
+push ref_00025bba  ; push 0x25bba
+push 0xb7
+push ref_00025b7e  ; push 0x25b7e
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017e38:
+call fcn_0001759e  ; call 0x1759e
+mov word [esi], bx
+call fcn_0001759e  ; call 0x1759e
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00017e4e:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017e7c  ; je 0x17e7c
+test bl, 3
+je short loc_00017e7c  ; je 0x17e7c
+push eax
+push ref_00025bcd  ; push 0x25bcd
+push 0xd7
+push ref_00025b7e  ; push 0x25b7e
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017e7c:
+call fcn_0001759e  ; call 0x1759e
+mov ebx, dword [ebx]
+call fcn_0001759e  ; call 0x1759e
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00017e8f:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017ec3  ; je 0x17ec3
+test esi, 3
+je short loc_00017ec3  ; je 0x17ec3
+push eax
+push ref_00025bcd  ; push 0x25bcd
+push 0xf7
+push ref_00025b7e  ; push 0x25b7e
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017ec3:
+call fcn_0001759e  ; call 0x1759e
+mov dword [esi], ebx
+call fcn_0001759e  ; call 0x1759e
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00017ed8:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x14
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017f08  ; je 0x17f08
+test bl, 7
+je short loc_00017f08  ; je 0x17f08
+push eax
+push ref_00025be0  ; push 0x25be0
+push 0x117
+push ref_00025b7e  ; push 0x25b7e
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017f08:
+call fcn_0001759e  ; call 0x1759e
+mov eax, dword [ebx]
+mov edx, dword [ebx + 4]
+mov dword [ebp - 0x10], eax
+mov dword [ebp - 0xc], edx
+call fcn_0001759e  ; call 0x1759e
+mov eax, dword [ebp - 0x10]
+mov edx, dword [ebp - 0xc]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00017f28:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov eax, dword [ebp + 0xc]
+mov edx, dword [ebp + 0x10]
+mov ebx, dword [ebp + 8]
+mov esi, eax
+mov edi, edx
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00017f64  ; je 0x17f64
+test bl, 7
+je short loc_00017f64  ; je 0x17f64
+push eax
+push ref_00025be0  ; push 0x25be0
+push 0x135
+push ref_00025b7e  ; push 0x25b7e
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00017f64:
+call fcn_0001759e  ; call 0x1759e
+mov dword [ebx], esi
+mov dword [ebx + 4], edi
+call fcn_0001759e  ; call 0x1759e
+lea esp, [ebp - 0xc]
+mov eax, esi
+pop ebx
+mov edx, edi
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00017f7f:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00018ee1  ; call 0x18ee1
+add esp, 0x10
+mov dword [ebp + 8], ebx
+or eax, esi
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00018eea  ; jmp 0x18eea
+
+fcn_00017fac:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00018ee1  ; call 0x18ee1
+add esp, 0x10
+mov dword [ebp + 8], ebx
+and eax, esi
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00018eea  ; jmp 0x18eea
+
+fcn_00017fd9:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00018ee1  ; call 0x18ee1
+add esp, 0x10
+mov dword [ebp + 8], edi
+and eax, esi
+or eax, ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018eea  ; jmp 0x18eea
+
+fcn_0001800d:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0x10]
+push ebx
+mov ebx, dword [ebp + 0xc]
+sub esp, 0xc
+push dword [ebp + 8]
+call fcn_00018ee1  ; call 0x18ee1
+add esp, 0x10
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], ebx
+movzx eax, al
+mov dword [ebp + 8], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_0001f2b6  ; jmp 0x1f2b6
+
+fcn_0001803d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00018ee1  ; call 0x18ee1
+mov edx, dword [ebp - 0x1c]
+mov ecx, esi
+movzx esi, cl
+push esi
+push edx
+push edi
+movzx eax, al
+push eax
+call fcn_0001f4bc  ; call 0x1f4bc
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018eea  ; jmp 0x18eea
+
+fcn_00018087:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00018ee1  ; call 0x18ee1
+mov edx, dword [ebp - 0x1c]
+mov ecx, esi
+movzx esi, cl
+push esi
+push edx
+push edi
+movzx eax, al
+push eax
+call fcn_0001f329  ; call 0x1f329
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018eea  ; jmp 0x18eea
+
+fcn_000180d1:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00018ee1  ; call 0x18ee1
+mov edx, dword [ebp - 0x1c]
+mov ecx, esi
+movzx esi, cl
+push esi
+push edx
+push edi
+movzx eax, al
+push eax
+call fcn_0001f3a4  ; call 0x1f3a4
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018eea  ; jmp 0x18eea
+
+fcn_0001811b:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0x18]
+push ebx
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x1c], ecx
+call fcn_00018ee1  ; call 0x18ee1
+mov ecx, esi
+mov edx, edi
+movzx esi, cl
+mov ecx, dword [ebp - 0x1c]
+movzx edi, dl
+mov edx, dword [ebp - 0x20]
+mov dword [esp], edi
+push esi
+push ecx
+push edx
+movzx eax, al
+push eax
+call fcn_0001f41f  ; call 0x1f41f
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018eea  ; jmp 0x18eea
+
+fcn_00018176:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00018ef6  ; call 0x18ef6
+add esp, 0x10
+mov dword [ebp + 8], ebx
+or eax, esi
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00018f27  ; jmp 0x18f27
+
+fcn_000181a3:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00018ef6  ; call 0x18ef6
+add esp, 0x10
+mov dword [ebp + 8], ebx
+and eax, esi
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00018f27  ; jmp 0x18f27
+
+fcn_000181d0:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00018ef6  ; call 0x18ef6
+add esp, 0x10
+mov dword [ebp + 8], edi
+and eax, esi
+or eax, ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f27  ; jmp 0x18f27
+
+fcn_00018204:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0x10]
+push ebx
+mov ebx, dword [ebp + 0xc]
+sub esp, 0xc
+push dword [ebp + 8]
+call fcn_00018ef6  ; call 0x18ef6
+add esp, 0x10
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], ebx
+movzx eax, ax
+mov dword [ebp + 8], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_0001f53c  ; jmp 0x1f53c
+
+fcn_00018234:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+movzx esi, si
+call fcn_00018ef6  ; call 0x18ef6
+mov edx, dword [ebp - 0x1c]
+push esi
+push edx
+push edi
+movzx eax, ax
+push eax
+call fcn_0001f738  ; call 0x1f738
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f27  ; jmp 0x18f27
+
+fcn_0001827c:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+movzx esi, si
+call fcn_00018ef6  ; call 0x18ef6
+mov edx, dword [ebp - 0x1c]
+push esi
+push edx
+push edi
+movzx eax, ax
+push eax
+call fcn_0001f5af  ; call 0x1f5af
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f27  ; jmp 0x18f27
+
+fcn_000182c4:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+movzx esi, si
+call fcn_00018ef6  ; call 0x18ef6
+mov edx, dword [ebp - 0x1c]
+push esi
+push edx
+push edi
+movzx eax, ax
+push eax
+call fcn_0001f626  ; call 0x1f626
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f27  ; jmp 0x18f27
+
+fcn_0001830c:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+push ebx
+mov edi, dword [ebp + 0x18]
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x1c], ecx
+movzx esi, si
+call fcn_00018ef6  ; call 0x18ef6
+mov ecx, dword [ebp - 0x1c]
+movzx edi, di
+mov edx, dword [ebp - 0x20]
+mov dword [esp], edi
+push esi
+push ecx
+push edx
+movzx eax, ax
+push eax
+call fcn_0001f69d  ; call 0x1f69d
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f27  ; jmp 0x18f27
+
+fcn_00018363:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00018f64  ; call 0x18f64
+add esp, 0x10
+mov dword [ebp + 8], ebx
+or eax, esi
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00018f97  ; jmp 0x18f97
+
+fcn_0001838d:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00018f64  ; call 0x18f64
+add esp, 0x10
+mov dword [ebp + 8], ebx
+and eax, esi
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00018f97  ; jmp 0x18f97
+
+fcn_000183b7:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00018f64  ; call 0x18f64
+add esp, 0x10
+mov dword [ebp + 8], edi
+and eax, esi
+or eax, ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f97  ; jmp 0x18f97
+
+fcn_000183e8:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0x10]
+push ebx
+mov ebx, dword [ebp + 0xc]
+sub esp, 0xc
+push dword [ebp + 8]
+call fcn_00018f64  ; call 0x18f64
+add esp, 0x10
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], ebx
+mov dword [ebp + 8], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_0001f7b4  ; jmp 0x1f7b4
+
+fcn_00018415:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x14]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00018f64  ; call 0x18f64
+mov edx, dword [ebp - 0x1c]
+push edx
+push edi
+push esi
+push eax
+call fcn_0001f9ae  ; call 0x1f9ae
+add esp, 0x20
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f97  ; jmp 0x18f97
+
+fcn_00018454:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x14]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00018f64  ; call 0x18f64
+mov edx, dword [ebp - 0x1c]
+push edx
+push edi
+push esi
+push eax
+call fcn_0001f820  ; call 0x1f820
+add esp, 0x20
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f97  ; jmp 0x18f97
+
+fcn_00018493:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x14]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00018f64  ; call 0x18f64
+mov edx, dword [ebp - 0x1c]
+push edx
+push edi
+push esi
+push eax
+call fcn_0001f89e  ; call 0x1f89e
+add esp, 0x20
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f97  ; jmp 0x18f97
+
+fcn_000184d2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x14]
+mov ecx, dword [ebp + 0x18]
+mov esi, dword [ebp + 0xc]
+push ebx
+mov edi, dword [ebp + 0x10]
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x1c], ecx
+call fcn_00018f64  ; call 0x18f64
+mov ecx, dword [ebp - 0x1c]
+mov edx, dword [ebp - 0x20]
+mov dword [esp], ecx
+push edx
+push edi
+push esi
+push eax
+call fcn_0001f91c  ; call 0x1f91c
+add esp, 0x20
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00018f97  ; jmp 0x18f97
+
+fcn_0001851d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00017d37  ; call 0x17d37
+add esp, 0x10
+mov dword [ebp + 8], edi
+or eax, esi
+or edx, ebx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017d61  ; jmp 0x17d61
+
+fcn_00018551:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00017d37  ; call 0x17d37
+add esp, 0x10
+mov dword [ebp + 8], edi
+and eax, esi
+and edx, ebx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017d61  ; jmp 0x17d61
+
+fcn_00018585:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov eax, dword [ebp + 0x14]
+mov ecx, dword [ebp + 0x18]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov esi, dword [ebp + 0x10]
+mov dword [ebp - 0x1c], eax
+mov dword [ebp - 0x20], ecx
+call fcn_00017d37  ; call 0x17d37
+add esp, 0x10
+mov dword [ebp + 8], ebx
+and eax, edi
+and edx, esi
+or eax, dword [ebp - 0x1c]
+or edx, dword [ebp - 0x20]
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017d61  ; jmp 0x17d61
+
+fcn_000185cb:
+push ebp
+mov ebp, esp
+sub esp, 0x14
+push dword [ebp + 8]
+call fcn_00017d37  ; call 0x17d37
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push edx
+push eax
+call fcn_0001fa1d  ; call 0x1fa1d
+leave
+ret
+
+fcn_000185e8:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ecx, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+push ecx
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x1c], eax
+call fcn_00017d37  ; call 0x17d37
+pop ecx
+pop ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001fd53  ; call 0x1fd53
+mov ecx, dword [ebp - 0x20]
+add esp, 0x20
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017d61  ; jmp 0x17d61
+
+fcn_00018636:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ecx, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+push ecx
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x1c], eax
+call fcn_00017d37  ; call 0x17d37
+pop ecx
+pop ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001faac  ; call 0x1faac
+mov ecx, dword [ebp - 0x20]
+add esp, 0x20
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017d61  ; jmp 0x17d61
+
+fcn_00018684:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ecx, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+push ecx
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x1c], eax
+call fcn_00017d37  ; call 0x17d37
+pop ecx
+pop ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001fb9e  ; call 0x1fb9e
+mov ecx, dword [ebp - 0x20]
+add esp, 0x20
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017d61  ; jmp 0x17d61
+
+fcn_000186d2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov eax, dword [ebp + 0x10]
+mov ecx, dword [ebp + 8]
+mov edi, dword [ebp + 0x20]
+mov edx, dword [ebp + 0x18]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x14]
+mov esi, dword [ebp + 0x1c]
+push ecx
+mov ebx, dword [ebp + 0xc]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x28], eax
+mov dword [ebp - 0x24], edx
+call fcn_00017d37  ; call 0x17d37
+push edi
+push esi
+push dword [ebp - 0x24]
+push dword [ebp - 0x28]
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001fc9c  ; call 0x1fc9c
+mov ecx, dword [ebp - 0x20]
+add esp, 0x30
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017d61  ; jmp 0x17d61
+
+fcn_00018730:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov dword [ebp + 8], ebx
+or eax, esi
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00017da5  ; jmp 0x17da5
+
+fcn_0001875d:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov dword [ebp + 8], ebx
+and eax, esi
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00017da5  ; jmp 0x17da5
+
+fcn_0001878a:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov dword [ebp + 8], edi
+and eax, esi
+or eax, ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017da5  ; jmp 0x17da5
+
+fcn_000187be:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0x10]
+push ebx
+mov ebx, dword [ebp + 0xc]
+sub esp, 0xc
+push dword [ebp + 8]
+call fcn_00017d8b  ; call 0x17d8b
+add esp, 0x10
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], ebx
+movzx eax, al
+mov dword [ebp + 8], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_0001f2b6  ; jmp 0x1f2b6
+
+fcn_000187ee:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00017d8b  ; call 0x17d8b
+mov edx, dword [ebp - 0x1c]
+mov ecx, esi
+movzx esi, cl
+push esi
+push edx
+push edi
+movzx eax, al
+push eax
+call fcn_0001f4bc  ; call 0x1f4bc
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017da5  ; jmp 0x17da5
+
+fcn_00018838:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00017d8b  ; call 0x17d8b
+mov edx, dword [ebp - 0x1c]
+mov ecx, esi
+movzx esi, cl
+push esi
+push edx
+push edi
+movzx eax, al
+push eax
+call fcn_0001f329  ; call 0x1f329
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017da5  ; jmp 0x17da5
+
+fcn_00018882:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00017d8b  ; call 0x17d8b
+mov edx, dword [ebp - 0x1c]
+mov ecx, esi
+movzx esi, cl
+push esi
+push edx
+push edi
+movzx eax, al
+push eax
+call fcn_0001f3a4  ; call 0x1f3a4
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017da5  ; jmp 0x17da5
+
+fcn_000188cc:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0x18]
+push ebx
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x1c], ecx
+call fcn_00017d8b  ; call 0x17d8b
+mov ecx, esi
+mov edx, edi
+movzx esi, cl
+mov ecx, dword [ebp - 0x1c]
+movzx edi, dl
+mov edx, dword [ebp - 0x20]
+mov dword [esp], edi
+push esi
+push ecx
+push edx
+movzx eax, al
+push eax
+call fcn_0001f41f  ; call 0x1f41f
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, al
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017da5  ; jmp 0x17da5
+
+fcn_00018927:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+mov dword [ebp + 8], ebx
+or eax, esi
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00017e04  ; jmp 0x17e04
+
+fcn_00018954:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+mov dword [ebp + 8], ebx
+and eax, esi
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00017e04  ; jmp 0x17e04
+
+fcn_00018981:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+mov dword [ebp + 8], edi
+and eax, esi
+or eax, ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e04  ; jmp 0x17e04
+
+fcn_000189b5:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0x10]
+push ebx
+mov ebx, dword [ebp + 0xc]
+sub esp, 0xc
+push dword [ebp + 8]
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], ebx
+movzx eax, ax
+mov dword [ebp + 8], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_0001f53c  ; jmp 0x1f53c
+
+fcn_000189e5:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+movzx esi, si
+call fcn_00017dc2  ; call 0x17dc2
+mov edx, dword [ebp - 0x1c]
+push esi
+push edx
+push edi
+movzx eax, ax
+push eax
+call fcn_0001f738  ; call 0x1f738
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e04  ; jmp 0x17e04
+
+fcn_00018a2d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+movzx esi, si
+call fcn_00017dc2  ; call 0x17dc2
+mov edx, dword [ebp - 0x1c]
+push esi
+push edx
+push edi
+movzx eax, ax
+push eax
+call fcn_0001f5af  ; call 0x1f5af
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e04  ; jmp 0x17e04
+
+fcn_00018a75:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov dword [ebp - 0x1c], edx
+movzx esi, si
+call fcn_00017dc2  ; call 0x17dc2
+mov edx, dword [ebp - 0x1c]
+push esi
+push edx
+push edi
+movzx eax, ax
+push eax
+call fcn_0001f626  ; call 0x1f626
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e04  ; jmp 0x17e04
+
+fcn_00018abd:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+push ebx
+mov edi, dword [ebp + 0x18]
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x1c], ecx
+movzx esi, si
+call fcn_00017dc2  ; call 0x17dc2
+mov ecx, dword [ebp - 0x1c]
+movzx edi, di
+mov edx, dword [ebp - 0x20]
+mov dword [esp], edi
+push esi
+push ecx
+push edx
+movzx eax, ax
+push eax
+call fcn_0001f69d  ; call 0x1f69d
+add esp, 0x20
+mov dword [ebp + 8], ebx
+movzx eax, ax
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e04  ; jmp 0x17e04
+
+fcn_00018b14:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov dword [ebp + 8], ebx
+or eax, esi
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00017e8f  ; jmp 0x17e8f
+
+fcn_00018b3e:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov dword [ebp + 8], ebx
+and eax, esi
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00017e8f  ; jmp 0x17e8f
+
+fcn_00018b68:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov dword [ebp + 8], edi
+and eax, esi
+or eax, ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f  ; jmp 0x17e8f
+
+fcn_00018b99:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0x10]
+push ebx
+mov ebx, dword [ebp + 0xc]
+sub esp, 0xc
+push dword [ebp + 8]
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], ebx
+mov dword [ebp + 8], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_0001f7b4  ; jmp 0x1f7b4
+
+fcn_00018bc6:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x14]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, dword [ebp - 0x1c]
+push edx
+push edi
+push esi
+push eax
+call fcn_0001f9ae  ; call 0x1f9ae
+add esp, 0x20
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f  ; jmp 0x17e8f
+
+fcn_00018c05:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x14]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, dword [ebp - 0x1c]
+push edx
+push edi
+push esi
+push eax
+call fcn_0001f820  ; call 0x1f820
+add esp, 0x20
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f  ; jmp 0x17e8f
+
+fcn_00018c44:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x14]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+push ebx
+mov dword [ebp - 0x1c], edx
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, dword [ebp - 0x1c]
+push edx
+push edi
+push esi
+push eax
+call fcn_0001f89e  ; call 0x1f89e
+add esp, 0x20
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f  ; jmp 0x17e8f
+
+fcn_00018c83:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov edx, dword [ebp + 0x14]
+mov ecx, dword [ebp + 0x18]
+mov esi, dword [ebp + 0xc]
+push ebx
+mov edi, dword [ebp + 0x10]
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x1c], ecx
+call fcn_00017e4e  ; call 0x17e4e
+mov ecx, dword [ebp - 0x1c]
+mov edx, dword [ebp - 0x20]
+mov dword [esp], ecx
+push edx
+push edi
+push esi
+push eax
+call fcn_0001f91c  ; call 0x1f91c
+add esp, 0x20
+mov dword [ebp + 8], ebx
+mov dword [ebp + 0xc], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017e8f  ; jmp 0x17e8f
+
+fcn_00018cce:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00017ed8  ; call 0x17ed8
+add esp, 0x10
+mov dword [ebp + 8], edi
+or eax, esi
+or edx, ebx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017f28  ; jmp 0x17f28
+
+fcn_00018d02:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x18
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+push edi
+call fcn_00017ed8  ; call 0x17ed8
+add esp, 0x10
+mov dword [ebp + 8], edi
+and eax, esi
+and edx, ebx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017f28  ; jmp 0x17f28
+
+fcn_00018d36:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ebx, dword [ebp + 8]
+mov eax, dword [ebp + 0x14]
+mov ecx, dword [ebp + 0x18]
+mov edi, dword [ebp + 0xc]
+push ebx
+mov esi, dword [ebp + 0x10]
+mov dword [ebp - 0x1c], eax
+mov dword [ebp - 0x20], ecx
+call fcn_00017ed8  ; call 0x17ed8
+add esp, 0x10
+mov dword [ebp + 8], ebx
+and eax, edi
+and edx, esi
+or eax, dword [ebp - 0x1c]
+or edx, dword [ebp - 0x20]
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017f28  ; jmp 0x17f28
+
+fcn_00018d7c:
+push ebp
+mov ebp, esp
+sub esp, 0x14
+push dword [ebp + 8]
+call fcn_00017ed8  ; call 0x17ed8
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push edx
+push eax
+call fcn_0001fa1d  ; call 0x1fa1d
+leave
+ret
+
+fcn_00018d99:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ecx, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+push ecx
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x1c], eax
+call fcn_00017ed8  ; call 0x17ed8
+pop ecx
+pop ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001fd53  ; call 0x1fd53
+mov ecx, dword [ebp - 0x20]
+add esp, 0x20
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017f28  ; jmp 0x17f28
+
+fcn_00018de7:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ecx, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+push ecx
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x1c], eax
+call fcn_00017ed8  ; call 0x17ed8
+pop ecx
+pop ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001faac  ; call 0x1faac
+mov ecx, dword [ebp - 0x20]
+add esp, 0x20
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017f28  ; jmp 0x17f28
+
+fcn_00018e35:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov ecx, dword [ebp + 8]
+mov eax, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov ebx, dword [ebp + 0xc]
+push ecx
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x1c], eax
+call fcn_00017ed8  ; call 0x17ed8
+pop ecx
+pop ecx
+push edi
+push esi
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001fb9e  ; call 0x1fb9e
+mov ecx, dword [ebp - 0x20]
+add esp, 0x20
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017f28  ; jmp 0x17f28
+
+fcn_00018e83:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov eax, dword [ebp + 0x10]
+mov ecx, dword [ebp + 8]
+mov edi, dword [ebp + 0x20]
+mov edx, dword [ebp + 0x18]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x14]
+mov esi, dword [ebp + 0x1c]
+push ecx
+mov ebx, dword [ebp + 0xc]
+mov dword [ebp - 0x20], ecx
+mov dword [ebp - 0x28], eax
+mov dword [ebp - 0x24], edx
+call fcn_00017ed8  ; call 0x17ed8
+push edi
+push esi
+push dword [ebp - 0x24]
+push dword [ebp - 0x28]
+push dword [ebp - 0x1c]
+push ebx
+push edx
+push eax
+call fcn_0001fc9c  ; call 0x1fc9c
+mov ecx, dword [ebp - 0x20]
+add esp, 0x30
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00017f28  ; jmp 0x17f28
+
+fcn_00018ee1:
+push ebp
+mov ebp, esp
+mov edx, dword [ebp + 8]
+in al, dx
+pop ebp
+ret
+
+fcn_00018eea:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0xc]
+mov edx, dword [ebp + 8]
+out dx, al
+pop ebp
+ret
+
+fcn_00018ef6:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00018f20  ; je 0x18f20
+test byte [ebp + 8], 1
+je short loc_00018f20  ; je 0x18f20
+push eax
+push ref_00025bf3  ; push 0x25bf3
+push 0x69
+push ref_00025c03  ; push 0x25c03
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00018f20:
+mov edx, dword [ebp + 8]
+in ax, dx
+leave
+ret
+
+fcn_00018f27:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00018f56  ; je 0x18f56
+test byte [ebp + 8], 1
+je short loc_00018f56  ; je 0x18f56
+push eax
+push ref_00025bf3  ; push 0x25bf3
+push 0x86
+push ref_00025c03  ; push 0x25c03
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00018f56:
+mov eax, ebx
+mov edx, dword [ebp + 8]
+out dx, ax
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00018f64:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00018f91  ; je 0x18f91
+test byte [ebp + 8], 3
+je short loc_00018f91  ; je 0x18f91
+push eax
+push ref_00025c42  ; push 0x25c42
+push 0xa3
+push ref_00025c03  ; push 0x25c03
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00018f91:
+mov edx, dword [ebp + 8]
+in eax, dx
+leave
+ret
+
+fcn_00018f97:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00018fc4  ; je 0x18fc4
+test byte [ebp + 8], 3
+je short loc_00018fc4  ; je 0x18fc4
+push eax
+push ref_00025c42  ; push 0x25c42
+push 0xc0
+push ref_00025c03  ; push 0x25c03
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00018fc4:
+mov eax, dword [ebp + 0xc]
+mov edx, dword [ebp + 8]
+out dx, eax
+mov eax, dword [ebp + 0xc]
+leave
+ret
+
+fcn_00018fd0:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x20
+lea eax, [ebp - 0xc]
+push eax
+call fcn_000197c7  ; call 0x197c7
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00019024  ; je 0x19024
+test ebx, ebx
+jns short loc_00019024  ; jns 0x19024
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001900f  ; je 0x1900f
+push ecx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001900f:
+push edx
+push ref_000206f4  ; push 0x206f4
+push 0x32
+push ref_00025c52  ; push 0x25c52
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00019024:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00019048  ; je 0x19048
+cmp dword [ebp - 0xc], 0
+jne short loc_00019048  ; jne 0x19048
+push eax
+push ref_00025c86  ; push 0x25c86
+push 0x33
+push ref_00025c52  ; push 0x25c52
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00019048:
+mov eax, dword [ebp - 0xc]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00019050:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001908a  ; je 0x1908a
+test ebx, ebx
+jne short loc_0001908a  ; jne 0x1908a
+push eax
+push ref_00025c9e  ; push 0x25c9e
+push 0x52
+push ref_00025c52  ; push 0x25c52
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+jmp short loc_0001908a  ; jmp 0x1908a
+
+loc_0001907f:
+cmp ax, si
+je short loc_00019097  ; je 0x19097
+movzx eax, word [ebx + 2]
+add ebx, eax
+
+loc_0001908a:
+mov ax, word [ebx]
+cmp ax, 0xffff
+jne short loc_0001907f  ; jne 0x1907f
+xor eax, eax
+jmp short loc_00019099  ; jmp 0x19099
+
+loc_00019097:
+mov eax, ebx
+
+loc_00019099:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_000190a0:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00018fd0  ; call 0x18fd0
+movzx ebx, bx
+push edx
+push edx
+push eax
+push ebx
+call fcn_00019050  ; call 0x19050
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000190be:
+push ebp
+mov ebp, esp
+push ebx
+push ecx
+mov ebx, dword [ebp + 0xc]
+
+loc_000190c6:
+push eax
+push eax
+push ebx
+push 4
+call fcn_00019050  ; call 0x19050
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+je short loc_000190f6  ; je 0x190f6
+push edx
+push edx
+lea eax, [ebx + 8]
+push eax
+push dword [ebp + 8]
+call fcn_00016ee8  ; call 0x16ee8
+add esp, 0x10
+test al, al
+jne short loc_000190f6  ; jne 0x190f6
+movzx eax, word [ebx + 2]
+add ebx, eax
+jmp short loc_000190c6  ; jmp 0x190c6
+
+loc_000190f6:
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_000190fd:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00018fd0  ; call 0x18fd0
+push edx
+push edx
+push eax
+push dword [ebp + 8]
+call fcn_000190be  ; call 0x190be
+leave
+ret
+
+fcn_00019115:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x20
+lea eax, [ebp - 0xc]
+push eax
+call fcn_00019797  ; call 0x19797
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001916c  ; je 0x1916c
+test ebx, ebx
+jns short loc_0001916c  ; jns 0x1916c
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00019154  ; je 0x19154
+push edx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00019154:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0xd8
+push ref_00025c52  ; push 0x25c52
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001916c:
+mov eax, dword [ebp - 0xc]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00019174:
+push ebp
+mov ebp, esp
+sub esp, 0x1c
+lea eax, [ebp - 0xc]
+push eax
+movzx eax, word [ebp + 0xc]
+push eax
+movzx eax, word [ebp + 8]
+push eax
+call fcn_000197df  ; call 0x197df
+add esp, 0x10
+test eax, eax
+jns short loc_0001919b  ; jns 0x1919b
+mov dword [ebp - 0xc], 0
+
+loc_0001919b:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000191c2  ; je 0x191c2
+cmp dword [ebp - 0xc], 0
+jne short loc_000191c2  ; jne 0x191c2
+push eax
+push ref_00025cb7  ; push 0x25cb7
+push 0xfa
+push ref_00025c52  ; push 0x25c52
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000191c2:
+mov eax, dword [ebp - 0xc]
+leave
+ret
+
+fcn_000191c7:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0x10]
+mov edx, dword [ebp + 0x20]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x14]
+mov dword [ebp - 0x24], eax
+mov eax, dword [ebp + 0x18]
+mov dword [ebp - 0x1c], edx
+mov dword [ebp - 0x28], eax
+mov eax, dword [ebp + 0x1c]
+mov dword [ebp - 0x20], eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001921f  ; je 0x1921f
+test esi, 0xfff
+jne short loc_00019207  ; jne 0x19207
+test ebx, 0xfff
+je short loc_0001921f  ; je 0x1921f
+
+loc_00019207:
+push eax
+push ref_00025ccb  ; push 0x25ccb
+push 0x11a
+push ref_00025c52  ; push 0x25c52
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001921f:
+push edi
+push edi
+push 0x48
+push 2
+call fcn_00019174  ; call 0x19174
+add esp, 0x10
+mov edi, eax
+test eax, eax
+je short loc_00019286  ; je 0x19286
+push eax
+push eax
+push ref_0002905c  ; push 0x2905c
+lea eax, [edi + 8]
+push eax
+call fcn_00016ea7  ; call 0x16ea7
+mov eax, dword [ebp - 0x24]
+mov dword [edi + 0x18], esi
+mov dword [edi + 0x20], ebx
+mov dword [edi + 0x28], 3
+mov dword [edi + 0x1c], eax
+mov eax, dword [ebp - 0x28]
+mov dword [edi + 0x24], eax
+lea eax, [edi + 0x2c]
+pop edx
+pop ecx
+push 4
+push eax
+call fcn_00016fff  ; call 0x16fff
+lea eax, [edi + 0x30]
+pop ebx
+pop esi
+push dword [ebp + 8]
+push eax
+call fcn_00016ea7  ; call 0x16ea7
+mov eax, dword [ebp - 0x20]
+add esp, 0x10
+mov edx, dword [ebp - 0x1c]
+mov dword [edi + 0x40], eax
+mov dword [edi + 0x44], edx
+
+loc_00019286:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001928e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+sub esp, 0x18
+mov eax, dword [ebp + 0x18]
+mov edx, dword [ebp + 0x1c]
+push 0x30
+mov esi, dword [ebp + 0x10]
+push 3
+mov edi, dword [ebp + 0x14]
+mov dword [ebp - 0x10], eax
+mov dword [ebp - 0xc], edx
+call fcn_00019174  ; call 0x19174
+add esp, 0x10
+test eax, eax
+je short loc_000192d6  ; je 0x192d6
+mov edx, dword [ebp + 8]
+mov dword [eax + 0x20], esi
+mov esi, dword [ebp - 0x10]
+mov dword [eax + 0x24], edi
+mov edi, dword [ebp - 0xc]
+mov dword [eax + 0x18], edx
+mov edx, dword [ebp + 0xc]
+mov dword [eax + 0x28], esi
+mov dword [eax + 0x2c], edi
+mov dword [eax + 0x1c], edx
+
+loc_000192d6:
+lea esp, [ebp - 8]
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000192dd:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001930d  ; je 0x1930d
+test esi, esi
+jne short loc_0001930d  ; jne 0x1930d
+push eax
+push ref_00025d2a  ; push 0x25d2a
+push 0x176
+push ref_00025c52  ; push 0x25c52
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001930d:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00019336  ; je 0x19336
+cmp ebx, 0xffe0
+jbe short loc_00019336  ; jbe 0x19336
+push ecx
+push ref_00025d3f  ; push 0x25d3f
+push 0x17b
+push ref_00025c52  ; push 0x25c52
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00019336:
+add ebx, 0x18
+push edx
+movzx ebx, bx
+push edx
+push ebx
+push 4
+call fcn_00019174  ; call 0x19174
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+je short loc_00019363  ; je 0x19363
+push eax
+push eax
+push esi
+lea eax, [ebx + 8]
+push eax
+call fcn_00016ea7  ; call 0x16ea7
+lea eax, [ebx + 0x18]
+add esp, 0x10
+jmp short loc_00019365  ; jmp 0x19365
+
+loc_00019363:
+xor eax, eax
+
+loc_00019365:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001936c:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000193a7  ; je 0x193a7
+test esi, esi
+jne short loc_000193a7  ; jne 0x193a7
+test ebx, ebx
+je short loc_000193a7  ; je 0x193a7
+push edx
+push ref_00025d73  ; push 0x25d73
+push 0x1a8
+push ref_00025c52  ; push 0x25c52
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000193a7:
+push eax
+push eax
+push ebx
+push edi
+call fcn_000192dd  ; call 0x192dd
+add esp, 0x10
+test eax, eax
+je short loc_000193cc  ; je 0x193cc
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001713e  ; jmp 0x1713e
+
+loc_000193cc:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000193d6:
+push ebp
+mov ebp, esp
+push edi
+push esi
+sub esp, 0x18
+mov eax, dword [ebp + 0x10]
+mov edx, dword [ebp + 0x14]
+push 0x18
+mov esi, dword [ebp + 8]
+push 5
+mov edi, dword [ebp + 0xc]
+mov dword [ebp - 0x10], eax
+mov dword [ebp - 0xc], edx
+call fcn_00019174  ; call 0x19174
+add esp, 0x10
+test eax, eax
+je short loc_00019412  ; je 0x19412
+mov edx, dword [ebp - 0x10]
+mov ecx, dword [ebp - 0xc]
+mov dword [eax + 8], esi
+mov dword [eax + 0xc], edi
+mov dword [eax + 0x10], edx
+mov dword [eax + 0x14], ecx
+
+loc_00019412:
+lea esp, [ebp - 8]
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00019419:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x24
+mov edx, dword [ebp + 0x14]
+mov eax, dword [ebp + 0x10]
+mov ecx, dword [ebp + 0x18]
+push 0x38
+mov esi, dword [ebp + 8]
+push 9
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x1c]
+mov dword [ebp - 0x1c], edx
+mov dword [ebp - 0x20], eax
+mov dword [ebp - 0x24], ecx
+call fcn_00019174  ; call 0x19174
+add esp, 0x10
+mov edx, eax
+test eax, eax
+je short loc_0001948e  ; je 0x1948e
+mov dword [eax + 8], esi
+mov esi, dword [ebp - 0x20]
+mov dword [eax + 0xc], edi
+mov edi, dword [ebp - 0x1c]
+mov ecx, dword [ebp - 0x24]
+mov dword [ebp - 0x20], edx
+mov dword [eax + 0x10], esi
+mov dword [eax + 0x14], edi
+push eax
+push eax
+push ecx
+lea eax, [edx + 0x18]
+push eax
+call fcn_00016ea7  ; call 0x16ea7
+mov edx, dword [ebp - 0x20]
+add esp, 0x10
+mov dword [ebp + 0xc], ebx
+add edx, 0x28
+mov dword [ebp + 8], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00016ea7  ; jmp 0x16ea7
+
+loc_0001948e:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00019496:
+push ebp
+mov ebp, esp
+push edi
+push esi
+sub esp, 0x18
+mov eax, dword [ebp + 0x10]
+mov edx, dword [ebp + 0x14]
+push 0x18
+mov esi, dword [ebp + 8]
+push 0xb
+mov edi, dword [ebp + 0xc]
+mov dword [ebp - 0x10], eax
+mov dword [ebp - 0xc], edx
+call fcn_00019174  ; call 0x19174
+add esp, 0x10
+test eax, eax
+je short loc_000194d2  ; je 0x194d2
+mov edx, dword [ebp - 0x10]
+mov ecx, dword [ebp - 0xc]
+mov dword [eax + 8], esi
+mov dword [eax + 0xc], edi
+mov dword [eax + 0x10], edx
+mov dword [eax + 0x14], ecx
+
+loc_000194d2:
+lea esp, [ebp - 8]
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000194d9:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0xc]
+push eax
+push eax
+push 0x10
+push 6
+call fcn_00019174  ; call 0x19174
+add esp, 0x10
+test eax, eax
+je short loc_00019516  ; je 0x19516
+mov edx, esi
+add eax, 0xa
+mov byte [eax - 2], dl
+mov byte [eax - 1], bl
+mov dword [ebp + 0xc], 6
+mov dword [ebp + 8], eax
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00016fff  ; jmp 0x16fff
+
+loc_00019516:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001951d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0x14]
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov dword [ebp - 0x1c], eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00019566  ; je 0x19566
+test esi, 0xfff
+jne short loc_0001954e  ; jne 0x1954e
+test ebx, 0xfff
+je short loc_00019566  ; je 0x19566
+
+loc_0001954e:
+push ecx
+push ref_00025d9b  ; push 0x25d9b
+push 0x251
+push ref_00025c52  ; push 0x25c52
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00019566:
+push edx
+push edx
+push 0x30
+push 2
+call fcn_00019174  ; call 0x19174
+add esp, 0x10
+mov edx, eax
+test eax, eax
+je short loc_000195c2  ; je 0x195c2
+push eax
+push eax
+push ref_0002904c  ; push 0x2904c
+lea eax, [edx + 8]
+push eax
+mov dword [ebp - 0x20], edx
+call fcn_00016ea7  ; call 0x16ea7
+mov edx, dword [ebp - 0x20]
+add esp, 0x10
+mov eax, dword [ebp - 0x1c]
+mov dword [edx + 0x18], esi
+add edx, 0x2c
+mov dword [edx - 0x10], edi
+mov dword [edx - 0xc], ebx
+mov dword [edx - 8], eax
+mov dword [edx - 4], 4
+mov dword [ebp + 0xc], 4
+mov dword [ebp + 8], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00016fff  ; jmp 0x16fff
+
+loc_000195c2:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_000195ca:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0x14]
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov dword [ebp - 0x20], eax
+mov eax, dword [ebp + 0x18]
+mov dword [ebp - 0x1c], eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00019619  ; je 0x19619
+test esi, 0xfff
+jne short loc_00019601  ; jne 0x19601
+test ebx, 0xfff
+je short loc_00019619  ; je 0x19619
+
+loc_00019601:
+push ecx
+push ref_00025d9b  ; push 0x25d9b
+push 0x27c
+push ref_00025c52  ; push 0x25c52
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00019619:
+push edx
+push edx
+push 0x30
+push 2
+call fcn_00019174  ; call 0x19174
+add esp, 0x10
+mov edx, eax
+test eax, eax
+je short loc_00019674  ; je 0x19674
+push eax
+push eax
+push ref_0002903c  ; push 0x2903c
+lea eax, [edx + 8]
+push eax
+mov dword [ebp - 0x24], edx
+call fcn_00016ea7  ; call 0x16ea7
+mov edx, dword [ebp - 0x24]
+add esp, 0x10
+mov eax, dword [ebp - 0x20]
+mov dword [edx + 0x18], esi
+add edx, 0x2c
+mov dword [edx - 8], eax
+mov eax, dword [ebp - 0x1c]
+mov dword [edx - 0x10], edi
+mov dword [edx - 0xc], ebx
+mov dword [edx - 4], eax
+mov dword [ebp + 0xc], 4
+mov dword [ebp + 8], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00016fff  ; jmp 0x16fff
+
+loc_00019674:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001967c:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0x14]
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov dword [ebp - 0x20], eax
+mov eax, dword [ebp + 0x18]
+mov dword [ebp - 0x1c], eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_000196cb  ; je 0x196cb
+test esi, 0xfff
+jne short loc_000196b3  ; jne 0x196b3
+test ebx, 0xfff
+je short loc_000196cb  ; je 0x196cb
+
+loc_000196b3:
+push ecx
+push ref_00025d9b  ; push 0x25d9b
+push 0x2a7
+push ref_00025c52  ; push 0x25c52
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000196cb:
+push edx
+push edx
+push 0x30
+push 2
+call fcn_00019174  ; call 0x19174
+add esp, 0x10
+mov edx, eax
+test eax, eax
+je short loc_00019723  ; je 0x19723
+push eax
+push eax
+push 0x10
+lea eax, [edx + 8]
+push eax
+mov dword [ebp - 0x24], edx
+call fcn_00016fff  ; call 0x16fff
+mov edx, dword [ebp - 0x24]
+add esp, 0x10
+mov eax, dword [ebp - 0x20]
+mov dword [edx + 0x18], esi
+add edx, 0x2c
+mov dword [edx - 8], eax
+mov eax, dword [ebp - 0x1c]
+mov dword [edx - 0x10], edi
+mov dword [edx - 0xc], ebx
+mov dword [edx - 4], eax
+mov dword [ebp + 0xc], 4
+mov dword [ebp + 8], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_00016fff  ; jmp 0x16fff
+
+loc_00019723:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001972b:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31  ; call 0x19b31
+push edx
+push edx
+mov edx, dword [eax]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x18]  ; ucall
+leave
+ret
+
+fcn_00019743:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31  ; call 0x19b31
+push edx
+mov edx, dword [eax]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x1c]  ; ucall
+leave
+ret
+
+fcn_0001975d:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31  ; call 0x19b31
+sub esp, 0xc
+mov edx, dword [eax]
+push dword [ebp + 0x14]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x20]  ; ucall
+leave
+ret
+
+fcn_0001977f:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31  ; call 0x19b31
+push edx
+push edx
+mov edx, dword [eax]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x24]  ; ucall
+leave
+ret
+
+fcn_00019797:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31  ; call 0x19b31
+push edx
+push edx
+mov edx, dword [eax]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x28]  ; ucall
+leave
+ret
+
+fcn_000197af:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31  ; call 0x19b31
+push edx
+push edx
+mov edx, dword [eax]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x2c]  ; ucall
+leave
+ret
+
+fcn_000197c7:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31  ; call 0x19b31
+push edx
+push edx
+mov edx, dword [eax]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x30]  ; ucall
+leave
+ret
+
+fcn_000197df:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00019b31  ; call 0x19b31
+movzx esi, si
+movzx ebx, bx
+mov edx, dword [eax]
+push dword [ebp + 0x10]
+push esi
+push ebx
+push eax
+call dword [edx + 0x34]  ; ucall
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00019807:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31  ; call 0x19b31
+push edx
+mov edx, dword [eax]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x38]  ; ucall
+leave
+ret
+
+fcn_00019821:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00019b31  ; call 0x19b31
+movzx ebx, bl
+mov edx, dword [eax]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push ebx
+push eax
+call dword [edx + 0x3c]  ; ucall
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00019843:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00019b31  ; call 0x19b31
+movzx ebx, bl
+mov edx, dword [eax]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push ebx
+push eax
+call dword [edx + 0x40]  ; ucall
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00019865:
+push ebp
+mov ebp, esp
+push edi
+push esi
+sub esp, 0x10
+mov edx, dword [ebp + 0xc]
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+mov dword [ebp - 0xc], edx
+mov dword [ebp - 0x10], eax
+call fcn_00019b31  ; call 0x19b31
+sub esp, 0xc
+mov edx, dword [eax]
+push edi
+push esi
+push dword [ebp - 0xc]
+push dword [ebp - 0x10]
+push eax
+call dword [edx + 0x44]  ; ucall
+lea esp, [ebp - 8]
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001989c:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31  ; call 0x19b31
+mov edx, dword [eax]
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x48]  ; ucall
+leave
+ret
+
+fcn_000198b8:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31  ; call 0x19b31
+push edx
+mov edx, dword [eax]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push eax
+call dword [edx + 0x4c]  ; ucall
+leave
+ret
+
+fcn_000198d2:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00019b31  ; call 0x19b31
+sub esp, 0xc
+mov edx, dword [eax]
+push eax
+call dword [edx + 0x5c]  ; ucall
+leave
+ret
+
+fcn_000198e8:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00019b31  ; call 0x19b31
+mov eax, dword [eax]
+mov dword [ebp + 8], ebx
+mov eax, dword [eax + 0x74]
+pop edx
+pop ebx
+pop ebp
+jmp eax
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00019b31  ; call 0x19b31
+mov eax, dword [eax]
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], ebx
+pop ebx
+mov eax, dword [eax + 0x6c]
+pop esi
+pop ebp
+jmp eax
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+call fcn_00019b31  ; call 0x19b31
+mov eax, dword [eax]
+mov dword [ebp + 0x10], edi
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], ebx
+mov eax, dword [eax + 0x68]
+add esp, 0xc
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp eax
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00019b31  ; call 0x19b31
+mov eax, dword [eax]
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], ebx
+pop ebx
+mov eax, dword [eax + 0x70]
+pop esi
+pop ebp
+jmp eax
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov eax, dword [ebp + 0xc]
+push 0x20
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0x14]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp - 0x20], eax
+mov eax, dword [ebp + 0x18]
+mov dword [ebp - 0x24], eax
+call fcn_00019db6  ; call 0x19db6
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_000199c2  ; je 0x199c2
+test ebx, ebx
+jne short loc_000199c2  ; jne 0x199c2
+push eax
+push ref_00025de9  ; push 0x25de9
+push 0x23d
+push ref_00025e03  ; push 0x25e03
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_000199c2:
+test edi, edi
+je short loc_000199cb  ; je 0x199cb
+push eax
+push eax
+push edi
+jmp short loc_000199d2  ; jmp 0x199d2
+
+loc_000199cb:
+push eax
+push eax
+push ref_0002906c  ; push 0x2906c
+
+loc_000199d2:
+push ebx
+call fcn_00016ea7  ; call 0x16ea7
+mov eax, dword [ebp - 0x1c]
+add esp, 0x10
+mov dword [ebx + 0x10], eax
+mov eax, dword [ebp - 0x20]
+mov dword [ebx + 0x14], eax
+test esi, esi
+je short loc_00019a22  ; je 0x19a22
+push edi
+push edi
+push esi
+push 0x10
+call fcn_00019e91  ; call 0x19e91
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00019a1f  ; je 0x19a1f
+test esi, esi
+jne short loc_00019a1f  ; jne 0x19a1f
+push ecx
+push ref_00025e44  ; push 0x25e44
+push 0x248
+push ref_00025e03  ; push 0x25e03
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00019a1f:
+mov dword [ebx + 0x18], esi
+
+loc_00019a22:
+mov eax, dword [ebp - 0x24]
+test eax, eax
+je short loc_00019a60  ; je 0x19a60
+push edx
+push edx
+push eax
+push 0x10
+call fcn_00019e91  ; call 0x19e91
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00019a5d  ; je 0x19a5d
+test esi, esi
+jne short loc_00019a5d  ; jne 0x19a5d
+push edi
+push ref_00025e66  ; push 0x25e66
+push 0x24d
+push ref_00025e03  ; push 0x25e03
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00019a5d:
+mov dword [ebx + 0x1c], esi
+
+loc_00019a60:
+push ecx
+push ecx
+push ref_00020594  ; push 0x20594
+push 0xc
+call fcn_00019e91  ; call 0x19e91
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00019a98  ; je 0x19a98
+test esi, esi
+jne short loc_00019a98  ; jne 0x19a98
+push edx
+push ref_00025e8a  ; push 0x25e8a
+push 0x252
+push ref_00025e03  ; push 0x25e03
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00019a98:
+sub esp, 0xc
+mov dword [esi + 8], ebx
+push esi
+call fcn_0001972b  ; call 0x1972b
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_00019af4  ; je 0x19af4
+test ebx, ebx
+jns short loc_00019af4  ; jns 0x19af4
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_00019ad3  ; je 0x19ad3
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_00019ad3:
+mov dword [ebp + 0x10], ref_000206f4  ; mov dword [ebp + 0x10], 0x206f4
+mov dword [ebp + 0xc], 0x256
+mov dword [ebp + 8], ref_00025e03  ; mov dword [ebp + 8], 0x25e03
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001548c  ; jmp 0x1548c
+
+loc_00019af4:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00019afc:
+push ebp
+mov ebp, esp
+push ebx
+push edx
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00019b26  ; je 0x19b26
+test ebx, ebx
+jne short loc_00019b26  ; jne 0x19b26
+push eax
+push ref_00025eae  ; push 0x25eae
+push 0x29
+push ref_00025ed6  ; push 0x25ed6
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00019b26:
+mov dword [ref_000312f0], ebx  ; mov dword [0x312f0], ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00019b31:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00019b5e  ; je 0x19b5e
+cmp dword [ref_000312f0], 0  ; cmp dword [0x312f0], 0
+jne short loc_00019b5e  ; jne 0x19b5e
+push eax
+push ref_00025f2c  ; push 0x25f2c
+push 0x3f
+push ref_00025ed6  ; push 0x25ed6
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00019b5e:
+mov eax, dword [ref_000312f0]  ; mov eax, dword [0x312f0]
+leave
+ret
+
+fcn_00019b65:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0xc]
+pop ebp
+mov dword [ref_000312f0], eax  ; mov dword [0x312f0], eax
+xor eax, eax
+ret
+
+fcn_00019b74:
+push ebp
+mov ebp, esp
+sub esp, 0x18
+mov eax, dword [ebp + 0xc]
+test eax, eax
+jne short loc_00019b85  ; jne 0x19b85
+
+loc_00019b81:
+xor eax, eax
+jmp short loc_00019b9d  ; jmp 0x19b9d
+
+loc_00019b85:
+push edx
+lea edx, [ebp - 0x10]
+push edx
+push eax
+push dword [ebp + 8]
+call fcn_0001989c  ; call 0x1989c
+add esp, 0x10
+test eax, eax
+js short loc_00019b81  ; js 0x19b81
+mov eax, dword [ebp - 0x10]
+
+loc_00019b9d:
+leave
+ret
+
+fcn_00019b9f:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+push dword [ebp + 8]
+push 4
+call fcn_00019b74  ; call 0x19b74
+leave
+ret
+
+fcn_00019bb1:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+push dword [ebp + 8]
+push 6
+call fcn_00019b74  ; call 0x19b74
+leave
+ret
+
+fcn_00019bc3:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+push dword [ebp + 8]
+push 0
+call fcn_00019b74  ; call 0x19b74
+leave
+ret
+
+fcn_00019bd5:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00019c02  ; je 0x19c02
+cmp dword [ebp + 0xc], 0
+jne short loc_00019c02  ; jne 0x19c02
+push eax
+push ref_00025f49  ; push 0x25f49
+push 0x95
+push ref_00025f54  ; push 0x25f54
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00019c02:
+leave
+ret
+
+fcn_00019c04:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00019c37  ; je 0x19c37
+lea eax, [ebx - 1]
+test eax, ebx
+je short loc_00019c37  ; je 0x19c37
+push ecx
+push ref_00025fa2  ; push 0x25fa2
+push 0xba
+push ref_00025f54  ; push 0x25f54
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00019c37:
+test esi, esi
+je short loc_00019ca6  ; je 0x19ca6
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00019c74  ; je 0x19c74
+xor edx, edx
+mov eax, ebx
+test ebx, 0xfff
+setne dl
+shr eax, 0xc
+add eax, edx
+not eax
+cmp esi, eax
+jbe short loc_00019c74  ; jbe 0x19c74
+push edx
+push ref_00025fc5  ; push 0x25fc5
+push 0xc2
+push ref_00025f54  ; push 0x25f54
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00019c74:
+push eax
+push eax
+mov eax, ebx
+shr eax, 0xc
+add esi, eax
+xor eax, eax
+test ebx, 0xfff
+setne al
+add esi, eax
+push esi
+push dword [ebp + 8]
+call fcn_00019b74  ; call 0x19b74
+add esp, 0x10
+cmp ebx, 1
+adc ebx, 0xffffffff
+mov edx, ebx
+not edx
+add ebx, eax
+and edx, ebx
+jmp short loc_00019ca8  ; jmp 0x19ca8
+
+loc_00019ca6:
+xor edx, edx
+
+loc_00019ca8:
+lea esp, [ebp - 8]
+mov eax, edx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00019cb1:
+push ebp
+mov ebp, esp
+sub esp, 0xc
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push 4
+call fcn_00019c04  ; call 0x19c04
+leave
+ret
+
+fcn_00019cc6:
+push ebp
+mov ebp, esp
+sub esp, 0xc
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push 6
+call fcn_00019c04  ; call 0x19c04
+leave
+ret
+
+fcn_00019cdb:
+push ebp
+mov ebp, esp
+sub esp, 0xc
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push 0
+call fcn_00019c04  ; call 0x19c04
+leave
+ret
+
+fcn_00019cf0:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00019d1d  ; je 0x19d1d
+cmp dword [ebp + 0xc], 0
+jne short loc_00019d1d  ; jne 0x19d1d
+push eax
+push ref_00025f49  ; push 0x25f49
+push 0x13b
+push ref_00025f54  ; push 0x25f54
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00019d1d:
+leave
+ret
+
+fcn_00019d1f:
+push ebp
+xor edx, edx
+mov ebp, esp
+mov eax, dword [ebp + 0xc]
+test eax, 0xfff
+setne dl
+shr eax, 0xc
+add eax, edx
+mov dword [ebp + 0xc], eax
+pop ebp
+jmp near fcn_00019b74  ; jmp 0x19b74
+
+fcn_00019d3d:
+push ebp
+mov ebp, esp
+sub esp, 0x20
+lea eax, [ebp - 0xc]
+push eax
+push dword [ebp + 8]
+call fcn_000198b8  ; call 0x198b8
+add esp, 0x10
+test eax, eax
+jns short loc_00019d5d  ; jns 0x19d5d
+mov dword [ebp - 0xc], 0
+
+loc_00019d5d:
+mov eax, dword [ebp - 0xc]
+leave
+ret
+
+fcn_00019d62:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+push dword [ebp + 8]
+push 6
+call fcn_00019d1f  ; call 0x19d1f
+leave
+ret
+
+fcn_00019d74:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+push dword [ebp + 8]
+push 0
+call fcn_00019d1f  ; call 0x19d1f
+leave
+ret
+
+fcn_00019d86:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 0xc]
+push ebx
+push dword [ebp + 8]
+call fcn_00019d1f  ; call 0x19d1f
+add esp, 0x10
+test eax, eax
+je short loc_00019daf  ; je 0x19daf
+mov dword [ebp + 0xc], ebx
+mov ebx, dword [ebp - 4]
+mov dword [ebp + 8], eax
+leave
+jmp near fcn_00016fff  ; jmp 0x16fff
+
+loc_00019daf:
+xor eax, eax
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00019db6:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 8]
+push ebx
+call fcn_00019d3d  ; call 0x19d3d
+add esp, 0x10
+test eax, eax
+je short loc_00019dd9  ; je 0x19dd9
+push edx
+push edx
+push ebx
+push eax
+call fcn_00016fff  ; call 0x16fff
+add esp, 0x10
+
+loc_00019dd9:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00019dde:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+push dword [ebp + 8]
+push 6
+call fcn_00019d86  ; call 0x19d86
+leave
+ret
+
+fcn_00019df0:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+push dword [ebp + 8]
+push 0
+call fcn_00019d86  ; call 0x19d86
+leave
+ret
+
+fcn_00019e02:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00019e39  ; je 0x19e39
+test ebx, ebx
+jne short loc_00019e39  ; jne 0x19e39
+push ecx
+push ref_0002619a  ; push 0x2619a
+push 0x221
+push ref_00025f54  ; push 0x25f54
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00019e39:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00019e62  ; je 0x19e62
+mov eax, ebx
+neg eax
+cmp esi, eax
+jbe short loc_00019e62  ; jbe 0x19e62
+push edx
+push ref_00026015  ; push 0x26015
+push 0x222
+push ref_00025f54  ; push 0x25f54
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00019e62:
+push eax
+push eax
+push esi
+push edi
+call fcn_00019d1f  ; call 0x19d1f
+add esp, 0x10
+test eax, eax
+je short loc_00019e87  ; je 0x19e87
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0xc], ebx
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001713e  ; jmp 0x1713e
+
+loc_00019e87:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00019e91:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 8]
+push ebx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00019ec1  ; je 0x19ec1
+test ebx, ebx
+jne short loc_00019ec1  ; jne 0x19ec1
+push eax
+push ref_0002619a  ; push 0x2619a
+push 0x245
+push ref_00025f54  ; push 0x25f54
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00019ec1:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00019eea  ; je 0x19eea
+mov eax, ebx
+neg eax
+cmp esi, eax
+jbe short loc_00019eea  ; jbe 0x19eea
+push ecx
+push ref_00026015  ; push 0x26015
+push 0x246
+push ref_00025f54  ; push 0x25f54
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00019eea:
+sub esp, 0xc
+push esi
+call fcn_00019d3d  ; call 0x19d3d
+add esp, 0x10
+test eax, eax
+je short loc_00019f06  ; je 0x19f06
+push edx
+push esi
+push ebx
+push eax
+call fcn_0001713e  ; call 0x1713e
+add esp, 0x10
+
+loc_00019f06:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_00019f0d:
+push ebp
+mov ebp, esp
+sub esp, 0xc
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push 6
+call fcn_00019e02  ; call 0x19e02
+leave
+ret
+
+fcn_00019f22:
+push ebp
+mov ebp, esp
+sub esp, 0xc
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push 0
+call fcn_00019e02  ; call 0x19e02
+leave
+ret
+
+fcn_00019f37:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x14
+mov ebx, dword [ebp + 0x10]
+mov esi, dword [ebp + 0x14]
+push ebx
+push dword [ebp + 8]
+call fcn_00019d86  ; call 0x19d86
+add esp, 0x10
+mov edi, eax
+test eax, eax
+je short loc_00019f6f  ; je 0x19f6f
+test esi, esi
+je short loc_00019f6f  ; je 0x19f6f
+cmp ebx, dword [ebp + 0xc]
+cmova ebx, dword [ebp + 0xc]
+push eax
+push ebx
+push esi
+push edi
+call fcn_0001713e  ; call 0x1713e
+add esp, 0x10
+
+loc_00019f6f:
+lea esp, [ebp - 0xc]
+mov eax, edi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_00019f79:
+push ebp
+mov ebp, esp
+sub esp, 8
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push 4
+call fcn_00019f37  ; call 0x19f37
+leave
+ret
+
+fcn_00019f91:
+push ebp
+mov ebp, esp
+sub esp, 8
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push 6
+call fcn_00019f37  ; call 0x19f37
+leave
+ret
+
+fcn_00019fa9:
+push ebp
+mov ebp, esp
+sub esp, 8
+push dword [ebp + 0x10]
+push dword [ebp + 0xc]
+push dword [ebp + 8]
+push 0
+call fcn_00019f37  ; call 0x19f37
+leave
+ret
+
+fcn_00019fc1:
+push ebp
+mov ebp, esp
+pop ebp
+ret
+
+fcn_00019fc6:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_00019ff4  ; je 0x19ff4
+test ebx, 0x400000
+je short loc_00019ff4  ; je 0x19ff4
+push eax
+push ref_00026049  ; push 0x26049
+push 0x33
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_00019ff4:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a019  ; je 0x1a019
+movzx eax, bh
+test eax, eax
+je short loc_0001a019  ; je 0x1a019
+push ecx
+push ref_000260bc  ; push 0x260bc
+push 0x34
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a019:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a03f  ; je 0x1a03f
+test ebx, 0x3f0000
+je short loc_0001a03f  ; je 0x1a03f
+push edx
+push ref_000260e0  ; push 0x260e0
+push 0x35
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a03f:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a065  ; je 0x1a065
+test ebx, 0xff800001
+je short loc_0001a065  ; je 0x1a065
+push eax
+push ref_00026105  ; push 0x26105
+push 0x36
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a065:
+sub esp, 0xc
+push dword [ebp + 0xc]
+push 0
+push 0
+push ebx
+push 0
+call fcn_0001a7eb  ; call 0x1a7eb
+add esp, 0x20
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001a07f:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a0ad  ; je 0x1a0ad
+test ebx, 0x400000
+je short loc_0001a0ad  ; je 0x1a0ad
+push eax
+push ref_00026049  ; push 0x26049
+push 0x5c
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a0ad:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a0d2  ; je 0x1a0d2
+movzx eax, bh
+test eax, eax
+je short loc_0001a0d2  ; je 0x1a0d2
+push ecx
+push ref_000260bc  ; push 0x260bc
+push 0x5d
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a0d2:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a0f8  ; je 0x1a0f8
+test ebx, 0x3f0000
+je short loc_0001a0f8  ; je 0x1a0f8
+push edx
+push ref_000260e0  ; push 0x260e0
+push 0x5e
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a0f8:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a11e  ; je 0x1a11e
+test ebx, 0xff800001
+je short loc_0001a11e  ; je 0x1a11e
+push eax
+push ref_00026105  ; push 0x26105
+push 0x5f
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a11e:
+sub esp, 0xc
+push dword [ebp + 0xc]
+push 0
+push 0
+push ebx
+push 1
+call fcn_0001a7eb  ; call 0x1a7eb
+add esp, 0x20
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001a138:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x14
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a16a  ; je 0x1a16a
+movzx eax, bh
+test eax, eax
+je short loc_0001a16a  ; je 0x1a16a
+push ecx
+push ref_000260bc  ; push 0x260bc
+push 0x8a
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a16a:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a193  ; je 0x1a193
+test ebx, 0x3f0000
+je short loc_0001a193  ; je 0x1a193
+push edx
+push ref_000260e0  ; push 0x260e0
+push 0x8b
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a193:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a1bc  ; je 0x1a1bc
+test ebx, 0xff800001
+je short loc_0001a1bc  ; je 0x1a1bc
+push eax
+push ref_00026105  ; push 0x26105
+push 0x8c
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a1bc:
+sub esp, 0xc
+push dword [ebp + 0xc]
+lea eax, [ebp - 9]
+push eax
+push 1
+push ebx
+push 2
+call fcn_0001a7eb  ; call 0x1a7eb
+mov al, byte [ebp - 9]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001a1d8:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a20e  ; je 0x1a20e
+movzx eax, bh
+test eax, eax
+je short loc_0001a20e  ; je 0x1a20e
+push ecx
+push ref_000260bc  ; push 0x260bc
+push 0xbb
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a20e:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a237  ; je 0x1a237
+test ebx, 0x3f0000
+je short loc_0001a237  ; je 0x1a237
+push edx
+push ref_000260e0  ; push 0x260e0
+push 0xbc
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a237:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a260  ; je 0x1a260
+test ebx, 0xff800001
+je short loc_0001a260  ; je 0x1a260
+push eax
+push ref_00026105  ; push 0x26105
+push 0xbd
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a260:
+sub esp, 0xc
+mov eax, esi
+push dword [ebp + 0x10]
+mov byte [ebp - 9], al
+lea eax, [ebp - 9]
+push eax
+push 1
+push ebx
+push 3
+call fcn_0001a7eb  ; call 0x1a7eb
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001a282:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x14
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a2b5  ; je 0x1a2b5
+test ebx, 0x3f0000
+je short loc_0001a2b5  ; je 0x1a2b5
+push edx
+push ref_000260e0  ; push 0x260e0
+push 0xea
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a2b5:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a2de  ; je 0x1a2de
+test ebx, 0xff800001
+je short loc_0001a2de  ; je 0x1a2de
+push eax
+push ref_00026105  ; push 0x26105
+push 0xeb
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a2de:
+sub esp, 0xc
+push dword [ebp + 0xc]
+lea eax, [ebp - 9]
+push eax
+push 1
+push ebx
+push 4
+call fcn_0001a7eb  ; call 0x1a7eb
+mov al, byte [ebp - 9]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001a2fa:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a331  ; je 0x1a331
+test ebx, 0x3f0000
+je short loc_0001a331  ; je 0x1a331
+push edx
+push ref_000260e0  ; push 0x260e0
+push 0x11a
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a331:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a35a  ; je 0x1a35a
+test ebx, 0xff800001
+je short loc_0001a35a  ; je 0x1a35a
+push eax
+push ref_00026105  ; push 0x26105
+push 0x11b
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a35a:
+sub esp, 0xc
+mov eax, esi
+push dword [ebp + 0x10]
+mov byte [ebp - 9], al
+lea eax, [ebp - 9]
+push eax
+push 1
+push ebx
+push 5
+call fcn_0001a7eb  ; call 0x1a7eb
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001a37c:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x14
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a3af  ; je 0x1a3af
+test ebx, 0x3f0000
+je short loc_0001a3af  ; je 0x1a3af
+push edx
+push ref_000260e0  ; push 0x260e0
+push 0x148
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a3af:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a3d8  ; je 0x1a3d8
+test ebx, 0xff800001
+je short loc_0001a3d8  ; je 0x1a3d8
+push eax
+push ref_00026105  ; push 0x26105
+push 0x149
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a3d8:
+sub esp, 0xc
+push dword [ebp + 0xc]
+lea eax, [ebp - 0xa]
+push eax
+push 2
+push ebx
+push 6
+call fcn_0001a7eb  ; call 0x1a7eb
+mov ax, word [ebp - 0xa]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001a3f5:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a42c  ; je 0x1a42c
+test ebx, 0x3f0000
+je short loc_0001a42c  ; je 0x1a42c
+push edx
+push ref_000260e0  ; push 0x260e0
+push 0x178
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a42c:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a455  ; je 0x1a455
+test ebx, 0xff800001
+je short loc_0001a455  ; je 0x1a455
+push eax
+push ref_00026105  ; push 0x26105
+push 0x179
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a455:
+sub esp, 0xc
+push dword [ebp + 0x10]
+lea eax, [ebp - 0xa]
+mov word [ebp - 0xa], si
+push eax
+push 2
+push ebx
+push 7
+call fcn_0001a7eb  ; call 0x1a7eb
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001a476:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x14
+mov eax, dword [ebp + 0xc]
+mov ebx, dword [ebp + 8]
+mov word [ebp - 0xc], ax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a4b0  ; je 0x1a4b0
+test ebx, 0x3f0000
+je short loc_0001a4b0  ; je 0x1a4b0
+push edx
+push ref_000260e0  ; push 0x260e0
+push 0x1a7
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a4b0:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a4d9  ; je 0x1a4d9
+test ebx, 0xff800001
+je short loc_0001a4d9  ; je 0x1a4d9
+push eax
+push ref_00026105  ; push 0x26105
+push 0x1a8
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a4d9:
+sub esp, 0xc
+push dword [ebp + 0x10]
+lea eax, [ebp - 0xc]
+push eax
+push 2
+push ebx
+push 0xa
+call fcn_0001a7eb  ; call 0x1a7eb
+mov eax, dword [ebp - 0xc]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001a4f5:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a525  ; je 0x1a525
+test esi, esi
+jne short loc_0001a525  ; jne 0x1a525
+push ecx
+push ref_0002619a  ; push 0x2619a
+push 0x1d8
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a525:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a54e  ; je 0x1a54e
+test ebx, 0x3f0000
+je short loc_0001a54e  ; je 0x1a54e
+push edx
+push ref_000260e0  ; push 0x260e0
+push 0x1d9
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a54e:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a577  ; je 0x1a577
+test ebx, 0xff800001
+je short loc_0001a577  ; je 0x1a577
+push eax
+push ref_00026105  ; push 0x26105
+push 0x1da
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a577:
+sub esp, 0xc
+push dword [ebp + 0x10]
+push esi
+push 0x20
+push ebx
+push 8
+call fcn_0001a7eb  ; call 0x1a7eb
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001a58f:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a5bf  ; je 0x1a5bf
+test esi, esi
+jne short loc_0001a5bf  ; jne 0x1a5bf
+push eax
+push ref_0002619a  ; push 0x2619a
+push 0x207
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a5bf:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a5e8  ; je 0x1a5e8
+test ebx, 0x3f0000
+jne short loc_0001a5e8  ; jne 0x1a5e8
+push ecx
+push ref_0002612f  ; push 0x2612f
+push 0x208
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a5e8:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a616  ; je 0x1a616
+mov eax, ebx
+shr eax, 0x10
+and eax, 0x3f
+cmp eax, 0x20
+jbe short loc_0001a616  ; jbe 0x1a616
+push edx
+push ref_00026154  ; push 0x26154
+push 0x209
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a616:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a63f  ; je 0x1a63f
+test ebx, 0xff800001
+je short loc_0001a63f  ; je 0x1a63f
+push eax
+push ref_00026105  ; push 0x26105
+push 0x20a
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a63f:
+sub esp, 0xc
+mov eax, ebx
+push dword [ebp + 0x10]
+shr eax, 0x10
+and eax, 0x3f
+push esi
+push eax
+push ebx
+push 9
+call fcn_0001a7eb  ; call 0x1a7eb
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001a65e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a692  ; je 0x1a692
+test edi, edi
+jne short loc_0001a692  ; jne 0x1a692
+push eax
+push ref_0002617a  ; push 0x2617a
+push 0x23c
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a692:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a6b9  ; je 0x1a6b9
+cmp dword [ebp + 0x10], 0
+jne short loc_0001a6b9  ; jne 0x1a6b9
+push eax
+push ref_00026196  ; push 0x26196
+push 0x23d
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a6b9:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a6e2  ; je 0x1a6e2
+test ebx, 0x3f0000
+jne short loc_0001a6e2  ; jne 0x1a6e2
+push eax
+push ref_0002612f  ; push 0x2612f
+push 0x23e
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a6e2:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a710  ; je 0x1a710
+mov eax, ebx
+shr eax, 0x10
+and eax, 0x3f
+cmp eax, 0x20
+jbe short loc_0001a710  ; jbe 0x1a710
+push esi
+push ref_00026154  ; push 0x26154
+push 0x23f
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a710:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a739  ; je 0x1a739
+test ebx, 0xff800001
+je short loc_0001a739  ; je 0x1a739
+push ecx
+push ref_00026105  ; push 0x26105
+push 0x240
+push ref_0002607b  ; push 0x2607b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a739:
+mov esi, ebx
+shr esi, 0x10
+push eax
+and esi, 0x3f
+push esi
+push edi
+push dword [ebp + 0x10]
+call fcn_0001713e  ; call 0x1713e
+pop edx
+push dword [ebp + 0x14]
+push eax
+push esi
+push ebx
+push 0xb
+call fcn_0001a7eb  ; call 0x1a7eb
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001a762:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x14
+lea eax, [ebp - 0xc]
+push eax
+push 0
+push 0
+push ref_000290bc  ; push 0x290bc
+call fcn_0001975d  ; call 0x1975d
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001a7bf  ; je 0x1a7bf
+test ebx, ebx
+jns short loc_0001a7bf  ; jns 0x1a7bf
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001a7aa  ; je 0x1a7aa
+push ecx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001a7aa:
+push edx
+push ref_000206f4  ; push 0x206f4
+push 0x24
+push ref_000261b1  ; push 0x261b1
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a7bf:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001a7e3  ; je 0x1a7e3
+cmp dword [ebp - 0xc], 0
+jne short loc_0001a7e3  ; jne 0x1a7e3
+push eax
+push ref_000261f5  ; push 0x261f5
+push 0x25
+push ref_000261b1  ; push 0x261b1
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001a7e3:
+mov eax, dword [ebp - 0xc]
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001a7eb:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0x18]
+push ebx
+mov ebx, dword [ebp + 0xc]
+call fcn_0001a762  ; call 0x1a762
+mov ecx, ebx
+shr ecx, 1
+and ecx, 0x7f
+push edx
+push dword [ebp + 0x14]
+lea edx, [ebp + 0x10]
+push edx
+mov edx, ebx
+shr edx, 0x16
+movzx ebx, bh
+and edx, 1
+push edx
+push dword [ebp + 8]
+push ebx
+push ecx
+push eax
+call dword [eax]  ; ucall
+add esp, 0x20
+test esi, esi
+je short loc_0001a827  ; je 0x1a827
+mov dword [esi], eax
+
+loc_0001a827:
+mov eax, dword [ebp + 0x10]
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001a831:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+movzx eax, byte [ebp + 8]
+push eax
+push 0x80
+call fcn_00018eea  ; call 0x18eea
+mov eax, dword [ebp + 8]
+leave
+ret
+
+fcn_0001a84b:
+push ebp
+mov ebp, esp
+sub esp, 0x10
+movzx eax, byte [ebp + 8]
+push eax
+push 0x80
+call fcn_00018eea  ; call 0x18eea
+mov eax, dword [ebp + 8]
+leave
+ret
+
+fcn_0001a865:
+push ebp
+xor eax, eax
+mov ebp, esp
+pop ebp
+ret
+
+fcn_0001a86c:
+push ebp
+xor eax, eax
+mov ebp, esp
+pop ebp
+ret
+
+fcn_0001a873:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00017d8b  ; jmp 0x17d8b
+
+fcn_0001a882:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00017dc2  ; jmp 0x17dc2
+
+fcn_0001a891:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00017e4e  ; jmp 0x17e4e
+
+fcn_0001a8a0:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00017ed8  ; jmp 0x17ed8
+
+fcn_0001a8af:
+push ebp
+mov ebp, esp
+movzx eax, byte [ebp + 0x18]
+mov dword [ebp + 0xc], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00017da5  ; jmp 0x17da5
+
+fcn_0001a8c5:
+push ebp
+mov ebp, esp
+movzx eax, word [ebp + 0x18]
+mov dword [ebp + 0xc], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00017e04  ; jmp 0x17e04
+
+fcn_0001a8db:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x18]
+mov dword [ebp + 0xc], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00017e8f  ; jmp 0x17e8f
+
+fcn_0001a8f0:
+push ebp
+mov ebp, esp
+mov ecx, dword [ebp + 0x10]
+mov eax, dword [ebp + 0x18]
+mov edx, dword [ebp + 0x1c]
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+pop ebp
+jmp near fcn_00017f28  ; jmp 0x17f28
+
+fcn_0001a90b:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00018ee1  ; jmp 0x18ee1
+
+fcn_0001a91a:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00018ef6  ; jmp 0x18ef6
+
+fcn_0001a929:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00018f64  ; jmp 0x18f64
+
+fcn_0001a938:
+push ebp
+mov ebp, esp
+movzx eax, byte [ebp + 0x18]
+mov dword [ebp + 0xc], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00018eea  ; jmp 0x18eea
+
+fcn_0001a94e:
+push ebp
+mov ebp, esp
+movzx eax, word [ebp + 0x18]
+mov dword [ebp + 0xc], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00018f27  ; jmp 0x18f27
+
+fcn_0001a964:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x18]
+mov dword [ebp + 0xc], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00018f97  ; jmp 0x18f97
+
+fcn_0001a979:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0x10]
+mov dword [ebp + 8], eax
+pop ebp
+jmp near fcn_00017d37  ; jmp 0x17d37
+
+fcn_0001a988:
+push ebp
+mov ebp, esp
+mov ecx, dword [ebp + 0x10]
+mov eax, dword [ebp + 0x18]
+mov edx, dword [ebp + 0x1c]
+mov dword [ebp + 8], ecx
+mov dword [ebp + 0xc], eax
+mov dword [ebp + 0x10], edx
+pop ebp
+jmp near fcn_00017d61  ; jmp 0x17d61
+
+fcn_0001a9a3:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0x10]
+cmp dword [ebp + 0x1c], 0
+mov ecx, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov dword [ebp - 0x1c], eax
+mov edi, dword [ebp + 0x14]
+mov eax, 0x80000002
+mov ebx, dword [ebp + 0x18]
+je near loc_0001aa50  ; je 0x1aa50
+cmp esi, 0xb
+ja short loc_0001aa50  ; ja 0x1aa50
+lea edx, [esi - 4]
+cmp edx, 3
+mov edx, 1
+cmovbe ebx, edx
+and esi, 3
+cmp esi, 3
+jne short loc_0001a9ec  ; jne 0x1a9ec
+test cl, cl
+je short loc_0001aa50  ; je 0x1aa50
+
+loc_0001a9ec:
+mov eax, 0xffff
+xor edx, edx
+test cl, cl
+je short loc_0001a9fc  ; je 0x1a9fc
+or eax, 0xffffffff
+xor edx, edx
+
+loc_0001a9fc:
+test ebx, ebx
+jne short loc_0001aa12  ; jne 0x1aa12
+cmp edi, edx
+jb short loc_0001aa46  ; jb 0x1aa46
+ja short loc_0001aa0b  ; ja 0x1aa0b
+
+loc_0001aa06:
+cmp dword [ebp - 0x1c], eax
+jbe short loc_0001aa46  ; jbe 0x1aa46
+
+loc_0001aa0b:
+mov eax, 0x80000003
+jmp short loc_0001aa50  ; jmp 0x1aa50
+
+loc_0001aa12:
+push ecx
+push esi
+push edx
+push eax
+call fcn_0001724f  ; call 0x1724f
+lea ecx, [ebx - 1]
+add esp, 0x10
+cmp edx, 0
+jbe short loc_0001aa4a  ; jbe 0x1aa4a
+
+loc_0001aa26:
+push ecx
+mov ecx, ebx
+xor ebx, ebx
+sub eax, ecx
+sbb edx, ebx
+add eax, 1
+push esi
+adc edx, 0
+push edx
+push eax
+call fcn_0001fdda  ; call 0x1fdda
+add esp, 0x10
+cmp edi, edx
+ja short loc_0001aa0b  ; ja 0x1aa0b
+jae short loc_0001aa06  ; jae 0x1aa06
+
+loc_0001aa46:
+xor eax, eax
+jmp short loc_0001aa50  ; jmp 0x1aa50
+
+loc_0001aa4a:
+cmp eax, ecx
+jb short loc_0001aa0b  ; jb 0x1aa0b
+jmp short loc_0001aa26  ; jmp 0x1aa26
+
+loc_0001aa50:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001aa58:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x24
+mov ebx, dword [ebp + 0x20]
+mov edi, dword [ebp + 0x18]
+mov esi, dword [ebp + 0x14]
+mov edx, dword [ebp + 0x10]
+push ebx
+push dword [ebp + 0x1c]
+mov dword [ebp - 0x1c], edx
+push edi
+push esi
+push edx
+push 1
+call fcn_0001a9a3  ; call 0x1a9a3
+add esp, 0x20
+test eax, eax
+js near loc_0001ab7d  ; js 0x1ab7d
+mov edx, dword [ebp - 0x1c]
+mov dword [ebp - 0x24], 0
+mov al, byte [edx + ref_000295ec]  ; mov al, byte [edx + 0x295ec]
+mov byte [ebp - 0x1e], al
+mov eax, edx
+and eax, 3
+mov dword [ebp - 0x1c], eax
+movzx eax, byte [eax + ref_000295f8]  ; movzx eax, byte [eax + 0x295f8]
+dec eax
+test ebx, eax
+movzx eax, byte [edx + ref_000295f8]  ; movzx eax, byte [edx + 0x295f8]
+sete byte [ebp - 0x1d]
+mov dword [ebp - 0x28], eax
+
+loc_0001aabc:
+cmp dword [ebp + 0x1c], 0
+je near loc_0001ab7b  ; je 0x1ab7b
+cmp dword [ebp - 0x1c], 0
+jne short loc_0001aadc  ; jne 0x1aadc
+sub esp, 0xc
+push esi
+call fcn_00017d8b  ; call 0x17d8b
+mov byte [ebx], al
+jmp near loc_0001ab64  ; jmp 0x1ab64
+
+loc_0001aadc:
+cmp dword [ebp - 0x1c], 1
+jne short loc_0001ab0d  ; jne 0x1ab0d
+cmp byte [ebp - 0x1d], 0
+je short loc_0001aaf6  ; je 0x1aaf6
+sub esp, 0xc
+push esi
+call fcn_00017dc2  ; call 0x17dc2
+mov word [ebx], ax
+jmp short loc_0001ab64  ; jmp 0x1ab64
+
+loc_0001aaf6:
+sub esp, 0xc
+push esi
+call fcn_00017dc2  ; call 0x17dc2
+pop edx
+pop ecx
+movzx eax, ax
+push eax
+push ebx
+call fcn_000172cb  ; call 0x172cb
+jmp short loc_0001ab64  ; jmp 0x1ab64
+
+loc_0001ab0d:
+cmp dword [ebp - 0x1c], 2
+jne short loc_0001ab3a  ; jne 0x1ab3a
+cmp byte [ebp - 0x1d], 0
+je short loc_0001ab26  ; je 0x1ab26
+sub esp, 0xc
+push esi
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [ebx], eax
+jmp short loc_0001ab64  ; jmp 0x1ab64
+
+loc_0001ab26:
+sub esp, 0xc
+push esi
+call fcn_00017e4e  ; call 0x17e4e
+pop edx
+pop ecx
+push eax
+push ebx
+call fcn_000173b2  ; call 0x173b2
+jmp short loc_0001ab64  ; jmp 0x1ab64
+
+loc_0001ab3a:
+cmp byte [ebp - 0x1d], 0
+je short loc_0001ab50  ; je 0x1ab50
+sub esp, 0xc
+push esi
+call fcn_00017ed8  ; call 0x17ed8
+mov dword [ebx], eax
+mov dword [ebx + 4], edx
+jmp short loc_0001ab64  ; jmp 0x1ab64
+
+loc_0001ab50:
+sub esp, 0xc
+push esi
+call fcn_00017ed8  ; call 0x17ed8
+add esp, 0xc
+push edx
+push eax
+push ebx
+call fcn_00017424  ; call 0x17424
+
+loc_0001ab64:
+movzx eax, byte [ebp - 0x1e]
+add esp, 0x10
+add esi, dword [ebp - 0x28]
+adc edi, dword [ebp - 0x24]
+dec dword [ebp + 0x1c]
+add ebx, eax
+jmp near loc_0001aabc  ; jmp 0x1aabc
+
+loc_0001ab7b:
+xor eax, eax
+
+loc_0001ab7d:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001ab85:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x24
+mov ebx, dword [ebp + 0x20]
+mov edi, dword [ebp + 0x18]
+mov esi, dword [ebp + 0x14]
+mov edx, dword [ebp + 0x10]
+push ebx
+push dword [ebp + 0x1c]
+mov dword [ebp - 0x1c], edx
+push edi
+push esi
+push edx
+push 1
+call fcn_0001a9a3  ; call 0x1a9a3
+add esp, 0x20
+test eax, eax
+js near loc_0001ac92  ; js 0x1ac92
+mov edx, dword [ebp - 0x1c]
+mov dword [ebp - 0x24], 0
+mov al, byte [edx + ref_000295ec]  ; mov al, byte [edx + 0x295ec]
+mov byte [ebp - 0x1e], al
+mov eax, edx
+and eax, 3
+mov dword [ebp - 0x1c], eax
+movzx eax, byte [eax + ref_000295f8]  ; movzx eax, byte [eax + 0x295f8]
+dec eax
+test ebx, eax
+movzx eax, byte [edx + ref_000295f8]  ; movzx eax, byte [edx + 0x295f8]
+sete byte [ebp - 0x1d]
+mov dword [ebp - 0x28], eax
+
+loc_0001abe9:
+cmp dword [ebp + 0x1c], 0
+je near loc_0001ac90  ; je 0x1ac90
+cmp dword [ebp - 0x1c], 0
+jne short loc_0001ac07  ; jne 0x1ac07
+push eax
+push eax
+movzx eax, byte [ebx]
+push eax
+push esi
+call fcn_00017da5  ; call 0x17da5
+jmp short loc_0001ac79  ; jmp 0x1ac79
+
+loc_0001ac07:
+cmp dword [ebp - 0x1c], 1
+jne short loc_0001ac31  ; jne 0x1ac31
+cmp byte [ebp - 0x1d], 0
+je short loc_0001ac1a  ; je 0x1ac1a
+push eax
+push eax
+movzx eax, word [ebx]
+jmp short loc_0001ac28  ; jmp 0x1ac28
+
+loc_0001ac1a:
+sub esp, 0xc
+push ebx
+call fcn_00017299  ; call 0x17299
+pop edx
+pop ecx
+movzx eax, ax
+
+loc_0001ac28:
+push eax
+push esi
+call fcn_00017e04  ; call 0x17e04
+jmp short loc_0001ac79  ; jmp 0x1ac79
+
+loc_0001ac31:
+cmp dword [ebp - 0x1c], 2
+jne short loc_0001ac57  ; jne 0x1ac57
+cmp byte [ebp - 0x1d], 0
+je short loc_0001ac43  ; je 0x1ac43
+push eax
+push eax
+push dword [ebx]
+jmp short loc_0001ac4f  ; jmp 0x1ac4f
+
+loc_0001ac43:
+sub esp, 0xc
+push ebx
+call fcn_0001737e  ; call 0x1737e
+pop edx
+pop ecx
+push eax
+
+loc_0001ac4f:
+push esi
+call fcn_00017e8f  ; call 0x17e8f
+jmp short loc_0001ac79  ; jmp 0x1ac79
+
+loc_0001ac57:
+cmp byte [ebp - 0x1d], 0
+je short loc_0001ac65  ; je 0x1ac65
+push eax
+push dword [ebx + 4]
+push dword [ebx]
+jmp short loc_0001ac73  ; jmp 0x1ac73
+
+loc_0001ac65:
+sub esp, 0xc
+push ebx
+call fcn_000173ed  ; call 0x173ed
+add esp, 0xc
+push edx
+push eax
+
+loc_0001ac73:
+push esi
+call fcn_00017f28  ; call 0x17f28
+
+loc_0001ac79:
+movzx eax, byte [ebp - 0x1e]
+add esp, 0x10
+add esi, dword [ebp - 0x28]
+adc edi, dword [ebp - 0x24]
+dec dword [ebp + 0x1c]
+add ebx, eax
+jmp near loc_0001abe9  ; jmp 0x1abe9
+
+loc_0001ac90:
+xor eax, eax
+
+loc_0001ac92:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001ac9a:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x24
+mov ebx, dword [ebp + 0x20]
+mov edi, dword [ebp + 0x18]
+mov esi, dword [ebp + 0x14]
+mov edx, dword [ebp + 0x10]
+push ebx
+push dword [ebp + 0x1c]
+mov dword [ebp - 0x1c], edx
+push edi
+push esi
+push edx
+push 0
+call fcn_0001a9a3  ; call 0x1a9a3
+add esp, 0x20
+test eax, eax
+js near loc_0001ad90  ; js 0x1ad90
+mov edx, dword [ebp - 0x1c]
+mov dword [ebp - 0x24], 0
+mov al, byte [edx + ref_000295ec]  ; mov al, byte [edx + 0x295ec]
+mov byte [ebp - 0x1e], al
+mov eax, edx
+and eax, 3
+mov dword [ebp - 0x1c], eax
+movzx eax, byte [eax + ref_000295f8]  ; movzx eax, byte [eax + 0x295f8]
+dec eax
+test ebx, eax
+movzx eax, byte [edx + ref_000295f8]  ; movzx eax, byte [edx + 0x295f8]
+sete byte [ebp - 0x1d]
+mov dword [ebp - 0x28], eax
+
+loc_0001acfe:
+cmp dword [ebp + 0x1c], 0
+je near loc_0001ad8e  ; je 0x1ad8e
+cmp dword [ebp - 0x1c], 0
+jne short loc_0001ad1b  ; jne 0x1ad1b
+sub esp, 0xc
+push esi
+call fcn_00018ee1  ; call 0x18ee1
+mov byte [ebx], al
+jmp short loc_0001ad77  ; jmp 0x1ad77
+
+loc_0001ad1b:
+cmp dword [ebp - 0x1c], 1
+jne short loc_0001ad4c  ; jne 0x1ad4c
+cmp byte [ebp - 0x1d], 0
+je short loc_0001ad35  ; je 0x1ad35
+sub esp, 0xc
+push esi
+call fcn_00018ef6  ; call 0x18ef6
+mov word [ebx], ax
+jmp short loc_0001ad77  ; jmp 0x1ad77
+
+loc_0001ad35:
+sub esp, 0xc
+push esi
+call fcn_00018ef6  ; call 0x18ef6
+pop edx
+pop ecx
+movzx eax, ax
+push eax
+push ebx
+call fcn_000172cb  ; call 0x172cb
+jmp short loc_0001ad77  ; jmp 0x1ad77
+
+loc_0001ad4c:
+cmp dword [ebp - 0x1c], 2
+jne short loc_0001ad7a  ; jne 0x1ad7a
+cmp byte [ebp - 0x1d], 0
+je short loc_0001ad65  ; je 0x1ad65
+sub esp, 0xc
+push esi
+call fcn_00018f64  ; call 0x18f64
+mov dword [ebx], eax
+jmp short loc_0001ad77  ; jmp 0x1ad77
+
+loc_0001ad65:
+sub esp, 0xc
+push esi
+call fcn_00018f64  ; call 0x18f64
+pop edx
+pop ecx
+push eax
+push ebx
+call fcn_000173b2  ; call 0x173b2
+
+loc_0001ad77:
+add esp, 0x10
+
+loc_0001ad7a:
+movzx eax, byte [ebp - 0x1e]
+add esi, dword [ebp - 0x28]
+adc edi, dword [ebp - 0x24]
+dec dword [ebp + 0x1c]
+add ebx, eax
+jmp near loc_0001acfe  ; jmp 0x1acfe
+
+loc_0001ad8e:
+xor eax, eax
+
+loc_0001ad90:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001ad98:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x24
+mov ebx, dword [ebp + 0x20]
+mov edi, dword [ebp + 0x18]
+mov esi, dword [ebp + 0x14]
+mov edx, dword [ebp + 0x10]
+push ebx
+push dword [ebp + 0x1c]
+mov dword [ebp - 0x1c], edx
+push edi
+push esi
+push edx
+push 0
+call fcn_0001a9a3  ; call 0x1a9a3
+add esp, 0x20
+test eax, eax
+js near loc_0001ae7a  ; js 0x1ae7a
+mov edx, dword [ebp - 0x1c]
+mov dword [ebp - 0x24], 0
+mov al, byte [edx + ref_000295ec]  ; mov al, byte [edx + 0x295ec]
+mov byte [ebp - 0x1e], al
+mov eax, edx
+and eax, 3
+mov dword [ebp - 0x1c], eax
+movzx eax, byte [eax + ref_000295f8]  ; movzx eax, byte [eax + 0x295f8]
+dec eax
+test ebx, eax
+movzx eax, byte [edx + ref_000295f8]  ; movzx eax, byte [edx + 0x295f8]
+sete byte [ebp - 0x1d]
+mov dword [ebp - 0x28], eax
+
+loc_0001adfc:
+cmp dword [ebp + 0x1c], 0
+je short loc_0001ae78  ; je 0x1ae78
+cmp dword [ebp - 0x1c], 0
+jne short loc_0001ae16  ; jne 0x1ae16
+push eax
+push eax
+movzx eax, byte [ebx]
+push eax
+push esi
+call fcn_00018eea  ; call 0x18eea
+jmp short loc_0001ae64  ; jmp 0x1ae64
+
+loc_0001ae16:
+cmp dword [ebp - 0x1c], 1
+jne short loc_0001ae40  ; jne 0x1ae40
+cmp byte [ebp - 0x1d], 0
+je short loc_0001ae29  ; je 0x1ae29
+push eax
+push eax
+movzx eax, word [ebx]
+jmp short loc_0001ae37  ; jmp 0x1ae37
+
+loc_0001ae29:
+sub esp, 0xc
+push ebx
+call fcn_00017299  ; call 0x17299
+pop edx
+pop ecx
+movzx eax, ax
+
+loc_0001ae37:
+push eax
+push esi
+call fcn_00018f27  ; call 0x18f27
+jmp short loc_0001ae64  ; jmp 0x1ae64
+
+loc_0001ae40:
+cmp dword [ebp - 0x1c], 2
+jne short loc_0001ae67  ; jne 0x1ae67
+cmp byte [ebp - 0x1d], 0
+je short loc_0001ae52  ; je 0x1ae52
+push eax
+push eax
+push dword [ebx]
+jmp short loc_0001ae5e  ; jmp 0x1ae5e
+
+loc_0001ae52:
+sub esp, 0xc
+push ebx
+call fcn_0001737e  ; call 0x1737e
+pop edx
+pop ecx
+push eax
+
+loc_0001ae5e:
+push esi
+call fcn_00018f97  ; call 0x18f97
+
+loc_0001ae64:
+add esp, 0x10
+
+loc_0001ae67:
+movzx eax, byte [ebp - 0x1e]
+add esi, dword [ebp - 0x28]
+adc edi, dword [ebp - 0x24]
+dec dword [ebp + 0x1c]
+add ebx, eax
+jmp short loc_0001adfc  ; jmp 0x1adfc
+
+loc_0001ae78:
+xor eax, eax
+
+loc_0001ae7a:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001ae82:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x10
+push dword [ebp + 8]
+call fcn_000198e8  ; call 0x198e8
+mov edx, dword [ebp + 0xc]
+add esp, 0x10
+mov edx, dword [edx]
+mov dword [edx + 0x60], ref_00029610  ; mov dword [edx + 0x60], 0x29610
+cmp eax, 0x80000014
+jne short loc_0001aec4  ; jne 0x1aec4
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001af18  ; je 0x1af18
+push ecx
+push ref_00029610  ; push 0x29610
+push ref_0002620e  ; push 0x2620e
+push 0x40
+call fcn_00015487  ; call 0x15487
+jmp short loc_0001af15  ; jmp 0x1af15
+
+loc_0001aec4:
+sub esp, 0xc
+push ref_00029604  ; push 0x29604
+call fcn_0001972b  ; call 0x1972b
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001af18  ; je 0x1af18
+test ebx, ebx
+jns short loc_0001af18  ; jns 0x1af18
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001af00  ; je 0x1af00
+push edx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001af00:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x35c
+push ref_0002624c  ; push 0x2624c
+call fcn_0001548c  ; call 0x1548c
+
+loc_0001af15:
+add esp, 0x10
+
+loc_0001af18:
+xor eax, eax
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001af1f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov al, byte [ebp + 0xc]
+mov esi, dword [ebp + 8]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x18]
+mov byte [ebp - 0x28], al
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001af62  ; je 0x1af62
+mov eax, dword [ebp - 0x28]
+sub esp, 0xc
+push dword [ebp + 0x14]
+and eax, 0x7f
+push ebx
+add eax, eax
+push eax
+push ref_0002627d  ; push 0x2627d
+push 0x80000
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_0001af62:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001af8b  ; je 0x1af8b
+cmp dword [esi - 0x18], 0x626d7370
+je short loc_0001af8b  ; je 0x1af8b
+push ecx
+push ref_000262c8  ; push 0x262c8
+push 0x43
+push ref_000262dd  ; push 0x262dd
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+jmp short loc_0001af8e  ; jmp 0x1af8e
+
+loc_0001af8b:
+sub esi, 0x18
+
+loc_0001af8e:
+push edx
+mov eax, edi
+push edx
+movzx edi, al
+mov al, byte [ebp - 0x28]
+push dword [ebp + 0x20]
+push dword [ebp + 0x1c]
+push edi
+push dword [ebp + 0x14]
+push ebx
+push eax
+call fcn_0001b3e8  ; call 0x1b3e8
+add esp, 0x14
+push esi
+mov ebx, eax
+call fcn_0001b2c0  ; call 0x1b2c0
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_0001afd4  ; je 0x1afd4
+push eax
+push eax
+push ref_00026307  ; push 0x26307
+push 0x80000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001afd4:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001afde:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 0xc]
+mov eax, dword [ebp + 8]
+mov dword [ebx], 0x626d7370
+mov dword [ebx + 4], eax
+lea eax, [ebp - 0xc]
+push eax
+push 0
+push 0
+push ref_000291dc  ; push 0x291dc
+call fcn_0001975d  ; call 0x1975d
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001b04e  ; je 0x1b04e
+test esi, esi
+jns short loc_0001b04e  ; jns 0x1b04e
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001b036  ; je 0x1b036
+push edx
+push esi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001b036:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0xee
+push ref_000262dd  ; push 0x262dd
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001b04e:
+mov eax, dword [ebp - 0xc]
+movzx edx, word [eax + 0x388]
+add eax, 0x38e
+mov dword [ebx + 8], edx
+mov dl, byte [eax - 1]
+mov dword [ebx + 0xce], eax
+lea eax, [ebx + 0x18]
+mov dword [ebx + 0xc], 0x80000010
+mov dword [ebx + 0x10], ref_000290bc  ; mov dword [ebx + 0x10], 0x290bc
+mov byte [ebx + 0xcd], dl
+mov dword [ebx + 0x14], eax
+mov dword [ebx + 0x18], fcn_0001af1f  ; mov dword [ebx + 0x18], 0x1af1f
+mov dword [ebx + 0x1c], fcn_0001b2a2  ; mov dword [ebx + 0x1c], 0x1b2a2
+mov dword [ebx + 0x20], fcn_0001b2ac  ; mov dword [ebx + 0x20], 0x1b2ac
+mov dword [ebx + 0x24], fcn_0001b2b6  ; mov dword [ebx + 0x24], 0x1b2b6
+mov dword [ebx + 0x38], 0x80000020
+mov dword [ebx + 0x3c], ref_0002909c  ; mov dword [ebx + 0x3c], 0x2909c
+mov dword [ebx + 0x40], fcn_0001b259  ; mov dword [ebx + 0x40], 0x1b259
+mov byte [ebx + 0x44], 0
+mov byte [ebx + 0xd2], 0
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001b0c6:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001b0e5  ; je 0x1b0e5
+push eax
+push eax
+push ref_0002631f  ; push 0x2631f
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001b0e5:
+sub esp, 0xc
+push 0x11b
+call fcn_00019d3d  ; call 0x19d3d
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+jne short loc_0001b11e  ; jne 0x1b11e
+call fcn_00015479  ; call 0x15479
+mov ebx, 0x80000009
+test al, al
+je near loc_0001b250  ; je 0x1b250
+push eax
+push eax
+push ref_0002633f  ; push 0x2633f
+push 0x80000000
+jmp near loc_0001b248  ; jmp 0x1b248
+
+loc_0001b11e:
+push eax
+push eax
+push ebx
+push dword [ebp + 0xc]
+call fcn_0001afde  ; call 0x1afde
+add esp, 0xc
+push 3
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add esp, 0xc
+push dword [ebx + 8]
+push 0xffe0
+mov esi, eax
+lea eax, [eax + 0x20]
+push eax
+call fcn_00018b68  ; call 0x18b68
+pop eax
+pop edx
+lea eax, [esi + 4]
+add esi, 0x40
+push 1
+push eax
+call fcn_00018730  ; call 0x18730
+pop ecx
+pop eax
+push 0x10
+push esi
+call fcn_00018730  ; call 0x18730
+pop eax
+pop edx
+push 8
+push esi
+call fcn_00018730  ; call 0x18730
+add esp, 0xc
+push 1
+push 0xf9
+push esi
+call fcn_0001878a  ; call 0x1878a
+pop ecx
+pop esi
+push 0xff
+push 0
+call fcn_0001b33b  ; call 0x1b33b
+lea eax, [ebx + 0xc]
+mov dword [esp], eax
+call fcn_0001972b  ; call 0x1972b
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001b1e1  ; je 0x1b1e1
+test esi, esi
+jns short loc_0001b1e1  ; jns 0x1b1e1
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001b1c9  ; je 0x1b1c9
+push eax
+push esi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001b1c9:
+push esi
+push ref_000206f4  ; push 0x206f4
+push 0xc4
+push ref_000262dd  ; push 0x262dd
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001b1e1:
+sub esp, 0xc
+add ebx, 0x38
+push ebx
+call fcn_0001977f  ; call 0x1977f
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001b234  ; je 0x1b234
+test ebx, ebx
+jns short loc_0001b234  ; jns 0x1b234
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001b21c  ; je 0x1b21c
+push ecx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001b21c:
+push edx
+push ref_000206f4  ; push 0x206f4
+push 0xca
+push ref_000262dd  ; push 0x262dd
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001b234:
+call fcn_00015479  ; call 0x15479
+xor ebx, ebx
+test al, al
+je short loc_0001b250  ; je 0x1b250
+push eax
+push eax
+push ref_00026368  ; push 0x26368
+push 0x40
+
+loc_0001b248:
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001b250:
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001b259:
+push ebp
+mov ebp, esp
+push ebx
+push ecx
+mov ebx, dword [ebp + 0xc]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001b28d  ; je 0x1b28d
+cmp dword [ebx - 0x38], 0x626d7370
+je short loc_0001b28d  ; je 0x1b28d
+push edx
+push ref_000262c8  ; push 0x262c8
+push 0x120
+push ref_000262dd  ; push 0x262dd
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+jmp short loc_0001b290  ; jmp 0x1b290
+
+loc_0001b28d:
+sub ebx, 0x38
+
+loc_0001b290:
+push eax
+push eax
+push ebx
+push dword [ebp + 8]
+call fcn_0001afde  ; call 0x1afde
+xor eax, eax
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001b2a2:
+push ebp
+mov eax, 0x80000003
+mov ebp, esp
+pop ebp
+ret
+
+fcn_0001b2ac:
+push ebp
+mov eax, 0x80000003
+mov ebp, esp
+pop ebp
+ret
+
+fcn_0001b2b6:
+push ebp
+mov eax, 0x80000003
+mov ebp, esp
+pop ebp
+ret
+
+fcn_0001b2c0:
+push ebp
+mov ebp, esp
+pop ebp
+ret
+
+fcn_0001b2c5:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 8
+push 3
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x20
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+and ebx, 0xffe0
+add esp, 0x10
+test al, al
+je short loc_0001b317  ; je 0x1b317
+test ebx, ebx
+je short loc_0001b302  ; je 0x1b302
+cmp ebx, 0xffe0
+jne short loc_0001b317  ; jne 0x1b317
+
+loc_0001b302:
+push eax
+push ref_00026386  ; push 0x26386
+push 0x2c
+push ref_000263b4  ; push 0x263b4
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001b317:
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001b31e:
+push ebp
+mov ebp, esp
+push ebx
+push eax
+mov ebx, dword [ebp + 8]
+call fcn_0001b2c5  ; call 0x1b2c5
+movzx ebx, bl
+add eax, ebx
+mov dword [ebp + 8], eax
+pop edx
+pop ebx
+pop ebp
+jmp near fcn_00018ee1  ; jmp 0x18ee1
+
+fcn_0001b33b:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 8]
+call fcn_0001b2c5  ; call 0x1b2c5
+mov edx, esi
+movzx ebx, bl
+movzx esi, dl
+mov dword [ebp + 0xc], esi
+add eax, ebx
+mov dword [ebp + 8], eax
+pop ebx
+pop esi
+pop ebp
+jmp near fcn_00018eea  ; jmp 0x18eea
+
+fcn_0001b363:
+push ebp
+mov ebp, esp
+push ebx
+mov ebx, 0x186a0
+push eax
+
+loc_0001b36d:
+sub esp, 0xc
+push 0
+call fcn_0001b31e  ; call 0x1b31e
+mov edx, dword [ebp + 8]
+add esp, 0x10
+mov byte [edx], al
+test al, 0x8e
+jne short loc_0001b397  ; jne 0x1b397
+sub esp, 0xc
+push 0xa
+call fcn_0001bb03  ; call 0x1bb03
+add esp, 0x10
+dec ebx
+jne short loc_0001b36d  ; jne 0x1b36d
+xor eax, eax
+jmp short loc_0001b399  ; jmp 0x1b399
+
+loc_0001b397:
+mov al, 1
+
+loc_0001b399:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001b39e:
+push ebp
+mov ebp, esp
+push ebx
+mov ebx, 0x80000012
+sub esp, 0x10
+push 0
+call fcn_0001b31e  ; call 0x1b31e
+add esp, 0x10
+test al, 0x40
+jne short loc_0001b3e1  ; jne 0x1b3e1
+test al, 1
+je short loc_0001b3cf  ; je 0x1b3cf
+push ecx
+push ecx
+push 0xff
+push 0
+call fcn_0001b33b  ; call 0x1b33b
+add esp, 0x10
+jmp short loc_0001b3e1  ; jmp 0x1b3e1
+
+loc_0001b3cf:
+push edx
+movzx eax, al
+push edx
+xor ebx, ebx
+push eax
+push 0
+call fcn_0001b33b  ; call 0x1b33b
+add esp, 0x10
+
+loc_0001b3e1:
+mov eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001b3e8:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x3c
+mov al, byte [ebp + 0x14]
+cmp dword [ebp + 0x10], 1
+mov edi, dword [ebp + 0x18]
+mov byte [ebp - 0x2f], al
+jbe short loc_0001b412  ; jbe 0x1b412
+cmp dword [ebp + 0x1c], 0
+je near loc_0001b914  ; je 0x1b914
+test edi, edi
+je near loc_0001b914  ; je 0x1b914
+
+loc_0001b412:
+call fcn_0001b39e  ; call 0x1b39e
+test eax, eax
+js near loc_0001b919  ; js 0x1b919
+mov al, byte [ebp + 8]
+mov dword [ebp - 0x34], 3
+mov byte [ebp - 0x2d], 0
+lea eax, [eax + eax + 1]
+mov byte [ebp - 0x2e], al
+
+loc_0001b434:
+mov al, byte [ebp - 0x2e]
+cmp dword [ebp + 0x10], 0xb
+mov byte [ebp - 0x2c], al
+mov al, byte [ebp + 0xc]
+mov byte [ebp - 0x30], al
+ja near loc_0001b5e9  ; ja 0x1b5e9
+mov eax, dword [ebp + 0x10]
+jmp dword [eax*4 + ref_000205a0]  ; ujmp: jmp dword [eax*4 + 0x205a0]
+
+loc_0001b454:
+mov al, byte [ebp - 0x2e]
+dec eax
+mov byte [ebp - 0x2c], al
+
+loc_0001b45b:
+cmp byte [ebp - 0x2f], 1
+je near loc_0001b5d9  ; je 0x1b5d9
+xor esi, esi
+jmp near loc_0001b5d5  ; jmp 0x1b5d5
+
+loc_0001b46c:
+mov eax, dword [ebp + 0x1c]
+mov al, byte [eax]
+mov byte [ebp - 0x30], al
+mov al, byte [ebp - 0x2e]
+dec eax
+mov byte [ebp - 0x2c], al
+
+loc_0001b47b:
+cmp dword [edi], 1
+mov esi, 4
+mov dword [edi], 1
+sbb ebx, ebx
+and ebx, 0x80000005
+jmp near loc_0001b597  ; jmp 0x1b597
+
+loc_0001b496:
+mov eax, dword [ebp + 0x1c]
+push ecx
+push ecx
+movzx eax, byte [eax]
+push eax
+push 5
+call fcn_0001b33b  ; call 0x1b33b
+mov al, byte [ebp - 0x2e]
+add esp, 0x10
+mov dword [edi], 1
+dec eax
+mov byte [ebp - 0x2c], al
+
+loc_0001b4b6:
+mov eax, dword [edi]
+test eax, eax
+je near loc_0001b5c6  ; je 0x1b5c6
+cmp eax, 1
+je near loc_0001b5d0  ; je 0x1b5d0
+cmp eax, 0x100
+ja near loc_0001b5e9  ; ja 0x1b5e9
+cmp byte [ebp - 0x2f], 1
+je near loc_0001b5d9  ; je 0x1b5d9
+mov esi, 0x18
+jmp near loc_0001b5d5  ; jmp 0x1b5d5
+
+loc_0001b4e8:
+mov al, byte [ebp - 0x2e]
+dec eax
+mov byte [ebp - 0x2c], al
+push eax
+push eax
+mov eax, dword [ebp + 0x1c]
+movzx eax, byte [eax + 1]
+push eax
+push 6
+call fcn_0001b33b  ; call 0x1b33b
+pop eax
+mov eax, dword [ebp + 0x1c]
+pop edx
+movzx eax, byte [eax]
+push eax
+push 5
+call fcn_0001b33b  ; call 0x1b33b
+add esp, 0x10
+
+loc_0001b513:
+cmp dword [edi], 2
+mov esi, 0xc
+mov dword [edi], 2
+sbb ebx, ebx
+and ebx, 0x80000005
+jmp short loc_0001b597  ; jmp 0x1b597
+
+loc_0001b52b:
+push eax
+push eax
+movzx eax, byte [edi]
+push eax
+push 5
+call fcn_0001b33b  ; call 0x1b33b
+mov al, byte [ebp - 0x2e]
+add esp, 0x10
+dec eax
+mov byte [ebp - 0x2c], al
+mov al, byte [edi]
+mov byte [ebp - 0x2d], al
+
+loc_0001b547:
+mov eax, dword [edi]
+dec eax
+cmp eax, 0x1f
+ja near loc_0001b5e9  ; ja 0x1b5e9
+mov esi, 0x14
+jmp near loc_0001b5e3  ; jmp 0x1b5e3
+
+loc_0001b55d:
+mov eax, dword [ebp + 0x1c]
+push ebx
+push ebx
+movzx eax, byte [eax + 1]
+push eax
+push 6
+call fcn_0001b33b  ; call 0x1b33b
+pop esi
+mov esi, 0x10
+pop eax
+mov eax, dword [ebp + 0x1c]
+movzx eax, byte [eax]
+push eax
+push 5
+call fcn_0001b33b  ; call 0x1b33b
+add esp, 0x10
+cmp dword [edi], 2
+mov dword [edi], 2
+sbb ebx, ebx
+and ebx, 0x80000005
+
+loc_0001b597:
+xor eax, eax
+test ebx, ebx
+jns short loc_0001b5f3  ; jns 0x1b5f3
+jmp near loc_0001b8e9  ; jmp 0x1b8e9
+
+loc_0001b5a2:
+mov eax, dword [edi]
+dec eax
+cmp eax, 0x1f
+ja short loc_0001b5e9  ; ja 0x1b5e9
+push ecx
+mov esi, 0x1c
+push ecx
+movzx eax, byte [edi]
+push eax
+push 5
+call fcn_0001b33b  ; call 0x1b33b
+mov al, byte [edi]
+add esp, 0x10
+mov byte [ebp - 0x2d], al
+jmp short loc_0001b5e3  ; jmp 0x1b5e3
+
+loc_0001b5c6:
+mov ebx, 0x80000005
+jmp near loc_0001b8e9  ; jmp 0x1b8e9
+
+loc_0001b5d0:
+mov esi, 8
+
+loc_0001b5d5:
+xor eax, eax
+jmp short loc_0001b5e5  ; jmp 0x1b5e5
+
+loc_0001b5d9:
+mov ebx, 0x80000003
+jmp near loc_0001b8e9  ; jmp 0x1b8e9
+
+loc_0001b5e3:
+mov al, 2
+
+loc_0001b5e5:
+xor ebx, ebx
+jmp short loc_0001b5f3  ; jmp 0x1b5f3
+
+loc_0001b5e9:
+mov ebx, 0x80000002
+jmp near loc_0001b8e9  ; jmp 0x1b8e9
+
+loc_0001b5f3:
+mov dl, al
+or edx, 1
+cmp byte [ebp - 0x2f], 1
+cmove eax, edx
+push edx
+movzx eax, al
+push edx
+push eax
+push 0xd
+call fcn_0001b33b  ; call 0x1b33b
+mov dword [esp], 2
+call fcn_0001b31e  ; call 0x1b31e
+mov eax, dword [ebp + 0x10]
+add esp, 0x10
+and eax, 0xfffffffd
+cmp eax, 9
+je short loc_0001b643  ; je 0x1b643
+
+loc_0001b626:
+movzx eax, byte [ebp - 0x2c]
+push ecx
+push ecx
+push eax
+push 4
+call fcn_0001b33b  ; call 0x1b33b
+add esp, 0x10
+movzx eax, byte [ebp - 0x30]
+cmp dword [ebp + 0x10], 4
+jne short loc_0001b67a  ; jne 0x1b67a
+jmp short loc_0001b66e  ; jmp 0x1b66e
+
+loc_0001b643:
+movzx ecx, byte [ebp - 0x2d]
+xor eax, eax
+mov dword [ebp - 0x38], ecx
+
+loc_0001b64c:
+cmp eax, dword [ebp - 0x38]
+jae short loc_0001b626  ; jae 0x1b626
+mov ecx, dword [ebp + 0x1c]
+push edx
+push edx
+movzx edx, byte [ecx + eax]
+mov dword [ebp - 0x3c], eax
+push edx
+push 7
+call fcn_0001b33b  ; call 0x1b33b
+mov eax, dword [ebp - 0x3c]
+add esp, 0x10
+inc eax
+jmp short loc_0001b64c  ; jmp 0x1b64c
+
+loc_0001b66e:
+cmp dword [edi], 1
+jbe short loc_0001b67a  ; jbe 0x1b67a
+push ecx
+push ecx
+push eax
+push 6
+jmp short loc_0001b67f  ; jmp 0x1b67f
+
+loc_0001b67a:
+push edx
+push edx
+push eax
+push 3
+
+loc_0001b67f:
+call fcn_0001b33b  ; call 0x1b33b
+add esp, 0x10
+lea eax, [esi + 0x40]
+movzx esi, al
+push ecx
+push ecx
+push esi
+push 2
+call fcn_0001b33b  ; call 0x1b33b
+lea eax, [ebp - 0x19]
+mov dword [esp], eax
+call fcn_0001b363  ; call 0x1b363
+add esp, 0x10
+test al, al
+je near loc_0001b8e4  ; je 0x1b8e4
+mov al, byte [ebp - 0x19]
+test al, 4
+je short loc_0001b6d6  ; je 0x1b6d6
+sub esp, 0xc
+push 0xc
+call fcn_0001b31e  ; call 0x1b31e
+add esp, 0x10
+and eax, 1
+cmp al, 1
+sbb ebx, ebx
+and ebx, 0xffffffec
+sub ebx, 0x7fffffe5
+jmp near loc_0001b8e9  ; jmp 0x1b8e9
+
+loc_0001b6d6:
+test al, 8
+je short loc_0001b6fe  ; je 0x1b6fe
+push ebx
+push ebx
+push 8
+push 0
+call fcn_0001b33b  ; call 0x1b33b
+pop esi
+pop eax
+push 0xff
+push 0
+call fcn_0001b33b  ; call 0x1b33b
+pop eax
+pop edx
+push 1
+push 0xc
+jmp near loc_0001b8c0  ; jmp 0x1b8c0
+
+loc_0001b6fe:
+mov eax, dword [ebp + 0x10]
+sub eax, 2
+cmp eax, 9
+ja near loc_0001b8ac  ; ja 0x1b8ac
+jmp dword [eax*4 + ref_000205d0]  ; ujmp: jmp dword [eax*4 + 0x205d0]
+
+loc_0001b714:
+sub esp, 0xc
+push 6
+call fcn_0001b31e  ; call 0x1b31e
+mov ecx, dword [ebp + 0x1c]
+mov byte [ecx + 1], al
+mov dword [esp], 5
+jmp near loc_0001b7eb  ; jmp 0x1b7eb
+
+loc_0001b730:
+cmp dword [edi], 1
+jbe near loc_0001b7e6  ; jbe 0x1b7e6
+xor esi, esi
+
+loc_0001b73b:
+cmp esi, dword [edi]
+jae near loc_0001b8ac  ; jae 0x1b8ac
+sub esp, 0xc
+push 7
+call fcn_0001b31e  ; call 0x1b31e
+mov ecx, dword [ebp + 0x1c]
+add esp, 0x10
+mov byte [ecx + esi], al
+mov eax, dword [edi]
+lea edx, [eax - 2]
+cmp esi, edx
+jne short loc_0001b773  ; jne 0x1b773
+sub esp, 0xc
+push 2
+call fcn_0001b31e  ; call 0x1b31e
+pop edx
+pop ecx
+or eax, 0x20
+movzx eax, al
+jmp short loc_0001b789  ; jmp 0x1b789
+
+loc_0001b773:
+dec eax
+cmp esi, eax
+jne short loc_0001b794  ; jne 0x1b794
+sub esp, 0xc
+push 2
+call fcn_0001b31e  ; call 0x1b31e
+pop edx
+pop ecx
+and eax, 0xdf
+
+loc_0001b789:
+push eax
+push 2
+call fcn_0001b33b  ; call 0x1b33b
+add esp, 0x10
+
+loc_0001b794:
+push eax
+push eax
+push 0x80
+push 0
+call fcn_0001b33b  ; call 0x1b33b
+mov eax, dword [edi]
+add esp, 0x10
+dec eax
+cmp esi, eax
+jae short loc_0001b7e0  ; jae 0x1b7e0
+mov dword [ebp - 0x2c], 0x64
+
+loc_0001b7b3:
+sub esp, 0xc
+push 0
+call fcn_0001b31e  ; call 0x1b31e
+add esp, 0x10
+test al, al
+js short loc_0001b7e0  ; js 0x1b7e0
+sub esp, 0xc
+push 0xa
+call fcn_0001bb03  ; call 0x1bb03
+add esp, 0x10
+dec dword [ebp - 0x2c]
+jne short loc_0001b7b3  ; jne 0x1b7b3
+mov ebx, 0x80000012
+jmp near loc_0001b8ac  ; jmp 0x1b8ac
+
+loc_0001b7e0:
+inc esi
+jmp near loc_0001b73b  ; jmp 0x1b73b
+
+loc_0001b7e6:
+sub esp, 0xc
+push 5
+
+loc_0001b7eb:
+call fcn_0001b31e  ; call 0x1b31e
+mov ecx, dword [ebp + 0x1c]
+mov byte [ecx], al
+jmp short loc_0001b805  ; jmp 0x1b805
+
+loc_0001b7f7:
+push eax
+push eax
+push 0x80
+push 0
+call fcn_0001b33b  ; call 0x1b33b
+
+loc_0001b805:
+add esp, 0x10
+jmp near loc_0001b8ac  ; jmp 0x1b8ac
+
+loc_0001b80d:
+sub esp, 0xc
+xor esi, esi
+push 5
+call fcn_0001b31e  ; call 0x1b31e
+add esp, 0x10
+mov byte [ebp - 0x2d], al
+movzx edx, al
+mov al, 1
+cmp dword [edi], edx
+jb short loc_0001b84a  ; jb 0x1b84a
+
+loc_0001b828:
+cmp esi, edx
+jae short loc_0001b848  ; jae 0x1b848
+sub esp, 0xc
+push 7
+mov dword [ebp - 0x2c], edx
+call fcn_0001b31e  ; call 0x1b31e
+mov ecx, dword [ebp + 0x1c]
+add esp, 0x10
+mov edx, dword [ebp - 0x2c]
+mov byte [ecx + esi], al
+inc esi
+jmp short loc_0001b828  ; jmp 0x1b828
+
+loc_0001b848:
+xor eax, eax
+
+loc_0001b84a:
+test al, al
+mov eax, 0x80000005
+mov dword [edi], edx
+cmovne ebx, eax
+jmp short loc_0001b8ac  ; jmp 0x1b8ac
+
+loc_0001b858:
+sub esp, 0xc
+push 5
+call fcn_0001b31e  ; call 0x1b31e
+add esp, 0x10
+mov byte [ebp - 0x2d], al
+test al, al
+je short loc_0001b8a0  ; je 0x1b8a0
+movzx eax, byte [edi]
+xor esi, esi
+movzx edx, byte [ebp - 0x2d]
+add eax, edx
+cmp eax, 0x20
+jg short loc_0001b8a7  ; jg 0x1b8a7
+
+loc_0001b87c:
+cmp esi, edx
+jae short loc_0001b89c  ; jae 0x1b89c
+sub esp, 0xc
+push 7
+mov dword [ebp - 0x2c], edx
+call fcn_0001b31e  ; call 0x1b31e
+mov ecx, dword [ebp + 0x1c]
+add esp, 0x10
+mov edx, dword [ebp - 0x2c]
+mov byte [ecx + esi], al
+inc esi
+jmp short loc_0001b87c  ; jmp 0x1b87c
+
+loc_0001b89c:
+mov dword [edi], edx
+jmp short loc_0001b8ac  ; jmp 0x1b8ac
+
+loc_0001b8a0:
+mov ebx, 0x80000005
+jmp short loc_0001b8ac  ; jmp 0x1b8ac
+
+loc_0001b8a7:
+mov ebx, 0x80000007
+
+loc_0001b8ac:
+test byte [ebp - 0x19], 8
+je short loc_0001b8e9  ; je 0x1b8e9
+cmp ebx, 0x80000005
+je short loc_0001b8e9  ; je 0x1b8e9
+push eax
+push eax
+push 8
+push 0
+
+loc_0001b8c0:
+call fcn_0001b33b  ; call 0x1b33b
+mov dword [esp], 0xa
+call fcn_0001bb03  ; call 0x1bb03
+add esp, 0x10
+dec dword [ebp - 0x34]
+jne near loc_0001b434  ; jne 0x1b434
+mov ebx, 0x80000007
+jmp short loc_0001b8e9  ; jmp 0x1b8e9
+
+loc_0001b8e4:
+mov ebx, 0x80000012
+
+loc_0001b8e9:
+push eax
+push eax
+push 0xff
+push 0
+call fcn_0001b33b  ; call 0x1b33b
+pop edx
+pop ecx
+push 1
+push 0xc
+call fcn_0001b33b  ; call 0x1b33b
+pop esi
+pop edi
+push 0
+push 0xd
+call fcn_0001b33b  ; call 0x1b33b
+add esp, 0x10
+mov eax, ebx
+jmp short loc_0001b919  ; jmp 0x1b919
+
+loc_0001b914:
+mov eax, 0x80000002
+
+loc_0001b919:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001b921:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 8
+push 3
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+pop edx
+pop ecx
+push 1
+mov ebx, eax
+lea eax, [eax + 4]
+add ebx, 0x40
+push eax
+call fcn_00018730  ; call 0x18730
+add esp, 0xc
+push 1
+push 0xf9
+push ebx
+call fcn_0001878a  ; call 0x1878a
+pop ebx
+pop eax
+push 0xff
+push 0
+call fcn_0001b33b  ; call 0x1b33b
+add esp, 0x10
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001b96b:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001b98a  ; je 0x1b98a
+push ebx
+push ebx
+push ref_000263e0  ; push 0x263e0
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001b98a:
+sub esp, 0xc
+mov esi, 0x80000009
+push 0x20
+call fcn_00019db6  ; call 0x19db6
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+je near loc_0001ba2d  ; je 0x1ba2d
+sub esp, 0xc
+lea eax, [eax + 0xc]
+push eax
+call fcn_0001ff91  ; call 0x1ff91
+lea eax, [ebx + 0x14]
+mov dword [ebx], 0x80000010
+mov dword [ebx + 4], ref_0002913c  ; mov dword [ebx + 4], 0x2913c
+mov dword [ebx + 8], eax
+mov dword [esp], ebx
+call fcn_0001972b  ; call 0x1972b
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001ba11  ; je 0x1ba11
+test ebx, ebx
+jns short loc_0001ba11  ; jns 0x1ba11
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001b9fc  ; je 0x1b9fc
+push ecx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001b9fc:
+push edx
+push ref_000206f4  ; push 0x206f4
+push 0x4c
+push ref_000263f9  ; push 0x263f9
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001ba11:
+call fcn_00015479  ; call 0x15479
+mov esi, ebx
+test al, al
+je short loc_0001ba2d  ; je 0x1ba2d
+push eax
+push eax
+push ref_0002641e  ; push 0x2641e
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001ba2d:
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001ba36:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+sub eax, 4
+cmp eax, 1
+ja short loc_0001ba89  ; ja 0x1ba89
+push 0
+push 0
+push 0
+push ref_0002909c  ; push 0x2909c
+call fcn_0001975d  ; call 0x1975d
+add esp, 0x10
+test eax, eax
+jne short loc_0001ba89  ; jne 0x1ba89
+call fcn_00015479  ; call 0x15479
+mov ebx, 0x80000003
+test al, al
+je near loc_0001baf9  ; je 0x1baf9
+push ecx
+push ecx
+push ref_00026435  ; push 0x26435
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp short loc_0001baf9  ; jmp 0x1baf9
+
+loc_0001ba89:
+xor ebx, ebx
+lea edi, [ebp - 0x1c]
+
+loc_0001ba8e:
+push edi
+push 0
+push ebx
+push ref_0002915c  ; push 0x2915c
+call fcn_0001975d  ; call 0x1975d
+add esp, 0x10
+mov esi, eax
+test eax, eax
+jne short loc_0001bab2  ; jne 0x1bab2
+mov eax, dword [ebp - 0x1c]
+sub esp, 0xc
+push dword [ebp + 8]
+call dword [eax]  ; ucall
+jmp short loc_0001baeb  ; jmp 0x1baeb
+
+loc_0001bab2:
+cmp eax, 0x8000000e
+jne short loc_0001bad4  ; jne 0x1bad4
+test ebx, ebx
+jne short loc_0001bad4  ; jne 0x1bad4
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001baee  ; je 0x1baee
+push edx
+push edx
+push ref_0002645f  ; push 0x2645f
+push 0x80000040
+jmp short loc_0001bae6  ; jmp 0x1bae6
+
+loc_0001bad4:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001baee  ; je 0x1baee
+push eax
+push eax
+push ref_0002648a  ; push 0x2648a
+push 0x40
+
+loc_0001bae6:
+call fcn_00015487  ; call 0x15487
+
+loc_0001baeb:
+add esp, 0x10
+
+loc_0001baee:
+inc ebx
+cmp esi, 0x8000000e
+jne short loc_0001ba8e  ; jne 0x1ba8e
+xor ebx, ebx
+
+loc_0001baf9:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001bb03:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov edi, dword [ebp + 8]
+test edi, edi
+je near loc_0001bba1  ; je 0x1bba1
+push eax
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x40
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+mov esi, eax
+and esi, 0xfffc
+add esi, 8
+mov dword [esp], esi
+call fcn_00018f64  ; call 0x18f64
+mov ecx, 0x64
+xor edx, edx
+add esp, 0x10
+mov ebx, eax
+imul eax, edi, 0x166
+and ebx, 0xffffff
+div ecx
+lea edi, [ebx + eax + 1]
+mov ecx, edi
+and edi, 0xffffff
+shr ecx, 0x18
+
+loc_0001bb6a:
+test ecx, ecx
+setne dl
+cmp edi, ebx
+jbe short loc_0001bb9d  ; jbe 0x1bb9d
+
+loc_0001bb73:
+sub esp, 0xc
+push esi
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x1c], ecx
+call fcn_00018f64  ; call 0x18f64
+add esp, 0x10
+mov ecx, dword [ebp - 0x1c]
+mov edx, dword [ebp - 0x20]
+and eax, 0xffffff
+cmp eax, ebx
+jae short loc_0001bb99  ; jae 0x1bb99
+test dl, dl
+je short loc_0001bba1  ; je 0x1bba1
+dec ecx
+
+loc_0001bb99:
+mov ebx, eax
+jmp short loc_0001bb6a  ; jmp 0x1bb6a
+
+loc_0001bb9d:
+test dl, dl
+jne short loc_0001bb73  ; jne 0x1bb73
+
+loc_0001bba1:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001bba9:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 8]
+lea eax, [ebx + 0x3804]
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+xor edx, edx
+test ah, 0x40
+je short loc_0001bbf6  ; je 0x1bbf6
+push eax
+push 0
+push 0xffff8003
+lea eax, [ebx + 0x38b0]
+add ebx, 0x38b4
+push eax
+call fcn_00018b68  ; call 0x18b68
+mov dword [esp], ebx
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+cmp eax, 0xff0a55a
+sete dl
+
+loc_0001bbf6:
+mov al, dl
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001bbfd:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x18
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov ebx, eax
+lea eax, [eax + 8]
+add ebx, 2
+mov dword [esp], eax
+call fcn_00017d8b  ; call 0x17d8b
+mov dword [esp], ebx
+mov dl, al
+mov dword [ebp - 0xc], edx
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+mov edx, dword [ebp - 0xc]
+mov ecx, eax
+and ecx, 0xfffffffd
+cmp cx, 0x8c44
+je short loc_0001bc80  ; je 0x1bc80
+lea ecx, [eax + 0x73b2]
+cmp cx, 2
+jbe short loc_0001bc80  ; jbe 0x1bc80
+lea ecx, [eax + 0x73b7]
+cmp cx, 3
+jbe short loc_0001bc80  ; jbe 0x1bc80
+lea ecx, [eax + 0x73bf]
+cmp cx, 1
+jbe short loc_0001bc80  ; jbe 0x1bc80
+cmp ax, 0x8c58
+je short loc_0001bc80  ; je 0x1bc80
+mov ecx, eax
+and ecx, 0xfffffffb
+cmp cx, 0x8c52
+je short loc_0001bc80  ; je 0x1bc80
+mov ecx, eax
+and ecx, 0xfffffff7
+cmp cx, 0x8c54
+jne short loc_0001bca7  ; jne 0x1bca7
+
+loc_0001bc80:
+cmp dl, 4
+je near loc_0001bd5d  ; je 0x1bd5d
+cmp dl, 5
+je short loc_0001bc9d  ; je 0x1bc9d
+mov eax, 1
+cmp dl, 3
+jne short loc_0001bcc0  ; jne 0x1bcc0
+jmp near loc_0001bd70  ; jmp 0x1bd70
+
+loc_0001bc9d:
+mov eax, 3
+jmp near loc_0001bd70  ; jmp 0x1bd70
+
+loc_0001bca7:
+lea ecx, [eax + 0x733f]
+cmp cx, 5
+ja short loc_0001bcd5  ; ja 0x1bcd5
+mov eax, 0x10
+test dl, dl
+je near loc_0001bd70  ; je 0x1bd70
+
+loc_0001bcc0:
+call fcn_00015479  ; call 0x15479
+test al, al
+je near loc_0001bd56  ; je 0x1bd56
+push ecx
+push ref_000264b4  ; push 0x264b4
+jmp short loc_0001bd44  ; jmp 0x1bd44
+
+loc_0001bcd5:
+lea ecx, [eax + 0x63bf]
+cmp cx, 6
+ja short loc_0001bd0f  ; ja 0x1bd0f
+cmp dl, 3
+je short loc_0001bd64  ; je 0x1bd64
+cmp dl, 4
+je short loc_0001bcf7  ; je 0x1bcf7
+mov eax, 0x20
+cmp dl, 2
+jne short loc_0001bcfe  ; jne 0x1bcfe
+jmp short loc_0001bd70  ; jmp 0x1bd70
+
+loc_0001bcf7:
+mov eax, 0x22
+jmp short loc_0001bd70  ; jmp 0x1bd70
+
+loc_0001bcfe:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001bd56  ; je 0x1bd56
+push edx
+push ref_000264bb  ; push 0x264bb
+jmp short loc_0001bd44  ; jmp 0x1bd44
+
+loc_0001bd0f:
+add ax, 0x633f
+cmp ax, 0xa
+ja short loc_0001bd56  ; ja 0x1bd56
+cmp dl, 2
+je short loc_0001bd6b  ; je 0x1bd6b
+cmp dl, 3
+je short loc_0001bd2e  ; je 0x1bd2e
+dec dl
+jne short loc_0001bd35  ; jne 0x1bd35
+mov eax, 0x41
+jmp short loc_0001bd70  ; jmp 0x1bd70
+
+loc_0001bd2e:
+mov eax, 0x43
+jmp short loc_0001bd70  ; jmp 0x1bd70
+
+loc_0001bd35:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001bd56  ; je 0x1bd56
+push eax
+push ref_000264c3  ; push 0x264c3
+
+loc_0001bd44:
+push ref_00029660  ; push 0x29660
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001bd56:
+mov eax, 0x44
+jmp short loc_0001bd70  ; jmp 0x1bd70
+
+loc_0001bd5d:
+mov eax, 2
+jmp short loc_0001bd70  ; jmp 0x1bd70
+
+loc_0001bd64:
+mov eax, 0x21
+jmp short loc_0001bd70  ; jmp 0x1bd70
+
+loc_0001bd6b:
+mov eax, 0x42
+
+loc_0001bd70:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001bd75:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+push edx
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov esi, eax
+lea eax, [eax + 2]
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+mov dword [esp], esi
+movzx ebx, ax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+cmp ax, 0x8086
+jne short loc_0001be20  ; jne 0x1be20
+mov eax, ebx
+mov esi, 1
+and eax, 0xfffffffd
+cmp ax, 0x8c44
+je near loc_0001be46  ; je 0x1be46
+lea eax, [ebx + 0x73b2]
+cmp ax, 2
+jbe short loc_0001be46  ; jbe 0x1be46
+lea eax, [ebx + 0x73b7]
+cmp ax, 3
+jbe short loc_0001be46  ; jbe 0x1be46
+lea eax, [ebx + 0x73bf]
+cmp ax, 1
+jbe short loc_0001be46  ; jbe 0x1be46
+cmp bx, 0x8c58
+je short loc_0001be46  ; je 0x1be46
+mov eax, ebx
+and eax, 0xfffffffb
+cmp ax, 0x8c52
+je short loc_0001be41  ; je 0x1be41
+mov eax, ebx
+and eax, 0xfffffff7
+cmp ax, 0x8c54
+je short loc_0001be41  ; je 0x1be41
+lea eax, [ebx + 0x63bf]
+cmp ax, 6
+jbe short loc_0001be46  ; jbe 0x1be46
+lea eax, [ebx + 0x733f]
+cmp ax, 5
+jbe short loc_0001be41  ; jbe 0x1be41
+lea eax, [ebx + 0x633f]
+cmp ax, 0xa
+jbe short loc_0001be46  ; jbe 0x1be46
+
+loc_0001be20:
+call fcn_00015479  ; call 0x15479
+xor esi, esi
+test al, al
+je short loc_0001be46  ; je 0x1be46
+push eax
+push ebx
+push ref_000264cb  ; push 0x264cb
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp short loc_0001be46  ; jmp 0x1be46
+
+loc_0001be41:
+mov esi, 1
+
+loc_0001be46:
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001be4f:
+push ebp
+mov ebp, esp
+push ebx
+push ebx
+mov eax, dword [ebp + 0xc]
+mov ebx, dword [ebp + 8]
+cmp al, 1
+je short loc_0001be6a  ; je 0x1be6a
+xor edx, edx
+cmp al, 1
+sbb eax, eax
+and eax, 0xfffffff0
+dec eax
+jmp short loc_0001be72  ; jmp 0x1be72
+
+loc_0001be6a:
+mov edx, 0x10
+or eax, 0xffffffff
+
+loc_0001be72:
+push ecx
+add ebx, 0x3410
+push edx
+push eax
+push ebx
+call fcn_00018b68  ; call 0x18b68
+add esp, 0x10
+mov dword [ebp + 8], ebx
+mov ebx, dword [ebp - 4]
+leave
+jmp near fcn_00017e4e  ; jmp 0x17e4e
+
+fcn_0001be90:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x10
+mov ebx, dword [ebp + 8]
+push ebx
+call fcn_0001bba9  ; call 0x1bba9
+add esp, 0x10
+xor edx, edx
+dec al
+jne short loc_0001bec3  ; jne 0x1bec3
+sub esp, 0xc
+add ebx, 0x3860
+push ebx
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+cmp eax, 0x7fff
+setne dl
+
+loc_0001bec3:
+mov al, dl
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001beca:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x10
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov esi, eax
+pop eax
+and esi, 0xffffc000
+pop edx
+lea ebx, [esi + 0x38b0]
+add esi, 0x38b4
+push 0xffff8003
+push ebx
+call fcn_00018b3e  ; call 0x18b3e
+pop ecx
+pop edi
+push 0x4010
+push ebx
+call fcn_00018b14  ; call 0x18b14
+mov dword [esp], esi
+call fcn_00017e4e  ; call 0x17e4e
+mov edi, eax
+pop eax
+pop edx
+push 0xffff8003
+push ebx
+call fcn_00018b3e  ; call 0x18b3e
+pop ecx
+pop eax
+push 0x403c
+push ebx
+call fcn_00018b14  ; call 0x18b14
+mov dword [esp], esi
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+xor edx, edx
+and edi, 3
+je short loc_0001bf57  ; je 0x1bf57
+shr eax, 6
+mov edx, eax
+and edx, 1
+
+loc_0001bf57:
+lea esp, [ebp - 0xc]
+mov al, dl
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001bf61:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+mov ebx, dword [ebp + 8]
+sub esp, 0xc
+push ebx
+call fcn_0001bba9  ; call 0x1bba9
+add esp, 0x10
+mov dl, al
+xor eax, eax
+test dl, dl
+je short loc_0001bfb4  ; je 0x1bfb4
+push eax
+push eax
+push 0xffff8003
+lea esi, [ebx + 0x38b0]
+add ebx, 0x38b4
+push esi
+call fcn_00018b3e  ; call 0x18b3e
+pop edx
+pop ecx
+push 0x4024
+push esi
+call fcn_00018b14  ; call 0x18b14
+mov dword [esp], ebx
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+shr eax, 0xe
+and eax, 1
+
+loc_0001bfb4:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001bfbb:
+push ebp
+mov ebp, esp
+push esi
+mov esi, 1
+push ebx
+push ecx
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+movzx ebx, ax
+mov eax, ebx
+and eax, 0xfffffffd
+cmp ax, 0x8c44
+je near loc_0001c0b4  ; je 0x1c0b4
+lea eax, [ebx + 0x73b2]
+cmp ax, 2
+jbe near loc_0001c0b4  ; jbe 0x1c0b4
+lea eax, [ebx + 0x73b7]
+cmp ax, 3
+jbe near loc_0001c0b4  ; jbe 0x1c0b4
+lea eax, [ebx + 0x73bf]
+cmp ax, 1
+jbe near loc_0001c0b4  ; jbe 0x1c0b4
+cmp bx, 0x8c58
+je near loc_0001c0b4  ; je 0x1c0b4
+mov eax, ebx
+and eax, 0xfffffffb
+cmp ax, 0x8c52
+je short loc_0001c0af  ; je 0x1c0af
+mov eax, ebx
+and eax, 0xfffffff7
+cmp ax, 0x8c54
+je short loc_0001c0af  ; je 0x1c0af
+lea eax, [ebx + 0x733f]
+cmp ax, 5
+jbe short loc_0001c0b4  ; jbe 0x1c0b4
+lea eax, [ebx + 0x63bf]
+mov si, 2
+cmp ax, 6
+jbe short loc_0001c0b4  ; jbe 0x1c0b4
+lea eax, [ebx + 0x633f]
+cmp ax, 0xa
+jbe short loc_0001c0b4  ; jbe 0x1c0b4
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001c087  ; je 0x1c087
+push edx
+push ebx
+push ref_000264fe  ; push 0x264fe
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001c087:
+call fcn_00015480  ; call 0x15480
+mov esi, 3
+test al, al
+je short loc_0001c0b4  ; je 0x1c0b4
+push eax
+push ref_00022281  ; push 0x22281
+push 0x1cd
+push ref_00026529  ; push 0x26529
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+jmp short loc_0001c0b4  ; jmp 0x1c0b4
+
+loc_0001c0af:
+mov esi, 1
+
+loc_0001c0b4:
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001c0bd:
+push ebp
+mov ebp, esp
+push esi
+mov esi, 1
+push ebx
+push ecx
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+movzx ebx, ax
+mov eax, ebx
+and eax, 0xfffffffd
+cmp ax, 0x8c44
+je near loc_0001c1b6  ; je 0x1c1b6
+lea eax, [ebx + 0x73b2]
+cmp ax, 2
+jbe near loc_0001c1b6  ; jbe 0x1c1b6
+lea eax, [ebx + 0x73b7]
+cmp ax, 3
+jbe near loc_0001c1b6  ; jbe 0x1c1b6
+lea eax, [ebx + 0x73bf]
+cmp ax, 1
+jbe near loc_0001c1b6  ; jbe 0x1c1b6
+cmp bx, 0x8c58
+je near loc_0001c1b6  ; je 0x1c1b6
+mov eax, ebx
+and eax, 0xfffffffb
+cmp ax, 0x8c52
+je short loc_0001c1b1  ; je 0x1c1b1
+mov eax, ebx
+and eax, 0xfffffff7
+cmp ax, 0x8c54
+je short loc_0001c1b1  ; je 0x1c1b1
+lea eax, [ebx + 0x63bf]
+cmp ax, 6
+jbe short loc_0001c1b6  ; jbe 0x1c1b6
+lea eax, [ebx + 0x733f]
+cmp ax, 5
+jbe short loc_0001c1b6  ; jbe 0x1c1b6
+lea eax, [ebx + 0x633f]
+mov si, 2
+cmp ax, 0xa
+jbe short loc_0001c1b6  ; jbe 0x1c1b6
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001c189  ; je 0x1c189
+push edx
+push ebx
+push ref_000264fe  ; push 0x264fe
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001c189:
+call fcn_00015480  ; call 0x15480
+mov esi, 3
+test al, al
+je short loc_0001c1b6  ; je 0x1c1b6
+push eax
+push ref_00022281  ; push 0x22281
+push 0x1ec
+push ref_00026529  ; push 0x26529
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+jmp short loc_0001c1b6  ; jmp 0x1c1b6
+
+loc_0001c1b1:
+mov esi, 1
+
+loc_0001c1b6:
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001c1bf:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_0001bfbb  ; call 0x1bfbb
+cmp eax, 1
+je short loc_0001c1db  ; je 0x1c1db
+xor edx, edx
+cmp eax, 2
+mov al, 6
+cmove edx, eax
+jmp short loc_0001c1dd  ; jmp 0x1c1dd
+
+loc_0001c1db:
+mov dl, 8
+
+loc_0001c1dd:
+mov al, dl
+leave
+ret
+
+fcn_0001c1e1:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_0001bfbb  ; call 0x1bfbb
+cmp eax, 1
+je short loc_0001c1fc  ; je 0x1c1fc
+cmp eax, 2
+sete al
+shl eax, 2
+jmp short loc_0001c1fe  ; jmp 0x1c1fe
+
+loc_0001c1fc:
+mov al, 6
+
+loc_0001c1fe:
+leave
+ret
+
+fcn_0001c200:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_0001bfbb  ; call 0x1bfbb
+cmp eax, 1
+je short loc_0001c218  ; je 0x1c218
+cmp eax, 2
+sete al
+jmp short loc_0001c21a  ; jmp 0x1c21a
+
+loc_0001c218:
+mov al, 2
+
+loc_0001c21a:
+leave
+ret
+
+fcn_0001c21c:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_0001c0bd  ; call 0x1c0bd
+cmp eax, 1
+jne short loc_0001c23a  ; jne 0x1c23a
+call fcn_0001bfbb  ; call 0x1bfbb
+cmp eax, 1
+jne short loc_0001c23a  ; jne 0x1c23a
+mov al, 0xe
+jmp short loc_0001c243  ; jmp 0x1c243
+
+loc_0001c23a:
+cmp eax, 2
+sete al
+shl eax, 3
+
+loc_0001c243:
+leave
+ret
+
+fcn_0001c245:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_0001bfbb  ; call 0x1bfbb
+cmp eax, 1
+je short loc_0001c25d  ; je 0x1c25d
+cmp eax, 2
+sete al
+jmp short loc_0001c25f  ; jmp 0x1c25f
+
+loc_0001c25d:
+mov al, 2
+
+loc_0001c25f:
+leave
+ret
+
+fcn_0001c261:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_0001c0bd  ; call 0x1c0bd
+cmp eax, 1
+jne short loc_0001c28a  ; jne 0x1c28a
+call fcn_0001bfbb  ; call 0x1bfbb
+cmp eax, 1
+je short loc_0001c286  ; je 0x1c286
+cmp eax, 2
+sete dl
+shl edx, 3
+jmp short loc_0001c294  ; jmp 0x1c294
+
+loc_0001c286:
+mov dl, 0xe
+jmp short loc_0001c294  ; jmp 0x1c294
+
+loc_0001c28a:
+cmp eax, 2
+mov dl, 0xa
+mov al, 0
+cmovne edx, eax
+
+loc_0001c294:
+mov al, dl
+leave
+ret
+
+fcn_0001c298:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_0001c0bd  ; call 0x1c0bd
+cmp eax, 1
+jne short loc_0001c2b6  ; jne 0x1c2b6
+call fcn_0001bfbb  ; call 0x1bfbb
+cmp eax, 1
+jne short loc_0001c2b6  ; jne 0x1c2b6
+mov al, 0xe
+jmp short loc_0001c2bf  ; jmp 0x1c2bf
+
+loc_0001c2b6:
+cmp eax, 2
+sete al
+shl eax, 3
+
+loc_0001c2bf:
+leave
+ret
+
+fcn_0001c2c1:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_0001c0bd  ; call 0x1c0bd
+cmp eax, 1
+jne short loc_0001c2ea  ; jne 0x1c2ea
+call fcn_0001bfbb  ; call 0x1bfbb
+cmp eax, 1
+je short loc_0001c2e6  ; je 0x1c2e6
+cmp eax, 2
+sete dl
+lea edx, [edx + edx*8]
+jmp short loc_0001c2f4  ; jmp 0x1c2f4
+
+loc_0001c2e6:
+mov dl, 0xf
+jmp short loc_0001c2f4  ; jmp 0x1c2f4
+
+loc_0001c2ea:
+cmp eax, 2
+mov dl, 0xb
+mov al, 0
+cmovne edx, eax
+
+loc_0001c2f4:
+mov al, dl
+leave
+ret
+
+fcn_0001c2f8:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_0001c0bd  ; call 0x1c0bd
+cmp eax, 1
+jne short loc_0001c316  ; jne 0x1c316
+call fcn_0001bfbb  ; call 0x1bfbb
+cmp eax, 1
+jne short loc_0001c316  ; jne 0x1c316
+mov al, 6
+jmp short loc_0001c31f  ; jmp 0x1c31f
+
+loc_0001c316:
+cmp eax, 2
+sete al
+shl eax, 2
+
+loc_0001c31f:
+leave
+ret
+
+fcn_0001c321:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+push eax
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov esi, eax
+lea eax, [eax + 0xa2]
+add esi, 0xa4
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+mov dword [esp], esi
+mov ebx, eax
+call fcn_00017dc2  ; call 0x17dc2
+mov ecx, dword [ebp + 8]
+add esp, 0x10
+lea edx, [ecx - 1]
+cmp edx, 4
+ja short loc_0001c394  ; ja 0x1c394
+jmp dword [edx*4 + ref_000205f8]  ; ujmp: jmp dword [edx*4 + 0x205f8]
+
+loc_0001c367:
+shr bx, 5
+jmp short loc_0001c377  ; jmp 0x1c377
+
+loc_0001c36d:
+shr ax, 1
+mov edx, eax
+jmp short loc_0001c37d  ; jmp 0x1c37d
+
+loc_0001c374:
+shr bx, 1
+
+loc_0001c377:
+mov edx, ebx
+jmp short loc_0001c37d  ; jmp 0x1c37d
+
+loc_0001c37b:
+mov dl, bl
+
+loc_0001c37d:
+and edx, 1
+jmp short loc_0001c396  ; jmp 0x1c396
+
+loc_0001c382:
+xor edx, edx
+test al, 2
+je short loc_0001c396  ; je 0x1c396
+and ebx, 0x22
+cmp bx, 2
+sete dl
+jmp short loc_0001c396  ; jmp 0x1c396
+
+loc_0001c394:
+xor edx, edx
+
+loc_0001c396:
+lea esp, [ebp - 8]
+mov al, dl
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001c39f:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x10
+mov eax, dword [ebp + 8]
+mov ebx, dword [ebp + 0xc]
+add eax, 0x404
+push eax
+movzx ebx, bl
+call fcn_00017e4e  ; call 0x17e4e
+lea ecx, [ebx*4]
+mov ebx, dword [ebp - 4]
+leave
+shr eax, cl
+and eax, 7
+ret
+
+fcn_0001c3cb:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+xor ebx, ebx
+sub esp, 0xc
+mov eax, dword [ebp + 8]
+movzx edi, byte [ebp + 0xc]
+lea esi, [eax + 0x404]
+
+loc_0001c3e3:
+call fcn_0001c1bf  ; call 0x1c1bf
+cmp bl, al
+jae short loc_0001c40a  ; jae 0x1c40a
+sub esp, 0xc
+push esi
+call fcn_00017e4e  ; call 0x17e4e
+movzx ecx, bl
+add esp, 0x10
+shl ecx, 2
+shr eax, cl
+and eax, 7
+cmp eax, edi
+je short loc_0001c42d  ; je 0x1c42d
+inc ebx
+jmp short loc_0001c3e3  ; jmp 0x1c3e3
+
+loc_0001c40a:
+call fcn_00015480  ; call 0x15480
+mov bl, 0xff
+test al, al
+je short loc_0001c42d  ; je 0x1c42d
+push eax
+push ref_00022281  ; push 0x22281
+push 0x390
+push ref_00026529  ; push 0x26529
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001c42d:
+lea esp, [ebp - 0xc]
+mov al, bl
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001c437:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x18
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov ebx, eax
+pop eax
+and ebx, 0xffffc000
+pop edx
+push 0
+push ebx
+call fcn_0001c39f  ; call 0x1c39f
+pop ecx
+pop edx
+lea edx, [ebp - 0xd]
+push edx
+sub eax, 0x20
+lea edx, [ebp - 0xc]
+movzx eax, al
+push edx
+push eax
+push 4
+push 0xe00000fc
+push ebx
+call fcn_00009ecd  ; call 0x9ecd
+add esp, 0x20
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001c4cd  ; je 0x1c4cd
+test ebx, ebx
+jns short loc_0001c4cd  ; jns 0x1c4cd
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001c4b5  ; je 0x1c4b5
+push eax
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001c4b5:
+push ecx
+push ref_000206f4  ; push 0x206f4
+push 0x3b7
+push ref_00026529  ; push 0x26529
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001c4cd:
+mov ebx, dword [ebp - 0xc]
+test ebx, 0x80000
+je short loc_0001c543  ; je 0x1c543
+and ebx, 0x70000
+shr ebx, 0x10
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001c4fb  ; je 0x1c4fb
+push edx
+push ebx
+push ref_00026565  ; push 0x26565
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001c4fb:
+call fcn_0001bfbb  ; call 0x1bfbb
+lea edx, [ebx + 1]
+cmp eax, 2
+jne short loc_0001c54c  ; jne 0x1c54c
+cmp ebx, 1
+je short loc_0001c547  ; je 0x1c547
+jb short loc_0001c51b  ; jb 0x1c51b
+cmp ebx, 5
+ja short loc_0001c522  ; ja 0x1c522
+mov edx, 5
+jmp short loc_0001c54c  ; jmp 0x1c54c
+
+loc_0001c51b:
+mov edx, 3
+jmp short loc_0001c54c  ; jmp 0x1c54c
+
+loc_0001c522:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001c543  ; je 0x1c543
+push eax
+push ref_00022281  ; push 0x22281
+push 0x3c7
+push ref_00026529  ; push 0x26529
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001c543:
+xor edx, edx
+jmp short loc_0001c54c  ; jmp 0x1c54c
+
+loc_0001c547:
+mov edx, 4
+
+loc_0001c54c:
+mov eax, edx
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001c553:
+push ebp
+mov eax, 0x80000002
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov ebx, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov esi, dword [ebp + 0x10]
+cmp ebx, 7
+ja short loc_0001c5c9  ; ja 0x1c5c9
+push eax
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+and eax, 0xffffc000
+cmp ebx, 7
+je short loc_0001c5a1  ; je 0x1c5a1
+sub esp, 0xc
+lea eax, [eax + ebx*4 + 0x3854]
+jmp short loc_0001c5a9  ; jmp 0x1c5a9
+
+loc_0001c5a1:
+sub esp, 0xc
+add eax, 0x3800
+
+loc_0001c5a9:
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+mov edx, eax
+and ax, 0x7fff
+and edx, 0x7fff0000
+shr edx, 0x10
+mov word [edi], dx
+mov word [esi], ax
+xor eax, eax
+
+loc_0001c5c9:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001c5d1:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov edi, dword [ebp + 8]
+mov ebx, dword [ebp + 0xc]
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001c5fa  ; je 0x1c5fa
+push eax
+push eax
+push ref_00026574  ; push 0x26574
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001c5fa:
+dec bl
+lea esi, [edi + 0x3428]
+jne short loc_0001c620  ; jne 0x1c620
+push ecx
+push ecx
+push 0x10
+lea ebx, [edi + 0x3424]
+push ebx
+call fcn_00017e04  ; call 0x17e04
+pop ebx
+pop edi
+push 1
+push esi
+call fcn_00018b14  ; call 0x18b14
+jmp short loc_0001c62a  ; jmp 0x1c62a
+
+loc_0001c620:
+push edx
+push edx
+push 0xfffffffffffffffe
+push esi
+call fcn_00018b3e  ; call 0x18b3e
+
+loc_0001c62a:
+add esp, 0x10
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001c647  ; je 0x1c647
+push eax
+push eax
+push ref_0002658e  ; push 0x2658e
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001c647:
+lea esp, [ebp - 0xc]
+xor eax, eax
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001c651:
+push ebp
+mov ebp, esp
+sub esp, 0x24
+lea edx, [ebp - 0xc]
+push edx
+lea edx, [ebp - 0x10]
+push edx
+lea edx, [ebp - 0x14]
+push edx
+lea eax, [ebp - 0x18]
+push eax
+push 1
+call fcn_0001ff1b  ; call 0x1ff1b
+mov eax, dword [ebp - 0x18]
+leave
+and eax, 0xfff0ff0
+ret
+
+fcn_0001c678:
+push ebp
+mov ebp, esp
+sub esp, 0x24
+lea edx, [ebp - 0xc]
+push edx
+lea edx, [ebp - 0x10]
+push edx
+lea edx, [ebp - 0x14]
+push edx
+lea eax, [ebp - 0x18]
+push eax
+push 1
+call fcn_0001ff1b  ; call 0x1ff1b
+mov eax, dword [ebp - 0x18]
+leave
+and eax, 0xf
+ret
+
+fcn_0001c69d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+call fcn_0001c651  ; call 0x1c651
+mov esi, eax
+call fcn_0001c678  ; call 0x1c678
+lea edx, [eax + esi]
+mov edi, eax
+cmp edx, 0x306c3
+je short loc_0001c708  ; je 0x1c708
+cmp edx, 0x40651
+je short loc_0001c708  ; je 0x1c708
+cmp edx, 0x40661
+je short loc_0001c708  ; je 0x1c708
+lea eax, [edx - 0x306d3]
+cmp eax, 1
+jbe short loc_0001c708  ; jbe 0x1c708
+sub edx, 0x40670
+mov bl, 1
+cmp edx, 1
+jbe short loc_0001c70a  ; jbe 0x1c70a
+call fcn_00015479  ; call 0x15479
+xor ebx, ebx
+test al, al
+je short loc_0001c70a  ; je 0x1c70a
+push esi
+push edi
+push ref_000265a6  ; push 0x265a6
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp short loc_0001c70a  ; jmp 0x1c70a
+
+loc_0001c708:
+mov bl, 1
+
+loc_0001c70a:
+lea esp, [ebp - 0xc]
+mov al, bl
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001c714:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x20
+lea edx, [ebp - 0xc]
+push edx
+lea edx, [ebp - 0x10]
+push edx
+lea edx, [ebp - 0x14]
+push edx
+lea eax, [ebp - 0x18]
+push eax
+push 1
+call fcn_0001ff1b  ; call 0x1ff1b
+mov eax, dword [ebp - 0x18]
+add esp, 0x20
+and eax, 0xfff0ff0
+cmp eax, 0x40650
+je short loc_0001c766  ; je 0x1c766
+ja short loc_0001c756  ; ja 0x1c756
+cmp eax, 0x306c0
+je short loc_0001c7b1  ; je 0x1c7b1
+cmp eax, 0x306d0
+je short loc_0001c766  ; je 0x1c766
+jmp short loc_0001c76a  ; jmp 0x1c76a
+
+loc_0001c756:
+cmp eax, 0x40660
+je short loc_0001c7b1  ; je 0x1c7b1
+cmp eax, 0x40670
+jne short loc_0001c76a  ; jne 0x1c76a
+jmp short loc_0001c7b1  ; jmp 0x1c7b1
+
+loc_0001c766:
+xor ebx, ebx
+jmp short loc_0001c7b3  ; jmp 0x1c7b3
+
+loc_0001c76a:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001c78f  ; je 0x1c78f
+mov eax, dword [ebp - 0x18]
+push edx
+and eax, 0xfff0ff0
+push eax
+push ref_000265e0  ; push 0x265e0
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001c78f:
+call fcn_00015480  ; call 0x15480
+mov bl, 2
+test al, al
+je short loc_0001c7b3  ; je 0x1c7b3
+push eax
+push ref_00022281  ; push 0x22281
+push 0x7f
+push ref_0002660b  ; push 0x2660b
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+jmp short loc_0001c7b3  ; jmp 0x1c7b3
+
+loc_0001c7b1:
+mov bl, 1
+
+loc_0001c7b3:
+mov al, bl
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001c7ba:
+push ebp
+mov ebp, esp
+sub esp, 0x20
+push 0
+push 0
+push 0
+lea eax, [ebp - 0x18]
+push eax
+push 0
+push 4
+call fcn_0001ff47  ; call 0x1ff47
+mov eax, dword [ebp - 0x18]
+add esp, 0x1c
+push 0x1a
+xor edx, edx
+push edx
+push eax
+call fcn_0001724f  ; call 0x1724f
+leave
+and eax, 0x3f
+inc eax
+ret
+
+fcn_0001c7ea:
+push ebp
+mov ebp, esp
+sub esp, 0xc
+push 0
+push 0
+push 0x8b
+call fcn_000175c6  ; call 0x175c6
+mov dword [esp], 0
+push 0
+push 0
+push 0
+push 1
+call fcn_0001ff1b  ; call 0x1ff1b
+add esp, 0x14
+push 0x8b
+call fcn_000175bc  ; call 0x175bc
+add esp, 0xc
+push 0x20
+push edx
+push eax
+call fcn_0001724f  ; call 0x1724f
+leave
+ret
+
+fcn_0001c82d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+mov eax, dword [ebp + 0x14]
+push 0x35
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov dword [ebp - 0x24], eax
+call fcn_000175bc  ; call 0x175bc
+add esp, 0x10
+mov dword [ebp - 0x20], eax
+mov dword [ebp - 0x1c], edx
+test edi, edi
+jne short loc_0001c879  ; jne 0x1c879
+call fcn_00015480  ; call 0x15480
+test al, al
+je near loc_0001c920  ; je 0x1c920
+mov dword [ebp + 0x10], ref_00026647  ; mov dword [ebp + 0x10], 0x26647
+mov dword [ebp + 0xc], 0xc8
+jmp near loc_0001c905  ; jmp 0x1c905
+
+loc_0001c879:
+push ecx
+push 0x10
+push dword [ebp - 0x1c]
+push dword [ebp - 0x20]
+call fcn_0001724f  ; call 0x1724f
+add esp, 0x10
+mov word [edi], ax
+test esi, esi
+jne short loc_0001c8ae  ; jne 0x1c8ae
+call fcn_00015480  ; call 0x15480
+test al, al
+je near loc_0001c920  ; je 0x1c920
+mov dword [ebp + 0x10], ref_00026672  ; mov dword [ebp + 0x10], 0x26672
+mov dword [ebp + 0xc], 0xd2
+jmp short loc_0001c905  ; jmp 0x1c905
+
+loc_0001c8ae:
+movzx eax, ax
+push edx
+xor edx, edx
+push eax
+movzx eax, word [ebp - 0x20]
+push edx
+push eax
+call fcn_000174b9  ; call 0x174b9
+add esp, 0x10
+mov word [esi], ax
+test ebx, ebx
+jne short loc_0001c8e3  ; jne 0x1c8e3
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001c920  ; je 0x1c920
+mov dword [ebp + 0x10], ref_000266a0  ; mov dword [ebp + 0x10], 0x266a0
+mov dword [ebp + 0xc], 0xdc
+jmp short loc_0001c905  ; jmp 0x1c905
+
+loc_0001c8e3:
+cmp dword [ebp - 0x24], 0
+mov word [ebx], 1
+jne short loc_0001c918  ; jne 0x1c918
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001c920  ; je 0x1c920
+mov dword [ebp + 0x10], ref_000266c7  ; mov dword [ebp + 0x10], 0x266c7
+mov dword [ebp + 0xc], 0xe3
+
+loc_0001c905:
+mov dword [ebp + 8], ref_0002660b  ; mov dword [ebp + 8], 0x2660b
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001548c  ; jmp 0x1548c
+
+loc_0001c918:
+mov eax, dword [ebp - 0x24]
+mov word [eax], 1
+
+loc_0001c920:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001c928:
+push ebp
+mov al, 1
+mov ebp, esp
+push edi
+push esi
+push ebx
+xor ebx, ebx
+sub esp, 0x2c
+lea esi, [ebp - 0x28]
+lea edi, [ebp - 0x20]
+
+loc_0001c93b:
+cmp dword [ebp + 8], 1
+je short loc_0001c96e  ; je 0x1c96e
+cmp dword [ebp + 8], 2
+jne short loc_0001c99b  ; jne 0x1c99b
+sub esp, 0xc
+push 0x150
+call fcn_000175bc  ; call 0x175bc
+add esp, 0xc
+push 8
+push esi
+push edi
+mov dword [ebp - 0x28], eax
+mov dword [ebp - 0x24], edx
+call fcn_0001713e  ; call 0x1713e
+mov al, byte [ebp - 0x19]
+shr al, 7
+jmp short loc_0001c998  ; jmp 0x1c998
+
+loc_0001c96e:
+push edx
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+and eax, 0xfffffffe
+add eax, 0x5da4
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+shr eax, 0x1f
+
+loc_0001c998:
+add esp, 0x10
+
+loc_0001c99b:
+sub esp, 0xc
+inc ebx
+push 1
+mov dword [ebp - 0x2c], eax
+call fcn_0001bb03  ; call 0x1bb03
+mov eax, dword [ebp - 0x2c]
+add esp, 0x10
+mov dl, al
+and dl, 1
+je short loc_0001c9c1  ; je 0x1c9c1
+cmp bx, 0x3e7
+jbe near loc_0001c93b  ; jbe 0x1c93b
+
+loc_0001c9c1:
+cmp bx, 0x3e8
+jne short loc_0001c9f0  ; jne 0x1c9f0
+test dl, dl
+je short loc_0001c9f0  ; je 0x1c9f0
+call fcn_00015479  ; call 0x15479
+mov ebx, 0x80000012
+test al, al
+je short loc_0001c9f2  ; je 0x1c9f2
+push eax
+push eax
+push ref_000266e8  ; push 0x266e8
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp short loc_0001c9f2  ; jmp 0x1c9f2
+
+loc_0001c9f0:
+xor ebx, ebx
+
+loc_0001c9f2:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001c9fc:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x48
+mov edi, dword [ebp + 8]
+push edi
+call fcn_0001c928  ; call 0x1c928
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+js near loc_0001cc05  ; js 0x1cc05
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001ca39  ; je 0x1ca39
+movzx eax, byte [ebp + 0xc]
+push ecx
+push eax
+push ref_00026710  ; push 0x26710
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001ca39:
+cmp edi, 1
+je short loc_0001ca4c  ; je 0x1ca4c
+cmp edi, 2
+je near loc_0001cb13  ; je 0x1cb13
+jmp near loc_0001cbc5  ; jmp 0x1cbc5
+
+loc_0001ca4c:
+push esi
+push 0
+push 0
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov edi, eax
+pop eax
+and edi, 0xfffffffe
+pop edx
+push dword [ebp + 0x10]
+lea esi, [edi + 0x5da0]
+add edi, 0x5da4
+push esi
+call fcn_00017e8f  ; call 0x17e8f
+mov eax, dword [ebp + 0xc]
+pop ecx
+pop edx
+or eax, 0x80000000
+push eax
+push edi
+call fcn_00017e8f  ; call 0x17e8f
+mov dword [esp], 1
+call fcn_0001c928  ; call 0x1c928
+mov dword [esp], edi
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [esp], esi
+mov dword [ebp - 0x40], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [esp], 0xa
+mov dword [ebp - 0x3c], eax
+call fcn_0001bb03  ; call 0x1bb03
+mov dword [esp], edi
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [esp], esi
+mov edi, eax
+call fcn_00017e4e  ; call 0x17e4e
+mov ecx, dword [ebp - 0x40]
+add esp, 0x10
+cmp ecx, edi
+je short loc_0001cb06  ; je 0x1cb06
+cmp dword [ebp - 0x3c], eax
+je short loc_0001cb06  ; je 0x1cb06
+
+loc_0001cadf:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001cafc  ; je 0x1cafc
+push ebx
+push ebx
+push ref_00026738  ; push 0x26738
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001cafc:
+mov ebx, 0x80000002
+jmp near loc_0001cc05  ; jmp 0x1cc05
+
+loc_0001cb06:
+mov eax, dword [ebp + 0x14]
+movzx ecx, cl
+mov dword [eax], ecx
+jmp near loc_0001cbe7  ; jmp 0x1cbe7
+
+loc_0001cb13:
+mov eax, dword [ebp + 0xc]
+lea edi, [ebp - 0x30]
+push ecx
+push 8
+lea ecx, [ebp - 0x28]
+mov dword [ebp - 0x24], eax
+mov eax, dword [ebp + 0x10]
+push ecx
+push edi
+or byte [ebp - 0x21], 0x80
+mov dword [ebp - 0x3c], ecx
+mov dword [ebp - 0x28], eax
+call fcn_0001713e  ; call 0x1713e
+add esp, 0xc
+push dword [ebp - 0x2c]
+push dword [ebp - 0x30]
+push 0x150
+call fcn_000175c6  ; call 0x175c6
+mov dword [esp], 2
+call fcn_0001c928  ; call 0x1c928
+mov dword [esp], 0x150
+call fcn_000175bc  ; call 0x175bc
+mov ecx, dword [ebp - 0x3c]
+add esp, 0xc
+push 8
+push edi
+push ecx
+mov dword [ebp - 0x2c], edx
+mov dword [ebp - 0x30], eax
+call fcn_0001713e  ; call 0x1713e
+mov dword [esp], 0xa
+call fcn_0001bb03  ; call 0x1bb03
+mov dword [esp], 0x150
+call fcn_000175bc  ; call 0x175bc
+add esp, 0xc
+push 8
+push edi
+mov dword [ebp - 0x30], eax
+lea eax, [ebp - 0x20]
+push eax
+mov dword [ebp - 0x2c], edx
+call fcn_0001713e  ; call 0x1713e
+mov eax, dword [ebp - 0x1c]
+add esp, 0x10
+cmp dword [ebp - 0x24], eax
+je short loc_0001cbba  ; je 0x1cbba
+mov eax, dword [ebp - 0x20]
+cmp dword [ebp - 0x28], eax
+jne near loc_0001cadf  ; jne 0x1cadf
+
+loc_0001cbba:
+movzx eax, byte [ebp - 0x24]
+mov edx, dword [ebp + 0x14]
+mov dword [edx], eax
+jmp short loc_0001cbe7  ; jmp 0x1cbe7
+
+loc_0001cbc5:
+call fcn_00015479  ; call 0x15479
+mov ebx, 0x80000003
+test al, al
+je short loc_0001cbe7  ; je 0x1cbe7
+push edx
+push edx
+push ref_00026763  ; push 0x26763
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001cbe7:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001cc05  ; je 0x1cc05
+push eax
+mov eax, dword [ebp + 0x14]
+push dword [eax]
+push ref_00026789  ; push 0x26789
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001cc05:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001cc0f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x38
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+push edi
+call fcn_0001c928  ; call 0x1c928
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+js near loc_0001ce1b  ; js 0x1ce1b
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001cc50  ; je 0x1cc50
+mov eax, esi
+movzx eax, al
+push ecx
+push eax
+push ref_000267aa  ; push 0x267aa
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001cc50:
+cmp edi, 1
+je short loc_0001cc63  ; je 0x1cc63
+cmp edi, 2
+je near loc_0001cd24  ; je 0x1cd24
+jmp near loc_0001cddb  ; jmp 0x1cddb
+
+loc_0001cc63:
+push eax
+push 0
+push 0
+push 0
+mov dword [ebp - 0x30], esi
+or byte [ebp - 0x2d], 0x80
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 0x48
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov esi, eax
+pop eax
+and esi, 0xfffffffe
+pop edx
+push dword [ebp - 0x30]
+lea edi, [esi + 0x5da4]
+add esi, 0x5da0
+push edi
+call fcn_00017e8f  ; call 0x17e8f
+mov dword [esp], 1
+call fcn_0001c928  ; call 0x1c928
+mov dword [esp], edi
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [esp], esi
+mov dword [ebp - 0x30], eax
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [esp], 0xa
+mov dword [ebp - 0x2c], eax
+call fcn_0001bb03  ; call 0x1bb03
+mov dword [esp], edi
+call fcn_00017e4e  ; call 0x17e4e
+mov dword [esp], esi
+mov edi, eax
+call fcn_00017e4e  ; call 0x17e4e
+mov edx, dword [ebp - 0x30]
+add esp, 0x10
+cmp edx, edi
+je short loc_0001cd13  ; je 0x1cd13
+cmp dword [ebp - 0x2c], eax
+je short loc_0001cd13  ; je 0x1cd13
+
+loc_0001ccec:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001cd09  ; je 0x1cd09
+push eax
+push eax
+push ref_00026738  ; push 0x26738
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001cd09:
+mov ebx, 0x80000002
+jmp near loc_0001ce1b  ; jmp 0x1ce1b
+
+loc_0001cd13:
+mov eax, dword [ebp + 0x14]
+mov dword [eax], edx
+lea eax, [ebp - 0x2c]
+push edi
+push 4
+push eax
+jmp near loc_0001cdd1  ; jmp 0x1cdd1
+
+loc_0001cd24:
+mov eax, dword [ebp + 0x10]
+lea edi, [ebp - 0x38]
+mov dword [ebp - 0x24], esi
+mov eax, dword [eax]
+push esi
+push 8
+lea esi, [ebp - 0x28]
+push esi
+push edi
+or byte [ebp - 0x21], 0x80
+mov dword [ebp - 0x28], eax
+call fcn_0001713e  ; call 0x1713e
+add esp, 0xc
+push dword [ebp - 0x34]
+push dword [ebp - 0x38]
+push 0x150
+call fcn_000175c6  ; call 0x175c6
+mov dword [esp], 2
+call fcn_0001c928  ; call 0x1c928
+mov dword [esp], 0x150
+call fcn_000175bc  ; call 0x175bc
+add esp, 0xc
+push 8
+push edi
+push esi
+mov dword [ebp - 0x34], edx
+mov dword [ebp - 0x38], eax
+call fcn_0001713e  ; call 0x1713e
+mov dword [esp], 0xa
+call fcn_0001bb03  ; call 0x1bb03
+mov dword [esp], 0x150
+call fcn_000175bc  ; call 0x175bc
+add esp, 0xc
+push 8
+push edi
+mov dword [ebp - 0x38], eax
+lea eax, [ebp - 0x20]
+push eax
+mov dword [ebp - 0x34], edx
+call fcn_0001713e  ; call 0x1713e
+mov eax, dword [ebp - 0x1c]
+add esp, 0x10
+cmp dword [ebp - 0x24], eax
+je short loc_0001cdc4  ; je 0x1cdc4
+mov eax, dword [ebp - 0x20]
+cmp dword [ebp - 0x28], eax
+jne near loc_0001ccec  ; jne 0x1ccec
+
+loc_0001cdc4:
+mov ecx, dword [ebp + 0x14]
+movzx eax, byte [ebp - 0x24]
+mov dword [ecx], eax
+push ecx
+push 4
+push esi
+
+loc_0001cdd1:
+push dword [ebp + 0x10]
+call fcn_0001713e  ; call 0x1713e
+jmp short loc_0001cdfa  ; jmp 0x1cdfa
+
+loc_0001cddb:
+call fcn_00015479  ; call 0x15479
+mov ebx, 0x80000003
+test al, al
+je short loc_0001cdfd  ; je 0x1cdfd
+push edx
+push edx
+push ref_00026763  ; push 0x26763
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+
+loc_0001cdfa:
+add esp, 0x10
+
+loc_0001cdfd:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001ce1b  ; je 0x1ce1b
+push eax
+mov eax, dword [ebp + 0x14]
+push dword [eax]
+push ref_00026789  ; push 0x26789
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001ce1b:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001ce25:
+push ebp
+mov eax, 0x80000002
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov ebx, dword [ebp + 0xc]
+test ebx, ebx
+je near loc_0001cf0f  ; je 0x1cf0f
+lea edi, [ebp - 0x1c]
+call fcn_0001c651  ; call 0x1c651
+lea esi, [ebp - 0x20]
+call fcn_0001c678  ; call 0x1c678
+push edi
+push esi
+push 0x8000000a
+push 1
+call fcn_0001cc0f  ; call 0x1cc0f
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_0001ce7b  ; je 0x1ce7b
+push edx
+push dword [ebp - 0x20]
+push ref_000267d1  ; push 0x267d1
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001ce7b:
+cmp dword [ebp - 0x1c], 0
+je short loc_0001ce8b  ; je 0x1ce8b
+
+loc_0001ce81:
+mov eax, 0x8000000e
+jmp near loc_0001cf0f  ; jmp 0x1cf0f
+
+loc_0001ce8b:
+mov edx, dword [ebp - 0x20]
+xor eax, eax
+
+loc_0001ce90:
+mov ecx, edx
+and edx, 0x3f
+mov byte [ebx + eax], dl
+inc eax
+shr ecx, 6
+cmp eax, 4
+je short loc_0001cea5  ; je 0x1cea5
+mov edx, ecx
+jmp short loc_0001ce90  ; jmp 0x1ce90
+
+loc_0001cea5:
+cmp dword [ebp + 8], 4
+mov dword [ebp - 0x20], ecx
+ja short loc_0001ceb2  ; ja 0x1ceb2
+
+loc_0001ceae:
+xor eax, eax
+jmp short loc_0001cf0f  ; jmp 0x1cf0f
+
+loc_0001ceb2:
+call fcn_0001c714  ; call 0x1c714
+test al, al
+jne short loc_0001ceae  ; jne 0x1ceae
+push edi
+push esi
+push 0x8000000b
+push 1
+call fcn_0001cc0f  ; call 0x1cc0f
+call fcn_00015479  ; call 0x15479
+add esp, 0x10
+test al, al
+je short loc_0001cee8  ; je 0x1cee8
+push eax
+push dword [ebp - 0x20]
+push ref_000267d1  ; push 0x267d1
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001cee8:
+cmp dword [ebp - 0x1c], 0
+jne short loc_0001ce81  ; jne 0x1ce81
+mov eax, dword [ebp - 0x20]
+mov edx, eax
+mov cl, al
+shr edx, 6
+and ecx, 0x3f
+shr eax, 0xc
+and edx, 0x3f
+and eax, 0x3f
+mov byte [ebx + 4], cl
+mov byte [ebx + 5], dl
+mov byte [ebx + 6], al
+jmp short loc_0001ceae  ; jmp 0x1ceae
+
+loc_0001cf0f:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001cf17:
+push ebp
+mov ebp, esp
+sub esp, 0x14
+push 0x1b
+call fcn_000175bc  ; call 0x175bc
+leave
+shrd eax, edx, 8
+and eax, 1
+ret
+
+fcn_0001cf2d:
+push ebp
+mov ebp, esp
+sub esp, 0x14
+push 0x35
+call fcn_000175bc  ; call 0x175bc
+add esp, 0x10
+leave
+mov edx, eax
+movzx eax, al
+shr edx, 0x10
+div dl
+cmp al, 1
+seta al
+ret
+
+fcn_0001cf4e:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 0x14
+mov edx, dword [ebp + 8]
+mov ebx, dword [ebp + 0xc]
+mov eax, dword [ebp + 0x10]
+mov dword [ebp - 0xc], 0
+test dx, dx
+jne short loc_0001cf71  ; jne 0x1cf71
+mov word [ebx], 0
+jmp short loc_0001cfc4  ; jmp 0x1cfc4
+
+loc_0001cf71:
+test al, al
+jne short loc_0001cf93  ; jne 0x1cf93
+lea eax, [ebp - 0xc]
+cmp dx, 0xfff
+push eax
+mov eax, 0xfff
+cmovbe eax, edx
+movzx eax, ax
+push 0x3e8
+shl eax, 0xa
+jmp short loc_0001cfa9  ; jmp 0x1cfa9
+
+loc_0001cf93:
+dec al
+jne short loc_0001cfc4  ; jne 0x1cfc4
+lea eax, [ebp - 0xc]
+push eax
+movzx eax, dx
+imul eax, eax, 0x3e8
+push 0x400
+
+loc_0001cfa9:
+cdq
+push edx
+push eax
+call fcn_00017502  ; call 0x17502
+add esp, 0x10
+cmp dword [ebp - 0xc], 0x1f3
+mov word [ebx], ax
+jbe short loc_0001cfc4  ; jbe 0x1cfc4
+inc eax
+mov word [ebx], ax
+
+loc_0001cfc4:
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_0001cfc9:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0x10
+mov eax, dword [ebp + 8]
+mov ebx, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0x10]
+mov dword [ebp - 0xc], 0
+mov word [ebx], 0
+test ax, ax
+je near loc_0001d073  ; je 0x1d073
+mov edx, eax
+test cl, cl
+jne short loc_0001d024  ; jne 0x1d024
+xor esi, esi
+test ax, ax
+jns short loc_0001d008  ; jns 0x1d008
+neg edx
+mov esi, 1
+and dx, 0x7fff
+
+loc_0001d008:
+lea eax, [ebp - 0xc]
+cmp dx, 0x1f4
+push eax
+mov eax, 0x1f4
+cmovle eax, edx
+cwde
+push 0x3e8
+shl eax, 0xa
+jmp short loc_0001d04f  ; jmp 0x1d04f
+
+loc_0001d024:
+dec cl
+jne short loc_0001d073  ; jne 0x1d073
+xor esi, esi
+test ah, 4
+je short loc_0001d03d  ; je 0x1d03d
+mov edx, eax
+mov esi, 1
+neg edx
+and dx, 0x3ff
+
+loc_0001d03d:
+lea eax, [ebp - 0xc]
+push eax
+movsx eax, dx
+imul eax, eax, 0x3e8
+push 0x400
+
+loc_0001d04f:
+cdq
+push edx
+push eax
+call fcn_00017502  ; call 0x17502
+add esp, 0x10
+cmp dword [ebp - 0xc], 0x1f3
+mov word [ebx], ax
+jbe short loc_0001d06a  ; jbe 0x1d06a
+inc eax
+mov word [ebx], ax
+
+loc_0001d06a:
+mov eax, esi
+test al, al
+je short loc_0001d073  ; je 0x1d073
+neg word [ebx]
+
+loc_0001d073:
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001d07a:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x24
+mov ebx, dword [ebp + 0xc]
+push 8
+mov esi, dword [ebp + 8]
+push ebx
+call fcn_00016fff  ; call 0x16fff
+mov eax, dword [ebp + 0x10]
+add esp, 0x10
+dec eax
+cmp eax, 0x14
+ja near loc_0001d1d0  ; ja 0x1d1d0
+jmp dword [eax*4 + ref_0002060c]  ; ujmp: jmp dword [eax*4 + 0x2060c]
+
+loc_0001d0a8:
+mov dword [ebx], 0
+mov byte [ebx + 4], 1
+mov al, byte [esi + 4]
+jmp short loc_0001d0dd  ; jmp 0x1d0dd
+
+loc_0001d0b7:
+mov dword [ebx], 0
+mov byte [ebx + 4], 2
+mov byte [ebx + 5], 0
+mov al, byte [esi + 4]
+mov byte [ebx + 6], al
+jmp near loc_0001d1ed  ; jmp 0x1d1ed
+
+loc_0001d0d0:
+mov dword [ebx], 0
+mov byte [ebx + 4], 0x10
+mov al, byte [esi + 6]
+
+loc_0001d0dd:
+mov byte [ebx + 5], al
+jmp near loc_0001d1ed  ; jmp 0x1d1ed
+
+loc_0001d0e5:
+mov al, byte [esi]
+lea edi, [ebp - 0x1e]
+push ecx
+push 0
+push edi
+mov byte [ebp - 0x1c], al
+movzx eax, word [esi + 2]
+mov word [ebp - 0x1e], 0
+push eax
+call fcn_0001cf4e  ; call 0x1cf4e
+movzx edx, word [ebp - 0x1e]
+add esp, 0xc
+mov eax, dword [ebp - 0x1c]
+mov word [ebp - 0x1e], 0
+and edx, 0xfff
+shl edx, 8
+and eax, 0xfff000ff
+or eax, edx
+mov dword [ebp - 0x1c], eax
+mov dl, byte [esi + 1]
+mov al, byte [ebp - 0x1a]
+push 0
+push edi
+and edx, 1
+shl edx, 4
+and eax, 0xffffffef
+or eax, edx
+mov byte [ebp - 0x1a], al
+movsx eax, word [esi + 4]
+push eax
+call fcn_0001cfc9  ; call 0x1cfc9
+mov ax, word [ebp - 0x1a]
+add esp, 0xc
+mov dx, word [ebp - 0x1e]
+push 4
+and eax, 0x1f
+shl edx, 5
+or eax, edx
+mov word [ebp - 0x1a], ax
+lea eax, [ebp - 0x1c]
+push eax
+push ebx
+call fcn_0001713e  ; call 0x1713e
+mov byte [ebx + 4], 0x11
+mov al, byte [esi + 6]
+mov byte [ebx + 5], al
+jmp short loc_0001d1ea  ; jmp 0x1d1ea
+
+loc_0001d174:
+mov dword [ebx], 0
+mov byte [ebx + 4], 0x12
+jmp short loc_0001d1ca  ; jmp 0x1d1ca
+
+loc_0001d180:
+push edx
+push 0
+lea eax, [ebp - 0x1e]
+push eax
+movzx eax, word [esi]
+push eax
+call fcn_0001cf4e  ; call 0x1cf4e
+movzx eax, byte [esi + 2]
+movzx edx, word [ebp - 0x1e]
+mov byte [ebx + 4], 0x13
+mov byte [ebx + 5], 0
+shl eax, 0x1f
+or eax, edx
+mov dword [ebx], eax
+jmp short loc_0001d1ea  ; jmp 0x1d1ea
+
+loc_0001d1a9:
+mov dword [ebx], 0
+mov byte [ebx + 4], 0x14
+jmp short loc_0001d1ca  ; jmp 0x1d1ca
+
+loc_0001d1b5:
+mov al, byte [esi + 1]
+mov dl, byte [esi]
+mov byte [ebx + 4], 0x15
+and eax, 1
+add eax, eax
+and edx, 1
+or eax, edx
+mov dword [ebx], eax
+
+loc_0001d1ca:
+mov byte [ebx + 5], 0
+jmp short loc_0001d1ed  ; jmp 0x1d1ed
+
+loc_0001d1d0:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001d1ed  ; je 0x1d1ed
+push eax
+push eax
+push ref_00026801  ; push 0x26801
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+
+loc_0001d1ea:
+add esp, 0x10
+
+loc_0001d1ed:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001d1f5:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x34
+mov ebx, dword [ebp + 8]
+push 8
+mov edi, dword [ebp + 0xc]
+lea esi, [ebp - 0x20]
+push esi
+call fcn_00016fff  ; call 0x16fff
+add esp, 0xc
+push 0x10
+push esi
+push ebx
+call fcn_0001d07a  ; call 0x1d07a
+push edi
+push esi
+push dword [ebp - 0x1c]
+push 2
+call fcn_0001cc0f  ; call 0x1cc0f
+add esp, 0x20
+test eax, eax
+jne short loc_0001d274  ; jne 0x1d274
+cmp dword [edi], 0
+jne short loc_0001d274  ; jne 0x1d274
+mov edx, dword [ebp - 0x20]
+mov dword [ebp - 0x2c], eax
+mov ecx, edx
+and ecx, 0x100000
+shr ecx, 0x14
+mov byte [ebx], dl
+movzx edx, dh
+mov byte [ebx + 1], cl
+lea ecx, [ebx + 2]
+add ebx, 4
+push eax
+push 1
+push ecx
+push edx
+call fcn_0001cf4e  ; call 0x1cf4e
+mov edx, dword [ebp - 0x20]
+add esp, 0xc
+push 1
+push ebx
+shr edx, 0x15
+push edx
+call fcn_0001cfc9  ; call 0x1cfc9
+mov eax, dword [ebp - 0x2c]
+add esp, 0x10
+
+loc_0001d274:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001d27c:
+push ebp
+mov ebp, esp
+sub esp, 0x1c
+push 0x11
+lea eax, [ebp - 0x10]
+push eax
+lea eax, [ebp + 8]
+push eax
+call fcn_0001d07a  ; call 0x1d07a
+push dword [ebp + 0x10]
+push dword [ebp - 0x10]
+push dword [ebp - 0xc]
+push 2
+call fcn_0001c9fc  ; call 0x1c9fc
+leave
+ret
+
+fcn_0001d2a3:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x24
+mov ebx, dword [ebp + 8]
+push 8
+mov edi, dword [ebp + 0xc]
+lea esi, [ebp - 0x20]
+push esi
+call fcn_00016fff  ; call 0x16fff
+add esp, 0xc
+push 0x14
+push esi
+push ebx
+call fcn_0001d07a  ; call 0x1d07a
+push edi
+push esi
+push dword [ebp - 0x1c]
+push 2
+call fcn_0001cc0f  ; call 0x1cc0f
+add esp, 0x20
+test eax, eax
+jne short loc_0001d2f3  ; jne 0x1d2f3
+cmp dword [edi], 0
+jne short loc_0001d2f3  ; jne 0x1d2f3
+mov edx, dword [ebp - 0x20]
+mov cl, dl
+and edx, 2
+and ecx, 1
+shr edx, 1
+mov byte [ebx], cl
+mov byte [ebx + 1], dl
+
+loc_0001d2f3:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001d2fb:
+push ebp
+mov ebp, esp
+sub esp, 0x1c
+push 0x15
+lea eax, [ebp - 0x10]
+push eax
+lea eax, [ebp + 8]
+push eax
+call fcn_0001d07a  ; call 0x1d07a
+push dword [ebp + 0xc]
+push dword [ebp - 0x10]
+push dword [ebp - 0xc]
+push 2
+call fcn_0001c9fc  ; call 0x1c9fc
+leave
+ret
+
+fcn_0001d322:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x24
+mov ebx, dword [ebp + 8]
+push 8
+mov edi, dword [ebp + 0xc]
+lea esi, [ebp - 0x20]
+push esi
+call fcn_00016fff  ; call 0x16fff
+add esp, 0xc
+push 0x12
+push esi
+push ebx
+call fcn_0001d07a  ; call 0x1d07a
+push edi
+push esi
+push dword [ebp - 0x1c]
+push 2
+call fcn_0001cc0f  ; call 0x1cc0f
+add esp, 0x20
+test eax, eax
+jne short loc_0001d373  ; jne 0x1d373
+cmp dword [edi], 0
+jne short loc_0001d373  ; jne 0x1d373
+mov edx, dword [ebp - 0x20]
+mov ecx, edx
+and cx, 0xfff
+shr edx, 0x1f
+mov word [ebx], cx
+mov byte [ebx + 2], dl
+
+loc_0001d373:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001d37b:
+push ebp
+mov ebp, esp
+sub esp, 0x1c
+push 0x13
+lea eax, [ebp - 0x10]
+push eax
+lea eax, [ebp + 8]
+push eax
+call fcn_0001d07a  ; call 0x1d07a
+push dword [ebp + 0xc]
+push dword [ebp - 0x10]
+push dword [ebp - 0xc]
+push 2
+call fcn_0001c9fc  ; call 0x1c9fc
+leave
+ret
+
+fcn_0001d3a2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x24
+mov ebx, dword [ebp + 8]
+push 8
+mov edi, dword [ebp + 0xc]
+lea esi, [ebp - 0x20]
+push esi
+call fcn_00016fff  ; call 0x16fff
+add esp, 0xc
+push 1
+push esi
+push ebx
+call fcn_0001d07a  ; call 0x1d07a
+push edi
+push esi
+push dword [ebp - 0x1c]
+push 2
+call fcn_0001cc0f  ; call 0x1cc0f
+add esp, 0x20
+test eax, eax
+jne short loc_0001d40d  ; jne 0x1d40d
+cmp dword [edi], 0
+jne short loc_0001d40d  ; jne 0x1d40d
+mov edx, dword [ebp - 0x20]
+mov ecx, edx
+and ecx, 0x100
+shr ecx, 8
+mov byte [ebx + 1], cl
+mov ecx, edx
+mov byte [ebx], dl
+and ecx, 0x200
+and edx, 0x400
+shr ecx, 9
+shr edx, 0xa
+mov byte [ebx + 2], cl
+mov byte [ebx + 3], dl
+
+loc_0001d40d:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001d415:
+push ebp
+mov ebp, esp
+sub esp, 8
+mov edx, dword [ref_000312e0]  ; mov edx, dword [0x312e0]
+mov eax, dword [ebp + 0xc]
+add eax, 3
+and eax, 0xfffffffc
+test edx, edx
+jne short loc_0001d43a  ; jne 0x1d43a
+mov dword [ref_000312e4], ref_00029db0  ; mov dword [0x312e4], 0x29db0
+jmp short loc_0001d460  ; jmp 0x1d460
+
+loc_0001d43a:
+mov ecx, dword [ref_000312e4]  ; mov ecx, dword [0x312e4]
+cmp dword [ecx + edx], 0x900ddea1
+je short loc_0001d460  ; je 0x1d460
+push eax
+push 0x3d
+push ref_00020660  ; push 0x20660
+push ref_00026822  ; push 0x26822
+call fcn_0001545e  ; call 0x1545e
+add esp, 0x10
+
+loc_0001d45e:
+jmp short loc_0001d45e  ; jmp 0x1d45e
+
+loc_0001d460:
+lea ecx, [eax + edx]
+cmp ecx, 0x752c
+jbe short loc_0001d482  ; jbe 0x1d482
+push eax
+push 0x4b
+push ref_00020660  ; push 0x20660
+push ref_00026842  ; push 0x26842
+call fcn_0001545e  ; call 0x1545e
+add esp, 0x10
+
+loc_0001d480:
+jmp short loc_0001d480  ; jmp 0x1d480
+
+loc_0001d482:
+mov eax, dword [ref_000312e4]  ; mov eax, dword [0x312e4]
+mov dword [ref_000312e0], ecx  ; mov dword [0x312e0], ecx
+mov dword [eax + ecx], 0x900ddea1
+mov ecx, dword [ebp + 0x10]
+add edx, eax
+xor eax, eax
+mov dword [ecx], edx
+leave
+ret
+
+fcn_0001d49f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0xc]
+mov edi, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0x14]
+mov dword [ebp - 0x1c], eax
+call fcn_00016406  ; call 0x16406
+movzx esi, di
+sub esp, 0xc
+mov dword [ebp - 0x20], eax
+lea eax, [esi + 0xc]
+push eax
+call fcn_00019d3d  ; call 0x19d3d
+add esp, 0x10
+mov ecx, dword [ebp - 0x20]
+test eax, eax
+mov edx, eax
+jne short loc_0001d4fb  ; jne 0x1d4fb
+call fcn_00015479  ; call 0x15479
+mov edi, 0x80000009
+test al, al
+je short loc_0001d55f  ; je 0x1d55f
+push eax
+push esi
+push ref_00026868  ; push 0x26868
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+jmp short loc_0001d55f  ; jmp 0x1d55f
+
+loc_0001d4fb:
+lea eax, [eax + 4]
+mov dword [ebx], eax
+mov eax, dword [ebp - 0x1c]
+mov word [edx + 4], ax
+mov eax, dword [ebx]
+mov word [eax + 2], di
+mov eax, dword [ebx]
+xor edi, edi
+mov dword [eax + 4], 0
+mov eax, dword [ebx]
+add eax, esi
+mov word [eax], 0xffff
+mov word [eax + 2], 8
+mov dword [eax + 4], 0
+mov eax, dword [ecx + 0x26c]
+mov dword [edx], eax
+mov dword [ecx + 0x26c], edx
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001d55f  ; je 0x1d55f
+sub esp, 0xc
+movzx eax, word [ebp - 0x1c]
+push dword [ebx]
+push esi
+push eax
+push ref_0002688e  ; push 0x2688e
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x20
+
+loc_0001d55f:
+lea esp, [ebp - 0xc]
+mov eax, edi
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001d569:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00016406  ; call 0x16406
+mov edx, dword [eax + 0x26c]
+mov eax, dword [ebp + 0xc]
+add edx, 4
+mov dword [eax], edx
+xor eax, eax
+leave
+ret
+
+fcn_0001d586:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x3c
+call fcn_00016410  ; call 0x16410
+sub esp, 0xc
+push 0x27
+mov edi, eax
+call fcn_00019db6  ; call 0x19db6
+mov dword [ebp - 0x1c], eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001d5c2  ; je 0x1d5c2
+cmp dword [ebp - 0x1c], 0
+jne short loc_0001d5cc  ; jne 0x1d5cc
+push edi
+push ref_000268a8  ; push 0x268a8
+push 0x41
+jmp near loc_0001d72a  ; jmp 0x1d72a
+
+loc_0001d5c2:
+cmp dword [ebp - 0x1c], 0
+je near loc_0001d737  ; je 0x1d737
+
+loc_0001d5cc:
+sub esp, 0xc
+push 0xc
+call fcn_00019db6  ; call 0x19db6
+mov dword [ebp - 0x20], eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001d5f8  ; je 0x1d5f8
+cmp dword [ebp - 0x20], 0
+jne short loc_0001d602  ; jne 0x1d602
+push esi
+push ref_000268e8  ; push 0x268e8
+push 0x47
+jmp near loc_0001d72a  ; jmp 0x1d72a
+
+loc_0001d5f8:
+cmp dword [ebp - 0x20], 0
+je near loc_0001d737  ; je 0x1d737
+
+loc_0001d602:
+sub esp, 0xc
+push 0x36
+call fcn_00019db6  ; call 0x19db6
+mov dword [ebp - 0x24], eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001d62e  ; je 0x1d62e
+cmp dword [ebp - 0x24], 0
+jne short loc_0001d638  ; jne 0x1d638
+push ebx
+push ref_00026910  ; push 0x26910
+push 0x4d
+jmp near loc_0001d72a  ; jmp 0x1d72a
+
+loc_0001d62e:
+cmp dword [ebp - 0x24], 0
+je near loc_0001d737  ; je 0x1d737
+
+loc_0001d638:
+sub esp, 0xc
+push 0xd
+call fcn_00019db6  ; call 0x19db6
+mov dword [ebp - 0x28], eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001d664  ; je 0x1d664
+cmp dword [ebp - 0x28], 0
+jne short loc_0001d66e  ; jne 0x1d66e
+push ecx
+push ref_0002692d  ; push 0x2692d
+push 0x53
+jmp near loc_0001d72a  ; jmp 0x1d72a
+
+loc_0001d664:
+cmp dword [ebp - 0x28], 0
+je near loc_0001d737  ; je 0x1d737
+
+loc_0001d66e:
+sub esp, 0xc
+push 0x102
+call fcn_00019db6  ; call 0x19db6
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001d69a  ; je 0x1d69a
+test ebx, ebx
+jne short loc_0001d6a2  ; jne 0x1d6a2
+push edx
+push ref_00026946  ; push 0x26946
+push 0x59
+jmp near loc_0001d72a  ; jmp 0x1d72a
+
+loc_0001d69a:
+test ebx, ebx
+je near loc_0001d737  ; je 0x1d737
+
+loc_0001d6a2:
+sub esp, 0xc
+push 0xdc
+call fcn_00019db6  ; call 0x19db6
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001d6cb  ; je 0x1d6cb
+test esi, esi
+jne short loc_0001d6cf  ; jne 0x1d6cf
+push eax
+push ref_00026960  ; push 0x26960
+push 0x5f
+jmp short loc_0001d72a  ; jmp 0x1d72a
+
+loc_0001d6cb:
+test esi, esi
+je short loc_0001d737  ; je 0x1d737
+
+loc_0001d6cf:
+sub esp, 0xc
+push 0x6b
+call fcn_00019db6  ; call 0x19db6
+mov dword [ebp - 0x2c], eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+mov edx, dword [ebp - 0x2c]
+test al, al
+je short loc_0001d6f9  ; je 0x1d6f9
+test edx, edx
+jne short loc_0001d6fd  ; jne 0x1d6fd
+push eax
+push ref_0002697f  ; push 0x2697f
+push 0x65
+jmp short loc_0001d72a  ; jmp 0x1d72a
+
+loc_0001d6f9:
+test edx, edx
+je short loc_0001d737  ; je 0x1d737
+
+loc_0001d6fd:
+sub esp, 0xc
+push 5
+mov dword [ebp - 0x30], edx
+call fcn_00019db6  ; call 0x19db6
+mov dword [ebp - 0x2c], eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+mov edx, dword [ebp - 0x30]
+test al, al
+je short loc_0001d741  ; je 0x1d741
+cmp dword [ebp - 0x2c], 0
+jne short loc_0001d747  ; jne 0x1d747
+push eax
+push ref_0002699a  ; push 0x2699a
+push 0x6b
+
+loc_0001d72a:
+push ref_000268cc  ; push 0x268cc
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001d737:
+mov edx, 0x80000009
+jmp near loc_0001dfa8  ; jmp 0x1dfa8
+
+loc_0001d741:
+cmp dword [ebp - 0x2c], 0
+je short loc_0001d737  ; je 0x1d737
+
+loc_0001d747:
+sub esp, 0xc
+push 0x11
+mov dword [ebp - 0x34], edx
+call fcn_00019db6  ; call 0x19db6
+mov dword [ebp - 0x30], eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+mov edx, dword [ebp - 0x34]
+test al, al
+je short loc_0001d776  ; je 0x1d776
+cmp dword [ebp - 0x30], 0
+jne short loc_0001d77c  ; jne 0x1d77c
+push eax
+push ref_000269b6  ; push 0x269b6
+push 0x71
+jmp short loc_0001d72a  ; jmp 0x1d72a
+
+loc_0001d776:
+cmp dword [ebp - 0x30], 0
+je short loc_0001d737  ; je 0x1d737
+
+loc_0001d77c:
+lea eax, [edi + 0xce]
+mov dword [esi + 0xd0], eax
+lea eax, [edi + 0x8ce]
+mov dword [esi + 0xd4], eax
+lea eax, [edi + 0x8e6]
+mov dword [esi + 0xd8], eax
+push eax
+push 0
+push 0x27
+push dword [ebp - 0x1c]
+mov dword [ebp - 0x40], edx
+call fcn_0001f079  ; call 0x1f079
+mov eax, dword [ebp - 0x20]
+mov ecx, dword [ebp - 0x1c]
+mov dword [eax], 0x80000010
+mov dword [eax + 8], ecx
+mov dword [eax + 4], ref_0002930c  ; mov dword [eax + 4], 0x2930c
+mov byte [ecx], 0x13
+call fcn_0001c651  ; call 0x1c651
+add esp, 0x10
+mov edx, dword [ebp - 0x40]
+cmp eax, 0x306d0
+sete cl
+cmp eax, 0x40670
+mov dword [ebp - 0x38], eax
+sete al
+mov byte [ebp - 0x34], al
+or al, cl
+mov byte [ebp - 0x39], cl
+mov byte [ebp - 0x3a], al
+je short loc_0001d811  ; je 0x1d811
+push eax
+push 0
+push 2
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+mov edx, dword [ebp - 0x40]
+add esp, 0x10
+
+loc_0001d811:
+mov al, byte [edi + 0x42]
+mov dword [ebp - 0x40], edx
+mov edx, dword [ebp - 0x24]
+mov ecx, dword [ebp - 0x1c]
+cmp byte [ebp - 0x3a], 1
+mov byte [edx], al
+mov al, byte [edi + 0x43]
+mov byte [edx + 1], al
+mov al, byte [edi + 0x44]
+mov byte [edx + 2], al
+mov al, byte [edi + 0x45]
+mov dword [edx + 4], 0xfed10000
+mov dword [edx + 8], 0xfed18000
+mov dword [edx + 0xc], 0xfed19000
+mov byte [edx + 3], al
+mov dword [edx + 0x22], 0xfed80000
+mov eax, dword [edi + 0x14]
+mov dword [edx + 0x10], eax
+movzx eax, word [edi + 0x18]
+mov dword [edx + 0x14], eax
+mov eax, dword [edi + 0x36]
+mov dword [edx + 0x2b], 0x400000
+mov dword [edx + 0x18], 0xfed84000
+mov word [edx + 0x26], 0
+mov dword [edx + 0x1c], eax
+mov eax, dword [edi + 4]
+mov byte [edx + 0x20], al
+sbb eax, eax
+mov dword [ecx + 1], edx
+mov edx, dword [ebp - 0x28]
+add eax, 3
+mov word [edx + 2], ax
+mov byte [edx + 4], 1
+mov byte [edx + 5], 1
+mov byte [edx + 6], 0
+mov byte [edx + 7], 1
+mov byte [edx + 0xc], 1
+mov eax, dword [edi + 0x22]
+mov word [edx], 0x800
+mov dword [edx + 8], eax
+mov dword [ecx + 5], edx
+mov byte [ebx], 0
+mov eax, dword [edi + 0x4e]
+mov byte [ebx + 3], 1
+mov dword [ebx + 4], 0
+mov byte [ebx + 0x10], 0
+mov word [ebx + 1], ax
+mov byte [ebx + 0x11], 1
+mov byte [ebx + 0x5d], 0xff
+mov byte [ebx + 0x5e], 0x80
+mov byte [ebx + 0x5f], 1
+mov byte [ebx + 0x60], 1
+mov byte [ebx + 0x61], 1
+mov byte [ebx + 0x62], 7
+mov byte [ebx + 0x63], 0
+mov byte [ebx + 0xcf], 1
+mov byte [ebx + 0xfe], 0
+mov byte [ebx + 0xff], 0xe
+mov byte [ebx + 0x100], 0
+mov byte [ebx + 0xc2], 1
+mov byte [ebx + 0xc3], 1
+mov byte [ebx + 0xf2], 0
+mov byte [ebx + 0x24], 1
+mov byte [ebx + 0x25], 0
+mov byte [ebx + 0x26], 0
+mov byte [ebx + 0x27], 0
+mov byte [ebx + 0x28], 0
+mov eax, dword [edi + 0x3a]
+mov byte [ebx + 0x2a], al
+mov eax, dword [edi + 0x3e]
+mov byte [ebx + 0x2b], al
+mov cl, byte [ebp - 0x39]
+cmp dword [ebp - 0x38], 0x40650
+mov byte [ebx + 0x6d], 2
+mov edx, dword [ebp - 0x40]
+mov word [ebx + 0x6e], 0x30ce
+sete al
+or cl, al
+mov byte [ebx + 0x70], 1
+mov byte [ebx + 0x71], 0
+mov byte [ebx + 0x72], 0
+mov byte [ebx + 0x73], 0
+mov byte [ebx + 0x74], 1
+jne short loc_0001d971  ; jne 0x1d971
+cmp byte [ebp - 0x34], 0
+je short loc_0001d975  ; je 0x1d975
+
+loc_0001d971:
+mov byte [ebx + 0x75], 0
+
+loc_0001d975:
+mov al, byte [edi + 0x46]
+mov byte [ebx + 0x77], 1
+mov byte [ebx + 0x78], 0
+mov byte [ebx + 0x79], 0
+mov byte [ebx + 0x76], al
+mov byte [ebx + 0x7a], 3
+mov byte [ebx + 0x7b], 0
+mov byte [ebx + 0x7c], 0
+mov byte [ebx + 0x7d], 0
+mov byte [ebx + 0x7e], 0
+mov byte [ebx + 0x7f], 0
+mov byte [ebx + 0x80], 0
+mov word [ebx + 0x81], 0
+mov byte [ebx + 0x83], 0
+mov byte [ebx + 0x84], 0
+mov byte [ebx + 0x85], 0
+mov word [ebx + 0x86], 0
+mov byte [ebx + 0x88], 0xff
+mov byte [ebx + 0x89], 0xff
+mov byte [ebx + 0x8a], 0xff
+mov byte [ebx + 0x8b], 0xff
+mov byte [ebx + 0x8c], 0xff
+mov byte [ebx + 0x8d], 0xff
+mov byte [ebx + 0x8e], 0xff
+mov byte [ebx + 0x8f], 0xff
+mov byte [ebx + 0x90], 0xff
+mov byte [ebx + 0x91], 0xff
+mov byte [ebx + 0x92], 0xff
+mov byte [ebx + 0x93], 0xff
+mov byte [ebx + 0x94], 0xff
+mov byte [ebx + 0x95], 0xff
+mov byte [ebx + 0x96], 0xff
+mov byte [ebx + 0x97], 0xff
+mov byte [ebx + 0x98], 0
+mov byte [ebx + 0x99], 0
+mov byte [ebx + 0x9a], 0
+mov byte [ebx + 0x9b], 0
+mov byte [ebx + 0x9c], 0
+mov byte [ebx + 0x9d], 0
+mov byte [ebx + 0x9e], 0
+mov byte [ebx + 0x9f], 0
+mov byte [ebx + 0xa0], 0
+mov byte [ebx + 0xa1], 0
+mov byte [ebx + 0xa2], 0
+mov byte [ebx + 0xa3], 0
+mov byte [ebx + 0xa4], 0
+mov byte [ebx + 0xa5], 0
+mov byte [ebx + 0xa6], 0
+mov byte [ebx + 0xa7], 0
+mov byte [ebx + 0xa8], 0
+mov byte [ebx + 0xa9], 0
+mov byte [ebx + 0xaa], 0
+mov byte [ebx + 0xab], 0
+cmp dword [edi + 0x52], 0
+mov word [ebx + 0xad], 0x200
+mov byte [ebx + 0xaf], 0
+sete byte [ebx + 0xac]
+mov byte [ebx + 0xb0], 0x30
+test cl, cl
+jne short loc_0001daf5  ; jne 0x1daf5
+cmp byte [ebp - 0x34], 0
+je short loc_0001db03  ; je 0x1db03
+
+loc_0001daf5:
+mov byte [ebx + 0xb1], 1
+mov byte [ebx + 0xb2], 0x40
+
+loc_0001db03:
+mov byte [ebx + 0x101], 0xff
+mov byte [ebx + 0x2e], 1
+mov byte [ebx + 0x2f], 0
+mov byte [ebx + 0x30], 4
+mov byte [ebx + 0x31], 0xc
+mov byte [ebx + 0x6b], 0
+mov byte [ebx + 0x32], 0
+mov byte [ebx + 0x33], 1
+mov byte [ebx + 0x34], 1
+mov byte [ebx + 0x35], 1
+mov byte [ebx + 0x36], 1
+mov byte [ebx + 0x37], 0
+mov byte [ebx + 0x38], 1
+mov byte [ebx + 0x39], 1
+mov byte [ebx + 0x3a], 1
+mov byte [ebx + 0x3b], 0
+mov byte [ebx + 0x3c], 1
+mov byte [ebx + 0x3e], 1
+mov byte [ebx + 0x3f], 0
+mov byte [ebx + 0x40], 1
+mov byte [ebx + 0x41], 1
+mov byte [ebx + 0x42], 1
+mov byte [ebx + 0x5c], 1
+mov byte [ebx + 0x43], 1
+mov byte [ebx + 0x44], 1
+mov byte [ebx + 0x47], 1
+mov byte [ebx + 0x48], 1
+mov byte [ebx + 0x49], 1
+mov byte [ebx + 0x4a], 0
+mov byte [ebx + 0x4b], 0
+mov byte [ebx + 0x58], 0
+mov byte [ebx + 0x59], 0
+mov byte [ebx + 0x5a], 1
+mov byte [ebx + 0x6a], 1
+mov byte [ebx + 0xc5], 1
+mov byte [ebx + 0xce], 1
+cmp dword [edi + 0x56], 0
+mov byte [ebx + 0xd0], 1
+mov byte [ebx + 0x2c], 1
+sete byte [ebx + 0xfd]
+mov byte [ebx + 0x55], 0
+mov byte [ebx + 0x56], 1
+mov word [ebx + 0x4c], 0
+mov dword [ebx + 0x4e], 0
+mov byte [ebx + 0x53], 2
+mov byte [ebx + 0x54], 0
+mov dword [ebx + 0x64], 0x5f5e100
+mov byte [ebx + 0xc4], 0
+mov byte [ebx + 0x5b], 1
+mov byte [ebx + 0xf3], 1
+mov byte [ebx + 0xc7], 0
+mov al, byte [edi + 0x4a]
+mov byte [ebx + 0x57], al
+test cl, cl
+jne short loc_0001dbff  ; jne 0x1dbff
+cmp byte [ebp - 0x34], 0
+jmp short loc_0001dc06  ; jmp 0x1dc06
+
+loc_0001dbff:
+cmp dword [ebp - 0x38], 0x40650
+
+loc_0001dc06:
+je short loc_0001dc87  ; je 0x1dc87
+mov byte [ebx + 0xfc], 0
+mov byte [ebx + 0xd1], 0
+mov dword [ebx + 0xd2], 0
+mov dword [ebx + 0xd6], 0
+mov dword [ebx + 0xda], 0
+mov dword [ebx + 0xde], 0
+mov dword [ebx + 0xe2], 0
+mov dword [ebx + 0xe6], 0
+mov dword [ebx + 0xea], 0
+mov dword [ebx + 0xee], 0
+mov byte [ebx + 0xf4], 1
+mov dword [ebx + 0xf5], 0x320
+mov word [ebx + 0xf9], 0x118
+mov byte [ebx + 0xfb], 7
+
+loc_0001dc87:
+push ecx
+push 0
+push 0
+push 0
+mov dword [ebp - 0x24], edx
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+mov edx, dword [ebp - 0x24]
+mov ecx, eax
+and ch, 0xfe
+cmp cx, 0xc04
+je short loc_0001dcce  ; je 0x1dcce
+mov ecx, eax
+and ecx, 0xfffffff7
+cmp cx, 0xa04
+je short loc_0001dcce  ; je 0x1dcce
+and eax, 0xffffffef
+cmp ax, 0x1604
+sete al
+movzx eax, al
+jmp short loc_0001dcd3  ; jmp 0x1dcd3
+
+loc_0001dcce:
+mov eax, 1
+
+loc_0001dcd3:
+mov byte [ebx + 0xc6], al
+mov word [ebx + 0xc8], 0xcf8
+mov word [ebx + 0xca], 0xcfc
+mov byte [ebx + 0xcc], 0xaa
+mov dword [esi], fcn_00018ee1  ; mov dword [esi], 0x18ee1
+mov dword [esi + 4], fcn_00018ef6  ; mov dword [esi + 4], 0x18ef6
+mov dword [esi + 8], fcn_00018f64  ; mov dword [esi + 8], 0x18f64
+mov dword [esi + 0xc], fcn_00018eea  ; mov dword [esi + 0xc], 0x18eea
+mov dword [esi + 0x10], fcn_00018f27  ; mov dword [esi + 0x10], 0x18f27
+mov dword [esi + 0x14], fcn_00018f97  ; mov dword [esi + 0x14], 0x18f97
+mov dword [esi + 0x18], fcn_00017d8b  ; mov dword [esi + 0x18], 0x17d8b
+mov dword [esi + 0x1c], fcn_00017dc2  ; mov dword [esi + 0x1c], 0x17dc2
+mov dword [esi + 0x20], fcn_00017e4e  ; mov dword [esi + 0x20], 0x17e4e
+mov dword [esi + 0x24], fcn_00017ed8  ; mov dword [esi + 0x24], 0x17ed8
+mov dword [esi + 0x28], fcn_00017da5  ; mov dword [esi + 0x28], 0x17da5
+mov dword [esi + 0x2c], fcn_00017e04  ; mov dword [esi + 0x2c], 0x17e04
+mov dword [esi + 0x30], fcn_00017e8f  ; mov dword [esi + 0x30], 0x17e8f
+mov dword [esi + 0x34], fcn_00016afd  ; mov dword [esi + 0x34], 0x16afd
+mov dword [esi + 0x38], fcn_0001a282  ; mov dword [esi + 0x38], 0x1a282
+mov dword [esi + 0x3c], fcn_0001a37c  ; mov dword [esi + 0x3c], 0x1a37c
+mov dword [esi + 0x40], fcn_0001a2fa  ; mov dword [esi + 0x40], 0x1a2fa
+mov dword [esi + 0x44], fcn_0001a3f5  ; mov dword [esi + 0x44], 0x1a3f5
+mov dword [esi + 0x48], fcn_000167d0  ; mov dword [esi + 0x48], 0x167d0
+mov dword [esi + 0x4c], fcn_000167fe  ; mov dword [esi + 0x4c], 0x167fe
+mov dword [esi + 0x50], fcn_00016861  ; mov dword [esi + 0x50], 0x16861
+mov dword [esi + 0x54], fcn_00016a4e  ; mov dword [esi + 0x54], 0x16a4e
+mov dword [esi + 0x58], fcn_0001713e  ; mov dword [esi + 0x58], 0x1713e
+mov dword [esi + 0x5c], fcn_0001f079  ; mov dword [esi + 0x5c], 0x1f079
+mov dword [esi + 0x60], fcn_00016a89  ; mov dword [esi + 0x60], 0x16a89
+mov dword [esi + 0x64], fcn_00016aa2  ; mov dword [esi + 0x64], 0x16aa2
+mov dword [esi + 0x68], fcn_0001fdda  ; mov dword [esi + 0x68], 0x1fdda
+mov dword [esi + 0x6c], fcn_0001724f  ; mov dword [esi + 0x6c], 0x1724f
+mov dword [esi + 0x70], fcn_0001fe24  ; mov dword [esi + 0x70], 0x1fe24
+mov dword [esi + 0x74], fcn_0001fe2d  ; mov dword [esi + 0x74], 0x1fe2d
+mov eax, dword [ebp - 0x1c]
+mov dword [esi + 0x78], fcn_0001670c  ; mov dword [esi + 0x78], 0x1670c
+mov dword [esi + 0x7c], fcn_00016b44  ; mov dword [esi + 0x7c], 0x16b44
+mov dword [esi + 0x80], fcn_0001cc0f  ; mov dword [esi + 0x80], 0x1cc0f
+mov dword [esi + 0x84], fcn_0001c9fc  ; mov dword [esi + 0x84], 0x1c9fc
+mov dword [esi + 0x88], fcn_00016ba4  ; mov dword [esi + 0x88], 0x16ba4
+mov dword [esi + 0x8c], fcn_00016bab  ; mov dword [esi + 0x8c], 0x16bab
+mov dword [esi + 0x90], fcn_00016bb3  ; mov dword [esi + 0x90], 0x16bb3
+mov dword [esi + 0x94], fcn_00016bdc  ; mov dword [esi + 0x94], 0x16bdc
+mov dword [esi + 0x98], fcn_000167ad  ; mov dword [esi + 0x98], 0x167ad
+mov dword [esi + 0x9c], fcn_00016822  ; mov dword [esi + 0x9c], 0x16822
+mov dword [esi + 0xa0], fcn_000175bc  ; mov dword [esi + 0xa0], 0x175bc
+mov dword [esi + 0xa4], fcn_000175c6  ; mov dword [esi + 0xa4], 0x175c6
+mov dword [esi + 0xa8], fcn_00016c50  ; mov dword [esi + 0xa8], 0x16c50
+mov dword [eax + 9], ebx
+mov dword [eax + 0x1e], esi
+xor eax, eax
+mov byte [edx], 0
+mov byte [edx + 1], 1
+mov byte [edx + 2], 1
+mov byte [edx + 3], 1
+mov byte [edx + 4], 0
+mov byte [edx + 5], 0
+mov byte [edx + 6], 0
+mov byte [edx + 7], 0
+mov byte [edx + 0x5c], 0xff
+mov byte [edx + 0x61], 0
+mov byte [edx + 0x5d], 0xff
+mov byte [edx + 0x62], 0
+mov byte [edx + 0x5e], 0xff
+mov byte [edx + 0x63], 0
+mov byte [edx + 8], 1
+mov byte [edx + 0x39], 0
+mov byte [edx + 0x40], 2
+mov byte [edx + 0x5f], 0
+mov byte [edx + 0x60], 0
+mov byte [edx + 0x64], 2
+mov word [edx + 0x65], 0x2710
+mov word [edx + 0x67], 2
+mov byte [edx + 0x69], 2
+mov byte [edx + 0x6a], 2
+mov byte [edx + 0x3b], 1
+mov byte [edx + 0x48], 0
+mov word [edx + 0x3c], 0x3e8
+mov byte [edx + 0x3f], 0xf
+mov byte [edx + 0x42], 0x14
+mov word [edx + 0x50], 1
+
+loc_0001dec9:
+mov byte [edx + eax + 9], 8
+mov byte [edx + eax + 0x19], 7
+mov byte [edx + eax + 0x29], 2
+inc eax
+cmp eax, 0x10
+jne short loc_0001dec9  ; jne 0x1dec9
+mov eax, dword [ebp - 0x2c]
+mov byte [edx + 0x49], 0
+mov byte [eax], 0
+xor eax, eax
+mov byte [edx + 0x52], 0
+mov byte [edx + 0x53], 0
+
+loc_0001def2:
+mov byte [edx + eax + 0x54], 8
+inc eax
+cmp eax, 8
+jne short loc_0001def2  ; jne 0x1def2
+mov esi, dword [ebp - 0x30]
+sub esp, 0xc
+mov ecx, dword [ebp - 0x1c]
+mov dword [edx + 0x44], 0
+mov dword [ecx + 0xd], edx
+mov word [esi], 0
+mov word [esi + 2], 0
+mov word [esi + 4], 0
+mov word [esi + 6], 0
+mov word [esi + 8], 0
+mov byte [esi + 0xa], 0
+mov byte [esi + 0xb], 0
+mov word [esi + 0xc], 0
+mov word [esi + 0xe], 0
+mov byte [esi + 0x10], 0
+mov dword [ecx + 0x11], esi
+mov byte [ecx + 0x22], 0
+mov eax, dword [edi + 0x8f6]
+mov dword [ecx + 0x15], eax
+push dword [ebp - 0x20]
+call fcn_0001972b  ; call 0x1972b
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+mov edx, ebx
+test al, al
+je short loc_0001dfa8  ; je 0x1dfa8
+test ebx, ebx
+jns short loc_0001dfa8  ; jns 0x1dfa8
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001df8e  ; je 0x1df8e
+push edx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001df8e:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x237
+push ref_000268cc  ; push 0x268cc
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+mov edx, ebx
+
+loc_0001dfa8:
+lea esp, [ebp - 0xc]
+mov eax, edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001dfb2:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+call fcn_00016410  ; call 0x16410
+mov esi, eax
+call fcn_0001bfbb  ; call 0x1bfbb
+sub esp, 0xc
+push 0x5ac
+mov dword [ebp - 0x1c], eax
+call fcn_00019db6  ; call 0x19db6
+add esp, 0x10
+mov ebx, eax
+test eax, eax
+jne short loc_0001e00b  ; jne 0x1e00b
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001e001  ; je 0x1e001
+push eax
+push ref_00022281  ; push 0x22281
+push 0x129
+
+loc_0001dff4:
+push ref_000269cf  ; push 0x269cf
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001e001:
+mov edx, 0x80000009
+jmp near loc_0001e677  ; jmp 0x1e677
+
+loc_0001e00b:
+sub esp, 0xc
+push 0xc
+call fcn_00019db6  ; call 0x19db6
+add esp, 0x10
+mov dword [ebp - 0x20], eax
+test eax, eax
+jne short loc_0001e035  ; jne 0x1e035
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001e001  ; je 0x1e001
+push eax
+push ref_00022281  ; push 0x22281
+push 0x12f
+jmp short loc_0001dff4  ; jmp 0x1dff4
+
+loc_0001e035:
+mov eax, dword [ebp - 0x20]
+xor edi, edi
+mov dword [eax], 0x80000010
+mov dword [eax + 4], ref_000291dc  ; mov dword [eax + 4], 0x291dc
+mov dword [eax + 8], ebx
+lea eax, [ebx + 0x284]
+mov byte [ebx], 0xc
+mov byte [ebx + 1], 0
+mov dword [ebx + 4], 0xfed1c000
+mov dword [ebp - 0x24], eax
+mov eax, dword [esi + 0x2a]
+mov word [ebx + 8], ax
+mov eax, dword [esi + 0x2e]
+mov byte [ebx + 0xc], 0
+mov byte [ebx + 0x37e], 1 ; enable GbE
+mov byte [ebx + 0x370], 1
+mov word [ebx + 0xa], ax
+mov byte [ebx + 0x1da], 1
+mov byte [ebx + 0x386], 1
+mov ax, word [esi + 0x18]
+or byte [ebx + 0x45e], 1
+or byte [ebx + 0x49e], 0x80
+and byte [ebx + 0x486], 0xfe
+mov word [ebx + 0x388], ax
+mov byte [ebx + 0x3a], 0
+mov byte [ebx + 0x496], 1
+mov byte [ebx + 0x497], 1
+mov byte [ebx + 0x498], 1
+mov byte [ebx + 0x499], 1
+mov byte [ebx + 0x49a], 1
+mov byte [ebx + 0x49b], 1
+mov byte [ebx + 0x49c], 1
+mov byte [ebx + 0x49d], 1
+or byte [ebx + 0x412], 0xf
+or byte [ebx + 0x419], 0xc0
+or byte [ebx + 0x41e], 2
+or byte [ebx + 0x424], 0x40
+mov byte [ebx + 0x43c], 1
+
+loc_0001e10e:
+call fcn_0001c1e1  ; call 0x1c1e1
+movzx eax, al
+cmp edi, eax
+jae short loc_0001e128  ; jae 0x1e128
+imul eax, edi, 0x12
+inc edi
+or byte [ebx + eax + 0x1e1], 0x40
+jmp short loc_0001e10e  ; jmp 0x1e10e
+
+loc_0001e128:
+mov al, byte [ebx + 0x436]
+xor ecx, ecx
+and byte [ebx + 0x426], 0xfe
+or byte [ebx + 0x432], 7
+or eax, 3
+and eax, 0xfffffffb
+mov word [ebx + 0x43a], 0
+mov byte [ebx + 0x436], al
+mov byte [ebx + 0x1a8], 1
+
+loc_0001e15a:
+mov dword [ebp - 0x28], ecx
+call fcn_0001c1bf  ; call 0x1c1bf
+mov ecx, dword [ebp - 0x28]
+cmp cl, al
+jae short loc_0001e192  ; jae 0x1e192
+movzx eax, cl
+imul eax, eax, 0x2c
+add eax, ebx
+mov dl, byte [eax + 0x46]
+mov byte [eax + 0x4f], cl
+mov byte [eax + 0x50], cl
+inc ecx
+mov byte [eax + 0x56], 4
+or edx, 5
+and edx, 0x7f
+mov byte [eax + 0x57], 3
+mov byte [eax + 0x4e], 0
+mov byte [eax + 0x46], dl
+jmp short loc_0001e15a  ; jmp 0x1e15a
+
+loc_0001e192:
+or byte [ebx + 0x17a], 8
+sub esp, 0xc
+and byte [ebx + 0x1aa], 0xfe
+mov byte [ebx + 0x1a6], 0
+mov byte [ebx + 0x1a7], 0
+mov byte [ebx + 0x1a9], 1
+push 0xc
+call fcn_00019db6  ; call 0x19db6
+add esp, 0x10
+test eax, eax
+jne short loc_0001e1dc  ; jne 0x1e1dc
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001e240  ; je 0x1e240
+push eax
+push ref_00022281  ; push 0x22281
+push 0xf8
+jmp short loc_0001e233  ; jmp 0x1e233
+
+loc_0001e1dc:
+sub esp, 0xc
+mov dword [eax], 0x80000010
+mov dword [eax + 4], ref_0002911c  ; mov dword [eax + 4], 0x2911c
+mov dword [eax + 8], ref_00029748  ; mov dword [eax + 8], 0x29748
+push eax
+call fcn_0001972b  ; call 0x1972b
+mov edi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001e240  ; je 0x1e240
+test edi, edi
+jns short loc_0001e240  ; jns 0x1e240
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001e228  ; je 0x1e228
+push eax
+push edi
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001e228:
+push ecx
+push ref_000206f4  ; push 0x206f4
+push 0x101
+
+loc_0001e233:
+push ref_000269cf  ; push 0x269cf
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001e240:
+mov dword [ebx + 0x1db], 1
+xor edi, edi
+
+loc_0001e24c:
+call fcn_0001c1e1  ; call 0x1c1e1
+mov edx, edi
+cmp dl, al
+jae near loc_0001e2db  ; jae 0x1e2db
+mov eax, edi
+inc edi
+movzx eax, al
+imul eax, eax, 0x12
+add eax, ebx
+mov dl, byte [eax + 0x1e1]
+lea ecx, [eax + 0x1da]
+mov byte [eax + 0x1df], 0x71
+mov byte [eax + 0x1e0], 0x1f
+mov byte [eax + 0x1e4], 1
+and edx, 0xffffffc0
+or edx, 0x27
+mov byte [eax + 0x1e1], dl
+mov byte [eax + 0x1e6], 1
+mov byte [eax + 0x1e8], 1
+mov byte [eax + 0x1e3], 0
+mov byte [eax + 0x1e5], 0
+mov byte [eax + 0x1e7], 0
+mov byte [eax + 0x1e9], 0
+mov byte [eax + 0x1ea], 0
+mov byte [eax + 0x1eb], 0
+mov byte [eax + 0x1ec], 0
+and byte [ecx + 0x13], 0xf0
+jmp near loc_0001e24c  ; jmp 0x1e24c
+
+loc_0001e2db:
+mov al, byte [ebx + 0x24c]
+mov byte [ebx + 0x24b], 0x7e
+mov byte [ebx + 0x253], 0
+mov byte [ebx + 0x255], 1
+or eax, 0x1e
+and eax, 0xfffffffe
+mov byte [ebx + 0x24c], al
+mov byte [ebx + 0x254], 0
+mov dword [ebx + 0x24f], 0
+mov byte [ebx + 0x257], 0
+mov byte [ebx + 0x258], 0
+mov byte [ebx + 0x259], 0
+mov byte [ebx + 0x25a], 0
+mov byte [ebx + 0x25b], 0x64
+call fcn_00015480  ; call 0x15480
+mov byte [ebx + 0x38d], 4
+push eax
+push 4
+push ref_000296b0  ; push 0x296b0
+lea eax, [ebx + 0x38e]
+push eax
+call fcn_0001713e  ; call 0x1713e
+mov word [ebx + 0x36], 0x8086
+mov word [ebx + 0x38], 0x7270
+mov byte [ebx + 0x3b], 0
+mov byte [ebx + 0x360], 2
+mov byte [ebx + 0x361], 0
+mov byte [ebx + 0x362], 1
+mov byte [ebx + 0x35c], 1
+mov byte [ebx + 0x35d], 0xf0
+mov byte [ebx + 0x35e], 0x1f
+mov byte [ebx + 0x35f], 0
+mov eax, dword [esi + 0xc]
+mov word [ebx + 0x22], 0xd000
+mov word [ebx + 0x24], 0x10
+mov byte [ebx + 0x11], al
+mov eax, dword [esi + 0x32]
+mov dword [ebx + 0x1e], 0x10000
+mov byte [ebx + 0x18], 2
+mov byte [ebx + 0x19], 6
+mov dword [ebx + 0x1a], eax
+mov byte [ebx + 0x371], 0
+mov word [ebx + 0x374], 0x12c
+mov byte [ebx + 0x372], 1
+mov byte [ebx + 0x373], 0
+pop eax
+pop edx
+lea eax, [ebx + 0x57c]
+push eax
+push dword [ebp - 0x24]
+call fcn_0001e681  ; call 0x1e681
+mov al, byte [ebx + 0x40e]
+add esp, 0x10
+or eax, 3
+and eax, 0xffffffc3
+mov byte [ebx + 0x40e], al
+xor eax, eax
+
+loc_0001e404:
+and byte [ebx + eax*8 + 0x554], 0xfc
+mov word [ebx + eax*8 + 0x558], 0
+mov word [ebx + eax*8 + 0x55a], 0
+inc eax
+cmp eax, 5
+jne short loc_0001e404  ; jne 0x1e404
+mov al, byte [ebx + 0x46a]
+xor ecx, ecx
+mov byte [ebx + 0x364], 1
+mov dword [ebx + 0x368], 0xfed00000
+mov byte [ebx + 0x36c], 1
+and eax, 0xffffffb0
+or eax, 0x49
+mov byte [ebx + 0x365], 0xf0
+mov byte [ebx + 0x366], 0xf
+mov byte [ebx + 0x367], 0
+mov byte [ebx + 0x476], 1
+mov dword [ebx + 0x47e], 0
+mov dword [ebx + 0x47a], 1
+mov byte [ebx + 0x46a], al
+mov byte [ebx + 0x37f], 0
+mov byte [ebx + 0x256], 1
+
+loc_0001e490:
+mov dword [ebp - 0x24], ecx
+call fcn_0001c1bf  ; call 0x1c1bf
+mov ecx, dword [ebp - 0x24]
+cmp cl, al
+jae short loc_0001e4ad  ; jae 0x1e4ad
+movzx eax, cl
+inc ecx
+imul eax, eax, 0x2c
+mov byte [ebx + eax + 0x58], 1
+jmp short loc_0001e490  ; jmp 0x1e490
+
+loc_0001e4ad:
+and byte [ebx + 0x45e], 0xf7
+xor ecx, ecx
+
+loc_0001e4b6:
+mov dword [ebp - 0x24], ecx
+call fcn_0001c1bf  ; call 0x1c1bf
+mov ecx, dword [ebp - 0x24]
+cmp cl, al
+jae short loc_0001e524  ; jae 0x1e524
+cmp dword [ebp - 0x1c], 2
+movzx eax, cl
+jne short loc_0001e4e3  ; jne 0x1e4e3
+imul esi, eax, 0x2c
+lea esi, [ebx + esi + 0x50]
+mov word [esi + 0xa], 0x1003
+mov word [esi + 0xc], 0x1003
+jmp short loc_0001e4fc  ; jmp 0x1e4fc
+
+loc_0001e4e3:
+cmp dword [ebp - 0x1c], 1
+jne short loc_0001e4fc  ; jne 0x1e4fc
+imul esi, eax, 0x2c
+lea esi, [ebx + esi + 0x50]
+mov word [esi + 0xa], 0x846
+mov word [esi + 0xc], 0x846
+
+loc_0001e4fc:
+imul eax, eax, 0x2c
+inc ecx
+add eax, ebx
+mov byte [eax + 0x59], 0
+mov byte [eax + 0x5e], 2
+mov byte [eax + 0x5f], 2
+mov word [eax + 0x60], 0x3c
+mov byte [eax + 0x62], 2
+mov byte [eax + 0x63], 2
+mov word [eax + 0x64], 0x3c
+jmp short loc_0001e4b6  ; jmp 0x1e4b6
+
+loc_0001e524:
+mov al, byte [ebx + 0x446]
+or byte [ebx + 0x442], 7
+and byte [ebx + 0x45e], 0xf9
+and eax, 0xffffffcc
+or eax, 0xc
+mov byte [ebx + 0x446], al
+mov al, byte [ebx + 0x486]
+mov dword [ebx + 0x44a], 0
+mov dword [ebx + 0x44e], 2
+mov dword [ebx + 0x452], 4
+and eax, 1
+or eax, 0x32
+mov byte [ebx + 0x486], al
+mov al, byte [ebx + 0x49e]
+mov dword [ebx + 0x456], 3
+mov dword [ebx + 0x45a], 3
+mov byte [ebx + 0x462], 4
+or eax, 1
+and eax, 0xffffffbd
+mov byte [ebx + 0x49e], al
+xor eax, eax
+mov byte [ebx + 0x10], 0xdd
+
+loc_0001e5a7:
+mov dword [ebx + eax*4 + 0x1ba], 0
+inc eax
+cmp eax, 8
+jne short loc_0001e5a7  ; jne 0x1e5a7
+cmp dword [ebp - 0x1c], 2
+lea eax, [ebx + 0x4de]
+lea esi, [ebx + 0x527]
+jne short loc_0001e5f2  ; jne 0x1e5f2
+mov byte [ebx + 0x526], 5
+push edi
+push 0x28
+push ref_000296f0  ; push 0x296f0
+push eax
+call fcn_0001713e  ; call 0x1713e
+add esp, 0xc
+mov byte [ebx + 0x553], 9
+push 0x24
+push ref_000296b4  ; push 0x296b4
+jmp short loc_0001e618  ; jmp 0x1e618
+
+loc_0001e5f2:
+mov byte [ebx + 0x526], 6
+push ecx
+push 0x30
+push ref_00029718  ; push 0x29718
+push eax
+call fcn_0001713e  ; call 0x1713e
+add esp, 0xc
+mov byte [ebx + 0x553], 6
+push 0x18
+push ref_000296d8  ; push 0x296d8
+
+loc_0001e618:
+push esi
+call fcn_0001713e  ; call 0x1713e
+add esp, 0x10
+sub esp, 0xc
+push dword [ebp - 0x20]
+call fcn_0001972b  ; call 0x1972b
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+mov edx, ebx
+test al, al
+je short loc_0001e677  ; je 0x1e677
+test ebx, ebx
+jns short loc_0001e677  ; jns 0x1e677
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001e65d  ; je 0x1e65d
+push edx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001e65d:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0x2d5
+push ref_000269cf  ; push 0x269cf
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+mov edx, ebx
+
+loc_0001e677:
+lea esp, [ebp - 0xc]
+mov eax, edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001e681:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov ebx, dword [ebp + 8]
+call fcn_00016410  ; call 0x16410
+test ebx, ebx
+jne short loc_0001e6bd  ; jne 0x1e6bd
+call fcn_00015480  ; call 0x15480
+test al, al
+je near loc_0001ecf3  ; je 0x1ecf3
+push edx
+push ref_00022281  ; push 0x22281
+push 0x35
+push ref_000269ec  ; push 0x269ec
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+jmp near loc_0001ecf3  ; jmp 0x1ecf3
+
+loc_0001e6bd:
+mov esi, eax
+call fcn_0001bfbb  ; call 0x1bfbb
+mov edi, eax
+push eax
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+add eax, 2
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+xor ecx, ecx
+mov byte [ebx], 0
+mov byte [ebx + 8], 0
+mov byte [ebx + 0x11], 1
+mov byte [ebx + 0x10], 1
+mov byte [ebx + 0x13], 0
+mov edx, eax
+mov byte [ebx + 0x12], 1
+
+loc_0001e6fb:
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x1c], ecx
+call fcn_0001c261  ; call 0x1c261
+mov ecx, dword [ebp - 0x1c]
+mov edx, dword [ebp - 0x20]
+movzx eax, al
+cmp ecx, eax
+jae short loc_0001e71b  ; jae 0x1e71b
+mov byte [ebx + ecx + 0x14], 0
+inc ecx
+jmp short loc_0001e6fb  ; jmp 0x1e6fb
+
+loc_0001e71b:
+xor ecx, ecx
+
+loc_0001e71d:
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x1c], ecx
+call fcn_0001c2f8  ; call 0x1c2f8
+mov ecx, dword [ebp - 0x1c]
+mov edx, dword [ebp - 0x20]
+movzx eax, al
+cmp ecx, eax
+jae short loc_0001e73d  ; jae 0x1e73d
+mov byte [ebx + ecx + 0x22], 0
+inc ecx
+jmp short loc_0001e71d  ; jmp 0x1e71d
+
+loc_0001e73d:
+mov byte [ebx + 0x28], 0
+mov byte [ebx + 1], 0
+mov byte [ebx + 9], 0
+mov byte [ebx + 0xb5], 0
+mov byte [ebx + 0xb4], 1
+mov al, byte [esi + 0x5c]
+mov byte [ebx + 0x2c], al
+mov al, byte [esi + 0x61]
+mov byte [ebx + 0x34], al
+mov al, byte [esi + 0x66]
+mov byte [ebx + 0x3c], al
+mov al, byte [esi + 0x6b]
+mov byte [ebx + 0x44], al
+mov al, byte [esi + 0x70]
+mov byte [ebx + 0x4c], al
+mov al, byte [esi + 0x75]
+mov byte [ebx + 0x54], al
+mov al, byte [esi + 0x7a]
+mov byte [ebx + 0x5c], al
+mov al, byte [esi + 0x7f]
+mov byte [ebx + 0x64], al
+mov al, byte [esi + 0x84]
+mov byte [ebx + 0x6c], al
+mov al, byte [esi + 0x89]
+mov byte [ebx + 0x74], al
+mov al, byte [esi + 0x8e]
+mov byte [ebx + 0x7c], al
+mov al, byte [esi + 0x93]
+mov byte [ebx + 0x84], al
+mov al, byte [esi + 0x98]
+mov byte [ebx + 0x8c], al
+mov al, byte [esi + 0x9d]
+mov byte [ebx + 0x94], al
+mov al, byte [esi + 0xa0]
+mov byte [ebx + 0x9c], al
+mov al, byte [esi + 0xa3]
+mov byte [ebx + 0xa0], al
+mov al, byte [esi + 0xa6]
+mov byte [ebx + 0xa4], al
+mov al, byte [esi + 0xa9]
+mov byte [ebx + 0xa8], al
+mov al, byte [esi + 0xac]
+mov byte [ebx + 0xac], al
+mov al, byte [esi + 0xaf]
+mov byte [ebx + 0xb0], al
+mov al, byte [esi + 0x5d]
+mov byte [ebx + 0x2d], al
+mov al, byte [esi + 0x62]
+mov byte [ebx + 0x35], al
+mov al, byte [esi + 0x67]
+mov byte [ebx + 0x3d], al
+mov al, byte [esi + 0x6c]
+mov byte [ebx + 0x45], al
+mov al, byte [esi + 0x71]
+mov byte [ebx + 0x4d], al
+mov al, byte [esi + 0x76]
+mov byte [ebx + 0x55], al
+mov al, byte [esi + 0x7b]
+mov byte [ebx + 0x5d], al
+mov al, byte [esi + 0x80]
+mov byte [ebx + 0x65], al
+mov al, byte [esi + 0x85]
+mov byte [ebx + 0x6d], al
+mov al, byte [esi + 0x8a]
+mov byte [ebx + 0x75], al
+mov al, byte [esi + 0x8f]
+mov byte [ebx + 0x7d], al
+mov al, byte [esi + 0x94]
+mov byte [ebx + 0x85], al
+mov al, byte [esi + 0x99]
+mov byte [ebx + 0x8d], al
+mov al, byte [esi + 0x9e]
+mov byte [ebx + 0x95], al
+mov al, byte [esi + 0xa1]
+mov byte [ebx + 0x9d], al
+mov al, byte [esi + 0xa4]
+mov byte [ebx + 0xa1], al
+mov al, byte [esi + 0xa7]
+mov byte [ebx + 0xa5], al
+mov al, byte [esi + 0xaa]
+mov byte [ebx + 0xa9], al
+mov al, byte [esi + 0xad]
+mov byte [ebx + 0xad], al
+mov al, byte [esi + 0xb0]
+mov byte [ebx + 0xb1], al
+mov ax, word [esi + 0x5a]
+mov word [ebx + 0x30], ax
+mov ax, word [esi + 0x5f]
+mov word [ebx + 0x38], ax
+mov ax, word [esi + 0x64]
+mov word [ebx + 0x40], ax
+mov ax, word [esi + 0x69]
+mov word [ebx + 0x48], ax
+mov ax, word [esi + 0x6e]
+mov word [ebx + 0x50], ax
+mov ax, word [esi + 0x73]
+mov word [ebx + 0x58], ax
+mov ax, word [esi + 0x78]
+mov word [ebx + 0x60], ax
+mov ax, word [esi + 0x7d]
+mov word [ebx + 0x68], ax
+mov ax, word [esi + 0x82]
+mov word [ebx + 0x70], ax
+mov ax, word [esi + 0x87]
+mov word [ebx + 0x78], ax
+mov ax, word [esi + 0x8c]
+mov word [ebx + 0x80], ax
+mov ax, word [esi + 0x91]
+mov word [ebx + 0x88], ax
+mov ax, word [esi + 0x96]
+mov word [ebx + 0x90], ax
+mov ax, word [esi + 0x9b]
+mov word [ebx + 0x98], ax
+mov al, byte [esi + 0xa2]
+mov byte [ebx + 0x9e], al
+mov al, byte [esi + 0xa5]
+mov byte [ebx + 0xa2], al
+mov al, byte [esi + 0xa8]
+mov byte [ebx + 0xa6], al
+mov al, byte [esi + 0xab]
+mov byte [ebx + 0xaa], al
+mov al, byte [esi + 0xae]
+mov byte [ebx + 0xae], al
+mov al, byte [esi + 0xb1]
+mov byte [ebx + 0xb2], al
+mov al, byte [esi + 0x5e]
+mov byte [ebx + 0x32], al
+mov al, byte [esi + 0x63]
+mov byte [ebx + 0x3a], al
+mov al, byte [esi + 0x68]
+mov byte [ebx + 0x42], al
+mov al, byte [esi + 0x6d]
+mov byte [ebx + 0x4a], al
+mov al, byte [esi + 0x72]
+mov byte [ebx + 0x52], al
+mov al, byte [esi + 0x77]
+mov byte [ebx + 0x5a], al
+mov al, byte [esi + 0x7c]
+mov byte [ebx + 0x62], al
+mov al, byte [esi + 0x81]
+mov byte [ebx + 0x6a], al
+mov al, byte [esi + 0x86]
+mov byte [ebx + 0x72], al
+mov al, byte [esi + 0x8b]
+mov byte [ebx + 0x7a], al
+mov al, byte [esi + 0x90]
+mov byte [ebx + 0x82], al
+mov al, byte [esi + 0x95]
+mov byte [ebx + 0x8a], al
+mov al, byte [esi + 0x9a]
+mov byte [ebx + 0x92], al
+mov al, byte [esi + 0x9f]
+mov byte [ebx + 0x9a], al
+cmp edi, 1
+jne near loc_0001eb4c  ; jne 0x1eb4c
+mov eax, edx
+and eax, 0xfffffff7
+cmp ax, 0x8c44
+je short loc_0001ea33  ; je 0x1ea33
+mov ecx, edx
+and ecx, 0xfffffffb
+cmp dx, 0x8c50
+jne short loc_0001ea3a  ; jne 0x1ea3a
+
+loc_0001ea33:
+lea edi, [ebx + 0x2f]
+xor edx, edx
+jmp short loc_0001ea8a  ; jmp 0x1ea8a
+
+loc_0001ea3a:
+cmp dx, 0x8c5c
+je short loc_0001ea33  ; je 0x1ea33
+mov edi, edx
+and edi, 0xfffffff3
+cmp di, 0x8c42
+je short loc_0001ea33  ; je 0x1ea33
+cmp dx, 0x8cc4
+je short loc_0001ea33  ; je 0x1ea33
+cmp cx, 0x8cc2
+jne short loc_0001eaa3  ; jne 0x1eaa3
+jmp short loc_0001ea33  ; jmp 0x1ea33
+
+loc_0001ea5d:
+cmp byte [edi + 3], 1
+sbb eax, eax
+not eax
+add eax, 4
+cmp byte [edi + 3], 0
+mov byte [edi - 1], al
+jne short loc_0001ea9e  ; jne 0x1ea9e
+mov ax, word [edi + 1]
+cmp ax, 0x7f
+jbe short loc_0001ea9e  ; jbe 0x1ea9e
+cmp ax, 0x130
+sbb eax, eax
+add eax, 4
+mov byte [edi], al
+
+loc_0001ea86:
+inc edx
+add edi, 8
+
+loc_0001ea8a:
+mov dword [ebp - 0x1c], edx
+call fcn_0001c261  ; call 0x1c261
+mov edx, dword [ebp - 0x1c]
+movzx eax, al
+cmp edx, eax
+jb short loc_0001ea5d  ; jb 0x1ea5d
+jmp short loc_0001eacd  ; jmp 0x1eacd
+
+loc_0001ea9e:
+mov byte [edi], 2
+jmp short loc_0001ea86  ; jmp 0x1ea86
+
+loc_0001eaa3:
+cmp cx, 0x8c4b
+je short loc_0001eae5  ; je 0x1eae5
+cmp ax, 0x8c41
+je short loc_0001eae5  ; je 0x1eae5
+lea eax, [edx + 0x63bf]
+cmp ax, 6
+jbe short loc_0001eae5  ; jbe 0x1eae5
+cmp dx, 0x8cc5
+je short loc_0001eae5  ; je 0x1eae5
+and edx, 0xfffffffd
+cmp dx, 0x8cc1
+je short loc_0001eae5  ; je 0x1eae5
+
+loc_0001eacd:
+cmp dword [esi + 0x10], 0
+je near loc_0001ec26  ; je 0x1ec26
+mov byte [ebx], 1
+xor edi, edi
+mov byte [ebx + 0x13], 1
+jmp near loc_0001ebf4  ; jmp 0x1ebf4
+
+loc_0001eae5:
+lea edi, [ebx + 0x2f]
+xor edx, edx
+
+loc_0001eaea:
+mov dword [ebp - 0x1c], edx
+call fcn_0001c261  ; call 0x1c261
+mov edx, dword [ebp - 0x1c]
+movzx eax, al
+cmp edx, eax
+jae short loc_0001eacd  ; jae 0x1eacd
+mov al, byte [edi + 3]
+cmp al, 5
+jne short loc_0001eb09  ; jne 0x1eb09
+mov byte [edi - 1], 5
+jmp short loc_0001eb24  ; jmp 0x1eb24
+
+loc_0001eb09:
+cmp al, 2
+jne short loc_0001eb13  ; jne 0x1eb13
+mov byte [edi - 1], 4
+jmp short loc_0001eb2d  ; jmp 0x1eb2d
+
+loc_0001eb13:
+cmp word [edi + 1], 0x70
+sbb ecx, ecx
+add ecx, 6
+mov byte [edi - 1], cl
+cmp al, 5
+jne short loc_0001eb29  ; jne 0x1eb29
+
+loc_0001eb24:
+mov byte [edi], 2
+jmp short loc_0001eb46  ; jmp 0x1eb46
+
+loc_0001eb29:
+cmp al, 2
+jne short loc_0001eb39  ; jne 0x1eb39
+
+loc_0001eb2d:
+cmp word [edi + 1], 0x50
+sbb eax, eax
+add eax, 2
+jmp short loc_0001eb44  ; jmp 0x1eb44
+
+loc_0001eb39:
+cmp word [edi + 1], 0x100
+sbb eax, eax
+add eax, 3
+
+loc_0001eb44:
+mov byte [edi], al
+
+loc_0001eb46:
+inc edx
+add edi, 8
+jmp short loc_0001eaea  ; jmp 0x1eaea
+
+loc_0001eb4c:
+cmp edi, 2
+jne near loc_0001eacd  ; jne 0x1eacd
+lea eax, [edx + 0x63bf]
+xor ecx, ecx
+mov word [ebp - 0x1c], ax
+lea eax, [edx + 0x633f]
+lea edi, [ebx + 0x2f]
+mov word [ebp - 0x20], ax
+
+loc_0001eb6e:
+mov dword [ebp - 0x24], ecx
+call fcn_0001c261  ; call 0x1c261
+mov ecx, dword [ebp - 0x24]
+movzx eax, al
+cmp ecx, eax
+jae near loc_0001eacd  ; jae 0x1eacd
+cmp word [ebp - 0x1c], 6
+ja short loc_0001ebad  ; ja 0x1ebad
+mov al, byte [edi + 3]
+cmp al, 3
+je short loc_0001eb96  ; je 0x1eb96
+test al, al
+jne short loc_0001eba2  ; jne 0x1eba2
+
+loc_0001eb96:
+cmp word [edi + 1], 0x70
+sbb eax, eax
+add eax, 6
+jmp short loc_0001ebaa  ; jmp 0x1ebaa
+
+loc_0001eba2:
+cmp al, 2
+setne al
+add eax, 4
+
+loc_0001ebaa:
+mov byte [edi - 1], al
+
+loc_0001ebad:
+cmp word [ebp - 0x20], 0xa
+ja short loc_0001ebb8  ; ja 0x1ebb8
+mov byte [edi - 1], 6
+
+loc_0001ebb8:
+mov al, byte [edi + 3]
+mov dl, al
+and edx, 0xfffffffb
+cmp dl, 3
+je short loc_0001ebc9  ; je 0x1ebc9
+test al, al
+jne short loc_0001ebd6  ; jne 0x1ebd6
+
+loc_0001ebc9:
+cmp word [edi + 1], 0x100
+sbb eax, eax
+add eax, 3
+jmp short loc_0001ebe4  ; jmp 0x1ebe4
+
+loc_0001ebd6:
+cmp al, 2
+jne short loc_0001ebe8  ; jne 0x1ebe8
+cmp word [edi + 1], 0x50
+sbb eax, eax
+add eax, 2
+
+loc_0001ebe4:
+mov byte [edi], al
+jmp short loc_0001ebeb  ; jmp 0x1ebeb
+
+loc_0001ebe8:
+mov byte [edi], 2
+
+loc_0001ebeb:
+inc ecx
+add edi, 8
+jmp near loc_0001eb6e  ; jmp 0x1eb6e
+
+loc_0001ebf4:
+call fcn_0001c261  ; call 0x1c261
+movzx eax, al
+cmp edi, eax
+jae short loc_0001ec08  ; jae 0x1ec08
+mov byte [ebx + edi + 0x14], 1
+inc edi
+jmp short loc_0001ebf4  ; jmp 0x1ebf4
+
+loc_0001ec08:
+mov byte [ebx + 0x15], 0
+xor edi, edi
+
+loc_0001ec0e:
+call fcn_0001c2f8  ; call 0x1c2f8
+movzx eax, al
+cmp edi, eax
+jae short loc_0001ec22  ; jae 0x1ec22
+mov byte [ebx + edi + 0x22], 1
+inc edi
+jmp short loc_0001ec0e  ; jmp 0x1ec0e
+
+loc_0001ec22:
+mov byte [ebx + 0x23], 0
+
+loc_0001ec26:
+xor ebx, ebx
+
+loc_0001ec28:
+call fcn_0001c2f8  ; call 0x1c2f8
+movzx eax, al
+cmp ebx, eax
+jae near loc_0001ecf3  ; jae 0x1ecf3
+mov dl, byte [esi + ebx + 0xb2]
+mov eax, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0xc]
+test dl, dl
+mov al, byte [eax + ebx*8 + 4]
+je short loc_0001ec55  ; je 0x1ec55
+mov byte [ecx + ebx*8], dl
+or eax, 1
+jmp short loc_0001ec5c  ; jmp 0x1ec5c
+
+loc_0001ec55:
+mov byte [ecx + ebx*8], 0
+and eax, 0xfffffffe
+
+loc_0001ec5c:
+mov byte [ecx + ebx*8 + 4], al
+mov dl, byte [esi + ebx + 0xb8]
+mov eax, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0xc]
+test dl, dl
+mov al, byte [eax + ebx*8 + 4]
+je short loc_0001ec7e  ; je 0x1ec7e
+mov byte [ecx + ebx*8 + 1], dl
+or eax, 2
+jmp short loc_0001ec86  ; jmp 0x1ec86
+
+loc_0001ec7e:
+mov byte [ecx + ebx*8 + 1], 0
+and eax, 0xfffffffd
+
+loc_0001ec86:
+mov byte [ecx + ebx*8 + 4], al
+mov dl, byte [esi + ebx + 0xbe]
+mov eax, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0xc]
+test dl, dl
+mov al, byte [eax + ebx*8 + 4]
+je short loc_0001ecac  ; je 0x1ecac
+or eax, 4
+mov byte [ecx + ebx*8 + 2], dl
+mov byte [ecx + ebx*8 + 4], al
+jmp short loc_0001ecb8  ; jmp 0x1ecb8
+
+loc_0001ecac:
+and eax, 0xfffffffb
+mov byte [ecx + ebx*8 + 2], 0
+mov byte [ecx + ebx*8 + 4], al
+
+loc_0001ecb8:
+mov dl, byte [esi + ebx + 0xc4]
+mov eax, dword [ebp + 0xc]
+test dl, dl
+mov al, byte [eax + ebx*8 + 4]
+je short loc_0001ecde  ; je 0x1ecde
+mov ecx, dword [ebp + 0xc]
+lea edx, [edx + edx + 1]
+or eax, 8
+mov byte [ecx + ebx*8 + 3], dl
+mov byte [ecx + ebx*8 + 4], al
+jmp short loc_0001eced  ; jmp 0x1eced
+
+loc_0001ecde:
+mov ecx, dword [ebp + 0xc]
+and eax, 0xfffffff7
+mov byte [ecx + ebx*8 + 3], 0
+mov byte [ecx + ebx*8 + 4], al
+
+loc_0001eced:
+inc ebx
+jmp near loc_0001ec28  ; jmp 0x1ec28
+
+loc_0001ecf3:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001ecfb:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x28
+push 0x15
+call fcn_00019db6  ; call 0x19db6
+add esp, 0x10
+mov edi, eax
+test eax, eax
+jne short loc_0001ed2b  ; jne 0x1ed2b
+call fcn_00015480  ; call 0x15480
+test al, al
+je near loc_0001edab  ; je 0x1edab
+push eax
+push ref_00026a09  ; push 0x26a09
+push 0x34
+jmp short loc_0001ed9e  ; jmp 0x1ed9e
+
+loc_0001ed2b:
+sub esp, 0xc
+push 0xc
+call fcn_00019db6  ; call 0x19db6
+add esp, 0x10
+mov dword [ebp - 0x1c], eax
+test eax, eax
+jne short loc_0001ed52  ; jne 0x1ed52
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001edab  ; je 0x1edab
+push eax
+push ref_00026a4b  ; push 0x26a4b
+push 0x3a
+jmp short loc_0001ed9e  ; jmp 0x1ed9e
+
+loc_0001ed52:
+sub esp, 0xc
+push 5
+call fcn_00019db6  ; call 0x19db6
+add esp, 0x10
+test eax, eax
+jne short loc_0001ed76  ; jne 0x1ed76
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001edab  ; je 0x1edab
+push edi
+push ref_00026a74  ; push 0x26a74
+push 0x40
+jmp short loc_0001ed9e  ; jmp 0x1ed9e
+
+loc_0001ed76:
+sub esp, 0xc
+push 0xc
+mov dword [ebp - 0x20], eax
+call fcn_00019db6  ; call 0x19db6
+add esp, 0x10
+mov edx, dword [ebp - 0x20]
+test eax, eax
+jne short loc_0001edb5  ; jne 0x1edb5
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001edab  ; je 0x1edab
+push esi
+push ref_00026a8e  ; push 0x26a8e
+push 0x46
+
+loc_0001ed9e:
+push ref_00026a2e  ; push 0x26a2e
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001edab:
+mov edx, 0x80000009
+jmp near loc_0001ef81  ; jmp 0x1ef81
+
+loc_0001edb5:
+sub esp, 0xc
+push 0x1d
+mov dword [ebp - 0x20], edx
+mov dword [ebp - 0x24], eax
+call fcn_00019db6  ; call 0x19db6
+add esp, 0x10
+mov edx, dword [ebp - 0x20]
+mov ecx, dword [ebp - 0x24]
+test eax, eax
+mov ebx, eax
+jne short loc_0001ede7  ; jne 0x1ede7
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001edab  ; je 0x1edab
+push ebx
+push ref_00026aad  ; push 0x26aad
+push 0x4c
+jmp short loc_0001ed9e  ; jmp 0x1ed9e
+
+loc_0001ede7:
+sub esp, 0xc
+push 0x13
+mov dword [ebp - 0x24], ecx
+mov dword [ebp - 0x20], edx
+call fcn_00019db6  ; call 0x19db6
+add esp, 0x10
+mov edx, dword [ebp - 0x20]
+mov ecx, dword [ebp - 0x24]
+test eax, eax
+mov esi, eax
+jne short loc_0001ee19  ; jne 0x1ee19
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001edab  ; je 0x1edab
+push ecx
+push ref_000269b6  ; push 0x269b6
+push 0x52
+jmp short loc_0001ed9e  ; jmp 0x1ed9e
+
+loc_0001ee19:
+mov dword [edi + 9], ecx
+mov byte [edi], 0xa
+mov dword [edi + 1], edx
+mov dword [ecx], 0
+mov eax, dword [edi + 9]
+mov dword [eax + 4], 0
+mov dword [edi + 5], ebx
+mov dword [edi + 0xd], esi
+mov dword [edi + 0x11], edi
+mov byte [edx + 3], 0x3f
+mov byte [edx + 4], 0x3f
+mov byte [edx + 2], 0
+mov byte [edx], 0x62
+mov byte [ebx + 6], 0
+mov byte [ebx + 7], 0
+mov byte [ebx + 8], 0
+mov byte [ebx + 9], 0
+mov byte [ebx + 1], 0
+mov word [ebx + 2], 0
+mov byte [ebx + 4], 0
+mov byte [ebx + 5], 0
+mov byte [ebx], 0
+mov word [ebx + 0x11], 0x200
+mov byte [ebx + 0x13], 0
+mov word [ebx + 0x14], 0
+mov byte [ebx + 0xa], 0
+mov byte [ebx + 0xb], 1
+mov byte [ebx + 0xc], 0
+mov byte [ebx + 0xd], 1
+call fcn_0001c651  ; call 0x1c651
+cmp eax, 0x40650
+jne short loc_0001eebd  ; jne 0x1eebd
+
+loc_0001ee9b:
+mov byte [ebx + 0xe], 1
+call fcn_0001c651  ; call 0x1c651
+mov byte [ebx + 0x10], 0
+mov byte [ebx + 0x16], 1
+cmp eax, 0x306d0
+setne al
+lea eax, [eax + eax*4 + 0x6a]
+mov byte [ebx + 0xf], al
+jmp short loc_0001eec9  ; jmp 0x1eec9
+
+loc_0001eebd:
+call fcn_0001c651  ; call 0x1c651
+cmp eax, 0x306d0
+je short loc_0001ee9b  ; je 0x1ee9b
+
+loc_0001eec9:
+mov eax, dword [ebp - 0x1c]
+sub esp, 0xc
+mov byte [ebx + 0x17], 0x14
+mov byte [ebx + 0x18], 5
+mov byte [ebx + 0x19], 1
+mov byte [ebx + 0x1a], 0
+mov byte [ebx + 0x1b], 0
+mov byte [ebx + 0x1c], 0
+mov word [esi], 0
+mov word [esi + 2], 0
+mov word [esi + 4], 0
+mov word [esi + 6], 0
+mov word [esi + 8], 0
+mov word [esi + 0xa], 0
+mov word [esi + 0xc], 0
+mov word [esi + 0xe], 0
+mov word [esi + 0x10], 0
+mov byte [esi + 0x12], 0
+mov dword [eax], 0x80000010
+mov dword [eax + 4], ref_0002928c  ; mov dword [eax + 4], 0x2928c
+mov dword [eax + 8], edi
+push eax
+call fcn_0001972b  ; call 0x1972b
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+mov edx, ebx
+test al, al
+je short loc_0001ef81  ; je 0x1ef81
+test ebx, ebx
+jns short loc_0001ef81  ; jns 0x1ef81
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001ef67  ; je 0x1ef67
+push edx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001ef67:
+push eax
+push ref_000206f4  ; push 0x206f4
+push 0xb3
+push ref_00026a2e  ; push 0x26a2e
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+mov edx, ebx
+
+loc_0001ef81:
+lea esp, [ebp - 0xc]
+mov eax, edx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001ef8b:
+push ebp
+mov ebp, esp
+push esi
+push ebx
+sub esp, 0xc
+push 2
+call fcn_00019db6  ; call 0x19db6
+mov esi, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001efb6  ; je 0x1efb6
+test esi, esi
+jne short loc_0001efba  ; jne 0x1efba
+push esi
+push ref_00026acd  ; push 0x26acd
+push 0x2d
+jmp short loc_0001efde  ; jmp 0x1efde
+
+loc_0001efb6:
+test esi, esi
+je short loc_0001efeb  ; je 0x1efeb
+
+loc_0001efba:
+sub esp, 0xc
+push 0xc
+call fcn_00019db6  ; call 0x19db6
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001eff2  ; je 0x1eff2
+test ebx, ebx
+jne short loc_0001eff6  ; jne 0x1eff6
+push ebx
+push ref_00026b0d  ; push 0x26b0d
+push 0x33
+
+loc_0001efde:
+push ref_00026af1  ; push 0x26af1
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001efeb:
+mov ebx, 0x80000009
+jmp short loc_0001f070  ; jmp 0x1f070
+
+loc_0001eff2:
+test ebx, ebx
+je short loc_0001efeb  ; je 0x1efeb
+
+loc_0001eff6:
+sub esp, 0xc
+mov dword [ebx], 0x80000010
+mov dword [ebx + 4], ref_0002920c  ; mov dword [ebx + 4], 0x2920c
+mov byte [esi], 1
+mov dword [ebx + 8], esi
+push ebx
+call fcn_0001972b  ; call 0x1972b
+mov ebx, eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001f056  ; je 0x1f056
+test ebx, ebx
+jns short loc_0001f056  ; jns 0x1f056
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001f041  ; je 0x1f041
+push ecx
+push ebx
+push ref_000206d3  ; push 0x206d3
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001f041:
+push edx
+push ref_000206f4  ; push 0x206f4
+push 0x4e
+push ref_00026af1  ; push 0x26af1
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f056:
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_0001f070  ; je 0x1f070
+push eax
+push eax
+push ref_00026b35  ; push 0x26b35
+push 0x40
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_0001f070:
+lea esp, [ebp - 8]
+mov eax, ebx
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001f079:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 8]
+mov edi, dword [ebp + 0x10]
+test esi, esi
+je short loc_0001f0d2  ; je 0x1f0d2
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f0b8  ; je 0x1f0b8
+mov eax, ebx
+lea edx, [esi - 1]
+not eax
+cmp edx, eax
+jbe short loc_0001f0b8  ; jbe 0x1f0b8
+push eax
+push ref_00026b5b  ; push 0x26b5b
+push 0x36
+push ref_00026b88  ; push 0x26b88
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f0b8:
+mov eax, edi
+movzx edi, al
+mov dword [ebp + 0x10], edi
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], ebx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_0001f1b5  ; jmp 0x1f1b5
+
+loc_0001f0d2:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001f0dc:
+push ebp
+mov ebp, esp
+pop ebp
+jmp near fcn_0001f0e5  ; jmp 0x1f0e5
+
+fcn_0001f0e5:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 8]
+mov edi, dword [ebp + 0x10]
+test esi, esi
+je near loc_0001f1ab  ; je 0x1f1ab
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f121  ; je 0x1f121
+test ebx, ebx
+jne short loc_0001f121  ; jne 0x1f121
+push eax
+push ref_0002619a  ; push 0x2619a
+push 0x3a
+push ref_00026bcd  ; push 0x26bcd
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f121:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f14a  ; je 0x1f14a
+mov eax, ebx
+lea edx, [esi - 1]
+not eax
+cmp edx, eax
+jbe short loc_0001f14a  ; jbe 0x1f14a
+push ecx
+push ref_00026b5b  ; push 0x26b5b
+push 0x3b
+push ref_00026bcd  ; push 0x26bcd
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f14a:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f16d  ; je 0x1f16d
+test bl, 3
+je short loc_0001f16d  ; je 0x1f16d
+push edx
+push ref_00026c14  ; push 0x26c14
+push 0x3c
+push ref_00026bcd  ; push 0x26bcd
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f16d:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f193  ; je 0x1f193
+test esi, 3
+je short loc_0001f193  ; je 0x1f193
+push eax
+push ref_00026c42  ; push 0x26c42
+push 0x3d
+push ref_00026bcd  ; push 0x26bcd
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f193:
+shr esi, 2
+mov dword [ebp + 0x10], edi
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], ebx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_0001f1e0  ; jmp 0x1f1e0
+
+loc_0001f1ab:
+lea esp, [ebp - 0xc]
+mov eax, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+loc_0001f1b5:
+push edi
+mov ecx, dword [esp + 0xc]
+mov al, byte [esp + 0x10]
+mov ah, al
+shrd edx, eax, 0x10
+shld eax, edx, 0x10
+mov edx, ecx
+mov edi, dword [esp + 8]
+shr ecx, 2
+rep stosd  ; rep stosd dword es:[edi], eax
+mov ecx, edx
+and ecx, 3
+rep stosb  ; rep stosb byte es:[edi], al
+mov eax, dword [esp + 8]
+pop edi
+ret
+
+loc_0001f1e0:
+push edi
+mov eax, dword [esp + 0x10]
+mov edi, dword [esp + 8]
+mov ecx, dword [esp + 0xc]
+rep stosd  ; rep stosd dword es:[edi], eax
+mov eax, dword [esp + 8]
+pop edi
+ret
+
+fcn_0001f1f5:
+push ebp
+mov eax, 0xfffffffe
+mov ebp, esp
+mov ecx, dword [ebp + 0x10]
+shl eax, cl
+mov ecx, dword [ebp + 0xc]
+not eax
+and eax, dword [ebp + 8]
+pop ebp
+shr eax, cl
+ret
+
+fcn_0001f20e:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f246  ; je 0x1f246
+mov ecx, dword [ebp + 0x10]
+mov eax, dword [ebp + 0x14]
+sub ecx, dword [ebp + 0xc]
+shr eax, cl
+mov edx, eax
+and edx, 1
+cmp eax, edx
+je short loc_0001f246  ; je 0x1f246
+push eax
+push ref_00026c67  ; push 0x26c67
+push 0x4d
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f246:
+mov cl, byte [ebp + 0x10]
+mov eax, 0xfffffffe
+mov edx, dword [ebp + 0x14]
+shl eax, cl
+mov cl, byte [ebp + 0xc]
+not eax
+shl edx, cl
+and eax, edx
+or eax, dword [ebp + 8]
+leave
+ret
+
+fcn_0001f261:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f299  ; je 0x1f299
+mov ecx, dword [ebp + 0x10]
+mov eax, dword [ebp + 0x14]
+sub ecx, dword [ebp + 0xc]
+shr eax, cl
+mov edx, eax
+and edx, 1
+cmp eax, edx
+je short loc_0001f299  ; je 0x1f299
+push eax
+push ref_00026ce4  ; push 0x26ce4
+push 0x77
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f299:
+mov cl, byte [ebp + 0x10]
+mov edx, 0xfffffffe
+mov eax, dword [ebp + 0x14]
+shl edx, cl
+mov cl, byte [ebp + 0xc]
+not eax
+shl eax, cl
+not eax
+or eax, edx
+and eax, dword [ebp + 8]
+leave
+ret
+
+fcn_0001f2b6:
+push ebp
+mov ebp, esp
+push ebx
+push ecx
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f2e5  ; je 0x1f2e5
+cmp dword [ebp + 0x10], 7
+jbe short loc_0001f2e5  ; jbe 0x1f2e5
+push edx
+push ref_00026d2f  ; push 0x26d2f
+push 0x9b
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f2e5:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f30e  ; je 0x1f30e
+mov eax, dword [ebp + 0x10]
+cmp dword [ebp + 0xc], eax
+jbe short loc_0001f30e  ; jbe 0x1f30e
+push eax
+push ref_00025b30  ; push 0x25b30
+push 0x9c
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f30e:
+mov cl, byte [ebp + 0x10]
+mov eax, 0xfffffffe
+movzx ebx, bl
+shl eax, cl
+mov cl, byte [ebp + 0xc]
+not eax
+and eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+shr eax, cl
+ret
+
+fcn_0001f329:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f361  ; je 0x1f361
+cmp ebx, 7
+jbe short loc_0001f361  ; jbe 0x1f361
+push edx
+push ref_00026d2f  ; push 0x26d2f
+push 0xe6
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f361:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f387  ; je 0x1f387
+cmp dword [ebp + 0xc], ebx
+jbe short loc_0001f387  ; jbe 0x1f387
+push eax
+push ref_00025b30  ; push 0x25b30
+push 0xe7
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f387:
+mov eax, edi
+movzx edi, al
+mov eax, esi
+push edi
+movzx esi, al
+push ebx
+push dword [ebp + 0xc]
+push esi
+call fcn_0001f20e  ; call 0x1f20e
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001f3a4:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f3dc  ; je 0x1f3dc
+cmp ebx, 7
+jbe short loc_0001f3dc  ; jbe 0x1f3dc
+push edx
+push ref_00026d2f  ; push 0x26d2f
+push 0x10c
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f3dc:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f402  ; je 0x1f402
+cmp dword [ebp + 0xc], ebx
+jbe short loc_0001f402  ; jbe 0x1f402
+push eax
+push ref_00025b30  ; push 0x25b30
+push 0x10d
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f402:
+mov eax, edi
+movzx edi, al
+mov eax, esi
+push edi
+movzx esi, al
+push ebx
+push dword [ebp + 0xc]
+push esi
+call fcn_0001f261  ; call 0x1f261
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001f41f:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x18]
+mov dword [ebp - 0x20], eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f463  ; je 0x1f463
+cmp ebx, 7
+jbe short loc_0001f463  ; jbe 0x1f463
+push edx
+push ref_00026d2f  ; push 0x26d2f
+push 0x136
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f463:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f488  ; je 0x1f488
+cmp esi, ebx
+jbe short loc_0001f488  ; jbe 0x1f488
+push eax
+push ref_00025b30  ; push 0x25b30
+push 0x137
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f488:
+mov eax, edi
+movzx edi, al
+movzx eax, byte [ebp - 0x1c]
+push edi
+push ebx
+push esi
+push eax
+call fcn_0001f3a4  ; call 0x1f3a4
+movzx edx, byte [ebp - 0x20]
+add esp, 0x10
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 0x14], edx
+movzx eax, al
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001f329  ; jmp 0x1f329
+
+fcn_0001f4bc:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f4f4  ; je 0x1f4f4
+cmp ebx, 7
+jbe short loc_0001f4f4  ; jbe 0x1f4f4
+push edx
+push ref_00026d2f  ; push 0x26d2f
+push 0xc0
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f4f4:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f51a  ; je 0x1f51a
+cmp dword [ebp + 0xc], ebx
+jbe short loc_0001f51a  ; jbe 0x1f51a
+push eax
+push ref_00025b30  ; push 0x25b30
+push 0xc1
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f51a:
+mov eax, edi
+sub esp, 0xc
+movzx edi, al
+mov eax, esi
+push edi
+movzx esi, al
+push 0
+push ebx
+push dword [ebp + 0xc]
+push esi
+call fcn_0001f41f  ; call 0x1f41f
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001f53c:
+push ebp
+mov ebp, esp
+push ebx
+push ecx
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f56b  ; je 0x1f56b
+cmp dword [ebp + 0x10], 0xf
+jbe short loc_0001f56b  ; jbe 0x1f56b
+push edx
+push ref_00026d3a  ; push 0x26d3a
+push 0x15b
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f56b:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f594  ; je 0x1f594
+mov eax, dword [ebp + 0x10]
+cmp dword [ebp + 0xc], eax
+jbe short loc_0001f594  ; jbe 0x1f594
+push eax
+push ref_00025b30  ; push 0x25b30
+push 0x15c
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f594:
+mov cl, byte [ebp + 0x10]
+mov eax, 0xfffffffe
+movzx ebx, bx
+shl eax, cl
+mov cl, byte [ebp + 0xc]
+not eax
+and eax, ebx
+mov ebx, dword [ebp - 4]
+leave
+shr eax, cl
+ret
+
+fcn_0001f5af:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f5e7  ; je 0x1f5e7
+cmp ebx, 0xf
+jbe short loc_0001f5e7  ; jbe 0x1f5e7
+push edx
+push ref_00026d3a  ; push 0x26d3a
+push 0x1a6
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f5e7:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f60d  ; je 0x1f60d
+cmp dword [ebp + 0xc], ebx
+jbe short loc_0001f60d  ; jbe 0x1f60d
+push eax
+push ref_00025b30  ; push 0x25b30
+push 0x1a7
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f60d:
+movzx edi, di
+movzx esi, si
+push edi
+push ebx
+push dword [ebp + 0xc]
+push esi
+call fcn_0001f20e  ; call 0x1f20e
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001f626:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f65e  ; je 0x1f65e
+cmp ebx, 0xf
+jbe short loc_0001f65e  ; jbe 0x1f65e
+push edx
+push ref_00026d3a  ; push 0x26d3a
+push 0x1cc
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f65e:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f684  ; je 0x1f684
+cmp dword [ebp + 0xc], ebx
+jbe short loc_0001f684  ; jbe 0x1f684
+push eax
+push ref_00025b30  ; push 0x25b30
+push 0x1cd
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f684:
+movzx edi, di
+movzx esi, si
+push edi
+push ebx
+push dword [ebp + 0xc]
+push esi
+call fcn_0001f261  ; call 0x1f261
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001f69d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x18]
+mov dword [ebp - 0x20], eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f6e1  ; je 0x1f6e1
+cmp ebx, 0xf
+jbe short loc_0001f6e1  ; jbe 0x1f6e1
+push edx
+push ref_00026d3a  ; push 0x26d3a
+push 0x1f6
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f6e1:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f706  ; je 0x1f706
+cmp esi, ebx
+jbe short loc_0001f706  ; jbe 0x1f706
+push eax
+push ref_00025b30  ; push 0x25b30
+push 0x1f7
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f706:
+movzx eax, word [ebp - 0x1c]
+movzx edi, di
+push edi
+push ebx
+push esi
+push eax
+call fcn_0001f626  ; call 0x1f626
+movzx edx, word [ebp - 0x20]
+add esp, 0x10
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 0x14], edx
+movzx eax, ax
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001f5af  ; jmp 0x1f5af
+
+fcn_0001f738:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f770  ; je 0x1f770
+cmp ebx, 0xf
+jbe short loc_0001f770  ; jbe 0x1f770
+push edx
+push ref_00026d3a  ; push 0x26d3a
+push 0x180
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f770:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f796  ; je 0x1f796
+cmp dword [ebp + 0xc], ebx
+jbe short loc_0001f796  ; jbe 0x1f796
+push eax
+push ref_00025b30  ; push 0x25b30
+push 0x181
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f796:
+sub esp, 0xc
+movzx edi, di
+push edi
+movzx esi, si
+push 0
+push ebx
+push dword [ebp + 0xc]
+push esi
+call fcn_0001f69d  ; call 0x1f69d
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001f7b4:
+push ebp
+mov ebp, esp
+sub esp, 8
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f7e1  ; je 0x1f7e1
+cmp dword [ebp + 0x10], 0x1f
+jbe short loc_0001f7e1  ; jbe 0x1f7e1
+push edx
+push ref_00026d46  ; push 0x26d46
+push 0x21b
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f7e1:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f80a  ; je 0x1f80a
+mov eax, dword [ebp + 0x10]
+cmp dword [ebp + 0xc], eax
+jbe short loc_0001f80a  ; jbe 0x1f80a
+push eax
+push ref_00025b30  ; push 0x25b30
+push 0x21c
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f80a:
+mov cl, byte [ebp + 0x10]
+mov eax, 0xfffffffe
+shl eax, cl
+mov cl, byte [ebp + 0xc]
+not eax
+and eax, dword [ebp + 8]
+leave
+shr eax, cl
+ret
+
+fcn_0001f820:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+mov dword [ebp - 0x1c], eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f85e  ; je 0x1f85e
+cmp ebx, 0x1f
+jbe short loc_0001f85e  ; jbe 0x1f85e
+push edx
+push ref_00026d46  ; push 0x26d46
+push 0x266
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f85e:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f883  ; je 0x1f883
+cmp esi, ebx
+jbe short loc_0001f883  ; jbe 0x1f883
+push eax
+push ref_00025b30  ; push 0x25b30
+push 0x267
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f883:
+mov eax, dword [ebp - 0x1c]
+mov dword [ebp + 0x14], edi
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001f20e  ; jmp 0x1f20e
+
+fcn_0001f89e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+mov dword [ebp - 0x1c], eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f8dc  ; je 0x1f8dc
+cmp ebx, 0x1f
+jbe short loc_0001f8dc  ; jbe 0x1f8dc
+push edx
+push ref_00026d46  ; push 0x26d46
+push 0x28c
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f8dc:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f901  ; je 0x1f901
+cmp esi, ebx
+jbe short loc_0001f901  ; jbe 0x1f901
+push eax
+push ref_00025b30  ; push 0x25b30
+push 0x28d
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f901:
+mov eax, dword [ebp - 0x1c]
+mov dword [ebp + 0x14], edi
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001f261  ; jmp 0x1f261
+
+fcn_0001f91c:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+mov edi, dword [ebp + 0x14]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x18]
+mov dword [ebp - 0x20], eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f960  ; je 0x1f960
+cmp ebx, 0x1f
+jbe short loc_0001f960  ; jbe 0x1f960
+push edx
+push ref_00026d46  ; push 0x26d46
+push 0x2b6
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f960:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f985  ; je 0x1f985
+cmp esi, ebx
+jbe short loc_0001f985  ; jbe 0x1f985
+push eax
+push ref_00025b30  ; push 0x25b30
+push 0x2b7
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f985:
+push edi
+push ebx
+push esi
+push dword [ebp - 0x1c]
+call fcn_0001f89e  ; call 0x1f89e
+mov edx, dword [ebp - 0x20]
+add esp, 0x10
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 0xc], esi
+mov dword [ebp + 0x14], edx
+mov dword [ebp + 8], eax
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001f820  ; jmp 0x1f820
+
+fcn_0001f9ae:
+push ebp
+mov ebp, esp
+push esi
+mov esi, dword [ebp + 0xc]
+push ebx
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001f9df  ; je 0x1f9df
+cmp ebx, 0x1f
+jbe short loc_0001f9df  ; jbe 0x1f9df
+push edx
+push ref_00026d46  ; push 0x26d46
+push 0x240
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001f9df:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001fa04  ; je 0x1fa04
+cmp esi, ebx
+jbe short loc_0001fa04  ; jbe 0x1fa04
+push eax
+push ref_00025b30  ; push 0x25b30
+push 0x241
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001fa04:
+sub esp, 0xc
+push dword [ebp + 0x14]
+push 0
+push ebx
+push esi
+push dword [ebp + 8]
+call fcn_0001f91c  ; call 0x1f91c
+lea esp, [ebp - 8]
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_0001fa1d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 0xc]
+mov edi, dword [ebp + 8]
+mov esi, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0x14]
+mov dword [ebp - 0x1c], eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001fa5b  ; je 0x1fa5b
+cmp ebx, 0x3f
+jbe short loc_0001fa5b  ; jbe 0x1fa5b
+push ecx
+push ref_00026d52  ; push 0x26d52
+push 0x2db
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001fa5b:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001fa80  ; je 0x1fa80
+cmp esi, ebx
+jbe short loc_0001fa80  ; jbe 0x1fa80
+push edx
+push ref_00025b30  ; push 0x25b30
+push 0x2dc
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001fa80:
+push eax
+push ebx
+push 0xffffffffffffffff
+push 0xfffffffffffffffe
+call fcn_0001fdda  ; call 0x1fdda
+add esp, 0x10
+mov dword [ebp + 0x10], esi
+not edx
+not eax
+and edx, dword [ebp - 0x1c]
+and eax, edi
+mov dword [ebp + 8], eax
+mov dword [ebp + 0xc], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001724f  ; jmp 0x1724f
+
+fcn_0001faac:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0x18]
+mov edi, dword [ebp + 0x1c]
+mov dword [ebp - 0x20], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x24], eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001faee  ; je 0x1faee
+cmp dword [ebp + 0x14], 0x3f
+jbe short loc_0001faee  ; jbe 0x1faee
+push eax
+push ref_00026d52  ; push 0x26d52
+push 0x329
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001faee:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001fb17  ; je 0x1fb17
+mov eax, dword [ebp + 0x14]
+cmp dword [ebp + 0x10], eax
+jbe short loc_0001fb17  ; jbe 0x1fb17
+push ebx
+push ref_00025b30  ; push 0x25b30
+push 0x32a
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001fb17:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001fb6a  ; je 0x1fb6a
+mov ebx, dword [ebp + 0x14]
+sub ebx, dword [ebp + 0x10]
+push ecx
+push ebx
+push edi
+push esi
+call fcn_0001724f  ; call 0x1724f
+add esp, 0xc
+push ebx
+push edi
+push esi
+mov dword [ebp - 0x1c], eax
+mov dword [ebp - 0x28], edx
+call fcn_0001724f  ; call 0x1724f
+mov ecx, dword [ebp - 0x28]
+add esp, 0x10
+and eax, 1
+test ecx, ecx
+jne short loc_0001fb52  ; jne 0x1fb52
+cmp dword [ebp - 0x1c], eax
+je short loc_0001fb6a  ; je 0x1fb6a
+
+loc_0001fb52:
+push edx
+push ref_00026d5e  ; push 0x26d5e
+push 0x331
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001fb6a:
+push eax
+push dword [ebp + 0x10]
+push edi
+push esi
+call fcn_0001fdda  ; call 0x1fdda
+add esp, 0xc
+push dword [ebp + 0x14]
+push 0xffffffffffffffff
+push 0xfffffffffffffffe
+mov esi, eax
+mov ebx, edx
+call fcn_0001fdda  ; call 0x1fdda
+not eax
+not edx
+and eax, esi
+and edx, ebx
+or eax, dword [ebp - 0x20]
+or edx, dword [ebp - 0x24]
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001fb9e:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov esi, dword [ebp + 0x18]
+mov edi, dword [ebp + 0x1c]
+mov dword [ebp - 0x20], eax
+mov eax, dword [ebp + 0xc]
+mov dword [ebp - 0x24], eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001fbe0  ; je 0x1fbe0
+cmp dword [ebp + 0x14], 0x3f
+jbe short loc_0001fbe0  ; jbe 0x1fbe0
+push eax
+push ref_00026d52  ; push 0x26d52
+push 0x35d
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001fbe0:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001fc09  ; je 0x1fc09
+mov eax, dword [ebp + 0x14]
+cmp dword [ebp + 0x10], eax
+jbe short loc_0001fc09  ; jbe 0x1fc09
+push ebx
+push ref_00025b30  ; push 0x25b30
+push 0x35e
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001fc09:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001fc5c  ; je 0x1fc5c
+mov ebx, dword [ebp + 0x14]
+sub ebx, dword [ebp + 0x10]
+push ecx
+push ebx
+push edi
+push esi
+call fcn_0001724f  ; call 0x1724f
+add esp, 0xc
+push ebx
+push edi
+push esi
+mov dword [ebp - 0x1c], eax
+mov dword [ebp - 0x28], edx
+call fcn_0001724f  ; call 0x1724f
+mov ecx, dword [ebp - 0x28]
+add esp, 0x10
+and eax, 1
+test ecx, ecx
+jne short loc_0001fc44  ; jne 0x1fc44
+cmp dword [ebp - 0x1c], eax
+je short loc_0001fc5c  ; je 0x1fc5c
+
+loc_0001fc44:
+push edx
+push ref_00026db3  ; push 0x26db3
+push 0x365
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001fc5c:
+push eax
+mov ecx, esi
+push dword [ebp + 0x10]
+not edi
+not ecx
+push edi
+push ecx
+call fcn_0001fdda  ; call 0x1fdda
+add esp, 0xc
+push dword [ebp + 0x14]
+push 0xffffffffffffffff
+push 0xfffffffffffffffe
+mov esi, eax
+mov ebx, edx
+call fcn_0001fdda  ; call 0x1fdda
+not ebx
+mov ecx, eax
+or ebx, edx
+mov eax, esi
+and ebx, dword [ebp - 0x24]
+not eax
+or eax, ecx
+and eax, dword [ebp - 0x20]
+lea esp, [ebp - 0xc]
+mov edx, ebx
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001fc9c:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x2c
+mov eax, dword [ebp + 8]
+mov edx, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x14]
+mov esi, dword [ebp + 0x20]
+mov dword [ebp - 0x28], eax
+mov eax, dword [ebp + 0x10]
+mov dword [ebp - 0x24], edx
+mov edx, dword [ebp + 0x1c]
+mov edi, dword [ebp + 0x24]
+mov dword [ebp - 0x1c], eax
+mov eax, dword [ebp + 0x18]
+mov dword [ebp - 0x2c], edx
+mov dword [ebp - 0x30], eax
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001fcf2  ; je 0x1fcf2
+cmp ebx, 0x3f
+jbe short loc_0001fcf2  ; jbe 0x1fcf2
+push ecx
+push ref_00026d52  ; push 0x26d52
+push 0x392
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001fcf2:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001fd18  ; je 0x1fd18
+cmp dword [ebp - 0x1c], ebx
+jbe short loc_0001fd18  ; jbe 0x1fd18
+push edx
+push ref_00025b30  ; push 0x25b30
+push 0x393
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001fd18:
+push eax
+push eax
+push dword [ebp - 0x2c]
+push dword [ebp - 0x30]
+push ebx
+push dword [ebp - 0x1c]
+push dword [ebp - 0x24]
+push dword [ebp - 0x28]
+call fcn_0001fb9e  ; call 0x1fb9e
+mov ecx, dword [ebp - 0x1c]
+add esp, 0x20
+mov dword [ebp + 0x18], esi
+mov dword [ebp + 0x1c], edi
+mov dword [ebp + 0x14], ebx
+mov dword [ebp + 0x10], ecx
+mov dword [ebp + 8], eax
+mov dword [ebp + 0xc], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near fcn_0001faac  ; jmp 0x1faac
+
+fcn_0001fd53:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov edx, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x14]
+mov esi, dword [ebp + 0x18]
+mov dword [ebp - 0x20], eax
+mov edi, dword [ebp + 0x1c]
+mov dword [ebp - 0x1c], edx
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001fd97  ; je 0x1fd97
+cmp ebx, 0x3f
+jbe short loc_0001fd97  ; jbe 0x1fd97
+push edx
+push ref_00026d52  ; push 0x26d52
+push 0x300
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001fd97:
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001fdbd  ; je 0x1fdbd
+cmp dword [ebp + 0x10], ebx
+jbe short loc_0001fdbd  ; jbe 0x1fdbd
+push eax
+push ref_00025b30  ; push 0x25b30
+push 0x301
+push ref_00026cb0  ; push 0x26cb0
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001fdbd:
+push edi
+push esi
+push 0
+push 0
+push ebx
+push dword [ebp + 0x10]
+push dword [ebp - 0x1c]
+push dword [ebp - 0x20]
+call fcn_0001fc9c  ; call 0x1fc9c
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+fcn_0001fdda:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0xc
+mov esi, dword [ebp + 8]
+mov edi, dword [ebp + 0xc]
+mov ebx, dword [ebp + 0x10]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001fe0f  ; je 0x1fe0f
+cmp ebx, 0x3f
+jbe short loc_0001fe0f  ; jbe 0x1fe0f
+push eax
+push ref_000259b8  ; push 0x259b8
+push 0x27
+push ref_00026e0a  ; push 0x26e0a
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001fe0f:
+mov dword [ebp + 0x10], ebx
+mov dword [ebp + 8], esi
+mov dword [ebp + 0xc], edi
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_0001ff76  ; jmp 0x1ff76
+
+fcn_0001fe24:
+push ebp
+mov ebp, esp
+pop ebp
+jmp near loc_0001fe90  ; jmp 0x1fe90
+
+fcn_0001fe2d:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov eax, dword [ebp + 8]
+mov edx, dword [ebp + 0xc]
+mov esi, dword [ebp + 0x10]
+mov ebx, dword [ebp + 0x14]
+mov dword [ebp - 0x20], eax
+mov edi, dword [ebp + 0x18]
+mov dword [ebp - 0x1c], edx
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0001fe6f  ; je 0x1fe6f
+mov eax, ebx
+or eax, esi
+jne short loc_0001fe6f  ; jne 0x1fe6f
+push eax
+push ref_00025a2d  ; push 0x25a2d
+push 0x2f
+push ref_00026e3f  ; push 0x26e3f
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001fe6f:
+mov eax, dword [ebp - 0x20]
+mov edx, dword [ebp - 0x1c]
+mov dword [ebp + 0x18], edi
+mov dword [ebp + 0x10], esi
+mov dword [ebp + 0x14], ebx
+mov dword [ebp + 8], eax
+mov dword [ebp + 0xc], edx
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+jmp near loc_0001fea2  ; jmp 0x1fea2
+
+loc_0001fe90:
+mov ecx, dword [esp + 0xc]
+mov eax, ecx
+imul ecx, dword [esp + 8]
+mul dword [esp + 4]
+add edx, ecx
+ret
+
+loc_0001fea2:
+mov ecx, dword [esp + 0x10]
+test ecx, ecx
+jne short loc_0001febd  ; jne 0x1febd
+mov ecx, dword [esp + 0x14]
+jecxz loc_0001feb8  ; jecxz 0x1feb8
+and dword [ecx + 4], 0
+mov dword [esp + 0x10], ecx
+
+loc_0001feb8:
+jmp near loc_00017581  ; jmp 0x17581
+
+loc_0001febd:
+push ebx
+push esi
+push edi
+mov edx, dword [esp + 0x14]
+mov eax, dword [esp + 0x10]
+mov edi, edx
+mov esi, eax
+mov ebx, dword [esp + 0x18]
+
+loc_0001fed0:
+shr edx, 1
+rcr eax, 1
+shrd ebx, ecx, 1
+shr ecx, 1
+jne short loc_0001fed0  ; jne 0x1fed0
+div ebx
+mov ebx, eax
+mov ecx, dword [esp + 0x1c]
+mul dword [esp + 0x18]
+imul ecx, ebx
+add edx, ecx
+mov ecx, dword [esp + 0x20]
+jb short loc_0001fefd  ; jb 0x1fefd
+cmp edi, edx
+ja short loc_0001ff08  ; ja 0x1ff08
+jb short loc_0001fefd  ; jb 0x1fefd
+cmp esi, eax
+jae short loc_0001ff08  ; jae 0x1ff08
+
+loc_0001fefd:
+dec ebx
+jecxz loc_0001ff13  ; jecxz 0x1ff13
+sub eax, dword [esp + 0x18]
+sbb edx, dword [esp + 0x1c]
+
+loc_0001ff08:
+jecxz loc_0001ff13  ; jecxz 0x1ff13
+sub esi, eax
+sbb edi, edx
+mov dword [ecx], esi
+mov dword [ecx + 4], edi
+
+loc_0001ff13:
+mov eax, ebx
+xor edx, edx
+pop edi
+pop esi
+pop ebx
+ret
+
+fcn_0001ff1b:
+push ebx
+
+fcn_0001ff1c:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0xc]
+cpuid
+push ecx
+mov ecx, dword [ebp + 0x10]
+jecxz loc_0001ff2c  ; jecxz 0x1ff2c
+mov dword [ecx], eax
+
+loc_0001ff2c:
+mov ecx, dword [ebp + 0x14]
+jecxz loc_0001ff33  ; jecxz 0x1ff33
+mov dword [ecx], ebx
+
+loc_0001ff33:
+mov ecx, dword [ebp + 0x18]
+jecxz loc_0001ff3a  ; jecxz 0x1ff3a
+pop dword [ecx]
+
+loc_0001ff3a:
+mov ecx, dword [ebp + 0x1c]
+jecxz loc_0001ff41  ; jecxz 0x1ff41
+mov dword [ecx], edx
+
+loc_0001ff41:
+mov eax, dword [ebp + 0xc]
+leave
+pop ebx
+ret
+
+fcn_0001ff47:
+push ebx
+
+fcn_0001ff48:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 0xc]
+mov ecx, dword [ebp + 0x10]
+cpuid
+push ecx
+mov ecx, dword [ebp + 0x14]
+jecxz loc_0001ff5b  ; jecxz 0x1ff5b
+mov dword [ecx], eax
+
+loc_0001ff5b:
+mov ecx, dword [ebp + 0x18]
+jecxz loc_0001ff62  ; jecxz 0x1ff62
+mov dword [ecx], ebx
+
+loc_0001ff62:
+mov ecx, dword [ebp + 0x20]
+jecxz loc_0001ff69  ; jecxz 0x1ff69
+mov dword [ecx], edx
+
+loc_0001ff69:
+mov ecx, dword [ebp + 0x1c]
+jecxz loc_0001ff70  ; jecxz 0x1ff70
+pop dword [ecx]
+
+loc_0001ff70:
+mov eax, dword [ebp + 0xc]
+leave
+pop ebx
+ret
+
+loc_0001ff76:
+mov cl, byte [esp + 0xc]
+xor eax, eax
+mov edx, dword [esp + 4]
+test cl, 0x20
+cmove eax, edx
+cmove edx, dword [esp + 8]
+shld edx, eax, cl
+shl eax, cl
+ret
+
+fcn_0001ff91:
+push ebp
+mov ebp, esp
+push ebx
+sub esp, 8
+mov ebx, dword [ebp + 8]
+mov dword [ebx], 0x53524549
+mov dword [ebx + 4], 0
+mov dword [ebx + 8], fcn_000200f7  ; mov dword [ebx + 8], 0x200f7
+push 0
+push 0x1f
+push 0
+call fcn_00016c9a  ; call 0x16c9a
+mov dword [ebx + 0x10], eax
+add eax, 0xf0
+mov dword [esp], eax
+call fcn_00017e4e  ; call 0x17e4e
+and eax, 0xffffc000
+mov dword [ebx + 0xc], eax
+call fcn_00015480  ; call 0x15480
+add esp, 0x10
+test al, al
+je short loc_0001fff9  ; je 0x1fff9
+cmp dword [ebx + 0xc], 0
+jne short loc_0001fff9  ; jne 0x1fff9
+push eax
+push ref_00026e7d  ; push 0x26e7d
+push 0x39
+push ref_00026ea6  ; push 0x26ea6
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+
+loc_0001fff9:
+xor eax, eax
+mov ebx, dword [ebp - 4]
+leave
+ret
+
+fcn_00020000:
+push ebp
+mov ebp, esp
+mov eax, dword [ebp + 8]
+push esi
+mov esi, 1
+push ebx
+sub esp, 0xc
+add eax, 2
+push eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+movzx ebx, ax
+mov eax, ebx
+and eax, 0xfffffffd
+cmp ax, 0x8c44
+je near loc_000200ee  ; je 0x200ee
+lea eax, [ebx + 0x73b2]
+cmp ax, 2
+jbe near loc_000200ee  ; jbe 0x200ee
+lea eax, [ebx + 0x73b7]
+cmp ax, 3
+jbe near loc_000200ee  ; jbe 0x200ee
+lea eax, [ebx + 0x73bf]
+cmp ax, 1
+jbe near loc_000200ee  ; jbe 0x200ee
+cmp bx, 0x8c58
+je near loc_000200ee  ; je 0x200ee
+mov eax, ebx
+and eax, 0xfffffffb
+cmp ax, 0x8c52
+je short loc_000200e9  ; je 0x200e9
+mov eax, ebx
+and eax, 0xfffffff7
+cmp ax, 0x8c54
+je short loc_000200e9  ; je 0x200e9
+lea eax, [ebx + 0x733f]
+cmp ax, 5
+jbe short loc_000200ee  ; jbe 0x200ee
+lea eax, [ebx + 0x63bf]
+mov si, 2
+cmp ax, 6
+jbe short loc_000200ee  ; jbe 0x200ee
+lea eax, [ebx + 0x633f]
+cmp ax, 0xa
+jbe short loc_000200ee  ; jbe 0x200ee
+call fcn_00015479  ; call 0x15479
+test al, al
+je short loc_000200c4  ; je 0x200c4
+push edx
+push ebx
+push ref_000264fe  ; push 0x264fe
+push 0x80000000
+call fcn_00015487  ; call 0x15487
+add esp, 0x10
+
+loc_000200c4:
+call fcn_00015480  ; call 0x15480
+mov esi, 3
+test al, al
+je short loc_000200ee  ; je 0x200ee
+push eax
+push ref_00022281  ; push 0x22281
+push 0x57
+push ref_00026ea6  ; push 0x26ea6
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+jmp short loc_000200ee  ; jmp 0x200ee
+
+loc_000200e9:
+mov esi, 1
+
+loc_000200ee:
+lea esp, [ebp - 8]
+mov eax, esi
+pop ebx
+pop esi
+pop ebp
+ret
+
+fcn_000200f7:
+push ebp
+mov ebp, esp
+push edi
+push esi
+push ebx
+sub esp, 0x1c
+mov ebx, dword [ebp + 8]
+call fcn_00015480  ; call 0x15480
+test al, al
+je short loc_0002012c  ; je 0x2012c
+cmp dword [ebx - 8], 0x53524549
+je short loc_0002012c  ; je 0x2012c
+push eax
+push ref_000262c8  ; push 0x262c8
+push 0x79
+push ref_00026ea6  ; push 0x26ea6
+call fcn_0001548c  ; call 0x1548c
+add esp, 0x10
+jmp short loc_0002012f  ; jmp 0x2012f
+
+loc_0002012c:
+sub ebx, 8
+
+loc_0002012f:
+mov esi, dword [ebx + 0x10]
+sub esp, 0xc
+push esi
+call fcn_00020000  ; call 0x20000
+mov edi, eax
+mov eax, dword [ebx + 0xc]
+mov dword [ebp - 0x1c], eax
+lea eax, [esi + 0x40]
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+mov ebx, eax
+lea eax, [esi + 0x48]
+mov dword [esp], eax
+call fcn_00017dc2  ; call 0x17dc2
+add esp, 0x10
+cmp dword [ebp + 0xc], 5
+ja near loc_00020388  ; ja 0x20388
+mov edx, dword [ebp + 0xc]
+jmp dword [edx*4 + ref_00020670]  ; ujmp: jmp dword [edx*4 + 0x20670]
+
+loc_00020172:
+push eax
+mov esi, 4
+push eax
+push 0
+push 0xcf9
+call fcn_00018eea  ; call 0x18eea
+add esp, 0x10
+jmp near loc_0002034f  ; jmp 0x2034f
+
+loc_0002018d:
+push eax
+mov esi, 6
+push eax
+push 2
+push 0xcf9
+call fcn_00018eea  ; call 0x18eea
+add esp, 0x10
+jmp near loc_0002034f  ; jmp 0x2034f
+
+loc_000201a8:
+push eax
+add esi, 0x44
+push eax
+and ebx, 0xfffffffc
+push 0x80
+movzx ebx, bx
+push esi
+call fcn_00018730  ; call 0x18730
+add esp, 0x10
+cmp edi, 2
+jne short loc_000201d8  ; jne 0x201d8
+push eax
+push eax
+push 0
+lea eax, [ebx + 0x9c]
+push eax
+call fcn_00018f97  ; call 0x18f97
+jmp short loc_000201f5  ; jmp 0x201f5
+
+loc_000201d8:
+dec edi
+jne short loc_000201f8  ; jne 0x201f8
+push ecx
+push ecx
+push 0
+lea eax, [ebx + 0x28]
+push eax
+call fcn_00018f27  ; call 0x18f27
+lea eax, [ebx + 0x2c]
+pop esi
+pop edi
+push 0
+push eax
+call fcn_00018f27  ; call 0x18f27
+
+loc_000201f5:
+add esp, 0x10
+
+loc_000201f8:
+push ecx
+push ecx
+push 0x100
+lea eax, [ebx + 0x34]
+add ebx, 4
+push eax
+call fcn_00018f27  ; call 0x18f27
+mov dword [esp], ebx
+call fcn_00018f64  ; call 0x18f64
+pop edi
+mov esi, eax
+and esi, 0xffffc3ff
+pop eax
+mov eax, esi
+or ah, 0x1c
+or esi, 0x3c00
+push eax
+push ebx
+call fcn_00018f97  ; call 0x18f97
+pop eax
+pop edx
+push esi
+push ebx
+call fcn_00018f97  ; call 0x18f97
+add esp, 0x10
+xor eax, eax
+jmp near loc_0002038d  ; jmp 0x2038d
+
+loc_00020242:
+mov ebx, eax
+push edx
+and ebx, 0xfffc
+push edx
+push 0
+lea eax, [ebx + 0x60]
+push eax
+mov dword [ebp - 0x20], eax
+call fcn_00018f97  ; call 0x18f97
+pop ecx
+pop eax
+lea eax, [ebx + 0x64]
+push 0
+push eax
+call fcn_00018f97  ; call 0x18f97
+pop eax
+pop edx
+lea eax, [ebx + 0x68]
+push 0
+push eax
+call fcn_00018f97  ; call 0x18f97
+mov eax, dword [ebp + 0xc]
+add esp, 0x10
+sub eax, 4
+cmp eax, 1
+ja near loc_0002034a  ; ja 0x2034a
+push ecx
+add esi, 0xac
+push ecx
+push 0x100000
+push esi
+call fcn_00018b14  ; call 0x18b14
+add esp, 0x10
+cmp dword [ebp + 0xc], 5
+jne near loc_0002034a  ; jne 0x2034a
+mov eax, dword [ebp - 0x1c]
+sub esp, 0xc
+add eax, 0x332c
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test al, 3
+jne near loc_0002034a  ; jne 0x2034a
+mov eax, dword [ebp - 0x1c]
+sub esp, 0xc
+add eax, 0x3330
+push eax
+call fcn_00017e4e  ; call 0x17e4e
+add esp, 0x10
+test ah, 0xc0
+jne short loc_0002034a  ; jne 0x2034a
+cmp edi, 1
+jne short loc_00020309  ; jne 0x20309
+push ecx
+push ecx
+push 0x40000000
+push ebx
+call fcn_00018363  ; call 0x18363
+lea eax, [ebx + 4]
+add ebx, 0xc
+pop esi
+pop edi
+push 0xbfffffff
+push eax
+call fcn_0001838d  ; call 0x1838d
+pop eax
+pop edx
+push 0xbfffffff
+jmp short loc_0002032f  ; jmp 0x2032f
+
+loc_00020309:
+cmp edi, 2
+jne short loc_00020338  ; jne 0x20338
+push ecx
+add ebx, 0x1f0
+push ecx
+push 1
+push ebx
+call fcn_00018363  ; call 0x18363
+pop esi
+pop edi
+push 0xfffffffffffffffb
+push ebx
+call fcn_0001838d  ; call 0x1838d
+pop eax
+pop edx
+push 0x7fffffff
+
+loc_0002032f:
+push ebx
+call fcn_0001838d  ; call 0x1838d
+add esp, 0x10
+
+loc_00020338:
+push edx
+push edx
+push 0x40000000
+push dword [ebp - 0x20]
+call fcn_00018363  ; call 0x18363
+add esp, 0x10
+
+loc_0002034a:
+mov esi, 0xe
+
+loc_0002034f:
+sub esp, 0xc
+push dword [ebp + 0xc]
+call fcn_0001ba36  ; call 0x1ba36
+add esp, 0x10
+mov ebx, eax
+cmp eax, 0x8000000e
+je short loc_0002036a  ; je 0x2036a
+test ebx, ebx
+jne short loc_0002038d  ; jne 0x2038d
+
+loc_0002036a:
+push eax
+push eax
+mov eax, esi
+movzx esi, al
+push esi
+push 0xcf9
+call fcn_00018eea  ; call 0x18eea
+call fcn_00017239  ; call 0x17239
+add esp, 0x10
+mov eax, ebx
+jmp short loc_0002038d  ; jmp 0x2038d
+
+loc_00020388:
+mov eax, 0x80000002
+
+loc_0002038d:
+lea esp, [ebp - 0xc]
+pop ebx
+pop esi
+pop edi
+pop ebp
+ret
+
+endloc_00020395:
+db 0x66
+db 0x90
+db 0x66
+dd 0x66906690
+dd 0x90906690
+
+ref_000203a0:
+dd 0x08000100
+dd 0x01010000
+dd 0x01000004
+dd 0x00000202
+
+ref_000203b0:
+dd 0x00000100
+dd 0x00001000
+dd 0x00010101
+dd 0x01000008
+dd 0x04000202
+dd 0x00000000
+
+ref_000203c8:
+dd 0x07000301
+dd 0x0f000000
+
+ref_000203d0:
+dd loc_000094ae
+dd loc_000094b5
+dd loc_000093fa
+dd loc_00009404
+dd loc_0000940e
+dd loc_00009444
+dd loc_00009448
+dd loc_00009451
+dd loc_00009415
+dd loc_0000941c
+
+ref_000203f8:
+dd 0x00000002
+dd 0x0000000a
+dd 0x00000064
+dd 0x00000000
+
+ref_00020408:
+dd 0xea002600
+dd 0xea002400
+dd 0xea002200
+dd 0xea002000
+dd 0x00000000
+dd 0x00000000
+
+ref_00020420:
+dd 0xea002400
+dd 0xea002600
+dd 0xea000800
+dd 0xea000a00
+dd 0xea002000
+dd 0xea002200
+
+ref_00020438:
+dd 0xe9002000
+dd 0xe9002200
+dd 0xe9002400
+dd 0xe9002600
+dd 0x00000000
+dd 0x00000000
+
+ref_00020450:
+dd 0xe9001600
+dd 0xe9001400
+dd 0xe9002e00
+dd 0xe9002c00
+dd 0xe9003200
+dd 0xe9003000
+
+ref_00020468:
+dd 0x0a090605
+
+ref_0002046c:
+dd 0x13000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x11000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x15000000
+dd 0x0f000000
+
+ref_000204b0:
+dd 0x00000000
+dd 0x00000001
+dd 0x00000002
+dd 0x00000003
+dd 0x00000008
+dd 0x00000009
+dd 0x0000000c
+dd 0x0000000d
+dd 0x00000004
+dd 0x00000005
+dd 0x00000006
+dd 0x00000007
+dd 0x0000000a
+dd 0x0000000b
+dd 0x0000000c
+dd 0x0000000d
+
+ref_000204f0:
+db 0x1d
+
+ref_000204f1:
+db 0x00
+db 0x1a
+db 0x00
+
+ref_000204f4:
+db '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ',0x00,0x00,0x00,0x00
+
+ref_0002051c:
+dd 0x00000001
+dd 0x00000002
+dd 0x00000004
+dd 0x00000008
+dd 0x00000010
+dd 0x00000020
+dd 0x00000040
+dd 0x00000000
+
+ref_0002053c:
+db ' +-#0!^',0x00
+
+ref_00020544:
+db '0000000000000000',0x00,0x00,0x00,0x00
+
+ref_00020558:
+dd 0x20202020
+dd 0x20202020
+dd 0x20202020
+dd 0x20202020
+dd 0x90906600
+
+ref_0002056c:
+db 'CbLocatePpi',0x00
+
+ref_00020578:
+db 'CbNotifyPpi',0x00
+
+ref_00020584:
+dd 0x6e496243
+dd 0x6c617473
+dd 0x6970506c
+dd 0x90906600
+
+ref_00020594:
+dd 0x80000010
+dd ref_0002907c
+dd 0x00000000
+
+ref_000205a0:
+dd loc_0001b45b
+dd loc_0001b454
+dd loc_0001b47b
+dd loc_0001b46c
+dd loc_0001b4b6
+dd loc_0001b496
+dd loc_0001b513
+dd loc_0001b4e8
+dd loc_0001b547
+dd loc_0001b52b
+dd loc_0001b55d
+dd loc_0001b5a2
+
+ref_000205d0:
+dd loc_0001b7e6
+dd loc_0001b8ac
+dd loc_0001b730
+dd loc_0001b8ac
+dd loc_0001b714
+dd loc_0001b8ac
+dd loc_0001b80d
+dd loc_0001b7f7
+dd loc_0001b714
+dd loc_0001b858
+
+ref_000205f8:
+dd loc_0001c367
+dd loc_0001c382
+dd loc_0001c36d
+dd loc_0001c374
+dd loc_0001c37b
+
+ref_0002060c:
+dd loc_0001d0a8
+dd loc_0001d0b7
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d1d0
+dd loc_0001d0d0
+dd loc_0001d0e5
+dd loc_0001d174
+dd loc_0001d180
+dd loc_0001d1a9
+dd loc_0001d1b5
+
+ref_00020660:
+dd 0x6c416243
+dd 0x61636f6c
+dd 0x6f506574
+dd 0x90006c6f
+
+ref_00020670:
+dd loc_0002018d
+dd loc_00020172
+dd loc_000201a8
+dd loc_00020242
+dd loc_00020242
+dd loc_00020242
+
+ref_00020688:
+db 'PEI: Starting...',0x0a,0x00
+
+ref_0002069a:
+db 'Initializing System Agent',0x0a,0x00
+
+ref_000206b5:
+db 'Initializing PCH',0x0a,0x00
+
+ref_000206c7:
+db 'PEI: Done.',0x0a,0x00
+
+ref_000206d3:
+db 0x0a,'ASSERT_EFI_ERROR (Status = %r)',0x0a,0x00
+
+ref_000206f4:
+db '!EFI_ERROR (Status)',0x00
+
+ref_00020708:
+db '../../intel/SystemAgent/SaInit/Pei/SaInitPeim.c',0x00
+
+ref_00020738:
+db 'Set BIOS_RESET_CPL to indicate all configurations complete',0x0a,0x00
+
+ref_00020774:
+db '[SA] Programming MSR 2E7',0x0a,0x00
+
+ref_0002078e:
+db 'SA Data HOB installed',0x0a,0x00
+
+ref_000207a5:
+db '***************** System Agent PCIe code version *****************',0x0a,0x00
+
+ref_000207e9:
+db '** Major version number is: %3d                                 **',0x0a,0x00
+
+ref_0002082d:
+db '** Minor version number is: %3d                                 **',0x0a,0x00
+
+ref_00020871:
+db '** Rev version number is:   %3d                                 **',0x0a,0x00
+
+ref_000208b5:
+db '** Build number is:         %3d                                 **',0x0a,0x00
+
+ref_000208f9:
+db '******************************************************************',0x0a,0x00
+
+ref_0002093d:
+db 'Programming SA Bars',0x0a,0x00
+
+ref_00020952:
+db 'Reporting SA PCIe code version',0x0a,0x00
+
+ref_00020972:
+db 'Initializing DMI',0x0a,0x00
+
+ref_00020984:
+db 'Initializing SA PCIe',0x0a,0x00
+
+ref_0002099a:
+db 'Initializing Graphics',0x0a,0x00
+
+ref_000209b1:
+db 'Initializing System Agent Overclocking',0x0a,0x00
+
+ref_000209d9:
+db 'Initializing DMI Tc/Vc mapping',0x0a,0x00
+
+ref_000209f9:
+db 'Early BIOS POST Programming',0x0a,0x00
+
+ref_00020a16:
+db '[SA] BootMode = %X',0x0a,0x00
+
+ref_00020a2a:
+db '[SA] Install SA S3 Notify callback',0x0a,0x00
+
+ref_00020a4e:
+db '[SA] Install Notify callback for Rapid Start Resume',0x0a,0x00
+
+ref_00020a83:
+db '(OC) Overclocking is disabled. Bypassing SA overclocking flow.',0x0a,0x00
+
+ref_00020ac3:
+db '../../intel/SystemAgent/SaInit/Pei/SaOcInit.c',0x00
+
+ref_00020af1:
+db '(OC) Updating EDRAM ratio value = %X',0x0a,0x00
+
+ref_00020b17:
+db '(OC) Set Voltage Frequency failed. EFI Status = %X, Library Status = %X',0x0a,0x00
+
+ref_00020b60:
+db '(OC) No OC support for this Domain = %X',0x0a,0x00
+
+ref_00020b89:
+db '(OC) GetOcCapabilities message failed. Library Status = %X, Domain = %X',0x0a,0x00
+
+ref_00020bd2:
+db '../../intel/SystemAgent/SaInit/Pei/GraphicsInit.c',0x00
+
+ref_00020c04:
+db 'PCH PCIe Graphics Card enabled.',0x0a,0x00
+
+ref_00020c25:
+db 'PCIe card on PEG%x%x (%x:%x:%x) enabled as VGA.',0x0a,0x00
+
+ref_00020c56:
+db 'PEG%x%x (%x:%x:%x) ISAEN has been set.',0x0a,0x00
+
+ref_00020c7e:
+db '(StallCount != 3000)',0x00
+
+ref_00020c93:
+db 'Temporary GttMmAdr Bar is not initialized. Returning from GraphicsInit().',0x0a,0x00
+
+ref_00020cde:
+db 'GttMmAdr != 0',0x00
+
+ref_00020cec:
+db 'IGD enabled.',0x0a,0x00
+
+ref_00020cfa:
+db 'SaPlatformPolicyPpi->GtConfig->GttSize <= 3',0x00
+
+ref_00020d26:
+db 'IGD VGA Decode is disabled because it',0x27,'s not a primary display.',0x0a,0x00
+
+ref_00020d66:
+db 'Disable IGD Device.',0x0a,0x00
+
+ref_00020d7b:
+db '../../intel/SystemAgent/SaInit/Pei/SaDmiPeim.c',0x00
+
+ref_00020daa:
+db 'Can',0x27,'t locate PchPlatformPolicy PPI - exiting.',0x0a,0x00
+
+ref_00020dd9:
+db 'DMI Recipe...',0x0a,0x00
+
+ref_00020de8:
+db 'Run AdditionalDmiProgramSteps!',0x0a,0x00
+
+ref_00020e08:
+db 'DMI Gen2 is Disabled or not capable, staying at Gen1 !',0x0a,0x00
+
+ref_00020e40:
+db 'DMI Link re-train to set GEN2',0x0a,0x00
+
+ref_00020e5f:
+db 'DMI trained to x%d at Gen%d',0x0a,0x00
+
+ref_00020e7c:
+db 'PEG%x%x (%x:%x:%x) - ',0x00
+
+ref_00020e92:
+db 'Trained to x%d at Gen%d.',0x00
+
+ref_00020eab:
+db ' VC0 Negotiation Pending = %d.',0x00
+
+ref_00020eca:
+db 'PEG%x%x (%x:%x:%x) - VC0 Negotiation Pending = %x after %d msec.',0x0a,0x00
+
+ref_00020f0c:
+db '../../intel/SystemAgent/SaInit/Pei/PciExpressInit.c',0x00
+
+ref_00020f40:
+db 'Previous Link Training Fail Mask 0x%2.2X',0x0a,0x00
+
+ref_00020f6a:
+db 'New Link Training Fail Mask 0x%2.2X',0x0a,0x00
+
+ref_00020f8f:
+db ' PEG%x%x (%x:%x:%x) - skipping due to furcation',0x0a,0x00
+
+ref_00020fc0:
+db ' PEG%x%x (%x:%x:%x) - checking',0x0a,0x00
+
+ref_00020fe0:
+db '  VC negotiation is complete',0x0a,0x00
+
+ref_00020ffe:
+db 'Total Stall: %d msec',0x0a,0x00
+
+ref_00021014:
+db 'Returned PegLinkFailMask 0x%2.2X',0x0a,0x00
+
+ref_00021036:
+db 'Invalid input to ProgramPreset() function!  PegFunc=%d, Lane=%d',0x0a,0x00
+
+ref_00021077:
+db '--- Sampler values before calibration ---',0x0a,0x00
+
+ref_000210a2:
+db 'ERROR: PEG dev=%d, lane=%d, sampler=%d, iteration=%d, found more than %d distinct codes!!!',0x0a,0x00
+
+ref_000210fe:
+db '--- Sampler values after calibration ---',0x0a,0x00
+
+ref_00021128:
+db 'PEG Link Status after auto speed disable:',0x0a,0x00
+
+ref_00021153:
+db 'Auto',0x0a,0x00
+
+ref_00021159:
+db 'Speed From Setup %x',0x0a,0x00
+
+ref_0002116e:
+db 'PEG%x%x (%x:%x:%x) - Max Link Speed = Gen%d',0x0a,0x00
+
+ref_0002119b:
+db 'ERROR: Attempted to reserve > %d IOTRK (Attempt = %d)! Skipping programming.',0x0a,0x00
+
+ref_000211e9:
+db 'IOTRK: Reserved = %d. Shared = %d. Total = %d.',0x0a,0x00
+
+ref_00021219:
+db 'ERROR: Attempted to reserve > %d RRTRK (Attempt = %d)! Skipping programming.',0x0a,0x00
+
+ref_00021267:
+db 'RRTRK: Reserved = %d. Shared = %d. Total = %d.',0x0a,0x00
+
+ref_00021297:
+db 'Crdtctl4 Crdtctl6 Crdtctl8 Before = %x %x %x',0x0a,0x00
+
+ref_000212c5:
+db 'PEG10: LinkDisabled = %x. Width = %x',0x0a,0x00
+
+ref_000212eb:
+db 'PEG11: LinkDisabled = %x. Width = %x',0x0a,0x00
+
+ref_00021311:
+db 'PEG12: LinkDisabled = %x. Width = %x',0x0a,0x00
+
+ref_00021337:
+db 'Crdtctl4 Crdtctl6 Crdtctl8 After = %x %x %x',0x0a,0x00
+
+ref_00021364:
+db 'VCU Busy Timeout after %d tries: MCHBAR=%8.8X. Interface=%8.8X. Data=%4.4X.',0x0a,0x00
+
+ref_000213b1:
+db 'ERROR: VCU Response Error after %d tries: MCHBAR=%8.8X. Interface=%4.4X. Data=%8.8X. ResponseCode=%4.4X',0x0a,0x00
+
+ref_0002141a:
+db 'In GetMaxBundles procedure',0x0a,0x00
+
+ref_00021436:
+db 'MaxBndlPwrdnCount = %d',0x0a,0x00
+
+ref_0002144e:
+db 'In PowerDownUnusedBundles sequence',0x0a,0x00
+
+ref_00021472:
+db 'All lanes are used. Do nothing.',0x0a,0x00
+
+ref_00021493:
+db 'PegLaneReversal is true',0x0a,0x00
+
+ref_000214ac:
+db 'BNDL_PWRDN PEG%d%d[%d:%d]',0x0a,0x00
+
+ref_000214c7:
+db 'PEG controller not detected',0x0a,0x00
+
+ref_000214e4:
+db 'PEG HW Strap value %x',0x0a,0x00
+
+ref_000214fb:
+db 'PEG Gen3 Fused off',0x0a,0x00
+
+ref_0002150f:
+db 0x0a,'Restore SA PEG DATA from previous boot: Size=%X',0x0a,0x00
+
+ref_00021541:
+db 0x0a,'PegGen3PresetSearch is disabled, Clear old Preset data',0x0a,0x00
+
+ref_0002157a:
+db 'PEG Recipe...',0x0a,0x00
+
+ref_00021589:
+db 'PEG Gen3 Equalization...',0x0a,0x00
+
+ref_000215a3:
+db 'Presence detect table...',0x0a,0x00
+
+ref_000215bd:
+db ' PEG%d%d PresenceDetect: %x. EndpointMaxLinkSpeed: %x.',0x0a,0x00
+
+ref_000215f5:
+db 'PEG SamplerCalibration...',0x0a,0x00
+
+ref_00021610:
+db 'PEG Ports Scanning starts.',0x0a,0x00
+
+ref_0002162c:
+db 'PEG%d%d - Endpoint not responding to PCI config space access, assuming negotiated width (X%d) is max width',0x0a,0x00
+
+ref_00021698:
+db 'CtrlMLW[%d]. EpMLW[%d]. UnusedLanes[%d]. BndlPwrdnCount[%d].',0x0a,0x00
+
+ref_000216d6:
+db 'BndlPwrdnCount violation! Overriding BndlPwrdnCount! '
+
+ref_0002170b:
+db 'BndlPwrdnCount[%d].',0x0a,0x00
+
+ref_00021720:
+db 'Run AdditionalPegProgramSteps on PEG%x%x!',0x0a,0x00
+
+ref_0002174b:
+db 'PEG10 '
+
+ref_00021751:
+db 'Disabled.',0x0a,0x00
+
+ref_0002175c:
+db 'PEG11 Disabled.',0x0a,0x00
+
+ref_0002176d:
+db 'PEG12 Disabled.',0x0a,0x00
+
+ref_0002177e:
+db 'Original PegLinkFailMask=%X, Final PegLinkFailMask=%X',0x0a,0x00
+
+ref_000217b5:
+db 'Setting GPIO%d to %x',0x0a,0x00
+
+ref_000217cb:
+db 'Asserting PEG slot reset.',0x0a,0x00
+
+ref_000217e6:
+db 'Deasserting PEG slot reset.',0x0a,0x00
+
+ref_00021803:
+db 'Toggling PEG slot reset.',0x0a,0x00
+
+ref_0002181d:
+db 'SECONDARY BUS RESET!',0x0a,0x00
+
+ref_00021833:
+db 'Reset Complete',0x0a,0x00
+
+ref_00021843:
+db 'PHY LAYER RESET!',0x0a,0x00
+
+ref_00021855:
+db 'Link retrain FAILED!!!',0x0a,0x00
+
+ref_0002186d:
+db 'DOWNGRADE from x%d to x%d detected',0x0a,0x00
+
+ref_00021891:
+db 'Width Recovery Successful',0x0a,0x00
+
+ref_000218ac:
+db 'Width Recovery FAILED!',0x0a,0x00
+
+ref_000218c4:
+db 'Error 0x%x.',0x0a,0x00
+
+ref_000218d1:
+db 'Success.',0x0a,0x00
+
+ref_000218db:
+db 'Link Width DOWNGRADED!',0x0a,0x00
+
+ref_000218f3:
+db 'Link Speed DOWNGRADED!',0x0a,0x00
+
+ref_0002190b:
+db 'Link speed downgrade detected',0x0a,0x00
+
+ref_0002192a:
+db 'Link width downgrade detected',0x0a,0x00
+
+ref_00021949:
+db 'DOWNGRADE from Gen %d to Gen %d detected',0x0a,0x00
+
+ref_00021973:
+db 'Link Speed Recovery FAILED!',0x0a,0x00
+
+ref_00021990:
+db 'Link Speed Recovery Successful',0x0a,0x00
+
+ref_000219b0:
+db 'DOWNGRADE, Link is not in L0',0x0a,0x00
+
+ref_000219ce:
+db '../../intel/SystemAgent/SaInit/Pei/PcieTrainingLinkRecovery.c',0x00
+
+ref_00021a0c:
+db ' PcieControllerList Array Index Out of Bounds  PortInfoListLength: %x',0x0a,0x00
+
+ref_00021a53:
+db ' LaneList Array Index Out of Bounds LaneListLength%x',0x0a,0x00
+
+ref_00021a89:
+db ' PEG%x%x (%x:%x:%x) - Root Port is not Gen3-capable. Max Link Speed = %d.',0x0a,0x00
+
+ref_00021ad4:
+db ' PEG%x%x (%x:%x:%x) - Root Port is Gen3-capable.',0x0a,0x00
+
+ref_00021b06:
+db ' PEG%x%x (%x:%x:%x) - VC0 negotiation is pending! Skipping endpoint.',0x0a,0x00
+
+ref_00021b4c:
+db ' PEG%x%x (%x:%x:%x) - Endpoint is not Gen3-capable. No PCIe Capability found.',0x0a,0x00
+
+ref_00021b9b:
+db ' PEG%x%x (%x:%x:%x) - Endpoint is not Gen3-capable. Max Link Speed = %d.',0x0a,0x00
+
+ref_00021be5:
+db ' PEG%x%x (%x:%x:%x) - Endpoint is Gen3-capable',0x0a,0x00
+
+ref_00021c15:
+db '../../intel/SystemAgent/SaInit/Pei/PcieTraining.c',0x00
+
+ref_00021c47:
+db 'Invalid Margin Test Requested.',0x0a,0x00
+
+ref_00021c67:
+db 'Preset for Lane %2d: ',0x00
+
+ref_00021c7d:
+db 'Search Result: P%d',0x00
+
+ref_00021c90:
+db 'Applying Policy value: P%d'
+
+ref_00021caa:
+db '. Saving value for next boot.',0x00
+
+ref_00021cc8:
+db 'Applying Policy value: P%d',0x00
+
+ref_00021ce3:
+db 'Restoring previous value: P%d',0x00
+
+ref_00021d01:
+db 'Illegal Lane: %d',0x00
+
+ref_00021d12:
+db 'PEG Gen3 Preset Search',0x0a,0x00
+
+ref_00021d2a:
+db ' Gen3 is disabled by policy',0x0a,0x00
+
+ref_00021d47:
+db 'Lane Reversal is Disabled',0x0a,0x00
+
+ref_00021d62:
+db 'Lane Reversal is Enabled',0x0a,0x00
+
+ref_00021d7c:
+db '../../intel/SystemAgent/SaInit/Pei/PcieTrainingPhase3.c',0x00
+
+ref_00021db4:
+db 'Calling CpuReplacementCheck',0x0a,0x00
+
+ref_00021dd1:
+db ' ME reported CPU Replacement value: %x',0x0a,0x00
+
+ref_00021df9:
+db ' PEG%x%x (%x:%x:%x) - LoadedSavedPreset = %d. EndpointDeviceChanged = %d.',0x0a,0x00
+
+ref_00021e44:
+db 'Skipping Preset Search - No Gen3 capable links',0x0a,0x00
+
+ref_00021e74:
+db 'Skipping PEG%d%d - Not Gen3 capable',0x0a,0x00
+
+ref_00021e99:
+db 'Using Lane %2d',0x27,'s Best Preset for Lanes %2d-%2d.',0x0a,0x00
+
+ref_00021eca:
+db 'PEG%d%d - Not Gen3 capable, skip coefficient programming.',0x0a,0x00
+
+ref_00021f05:
+db 'PEG Gen3 Preset Search done',0x0a
+
+ref_00021f21:
+db 0x0a
+db 0x00
+
+ref_00021f23:
+db 'GetCoefficientsFromPreset(): Unsupported Preset Requested: P%d. Using P7.',0x0a,0x00
+
+ref_00021f6e:
+db 'ConfigureTxJitterMux: System unsupported, no PEG.',0x0a,0x00
+
+ref_00021fa1:
+db 'Unsupported CPU stepping!',0x0a,0x00
+
+ref_00021fbc:
+db 'TempValue >= 47',0x00
+
+ref_00021fcc:
+db '../../intel/SystemAgent/SaInit/Pei/PcieTrainingMargining.c',0x00
+
+ref_00022007:
+db 'TempValue <= 17',0x00
+
+ref_00022017:
+db 'ProgramIobp Read Error, Address:%x AndMask:%x OrMask:%x',0x0a,0x00
+
+ref_00022050:
+db '../../intel/Pch/Library/PchPlatformLib/IobpAccess.c',0x00
+
+ref_00022084:
+db 'ProgramIobp Write Error, Address:%x AndMask:%x OrMask:%x',0x0a,0x00
+
+ref_000220be:
+db '(((*LatencyValue1) & (0x00000400 + 0x00000800 + 0x00001000)) >> 10) < 6',0x00
+
+ref_00022106:
+db '../../intel/Pch/Library/PchPciExpressHelpersLib/PchPciExpressHelpersLibrary.c',0x00
+
+ref_00022154:
+db '(((LatencyValue2) & (0x00000400 + 0x00000800 + 0x00001000)) >> 10) < 6',0x00
+
+ref_0002219b:
+db 'Endpoint Device %0x Capability ASPM: %0x',0x0a,0x00
+
+ref_000221c5:
+db 'Override root port ASPM to L1 for pre-1.1 devices',0x0a,0x00
+
+ref_000221f8:
+db 'Calculate Endpoint Device %0x Aspm Value: %0x',0x0a,0x00
+
+ref_00022227:
+db 'Program Endpoint Device %0x Aspm Value: %0x',0x0a,0x00
+
+ref_00022254:
+db 'Check DownStreamBus:%d and no device found!',0x0a,0x00
+
+ref_00022281:
+db '((BOOLEAN)(0==1))',0x00
+
+ref_00022293:
+db 'PchCpuStrapSet() - Start',0x0a,0x00
+
+ref_000222ad:
+db 'PchCpuStrapSet() - End',0x0a,0x00
+
+ref_000222c5:
+db 'PchOnMemoryInstalled() Start',0x0a,0x00
+
+ref_000222e3:
+db 'PCH Installing PcieDeviceTable HOB (%d entries)',0x0a,0x00
+
+ref_00022314:
+db 'HobPtr != 0',0x00
+
+ref_00022320:
+db '../../intel/Pch/PchInit/Pei/PchInitPeim.c',0x00
+
+ref_0002234a:
+db 'Index != 0',0x00
+
+ref_00022355:
+db 'PCH Installing PchPlatformPolicy HOB (PCH bus = %d)',0x0a,0x00
+
+ref_0002238a:
+db 'Disable Azalia: initialization error in Auto mode!',0x0a,0x00
+
+ref_000223be:
+db 'PchOnMemoryInstalled() End',0x0a,0x00
+
+ref_000223da:
+db 'Gen3TxOutVoltDnAmpAdj is out of valid range ',0x0a,0x00
+
+ref_00022408:
+db 'Gen12TxOutVoltDnAmpAdj is out of valid range ',0x0a,0x00
+
+ref_00022437:
+db 'Gen3TxOutDeEmAdj is out of valid range ',0x0a,0x00
+
+ref_00022460:
+db 'Gen12TxOutDeEmAdj is out of valid range ',0x0a,0x00
+
+ref_0002248a:
+db 'PchSataInit() - Start',0x0a,0x00
+
+ref_000224a1:
+db 'Please do not enable any SATA port before SATA  Hsio initialization is done.',0x0a,0x00
+
+ref_000224ef:
+db 'PchSataInit() - End',0x0a,0x00
+
+ref_00022504:
+db 'PchGbeMandatedReset: resetting the board via CF9 to unlock LAN Disable register...',0x0a,0x00
+
+ref_00022558:
+db 'PchGbeMandatedReset: resetting the board via CF9...',0x0a,0x00
+
+ref_0002258d:
+db 'isCLK 0xED00015C Read warning: %r',0x0a,0x00
+
+ref_000225b0:
+db 'isCLK 0xED000118 Read warning: %r',0x0a,0x00
+
+ref_000225d3:
+db 'isCLK 0xED000120 Read warning: %r',0x0a,0x00
+
+ref_000225f6:
+db 'PchInitialize() - Start',0x0a,0x00
+
+ref_0002260f:
+db '(PchPlatformPolicyPpi->Rcba & (UINT32) (~0xFFFFC000)) == 0',0x00
+
+ref_0002264a:
+db '(MmioRead32 (AcpiBarAddress) & 0xFFFC) == PchPlatformPolicyPpi->PmBase',0x00
+
+ref_00022691:
+db '(MmioRead32 (GpioBarAddress) & 0xFFFC) == PchPlatformPolicyPpi->GpioBase',0x00
+
+ref_000226da:
+db 'PchInitialize() - End',0x0a,0x00
+
+ref_000226f1:
+db 'PchConfigureInterruptRegister() Start',0x0a,0x00
+
+ref_00022718:
+db 'PchConfigureInterruptRegister() End',0x0a,0x00
+
+ref_0002273d:
+db 'PchEarlyInit() - Start',0x0a,0x00
+
+ref_00022755:
+db 'PchEarlyInit() - End',0x0a,0x00
+
+ref_0002276b:
+db 'InstallPchInitPpi() - Start',0x0a,0x00
+
+ref_00022788:
+db 'PCH SKU is not supported due to no proper PCH LPC found!',0x0a,0x00
+
+ref_000227c2:
+db 'Rcba needs to be programmed before here',0x0a,0x00
+
+ref_000227eb:
+db 'Failed to allocate memory for PchDmiTcVcMapPpiDesc! ',0x0a,0x00
+
+ref_00022821:
+db 'Failed to allocate memory for PchDmiTcVcMapPpi! ',0x0a,0x00
+
+ref_00022853:
+db 'InstallPchInitPpi() - End',0x0a,0x00
+
+ref_0002286e:
+db '------------------ PCH USB Config ------------------',0x0a,0x00
+
+ref_000228a4:
+db ' UsbPerPortCtl= %x',0x0a,0x00
+
+ref_000228b8:
+db ' Ehci1Usbr= %x',0x0a,0x00
+
+ref_000228c8:
+db ' Ehci2Usbr= %x',0x0a,0x00
+
+ref_000228d8:
+db ' PortSettings[%d] Enabled= %x',0x0a,0x00
+
+ref_000228f7:
+db ' PortSettings[%d] Location = %x',0x0a,0x00
+
+ref_00022918:
+db ' Port30Settings[%d] Enabled= %x',0x0a,0x00
+
+ref_00022939:
+db ' Usb20Settings[%d] Enabled= %x',0x0a,0x00
+
+ref_00022959:
+db ' Usb30Settings.Mode= %x',0x0a,0x00
+
+ref_00022972:
+db ' Usb30Settings.PreBootSupport= %x',0x0a,0x00
+
+ref_00022995:
+db ' Usb30Settings.Btcg= %x',0x0a,0x00
+
+ref_000229ae:
+db ' Usb30Settings.ManualMode= %x',0x0a,0x00
+
+ref_000229cd:
+db ' Usb30Settings.ManualModeUsb20PerPinRoute[%d]= EHCI',0x0a,0x00
+
+ref_00022a02:
+db ' Usb30Settings.ManualModeUsb20PerPinRoute[%d]= XHCI',0x0a,0x00
+
+ref_00022a37:
+db ' Usb30Settings.ManualModeUsb30PerPinEnable[%d]= %x',0x0a,0x00
+
+ref_00022a6b:
+db ' PortUsb20[%d].OverCurrentPin= OC%x',0x0a,0x00
+
+ref_00022a90:
+db ' PortUsb20[%d].Usb20EyeDiagramTuningParam1= %x',0x0a,0x00
+
+ref_00022ac0:
+db ' PortUsb20[%d].Usb20EyeDiagramTuningParam2= %x',0x0a,0x00
+
+ref_00022af0:
+db ' PortUsb30[%d].OverCurrentPin= OC%x',0x0a,0x00
+
+ref_00022b15:
+db ' PortUsb30[%d].FixedEqualization = %x',0x0a,0x00
+
+ref_00022b3c:
+db ' Usb20PortLength[%d]= %x.%0x',0x0a,0x00
+
+ref_00022b5a:
+db '------------------ PCH USB 3.0 Iobp Config ------------------',0x0a,0x00
+
+ref_00022b99:
+db ' Usb30IobpConfig[%d].Usb30TxOutVoltDnAmpAdj= %x',0x0a,0x00
+
+ref_00022bca:
+db ' Usb30IobpConfig[%d].Usb30TxOutImpScVoltAmpAdj= %x',0x0a,0x00
+
+ref_00022bfe:
+db ' Usb30IobpConfig[%d].Usb30TxOutDeEmpAdj= %x',0x0a,0x00
+
+ref_00022c2b:
+db ' Usb30IobpConfig[%d].Usb30TxOutAdjEn= %x',0x0a,0x00
+
+ref_00022c55:
+db ' Usb30IobpConfig[%d].Usb30TxOutImpAdjVoltAmp= %x',0x0a,0x00
+
+ref_00022c87:
+db ' Usb30IobpConfig[%d].Usb30TxOutVoltDnAmpAdjEnable= %x',0x0a,0x00
+
+ref_00022cbe:
+db ' Usb30IobpConfig[%d].Usb30TxOutImpScVoltAmpAdjEnable= %x',0x0a,0x00
+
+ref_00022cf8:
+db ' Usb30IobpConfig[%d].Usb30TxOutDeEmpAdjEnable= %x',0x0a,0x00
+
+ref_00022d2b:
+db ' Usb30IobpConfig[%d].Usb30Ecrt98Enable= %x',0x0a,0x00
+
+ref_00022d57:
+db '------------------ PCH PCIE Config ------------------',0x0a,0x00
+
+ref_00022d8e:
+db ' RootPort[%d] Enabled= %x',0x0a,0x00
+
+ref_00022da9:
+db ' RootPort[%d] Hide= %x',0x0a,0x00
+
+ref_00022dc1:
+db ' RootPort[%d] SlotImplemented= %x',0x0a,0x00
+
+ref_00022de4:
+db ' RootPort[%d] HotPlug= %x',0x0a,0x00
+
+ref_00022dff:
+db ' RootPort[%d] PmSci= %x',0x0a,0x00
+
+ref_00022e18:
+db ' RootPort[%d] ExtSync= %x',0x0a,0x00
+
+ref_00022e33:
+db ' RootPort[%d] UnsupportedRequestReport= %x',0x0a,0x00
+
+ref_00022e5f:
+db ' RootPort[%d] FatalErrorReport= %x',0x0a,0x00
+
+ref_00022e83:
+db ' RootPort[%d] NoFatalErrorReport= %x',0x0a,0x00
+
+ref_00022ea9:
+db ' RootPort[%d] CorrectableErrorReport= %x',0x0a,0x00
+
+ref_00022ed3:
+db ' RootPort[%d] PmeInterrupt= %x',0x0a,0x00
+
+ref_00022ef3:
+db ' RootPort[%d] SystemErrorOnFatalError= %x',0x0a,0x00
+
+ref_00022f1e:
+db ' RootPort[%d] SystemErrorOnNonFatalError= %x',0x0a,0x00
+
+ref_00022f4c:
+db ' RootPort[%d] SystemErrorOnCorrectableError= %x',0x0a,0x00
+
+ref_00022f7d:
+db ' RootPort[%d] AdvancedErrorReporting= %x',0x0a,0x00
+
+ref_00022fa7:
+db ' RootPort[%d] TransmitterHalfSwing= %x',0x0a,0x00
+
+ref_00022fcf:
+db ' RootPort[%d] PcieSpeed= %x',0x0a,0x00
+
+ref_00022fec:
+db ' RootPort[%d]'
+
+ref_00022ff9:
+db ' FunctionNumber= %x',0x0a,0x00
+
+ref_0002300e:
+db ' RootPort[%d] PhysicalSlotNumber= %x',0x0a,0x00
+
+ref_00023034:
+db ' RootPort[%d] CompletionTimeout= %x',0x0a,0x00
+
+ref_00023059:
+db ' RootPort[%d] Aspm= %x',0x0a,0x00
+
+ref_00023071:
+db ' RootPort[%d] L1Substates= %x',0x0a,0x00
+
+ref_00023090:
+db ' RootPort[%d]'
+
+ref_0002309d:
+db ' LtrEnable= %x',0x0a,0x00
+
+ref_000230ad:
+db ' RootPort[%d] LtrConfigLock= %x',0x0a,0x00
+
+ref_000230ce:
+db ' RootPort[%d] LtrMaxSnoopLatency= %x',0x0a,0x00
+
+ref_000230f4:
+db ' RootPort[%d] LtrMaxNoSnoopLatency= %x',0x0a,0x00
+
+ref_0002311c:
+db ' RootPort[%d] SnoopLatencyOverrideMode= %x',0x0a,0x00
+
+ref_00023148:
+db ' RootPort[%d] SnoopLatencyOverrideMultiplier= %x',0x0a,0x00
+
+ref_0002317a:
+db ' RootPort[%d] SnoopLatencyOverrideValue= %x',0x0a,0x00
+
+ref_000231a7:
+db ' RootPort[%d] NonSnoopLatencyOverrideMode= %x',0x0a,0x00
+
+ref_000231d6:
+db ' RootPort[%d] NonSnoopLatencyOverrideMultiplier= %x',0x0a,0x00
+
+ref_0002320b:
+db ' RootPort[%d] NonSnoopLatencyOverrideValue= %x',0x0a,0x00
+
+ref_0002323b:
+db ' EnableSubDecode= %x',0x0a,0x00
+
+ref_00023251:
+db ' PchPcieSbdePort= %x',0x0a,0x00
+
+ref_00023267:
+db ' RootPortClockGating= %x',0x0a,0x00
+
+ref_00023281:
+db ' RootPortFunctionSwapping= %x',0x0a,0x00
+
+ref_000232a0:
+db ' AllowNoLtrIccPllShutdown= %x',0x0a,0x00
+
+ref_000232bf:
+db '------------------ PCH SATA Config ------------------',0x0a,0x00
+
+ref_000232f6:
+db ' SataMode= %x',0x0a,0x00
+
+ref_00023305:
+db ' PortSettings[%d] HotPlug= %x',0x0a,0x00
+
+ref_00023324:
+db ' PortSettings[%d] InterlockSw= %x',0x0a,0x00
+
+ref_00023347:
+db ' PortSettings[%d] External= %x',0x0a,0x00
+
+ref_00023367:
+db ' PortSettings[%d] SpinUp= %x',0x0a,0x00
+
+ref_00023385:
+db ' PortSettings[%d] SolidStateDrive= %x',0x0a,0x00
+
+ref_000233ac:
+db ' PortSettings[%d] DevSlp= %x',0x0a,0x00
+
+ref_000233ca:
+db ' PortSettings[%d] EnableDitoConfig= %x',0x0a,0x00
+
+ref_000233f2:
+db ' PortSettings[%d] DmVal= %x',0x0a,0x00
+
+ref_0002340f:
+db ' PortSettings[%d] DitoVal= %x',0x0a,0x00
+
+ref_0002342e:
+db ' PortSettings[%d] PortRxEq GenSpeed[0]'
+
+ref_00023454:
+db ' Enable= %x',0x0a,0x00
+
+ref_00023461:
+db ' PortSettings[%d] PortRxEq GenSpeed[0] RxEq= %x',0x0a,0x00
+
+ref_00023492:
+db ' PortSettings[%d] PortRxEq GenSpeed[1] Enable= %x',0x0a,0x00
+
+ref_000234c5:
+db ' PortSettings[%d] PortRxEq GenSpeed[1] RxEq= %x',0x0a,0x00
+
+ref_000234f6:
+db ' PortSettings[%d] PortRxEq GenSpeed[2] Enable= %x',0x0a,0x00
+
+ref_00023529:
+db ' PortSettings[%d] PortRxEq GenSpeed[2] RxEq= %x',0x0a,0x00
+
+ref_0002355a:
+db ' PortSettings[%d] PortIobp Gen3TxOutVoltDnAmpAdj= %x',0x0a,0x00
+
+ref_00023590:
+db ' PortSettings[%d] PortIobp Gen12TxOutVoltDnAmpAdj= %x',0x0a,0x00
+
+ref_000235c7:
+db ' PortSettings[%d] PortIobp Gen3TxOutDeEmAdj= %x',0x0a,0x00
+
+ref_000235f8:
+db ' PortSettings[%d] PortIobp Gen12TxOutDeEmAdj= %x',0x0a,0x00
+
+ref_0002362a:
+db ' PortSettings[%d] PortIobp Gen3TxOutVoltDnAmpAdjEnable= %x',0x0a,0x00
+
+ref_00023666:
+db ' PortSettings[%d] PortIobp Gen12TxOutVoltDnAmpAdjEnable= %x',0x0a,0x00
+
+ref_000236a3:
+db ' PortSettings[%d] PortIobp Gen3TxOutDeEmAdjEnable= %x',0x0a,0x00
+
+ref_000236da:
+db ' PortSettings[%d] PortIobp Gen12TxOutDeEmAdjEnable= %x',0x0a,0x00
+
+ref_00023712:
+db ' PortSettings[%d] Sata Thermal Throttling Enabled= %x',0x0a,0x00
+
+ref_00023749:
+db ' RaidAlternateId= %x',0x0a,0x00
+
+ref_0002375f:
+db ' Raid0= %x',0x0a,0x00
+
+ref_0002376b:
+db ' Raid1= %x',0x0a,0x00
+
+ref_00023777:
+db ' Raid10= %x',0x0a,0x00
+
+ref_00023784:
+db ' Raid5= %x',0x0a,0x00
+
+ref_00023790:
+db ' Irrt= %x',0x0a,0x00
+
+ref_0002379b:
+db ' OromUiBanner= %x',0x0a,0x00
+
+ref_000237ae:
+db ' OromUiDelay= %x',0x0a,0x00
+
+ref_000237c0:
+db ' HddUnlock= %x',0x0a,0x00
+
+ref_000237d0:
+db ' LedLocate= %x',0x0a,0x00
+
+ref_000237e0:
+db ' IrrtOnly= %x',0x0a,0x00
+
+ref_000237ef:
+db ' SmartStorage= %x',0x0a,0x00
+
+ref_00023802:
+db ' SpeedSupport= %x',0x0a,0x00
+
+ref_00023815:
+db ' eSATASpeedLimit= %x',0x0a,0x00
+
+ref_0002382b:
+db ' TestMode= %x',0x0a,0x00
+
+ref_0002383a:
+db ' LegacyMode= %x',0x0a,0x00
+
+ref_0002384b:
+db ' SalpSupport= %x',0x0a,0x00
+
+ref_0002385d:
+db ' PwrOptEnable= %x',0x0a,0x00
+
+ref_00023870:
+db ' PcieNandRemap Enable= %x',0x0a,0x00
+
+ref_0002388b:
+db ' PcieNandRemap PcieNandPort= %x',0x0a,0x00
+
+ref_000238ac:
+db ' PcieNandRemap ConfigAccessLockDown= %x',0x0a,0x00
+
+ref_000238d5:
+db ' PcieNandRemap DeviceResetDelay= %x',0x0a,0x00
+
+ref_000238fa:
+db '------------------ PCH IOAPIC Config ------------------',0x0a,0x00
+
+ref_00023933:
+db ' BdfValid= %x',0x0a,0x00
+
+ref_00023942:
+db ' BusNumber= %x',0x0a,0x00
+
+ref_00023952:
+db ' DeviceNumber= %x',0x0a,0x00
+
+ref_00023965:
+db ' IoApicId= %x',0x0a,0x00
+
+ref_00023974:
+db ' ApicRangeSelect= %x',0x0a,0x00
+
+ref_0002398a:
+db ' IoApicEntry24_39= %x',0x0a,0x00
+
+ref_000239a1:
+db '------------------ PCH HPET Config ------------------',0x0a,0x00
+
+ref_000239d8:
+db ' Enable %x',0x0a,0x00
+
+ref_000239e4:
+db ' BdfValid %x',0x0a,0x00
+
+ref_000239f2:
+db ' BusNumber %x',0x0a,0x00
+
+ref_00023a01:
+db ' DeviceNumber %x',0x0a,0x00
+
+ref_00023a13:
+db ' FunctionNumber %x',0x0a,0x00
+
+ref_00023a27:
+db ' Base %x',0x0a,0x00
+
+ref_00023a31:
+db '------------------ PCH Lock Down Config ------------------',0x0a,0x00
+
+ref_00023a6d:
+db ' GlobalSmi= %x',0x0a,0x00
+
+ref_00023a7d:
+db ' BiosInterface= %x',0x0a,0x00
+
+ref_00023a91:
+db ' GpioLockDown= %x',0x0a,0x00
+
+ref_00023aa4:
+db ' RtcLock= %x',0x0a,0x00
+
+ref_00023ab2:
+db ' BiosLock= %x',0x0a,0x00
+
+ref_00023ac1:
+db ' SmmBwp= %x',0x0a,0x00
+
+ref_00023ace:
+db '------------------ PCH Flash Protection Config ------------------',0x0a,0x00
+
+ref_00023b11:
+db ' WriteProtectionEnable[%d]= %x',0x0a,0x00
+
+ref_00023b31:
+db ' ReadProtectionEnable[%d]= %x',0x0a,0x00
+
+ref_00023b50:
+db ' ProtectedRangeLimit[%d]= %x',0x0a,0x00
+
+ref_00023b6e:
+db ' ProtectedRangeBase[%d]= %x',0x0a,0x00
+
+ref_00023b8b:
+db '------------------ PCH SMBUS Config ------------------',0x0a,0x00
+
+ref_00023bc3:
+db ' SmbusIoBase= %x',0x0a,0x00
+
+ref_00023bd5:
+db ' NumRsvdSmbusAddresses= %x',0x0a,0x00
+
+ref_00023bf1:
+db ' RsvdSmbusAddressTable= {',0x00
+
+ref_00023c0b:
+db ' %02xh',0x00
+
+ref_00023c12:
+db ' }',0x0a,0x00
+
+ref_00023c16:
+db '------------------ PCH Azalia Config ------------------',0x0a,0x00
+
+ref_00023c4f:
+db ' Pme= %x',0x0a,0x00
+
+ref_00023c59:
+db ' DockSupport= %x',0x0a,0x00
+
+ref_00023c6b:
+db ' ResetWaitTimer= %x',0x0a,0x00
+
+ref_00023c80:
+db '------------------ PCH PM Config ------------------',0x0a,0x00
+
+ref_00023cb5:
+db ' PowerResetStatusClear MeWakeSts= %x',0x0a,0x00
+
+ref_00023cdb:
+db ' PowerResetStatusClear MeHrstColdSts= %x',0x0a,0x00
+
+ref_00023d05:
+db ' PowerResetStatusClear MeHrstWarmSts= %x',0x0a,0x00
+
+ref_00023d2f:
+db ' PowerResetStatusClear MeHostPowerDn= %x',0x0a,0x00
+
+ref_00023d59:
+db ' PowerResetStatusClear WolOvrWkSts= %x',0x0a,0x00
+
+ref_00023d81:
+db ' WakeConfig PmeB0S5Dis= %x',0x0a,0x00
+
+ref_00023d9d:
+db ' WakeConfig WolEnableOverride= %x',0x0a,0x00
+
+ref_00023dc0:
+db ' WakeConfig Gp27WakeFromDeepSx= %x',0x0a,0x00
+
+ref_00023de4:
+db ' WakeConfig PcieWakeFromDeepSx= %x',0x0a,0x00
+
+ref_00023e08:
+db ' WakeConfig WoWlanEnable= %x',0x0a,0x00
+
+ref_00023e26:
+db ' WakeConfig WoWlanDeepSxEnable= %x',0x0a,0x00
+
+ref_00023e4a:
+db ' PchDeepSxPol= %x',0x0a,0x00
+
+ref_00023e5d:
+db ' PchSlpS3MinAssert= %x',0x0a,0x00
+
+ref_00023e75:
+db ' PchSlpS4MinAssert= %x',0x0a,0x00
+
+ref_00023e8d:
+db ' PchSlpSusMinAssert= %x',0x0a,0x00
+
+ref_00023ea6:
+db ' PchSlpAMinAssert= %x',0x0a,0x00
+
+ref_00023ebd:
+db ' PciClockRun= %x',0x0a,0x00
+
+ref_00023ecf:
+db ' SlpStrchSusUp= %x',0x0a,0x00
+
+ref_00023ee3:
+db ' SlpLanLowDc= %x',0x0a,0x00
+
+ref_00023ef5:
+db ' LegacyDmaDisable= %x',0x0a,0x00
+
+ref_00023f0c:
+db ' PchPwrCycDur= %x',0x0a,0x00
+
+ref_00023f1f:
+db '------------------ PCH DMI Config ------------------',0x0a,0x00
+
+ref_00023f55:
+db ' DmiAspm= %x',0x0a,0x00
+
+ref_00023f63:
+db ' DmiExtSync= %x',0x0a,0x00
+
+ref_00023f74:
+db ' DmiIot= %x',0x0a,0x00
+
+ref_00023f81:
+db ' MemCloseStateEn= %x',0x0a,0x00
+
+ref_00023f97:
+db ' InternalObffEn= %x',0x0a,0x00
+
+ref_00023fac:
+db '------------------ PCH LPC SIRQ Config ------------------',0x0a,0x00
+
+ref_00023fe7:
+db ' SirqEnable= %x',0x0a,0x00
+
+ref_00023ff8:
+db ' SirqMode= %x',0x0a,0x00
+
+ref_00024007:
+db ' StartFramePulse= %x',0x0a,0x00
+
+ref_0002401d:
+db '------------------ PCH Thermal Config ------------------',0x0a,0x00
+
+ref_00024057:
+db ' ThermalAlertEnable TselLock %x',0x0a,0x00
+
+ref_00024078:
+db ' ThermalAlertEnable TscLock %x',0x0a,0x00
+
+ref_00024098:
+db ' ThermalAlertEnable TsmicLock= %x',0x0a,0x00
+
+ref_000240bb:
+db ' ThermalAlertEnable PhlcLock= %x',0x0a,0x00
+
+ref_000240dd:
+db ' ThermalThrottling TTLevels T0Level %x centigrade degree',0x0a,0x00
+
+ref_00024117:
+db ' ThermalThrottling TTLevels T1Level %x centigrade degree',0x0a,0x00
+
+ref_00024151:
+db ' ThermalThrottling TTLevels T2Level %x centigrade degree',0x0a,0x00
+
+ref_0002418b:
+db ' ThermalThrottling TTLevels TTEnable %x',0x0a,0x00
+
+ref_000241b4:
+db ' ThermalThrottling TTLevels TTState13Enable %x',0x0a,0x00
+
+ref_000241e4:
+db ' ThermalThrottling TTLevels TTLock %x',0x0a,0x00
+
+ref_0002420b:
+db ' ThermalThrottling TTLevels SuggestedSetting %x',0x0a,0x00
+
+ref_0002423c:
+db ' ThermalThrottling TTLevels PchCrossThrottling %x',0x0a,0x00
+
+ref_0002426f:
+db ' ThermalThrottling DmiHaAWC DmiTsawEn %x',0x0a,0x00
+
+ref_00024299:
+db ' ThermalThrottling DmiHaAWC TS0TW %x',0x0a,0x00
+
+ref_000242bf:
+db ' ThermalThrottling DmiHaAWC TS1TW %x',0x0a,0x00
+
+ref_000242e5:
+db ' ThermalThrottling DmiHaAWC TS2TW %x',0x0a,0x00
+
+ref_0002430b:
+db ' ThermalThrottling DmiHaAWC TS3TW %x',0x0a,0x00
+
+ref_00024331:
+db ' ThermalThrottling DmiHaAWC SuggestedSetting %x',0x0a,0x00
+
+ref_00024362:
+db ' ThermalThrottling SataTT P0T1M %x',0x0a,0x00
+
+ref_00024386:
+db ' ThermalThrottling SataTT P0T2M %x',0x0a,0x00
+
+ref_000243aa:
+db ' ThermalThrottling SataTT P0T3M %x',0x0a,0x00
+
+ref_000243ce:
+db ' ThermalThrottling SataTT P0TDisp %x',0x0a,0x00
+
+ref_000243f4:
+db ' ThermalThrottling SataTT P0Tinact %x',0x0a,0x00
+
+ref_0002441b:
+db ' ThermalThrottling SataTT P0TDispFinit %x',0x0a,0x00
+
+ref_00024446:
+db ' ThermalThrottling SataTT P1T1M %x',0x0a,0x00
+
+ref_0002446a:
+db ' ThermalThrottling SataTT P1T2M %x',0x0a,0x00
+
+ref_0002448e:
+db ' ThermalThrottling SataTT P1T3M %x',0x0a,0x00
+
+ref_000244b2:
+db ' ThermalThrottling SataTT P1TDisp %x',0x0a,0x00
+
+ref_000244d8:
+db ' ThermalThrottling SataTT P1Tinact %x',0x0a,0x00
+
+ref_000244ff:
+db ' ThermalThrottling SataTT P1TDispFinit %x',0x0a,0x00
+
+ref_0002452a:
+db ' ThermalThrottling SataTT SuggestedSetting %x',0x0a,0x00
+
+ref_00024559:
+db ' MemoryThrottling Enable= %x',0x0a,0x00
+
+ref_00024577:
+db ' MemoryThrottling TsGpioPinSetting PmsyncEnable= %x',0x0a,0x00
+
+ref_000245ac:
+db ' MemoryThrottling TsGpioPinSetting C0TransmitEnable= %x',0x0a,0x00
+
+ref_000245e5:
+db ' MemoryThrottling TsGpioPinSetting PinSelection= %x',0x0a,0x00
+
+ref_0002461a:
+db ' PchHotLevel = %x',0x0a,0x00
+
+ref_0002462d:
+db ' ThermalDeviceEnable (D31:F6) %x',0x0a,0x00
+
+ref_0002464f:
+db '------------------ PCH General Config ------------------',0x0a,0x00
+
+ref_00024689:
+db ' SubSystemVendorId= %x',0x0a,0x00
+
+ref_000246a1:
+db ' SubSystemId= %x',0x0a,0x00
+
+ref_000246b3:
+db ' Crid= %x',0x0a,0x00
+
+ref_000246be:
+db ' DciEn= %x',0x0a,0x00
+
+ref_000246ca:
+db '------------------ PCH LAN Config ------------------',0x0a,0x00
+
+ref_00024700:
+db '------------------ PCH Serial IO Config ------------------',0x0a,0x00
+
+ref_0002473c:
+db ' SerialIoGpio= %x',0x0a,0x00
+
+ref_0002474f:
+db ' SerialIoDma= %x',0x0a,0x00
+
+ref_00024761:
+db ' SerialIoI2c0= %x',0x0a,0x00
+
+ref_00024774:
+db ' SerialIoI2c1= %x',0x0a,0x00
+
+ref_00024787:
+db ' SerialIoSpi0= %x',0x0a,0x00
+
+ref_0002479a:
+db ' SerialIoSpi1= %x',0x0a,0x00
+
+ref_000247ad:
+db ' SerialIoUart0= %x',0x0a,0x00
+
+ref_000247c1:
+db ' SerialIoUart1= %x',0x0a,0x00
+
+ref_000247d5:
+db ' SerialIoSdio= %x',0x0a,0x00
+
+ref_000247e8:
+db ' I2c0VoltageSelect= %x',0x0a,0x00
+
+ref_00024800:
+db ' I2c1VoltageSelect= %x',0x0a,0x00
+
+ref_00024818:
+db ' GpioIrqRoute= %x',0x0a,0x00
+
+ref_0002482b:
+db ' DriverModeTouchPanel= %x',0x0a,0x00
+
+ref_00024846:
+db ' DriverModeTouchPad= %x',0x0a,0x00
+
+ref_0002485f:
+db ' DriverModeSensorHub= %x',0x0a,0x00
+
+ref_00024879:
+db ' Ddr50Support= %x',0x0a,0x00
+
+ref_0002488c:
+db '------------------ PCH Audio DSP Config ------------------',0x0a,0x00
+
+ref_000248c8:
+db ' AudioDspAcpiMode= %x',0x0a,0x00
+
+ref_000248df:
+db ' AudioDspD3PowerGating= %x',0x0a,0x00
+
+ref_000248fb:
+db ' AudioDspSramPowerGating= %x',0x0a,0x00
+
+ref_00024919:
+db ' AudioDspBluetoothSupport= %x',0x0a,0x00
+
+ref_00024938:
+db ' AudioDspAcpiInterruptMode= %x',0x0a,0x00
+
+ref_00024958:
+db ' AudioDspMclkOutputSelect= %x',0x0a,0x00
+
+ref_00024977:
+db ' AudioDspFeatureMask= %x',0x0a,0x00
+
+ref_00024991:
+db '------------------ PCH Platform Data ------------------',0x0a,0x00
+
+ref_000249ca:
+db ' FviSmbiosType= %x',0x0a,0x00
+
+ref_000249de:
+db ' EcPresent= %x',0x0a,0x00
+
+ref_000249ee:
+db ' TempPciBusMin= %x',0x0a,0x00
+
+ref_00024a02:
+db ' TempPciBusMax= %x',0x0a,0x00
+
+ref_00024a16:
+db ' TempMemBaseAddr= %x',0x0a,0x00
+
+ref_00024a2c:
+db ' TempMemSize= %x',0x0a,0x00
+
+ref_00024a3e:
+db '------------------ PCH Interrupt Config ------------------',0x0a,0x00
+
+ref_00024a7a:
+db ' DXXIP[%d] Offset = %x',0x0a,0x00
+
+ref_00024a92:
+db ' DXXIP[%d] Settings = %x',0x0a,0x00
+
+ref_00024aac:
+db ' DXXIR[%d] Offset = %x',0x0a,0x00
+
+ref_00024ac4:
+db ' DXXIR[%d] Settings = %x',0x0a,0x00
+
+ref_00024ade:
+db '------------------------ PCH Dump Platform Policy Start ------------------------',0x0a,0x00
+
+ref_00024b30:
+db ' Revision= %x',0x0a,0x00
+
+ref_00024b3f:
+db ' Rcba= %x',0x0a,0x00
+
+ref_00024b4a:
+db ' PmBase= %x',0x0a,0x00
+
+ref_00024b57:
+db ' GpioBase= %x',0x0a,0x00
+
+ref_00024b66:
+db ' Port80Route= %x',0x0a,0x00
+
+ref_00024b78:
+db '------------------------ PCH Dump Platform Policy End --------------------------',0x0a,0x00
+
+ref_00024bca:
+db 'PchPlatformPolicy->Rcba != '
+
+ref_00024be5:
+db 0x30
+db 0x00
+
+ref_00024be7:
+db '../../intel/Pch/PchInit/Pei/PchDebugDump.c',0x00
+
+ref_00024c12:
+db 'PchPlatformPolicy->PmBase != 0',0x00
+
+ref_00024c31:
+db 'PchPlatformPolicy->GpioBase != 0',0x00
+
+ref_00024c52:
+db 'PchPlatformPolicy->PlatformData.TempMemBaseAddr != 0',0x00
+
+ref_00024c87:
+db 'PchPlatformPolicy->PlatformData.TempMemSize >= 0x10000',0x00
+
+ref_00024cbe:
+db 'PchPlatformPolicy->PlatformData.TempIoBaseAddr != 0',0x00
+
+ref_00024cf2:
+db 'PchPlatformPolicy->PlatformData.TempIoSize >= 0x10',0x00
+
+ref_00024d25:
+db '../../intel/Pch/PchInit/Pei/PchDmiPeim.c',0x00
+
+ref_00024d4e:
+db 'TC:%0x VC:%0x!',0x0a,0x00
+
+ref_00024d5e:
+db 'VC:%0x VCID:%0x Enable:%0x!',0x0a,0x00
+
+ref_00024d7b:
+db 'PchDmiGen2Prog() Start',0x0a,0x00
+
+ref_00024d93:
+db 'PchDmiGen2Prog() End',0x0a,0x00
+
+ref_00024da9:
+db 'Usb30TxOutVoltDnAmpAdj is out of valid range ',0x0a,0x00
+
+ref_00024dd8:
+db 'Usb30TxOutImpScVoltAmpAdj is out of valid range ',0x0a,0x00
+
+ref_00024e0a:
+db 'Usb30TxOutDeEmpAdj is out of valid range ',0x0a,0x00
+
+ref_00024e35:
+db 'Usb30TxOutImpAdjVoltAmp is out of valid range ',0x0a,0x00
+
+ref_00024e65:
+db 'PchStartUsbInit() - Start',0x0a,0x00
+
+ref_00024e80:
+db 'Revision : 0x%x',0x0a,0x00
+
+ref_00024e91:
+db 'EhciMemBaseAddr : 0x%x',0x0a,0x00
+
+ref_00024ea9:
+db 'XhciMemBaseAddr : 0x%x',0x0a,0x00
+
+ref_00024ec1:
+db '../../intel/Pch/PchInit/Pei/PchUsbInit.c',0x00
+
+ref_00024eea:
+db 'PchStartUsbInit() - End',0x0a,0x00
+
+ref_00024f03:
+db 'PchUsbInit() - Start',0x0a,0x00
+
+ref_00024f19:
+db 'PchUsbInit() - End',0x0a,0x00
+
+ref_00024f2d:
+db 'Invalid Vendor ID! ',0x0a,0x00
+
+ref_00024f42:
+db 'PchInitRootPorts() Start',0x0a,0x00
+
+ref_00024f5c:
+db 'Func0PortNum <= MaxPciePortNum',0x00
+
+ref_00024f7b:
+db '../../intel/Pch/PchInit/Pei/PchRootPortsPei.c',0x00
+
+ref_00024fa9:
+db ' Root Port %x device enabled. RpEnableMask: 0x%x',0x0a,0x00
+
+ref_00024fdb:
+db 'PchInitRootPorts() End',0x0a,0x00
+
+ref_00024ff3:
+db 'ICB bit is not zero before SendCodecCommand! ',0x0a,0x00
+
+ref_00025022:
+db 'SendCodecCommand: ReadBack fail! ',0x0a,0x00
+
+ref_00025045:
+db 'VendorDeviceId != 0',0x00
+
+ref_00025059:
+db '../../intel/Pch/PchInit/Pei/PchHdaPei.c',0x00
+
+ref_00025081:
+db 'Set the ownership of I/O buffers to HD-Audio or Audio DSP subsystem',0x0a,0x00
+
+ref_000250c6:
+db 'PchAzaliaInit() Start',0x0a,0x00
+
+ref_000250dd:
+db 'Reset High Definition Audio (Azalia) Codec Time Out - 1! ',0x0a,0x00
+
+ref_00025118:
+db 'Reset High Definition Audio (Azalia) Codec Time Out - 2! ',0x0a,0x00
+
+ref_00025153:
+db 'No Azalia device is detected.',0x0a,0x00
+
+ref_00025172:
+db 'SDI%d has no Azalia device.',0x0a,0x00
+
+ref_0002518f:
+db 'Error: Reading the Codec Vendor ID/Device ID fail!',0x0a,0x00
+
+ref_000251c3:
+db 'Error: Reading the Codec Revision ID fail!',0x0a,0x00
+
+ref_000251ef:
+db 'SDI:%d Detected Azalia Codec 0x%08X rev 0x%02X',0x0a,0x00
+
+ref_0002521f:
+db 'Error: No matching Azalia codec verb table found for codec (0x%08X).',0x0a,0x00
+
+ref_00025265:
+db 'Found verb table for vendor 0x%04X devId 0x%04X rev 0x%02X (SDI:%X, size: %d dwords)',0x0a,0x00
+
+ref_000252bb:
+db '(CodecCmdData >> 28) == 0',0x00
+
+ref_000252d5:
+db 'Error loading verb table for Azalia Codec of 0x%08X',0x00
+
+ref_00025309:
+db 'PchAzaliaInit() End',0x0a,0x00
+
+ref_0002531e:
+db '../../intel/Pch/PchInit/Common/PchUsbCommon.c',0x00
+
+ref_0002534c:
+db 'PchUsbCommon XHCI Capability Pointer = 0x%x',0x0a,0x00
+
+ref_00025379:
+db 'PchUsbCommon DebugPortSsIndex = %d',0x0a,0x00
+
+ref_0002539d:
+db 'OCPin < 4',0x00
+
+ref_000253a7:
+db 'UsbConfig->PortUsb20[Index].Usb20EyeDiagramTuningParam2 < 8',0x00
+
+ref_000253e3:
+db 'UsbConfig->PortUsb20[Index].Usb20EyeDiagramTuningParam1 < 8',0x00
+
+ref_0002541f:
+db 'CommonUsbInit() - Start',0x0a,0x00
+
+ref_00025438:
+db 'CommonUsbInit() - End',0x0a,0x00
+
+ref_0002544f:
+db 'hljztL',0x00
+
+ref_00025456:
+db '(null)',0x00
+
+ref_0002545d:
+db '{%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}',0x0a,0x00
+
+ref_00025491:
+db '%s: overwrite GUID ',0x00
+
+ref_000254a5:
+db '%s: no room for a new PPI',0x0a,0x00
+
+ref_000254c0:
+db '%s: NOT_FOUND in %d entries ',0x00
+
+ref_000254dd:
+db '%s: no room for a new notifier',0x0a,0x00
+
+ref_000254fd:
+db '%s installed %d',0x0a,0x00
+
+ref_0002550e:
+db 'Invalid PEI data version, %d != %d',0x0a,0x00
+
+ref_00025532:
+db 'MRC: S3 Resume',0x0a,0x00
+
+ref_00025542:
+db 'Initializing Policy',0x0a,0x00
+
+ref_00025557:
+db 'Installing common PPI',0x0a,0x00
+
+ref_0002556e:
+db 'stall.c',0x00
+
+ref_00025576:
+db 'Generating Random number...',0x0a,0x00
+
+ref_00025593:
+db 'Exiting Random number: %08Xh',0x0a,0x00
+
+ref_000255b1:
+db 'Post Code: %04Xh',0x0a,0x00
+
+ref_000255c3:
+db 'Returned From MrcStartMemoryConfiguration(). MrcStatus = %08Xh',0x0a,0x00
+
+ref_00025603:
+db '(Bus <= 0xFF) && (Device <= 0x1F) && (Function <= 0x7)',0x00
+
+ref_0002563a:
+db '../policy/MrcOemPlatform.c',0x00
+
+ref_00025655:
+db 'Pch PEI Platform Policy Initialization Done ',0x0a,0x00
+
+ref_00025683:
+db '../../intel/SampleCode/PolicyInit/Pei/PolicyInitPei.c',0x00
+
+ref_000256b9:
+db 'CPU PEI Platform Policy Initialization Done ',0x0a,0x00
+
+ref_000256e7:
+db 'Me PEI Platform Policy Initialization Done ',0x0a,0x00
+
+ref_00025714:
+db 'SystemAgent PEI Platform Policy Initialization Done ',0x0a,0x00
+
+ref_0002574a:
+db '((UINTN)Buffer & (sizeof (Guid->Data1) - 1)) == 0',0x00
+
+ref_0002577c:
+db '../../UDK2010.SR1/MdePkg/Library/BaseMemoryLibOptPei/MemLibGuid.c',0x00
+
+ref_000257be:
+db 'Length <= (0xFFFFFFFF - (UINTN)Buffer + 1)',0x00
+
+ref_000257e9:
+db '(Length & (sizeof (*GuidPtr) - 1)) == 0',0x00
+
+ref_00025811:
+db '!(Buffer == ((void *) 0) && Length > 0)',0x00
+
+ref_00025839:
+db '../../UDK2010.SR1/MdePkg/Library/BaseMemoryLibOptPei/ZeroMemWrapper.c',0x00
+
+ref_0002587f:
+db 'DestinationBuffer != ((void *) 0)',0x00
+
+ref_000258a1:
+db '../../UDK2010.SR1/MdePkg/Library/BaseMemoryLibOptPei/CompareMemWrapper.c',0x00
+
+ref_000258ea:
+db 'SourceBuffer != ((void *) 0)',0x00
+
+ref_00025907:
+db '(Length - 1) <= (0xFFFFFFFF - (UINTN)DestinationBuffer)',0x00
+
+ref_0002593f:
+db '(Length - 1) <= (0xFFFFFFFF - (UINTN)SourceBuffer)',0x00
+
+ref_00025972:
+db '../../UDK2010.SR1/MdePkg/Library/BaseMemoryLibOptPei/CopyMemWrapper.c',0x00
+
+ref_000259b8:
+db 'Count < 64',0x00
+
+ref_000259c3:
+db '../../UDK2010.SR1/MdePkg/Library/BaseLib/RShiftU64.c',0x00
+
+ref_000259f8:
+db '../../UDK2010.SR1/MdePkg/Library/BaseLib/Unaligned.c',0x00
+
+ref_00025a2d:
+db 'Divisor != 0',0x00
+
+ref_00025a3a:
+db '../../UDK2010.SR1/MdePkg/Library/BaseLib/ModU64x32.c',0x00
+
+ref_00025a6f:
+db '../../UDK2010.SR1/MdePkg/Library/BaseLib/DivU64x32.c',0x00
+
+ref_00025aa4:
+db '../../UDK2010.SR1/MdePkg/Library/BaseLib/DivU64x32Remainder.c',0x00
+
+ref_00025ae2:
+db 'EndBit < sizeof (Value) * 8',0x00
+
+ref_00025afe:
+db '../../UDK2010.SR1/MdePkg/Library/BaseLib/X86Msr.c',0x00
+
+ref_00025b30:
+db 'StartBit <= EndBit',0x00
+
+ref_00025b43:
+db 'EndBit < sizeof (OrData) * 8',0x00
+
+ref_00025b60:
+db 'EndBit < sizeof (AndData) * 8',0x00
+
+ref_00025b7e:
+db '../../UDK2010.SR1/MdePkg/Library/BaseIoLibIntrinsic/IoLib.c',0x00
+
+ref_00025bba:
+db '(Address & 1) == 0',0x00
+
+ref_00025bcd:
+db '(Address & 3) == 0',0x00
+
+ref_00025be0:
+db '(Address & 7) == 0',0x00
+
+ref_00025bf3:
+db '(Port & 1) == 0',0x00
+
+ref_00025c03:
+db '../../UDK2010.SR1/MdePkg/Library/BaseIoLibIntrinsic/IoLibGcc.c',0x00
+
+ref_00025c42:
+db '(Port & 3) == 0',0x00
+
+ref_00025c52:
+db '../../UDK2010.SR1/MdePkg/Library/PeiHobLib/HobLib.c',0x00
+
+ref_00025c86:
+db 'HobList != ((void *) 0)',0x00
+
+ref_00025c9e:
+db 'HobStart != ((void *) 0)',0x00
+
+ref_00025cb7:
+db 'Hob != ((void *) 0)',0x00
+
+ref_00025ccb:
+db '((MemoryAllocationModule & (0x00001000 - 1)) == 0) && ((ModuleLength & (0x00001000 - 1)) == 0)',0x00
+
+ref_00025d2a:
+db 'Guid != ((void *) 0)',0x00
+
+ref_00025d3f:
+db 'DataLength <= (0xFFF8 - sizeof (EFI_HOB_GUID_TYPE))',0x00
+
+ref_00025d73:
+db 'Data != ((void *) 0) || DataLength == 0',0x00
+
+ref_00025d9b:
+db '((BaseAddress & (0x00001000 - 1)) == 0) && ((Length & (0x00001000 - 1)) == 0)',0x00
+
+ref_00025de9:
+db 'FvInfoPpi != ((void *) 0)',0x00
+
+ref_00025e03:
+db '../../UDK2010.SR1/MdePkg/Library/PeiServicesLib/PeiServicesLib.c',0x00
+
+ref_00025e44:
+db 'ParentFvNameValue != ((void *) 0)',0x00
+
+ref_00025e66:
+db 'ParentFileNameValue != ((void *) 0)',0x00
+
+ref_00025e8a:
+db 'FvInfoPpiDescriptor != ((void *) 0)',0x00
+
+ref_00025eae:
+db 'PeiServicesTablePointer != ((void *) 0)',0x00
+
+ref_00025ed6:
+db '../../UDK2010.SR1/MdePkg/Library/PeiServicesTablePointerLib/PeiServicesTablePointer.c',0x00
+
+ref_00025f2c:
+db 'gPeiServices != ((void *) 0)',0x00
+
+ref_00025f49:
+db 'Pages != 0',0x00
+
+ref_00025f54:
+db '../../UDK2010.SR1/MdePkg/Library/PeiMemoryAllocationLib/MemoryAllocationLib.c',0x00
+
+ref_00025fa2:
+db '(Alignment & (Alignment - 1)) == 0',0x00
+
+ref_00025fc5:
+db 'Pages <= (0xFFFFFFFF - (((Alignment) >> 12) + (((Alignment) & 0xFFF) ? 1 : 0)))',0x00
+
+ref_00026015:
+db 'AllocationSize <= (0xFFFFFFFF - (UINTN) Buffer + 1)',0x00
+
+ref_00026049:
+db '!((BOOLEAN) (((SmBusAddress) & 0x00400000) != 0))',0x00
+
+ref_0002607b:
+db '../../UDK2010.SR1/MdePkg/Library/PeiSmbusLibSmbus2Ppi/SmbusLib.c',0x00
+
+ref_000260bc:
+db '(((SmBusAddress) >> 8) & 0xff) == 0',0x00
+
+ref_000260e0:
+db '(((SmBusAddress) >> 16) & 0x3f) == 0',0x00
+
+ref_00026105:
+db '((SmBusAddress) & ~(0x00800000 - 2)) == 0',0x00
+
+ref_0002612f:
+db '(((SmBusAddress) >> 16) & 0x3f) >= 1',0x00
+
+ref_00026154:
+db '(((SmBusAddress) >> 16) & 0x3f) <= 32',0x00
+
+ref_0002617a:
+db 'WriteBuffer != ((void *) 0)',0x00
+
+ref_00026196:
+db 'Read'
+
+ref_0002619a:
+db 'Buffer != ((void *) 0)',0x00
+
+ref_000261b1:
+db '../../UDK2010.SR1/MdePkg/Library/PeiSmbusLibSmbus2Ppi/PeiSmbusLib.c',0x00
+
+ref_000261f5:
+db 'SmbusPpi != ((void *) 0)',0x00
+
+ref_0002620e:
+db 'CpuIO PPI has been loaded into memory.  Reinstalled PPI=0x%x',0x0a,0x00
+
+ref_0002624c:
+db '../../UDK2010.SR1/UefiCpuPkg/CpuIoPei/CpuIoPei.c',0x00
+
+ref_0002627d:
+db 'PEI SmbusExecute() Start, SmbusDeviceAddress=%x, Command=%x, Operation=%x',0x0a,0x00
+
+ref_000262c8:
+db 'CR has Bad Signature',0x00
+
+ref_000262dd:
+db '../../intel/Pch/Smbus/Pei/PchSmbusEntry.c',0x00
+
+ref_00026307:
+db 'PEI SmbusExecute() End',0x0a,0x00
+
+ref_0002631f:
+db 'InitializePchSmbusPeim() Start',0x0a,0x00
+
+ref_0002633f:
+db 'Failed to allocate memory for Private! ',0x0a,0x00
+
+ref_00026368:
+db 'InitializePchSmbusPeim() End',0x0a,0x00
+
+ref_00026386:
+db 'SmbusIoBase != 0x0000FFE0 && SmbusIoBase != 0',0x00
+
+ref_000263b4:
+db '../../intel/Pch/Smbus/Common/PchSmbusExec.c',0x00
+
+ref_000263e0:
+db 'InstallPchReset() Start',0x0a,0x00
+
+ref_000263f9:
+db '../../intel/Pch/Reset/Pei/PchReset.c',0x00
+
+ref_0002641e:
+db 'InstallPchReset() End',0x0a,0x00
+
+ref_00026435:
+db 'Please do the global reset through HECI ',0x0a,0x00
+
+ref_0002645f:
+db 'None of Pch Reset Callback Ppi is found .',0x0a,0x00
+
+ref_0002648a:
+db 'Failed to locate Pch Reset Callback Ppi.',0x0a,0x00
+
+ref_000264b4:
+db 'LptHC0',0x00
+
+ref_000264bb:
+db 'LptLpB0',0x00
+
+ref_000264c3:
+db 'WptLpB0',0x00
+
+ref_000264cb:
+db 'PCH code doesn',0x27,'t support the LpcDeviceId: 0x%04x!',0x0a,0x00
+
+ref_000264fe:
+db 'Unsupported PCH SKU, LpcDeviceId: 0x%04x!',0x0a,0x00
+
+ref_00026529:
+db '../../intel/Pch/Library/PchPlatformLib/PchPlatformLibrary.c',0x00
+
+ref_00026565:
+db 'GbePortSel=%d',0x0a,0x00
+
+ref_00026574:
+db 'ConfigureDisplay() Start',0x0a,0x00
+
+ref_0002658e:
+db 'ConfigureDisplay() End',0x0a,0x00
+
+ref_000265a6:
+db 'CPU stepping = %x and CpuFamily = %x  is not supported !',0x0a,0x00
+
+ref_000265e0:
+db 'Unsupported CPU SKU, CpuFamilyId: 0x%08X!',0x0a,0x00
+
+ref_0002660b:
+db '../../intel/Cpu/Library/CpuPlatformLib/CpuPlatformLibrary.c',0x00
+
+ref_00026647:
+db 'NumberOfEnabledCoresPerDie != ((void *) 0)',0x00
+
+ref_00026672:
+db 'NumberOfEnabledThreadsPerCore != ((void *) 0)',0x00
+
+ref_000266a0:
+db 'NumberOfDiesPerPackage != ((void *) 0)',0x00
+
+ref_000266c7:
+db 'NumberOfPackages != ((void *) 0)',0x00
+
+ref_000266e8:
+db '(MAILBOX) Mailbox interface timed out.',0x0a,0x00
+
+ref_00026710:
+db '(MAILBOX) Mailbox Write Command = %2Xh',0x0a,0x00
+
+ref_00026738:
+db '(MAILBOX) Mailbox read data is corrupted.',0x0a,0x00
+
+ref_00026763:
+db '(MAILBOX) Unrecognized Mailbox Type.',0x0a,0x00
+
+ref_00026789:
+db '(MAILBOX) Mailbox Status = %2Xh',0x0a,0x00
+
+ref_000267aa:
+db '(MAILBOX) Mailbox Read Command = %2Xh',0x0a,0x00
+
+ref_000267d1:
+db 'Read PCH Power Limit from PCODE Mail Box : %x ',0x0a,0x00
+
+ref_00026801:
+db '(OC MAILBOX) Unknown Command ID',0x0a,0x00
+
+ref_00026822:
+db '%s:%d pool cookie corrupted...',0x0a,0x00
+
+ref_00026842:
+db '%s:%d failed to allocate %d bytes...',0x0a,0x00
+
+ref_00026868:
+db 'No memory to create HOB of %d bytes!',0x0a,0x00
+
+ref_0002688e:
+db 'Created hob: %x %u at %p',0x0a,0x00
+
+ref_000268a8:
+db 'SaPlatformPolicyPpi != ((void *) 0)',0x00
+
+ref_000268cc:
+db '../policy/SaPolicyInitPei.c',0x00
+
+ref_000268e8:
+db 'SaPlatformPolicyPpiDesc != ((void *) 0)',0x00
+
+ref_00026910:
+db 'PlatformData != ((void *) 0)',0x00
+
+ref_0002692d:
+db 'GtConfig != ((void *) 0)',0x00
+
+ref_00026946:
+db 'MemConfig != ((void *) 0)',0x00
+
+ref_00026960:
+db 'MemConfigNoCrc != ((void *) 0)',0x00
+
+ref_0002697f:
+db 'PcieConfig != ((void *) 0)',0x00
+
+ref_0002699a:
+db 'PegGpioData != ((void *) 0)',0x00
+
+ref_000269b6:
+db 'OcConfig != ((void *) 0)',0x00
+
+ref_000269cf:
+db '../policy/PchPolicyInitPei.c',0x00
+
+ref_000269ec:
+db '../policy/PchPolicyInitUsb.c',0x00
+
+ref_00026a09:
+db 'CpuPlatformPolicyPpi != ((void *) 0)',0x00
+
+ref_00026a2e:
+db '../policy/CpuPolicyInitPei.c',0x00
+
+ref_00026a4b:
+db 'CpuPlatformPolicyPpiDesc != ((void *) 0)',0x00
+
+ref_00026a74:
+db 'CpuConfig != ((void *) 0)',0x00
+
+ref_00026a8e:
+db 'SecurityConfig != ((void *) 0)',0x00
+
+ref_00026aad:
+db 'PowerMgmtConfig != ((void *) 0)',0x00
+
+ref_00026acd:
+db 'MePlatformPolicyPpi != ((void *) 0)',0x00
+
+ref_00026af1:
+db '../policy/MePolicyInitPei.c',0x00
+
+ref_00026b0d:
+db 'MePlatformPolicyPpiDesc != ((void *) 0)',0x00
+
+ref_00026b35:
+db 'ME PEI Platform Policy PPI Installed',0x0a,0x00
+
+ref_00026b5b:
+db '(Length - 1) <= (0xFFFFFFFF - (UINTN)Buffer)',0x00
+
+ref_00026b88:
+db '../../UDK2010.SR1/MdePkg/Library/BaseMemoryLibOptPei/SetMemWrapper.c',0x00
+
+ref_00026bcd:
+db '../../UDK2010.SR1/MdePkg/Library/BaseMemoryLibOptPei/SetMem32Wrapper.c',0x00
+
+ref_00026c14:
+db '(((UINTN)Buffer) & (sizeof (Value) - 1)) == 0',0x00
+
+ref_00026c42:
+db '(Length & (sizeof (Value) - 1)) == 0',0x00
+
+ref_00026c67:
+db '(OrData >> (EndBit - StartBit)) == ((OrData >> (EndBit - StartBit)) & 1)',0x00
+
+ref_00026cb0:
+db '../../UDK2010.SR1/MdePkg/Library/BaseLib/BitField.c',0x00
+
+ref_00026ce4:
+db '(AndData >> (EndBit - StartBit)) == ((AndData >> (EndBit - StartBit)) & 1)',0x00
+
+ref_00026d2f:
+db 'EndBit < 8',0x00
+
+ref_00026d3a:
+db 'EndBit < 16',0x00
+
+ref_00026d46:
+db 'EndBit < 32',0x00
+
+ref_00026d52:
+db 'EndBit < 64',0x00
+
+ref_00026d5e:
+db 'RShiftU64 (OrData, EndBit - StartBit) == (RShiftU64 (OrData, EndBit - StartBit) & 1)',0x00
+
+ref_00026db3:
+db 'RShiftU64 (AndData, EndBit - StartBit) == (RShiftU64 (AndData, EndBit - StartBit) & 1)',0x00
+
+ref_00026e0a:
+db '../../UDK2010.SR1/MdePkg/Library/BaseLib/LShiftU64.c',0x00
+
+ref_00026e3f:
+db '../../UDK2010.SR1/MdePkg/Library/BaseLib/DivU64x64Remainder.c',0x00
+
+ref_00026e7d:
+db 'PchResetInstance->PchRootComplexBar != 0',0x00
+
+ref_00026ea6:
+db 0x2e
+db 0x2e
+dd 0x2f2e2e2f
+dd 0x65746e69
+dd 0x63502f6c
+dd 0x65522f68
+dd 0x2f746573
+dd 0x6d6d6f43
+dd 0x502f6e6f
+dd 0x65526863
+dd 0x43746573
+dd 0x6f6d6d6f
+dd 0x00632e6e
+dd 0x90669066
+
+ref_00026ed8:
+dd 0x80000020
+dd ref_0002908c
+dd fcn_00000197
+
+ref_00026ee4:
+dd 0x80000020
+dd ref_0002909c
+dd fcn_000000ce
+
+ref_00026ef0:
+dd 0x80000010
+dd ref_0002931c
+dd 0x00000000
+
+ref_00026efc:
+dd 0x00014001
+dd 0x00022101
+dd 0x00034003
+dd 0x00045004
+dd 0x00056105
+dd 0x00068006
+dd 0x00078107
+dd 0x0008a108
+dd 0x0009c009
+dd 0x000ac10a
+dd 0x000be10b
+dd 0x010c800c
+dd 0x010d810d
+dd 0x010e910e
+dd 0x010fa00f
+dd 0x0110a110
+dd 0x0111b111
+dd 0x0112c012
+dd 0x0113c113
+dd 0x0114d114
+dd 0x0115e015
+dd 0x0116e116
+dd 0x0117f117
+dd 0x0118f618
+
+ref_00026f5c:
+dd 0x00000020
+dd ref_000291dc
+dd fcn_0000d87f
+dd 0x80000040
+dd ref_0002909c
+dd fcn_0000be41
+
+ref_00026f74:
+dd 0x80000010
+dd ref_0002914c
+dd 0x00000000
+
+ref_00026f80:
+dd 0x80000010
+dd ref_000291ac
+dd ref_00026f8c
+
+ref_00026f8c:
+dd fcn_000118c3
+dd fcn_00010bc2
+dd fcn_00010d5e
+dd fcn_0000bd38
+
+ref_00026f9c:
+dd 0x02353140
+dd 0x20373144
+dd 0x32103146
+dd 0x32163148
+dd 0x3250314c
+dd 0x76543150
+dd 0x00063158
+dd 0x55443164
+dd 0x00073168
+
+ref_00026fc0:
+dd 0x02353140
+dd 0x20373144
+dd 0x32103146
+dd 0x32163148
+dd 0x3250314c
+dd 0x76543150
+
+ref_00026fd8:
+dd 0x00003100
+dd 0x03203200
+dd 0x00003108
+dd 0x00000001
+dd 0x0000310c
+dd 0x43214321
+dd 0x00003110
+dd 0x00000001
+dd 0x00003118
+dd 0x00000001
+
+ref_00027000:
+dd 0x00003100
+dd 0x03203200
+dd 0x00003108
+dd 0x00000001
+dd 0x0000310c
+dd 0x43214321
+dd 0x00003110
+dd 0x00000001
+dd 0x00003114
+dd 0x00000001
+dd 0x00003118
+dd 0x00000001
+
+ref_00027030:
+dd 0x00000000
+dd 0x00000001
+dd 0x00000002
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000003
+dd 0x01010001
+dd 0x07010201
+dd 0xe9002440
+dd 0xe9002640
+dd 0xe9000840
+dd 0xe9000a40
+dd 0xe9000c40
+dd 0xe9000e40
+dd 0xe9001040
+dd 0xe9001240
+dd 0xea002040
+dd 0xea002240
+dd 0xea002440
+dd 0xea002640
+dd 0xe9002e40
+dd 0xe9002c40
+dd 0xe9002a40
+dd 0xe9002840
+dd 0xe9002640
+dd 0xe9002440
+dd 0xe9002240
+dd 0xe9002040
+dd 0xea002040
+dd 0xea002240
+
+ref_000270b0:
+dd 0xe9002168
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002160
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9002160
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe900215c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe90021cc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002170
+dd 0xffffff9f
+dd 0x00000000
+dd 0xe9002368
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002360
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9002360
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe900235c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe90023cc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002370
+dd 0xffffff9f
+dd 0x00000000
+dd 0xe9002568
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002560
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9002560
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe900255c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe90025cc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002570
+dd 0xffffff9f
+dd 0x00000000
+dd 0xe9002768
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002760
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9002760
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe900275c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe90027cc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002770
+dd 0xffffff9f
+dd 0x00000000
+
+ref_000271d0:
+dd 0xe9001768
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9001760
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9001760
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe900175c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe90017cc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9001770
+dd 0xffffff9f
+dd 0x00000000
+dd 0xe9001568
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9001560
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9001560
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe900155c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe90015cc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9001570
+dd 0xffffff9f
+dd 0x00000000
+dd 0xe9002f68
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002f60
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9002f60
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe9002f5c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe9002fcc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002f70
+dd 0xffffff9f
+dd 0x00000000
+dd 0xe9002d68
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002d60
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9002d60
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe9002d5c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe9002dcc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9002d70
+dd 0xffffff9f
+dd 0x00000000
+dd 0xe9003368
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9003360
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9003360
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe900335c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe90033cc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9003370
+dd 0xffffff9f
+dd 0x00000000
+dd 0xe9003168
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9003160
+dd 0xfffffffd
+dd 0x00000002
+dd 0xe9003160
+dd 0xfffffffe
+dd 0x00000001
+dd 0xe900315c
+dd 0xc0ffffff
+dd 0x05000000
+dd 0xe90031cc
+dd 0xfeffffff
+dd 0x01000000
+dd 0xe9003170
+dd 0xffffff9f
+dd 0x00000000
+
+ref_00027380:
+dd 0x00000530
+dd 0x00000540
+dd 0x00000550
+dd 0x00000560
+
+ref_00027390:
+dd 0x00000480
+dd 0x00000490
+dd 0x000004a0
+dd 0x000004b0
+dd 0x000004c0
+dd 0x000004d0
+dd 0x000004e0
+dd 0x000004f0
+dd 0x00000500
+dd 0x00000510
+dd 0x00000520
+
+ref_000273bc:
+dd 0x00000510
+dd 0x00000520
+dd 0x00000530
+dd 0x00000540
+
+ref_000273cc:
+dd 0x00000570
+dd 0x00000580
+dd 0x00000590
+dd 0x000005a0
+dd 0x000005b0
+dd 0x000005c0
+
+ref_000273e4:
+dd 0x00000480
+dd 0x00000490
+dd 0x000004a0
+dd 0x000004b0
+dd 0x000004c0
+dd 0x000004d0
+dd 0x000004e0
+dd 0x000004f0
+dd 0x00000500
+
+ref_00027408:
+dd 0x00000480
+dd 0x00000490
+dd 0x000004a0
+dd 0x000004b0
+dd 0x000004c0
+dd 0x000004d0
+dd 0x000004e0
+dd 0x000004f0
+dd 0x00000500
+dd 0x00000510
+dd 0x00000520
+dd 0x00000530
+dd 0x00000540
+dd 0x00000550
+dd 0x00000560
+
+ref_00027444:
+dd 0x00000000
+dd 0xea002554
+dd 0xffffc0ff
+dd 0x00000000
+dd 0xea002558
+dd 0xffffffc0
+dd 0x00000001
+dd 0xea002754
+dd 0xffffc0ff
+dd 0x00000001
+dd 0xea002758
+dd 0xffffffc0
+dd 0x00000002
+dd 0xea000954
+dd 0xffffc0ff
+dd 0x00000002
+dd 0xea000958
+dd 0xffffffc0
+dd 0x00000003
+dd 0xea000b54
+dd 0xffffc0ff
+dd 0x00000003
+dd 0xea000b58
+dd 0xffffffc0
+dd 0x00010000
+dd 0xea002554
+dd 0xc0ffffc0
+dd 0x00010001
+dd 0xea002754
+dd 0xc0ffffc0
+dd 0x00010002
+dd 0xea000954
+dd 0xc0ffffc0
+dd 0x00010003
+dd 0xea000b54
+dd 0xc0ffffc0
+dd 0x00020000
+dd 0xea002550
+dd 0xc0ffffff
+dd 0x00020000
+dd 0xea002554
+dd 0xffc0ffff
+dd 0x00020001
+dd 0xea002750
+dd 0xc0ffffff
+dd 0x00020001
+dd 0xea002754
+dd 0xffc0ffff
+dd 0x00020002
+dd 0xea000950
+dd 0xc0ffffff
+dd 0x00020002
+dd 0xea000954
+dd 0xffc0ffff
+dd 0x00020003
+dd 0xea000b50
+dd 0xc0ffffff
+dd 0x00020003
+dd 0xea000b54
+dd 0xffc0ffff
+
+ref_00027534:
+dd 0x00000004
+dd 0xea002154
+dd 0xffffc0ff
+dd 0x00000004
+dd 0xea002158
+dd 0xffffffc0
+dd 0x00000005
+dd 0xea002354
+dd 0xffffc0ff
+dd 0x00000005
+dd 0xea002358
+dd 0xffffffc0
+dd 0x00010004
+dd 0xea002154
+dd 0xc0ffffc0
+dd 0x00010005
+dd 0xea002354
+dd 0xc0ffffc0
+dd 0x00020004
+dd 0xea002150
+dd 0xc0ffffff
+dd 0x00020004
+dd 0xea002154
+dd 0xffc0ffff
+dd 0x00020005
+dd 0xea002350
+dd 0xc0ffffff
+dd 0x00020005
+dd 0xea002354
+dd 0xffc0ffff
+
+ref_000275ac:
+dd 0xea002490
+dd 0xffff0000
+dd 0x00003e67
+dd 0xea002690
+dd 0xffff0000
+dd 0x00003e67
+dd 0xea000890
+dd 0xffff0000
+dd 0x00003e67
+dd 0xea000a90
+dd 0xffff0000
+dd 0x00003e67
+
+ref_000275dc:
+dd 0xea002090
+dd 0xffff0000
+dd 0x00003e67
+dd 0xea002290
+dd 0xffff0000
+dd 0x00003e67
+
+ref_000275f4:
+dd 0xea002490
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea002690
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea000890
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea000a90
+dd 0xffff0000
+dd 0x00004c5a
+
+ref_00027624:
+dd 0xea002090
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea002290
+dd 0xffff0000
+dd 0x00004c5a
+
+ref_0002763c:
+dd 0xe9002e08
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9002c08
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9002a08
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9002808
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9002608
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9002408
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9002208
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9002008
+dd 0x0ffffeff
+dd 0xe0000100
+
+ref_0002769c:
+dd 0xe90031cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe90033cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe90015cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe90017cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe9003168
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe9003368
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe9001568
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe9001768
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe900316c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900336c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900156c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900176c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900314c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe900334c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe900154c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe900174c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe9003114
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9003314
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9001514
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9001714
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9003164
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9003364
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9001564
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9001764
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9003170
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9003370
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9001570
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9001770
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9003038
+dd 0xc0fffff0
+dd 0x0700000b
+dd 0xe9003238
+dd 0xc0fffff0
+dd 0x0700000b
+dd 0xe9001438
+dd 0xc0fffff0
+dd 0x0700000b
+dd 0xe9001638
+dd 0xc0fffff0
+dd 0x0700000b
+dd 0xe9003140
+dd 0xff7fffff
+dd 0x00000000
+dd 0xe9003340
+dd 0xff7fffff
+dd 0x00000000
+dd 0xe9001540
+dd 0xff7fffff
+dd 0x00000000
+dd 0xe9001740
+dd 0xff7fffff
+dd 0x00000000
+
+ref_0002784c:
+dd 0xe9002c2c
+dd 0xfffff8ff
+dd 0x00000100
+dd 0xe9002e2c
+dd 0xfffff8ff
+dd 0x00000100
+dd 0xe9002dcc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe9002fcc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe9002d68
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe9002f68
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe9002d6c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe9002f6c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe9002d4c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe9002f4c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe9002d14
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002f14
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002d64
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002f64
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002d70
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002f70
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002c38
+dd 0xc0fffff0
+dd 0x0700000b
+dd 0xe9002e38
+dd 0xc0fffff0
+dd 0x0700000b
+dd 0xe9002d40
+dd 0xff7fffff
+dd 0x00000000
+dd 0xe9002f40
+dd 0xff7fffff
+dd 0x00000000
+
+ref_0002793c:
+dd 0xea008008
+dd 0x00ffffff
+dd 0x1c000000
+dd 0xea002408
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002608
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea000808
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea000a08
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002438
+dd 0xc0fffff0
+dd 0x0700000d
+dd 0xea002638
+dd 0xc0fffff0
+dd 0x0700000d
+dd 0xea000838
+dd 0xc0fffff0
+dd 0x0700000d
+dd 0xea000a38
+dd 0xc0fffff0
+dd 0x0700000d
+dd 0xea002440
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002640
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea000840
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea000a40
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002410
+dd 0x0000ffff
+dd 0x0d510000
+dd 0xea002610
+dd 0x0000ffff
+dd 0x0d510000
+dd 0xea000810
+dd 0x0000ffff
+dd 0x0d510000
+dd 0xea000a10
+dd 0x0000ffff
+dd 0x0d510000
+dd 0xea00242c
+dd 0xfffdf7ff
+dd 0x00020000
+dd 0xea00262c
+dd 0xfffdf7ff
+dd 0x00020000
+dd 0xea00082c
+dd 0xfffdf7ff
+dd 0x00020000
+dd 0xea000a2c
+dd 0xfffdf7ff
+dd 0x00020000
+dd 0xea002418
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002618
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea000818
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea000a18
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002400
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002600
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea000800
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea000a00
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002428
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea002628
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea000828
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea000a28
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea00241c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00261c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00081c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea000a1c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00248c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea00268c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea00088c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea000a8c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea0024a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0026a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0008a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea000aa4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0024ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea0026ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea0008ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea000aac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea002540
+dd 0xff000000
+dd 0x00140718
+dd 0xea002740
+dd 0xff000000
+dd 0x00140718
+dd 0xea000940
+dd 0xff000000
+dd 0x00140718
+dd 0xea000b40
+dd 0xff000000
+dd 0x00140718
+dd 0xea002544
+dd 0xff000000
+dd 0x00140998
+dd 0xea002744
+dd 0xff000000
+dd 0x00140998
+dd 0xea000944
+dd 0xff000000
+dd 0x00140998
+dd 0xea000b44
+dd 0xff000000
+dd 0x00140998
+dd 0xea002548
+dd 0xff000000
+dd 0x00140998
+dd 0xea002748
+dd 0xff000000
+dd 0x00140998
+dd 0xea000948
+dd 0xff000000
+dd 0x00140998
+dd 0xea000b48
+dd 0xff000000
+dd 0x00140998
+dd 0xea00257c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00277c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00097c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea000b7c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea002578
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea002778
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea000978
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea000b78
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea00250c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea00270c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea00090c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea000b0c
+dd 0xffc7fff0
+dd 0x00000005
+
+ref_00027ca8:
+dd 0xea002008
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002208
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002038
+dd 0xc0fffff0
+dd 0x0700000d
+dd 0xea002238
+dd 0xc0fffff0
+dd 0x0700000d
+dd 0xea00202c
+dd 0xfffdf0ff
+dd 0x00020100
+dd 0xea00222c
+dd 0xfffdf0ff
+dd 0x00020100
+dd 0xea002040
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002240
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002010
+dd 0x0000ffff
+dd 0x0d510000
+dd 0xea002210
+dd 0x0000ffff
+dd 0x0d510000
+dd 0xea002018
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002218
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002000
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002200
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002028
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea002228
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea00201c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00221c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00208c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea00228c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea0020a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0022a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0020ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea0022ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea002140
+dd 0xff000000
+dd 0x00140718
+dd 0xea002340
+dd 0xff000000
+dd 0x00140718
+dd 0xea002144
+dd 0xff000000
+dd 0x00140998
+dd 0xea002344
+dd 0xff000000
+dd 0x00140998
+dd 0xea002148
+dd 0xff000000
+dd 0x00140998
+dd 0xea002348
+dd 0xff000000
+dd 0x00140998
+dd 0xea00217c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00237c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea002178
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea002378
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea00210c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea00230c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0x032c599d
+dd 0x00c02c29
+dd 0xeb0f000a
+dd 0x0a00822c
+dd 0x40e90f00
+dd 0x88059cc1
+dd 0xc098e900
+dd 0x1f203b41
+dd 0x41c098eb
+dd 0xe91f203b
+dd 0x3b41c098
+dd 0x2cea1f20
+dd 0x000a0082
+dd 0xc030ea0f
+dd 0x00000f00
+dd 0x00c030eb
+dd 0xe900000f
+dd 0x6055c094
+dd 0x30eb4740
+dd 0x000f00c0
+dd 0x8340ea00
+dd 0x0088059c
+dd 0x80c178ea
+dd 0xeb000019
+dd 0x6055c094
+dd 0x94e94740
+dd 0x406055c0
+dd 0xc088ea47
+dd 0x5580983a
+dd 0x80c178eb
+dd 0xe9000019
+dd 0x983ac088
+dd 0x88e95580
+dd 0x80983a82
+dd 0xc08cea55
+dd 0x0c782046
+dd 0x46c08ceb
+dd 0xe90c7820
+dd 0x2046828c
+dd 0x78ea0c78
+dd 0x001980c1
+dd 0xc1ccea00
+dd 0x38254304
+dd 0x04c1cce9
+dd 0xeb382543
+dd 0x4304c1cc
+dd 0x7cea3825
+dd 0xa02400c1
+dd 0xc17ce94e
+dd 0x3ec02400
+dd 0x00c17ceb
+dd 0xea3ec024
+dd 0x05acc140
+dd 0x90eb0088
+dd 0x3e5155c0
+dd 0xc090eb2b
+dd 0x2b3e5155
+dd 0x558290e9
+dd 0xea2b3e51
+dd 0xa000c008
+dd 0x08e9b000
+dd 0x00a000c0
+dd 0xc144eab0
+dd 0x00840394
+dd 0x94c144eb
+dd 0xe9008403
+dd 0x03948344
+dd 0x38ea0084
+dd 0xce0032c0
+dd 0xc038eb38
+dd 0x38ce0032
+dd 0x32c038e9
+dd 0xea38ce00
+
+ref_00027f7c:
+dd 0x00000003
+dd 0xea002154
+dd 0xffffc0ff
+dd 0x00000003
+dd 0xea002158
+dd 0xffffffc0
+dd 0x00000002
+dd 0xea002354
+dd 0xffffc0ff
+dd 0x00000002
+dd 0xea002358
+dd 0xffffffc0
+dd 0x00000001
+dd 0xea002554
+dd 0xffffc0ff
+dd 0x00000001
+dd 0xea002558
+dd 0xffffffc0
+dd 0x00000000
+dd 0xea002754
+dd 0xffffc0ff
+dd 0x00000000
+dd 0xea002758
+dd 0xffffffc0
+dd 0x00010003
+dd 0xea002154
+dd 0xc0ffffc0
+dd 0x00010002
+dd 0xea002354
+dd 0xc0ffffc0
+dd 0x00010001
+dd 0xea002554
+dd 0xc0ffffc0
+dd 0x00010000
+dd 0xea002754
+dd 0xc0ffffc0
+dd 0x00020003
+dd 0xea002150
+dd 0xc0ffffff
+dd 0x00020003
+dd 0xea002154
+dd 0xffc0ffff
+dd 0x00020002
+dd 0xea002350
+dd 0xc0ffffff
+dd 0x00020002
+dd 0xea002354
+dd 0xffc0ffff
+dd 0x00020001
+dd 0xea002550
+dd 0xc0ffffff
+dd 0x00020001
+dd 0xea002554
+dd 0xffc0ffff
+dd 0x00020000
+dd 0xea002750
+dd 0xc0ffffff
+dd 0x00020000
+dd 0xea002754
+dd 0xffc0ffff
+
+ref_0002806c:
+dd 0xea002090
+dd 0xffff0000
+dd 0x00003e67
+dd 0xea002290
+dd 0xffff0000
+dd 0x00003e67
+dd 0xea002490
+dd 0xffff0000
+dd 0x00003e67
+dd 0xea002690
+dd 0xffff0000
+dd 0x00003e67
+
+ref_0002809c:
+dd 0xea002090
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea002290
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea002490
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea002690
+dd 0xffff0000
+dd 0x00004c5a
+
+ref_000280cc:
+dd 0xe9000808
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9000a08
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9000c08
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9000e08
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9001008
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9001208
+dd 0x0ffffeff
+dd 0xe0000100
+
+ref_00028114:
+dd 0xea008008
+dd 0x00ffffff
+dd 0x1c000000
+dd 0xea002008
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002208
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002408
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002608
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002038
+dd 0xfffffff0
+dd 0x0000000d
+dd 0xea002238
+dd 0xfffffff0
+dd 0x0000000d
+dd 0xea002438
+dd 0xfffffff0
+dd 0x0000000d
+dd 0xea002638
+dd 0xfffffff0
+dd 0x0000000d
+dd 0xea00202c
+dd 0xfffdf0ff
+dd 0x00020100
+dd 0xea00222c
+dd 0xfffdf0ff
+dd 0x00020100
+dd 0xea00242c
+dd 0xfffdf0ff
+dd 0x00020100
+dd 0xea00262c
+dd 0xfffdf0ff
+dd 0x00020100
+dd 0xea002040
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002240
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002440
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002640
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002010
+dd 0x0000ffff
+dd 0x55510000
+dd 0xea002210
+dd 0x0000ffff
+dd 0x55510000
+dd 0xea002410
+dd 0x0000ffff
+dd 0x55510000
+dd 0xea002610
+dd 0x0000ffff
+dd 0x55510000
+dd 0xea002140
+dd 0xff000000
+dd 0x00140718
+dd 0xea002340
+dd 0xff000000
+dd 0x00140718
+dd 0xea002540
+dd 0xff000000
+dd 0x00140718
+dd 0xea002740
+dd 0xff000000
+dd 0x00140718
+dd 0xea002144
+dd 0xff000000
+dd 0x00140998
+dd 0xea002344
+dd 0xff000000
+dd 0x00140998
+dd 0xea002544
+dd 0xff000000
+dd 0x00140998
+dd 0xea002744
+dd 0xff000000
+dd 0x00140998
+dd 0xea002148
+dd 0xff000000
+dd 0x00140998
+dd 0xea002348
+dd 0xff000000
+dd 0x00140998
+dd 0xea002548
+dd 0xff000000
+dd 0x00140998
+dd 0xea002748
+dd 0xff000000
+dd 0x00140998
+dd 0xea00217c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00237c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00257c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00277c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00208c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea00228c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea00248c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea00268c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea0020a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0022a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0024a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0026a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0020ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea0022ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea0024ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea0026ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea002018
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002218
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002418
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002618
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002000
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002200
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002400
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002600
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002028
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea002228
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea002428
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea002628
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea00201c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00221c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00241c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00261c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea002178
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea002378
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea002578
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea002778
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea00210c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea00230c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea00250c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea00270c
+dd 0xffc7fff0
+dd 0x00000005
+
+ref_00028480:
+dd 0xe90025cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe90027cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe9002568
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe9002768
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe900242c
+dd 0xfffff8ff
+dd 0x00000100
+dd 0xe900262c
+dd 0xfffff8ff
+dd 0x00000100
+dd 0xe900256c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900276c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900254c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe900274c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe9002564
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002764
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002570
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002770
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002514
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002714
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002438
+dd 0xfffffff0
+dd 0x0000000b
+dd 0xe9002638
+dd 0xfffffff0
+dd 0x0000000b
+dd 0xe9002414
+dd 0xffff01ff
+dd 0x00006600
+dd 0xe9002614
+dd 0xffff01ff
+dd 0x00006600
+dd 0xe9002540
+dd 0xff7fffff
+dd 0x00000000
+dd 0xe9002740
+dd 0xff7fffff
+dd 0x00000000
+
+ref_00028588:
+dd 0xe90021cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe90023cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe9002168
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe9002368
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe900216c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900236c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900214c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe900234c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe9002164
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002364
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002170
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002370
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002114
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002314
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002038
+dd 0xfffffff0
+dd 0x0000000b
+dd 0xe9002238
+dd 0xfffffff0
+dd 0x0000000b
+dd 0xe9002014
+dd 0xffff01ff
+dd 0x00006600
+dd 0xe9002214
+dd 0xffff01ff
+dd 0x00006600
+dd 0xe9002140
+dd 0xff7fffff
+dd 0x00000000
+dd 0xe9002340
+dd 0xff7fffff
+dd 0x00000000
+dd 0x1119fbc2
+dd 0x09c00c20
+dd 0xe9072237
+dd 0x3709c00c
+dd 0x2cea0722
+dd 0x000a0082
+dd 0xc140e90f
+dd 0x0088059c
+dd 0x00c02cea
+dd 0xea0f000a
+dd 0x3b41c098
+dd 0x30e91f20
+dd 0x000f00c0
+dd 0xc098e900
+dd 0x1f203b41
+dd 0x9cc140ea
+dd 0xe9008805
+dd 0x6055c094
+dd 0x30e94740
+dd 0x000f00c0
+dd 0xc178ea00
+dd 0x00001980
+dd 0x55c094e9
+dd 0xea474060
+dd 0x1980c178
+dd 0x88ea0000
+dd 0x80983ac0
+dd 0xc088e955
+dd 0x5580983a
+dd 0x46c08cea
+dd 0xe90c7820
+dd 0x2046c08c
+dd 0x90ea0c78
+dd 0x3e5155c0
+dd 0xc090e92b
+dd 0x2b3e5155
+dd 0x04c1ccea
+dd 0xe9380043
+dd 0x2400c17c
+dd 0xcce94ea0
+dd 0x004304c1
+dd 0xc17cea38
+dd 0x3ec02400
+dd 0x00c1c4ea
+dd 0xea000002
+dd 0x0200c1c4
+dd 0x08e90000
+dd 0x00a000c0
+dd 0xc008e9b0
+dd 0xb000a000
+dd 0x94c144ea
+dd 0xe9008403
+dd 0x0394c144
+dd 0x0cea0084
+dd 0x221709c0
+dd 0xc00ce907
+dd 0x07221709
+dd 0x000000ea
+
+ref_00028760:
+dd 0x00000003
+dd 0xea002154
+dd 0xffffc0ff
+dd 0x00000003
+dd 0xea002158
+dd 0xffffffc0
+dd 0x00000002
+dd 0xea002354
+dd 0xffffc0ff
+dd 0x00000002
+dd 0xea002358
+dd 0xffffffc0
+dd 0x00000001
+dd 0xea002554
+dd 0xffffc0ff
+dd 0x00000001
+dd 0xea002558
+dd 0xffffffc0
+dd 0x00000000
+dd 0xea002754
+dd 0xffffc0ff
+dd 0x00000000
+dd 0xea002758
+dd 0xffffffc0
+dd 0x00010003
+dd 0xea002154
+dd 0xc0ffffc0
+dd 0x00010002
+dd 0xea002354
+dd 0xc0ffffc0
+dd 0x00010001
+dd 0xea002554
+dd 0xc0ffffc0
+dd 0x00010000
+dd 0xea002754
+dd 0xc0ffffc0
+dd 0x00020003
+dd 0xea002150
+dd 0xc0ffffff
+dd 0x00020003
+dd 0xea002154
+dd 0xffc0ffff
+dd 0x00020002
+dd 0xea002350
+dd 0xc0ffffff
+dd 0x00020002
+dd 0xea002354
+dd 0xffc0ffff
+dd 0x00020001
+dd 0xea002550
+dd 0xc0ffffff
+dd 0x00020001
+dd 0xea002554
+dd 0xffc0ffff
+dd 0x00020000
+dd 0xea002750
+dd 0xc0ffffff
+dd 0x00020000
+dd 0xea002754
+dd 0xffc0ffff
+
+ref_00028850:
+dd 0xe9000808
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9000a08
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9000c08
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9000e08
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9001008
+dd 0x0ffffeff
+dd 0xe0000100
+dd 0xe9001208
+dd 0x0ffffeff
+dd 0xe0000100
+
+ref_00028898:
+dd 0xea008008
+dd 0x00ffffff
+dd 0x1c000000
+dd 0xea002008
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002208
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002408
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002608
+dd 0x00039ef7
+dd 0xea6c6108
+dd 0xea002038
+dd 0xfffffff0
+dd 0x0000000d
+dd 0xea002238
+dd 0xfffffff0
+dd 0x0000000d
+dd 0xea002438
+dd 0xfffffff0
+dd 0x0000000d
+dd 0xea002638
+dd 0xfffffff0
+dd 0x0000000d
+dd 0xea00202c
+dd 0xfffdf8ff
+dd 0x00020100
+dd 0xea00222c
+dd 0xfffdf8ff
+dd 0x00020100
+dd 0xea00242c
+dd 0xfffdf8ff
+dd 0x00020100
+dd 0xea00262c
+dd 0xfffdf8ff
+dd 0x00020100
+dd 0xea002040
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002240
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002440
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002640
+dd 0xe0ffffff
+dd 0x01000000
+dd 0xea002010
+dd 0x0000ffff
+dd 0x55510000
+dd 0xea002210
+dd 0x0000ffff
+dd 0x55510000
+dd 0xea002410
+dd 0x0000ffff
+dd 0x55510000
+dd 0xea002610
+dd 0x0000ffff
+dd 0x55510000
+dd 0xea002140
+dd 0xff000000
+dd 0x00140718
+dd 0xea002340
+dd 0xff000000
+dd 0x00140718
+dd 0xea002540
+dd 0xff000000
+dd 0x00140718
+dd 0xea002740
+dd 0xff000000
+dd 0x00140718
+dd 0xea002144
+dd 0xff000000
+dd 0x00140998
+dd 0xea002344
+dd 0xff000000
+dd 0x00140998
+dd 0xea002544
+dd 0xff000000
+dd 0x00140998
+dd 0xea002744
+dd 0xff000000
+dd 0x00140998
+dd 0xea002148
+dd 0xff000000
+dd 0x00140998
+dd 0xea002348
+dd 0xff000000
+dd 0x00140998
+dd 0xea002548
+dd 0xff000000
+dd 0x00140998
+dd 0xea002748
+dd 0xff000000
+dd 0x00140998
+dd 0xea00217c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00237c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00257c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00277c
+dd 0xfcffffff
+dd 0x03000000
+dd 0xea00208c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea00228c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea00248c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea00268c
+dd 0xff00ffff
+dd 0x00800000
+dd 0xea0020a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0022a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0024a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0026a4
+dd 0xffcf00ff
+dd 0x00308300
+dd 0xea0020ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea0022ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea0024ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea0026ac
+dd 0xffffffcf
+dd 0x00000020
+dd 0xea002090
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea002290
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea002490
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea002690
+dd 0xffff0000
+dd 0x00004c5a
+dd 0xea002018
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002218
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002418
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002618
+dd 0x0000fcff
+dd 0x38250100
+dd 0xea002000
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002200
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002400
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002600
+dd 0x30fcffff
+dd 0xcf030000
+dd 0xea002028
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea002228
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea002428
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea002628
+dd 0x00e0ffff
+dd 0x580e0000
+dd 0xea00201c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00221c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00241c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea00261c
+dd 0xffff83ff
+dd 0x00002400
+dd 0xea002178
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea002378
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea002578
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea002778
+dd 0xffffe0ff
+dd 0x00001800
+dd 0xea00210c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea00230c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea00250c
+dd 0xffc7fff0
+dd 0x00000005
+dd 0xea00270c
+dd 0xffc7fff0
+dd 0x00000005
+
+ref_00028c34:
+dd 0xe90025cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe90027cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe9002568
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe9002768
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe900242c
+dd 0xfffff8ff
+dd 0x00000100
+dd 0xe900262c
+dd 0xfffff8ff
+dd 0x00000100
+dd 0xe900256c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900276c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900254c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe900274c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe9002564
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002764
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002570
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002770
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002514
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002714
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002438
+dd 0xfffffff0
+dd 0x0000000b
+dd 0xe9002638
+dd 0xfffffff0
+dd 0x0000000b
+dd 0xe9002414
+dd 0xffff01ff
+dd 0x00006600
+dd 0xe9002614
+dd 0xffff01ff
+dd 0x00006600
+dd 0xe9002490
+dd 0xffff00ff
+dd 0x00004100
+dd 0xe9002690
+dd 0xffff00ff
+dd 0x00004100
+dd 0xe9002540
+dd 0xff7fffff
+dd 0x00000000
+dd 0xe9002740
+dd 0xff7fffff
+dd 0x00000000
+
+ref_00028d54:
+dd 0xe90021cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe90023cc
+dd 0xffffebf8
+dd 0x00001407
+dd 0xe9002168
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe9002368
+dd 0xfefff0c3
+dd 0x00000a28
+dd 0xe900216c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900236c
+dd 0xffffff00
+dd 0x0000003f
+dd 0xe900214c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe900234c
+dd 0xff0000ff
+dd 0x00120500
+dd 0xe9002164
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002364
+dd 0xffff0fff
+dd 0x00005000
+dd 0xe9002170
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002370
+dd 0xffffffe7
+dd 0x00000000
+dd 0xe9002114
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002314
+dd 0xc7fff8ff
+dd 0x00000100
+dd 0xe9002038
+dd 0xfffffff0
+dd 0x0000000b
+dd 0xe9002238
+dd 0xfffffff0
+dd 0x0000000b
+dd 0xe9002014
+dd 0xffff01ff
+dd 0x00006600
+dd 0xe9002214
+dd 0xffff01ff
+dd 0x00006600
+dd 0xe9002090
+dd 0xffff00ff
+dd 0x00004100
+dd 0xe9002290
+dd 0xffff00ff
+dd 0x00004100
+dd 0xe9002140
+dd 0xff7fffff
+dd 0x00000000
+dd 0xe9002340
+dd 0xff7fffff
+dd 0x00000000
+dd 0x2201fbc2
+dd 0x09c00c20
+dd 0xe9072237
+dd 0x3709c00c
+dd 0x2cea0722
+dd 0x000a0082
+dd 0xc140e90f
+dd 0x0088059c
+dd 0x00c02cea
+dd 0xea0f000a
+dd 0x3b41c098
+dd 0x30e91f20
+dd 0x000f00c0
+dd 0xc098e900
+dd 0x1f203b41
+dd 0x9cc140ea
+dd 0xe9008805
+dd 0x6055c094
+dd 0x30e94740
+dd 0x000f00c0
+dd 0xc178ea00
+dd 0x00001980
+dd 0x55c094e9
+dd 0xea474060
+dd 0x1980c178
+dd 0x88ea0000
+dd 0x80983ac0
+dd 0xc088e955
+dd 0x5580983a
+dd 0x46c08cea
+dd 0xe90c7820
+dd 0x2046c08c
+dd 0x90ea0c78
+dd 0x3e5155c0
+dd 0xc090e92b
+dd 0x2b3e5155
+dd 0x04c1ccea
+dd 0xe9380043
+dd 0x2400c17c
+dd 0xcce94ea0
+dd 0x004304c1
+dd 0xc17cea38
+dd 0x3ec02400
+dd 0x00c1c4ea
+dd 0xea000002
+dd 0x0200c1c4
+dd 0x08e90000
+dd 0x00a000c0
+dd 0xc008e9b0
+dd 0xb000a000
+dd 0x94c144ea
+dd 0xe9008403
+dd 0x0394c144
+dd 0x0cea0084
+dd 0x221709c0
+dd 0xc00ce907
+dd 0x07221709
+dd 0x000000ea
+dd 0xcb000240
+dd 0xffffffc3
+dd 0x00000008
+dd 0xcb000248
+dd 0xffffffc3
+dd 0x0000000c
+dd 0xcb000250
+dd 0xffffffc3
+dd 0x0000000c
+dd 0xcb000258
+dd 0xffffffc3
+dd 0x0000000c
+dd 0xcb000260
+dd 0xffffffc3
+dd 0x0000000c
+dd 0xcb000268
+dd 0xffffffc3
+dd 0x00000010
+dd 0xcb000270
+dd 0xffffffc3
+dd 0x00000010
+dd 0xcb000240
+dd 0xfff3ffff
+dd 0x00040000
+dd 0xcb000248
+dd 0xfff3ffff
+dd 0x00040000
+dd 0xcb000250
+dd 0xfff3ffff
+dd 0x00040000
+dd 0xcb000258
+dd 0xfff3ffff
+dd 0x00040000
+dd 0xcb000260
+dd 0xfff3ffff
+dd 0x00040000
+dd 0xcb000268
+dd 0xfff3ffff
+dd 0x00040000
+dd 0xcb000270
+dd 0xfff3ffff
+dd 0x00040000
+dd 0xcb000014
+dd 0xffff9fff
+dd 0x00002000
+
+ref_00028ff8:
+dd 0xb3e123d0
+dd 0x4db47a1e
+dd 0xd4be66af
+dd 0x38669c1e
+
+ref_00029008:
+dd 0x524ed3ca
+dd 0x49f5b250
+dd 0xbaa2d994
+dd 0x140ec7ff
+dd 0xc1392859
+dd 0x446e1f65
+dd 0x3584f5b3
+dd 0xc4d1c7fc
+
+ref_00029028:
+dd 0x80000010
+dd ref_000290cc
+dd ref_00029034
+
+ref_00029034:
+dd 0x00000000
+dd fcn_000165b9
+
+ref_0002903c:
+dd 0x564b33cd
+dd 0x4593c92a
+dd 0x7324bf90
+dd 0x22633ce4
+
+ref_0002904c:
+dd 0x4ed4bf27
+dd 0x42e94092
+dd 0x7b527d80
+dd 0xbdc9001d
+
+ref_0002905c:
+dd 0xf8e21975
+dd 0x4f580899
+dd 0x2555bea4
+dd 0x7ad7c6a9
+
+ref_0002906c:
+dd 0x8c8ce578
+dd 0x4f1c8a3d
+dd 0x61893599
+dd 0xd32dc385
+
+ref_0002907c:
+dd 0x49edb1c1
+dd 0x4761bf21
+dd 0x00eb12bb
+dd 0x39bbaa31
+
+ref_0002908c:
+dd 0x605ea650
+dd 0x42e1c65c
+dd 0xa59180ba
+dd 0xc618b62a
+
+ref_0002909c:
+dd 0xf894643d
+dd 0x42d1c449
+dd 0xbd85a88e
+dd 0xde5bc6d8
+
+ref_000290ac:
+dd 0xe6af1f7b
+dd 0x46dafc3f
+dd 0xb4a328a8
+dd 0x8242a457
+
+ref_000290bc:
+dd 0x9ca93627
+dd 0x4324b65b
+dd 0xb4c002a2
+dd 0x43457661
+
+ref_000290cc:
+dd 0x1f4c6f90
+dd 0x48d8b06b
+dd 0xe5ba01a2
+dd 0x567dcdf1
+dd 0xde8f2878
+dd 0x498e36d5
+dd 0x8c1659ba
+dd 0x35b34726
+dd 0xc4d6994a
+dd 0x47c0aa3d
+dd 0xbfb00aae
+dd 0x13a6baad
+dd 0xd0a2562e
+dd 0x4a7ca1b1
+dd 0xc7c85297
+dd 0x466cfcbb
+dd 0x3d0e663a
+dd 0x4489dc72
+dd 0x9ee4c587
+dd 0x52a473e7
+
+ref_0002911c:
+dd 0xaf4a1998
+dd 0x45454949
+dd 0xe7c14c9c
+dd 0x56e042c0
+
+ref_0002912c:
+dd 0x220307a4
+dd 0x42a53670
+dd 0x9d3201aa
+dd 0x6b913ecd
+
+ref_0002913c:
+dd 0x433e0f9f
+dd 0x410a05ae
+dd 0x29bfc3a0
+dd 0xac25cb8e
+
+ref_0002914c:
+dd 0x1edcbdf9
+dd 0x4bd4ffc6
+dd 0x5d19f694
+dd 0x5670e11d
+
+ref_0002915c:
+dd 0x17865dc0
+dd 0x4da80b8b
+dd 0x467c428b
+dd 0x4dca5cb8
+dd 0x63b6e435
+dd 0x49c632bc
+dd 0xa1b7bd81
+dd 0x6c1afea0
+
+ref_0002917c:
+dd 0xed097352
+dd 0x445a9041
+dd 0x9db2b680
+dd 0x45889e50
+dd 0xfbf26154
+dd 0x4bdc4e55
+dd 0x18d97baf
+dd 0x613f44ac
+
+ref_0002919c:
+dd 0xf38d1338
+dd 0x4fb6af7a
+dd 0x9c1adb91
+dd 0x0d578321
+
+ref_000291ac:
+dd 0x908c7f8b
+dd 0x47fb5c48
+dd 0xfdf55783
+dd 0x7652234e
+
+ref_000291bc:
+dd 0xc02b0573
+dd 0x4a312b4e
+dd 0x56941aa3
+dd 0x2c44507b
+dd 0x3bc1f6de
+dd 0x4547693e
+dd 0x822100a3
+dd 0xb220a43c
+
+ref_000291dc:
+dd 0x50031131
+dd 0x43ef4f24
+dd 0x3773afb7
+dd 0xac0ef794
+dd 0xe806424f
+dd 0x4b1ad425
+dd 0x695f26bc
+dd 0x5aa18903
+
+ref_000291fc:
+dd 0x794a0deb
+dd 0x4e7bc971
+dd 0xbfd0f28a
+dd 0x9826ca3c
+
+ref_0002920c:
+dd 0x98191174
+dd 0x41060b26
+dd 0x45d002af
+dd 0x2b05e851
+dd 0x21d56275
+dd 0x405ff984
+dd 0x08ea0b9f
+dd 0x7e0aef4d
+dd 0x881807d2
+dd 0x4ec998d1
+dd 0x4677a0af
+dd 0x49242fc4
+dd 0x2549016d
+dd 0x4d002b17
+dd 0x441da4b5
+dd 0xf838013a
+dd 0x7408d748
+dd 0x4ee6fc8c
+dd 0xbec48892
+dd 0x10a492c0
+dd 0x38cdd10b
+dd 0x4f6e767d
+dd 0xee6744a7
+dd 0xa52ffe1d
+dd 0xe9db0d58
+dd 0x47f6d48d
+dd 0x406f6e9c
+dd 0x417b6ce8
+dd 0x09be4bc2
+dd 0x4dea790e
+dd 0x0538dc8b
+dd 0x44399816
+
+ref_0002928c:
+dd 0xf8d5438e
+dd 0x481d26e1
+dd 0xd6303cb6
+dd 0x20a4f4ef
+dd 0x9a7ef41e
+dd 0x4bd1c140
+dd 0x111e84b8
+dd 0xe64c0b24
+dd 0x30eb2979
+dd 0x4d60b0f7
+dd 0x2c1adcb2
+dd 0xf4b1ce96
+dd 0x3acf33ee
+dd 0x40f4d892
+dd 0x5438fca2
+dd 0x3d32e1d2
+dd 0xb6ec423c
+dd 0x490d21d2
+dd 0x58ddc685
+dd 0x74a6ea64
+dd 0x268f33a9
+dd 0x48becccd
+dd 0x05861788
+dd 0xd62ec33a
+dd 0x55750d10
+dd 0x4bf56d3d
+dd 0x5ee3d889
+dd 0xf490b0f0
+dd 0x99b56126
+dd 0x4d9be16c
+dd 0x35aa71bb
+dd 0x2f701a46
+
+ref_0002930c:
+dd 0x573eaf99
+dd 0x46b5f445
+dd 0x4abcd5a5
+dd 0xf3983593
+
+ref_0002931c:
+dd 0x09ea8911
+dd 0x4230be0d
+dd 0xc6ed03a0
+dd 0x118eb493
+
+ref_0002932c:
+dd 0x3e14d361
+dd 0x42e4c7d7
+dd 0xebb907ae
+dd 0x2aed9648
+dd 0x61c68702
+dd 0x4f434d7e
+dd 0x43a7ef8d
+dd 0xc574ce05
+dd 0xd3bfe2de
+dd 0x11df3daf
+dd 0xa5e340ba
+dd 0x9395d856
+dd 0x69a20012
+dd 0x4e35b167
+dd 0xee9899a9
+dd 0x2ef03508
+dd 0xfa2ddc38
+dd 0x42183f19
+dd 0xd7d93eb5
+dd 0x6767629d
+dd 0xf9f0b131
+dd 0x4f16f346
+dd 0x41f9dd80
+dd 0x7d3a2b07
+dd 0x60ac3a8f
+dd 0x4cd44d66
+dd 0xf0c35a89
+dd 0xee65666e
+dd 0xfc5f2e00
+dd 0x11e1fc68
+dd 0x00081fa2
+dd 0x669a0c20
+dd 0x3ea94650
+dd 0x11e1fc5b
+dd 0x00081fa2
+dd 0x669a0c20
+dd 0x707be83e
+dd 0x40a50bf6
+dd 0xc03464be
+dd 0xe2b8a03a
+dd 0xbb929da9
+dd 0x403568f7
+dd 0xbba32cb2
+dd 0x55da233f
+dd 0x7d279373
+dd 0x4d4feecc
+dd 0xc4ce2fae
+dd 0x6ab006b7
+dd 0x1e94f097
+dd 0x40895acd
+dd 0xa5b9e3b2
+dd 0x0ca779c8
+dd 0x4efa0db6
+dd 0x4bb126dc
+dd 0xbc146fa7
+dd 0x3c7b0c63
+dd 0xca0801d3
+dd 0x4decafb1
+dd 0x6593659b
+dd 0x6b93c7ec
+dd 0x9a8f82d5
+dd 0x48da39b1
+dd 0x2da2dc92
+dd 0xf64d83a8
+dd 0x7c66ffdc
+dd 0xe5d4423c
+dd 0xad551b25
+dd 0x982695ba
+dd 0xb441df87
+dd 0x48118d94
+dd 0x9a0ff785
+dd 0x2a9df87b
+dd 0x03fdf171
+dd 0x4ace1d67
+dd 0x363e04a9
+dd 0x74fa38d3
+dd 0x1bad711c
+dd 0x4241d451
+dd 0x3785f3b1
+dd 0x700c2e81
+dd 0x368cda0d
+dd 0x4b9bcf31
+dd 0xd1e7f68c
+dd 0x7e15ffbf
+dd 0xd7ac94af
+dd 0x45eca498
+dd 0x6ea5a2bf
+dd 0x8b613495
+dd 0xacc8e1e4
+dd 0x4e409f9f
+dd 0x9ef97ea5
+dd 0xa54cf352
+dd 0x1bf06aea
+dd 0x4a8d5bec
+dd 0x9b747695
+dd 0x302d5609
+dd 0xbe644001
+dd 0x48b1e7d4
+dd 0xa08b96b0
+dd 0xe77abc47
+dd 0x3d989471
+dd 0x46b7cfac
+dd 0x43081c9b
+dd 0x2d400901
+dd 0x2986883f
+dd 0x48d088e0
+dd 0xc220824b
+dd 0xacdd4869
+dd 0xc38fb0e2
+dd 0x49c90c43
+dd 0x179b44b5
+dd 0xa3cb4daa
+dd 0x5848fd2d
+dd 0x474bd6af
+dd 0xdd957582
+dd 0x23e80ae7
+dd 0x429501d9
+dd 0x40f4e447
+dd 0xc9757b86
+dd 0x4eb51d3a
+dd 0x87f22dcb
+dd 0x41057304
+dd 0x71317cbb
+dd 0x3bc2cc43
+dd 0xc020489e
+dd 0x4ef26db2
+dd 0x06caa59a
+dd 0x6ad311fc
+dd 0xcbcb3817
+dd 0x497e81e6
+dd 0xfac8ff87
+dd 0x28ec248f
+dd 0xaaa99a23
+dd 0x4c3113b6
+dd 0x9e298bbb
+dd 0xa44fc08e
+dd 0xcacb3817
+dd 0x497e81e6
+dd 0xfac8ff87
+dd 0x28ec248f
+
+ref_0002955c:
+dd 0x4c10d934
+dd 0x45a438e6
+dd 0x792a249a
+dd 0x7fcb3db9
+dd 0x27e569d5
+dd 0x4d8f0afc
+dd 0x3a78908c
+dd 0xab18a3c4
+dd 0x711c703f
+dd 0x4b10c285
+dd 0xec36b0a3
+dd 0xe28b3cbd
+dd 0xe39e5bea
+dd 0x45f65f1e
+dd 0xbfd81caf
+dd 0xcd49475f
+dd 0x1ea81bec
+dd 0x4d98f01a
+dd 0x614a01a2
+dd 0x22c02fce
+dd 0x76b6bdfa
+dd 0x44622acd
+dd 0x58cb3f9e
+dd 0x37d969c9
+dd 0x9a4e9246
+dd 0x11d5d553
+dd 0x0600e287
+dd 0xb9c34529
+dd 0x4c19049f
+dd 0x4dd34137
+dd 0x978b109c
+dd 0xfafd3fa8
+dd 0x86cf2b1a
+dd 0x4642b3da
+dd 0x1cd0f595
+dd 0xb8601c6c
+
+ref_000295ec:
+dd 0x08040201
+dd 0x08040201
+dd 0x00000000
+
+ref_000295f8:
+dd 0x08040201
+dd 0x00000000
+dd 0x08040201
+
+ref_00029604:
+dd 0x80000010
+dd ref_000290ac
+dd 0x00000000
+
+ref_00029610:
+dd fcn_0001aa58
+dd fcn_0001ab85
+dd fcn_0001ac9a
+dd fcn_0001ad98
+dd fcn_0001a90b
+dd fcn_0001a91a
+dd fcn_0001a929
+dd fcn_0001a979
+dd fcn_0001a938
+dd fcn_0001a94e
+dd fcn_0001a964
+dd fcn_0001a988
+dd fcn_0001a873
+dd fcn_0001a882
+dd fcn_0001a891
+dd fcn_0001a8a0
+dd fcn_0001a8af
+dd fcn_0001a8c5
+dd fcn_0001a8db
+dd fcn_0001a8f0
+
+ref_00029660:
+dd 0x75736e55
+dd 0x726f7070
+dd 0x20646574
+dd 0x20484350
+dd 0x70657453
+dd 0x676e6970
+dd 0x7553202e
+dd 0x726f7070
+dd 0x676e6974
+dd 0x48435020
+dd 0x65747320
+dd 0x6e697070
+dd 0x74732067
+dd 0x69747261
+dd 0x6620676e
+dd 0x206d6f72
+dd 0x61207325
+dd 0x6120646e
+dd 0x65766f62
+dd 0x9066000a
+
+ref_000296b0:
+dd 0xa6a4a2a0
+
+ref_000296b4:
+dd 0x02353140
+dd 0x20373144
+dd 0x32103146
+dd 0x32163148
+dd 0x3250314c
+dd 0x76543150
+dd 0x00063158
+dd 0x55443164
+dd 0x00073168
+
+ref_000296d8:
+dd 0x02353140
+dd 0x20373144
+dd 0x32103146
+dd 0x32163148
+dd 0x3250314c
+dd 0x76543150
+
+ref_000296f0:
+dd 0x00003100
+dd 0x03203200
+dd 0x00003108
+dd 0x00000001
+dd 0x0000310c
+dd 0x43214321
+dd 0x00003110
+dd 0x00000001
+dd 0x00003118
+dd 0x00000001
+
+ref_00029718:
+dd 0x00003100
+dd 0x03203200
+dd 0x00003108
+dd 0x00000001
+dd 0x0000310c
+dd 0x43214321
+dd 0x00003110
+dd 0x00000001
+dd 0x00003114
+dd 0x00000001
+dd 0x00003118
+dd 0x00000001
+
+ref_00029748:
+dd 0x422b8086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x422c8086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x42388086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x42398086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00828086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00858086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00838086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00848086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00868086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00878086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00888086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00898086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x008f8086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00908086
+dd 0x02ffffff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08ae8086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08af8086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08968086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08978086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08858086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08868086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08948086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08958086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08928086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08938086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08908086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08918086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08878086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08888086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x088e8086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x088f8086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08b58086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08b68086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x08b38086
+dd 0x028002ff
+dd 0x01540003
+dd 0x00000003
+dd 0x00000000
+dd 0x00000000
+dd 0x08b38086
+dd 0x028002ff
+dd 0x01580002
+dd 0x00000003
+dd 0x00000000
+dd 0x00000000
+dd 0x08b48086
+dd 0x028002ff
+dd 0x01540003
+dd 0x00000003
+dd 0x00000000
+dd 0x00000000
+dd 0x08b48086
+dd 0x028002ff
+dd 0x01580002
+dd 0x00000003
+dd 0x00000000
+dd 0x00000000
+dd 0x08b18086
+dd 0x028002ff
+dd 0x01540003
+dd 0x00000003
+dd 0x00000000
+dd 0x00000000
+dd 0x08b18086
+dd 0x028002ff
+dd 0x01580002
+dd 0x00000003
+dd 0x00000000
+dd 0x00000000
+dd 0x08b28086
+dd 0x028002ff
+dd 0x01540003
+dd 0x00000003
+dd 0x00000000
+dd 0x00000000
+dd 0x08b28086
+dd 0x028002ff
+dd 0x01580002
+dd 0x00000003
+dd 0x00000000
+dd 0x00000000
+dd 0x08b08086
+dd 0x028002ff
+dd 0x00000001
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+
+; .bss
+ref_00029b38:
+dd 0x00000000
+
+ref_00029b3c:
+dd 0x00000000
+
+ref_00029b40:
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+
+ref_00029b58:
+dd 0x00000000
+dd 0x00000000
+
+ref_00029b60:
+dd 0x00000000
+
+ref_00029b64:
+dd 0x00000000
+
+ref_00029b68:
+dd 0x00000000
+
+ref_00029b6c:
+dd 0x00000000
+
+ref_00029b70:
+dd 0x00000000
+
+ref_00029b74:
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+
+ref_00029b8c:
+dd 0x00000000
+
+ref_00029b90:
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+
+ref_00029bb4:
+dd 0x00000000
+
+ref_00029bb8:
+dd 0x00000000
+
+ref_00029bbc:
+dd 0x00000000
+
+ref_00029bc0:
+dd 0x00000000
+
+ref_00029bc4:
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+
+ref_00029cb0:
+dd 0x00000000
+
+ref_00029cb4:
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+
+ref_00029da4:
+dd 0x00000000
+dd 0x00000000
+
+ref_00029dac:
+dd 0x00000000
+
+ref_00029db0:
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+
+ref_000312e0:
+dd 0x00000000
+
+ref_000312e4:
+dd 0x00000000
+dd 0x00000000
+dd 0x00000000
+
+ref_000312f0:
+dd 0x00000000
+dd 0x00000000