Function at 0x615b50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x74e188
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
push edi
mov esi, ecx
mov ecx, dword [esi + 0x80]
mov edi, ebx
neg edi
mov eax, edi
add ecx, 1
cmp eax, ebx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x14], eax
jg 0x615c2e
lea esp, [esp]
cmp edi, ebx
jg 0x615c1f
mov edx, dword [ebp + 0xc]
add edx, eax
mov dword [esp + 0x38], edx
mov edx, dword [ebp + 8]
add edx, edi
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x38]
test edx, edx
jl 0x615c0f
cmp edx, ecx
jge 0x615c0f
mov edx, dword [esp + 0x1c]
test edx, edx
jl 0x615c0f
cmp edx, ecx
jge 0x615c0f
mov ecx, edi
mov edx, eax
imul ecx, edi
imul edx, eax
add ecx, edx
mov edx, ebx
imul edx, ebx
cmp ecx, edx
jg 0x615c0b
mov eax, dword [ebp + 0x10]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x38]
push eax
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov ecx, esi
mov dword [esp + 0x2c], esp
call dword [eax + 0xe8]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x40]
add dword [esp + 0x1c], 1
add edi, 1
cmp edi, ebx
jle 0x615bb6
mov edi, dword [esp + 0x2c]
add eax, 1
cmp eax, ebx
mov dword [esp + 0x14], eax
jle 0x615ba0
test ebx, ebx
mov edi, 1
jle 0x615c3c
mov edi, 2
cmp ebx, 3
jle 0x615c5c
mov ecx, dword [0x912e94]
mov edx, dword [ecx]
push 0x1011
push 0x7e2274
push 1
push 0
call dword [edx + 0x40]
add edi, eax
test byte [esi + 0x18], 1
lea edi, [edi + ebx + 5]
mov dword [esp + 0x28], edi
je 0x615fe6
lea eax, [ebx + 9]
mov ecx, eax
neg ecx
cmp ecx, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x34], ecx
jg 0x6164f2
lea esp, [esp]
mov eax, dword [esp + 0x38]
cmp eax, dword [esp + 0x28]
mov dword [esp + 0x3c], eax
jg 0x615fcc
mov eax, dword [esp + 0x34]
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x3c]
lea ebx, [eax + ecx]
mov eax, dword [ebp + 8]
lea ecx, [edx + eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ecx
mov edi, edi
test ebx, ebx
jl 0x615fb0
cmp ebx, dword [esp + 0x40]
jge 0x615fb0
test ecx, ecx
jl 0x615fb0
cmp ecx, dword [esp + 0x40]
jge 0x615fb0
mov eax, dword [esp + 0x3c]
mov edx, eax
imul edx, eax
mov eax, dword [esp + 0x34]
mov edi, eax
imul edi, eax
lea eax, [edx + edi]
mov edx, dword [esp + 0x28]
mov edi, edx
imul edi, edx
cmp eax, edi
jg 0x615fb0
mov edx, dword [ebp + 0x1c]
add edx, 5
mov edi, edx
imul edi, edx
cmp eax, edi
jge 0x615d3b
push 0
push 0
push 0
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov eax, dword [esi]
mov ecx, esi
mov dword [esp + 0x34], esp
call dword [eax + 0xd4]
mov ecx, dword [esp + 0x10]
test cl, 3
jne 0x615fb0
test bl, 3
jne 0x615fb0
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov ecx, esi
mov dword [esp + 0x28], esp
mov dword [eax + 4], ebx
call fcn.0060d2b0
mov byte [esp + 0x24], al
mov eax, dword [esi + 0x5c]
push 0
mov ecx, eax
imul eax, dword [esp + 0x14]
push 0x863e70
imul ecx, ebx
push 0x863e58
push 0
sub esp, 8
mov edi, esp
mov dword [edi + 4], ecx
mov dword [edi], eax
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x38], esp
call dword [edx + 0x2c]
push eax
call fcn.0071f44c
mov ecx, eax
add esp, 0x14
test ecx, ecx
je 0x615fac
mov eax, dword [esi + 0x58]
cdq
idiv dword [esi + 0x5c]
mov edi, eax
mov eax, ebx
cdq
idiv edi
mov eax, dword [esp + 0x10]
shr dl, 2
push edx
cdq
idiv edi
mov eax, dword [esp + 0x28]
shr dl, 2
push edx
push eax
call fcn.0063b5e0
cmp byte [esp + 0x24], 0
je 0x615e9f
add byte [esp + 0x24], 0xff
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
push ecx
sub esp, 8
mov eax, esp
mov ecx, esi
mov dword [esp + 0x2c], esp
mov dword [eax], edx
mov dword [eax + 4], ebx
call fcn.0060d400
movzx eax, byte [esp + 0x24]
lea ecx, [eax*8]
sub ecx, eax
add ecx, ecx
sub ecx, eax
lea edx, [ecx*8 + 0x9a9465]
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], edx
jmp 0x615e30
mov edi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 0x2c], eax
add ebx, ecx
lea esp, [esp]
mov ecx, dword [esp + 0x30]
push 0x40
sub esp, 8
cmp byte [ecx + eax], 0
mov eax, esp
mov dword [esp + 0x2c], esp
mov ecx, esi
mov dword [eax + 4], ebx
mov dword [eax], edi
je 0x615e66
mov edx, dword [esi]
call dword [edx + 0x100]
jmp 0x615e6e
mov eax, dword [esi]
call dword [eax + 0x104]
mov eax, dword [esp + 0x2c]
add eax, 1
add edi, 1
cmp eax, 4
mov dword [esp + 0x2c], eax
jl 0x615e40
mov ecx, dword [esp + 0x14]
add dword [esp + 0x30], 4
mov ebx, dword [esp + 0x1c]
add ecx, 1
cmp ecx, 4
mov dword [esp + 0x14], ecx
jl 0x615e30
jmp 0x615fac
mov ecx, dword [esp + 0x10]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x28], esp
call dword [edx + 0xe0]
mov ecx, dword [esi + 0x28]
mov edx, dword [ecx]
movzx eax, al
push eax
mov dword [esp + 0x24], eax
call dword [edx + 0x20]
mov dword [esp + 0x30], eax
mov dword [esp + 0x14], 0
jmp 0x615ee0
mov ebx, dword [esp + 0x1c]
lea ecx, [ecx]
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
add ebx, eax
mov dword [esp + 0x2c], 5
sub esp, 8
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], ebx
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x20], esp
call dword [edx + 0xe0]
mov ecx, dword [esi + 0x28]
mov edx, dword [ecx]
movzx eax, al
push eax
call dword [edx + 0x20]
cmp dword [esp + 0x30], eax
je 0x615f39
mov eax, dword [esp + 0x20]
push eax
sub esp, 8
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], ebx
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x24], esp
call dword [edx + 0xe4]
add edi, 1
sub dword [esp + 0x2c], 1
jne 0x615ef2
mov eax, dword [esp + 0x14]
add eax, 1
cmp eax, 5
mov dword [esp + 0x14], eax
jl 0x615ed9
mov dword [esp + 0x14], 0
jmp 0x615f60
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
xor edi, edi
lea ebx, [ecx + eax]
lea ecx, [ecx]
mov edx, dword [esp + 0x10]
push 0x40
sub esp, 8
mov eax, esp
add edx, edi
mov dword [eax], edx
mov dword [eax + 4], ebx
mov eax, dword [esi]
mov ecx, esi
mov dword [esp + 0x24], esp
call dword [eax + 0x104]
add edi, 1
cmp edi, 4
jl 0x615f70
mov eax, dword [esp + 0x14]
add eax, 1
cmp eax, 4
mov dword [esp + 0x14], eax
jl 0x615f60
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x3c]
add eax, 1
add ecx, 1
cmp eax, dword [esp + 0x28]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x10], ecx
jle 0x615cc0
mov eax, dword [esp + 0x34]
add eax, 1
cmp eax, dword [esp + 0x28]
mov dword [esp + 0x34], eax
jle 0x615c90
jmp 0x6164f2
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x5c]
cdq
idiv ecx
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x48]
cdq
idiv ecx
mov ecx, dword [0x920d88]
mov ebx, dword [ecx + 0xc]
sub eax, edi
add eax, dword [ebp + 8]
cdq
idiv ebx
mov eax, dword [esp + 0x20]
sub eax, edi
add eax, dword [ebp + 0xc]
mov dword [esp + 0x3c], edx
cdq
idiv dword [ecx + 0x10]
mov eax, edi
neg eax
cmp eax, edi
mov dword [esp + 0x38], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], edx
jg 0x6164f2
mov eax, dword [esp + 0x38]
cmp eax, dword [esp + 0x28]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x10], edx
mov dword [esp + 0x34], eax
jg 0x6164c5
mov eax, dword [ebp + 0xc]
mov edx, dword [esp + 0x14]
lea ebx, [eax + edx]
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x34]
lea edi, [eax + edx]
test ebx, ebx
jl 0x616495
mov eax, dword [esp + 0x40]
cmp ebx, eax
jge 0x616495
test edi, edi
jl 0x616495
cmp edi, eax
jge 0x616495
mov eax, dword [esp + 0x34]
mov ecx, eax
imul ecx, eax
mov eax, dword [esp + 0x14]
mov edx, eax
imul edx, eax
mov eax, dword [esp + 0x28]
add ecx, edx
mov edx, eax
imul edx, eax
cmp ecx, edx
jg case.default.0x616436
push 0
push 0
push 0
sub esp, 8
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], ebx
mov eax, dword [esi]
mov ecx, esi
mov dword [esp + 0x2c], esp
call dword [eax + 0xd4]
sub esp, 8
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], ebx
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x20], esp
call dword [edx + 0xe0]
mov ecx, dword [esi + 0x28]
mov edx, dword [ecx]
movzx eax, al
mov dword [esp + 0x20], eax
movzx eax, ax
push eax
call dword [edx + 0x20]
test eax, eax
mov ecx, esi
jne 0x6163b8
push 8
sub esp, 8
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], ebx
mov edx, dword [esi]
mov dword [esp + 0x24], esp
call dword [edx + 0xf4]
cmp eax, 1
mov dword [esp + 0x2c], eax
je 0x616188
cmp eax, 2
je 0x616188
mov ecx, dword [esi + 0x5c]
mov eax, ecx
imul eax, ebx
add eax, dword [esi + 0x4c]
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
mov eax, ecx
imul eax, edi
add eax, dword [esi + 0x48]
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
call fcn.00412a00
and eax, 1
mov ecx, 7
sub ecx, eax
add esp, 8
cmp dword [esp + 0x2c], ecx
jg 0x6161c7
mov eax, dword [0x920d88]
mov ecx, dword [eax + 0xc]
imul ecx, dword [esp + 0x24]
add ecx, dword [eax + 8]
mov edx, dword [esp + 0x10]
cmp byte [ecx + edx], 0
jne 0x616181
mov eax, dword [ebp + 0x18]
jmp 0x6161a8
mov eax, 0x56
jmp 0x6161a8
mov eax, dword [0x920d88]
mov ecx, dword [eax + 0xc]
imul ecx, dword [esp + 0x24]
add ecx, dword [eax + 8]
mov edx, dword [esp + 0x10]
xor eax, eax
cmp byte [ecx + edx], al
setne al
lea eax, [eax + eax + 0x54]
cmp eax, dword [esp + 0x20]
je 0x6161c7
push eax
sub esp, 8
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], ebx
mov eax, dword [esi]
mov ecx, esi
mov dword [esp + 0x24], esp
call dword [eax + 0xe4]
push ebx
push edi
call fcn.00412a00
add esp, 8
push eax
lea ecx, [esp + 0x58]
call fcn.00412d00
mov edx, dword [esp + 0x54]
lea ecx, [esp + 0x54]
call dword [edx + 4]
xor edx, edx
mov ecx, 0xf
div ecx
mov eax, dword [esi + 0x5c]
imul eax, edi
lea ecx, [eax + edx - 7]
mov edx, dword [esp + 0x54]
mov dword [esp + 0x7c], ecx
lea ecx, [esp + 0x54]
call dword [edx + 4]
xor edx, edx
mov ecx, 0xf
div ecx
mov eax, dword [esi + 0x5c]
imul eax, ebx
push 0
sub esp, 8
mov dword [esp + 0x24], esp
lea ecx, [eax + edx - 7]
mov edx, dword [esp + 0x88]
mov eax, esp
mov dword [esp + 0x8c], ecx
mov dword [eax + 4], ecx
mov ecx, esi
mov dword [eax], edx
call fcn.006119b0
test eax, eax
je case.default.0x616436
mov dword [esp + 0x1c], 0
lea ecx, [esp + 0x54]
call fcn.00412aa0
mov ecx, dword [esp + 0x1c]
cdq
idiv dword [ecx*4 + 0x864794]
test edx, edx
je 0x61627c
mov eax, ecx
add eax, 1
cmp eax, 3
mov dword [esp + 0x1c], eax
jl 0x616250
jmp case.default.0x616436
xor ecx, ecx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x8c], vtable.CBSList_class_CMapObj__.0
mov dword [esp + 0x98], ecx
mov dword [esp + 0x94], ecx
mov dword [esp + 0x9c], ecx
push ecx
push ecx
lea edx, [esp + 0x94]
push edx
mov edx, dword [esp + 0x88]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x9c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x98]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x9c]
mov dword [esp + 0x34], esp
mov dword [esp + 0xc8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x168]
cmp dword [esp + 0x90], 0
je 0x616338
mov dword [esp + 0x8c], vtable.CBSList_class_CMapObj__.0
mov dword [esp + 0xac], 1
lea ecx, [esp + 0x8c]
call fcn.00548f00
mov dword [esp + 0xac], 0xffffffff
mov dword [esp + 0x8c], vtable.CBList_class_CMapObj__.0
jmp case.default.0x616436
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx*4 + 0x920d34]
mov edx, dword [esp + 0x54]
sub eax, 1
lea ecx, [esp + 0x54]
mov dword [esp + 0x20], eax
call dword [edx + 4]
mov ecx, dword [esp + 0x20]
add ecx, 1
xor edx, edx
div ecx
mov ecx, dword [esp + 0x7c]
push 0
push 0
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x90]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax*4 + 0x920d0c]
mov eax, dword [0x920dc8]
mov dword [esp + 0x28], esp
push esi
mov edx, dword [ecx + edx*4]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.00603a80
add esp, 0x18
mov dword [esp + 0x8c], vtable.CBSList_class_CMapObj__.0
mov dword [esp + 0xac], 2
jmp 0x616311
push 0xc
sub esp, 8
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], ebx
mov edx, dword [esi]
mov dword [esp + 0x24], esp
call dword [edx + 0xec]
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x30], eax
mov eax, ecx
imul eax, ebx
add eax, dword [esi + 0x4c]
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
mov eax, ecx
imul eax, edi
add eax, dword [esi + 0x48]
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
call fcn.00412a00
add esp, 8
and eax, reloc.WS2_32.dll_closesocket
jns 0x61640f
dec eax
or eax, 0xfffffffc
inc eax
mov ecx, 4
sub ecx, eax
mov eax, dword [esp + 0x30]
sub eax, ecx
mov dword [esp + 0x30], eax
cmp eax, 1
mov eax, 1
jl 0x61642e
mov eax, dword [esp + 0x30]
add eax, 0xffffffff
cmp eax, 6
ja case.default.0x616436
jmp dword [eax*4 + 0x6167fc]
push 0x5a
jmp 0x616477
mov eax, dword [ebp + 0x10]
cmp eax, 0x59
jg 0x61644e
mov eax, 0x59
push eax
sub esp, 8
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], ebx
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x24], esp
call dword [edx + 0xe8]
jmp case.default.0x616436
mov eax, dword [ebp + 0x10]
cmp eax, 0x58
jg 0x616476
mov eax, 0x58
push eax
sub esp, 8
mov eax, esp
mov dword [eax + 4], ebx
mov dword [eax], edi
mov eax, dword [esi]
mov ecx, esi
mov dword [esp + 0x24], esp
call dword [eax + 0xe8]
mov ecx, dword [0x920d88]
mov eax, dword [esp + 0x10]
add eax, 1
cmp eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
jne 0x6164ad
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x34]
add eax, 1
add edi, 1
cmp eax, dword [esp + 0x28]
mov dword [esp + 0x34], eax
jle 0x616061
mov eax, dword [esp + 0x24]
add eax, 1
cmp eax, dword [ecx + 0x10]
mov dword [esp + 0x24], eax
jne 0x6164dd
mov dword [esp + 0x24], 0
mov eax, dword [esp + 0x14]
add eax, 1
cmp eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
jle 0x616033
mov edi, dword [esi + 0x5c]
mov ebx, dword [ebp + 0x1c]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add ebx, 5
mov eax, edi
imul eax, ebx
sub ecx, ebx
imul ecx, edi
sub edx, ebx
imul edx, edi
add eax, eax
lea edi, [eax + edx - 1]
lea eax, [eax + ecx - 1]
sub esp, 0x10
mov dword [esp + 0x98], eax
mov eax, esp
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x98]
mov dword [esp + 0x28], esp
mov dword [eax + 0xc], ecx
push 0
mov ecx, esi
mov dword [eax], edx
mov dword [eax + 8], edi
call fcn.00614f90
test byte [esi + 0x18], 1
je 0x61658c
push 0
push 0x85e214
push 0x85e200
push 0
push esi
call fcn.0071f44c
mov edx, dword [ebp + 0x1c]
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
add esp, 0x14
push 1
push 0
push 0
add edx, 2
push edx
sub esp, 8
mov edx, esp
mov dword [edx], ecx
mov ecx, eax
mov dword [esp + 0x30], esp
mov dword [edx + 4], edi
call fcn.0061d060
jmp 0x61658f
mov edi, dword [ebp + 0xc]
mov eax, dword [esp + 0x28]
mov edx, dword [ebp + 8]
mov ecx, edx
add edx, eax
mov dword [esp + 0x64], edx
sub ecx, eax
mov edx, edi
sub edx, eax
lea eax, [eax + edi + 1]
mov dword [esp + 0x68], eax
mov eax, dword [esi + 0x78]
cmp ecx, eax
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], edx
jge 0x6165c1
mov ecx, eax
mov dword [esp + 0x5c], ecx
mov eax, dword [esi + 0x7c]
cmp edx, eax
jge 0x6165cc
mov dword [esp + 0x60], eax
mov eax, dword [esi + 0x80]
cmp dword [esp + 0x64], eax
jle 0x6165dc
mov dword [esp + 0x64], eax
mov eax, dword [esi + 0x84]
cmp dword [esp + 0x68], eax
jle 0x6165ec
mov dword [esp + 0x68], eax
xor eax, eax
or edx, 0xffffffff
cmp dword [ebp + 0x24], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], edx
jne 0x61661c
mov edx, dword [esi]
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x60]
push ecx
mov ecx, esi
call dword [edx + 0xac]
jmp 0x616650
push 1
lea edx, [esp + 0x48]
push edx
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x78]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x7c]
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x80]
mov dword [eax + 0xc], ecx
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x30], esp
call dword [edx + 0xc8]
mov eax, dword [ebp + 0x20]
xor ecx, ecx
cmp eax, ecx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x78], 0xffffffff
mov dword [esp + 0x6c], 1
mov dword [esp + 0x74], ecx
jl 0x6166cb
mov edx, dword [esi]
push eax
lea eax, [esp + 0x60]
push eax
mov ecx, esi
call dword [edx + 0x74]
test byte [esi + 0x18], 1
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x6c]
je 0x6166ab
push ecx
push ebx
push 0x5a
push 0x55
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov dword [eax + 4], edi
mov eax, dword [esi]
mov ecx, esi
mov dword [esp + 0x30], esp
call dword [eax + 0x98]
jmp 0x6166cb
push 0
push ecx
push ebx
push 0x5a
push 0x55
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov dword [eax + 4], edi
mov eax, dword [esi]
mov ecx, esi
mov dword [esp + 0x34], esp
call dword [eax + 0x8c]
mov ecx, dword [ebp + 0x2c]
test ecx, ecx
jne 0x6166db
cmp dword [ebp + 0x28], ecx
je 0x6167e4
mov ebx, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
sub ebx, 1
sub eax, 1
add edi, 1
add edx, 1
test ecx, ecx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edx
je 0x616742
sub esp, 0x10
mov eax, esp
mov dword [eax], ebx
mov ecx, dword [esp + 0x58]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x5c]
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x60]
mov dword [eax + 0xc], ecx
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x28], esp
call dword [edx + 0x54]
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x44]
cmp dword [ebp + 0x28], 0
je 0x6167e4
mov ecx, dword [esp + 0x74]
sub ebx, 1
sub eax, 1
add edi, 1
add edx, 1
cmp dword [esp + 0x6c], ecx
jg 0x616794
mov ecx, dword [esp + 0x78]
cmp dword [esp + 0x70], ecx
jg 0x616794
mov ecx, dword [esp + 0x6c]
cmp ecx, ebx
jge 0x616776
mov ebx, ecx
mov ecx, dword [esp + 0x70]
cmp ecx, eax
jge 0x616780
mov eax, ecx
cmp dword [esp + 0x74], edi
jle 0x61678a
mov edi, dword [esp + 0x74]
mov ecx, dword [esp + 0x78]
cmp ecx, edx
jle 0x616794
mov edx, ecx
mov ecx, dword [esi + 0x78]
cmp ebx, ecx
jge 0x61679d
mov ebx, ecx
mov ecx, dword [esi + 0x7c]
cmp eax, ecx
jge 0x6167a6
mov eax, ecx
mov ecx, dword [esi + 0x80]
cmp edi, ecx
jle 0x6167b2
mov edi, ecx
mov ecx, dword [esi + 0x84]
cmp edx, ecx
jle 0x6167be
mov edx, ecx
mov esi, dword [esi + 0x5c]
imul eax, esi
imul edx, esi
mov ecx, esi
imul ecx, ebx
mov ebx, eax
mov eax, esi
mov esi, dword [ebp + 0x28]
imul eax, edi
sub eax, 1
mov dword [esi], ecx
mov dword [esi + 4], ebx
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov ecx, dword [esp + 0xa4]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x28