Function at 0x66b450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x4f4]
cmp eax, dword [ecx + 8]
jbe 0x66c706
sub esp, 0x574
lea edi, [esp + 0x400]
xor eax, eax
call fcn.0044f1be
mov ecx, dword [esp + 0x578]
mov dword [esp + 0x438], ecx
mov edx, dword [esp + 0x57c]
mov dword [esp + 0x43c], edx
lea edi, [esp + 0x508]
call fcn.0044f1b5
call fcn.0043ec30
lea edi, [esp + 0x128]
xor eax, eax
call fcn.0044f1c9
lea edi, [esp + 0x49c]
call fcn.0044f1b5
lea ecx, [esp + 0x49c]
mov dword [esp + 0x134], ecx
call fcn.0043ec30
mov ecx, dword [esp]
mov dword [esp + 0x130], ecx
lea edi, [esp + 0x10c]
xor eax, eax
call fcn.0044f1c9
lea edi, [esp + 0x448]
call fcn.0044f1bb
lea ecx, [esp + 0x448]
mov dword [esp + 0x118], ecx
call fcn.0043ec30
mov ecx, dword [esp]
mov dword [esp + 0x114], ecx
mov dword [esp + 0xec], 0
mov dword [esp + 0xf0], 0
mov dword [esp + 0xf4], 0
lea edi, [esp + 0xf8]
xor eax, eax
call fcn.0044f1cb
lea ecx, [esp + 8]
mov dword [esp + 0xd8], ecx
mov edx, 1
mov ebx, 1
lea ebp, [esp + 0x400]
xor esi, esi
lea edi, [esp + 0x3c]
lea edx, [esp + 0x128]
mov dword [esp + 0xa8], edx
mov edx, 1
jmp 0x66b662
mov esi, eax
mov eax, dword [esp + 0xc8]
add eax, 0x48
mov ebp, esi
mov esi, ecx
mov ecx, eax
mov edi, edx
mov edx, ebx
mov ebx, edi
mov dword [esp + 0xc8], ecx
mov dword [esp + 0x94], edx
mov dword [esp + 0xd4], ebx
mov dword [esp + 0x90], ebp
mov dword [esp + 0x54], esi
lea edi, [esp + 0x3b8]
mov esi, ecx
call fcn.0044f62c
lea edi, [esp + 0x298]
lea esi, [esp + 0x3b8]
call fcn.0044f62c
lea ecx, [0x7afa00]
mov dword [esp], ecx
lea ecx, [esp + 0x10c]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x2d0]
mov dword [esp + 8], ecx
call fcn.0040ae60
mov eax, dword [esp + 0xc]
movzx eax, byte [eax]
test al, al
je 0x66b6b1
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0xd4]
mov ebx, dword [esp + 0x94]
inc ebx
mov ebp, dword [esp + 0x50]
cmp ebx, ebp
jl 0x66b585
mov ebx, eax
mov ebp, edx
mov esi, dword [esp + 0x98]
mov edi, dword [esp + 0xd0]
mov eax, dword [esp + 0xcc]
mov dword [esp + 0xa8], eax
xor eax, eax
mov edx, ecx
mov ecx, dword [esp + 0xd8]
test ebx, ebx
jle 0x66c12d
mov dword [esp + 0x54], esi
mov dword [esp + 0xd4], edi
mov dword [esp + 0x98], edx
mov dword [esp + 0x50], ebx
mov dword [esp + 0xd0], ebp
call fcn.0040aa60
mov eax, dword [esp]
mov dword [esp + 0xcc], eax
mov ecx, dword [esp + 0xd0]
xor edx, edx
mov ebx, dword [esp + 0xd4]
xor ebp, ebp
mov esi, dword [esp + 0x54]
jmp 0x66b59d
lea eax, [0x7afa00]
mov dword [esp], eax
lea ecx, [esp + 0x10c]
mov dword [esp + 4], ecx
lea edx, [esp + 0x2d0]
mov dword [esp + 8], edx
call fcn.0040b4a0
mov eax, dword [esp + 0xc]
mov byte [eax], 1
xor eax, eax
mov ecx, dword [esp + 0xd4]
mov edx, dword [esp + 0x90]
mov ebx, dword [esp + 0x54]
jmp 0x66b6ff
mov ebp, dword [esp + 0x64]
inc ebp
mov ebx, edx
mov edx, ecx
mov ecx, eax
mov eax, ebp
mov dword [esp + 0x64], eax
mov dword [esp + 0xd4], ecx
mov dword [esp + 0x90], edx
mov dword [esp + 0x54], ebx
mov ebp, dword [esp + 0x2d0]
mov esi, dword [esp + 0x2d4]
mov ebp, dword [ebp + 0x64]
mov dword [esp], esi
call ebp
mov eax, dword [esp + 0x64]
cmp dword [esp + 4], eax
jle 0x66c116
mov ecx, dword [esp + 0x2d0]
mov ecx, dword [ecx + 0x2c]
mov edx, dword [esp + 0x2d4]
mov dword [esp], edx
mov dword [esp + 4], eax
call ecx
lea edi, [esp + 0x144]
mov esi, dword [esp + 0xd8]
call fcn.0044f65e
mov eax, dword [esp + 0x150]
movzx ecx, byte [esp + 0x174]
test eax, eax
test cl, cl
jne 0x66c078
test eax, eax
je 0x66b79a
mov eax, dword [esp + 0xd4]
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x54]
jmp 0x66b6f2
mov eax, dword [esp + 0x160]
mov ecx, dword [esp + 0x15c]
nop
mov dword [esp], ecx
mov dword [esp + 4], eax
lea eax, [0x814795]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
call fcn.0046e0b0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp eax, 1
jne 0x66b7f0
cmp byte [ecx], 0x2d
jne 0x66b7f0
mov eax, dword [esp + 0xd4]
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x54]
jmp 0x66b6f2
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.006723c0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x4c], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xa4], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x58], edx
mov ebx, dword [esp + 8]
mov dword [esp + 0xb4], ebx
mov dword [esp], ebx
mov dword [esp + 4], edx
call fcn.0066a410
movzx eax, byte [esp + 8]
test al, al
je 0x66c06f
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0xb4]
mov dword [esp + 0x58], eax
mov dword [esp + 0xb4], ecx
mov edx, dword [esp + 0x2c8]
lea ebx, [0x7ab300]
mov dword [esp], ebx
inc edx
mov dword [esp + 0x60], edx
mov dword [esp + 4], edx
mov dword [esp + 8], edx
call fcn.0043a890
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x2c4]
mov edx, dword [esp + 0x2c8]
mov ebx, dword [esp + 0x60]
cmp ebx, edx
jle 0x66c068
mov dword [esp + 0xc4], eax
cmp eax, ecx
je 0x66b8af
mov dword [esp], eax
mov dword [esp + 4], ecx
shl edx, 2
mov dword [esp + 8], edx
call fcn.0044f8d0
mov eax, dword [esp + 0x2c8]
mov ecx, dword [esp + 0x60]
cmp eax, ecx
jae 0x66c6ff
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0xc4]
mov dword [edx + eax*4], ecx
mov eax, dword [esp + 0x154]
mov dword [esp + 0x70], eax
mov ebx, dword [esp + 0x158]
mov dword [esp + 0xb8], ebx
mov ebp, dword [eax + 0x60]
mov dword [esp], ebx
call ebp
mov eax, dword [esp + 8]
test eax, eax
je 0x66c048
xor eax, eax
test al, al
jne 0x66c028
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x70], eax
mov dword [esp + 0xb8], ecx
mov edx, dword [esp + 0xa4]
mov dword [esp], edx
mov ebx, dword [esp + 0x4c]
mov dword [esp + 4], ebx
lea ebp, [0x814e87]
mov dword [esp + 8], ebp
mov dword [esp + 0xc], 6
call fcn.00672480
movzx eax, byte [esp + 0x10]
test al, al
jne 0x66bff3
xor eax, eax
mov byte [esp + 0x3e], al
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x66bfb4
mov edx, 1
test dl, dl
je 0x66bdc0
test ecx, ecx
jne 0x66bdb2
mov edx, dword [esp + 0x144]
mov ebx, dword [esp + 0x148]
mov dword [esp + 0xb4], edx
mov dword [esp + 0x8c], ebx
mov eax, dword [esp + 0xa4]
mov dword [esp], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], eax
lea eax, [0x815cff]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 9
call fcn.00672480
movzx eax, byte [esp + 0x10]
lea edi, [esp + 0x208]
lea esi, [0x8bc2e0]
call fcn.0044f62c
mov ecx, dword [esp + 0xb4]
mov dword [esp + 0x208], ecx
mov ecx, dword [esp + 0x8c]
mov dword [esp + 0x20c], ecx
mov ecx, dword [esp + 0x58]
test ecx, ecx
setne cl
mov byte [esp + 0x230], cl
mov ecx, dword [esp + 0xc4]
mov dword [esp + 0x234], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x238], ecx
mov dword [esp + 0x23c], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x240], ecx
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x244], ecx
mov byte [esp + 0x248], al
movzx eax, byte [esp + 0x3e]
mov byte [esp + 0x249], al
mov dword [esp], 0
mov eax, dword [esp + 0x20c]
mov ecx, dword [esp + 0x208]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0043dea0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x210], edx
mov dword [esp + 0x214], ecx
mov dword [esp + 0x218], eax
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0066c870
mov eax, dword [esp + 0xc]
mov dword [esp + 0x21c], eax
nop
mov dword [esp + 0xfc], 0
mov dword [esp + 0x104], 0
mov byte [esp + 0x108], 0
lea eax, [esp + 0xf8]
mov dword [esp], eax
lea ecx, [0x81416b]
mov dword [esp + 4], ecx
mov dword [esp + 8], 1
call fcn.00504450
lea eax, [esp + 0xf8]
mov dword [esp], eax
mov ecx, dword [esp + 0x218]
mov edx, dword [esp + 0x214]
mov ebx, dword [esp + 0x210]
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
call fcn.006665a0
lea eax, [esp + 0xf8]
mov dword [esp], eax
lea ecx, [0x81423e]
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00504450
nop
mov eax, dword [esp + 0xfc]
mov ecx, dword [esp + 0xf8]
mov edx, dword [esp + 0x104]
mov ebx, dword [esp + 0x100]
cmp edx, eax
ja 0x66c6f8
mov dword [esp], 0
sub ebx, edx
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and ebx, edx
add ecx, ebx
mov dword [esp + 4], ecx
sub eax, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebp
call fcn.0043dd50
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x228], ecx
mov dword [esp + 0x22c], eax
mov dword [esp], 0
lea eax, [0x81416b]
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov ecx, dword [esp + 0x20c]
mov edx, dword [esp + 0x208]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
lea ecx, [0x81423e]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], 2
call fcn.0043dc30
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x220], ecx
mov dword [esp + 0x224], eax
mov eax, dword [esp + 0xf0]
lea ecx, [eax + 1]
mov edx, dword [esp + 0xf4]
mov ebx, dword [esp + 0xec]
cmp ecx, edx
ja 0x66bd75
lea ecx, [eax + 1]
mov dword [esp + 0xf0], ecx
lea eax, [eax + eax*8]
lea edi, [ebx + eax*8]
mov eax, dword [0xb91180]
test eax, eax
jne 0x66bd53
lea esi, [esp + 0x208]
call fcn.0044f62c
lea eax, [0x7afac0]
mov dword [esp], eax
mov ecx, dword [esp + 0xa8]
mov dword [esp + 4], ecx
lea edx, [esp + 0x2d0]
mov dword [esp + 8], edx
call fcn.0040ae60
mov eax, dword [esp + 0xc]
cmp dword [eax], 1
jle 0x66bce0
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xf0]
lea edx, [ecx - 1]
cmp edx, ecx
jae 0x66c6f1
lea ecx, [ecx + ecx*8]
lea esi, [eax + ecx*8 - 0x48]
lea edi, [esp + 0x370]
call fcn.0044f62c
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xf0]
mov edx, dword [esp + 0xec]
lea ebx, [ecx + 1]
cmp ebx, eax
ja 0x66bd16
lea eax, [ecx + 1]
mov dword [esp + 0xf0], eax
lea eax, [ecx + ecx*8]
lea edi, [edx + eax*8]
mov eax, dword [0xb91180]
test eax, eax
jne 0x66bcf7
lea esi, [esp + 0x370]
call fcn.0044f62c
mov eax, dword [esp + 0xd4]
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x54]
jmp 0x66b6f2
lea eax, [0x7fac20]
mov dword [esp], eax
mov dword [esp + 4], edi
lea eax, [esp + 0x370]
mov dword [esp + 8], eax
call fcn.004101b0
jmp 0x66bce0
lea ebp, [0x7fac20]
mov dword [esp], ebp
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.0043a950
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xf4], eax
mov dword [esp + 0xec], edx
jmp 0x66bcba
lea eax, [0x7fac20]
mov dword [esp], eax
mov dword [esp + 4], edi
lea eax, [esp + 0x208]
mov dword [esp + 8], eax
call fcn.004101b0
jmp 0x66bc45
lea ebp, [0x7fac20]
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
call fcn.0043a950
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xf4], ecx
mov dword [esp + 0xec], ebx
jmp 0x66bc1b
mov edx, dword [esp + 0xb4]
mov ebx, ecx
jmp 0x66b988
mov eax, dword [esp + 0x70]
mov dword [esp + 0xe4], eax
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0xe8], ecx
lea edx, [0x7afac0]
mov dword [esp], edx
mov ebx, dword [esp + 0xcc]
mov dword [esp + 4], ebx
lea ebp, [esp + 0xe4]
mov dword [esp + 8], ebp
call fcn.0040b4a0
mov eax, dword [esp + 0xc]
inc dword [eax]
mov eax, dword [esp + 0x70]
mov dword [esp + 0xe4], eax
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0xe8], ecx
lea edx, [0x7afac0]
mov dword [esp], edx
mov ebx, dword [esp + 0xcc]
mov dword [esp + 4], ebx
lea ebp, [esp + 0xe4]
mov dword [esp + 8], ebp
call fcn.0040ae60
mov eax, dword [esp + 0xc]
cmp dword [eax], 1
je 0x66be68
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0xd4]
mov edx, dword [esp + 0x90]
mov ebx, eax
mov eax, ecx
mov ecx, edx
mov edx, ebx
jmp 0x66b6f2
mov eax, dword [esp + 0x70]
mov ecx, dword [eax + 0x60]
mov edx, dword [esp + 0xb8]
mov dword [esp], edx
call ecx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov dword [esp + 0xc0], ecx
lea edi, [esp + 0x328]
mov edx, eax
xor eax, eax
call fcn.0044f1be
mov ecx, dword [esp + 0xc0]
mov dword [esp + 0x328], ecx
mov dword [esp + 0x32c], edx
mov ecx, dword [esp + 0xc4]
mov dword [esp + 0x354], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x358], ecx
mov dword [esp + 0x35c], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x360], ecx
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x364], ecx
mov ecx, dword [esp + 0x90]
lea edx, [ecx + 1]
mov ebx, dword [esp + 0x54]
cmp edx, ebx
ja 0x66bf72
mov ebp, dword [esp + 0xd4]
lea ecx, [ecx + ecx*8]
lea edi, [ebp + ecx*8]
mov ecx, dword [0xb91180]
test ecx, ecx
jne 0x66bf27
lea esi, [esp + 0x328]
call fcn.0044f62c
mov eax, ebx
mov ecx, ebp
jmp 0x66be5b
mov dword [esp + 0xac], ebp
mov dword [esp + 0x88], edx
mov dword [esp + 0x84], ebx
lea eax, [0x7fac20]
mov dword [esp], eax
mov dword [esp + 4], edi
lea eax, [esp + 0x328]
mov dword [esp + 8], eax
call fcn.004101b0
xor eax, eax
mov edx, dword [esp + 0x88]
mov ebx, dword [esp + 0x84]
mov ebp, dword [esp + 0xac]
jmp 0x66bf1e
lea eax, [0x7fac20]
mov dword [esp], eax
mov ebp, dword [esp + 0xd4]
mov dword [esp + 4], ebp
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
call fcn.0043a950
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
lea edx, [eax + 1]
xor eax, eax
mov ecx, dword [esp + 0x90]
jmp 0x66bf01
movzx edx, byte [esp + 0x174]
test dl, dl
jne 0x66bfca
mov edx, 1
jmp 0x66b96a
mov eax, dword [esp + 0x70]
mov ecx, dword [eax + 0x50]
mov edx, dword [esp + 0xb8]
mov dword [esp], edx
call ecx
cmp dword [esp + 4], 0x19
setne dl
movzx eax, byte [esp + 0x3e]
mov ecx, dword [esp + 0x58]
jmp 0x66b96a
mov eax, dword [esp + 0x70]
mov ecx, dword [eax + 0x50]
mov edx, dword [esp + 0xb8]
mov dword [esp], edx
call ecx
mov eax, dword [esp + 4]
lea ecx, [eax - 1]
cmp ecx, 0xd
ja 0x66c01c
mov eax, 1
jmp 0x66b955
cmp eax, 0x18
je 0x66c012
xor eax, eax
jmp 0x66b955
mov eax, dword [esp + 0x70]
mov eax, dword [eax + 0x28]
mov ecx, dword [esp + 0xb8]
mov dword [esp], ecx
call eax
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
jmp 0x66b912
mov eax, dword [esp + 0x70]
mov ecx, dword [eax + 0x50]
mov edx, dword [esp + 0xb8]
mov dword [esp], edx
call ecx
cmp dword [esp + 4], 0x16
sete al
jmp 0x66b8ff
mov edx, ebx
jmp 0x66b891
xor eax, eax
xor ecx, ecx
jmp 0x66b846
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x154]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x158]
mov dword [esp + 0x9c], ecx
mov edx, dword [eax + 0x50]
mov dword [esp], ecx
call edx
cmp dword [esp + 4], 0x16
je 0x66c0f0
mov eax, dword [esp + 0x8c]
test eax, eax
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0x40]
jne 0x66c0de
xor eax, eax
test al, al
je 0x66b79a
mov eax, dword [esp + 0xd4]
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x54]
jmp 0x66b6f2
mov ecx, dword [ecx + 0x50]
mov dword [esp], eax
call ecx
cmp dword [esp + 4], 0x19
setne al
jmp 0x66c0bf
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x28]
mov ecx, dword [esp + 0x9c]
mov dword [esp], ecx
call eax
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x8c]
test edx, edx
jmp 0x66c0bb
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0xd4]
jmp 0x66b623
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xf0]
mov edx, dword [esp + 0xec]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00407a10
mov eax, dword [esp + 0xc]
mov dword [esp + 0xdc], 0
mov dword [esp + 0xe0], 0
lea ecx, [0x672700]
mov dword [esp + 0xdc], ecx
lea ecx, [esp + 0xec]
mov dword [esp + 0xe0], ecx
lea edx, [0x78f900]
mov dword [esp], edx
mov dword [esp + 4], eax
lea eax, [esp + 0xdc]
mov dword [esp + 8], eax
call fcn.004865f0
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xec]
xor edx, edx
xor ebx, ebx
jmp 0x66c2b1
mov eax, dword [esp + 0x74]
lea esi, [eax + 1]
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0xb0]
mov ebx, dword [esp + 0x5c]
mov ebp, dword [esp + 0x94]
mov dword [esp + 0x74], esi
lea ebp, [esi + edx]
mov dword [esp + 0x90], ebp
mov edx, dword [esp + 0xf0]
mov ecx, dword [esp + 0xec]
cmp ebp, edx
jge 0x66c258
jae 0x66c6e3
lea edx, [ebp + ebp*8]
lea ecx, [ecx + edx*8]
lea edi, [esp + 0x1c0]
mov esi, ecx
call fcn.0044f62c
mov ecx, dword [esp + 0x1c4]
mov edx, dword [esp + 0x1c0]
cmp ecx, ebx
jne 0x66c258
mov dword [esp], edx
mov eax, dword [esp + 0xb0]
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.00402010
movzx eax, byte [esp + 0xc]
test al, al
jne 0x66c1bb
mov ecx, dword [esp + 0x74]
cmp ecx, 1
jne 0x66c3a9
mov ecx, dword [esp + 0x98]
lea edx, [ecx + 1]
mov ebx, dword [esp + 0x48]
cmp edx, ebx
ja 0x66c369
mov eax, dword [esp + 0xd4]
lea ecx, [ecx + ecx*8]
lea edi, [eax + ecx*8]
mov ecx, dword [0xb91180]
test ecx, ecx
jne 0x66c323
lea esi, [esp + 0x250]
call fcn.0044f62c
mov ebp, dword [esp + 0x90]
mov ecx, eax
mov eax, ebx
mov ebx, edx
mov edx, ebp
mov ebp, dword [esp + 0xf0]
mov esi, ebx
mov ebx, dword [esp + 0xec]
cmp edx, ebp
jge 0x66c560
jae 0x66c6ea
mov dword [esp + 0x98], esi
mov dword [esp + 0xd4], ecx
mov dword [esp + 0x68], edx
mov dword [esp + 0x48], eax
lea ebp, [edx + edx*8]
mov dword [esp + 0x94], ebp
lea ebx, [ebx + ebp*8]
lea edi, [esp + 0x250]
mov esi, ebx
call fcn.0044f62c
mov ecx, dword [esp + 0x250]
mov dword [esp + 0xb0], ecx
mov ebx, dword [esp + 0x254]
mov dword [esp + 0x5c], ebx
mov esi, 1
jmp 0x66c1e7
mov dword [esp + 0xa0], eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x80], ebx
lea eax, [0x7fac20]
mov dword [esp], eax
mov dword [esp + 4], edi
lea eax, [esp + 0x250]
mov dword [esp + 8], eax
call fcn.004101b0
mov eax, dword [esp + 0xa0]
mov edx, dword [esp + 0x44]
mov ebx, dword [esp + 0x80]
jmp 0x66c2a2
lea eax, [0x7fac20]
mov dword [esp], eax
mov ebp, dword [esp + 0xd4]
mov dword [esp + 4], ebp
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
call fcn.0043a950
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x98]
jmp 0x66c282
mov edx, dword [esp + 0xf4]
mov ebx, dword [esp + 0xec]
mov ebp, dword [esp + 0x90]
test ebp, ebp
jl 0x66c6dc
mov eax, ecx
mov ecx, dword [esp + 0x68]
cmp ecx, ebp
ja 0x66c6dc
cmp ebp, edx
ja 0x66c6dc
lea edi, [esp + 0x178]
mov esi, eax
xor eax, eax
call fcn.0044f1be
mov ecx, dword [esp + 0x94]
shl ecx, 3
nop
mov edi, ebp
mov ebp, dword [esp + 0x68]
sub edx, ebp
neg edx
sar edx, 0x1f
and ecx, edx
lea edx, [ebx + ecx]
cmp esi, 1
jle 0x66c540
mov ebp, dword [ebx + ecx + 0x78]
cmp dword [edx + 0x30], ebp
jne 0x66c540
movzx ebp, byte [ebx + ecx + 0x28]
movzx ecx, byte [ebx + ecx + 0x70]
xchg ebp, eax
cmp al, cl
xchg ebp, eax
jne 0x66c540
lea edi, [esp + 0x178]
lea esi, [0x8bc340]
call fcn.0044f62c
xor ecx, ecx
mov byte [esp + 0x3f], cl
lea edi, [esp + 0x2e0]
lea esi, [esp + 0x178]
call fcn.0044f62c
movzx ecx, byte [esp + 0x3f]
test cl, cl
je 0x66c529
mov ecx, dword [esp + 0x98]
lea edx, [ecx + 1]
mov ebx, dword [esp + 0x48]
cmp edx, ebx
ja 0x66c4e7
mov ebp, dword [esp + 0xd4]
lea ecx, [ecx + ecx*8]
lea edi, [ebp + ecx*8]
mov ecx, dword [0xb91180]
test ecx, ecx
jne 0x66c4a8
lea esi, [esp + 0x2e0]
call fcn.0044f62c
mov eax, ebp
jmp 0x66c2a2
mov dword [esp + 0xbc], ebp
mov dword [esp + 0x7c], edx
mov dword [esp + 0x78], ebx
lea eax, [0x7fac20]
mov dword [esp], eax
mov dword [esp + 4], edi
lea eax, [esp + 0x2e0]
mov dword [esp + 8], eax
call fcn.004101b0
xor eax, eax
mov edx, dword [esp + 0x7c]
mov ebx, dword [esp + 0x78]
mov ebp, dword [esp + 0xbc]
jmp 0x66c4a1
lea eax, [0x7fac20]
mov dword [esp], eax
mov ebp, dword [esp + 0xd4]
mov dword [esp + 4], ebp
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
call fcn.0043a950
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
lea edx, [eax + 1]
xor eax, eax
mov ecx, dword [esp + 0x98]
jmp 0x66c484
mov ebx, dword [esp + 0x48]
mov edx, dword [esp + 0x98]
mov ebp, dword [esp + 0xd4]
jmp 0x66c4a1
test esi, esi
jbe 0x66c6d5
lea edi, [esp + 0x178]
mov esi, edx
call fcn.0044f62c
mov ecx, 1
jmp 0x66c447
mov dword [esp + 0xec], ecx
mov dword [esp + 0xf0], esi
mov dword [esp + 0xf4], eax
mov dword [esp], ecx
mov dword [esp + 4], esi
mov dword [esp + 8], eax
call fcn.00407a10
mov eax, dword [esp + 0xc]
lea ecx, [0x8b8010]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004871c0
mov eax, dword [esp + 0xf0]
mov dword [esp + 0x98], eax
mov ecx, dword [esp + 0x57c]
mov edx, dword [esp + 0x578]
xor ebx, ebx
jmp 0x66c5dd
mov ebp, dword [esp + 0x6c]
lea ebx, [ebp + 1]
mov ebp, dword [esp + 0x98]
mov esi, dword [esp + 0x57c]
mov edi, dword [esp + 0x578]
mov eax, ebp
mov ecx, esi
mov edx, edi
cmp ebx, eax
jge 0x66c69d
mov ebp, dword [esp + 0xec]
lea esi, [esp + 0xec]
cmp dword [esi + 4], ebx
jbe 0x66c6ce
mov dword [esp + 0x6c], ebx
mov dword [esp + 0xc8], ebp
lea eax, [ebx + ebx*8]
mov dword [esp + 0x94], eax
shl eax, 3
mov dword [esp + 0x90], eax
mov edi, dword [ebp + eax + 0x34]
mov ebx, dword [ebp + eax + 0x30]
mov eax, dword [ebp + eax + 0x2c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edi
call fcn.0066a560
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xe4], ecx
mov dword [esp + 0xe8], eax
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.006670a0
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0xc8]
lea edi, [ecx + eax*8 + 0x44]
mov eax, dword [0xb91180]
mov edx, dword [esp + 8]
test eax, eax
jne 0x66c691
mov eax, dword [esp + 0x90]
mov dword [ecx + eax + 0x44], edx
jmp 0x66c5bb
mov eax, edx
call fcn.0044f0d0
jmp 0x66c5bb
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xf0]
mov edx, dword [esp + 0xec]
mov dword [esp + 0x580], edx
mov dword [esp + 0x584], ecx
mov dword [esp + 0x588], eax
add esp, 0x574
ret
call fcn.004287c0
ud2
call fcn.004287c0
ud2
call fcn.004288c0
ud2
call fcn.004287c0
ud2
call fcn.004287c0
ud2
call fcn.004287c0
ud2
call fcn.004288c0
ud2
call fcn.004287c0
ud2
call fcn.0044d880
jmp fcn.0066b450