Function at 0x61abf0
Capabilities:
Capture screenshot

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x65c228
push eax
mov dword fs:[0], esp
sub esp, 0x80
push ebx
mov ebx, ecx
push edi
fld qword [ebx + 0x11a]
fcomp qword [0x665ef8]
fnstsw ax
test ah, 1
jne 0x61b758
mov eax, dword [ebx + 0x47cdc]
xor edi, edi
cmp eax, edi
jne 0x61ac3e
cmp dword [0x8267b0], edi
jne 0x61b758
push ebp
push esi
mov esi, dword [esp + 0xa0]
cmp esi, edi
mov dword [esp + 0x18], esi
jne 0x61ac68
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x20]
push eax
call dword [fcn.0065f510]
push eax
call fcn.00644092
mov dword [esp + 0x18], eax
mov esi, eax
lea ecx, [esp + 0x64]
call fcn.0064414c
mov dword [esp + 0x98], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], 0x661a18
cmp esi, edi
mov byte [esp + 0x98], 1
jne 0x61ac94
xor eax, eax
jmp 0x61ac97
mov eax, dword [esi + 4]
push eax
call dword [fcn.0065e0d0]
push eax
lea ecx, [esp + 0x68]
call fcn.00644146
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 8]
sub eax, ecx
mov ecx, dword [esi + 4]
sub eax, 0x12
push eax
push 0x37
push ecx
call dword [fcn.0065e0c8]
push eax
lea ecx, [esp + 0x40]
call fcn.006440f8
mov edx, dword [esp + 0x40]
lea eax, [esp + 0x3c]
neg eax
sbb eax, eax
and eax, edx
mov edx, dword [esp + 0x68]
push eax
push edx
call fcn.00644140
mov esi, dword [ebx + 8]
mov dword [esp + 0x38], eax
mov eax, dword [ebx + 0x10]
push 6
sub eax, esi
lea ecx, [esp + 0x68]
sub eax, 0x12
push eax
push 0x37
push edi
push edi
push ecx
mov ecx, 0x732bc0
call fcn.004961f0
push 1
lea ecx, [esp + 0x68]
call fcn.0064412e
lea edx, [esp + 0x64]
push 3
push edx
mov ecx, 0x732bc0
call fcn.00495d00
mov dword [esp + 0x34], eax
lea eax, [esp + 0x64]
push edi
push eax
mov ecx, 0x732bc0
call fcn.00495c80
fild dword [esp + 0xa4]
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], 2
fstp qword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
push ecx
push edx
mov ecx, ebx
call fcn.0061df80
lea ecx, [ebx + 0xaa]
mov dword [esp + 0x2c], eax
push ecx
push eax
call fcn.00473080
mov ebp, eax
add esp, 8
dec ebp
mov edx, dword [ebx + 0x4e]
mov dword [esp + 0x14], edx
lea eax, [ebp + ebp*2]
lea ecx, [ebp + eax*4]
fld dword [ebx + ecx*2 + 0x2c6]
fld dword [ebx + ecx*2 + 0x2ca]
lea ecx, [ebx + ecx*2]
fcompp
fnstsw ax
test ah, 1
je 0x61ada8
fld dword [ecx + 0x2c6]
jmp 0x61adae
fld dword [ecx + 0x2ca]
fcom qword [0x672488]
fnstsw ax
test ah, 1
jne 0x61adc3
fstp st(0)
mov dword [esp + 0x14], edi
jmp 0x61add8
fcomp qword [0x665ee8]
fnstsw ax
test ah, 1
jne 0x61add8
mov dword [esp + 0x14], 1
lea esi, [ecx + 0x2c4]
mov ecx, 6
lea edi, [esp + 0x74]
mov eax, dword [ebx + 0x96]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebx + 0x1a6]
movsw word es:[edi], word [esi]
mov edi, dword [0x6a2d04]
mov dword [esp + 0x10], edx
test eax, eax
je 0x61ae07
mov edi, eax
mov ecx, dword [ebx + 0xa6]
test ecx, ecx
je 0x61ae1b
test eax, eax
jne 0x61ae1b
mov edi, dword [ebx + 0x299]
mov eax, dword [ebx + 0x6826c]
test eax, eax
je 0x61af80
mov ecx, dword [ebx + 0xfe]
mov eax, dword [ebx + 0x102]
sub eax, ecx
mov edx, dword [ebx + 0x68270]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
fild dword [esp + 0x1c]
mov dword [esp + 0x1c], edx
fstp qword [esp + 0x54]
fild dword [ebx + 0xd2]
fstp qword [esp + 0x5c]
fild dword [ebx + 0x47ca0]
fstp qword [esp + 0x4c]
fild dword [esp + 0x1c]
fmul qword [esp + 0x54]
fmul qword [esp + 0x5c]
fdiv qword [esp + 0x4c]
fiadd dword [esp + 0x20]
fcomp qword [esp + 0x44]
fnstsw ax
test ah, 0x41
jne 0x61af09
dec edx
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0xa4]
fild dword [esp + 0x20]
sub edx, ecx
dec edx
mov dword [esp + 0x20], edx
fild dword [esp + 0x20]
fmul qword [esp + 0x4c]
fld qword [esp + 0x54]
fmul qword [esp + 0x5c]
fdivp st(1)
fstp qword [esp + 0x5c]
fcom qword [esp + 0x5c]
fnstsw ax
test ah, 1
jne 0x61aec6
fstp st(0)
fld qword [esp + 0x5c]
call fcn.00645030
lea ecx, [eax + eax*2]
lea edi, [esp + 0x74]
fld dword [ebx + eax*4 + 0xc75e4]
lea ecx, [ecx + ecx*4]
fstp dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea ebp, [ebp + ecx*4]
lea edx, [ebp + ebp*2]
lea ecx, [ebp + edx*4]
lea esi, [ebx + ecx*2 + 0x68274]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebx + eax*4 + 0xc760c]
mov eax, dword [ebx + 0x6826c]
test eax, eax
je 0x61af80
mov edx, dword [0x73a974]
push 0x6a0bcc
push 0
push edx
push 2
lea eax, [esp + 0x74]
push 2
lea ecx, [esp + 0x70]
push eax
push ecx
push 0x732bc0
call fcn.00496440
mov edx, dword [eax]
push edi
mov dword [esp + 0x48], edx
mov eax, dword [eax + 4]
lea esi, [eax + 4]
call fcn.00473400
add esp, 0x24
lea ecx, [esp + 0x64]
lea edx, [esp + 0x5c]
push eax
mov eax, dword [0x73a964]
push 0x35
push eax
push esi
push 0
push ecx
push edx
push 0x732bc0
call fcn.00496440
mov ecx, dword [eax]
add esp, 0x20
mov dword [esp + 0x24], ecx
mov eax, dword [eax + 4]
lea esi, [esi + eax + 2]
jmp 0x61af84
mov esi, dword [esp + 0x24]
mov edx, dword [0x73a974]
push 0x6a0b94
push 0
push edx
push esi
lea eax, [esp + 0x74]
push 2
lea ecx, [esp + 0x70]
push eax
push ecx
push 0x732bc0
call fcn.00496440
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov eax, dword [eax + 4]
lea esi, [esi + eax + 2]
mov eax, dword [esp + 0x4c]
push eax
call fcn.004732f0
mov ecx, dword [0x73a964]
add esp, 0x24
lea edx, [esp + 0x64]
push eax
push 0x35
push ecx
push esi
push 0
lea eax, [esp + 0x70]
push edx
push eax
push 0x732bc0
call fcn.00496440
mov ecx, dword [eax]
mov edx, dword [0x73a974]
add esp, 0x20
mov dword [esp + 0x24], ecx
mov eax, dword [eax + 4]
lea ecx, [esp + 0x5c]
push 0x6c1258
push 0
lea esi, [esi + eax + 2]
push edx
push esi
lea eax, [esp + 0x74]
push 2
push eax
push ecx
push 0x732bc0
call fcn.00496440
mov edx, dword [eax]
mov ebp, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
add esp, 0x20
mov eax, dword [eax + 4]
mov dword [esp + 0x24], edx
push 0
push 0x35
lea esi, [esi + eax + 2]
mov eax, dword [esp + 0x7e]
push ebp
push edi
push eax
push esi
lea ecx, [esp + 0x7c]
push 0
lea edx, [esp + 0x78]
push ecx
push edx
mov ecx, 0x732bc0
call fcn.00496a70
mov ecx, dword [eax]
mov edx, dword [0x73a974]
push 0x6b6170
push 0
mov eax, dword [eax + 4]
push edx
mov dword [esp + 0x30], ecx
lea esi, [esi + eax + 2]
lea eax, [esp + 0x70]
push esi
push 2
lea ecx, [esp + 0x70]
push eax
push ecx
push 0x732bc0
call fcn.00496440
mov edx, dword [eax]
add esp, 0x20
mov dword [esp + 0x24], edx
lea ecx, [esp + 0x64]
mov eax, dword [eax + 4]
push 0
push 0x35
push ebp
lea esi, [esi + eax + 2]
mov eax, dword [esp + 0x86]
push edi
push eax
push esi
push 0
lea edx, [esp + 0x78]
push ecx
push edx
mov ecx, 0x732bc0
call fcn.00496a70
mov ecx, dword [eax]
mov edx, dword [0x73a974]
push 0x6c02f4
push 0
mov eax, dword [eax + 4]
push edx
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x68]
lea esi, [esi + eax + 2]
lea eax, [esp + 0x70]
push esi
push 2
push eax
push ecx
push 0x732bc0
call fcn.00496440
mov edx, dword [eax]
add esp, 0x20
fld dword [esp + 0x76]
fcomp dword [0x65f998]
mov eax, dword [eax + 4]
push 0
mov dword [esp + 0x28], edx
push 0x35
lea esi, [esi + eax + 2]
fnstsw ax
test ah, 0x41
jne 0x61b142
mov eax, dword [ebx + 0x4e]
lea edx, [esp + 0x64]
fld dword [esp + 0x7e]
fsub dword [esp + 0x18]
push eax
push 0
push ecx
lea ecx, [esp + 0x78]
fstp dword [esp]
push esi
push 0
push ecx
push edx
mov ecx, 0x732bc0
call fcn.00496a70
mov ecx, dword [eax]
mov dword [esp + 0x24], ecx
jmp 0x61b167
mov edx, dword [ebx + 0x4e]
lea eax, [esp + 0x6c]
push edx
push 0
push 0
push esi
push 0
lea ecx, [esp + 0x78]
push eax
push ecx
mov ecx, 0x732bc0
call fcn.00496a70
mov edx, dword [eax]
mov dword [esp + 0x24], edx
mov eax, dword [eax + 4]
push 0x6c02ec
push 0
lea ecx, [esp + 0x6c]
lea esi, [esi + eax + 2]
mov eax, dword [0x73a974]
push eax
push esi
push 2
lea edx, [esp + 0x70]
push ecx
push edx
push 0x732bc0
call fcn.00496440
fld dword [esp + 0x96]
fcomp dword [0x65f998]
mov ecx, dword [eax]
add esp, 0x20
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 4]
fnstsw ax
lea esi, [esi + ecx + 2]
test ah, 0x41
jne 0x61b205
fld dword [esp + 0x10]
fcomp dword [0x65f998]
fnstsw ax
test ah, 0x41
jne 0x61b205
fld dword [esp + 0x76]
fsub dword [esp + 0x10]
push 1
push 0x35
push 2
push 0
fmul dword [0x65f9a8]
push ecx
lea edx, [esp + 0x78]
lea eax, [esp + 0x70]
mov ecx, 0x732bc0
fdiv dword [esp + 0x24]
fstp dword [esp]
push esi
push 0
push edx
push eax
call fcn.00496a70
mov ecx, dword [eax]
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 4]
mov eax, dword [ebx + 0x5e]
lea esi, [esi + ecx + 2]
test eax, eax
jne 0x61b21c
mov eax, dword [ebx + 0x66]
test eax, eax
mov eax, 0x6a0bf4
je 0x61b221
mov eax, 0x6a0bfc
mov edx, dword [0x73a974]
push eax
push 0
push edx
push esi
lea eax, [esp + 0x74]
push 2
lea ecx, [esp + 0x70]
push eax
push ecx
push 0x732bc0
call fcn.00496440
mov edx, dword [eax]
add esp, 0x20
mov dword [esp + 0x24], edx
mov eax, dword [eax + 4]
lea esi, [esi + eax + 2]
mov eax, dword [ebx + 0x66]
test eax, eax
je 0x61b261
fld dword [0x65f994]
jmp 0x61b267
fld dword [0x663770]
mov eax, dword [esp + 0x7e]
mov dword [esp + 0x60], 0
mov dword [esp + 0x5c], eax
fild qword [esp + 0x5c]
fstp dword [esp + 0x10]
fmul dword [esp + 0x10]
call fcn.00645030
push eax
call fcn.004724d0
mov ecx, dword [0x73a998]
add esp, 4
lea edx, [esp + 0x64]
push eax
push 0x35
push ecx
push esi
push 0
lea eax, [esp + 0x70]
push edx
push eax
push 0x732bc0
call fcn.00496440
mov ecx, dword [eax]
mov ebp, dword [esp + 0xaa]
mov dword [esp + 0x44], ecx
add esp, 0x20
mov eax, dword [eax + 4]
lea esi, [esi + eax + 2]
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0xed], 3
jne 0x61b33d
mov edx, dword [0x73a964]
push 0x6b5cd4
push 0
push edx
push esi
lea eax, [esp + 0x74]
push 2
lea ecx, [esp + 0x70]
push eax
push ecx
push 0x732bc0
call fcn.00496440
mov edx, dword [eax]
push ebp
mov dword [esp + 0x48], edx
mov eax, dword [eax + 4]
lea esi, [esi + eax + 2]
call fcn.004724d0
add esp, 0x24
lea ecx, [esp + 0x64]
lea edx, [esp + 0x5c]
push eax
mov eax, dword [0x73a998]
push 0x69a8e4
push 0x35
push eax
push esi
push 0
push ecx
push edx
push 0x732bc0
call fcn.00496440
add esp, 0x24
jmp 0x61b3e1
mov ecx, dword [ebx + 0x5e]
test ecx, ecx
jne 0x61b3ee
mov ecx, dword [ebx + 0x66]
test ecx, ecx
jne 0x61b3ee
movsx dx, byte [eax + 0xec]
push eax
push edx
call fcn.00474010
add esp, 8
test ax, ax
je 0x61b3ee
mov eax, dword [0x73a974]
push 0x6a0bfc
push 0
push eax
push esi
lea ecx, [esp + 0x74]
push 2
lea edx, [esp + 0x70]
push ecx
push edx
push 0x732bc0
call fcn.00496440
mov edx, dword [ebx + 0x48]
mov ecx, dword [eax]
fld dword [esp + 0x96]
fmul dword [edx + 0xc]
mov eax, dword [eax + 4]
mov dword [esp + 0x44], ecx
fmul dword [esp + 0x30]
lea esi, [esi + eax + 2]
call fcn.00645030
push eax
call fcn.004724d0
add esp, 0x24
lea ecx, [esp + 0x64]
lea edx, [esp + 0x5c]
push eax
mov eax, dword [0x73a998]
push 0x37
push eax
push esi
push 0
push ecx
push edx
push 0x732bc0
call fcn.00496440
add esp, 0x20
mov ecx, dword [eax]
mov dword [esp + 0x24], ecx
mov eax, dword [eax + 4]
lea esi, [esi + eax + 2]
mov eax, dword [ebx + 0x9e]
test eax, eax
je 0x61b633
mov eax, dword [ebx + 0x86]
test eax, eax
je 0x61b5bf
mov edx, dword [0x73a974]
push 0x6c07b8
push 0
push edx
push esi
lea eax, [esp + 0x74]
push 2
lea ecx, [esp + 0x70]
push eax
push ecx
push 0x732bc0
call fcn.00496440
fld dword [esp + 0xaa]
fcomp dword [0x65f998]
mov edx, dword [eax]
add esp, 0x20
mov dword [esp + 0x24], edx
mov ecx, dword [eax + 4]
fnstsw ax
lea esi, [esi + ecx + 2]
test ah, 0x41
jne 0x61b47e
mov eax, dword [esp + 0x14]
push 0
push 0x35
push eax
push edi
push ebp
push esi
lea ecx, [esp + 0x7c]
push 0
lea edx, [esp + 0x78]
push ecx
push edx
mov ecx, 0x732bc0
call fcn.00496a70
mov ecx, dword [eax]
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 4]
mov edx, dword [0x73a974]
push 0x6c2270
lea esi, [esi + ecx + 2]
push 0
push edx
push esi
lea eax, [esp + 0x74]
push 2
lea ecx, [esp + 0x70]
push eax
push ecx
push 0x732bc0
call fcn.00496440
fld dword [esp + 0xaa]
fcomp dword [0x65f998]
mov edx, dword [eax]
add esp, 0x20
mov dword [esp + 0x24], edx
mov ecx, dword [eax + 4]
fnstsw ax
lea esi, [esi + ecx + 2]
test ah, 0x41
jne 0x61b516
fld dword [esp + 0x76]
fcomp dword [0x65f998]
fnstsw ax
test ah, 0x41
jne 0x61b516
mov eax, dword [esp + 0x14]
push 0
fld dword [esp + 0x7a]
fsub dword [esp + 0x8e]
push 0x35
push eax
push 0
push ecx
fstp dword [esp]
push esi
lea ecx, [esp + 0x7c]
push 0
lea edx, [esp + 0x78]
push ecx
push edx
mov ecx, 0x732bc0
call fcn.00496a70
mov ecx, dword [eax]
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 4]
mov edx, dword [0x73a974]
push 0x6c2268
lea esi, [esi + ecx + 2]
push 0
push edx
push esi
lea eax, [esp + 0x74]
push 2
lea ecx, [esp + 0x70]
push eax
push ecx
push 0x732bc0
call fcn.00496440
fld dword [esp + 0xaa]
fcomp dword [0x65f998]
mov edx, dword [eax]
add esp, 0x20
mov dword [esp + 0x24], edx
mov ecx, dword [eax + 4]
fnstsw ax
lea esi, [esi + ecx + 2]
test ah, 0x41
jne 0x61b62f
fld dword [esp + 0x76]
fcomp dword [0x65f998]
fnstsw ax
test ah, 0x41
jne 0x61b62f
fld dword [esp + 0x76]
fsub dword [esp + 0x8a]
push 1
push 0x35
push 2
push 0
fmul dword [0x65f9a8]
push ecx
lea eax, [esp + 0x78]
lea ecx, [esp + 0x70]
fdiv dword [esp + 0x9e]
fstp dword [esp]
push esi
push 0
push eax
push ecx
mov ecx, 0x732bc0
call fcn.00496a70
mov edx, dword [eax]
mov dword [esp + 0x24], edx
jmp 0x61b62c
mov eax, dword [0x73a974]
push 0x6c2084
push 0
push eax
push esi
lea ecx, [esp + 0x74]
push 2
lea edx, [esp + 0x70]
push ecx
push edx
push 0x732bc0
call fcn.00496440
fld dword [esp + 0xaa]
fcomp dword [0x65f998]
mov ecx, dword [eax]
add esp, 0x20
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 4]
fnstsw ax
lea esi, [esi + ecx + 2]
test ah, 0x41
jne 0x61b62f
push 0
push 0x35
push 4
push edi
push ebp
push esi
lea edx, [esp + 0x7c]
push 0
lea eax, [esp + 0x78]
push edx
push eax
mov ecx, 0x732bc0
call fcn.00496a70
mov ecx, dword [eax]
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 4]
lea esi, [esi + ecx + 2]
lea edx, [esi - 1]
lea eax, [esp + 0x64]
push edx
push 0x36
push 0
push 0
push eax
mov ecx, 0x732bc0
call fcn.00495f40
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x64]
push ecx
push edx
mov ecx, 0x732bc0
call fcn.00495ca0
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x64]
push eax
push ecx
mov ecx, 0x732bc0
call fcn.00495d20
mov eax, dword [esp + 0xa8]
test eax, eax
je 0x61b6ac
mov edi, dword [esp + 0x68]
lea eax, [esp + 0x64]
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 4]
neg eax
sbb eax, eax
push 0xcc0020
and eax, edi
push 0
push 0
push eax
push esi
push 0x37
push ecx
push edx
mov edx, dword [esp + 0x38]
mov eax, dword [edx + 4]
push eax
jmp 0x61b6d3
mov ebp, dword [esp + 0x68]
lea eax, [esp + 0x64]
mov ecx, dword [esp + 0x18]
push 0xcc0020
neg eax
mov edx, dword [ecx + 4]
push 0
sbb eax, eax
push 0
and eax, ebp
push eax
push esi
push 0x37
push 0
push 0
push edx
call dword [fcn.0065e0cc]
mov eax, dword [esp + 0x38]
pop esi
test eax, eax
pop ebp
je 0x61b6e6
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x64]
push eax
call fcn.00644140
lea ecx, [esp + 0x34]
call fcn.0064406e
lea ecx, [esp + 0x5c]
call fcn.00644134
mov eax, dword [esp + 0x98]
test eax, eax
jne 0x61b723
mov ecx, dword [esp + 0x10]
mov ebx, dword [ebx + 0x14]
mov edx, dword [ecx + 4]
mov eax, dword [ebx + 0x20]
push edx
push eax
call dword [fcn.0065f4e8]
mov dword [esp + 0x34], 0x661578
lea ecx, [esp + 0x34]
mov byte [esp + 0x90], 2
call fcn.0064406e
lea ecx, [esp + 0x5c]
mov dword [esp + 0x34], 0x6602dc
mov dword [esp + 0x90], 0xffffffff
call fcn.0064411c
mov ecx, dword [esp + 0x88]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x8c
ret 0xc