Function at 0x654a74
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x11
push 0
push 0
dec ecx
jne 0x654a7c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x655b40
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x398], 1
mov dl, 1
mov eax, dword [0x42c864]
call fcn.004331e8
mov dword [ebp - 0x18], eax
mov dl, 6
mov eax, dword [ebp - 0x18]
call fcn.004347fc
mov edx, 0x1f4
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edx, 0x320
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 0x18]
call fcn.004337bc
mov eax, dword [eax + 0xc]
xor edx, edx
call fcn.00555778
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [0x68fc0c]
call fcn.00580740
test al, al
jne 0x654b15
mov eax, dword [0x68fc10]
call fcn.00580740
test al, al
jne 0x654b15
xor eax, eax
jmp 0x654b17
mov al, 1
mov byte [ebp - 0x25], al
mov eax, dword [0x68fc0c]
xor edx, edx
call fcn.004061e8
jne 0x654b3a
mov eax, dword [0x68fc10]
xor edx, edx
call fcn.004061e8
je 0x655086
mov eax, dword [0x68fc0c]
xor edx, edx
call fcn.004061e8
je 0x654c80
mov eax, dword [0x68fc0c]
call fcn.00580740
mov ebx, eax
mov eax, ebx
xor al, 1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x370]
mov byte [edx + 0x29c], al
test bl, bl
je 0x654bab
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
xor edx, edx
call fcn.0057e3c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x360]
mov edx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
call fcn.0045f864
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov dl, 3
call fcn.0057e414
jmp 0x654c1f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov dl, 1
call fcn.0057e3c8
cmp byte [ebp - 0x25], 0
jne 0x654bd6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov edx, 0x3c
call fcn.0045f864
jmp 0x654bf0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x360]
mov edx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
call fcn.0045f864
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov dl, 1
call fcn.0057e414
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov edx, 0x120
sub edx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
call fcn.0045f8cc
push ebp
mov eax, dword [0x68fc0c]
push eax
push ebx
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
add eax, 0x370
call fcn.0065494c
pop ecx
lea ecx, [ebp - 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov edx, dword [eax + 0x4c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov eax, dword [eax + 0x48]
call fcn.0041d378
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x44]
mov dword [eax + 0x388], edx
mov edx, dword [ebp - 0x40]
mov dword [eax + 0x38c], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov dl, 1
call fcn.00460104
cmp dword [ebp - 0x20], 0x15e
jle 0x654d7e
mov eax, dword [0x68fc0c]
call fcn.00580740
test al, al
jne 0x654d7e
add dword [ebp - 0x1c], 0x10
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x65434c]
call fcn.0044fca4
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x360]
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x270], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x274], eax
xor edx, edx
mov eax, dword [ebp - 0x2c]
call fcn.0044fd60
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov edx, dword [eax + 0x40]
mov eax, dword [ebp - 0x2c]
call fcn.0045f864
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov edx, dword [eax + 0x44]
mov eax, dword [ebp - 0x2c]
call fcn.0045f898
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
sub edx, dword [eax + 0x40]
mov eax, dword [ebp - 0x2c]
call fcn.0045f8cc
mov edx, 0x14f
mov eax, dword [ebp - 0x2c]
call fcn.0045f900
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
xor edx, edx
call fcn.0045f864
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov edx, dword [eax + 0x44]
mov eax, dword [ebp - 0x2c]
sub edx, dword [eax + 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
call fcn.0045f898
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov dword [ebp - 0x20], 0x15e
jmp 0x654d83
xor eax, eax
mov dword [ebp - 0x2c], eax
mov eax, dword [0x68fc10]
xor edx, edx
call fcn.004061e8
je 0x654f52
mov eax, dword [0x68fc10]
call fcn.00580740
mov ebx, eax
test bl, bl
jne 0x654e00
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x5c]
push eax
xor ecx, ecx
mov edx, 0x655b54
mov eax, dword [0x68fc10]
call fcn.0049443c
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0xf
lea ecx, [ebp - 0x60]
mov dl, 1
mov eax, dword [0x68fc10]
call fcn.00580788
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x4c], 0xf
lea edx, [ebp - 0x58]
mov ecx, 1
mov eax, 0x655b60
call fcn.0040db2c
mov edx, dword [ebp - 0x48]
mov eax, 0x68fc10
call fcn.00405ef8
cmp byte [ebp - 0x25], 0
je 0x654e42
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
xor edx, edx
call fcn.0057e3c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x360]
mov edx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
call fcn.0045f864
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov dl, 3
call fcn.0057e414
jmp 0x654e94
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov dl, 1
call fcn.0057e3c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, 0x3c
call fcn.0045f864
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov dl, 1
call fcn.0057e414
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, 0x120
sub edx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
call fcn.0045f8cc
push ebp
mov eax, dword [0x68fc10]
push eax
push ebx
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
add eax, 0x374
call fcn.0065494c
pop ecx
lea ecx, [ebp - 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, dword [eax + 0x4c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov eax, dword [eax + 0x48]
call fcn.0041d378
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x44]
mov dword [eax + 0x390], edx
mov edx, dword [ebp - 0x40]
mov dword [eax + 0x394], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
cmp byte [eax + 0x57], 0
je 0x654f42
cmp dword [ebp - 0x2c], 0
je 0x654f19
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x44]
mov eax, dword [ebp - 0x2c]
add edx, dword [eax + 0x4c]
add edx, 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
call fcn.0045f898
jmp 0x654f42
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov edx, dword [eax + 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
add edx, dword [eax + 0x4c]
add edx, 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
call fcn.0045f898
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov dl, 1
call fcn.00460104
cmp dword [ebp - 0x2c], 0
je 0x654f69
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
sub edx, dword [eax + 0x40]
mov eax, dword [ebp - 0x2c]
call fcn.0045f8cc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
cmp byte [eax + 0x290], 0
je 0x655094
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x374]
mov edx, dword [edx + 0x48]
cmp edx, dword [eax + 0x48]
jle 0x655094
cmp dword [ebp - 0x2c], 0
jne 0x655013
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x374]
mov edx, dword [edx + 0x48]
call fcn.0045f8cc
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov eax, dword [eax + 0x258]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov eax, dword [eax + 0x258]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov edx, dword [eax + 0x4c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov eax, dword [eax + 0x48]
call fcn.0041d378
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x44]
mov dword [eax + 0x388], edx
mov edx, dword [ebp - 0x40]
mov dword [eax + 0x38c], edx
jmp 0x655094
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x48]
sub edx, 0x10
call fcn.0045f8cc
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov eax, dword [eax + 0x258]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov eax, dword [eax + 0x258]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov edx, dword [eax + 0x4c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov eax, dword [eax + 0x48]
call fcn.0041d378
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x44]
mov dword [eax + 0x388], edx
mov edx, dword [ebp - 0x40]
mov dword [eax + 0x38c], edx
jmp 0x655094
mov dword [ebp - 0x20], 0x4d
mov dword [ebp - 0x1c], 0x116
mov edx, dword [ebp - 0x1c]
mov eax, 0x116
call fcn.004970d4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x20]
dec eax
test eax, eax
jl 0x655115
inc eax
mov dword [ebp - 0x38], eax
xor edi, edi
mov eax, dword [ebp - 0x18]
call fcn.004337bc
mov eax, dword [eax + 0x14]
push eax
lea eax, [edi + edi*2]
lea eax, [eax + eax*8]
mov edx, dword [ebp - 0x20]
dec edx
mov ecx, edx
cdq
idiv ecx
add eax, 0xe4
imul edx, eax, 0x10101
pop eax
call fcn.0042e180
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, edi
xor eax, eax
call fcn.0041d3a0
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x18]
call fcn.004337bc
pop edx
call fcn.0042e580
inc edi
dec dword [ebp - 0x38]
jne 0x6550bd
mov eax, dword [0x68fc0c]
xor edx, edx
call fcn.004061e8
jne 0x655135
mov eax, dword [0x68fc10]
xor edx, edx
call fcn.004061e8
je 0x6551c7
cmp byte [ebp - 0x25], 0
jne 0x655312
mov eax, dword [0x691174]
call fcn.005528cc
mov dword [ebp - 0x24], eax
mov eax, dword [0x691174]
mov eax, dword [eax + 0xc]
dec eax
test eax, eax
jl 0x655312
inc eax
mov dword [ebp - 0x38], eax
xor edi, edi
mov eax, dword [0x691174]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x6551bc
inc eax
mov dword [ebp - 0x3c], eax
xor ebx, ebx
mov edx, dword [0x691174]
mov edx, dword [edx + 4]
add edx, edi
mov eax, dword [0x691174]
mov eax, dword [eax]
add eax, ebx
call fcn.00552854
mov esi, eax
cmp esi, dword [ebp - 0x24]
je 0x6551b6
push esi
mov eax, dword [ebp - 0x18]
call fcn.004337bc
mov ecx, dword [ebp - 0x20]
sub ecx, 0x20
sar ecx, 1
jns 0x6551ac
adc ecx, 0
add ecx, edi
lea edx, [ebx + 0xa]
call fcn.0042eb18
inc ebx
dec dword [ebp - 0x3c]
jne 0x655176
inc edi
dec dword [ebp - 0x38]
jne 0x655163
jmp 0x655312
mov eax, dword [0x6919b0]
call fcn.0055296c
test al, al
je 0x6551f5
mov eax, dword [0x691958]
call fcn.0055296c
test al, al
je 0x6551f5
mov eax, dword [0x691958]
mov edx, dword [eax]
mov dword [ebp - 0x34], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x30], edx
jmp 0x65520d
lea ecx, [ebp - 0x34]
mov edx, dword [0x6902b0]
mov edx, dword [edx + 4]
mov eax, dword [0x6902b0]
mov eax, dword [eax]
call fcn.0041d378
mov eax, dword [0x6902b0]
mov eax, dword [eax + 0xc]
add eax, 0xa
dec eax
sub eax, 0xa
jl 0x655312
inc eax
mov dword [ebp - 0x38], eax
mov edi, 0xa
lea eax, [edi + edi*2]
lea eax, [eax + eax*8]
mov edx, dword [ebp - 0x20]
dec edx
mov ecx, edx
cdq
idiv ecx
add eax, 0xe4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
call fcn.004337bc
mov eax, dword [eax + 0x14]
imul edx, dword [ebp - 0x24], 0x10101
call fcn.0042e180
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, edi
xor eax, eax
call fcn.0041d3a0
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x18]
call fcn.004337bc
pop edx
call fcn.0042e580
mov eax, dword [0x6902b0]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x655308
inc eax
mov dword [ebp - 0x3c], eax
xor ebx, ebx
mov edx, dword [ebp - 0x30]
add edx, edi
sub edx, 0xa
mov eax, dword [ebp - 0x34]
add eax, ebx
call fcn.00552854
mov esi, eax
mov eax, esi
and eax, 0xff
imul dword [ebp - 0x24]
and eax, 0xff00
mov edx, esi
and edx, 0xff00
imul edx, dword [ebp - 0x24]
and edx, 0xff0000
or eax, edx
and esi, 0xff0000
imul esi, dword [ebp - 0x24]
and esi, 0xff000000
or eax, esi
mov esi, eax
shr esi, 8
push esi
mov eax, dword [ebp - 0x18]
call fcn.004337bc
mov edx, dword [ebp - 0x1c]
sub edx, 0xf0
sar edx, 1
jns 0x6552f9
adc edx, 0
add edx, ebx
mov ecx, edi
call fcn.0042eb18
inc ebx
dec dword [ebp - 0x3c]
jne 0x655292
inc edi
dec dword [ebp - 0x38]
jne 0x65522b
xor esi, esi
mov ebx, 0xc
call fcn.004d9cdc
cmp byte [eax + 0x217], 0
je 0x655370
call fcn.004d9cdc
fld qword [eax + 0xd10]
fcomp dword [0x655b88]
wait
fnstsw ax
sahf
jbe 0x655370
call fcn.004d9cdc
add eax, 0xd18
push eax
call fcn.004d9cdc
fld qword [eax + 0xd10]
pop eax
fsubr qword [eax]
fmul dword [0x655b8c]
fmul dword [0x655b90]
fmul dword [0x655b90]
call fcn.00403610
mov esi, eax
lea eax, [ebp - 0x14]
mov edx, dword [0x692008]
mov edx, dword [edx]
call fcn.00405f20
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x380]
mov dl, 1
call fcn.0057e3c8
mov edx, dword [ebp - 0x1c]
sub edx, 8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x380]
call fcn.0045f8cc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x360]
mov edx, dword [eax + 0x44]
mov eax, dword [ebp - 0x20]
add eax, 6
add edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x380]
call fcn.0045f898
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x360]
mov edx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x380]
call fcn.0045f864
push 0x655b98
push dword [ebp - 0x14]
push 0x655bc4
lea eax, [ebp - 0x6c]
mov edx, 3
call fcn.004061a0
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x380]
mov eax, dword [eax + 0x258]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x380]
mov dl, 1
call fcn.00460104
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x380]
mov edx, dword [eax]
call dword [edx + 0x80]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x380]
add ebx, dword [eax + 0x4c]
test esi, esi
jle 0x655584
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov dl, 1
call fcn.0057e3c8
mov edx, dword [ebp - 0x1c]
sub edx, 8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
call fcn.0045f8cc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x380]
mov edx, dword [eax + 0x44]
add edx, dword [eax + 0x4c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
call fcn.0045f898
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x360]
mov edx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
call fcn.0045f864
mov eax, dword [0x6902f8]
push dword [eax]
mov eax, esi
mov ecx, 0xe10
cdq
idiv ecx
lea edx, [ebp - 0x74]
call fcn.0040c1d4
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 0x70]
call fcn.004060a4
push dword [ebp - 0x70]
push 0x655bd4
mov eax, esi
mov ecx, 0xe10
cdq
idiv ecx
mov eax, edx
mov ecx, 0x3c
cdq
idiv ecx
lea edx, [ebp - 0x7c]
call fcn.00653d44
mov edx, dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
call fcn.004060a4
push dword [ebp - 0x78]
push 0x655bd4
mov eax, esi
mov ecx, 0x3c
cdq
idiv ecx
mov eax, edx
lea edx, [ebp - 0x84]
call fcn.00653d44
mov edx, dword [ebp - 0x84]
lea eax, [ebp - 0x80]
call fcn.004060a4
push dword [ebp - 0x80]
lea eax, [ebp - 8]
mov edx, 6
call fcn.004061a0
push 0x655b98
push dword [ebp - 8]
push 0x655bc4
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.004061a0
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov eax, dword [eax + 0x258]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
mov dl, 1
call fcn.00460104
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x384]
add ebx, dword [eax + 0x4c]
mov eax, dword [ebp - 0x18]
call fcn.004337bc
mov eax, dword [eax + 0x14]
xor edx, edx
call fcn.0042e29c
mov eax, dword [ebp - 0x18]
call fcn.004337bc
mov eax, dword [eax + 0x14]
mov edx, 0x999999
call fcn.0042e180
mov eax, dword [ebp - 0x20]
inc eax
push eax
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
xor eax, eax
call fcn.0041d3a0
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x18]
call fcn.004337bc
pop edx
call fcn.0042e580
mov eax, dword [ebp - 0x18]
call fcn.004337bc
mov eax, dword [eax + 0x14]
mov edx, 0xe8e8e8
call fcn.0042e180
mov eax, dword [ebp - 0x20]
add eax, ebx
dec eax
push eax
lea eax, [ebp - 0x58]
push eax
mov edx, dword [ebp - 0x20]
inc edx
mov ecx, dword [ebp - 0x1c]
xor eax, eax
call fcn.0041d3a0
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x18]
call fcn.004337bc
pop edx
call fcn.0042e580
mov eax, dword [ebp - 0x18]
call fcn.004337bc
mov eax, dword [eax + 0x14]
mov edx, 0x999999
call fcn.0042e180
mov esi, dword [ebp - 0x20]
add esi, ebx
push esi
lea eax, [ebp - 0x58]
push eax
mov edx, esi
dec edx
mov ecx, dword [ebp - 0x1c]
xor eax, eax
call fcn.0041d3a0
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x18]
call fcn.004337bc
pop edx
call fcn.0042e580
mov esi, 0x28
lea eax, [ebp - 0xc]
push eax
call fcn.004d9cdc
mov eax, dword [eax + 0x178]
xor ecx, ecx
xor edx, edx
call fcn.00517208
mov edx, dword [ebp - 0xc]
mov eax, 0x655bdc
call fcn.004063e4
mov edi, eax
test edi, edi
jle 0x6556aa
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040626c
lea ecx, [edi + 1]
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.004062b8
add esi, 0x10
jmp 0x6556b2
lea eax, [ebp - 0xc]
call fcn.00405ebc
mov edx, dword [0x6911c0]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x364]
call fcn.005462fc
mov edx, dword [ebp - 0x20]
add edx, ebx
add edx, 0x1d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x364]
call fcn.0045f898
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x364]
mov edx, dword [ebp - 0x1c]
sub edx, dword [eax + 0x48]
sar edx, 1
jns 0x6556f4
adc edx, 0
add edx, 8
call fcn.0045f864
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004061e8
je 0x65588a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x37c]
mov eax, dword [eax + 0x258]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x378]
mov eax, dword [eax + 0x258]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x37c]
mov edx, dword [eax + 0x48]
add edx, 6
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x378]
add edx, dword [ecx + 0x48]
sar edx, 1
jns 0x65575c
adc edx, 0
push edx
mov edx, dword [ebp - 0x1c]
add edx, 0x10
sar edx, 1
jns 0x65576a
adc edx, 0
pop ecx
sub edx, ecx
call fcn.0045f864
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x37c]
cmp dword [eax + 0x40], 0x10
jle 0x6557c0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x37c]
mov edx, dword [edx + 0x40]
add edx, dword [eax + 0x48]
add edx, 6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x378]
call fcn.0045f864
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x378]
mov edx, dword [eax + 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x37c]
call fcn.0045f898
jmp 0x655846
mov edx, dword [ebp - 0x1c]
add edx, 0x10
sar edx, 1
jns 0x6557cd
adc edx, 0
mov ecx, dword [eax + 0x48]
sar ecx, 1
jns 0x6557d7
adc ecx, 0
sub edx, ecx
call fcn.0045f864
mov edx, dword [ebp - 0x1c]
add edx, 0x10
sar edx, 1
jns 0x6557eb
adc edx, 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x378]
mov eax, dword [eax + 0x48]
sar eax, 1
jns 0x6557fe
adc eax, 0
sub edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x378]
call fcn.0045f864
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x37c]
mov edx, dword [eax + 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x37c]
sub edx, dword [eax + 0x4c]
sub edx, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x37c]
call fcn.0045f898
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x37c]
add esi, dword [eax + 0x4c]
add esi, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x37c]
mov dl, 1
call fcn.00460104
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x378]
mov dl, 1
call fcn.00460104
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x37c]
mov edx, dword [eax]
call dword [edx + 0x80]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x378]
mov edx, dword [eax]
call dword [edx + 0x80]
jmp 0x6558aa
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x37c]
xor edx, edx
call fcn.00460104
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x378]
xor edx, edx
call fcn.00460104
mov eax, esi
dec eax
test eax, eax
jl 0x65591a
inc eax
mov dword [ebp - 0x38], eax
xor edi, edi
mov eax, dword [ebp - 0x18]
call fcn.004337bc
mov eax, dword [eax + 0x14]
push eax
lea eax, [edi + edi*2]
lea eax, [eax + eax*8]
mov edx, esi
dec edx
mov ecx, edx
cdq
idiv ecx
mov edx, 0xff
sub edx, eax
imul edx, edx, 0x10101
pop eax
call fcn.0042e180
mov eax, dword [ebp - 0x20]
add eax, ebx
add eax, edi
inc eax
push eax
lea eax, [ebp - 0x58]
push eax
mov edx, dword [ebp - 0x20]
add edx, ebx
add edx, edi
mov ecx, dword [ebp - 0x1c]
xor eax, eax
call fcn.0041d3a0
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x18]
call fcn.004337bc
pop edx
call fcn.0042e580
inc edi
dec dword [ebp - 0x38]
jne 0x6558b7
cmp dword [ebp - 0x2c], 0
jne 0x655954
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov ecx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
add ecx, dword [eax + 0x48]
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x374]
mov edx, dword [edi + 0x40]
add edx, dword [edi + 0x48]
mov eax, dword [ebp - 0x1c]
call fcn.0049713c
mov dword [ebp - 0x1c], eax
jmp 0x65597a
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x40]
mov eax, dword [ebp - 0x2c]
add ecx, dword [eax + 0x48]
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0x374]
mov edx, dword [edi + 0x40]
add edx, dword [edi + 0x48]
mov eax, dword [ebp - 0x1c]
call fcn.0049713c
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x364]
mov edx, dword [eax + 0x44]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00653bd4
mov edx, dword [ebp - 0x20]
add edx, ebx
add edx, esi
add edx, 0x1c
mov eax, dword [ebp - 4]
call fcn.0045f900
mov edx, dword [ebp - 0x1c]
add edx, 8
mov eax, dword [ebp - 4]
call fcn.0045f8cc
cmp dword [ebp - 0x2c], 0
jne 0x6559c5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov eax, dword [eax + 0x48]
jmp 0x6559cb
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x48]
cmp byte [ebp - 0x25], 0
je 0x655a67
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10
cmp eax, ecx
jge 0x6559ee
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x370]
cmp byte [ecx + 0x57], 0
jne 0x655a0a
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x374]
mov ecx, dword [edx + 0x48]
mov ebx, dword [ebp - 0x1c]
sub ebx, 0x10
cmp ecx, ebx
jge 0x655a67
cmp byte [edx + 0x57], 0
je 0x655a67
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x374]
mov edx, dword [edx + 0x48]
call fcn.004970d4
mov edi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
sar eax, 1
jns 0x655a2a
adc eax, 0
sar edi, 1
jns 0x655a31
adc edi, 0
sub eax, edi
mov edi, eax
cmp dword [ebp - 0x2c], 0
jne 0x655a4d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x370]
mov edx, edi
call fcn.0045f864
jmp 0x655a57
mov edx, edi
mov eax, dword [ebp - 0x2c]
call fcn.0045f864
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
mov edx, edi
call fcn.0045f864
call fcn.005185a4
mov edx, eax
sar edx, 1
jns 0x655a75
adc edx, 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
sar eax, 1
jns 0x655a82
adc eax, 0
sub edx, eax
mov eax, dword [ebp - 4]
call fcn.004553b4
call fcn.005185c4
mov edx, eax
sar edx, 1
jns 0x655a9a
adc edx, 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
sar eax, 1
jns 0x655aa7
adc eax, 0
sub edx, eax
mov eax, dword [ebp - 4]
call fcn.004553f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x360]
mov eax, dword [eax + 0x198]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
call fcn.00404748
mov eax, dword [ebp - 4]
mov byte [eax + 0x398], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x655b47
lea eax, [ebp - 0x88]
call fcn.00405ebc
lea eax, [ebp - 0x84]
call fcn.00405684
lea eax, [ebp - 0x80]
call fcn.00405ebc
lea eax, [ebp - 0x7c]
call fcn.00405684
lea eax, [ebp - 0x78]
call fcn.00405ebc
lea eax, [ebp - 0x74]
call fcn.00405684
lea eax, [ebp - 0x70]
mov edx, 6
call fcn.00405ed4
lea eax, [ebp - 0x48]
call fcn.00405ebc
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405ed4
ret