00d9e950 sub      esp, 0x18
00d9e953 cmp      dword ptr [esp + 0x20], 0
00d9e958 push     ebx
00d9e959 push     ebp
00d9e95a push     esi
00d9e95b mov      esi, edx
00d9e95d push     edi
00d9e95e mov      dword ptr [esp + 0x14], esi
00d9e962 mov      ebx, ecx
00d9e964 jne      0xd9e973
00d9e966 mov      eax, 1
00d9e96b mov      dword ptr [esp + 0x30], eax
00d9e96f mov      dword ptr [esp + 0x34], eax
00d9e973 cmp      dword ptr [ebx + 0x74], 0xa
00d9e977 jl       0xd9e980
00d9e979 mov      eax, dword ptr [ebx]
00d9e97b mov      edx, dword ptr [eax + 0x18]
00d9e97e call     edx
00d9e980 mov      ebp, dword ptr [ebx + 0x70]
00d9e983 mov      edi, dword ptr [ebx + 0x74]
00d9e986 sub      esi, ebp
00d9e988 sub      esi, 0x20
00d9e98b cmp      edi, 1
00d9e98e jle      0xd9e99e
00d9e990 mov      edx, esi
00d9e992 mov      ecx, ebx
00d9e994 call     0xd9cbc0
00d9e999 test     eax, eax
00d9e99b jne      0xd9e99e
00d9e99d int3     
00d9e99e mov      eax, dword ptr [esi + 4]
00d9e9a1 mov      edx, dword ptr [esi + 0x1c]
00d9e9a4 lea      ecx, [ebp + ebp + 0x20]
00d9e9a8 sub      eax, ecx
00d9e9aa sub      eax, esi
00d9e9ac mov      dword ptr [esp + 0x10], eax
00d9e9b0 mov      eax, dword ptr [esi + 0x18]
00d9e9b3 mov      ecx, eax
00d9e9b5 and      ecx, 0x20000
00d9e9bb neg      ecx
00d9e9bd sbb      ecx, ecx
00d9e9bf neg      ecx
00d9e9c1 shr      eax, 0x12
00d9e9c4 inc      ecx
00d9e9c5 and      eax, 0x3f
00d9e9c8 mov      dword ptr [esp + 0x20], edx
00d9e9cc mov      dword ptr [esp + 0x24], ecx
00d9e9d0 mov      dword ptr [esp + 0x1c], eax
00d9e9d4 cmp      edi, 3
00d9e9d7 jl       0xd9ea30
00d9e9d9 cmp      edi, 1
00d9e9dc jle      0xd9e9ff
00d9e9de mov      cl, byte ptr [0x14570fc]
00d9e9e4 mov      ebp, dword ptr [ebx + 0x70]
00d9e9e7 lea      edi, [esi + 0x20]
00d9e9ea lea      eax, [edi + ebp]
00d9e9ed cmp      edi, eax
00d9e9ef jae      0xd9e9ff
00d9e9f1 mov      dl, byte ptr [edi]
00d9e9f3 inc      edi
00d9e9f4 cmp      dl, cl
00d9e9f6 jne      0xd9e9fe
00d9e9f8 cmp      edi, eax
00d9e9fa jb       0xd9e9f1
00d9e9fc jmp      0xd9e9ff
00d9e9fe int3     
00d9e9ff cmp      dword ptr [ebx + 0x74], 1
00d9ea03 jle      0xd9ea30
00d9ea05 mov      eax, dword ptr [esi + 0x1c]
00d9ea08 mov      edi, dword ptr [esi + 4]
00d9ea0b mov      cl, byte ptr [0x14570fc]
00d9ea11 add      ebp, esi
00d9ea13 lea      eax, [eax + ebp + 0x20]
00d9ea17 sub      edi, eax
00d9ea19 add      edi, eax
00d9ea1b mov      ebp, eax
00d9ea1d cmp      eax, edi
00d9ea1f jae      0xd9ea30
00d9ea21 mov      dl, byte ptr [ebp]
00d9ea24 inc      ebp
00d9ea25 cmp      dl, cl
00d9ea27 jne      0xd9ea2f
00d9ea29 cmp      ebp, edi
00d9ea2b jb       0xd9ea21
00d9ea2d jmp      0xd9ea30
00d9ea2f int3     
00d9ea30 mov      edi, dword ptr [esp + 0x2c]
00d9ea34 test     edi, edi
00d9ea36 je       0xd9eae1
00d9ea3c mov      ecx, dword ptr [esi + 0x18]
00d9ea3f shr      ecx, 0x12
00d9ea42 and      ecx, 0x3f
00d9ea45 mov      ebp, 1
00d9ea4a shl      ebp, cl
00d9ea4c mov      dword ptr [esp + 0x34], ebp
00d9ea50 cmp      ebp, 0x10
00d9ea53 jle      0xd9ea70
00d9ea55 lea      ecx, [edi + ebp - 1]
00d9ea59 mov      eax, ecx
00d9ea5b xor      edx, edx
00d9ea5d div      ebp
00d9ea5f sub      ecx, edx
00d9ea61 cmp      edi, ecx
00d9ea63 je       0xd9ea6c
00d9ea65 sar      ebp, 1
00d9ea67 cmp      ebp, 0x10
00d9ea6a jg       0xd9ea55
00d9ea6c mov      dword ptr [esp + 0x34], ebp
00d9ea70 lea      eax, [edi + 0xf]
00d9ea73 mov      ecx, eax
00d9ea75 and      ecx, 0xf
00d9ea78 sub      eax, ecx
00d9ea7a cmp      edi, eax
00d9ea7c jne      0xd9ed87
00d9ea82 mov      ebp, dword ptr [esp + 0x14]
00d9ea86 and      dword ptr [esi + 0x18], 0xfffeffff
00d9ea8d mov      eax, dword ptr [esi + 8]
00d9ea90 mov      ecx, dword ptr [esi + 0xc]
00d9ea93 mov      dword ptr [eax + 0xc], ecx
00d9ea96 mov      edx, dword ptr [esi + 0xc]
00d9ea99 mov      eax, dword ptr [esi + 8]
00d9ea9c mov      dword ptr [edx + 8], eax
00d9ea9f mov      eax, dword ptr [esi + 4]
00d9eaa2 xor      edx, edx
00d9eaa4 mov      dword ptr [esi + 8], edx
00d9eaa7 mov      dword ptr [esi + 0xc], edx
00d9eaaa mov      ecx, dword ptr [ebx + 0x70]
00d9eaad dec      dword ptr [ebx + 0x60]
00d9eab0 lea      ecx, [ecx + ecx + 0x20]
00d9eab4 sub      eax, ecx
00d9eab6 sub      eax, esi
00d9eab8 mov      ecx, 0xffffffe0
00d9eabd sub      ecx, eax
00d9eabf add      dword ptr [ebx + 0x5c], ecx
00d9eac2 mov      ecx, dword ptr [ebx + 0xc]
00d9eac5 cmp      ecx, edx
00d9eac7 je       0xd9ead9
00d9eac9 movzx    edx, byte ptr [esi + 0x1b]
00d9eacd lea      ecx, [ecx + edx*4]
00d9ead0 mov      edx, 0xffffffe0
00d9ead5 sub      edx, eax
00d9ead7 add      dword ptr [ecx], edx
00d9ead9 test     edi, edi
00d9eadb jne      0xd9eb24
00d9eadd xor      eax, eax
00d9eadf jmp      0xd9eb2a
00d9eae1 cmp      dword ptr [esp + 0x44], 2
00d9eae6 mov      ebp, dword ptr [esp + 0x14]
00d9eaea je       0xd9ea86
00d9eaec mov      edi, dword ptr [esp + 0x34]
00d9eaf0 lea      ecx, [edi + ebp - 1]
00d9eaf4 mov      eax, ecx
00d9eaf6 xor      edx, edx
00d9eaf8 div      edi
00d9eafa mov      eax, dword ptr [esp + 0x10]
00d9eafe add      eax, ebp
00d9eb00 sub      ecx, edx
00d9eb02 add      ecx, 0xf
00d9eb05 mov      edx, ecx
00d9eb07 and      edx, 0xf
00d9eb0a sub      ecx, edx
00d9eb0c mov      edi, ecx
00d9eb0e mov      ecx, dword ptr [esp + 0x30]
00d9eb12 lea      edx, [edi + ecx]
00d9eb15 cmp      edx, eax
00d9eb17 jbe      0xd9ea86
00d9eb1d xor      edi, edi
00d9eb1f jmp      0xd9ea86
00d9eb24 cmp      edi, ebp
00d9eb26 sbb      eax, eax
00d9eb28 neg      eax
00d9eb2a mov      ecx, dword ptr [esp + 0x38]
00d9eb2e push     eax
00d9eb2f mov      eax, dword ptr [esp + 0x40]
00d9eb33 push     eax
00d9eb34 push     ecx
00d9eb35 mov      edx, esi
00d9eb37 mov      ecx, ebx
00d9eb39 call     0xd9dfb0
00d9eb3e mov      esi, eax
00d9eb40 mov      eax, dword ptr [ebx + 0x70]
00d9eb43 mov      ecx, dword ptr [esi + 4]
00d9eb46 lea      edx, [eax + esi + 0x20]
00d9eb4a lea      eax, [eax + eax + 0x20]
00d9eb4e sub      ecx, eax
00d9eb50 sub      ecx, esi
00d9eb52 add      ecx, edx
00d9eb54 mov      dword ptr [esp + 0x2c], esi
00d9eb58 mov      dword ptr [esp + 0x14], edx
00d9eb5c test     edi, edi
00d9eb5e jne      0xd9ebd4
00d9eb60 xor      edx, edx
00d9eb62 cmp      dword ptr [esp + 0x44], 2
00d9eb67 jne      0xd9eb80
00d9eb69 mov      edi, ecx
00d9eb6b sub      edi, dword ptr [esp + 0x30]
00d9eb6f mov      eax, edi
00d9eb71 div      dword ptr [esp + 0x34]
00d9eb75 sub      edi, edx
00d9eb77 mov      edx, edi
00d9eb79 and      edx, 0xf
00d9eb7c sub      edi, edx
00d9eb7e jmp      0xd9ebd0
00d9eb80 mov      edi, dword ptr [esp + 0x34]
00d9eb84 lea      esi, [edi + ebp - 1]
00d9eb88 mov      eax, esi
00d9eb8a div      edi
00d9eb8c sub      esi, edx
00d9eb8e add      esi, 0xf
00d9eb91 mov      eax, esi
00d9eb93 and      eax, 0xf
00d9eb96 sub      esi, eax
00d9eb98 cmp      dword ptr [esp + 0x40], 0
00d9eb9d mov      edi, esi
00d9eb9f je       0xd9ebb0
00d9eba1 cmp      ebp, edi
00d9eba3 jne      0xd9ebb0
00d9eba5 mov      edx, dword ptr [esp + 0x30]
00d9eba9 lea      eax, [edi + edx]
00d9ebac cmp      eax, ecx
00d9ebae jbe      0xd9ebd0
00d9ebb0 mov      edi, dword ptr [esp + 0x34]
00d9ebb4 mov      edx, dword ptr [esp + 0x14]
00d9ebb8 lea      esi, [edx + edi - 1]
00d9ebbc mov      eax, esi
00d9ebbe xor      edx, edx
00d9ebc0 div      edi
00d9ebc2 sub      esi, edx
00d9ebc4 add      esi, 0xf
00d9ebc7 mov      eax, esi
00d9ebc9 and      eax, 0xf
00d9ebcc sub      esi, eax
00d9ebce mov      edi, esi
00d9ebd0 mov      esi, dword ptr [esp + 0x2c]
00d9ebd4 cmp      edi, dword ptr [esp + 0x14]
00d9ebd8 jb       0xd9ed59
00d9ebde mov      edx, dword ptr [esp + 0x30]
00d9ebe2 lea      eax, [edi + edx]
00d9ebe5 cmp      eax, ecx
00d9ebe7 ja       0xd9ed59
00d9ebed cmp      dword ptr [esp + 0x40], 0
00d9ebf2 je       0xd9ec0c
00d9ebf4 cmp      edi, ebp
00d9ebf6 je       0xd9ec0c
00d9ebf8 mov      eax, dword ptr [esp + 0x10]
00d9ebfc cmp      eax, edx
00d9ebfe jb       0xd9ec02
00d9ec00 mov      eax, edx
00d9ec02 push     eax
00d9ec03 mov      edx, ebp
00d9ec05 mov      ecx, edi
00d9ec07 call     0xd959c0
00d9ec0c cmp      dword ptr [ebx + 0x74], 1
00d9ec10 jl       0xd9ec76
00d9ec12 mov      eax, dword ptr [esp + 0x10]
00d9ec16 mov      ecx, dword ptr [esp + 0x30]
00d9ec1a mov      dword ptr [esp + 0x2c], eax
00d9ec1e cmp      eax, ecx
00d9ec20 jb       0xd9ec26
00d9ec22 mov      dword ptr [esp + 0x2c], ecx
00d9ec26 mov      ecx, dword ptr [esp + 0x2c]
00d9ec2a add      ecx, edi
00d9ec2c cmp      ecx, ebp
00d9ec2e jbe      0xd9ec68
00d9ec30 lea      ecx, [eax + ebp]
00d9ec33 cmp      ecx, edi
00d9ec35 jbe      0xd9ec68
00d9ec37 cmp      ebp, edi
00d9ec39 jae      0xd9ec51
00d9ec3b mov      dl, byte ptr [0x14570fb]
00d9ec41 mov      eax, edi
00d9ec43 sub      eax, ebp
00d9ec45 push     eax
00d9ec46 mov      ecx, ebp
00d9ec48 call     0xd95820
00d9ec4d mov      eax, dword ptr [esp + 0x10]
00d9ec51 mov      ecx, dword ptr [esp + 0x2c]
00d9ec55 lea      edx, [eax + ebp]
00d9ec58 add      ecx, edi
00d9ec5a cmp      edx, ecx
00d9ec5c jbe      0xd9ec76
00d9ec5e sub      eax, dword ptr [esp + 0x2c]
00d9ec62 sub      eax, edi
00d9ec64 add      eax, ebp
00d9ec66 jmp      0xd9ec6a
00d9ec68 mov      ecx, ebp
00d9ec6a mov      dl, byte ptr [0x14570fb]
00d9ec70 push     eax
00d9ec71 call     0xd95820
00d9ec76 bsr      edx, dword ptr [esp + 0x34]
00d9ec7b setne    al
00d9ec7e push     1
00d9ec80 movzx    eax, al
00d9ec83 push     1
00d9ec85 mov      ecx, edx
00d9ec87 neg      eax
00d9ec89 and      ecx, eax
00d9ec8b mov      eax, dword ptr [esp + 0x38]
00d9ec8f push     ecx
00d9ec90 mov      ecx, dword ptr [esp + 0x48]
00d9ec94 push     eax
00d9ec95 mov      dword ptr [esp + 0x28], edx
00d9ec99 mov      edx, dword ptr [esp + 0x54]
00d9ec9d push     edx
00d9ec9e mov      edx, dword ptr [esp + 0x4c]
00d9eca2 push     ecx
00d9eca3 push     edx
00d9eca4 add      eax, edi
00d9eca6 push     eax
00d9eca7 push     edi
00d9eca8 mov      edx, esi
00d9ecaa mov      ecx, ebx
00d9ecac call     0xd9e320
00d9ecb1 cmp      dword ptr [ebx + 0x74], 1
00d9ecb5 jl       0xd9ed4d
00d9ecbb cmp      dword ptr [esp + 0x40], 0
00d9ecc0 mov      eax, dword ptr [esp + 0x30]
00d9ecc4 je       0xd9ecea
00d9ecc6 mov      ecx, dword ptr [esp + 0x10]
00d9ecca cmp      eax, ecx
00d9eccc jbe      0xd9ed4d
00d9ecce mov      dl, byte ptr [0x14570fa]
00d9ecd4 sub      eax, ecx
00d9ecd6 push     eax
00d9ecd7 add      ecx, edi
00d9ecd9 call     0xd95820
00d9ecde mov      eax, edi
00d9ece0 pop      edi
00d9ece1 pop      esi
00d9ece2 pop      ebp
00d9ece3 pop      ebx
00d9ece4 add      esp, 0x18
00d9ece7 ret      0x1c
00d9ecea add      eax, edi
00d9ecec cmp      eax, ebp
00d9ecee jb       0xd9ed3b
00d9ecf0 mov      esi, dword ptr [esp + 0x10]
00d9ecf4 lea      ebx, [esi + ebp]
00d9ecf7 cmp      ebx, edi
00d9ecf9 jb       0xd9ed3b
00d9ecfb cmp      edi, ebp
00d9ecfd jae      0xd9ed13
00d9ecff mov      eax, ebp
00d9ed01 sub      eax, edi
00d9ed03 je       0xd9ed13
00d9ed05 mov      dl, byte ptr [0x14570fa]
00d9ed0b push     eax
00d9ed0c mov      ecx, edi
00d9ed0e call     0xd95820
00d9ed13 mov      eax, edi
00d9ed15 sub      eax, esi
00d9ed17 sub      eax, ebp
00d9ed19 add      eax, dword ptr [esp + 0x30]
00d9ed1d test     eax, eax
00d9ed1f jle      0xd9ed4d
00d9ed21 mov      dl, byte ptr [0x14570fa]
00d9ed27 push     eax
00d9ed28 mov      ecx, ebx
00d9ed2a call     0xd95820
00d9ed2f mov      eax, edi
00d9ed31 pop      edi
00d9ed32 pop      esi
00d9ed33 pop      ebp
00d9ed34 pop      ebx
00d9ed35 add      esp, 0x18
00d9ed38 ret      0x1c
00d9ed3b mov      ecx, dword ptr [esp + 0x30]
00d9ed3f mov      dl, byte ptr [0x14570fa]
00d9ed45 push     ecx
00d9ed46 mov      ecx, edi
00d9ed48 call     0xd95820
00d9ed4d mov      eax, edi
00d9ed4f pop      edi
00d9ed50 pop      esi
00d9ed51 pop      ebp
00d9ed52 pop      ebx
00d9ed53 add      esp, 0x18
00d9ed56 ret      0x1c
00d9ed59 mov      edx, dword ptr [esp + 0x1c]
00d9ed5d mov      eax, dword ptr [esp + 0x20]
00d9ed61 mov      ecx, dword ptr [esp + 0x24]
00d9ed65 push     1
00d9ed67 push     1
00d9ed69 push     edx
00d9ed6a mov      edx, dword ptr [esp + 0x48]
00d9ed6e push     eax
00d9ed6f mov      eax, dword ptr [esp + 0x48]
00d9ed73 push     ecx
00d9ed74 mov      ecx, dword ptr [esp + 0x24]
00d9ed78 push     edx
00d9ed79 push     eax
00d9ed7a add      ecx, ebp
00d9ed7c push     ecx
00d9ed7d push     ebp
00d9ed7e mov      edx, esi
00d9ed80 mov      ecx, ebx
00d9ed82 call     0xd9e320
00d9ed87 pop      edi
00d9ed88 pop      esi
00d9ed89 pop      ebp
00d9ed8a xor      eax, eax
00d9ed8c pop      ebx
00d9ed8d add      esp, 0x18
00d9ed90 ret      0x1c
00d9ed93 int3     
00d9ed94 int3     
00d9ed95 int3     
00d9ed96 int3     
00d9ed97 int3     
00d9ed98 int3     
00d9ed99 int3     
00d9ed9a int3     
00d9ed9b int3     
00d9ed9c int3     
00d9ed9d int3     
00d9ed9e int3     
00d9ed9f int3     
00d9eda0 push     esi
00d9eda1 mov      esi, ecx
00d9eda3 mov      ecx, dword ptr [esi + 0x1d8]
00d9eda9 push     edi
00d9edaa test     ecx, ecx
00d9edac je       0xd9ee25
00d9edae cmp      byte ptr [esi + 0x7d], 0
00d9edb2 jne      0xd9ee25
00d9edb4 push     ebx
00d9edb5 mov      ebx, dword ptr [esi + 0x70]
00d9edb8 mov      eax, edx
00d9edba sub      eax, ebx
00d9edbc mov      eax, dword ptr [eax - 0x10]
00d9edbf push     ebp
00d9edc0 test     eax, eax
00d9edc2 je       0xd9edf5
00d9edc4 lea      edi, [eax + 3]
00d9edc7 mov      ebp, edi
00d9edc9 and      ebp, 3
00d9edcc sub      edi, ebp
00d9edce cmp      edi, eax
00d9edd0 jne      0xd9edf5
00d9edd2 mov      eax, dword ptr [eax + 8]
00d9edd5 test     eax, eax
00d9edd7 je       0xd9edf5
00d9edd9 lea      edi, [eax + 3]
00d9eddc mov      ebp, edi
00d9edde and      ebp, 3
00d9ede1 sub      edi, ebp
00d9ede3 cmp      edi, eax
00d9ede5 jne      0xd9edf5
00d9ede7 cmp      dword ptr [eax + 4], 0x93d82b95
00d9edee jne      0xd9edf5
00d9edf0 cmp      dword ptr [eax + 0x70], ebx
00d9edf3 je       0xd9edf7
00d9edf5 xor      eax, eax
00d9edf7 pop      ebp
00d9edf8 pop      ebx
00d9edf9 cmp      eax, esi
00d9edfb je       0xd9ee25
00d9edfd mov      edi, dword ptr [esp + 0x18]
00d9ee01 push     edi
00d9ee02 mov      edi, dword ptr [esp + 0x18]
00d9ee06 push     edi
00d9ee07 mov      edi, dword ptr [esp + 0x18]
00d9ee0b push     edi
00d9ee0c mov      edi, dword ptr [esp + 0x18]
00d9ee10 mov      byte ptr [esi + 0x7d], 1
00d9ee14 mov      eax, dword ptr [ecx]
00d9ee16 mov      eax, dword ptr [eax + 0x10]
00d9ee19 push     edi
00d9ee1a call     eax
00d9ee1c pop      edi
00d9ee1d mov      byte ptr [esi + 0x7d], 0
00d9ee21 pop      esi
00d9ee22 ret      0x10
00d9ee25 mov      ecx, dword ptr [esp + 0x18]
00d9ee29 mov      eax, dword ptr [esp + 0x14]
00d9ee2d push     0
00d9ee2f push     0
00d9ee31 push     ecx
00d9ee32 mov      ecx, dword ptr [esp + 0x1c]
00d9ee36 push     eax
00d9ee37 mov      eax, dword ptr [esp + 0x1c]
00d9ee3b push     1
00d9ee3d push     ecx
00d9ee3e push     eax
00d9ee3f mov      ecx, esi
00d9ee41 call     0xd9e950
00d9ee46 pop      edi
00d9ee47 pop      esi
00d9ee48 ret      0x10
00d9ee4b int3     
00d9ee4c int3     
00d9ee4d int3     
00d9ee4e int3     
00d9ee4f int3     
