Function at 0x66312c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6768b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x16c
mov dword [ebp - 0x170], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0xc0], ecx
mov edx, dword [ebp + 0x14]
movsx eax, word [edx + 0x6a]
mov ecx, dword [ebp + 0x14]
movsx edx, word [ecx + 0x64]
sub eax, edx
add eax, 1
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
movsx ecx, word [eax + 0x68]
mov edx, dword [ebp + 0x14]
movsx eax, word [edx + 0x62]
sub ecx, eax
add ecx, 1
mov dword [ebp - 0x7c], ecx
mov ecx, dword [ebp - 0x7c]
add ecx, 1
mov dword [ebp - 0x7c], ecx
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x80], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0x78]
mov dword [ebp - 0x94], eax
lea ecx, [ebp - 0xc8]
call fcn.00461990
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebp + 8]
call fcn.00505fe0
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x70]
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.00505f80
lea edx, [ebp - 0x70]
push edx
lea ecx, [ebp - 0xc8]
call fcn.00461a00
lea eax, [ebp - 0xc8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
call dword [edx + 0x30]
mov dword [ebp - 0x2c], eax
push 1
mov ecx, dword [ebp + 8]
call fcn.0065ad5c
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x94], 7
je 0x66369a
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x20]
mov edx, dword [ebp - 0x170]
add ecx, dword [edx + 0x208]
mov dword [ebp - 0xb4], ecx
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0xb4]
add ecx, dword [eax + 0x210]
mov dword [ebp - 0xac], ecx
cmp dword [ebp - 0x94], 4
je 0x663267
cmp dword [ebp - 0x94], 5
je 0x663267
cmp dword [ebp - 0x94], 6
jne 0x66327f
mov eax, dword [ebp - 0x80]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx + 0x24]
sub ecx, eax
mov dword [ebp - 0xb8], ecx
jmp 0x66328b
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 0x24]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xdc], 0
jmp 0x6632a6
mov ecx, dword [ebp - 0xdc]
add ecx, 1
mov dword [ebp - 0xdc], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xdc]
cmp eax, dword [edx + 8]
jge 0x6634bf
mov dword [ebp - 0xa0], 0
jmp 0x6632d3
mov ecx, dword [ebp - 0xa0]
add ecx, 1
mov dword [ebp - 0xa0], ecx
mov edx, dword [ebp - 0xa0]
cmp edx, dword [ebp - 0xc0]
jge 0x6634ba
mov eax, dword [ebp + 0x14]
cmp dword [eax + 0x70], 0
je 0x663307
mov ecx, dword [ebp - 0xa0]
add ecx, 1
imul ecx, ecx, 0x58
mov edx, dword [ebp + 0xc]
add edx, ecx
mov dword [ebp - 0xd0], edx
jmp 0x663322
mov eax, dword [ebp - 0xa0]
add eax, 1
imul eax, dword [ebp - 0x30]
imul eax, eax, 0x58
mov ecx, dword [ebp + 0xc]
add ecx, eax
mov dword [ebp - 0xd0], ecx
lea edx, [ebp - 0x74]
push edx
mov eax, dword [ebp - 0xd0]
push eax
mov ecx, dword [ebp - 0x170]
call fcn.00663081
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jne 0x66336e
mov dword [ebp - 0x124], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8]
call fcn.004619e0
mov eax, dword [ebp - 0x124]
jmp 0x663fb7
mov ecx, dword [ebp - 0xb8]
add ecx, dword [ebp - 0x80]
mov dword [ebp - 0xb0], ecx
mov edx, dword [ebp - 0xb0]
sub edx, 2
mov dword [ebp - 0xb0], edx
mov eax, dword [ebp - 0xb8]
add eax, 2
mov dword [ebp - 0xb8], eax
push 0
mov ecx, dword [ebp + 8]
call fcn.0065bc20
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0xb8]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0xe0], eax
mov ecx, dword [ebp - 0x8c]
push ecx
lea ecx, [ebp - 0xe4]
call fcn.0065aa4a
mov byte [ebp - 4], 1
cmp dword [ebp - 0x94], 4
je 0x663450
cmp dword [ebp - 0x94], 5
je 0x663450
cmp dword [ebp - 0x94], 6
je 0x663450
mov edx, dword [ebp - 0x8c]
push edx
call fcn.0065c696
add esp, 4
push eax
mov eax, dword [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x12c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004f7f10
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xec], edx
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0xb0]
sub ecx, dword [ebp - 0xb8]
cmp dword [ebp - 0xec], ecx
jl 0x663446
mov edx, dword [ebp - 0xb8]
mov dword [ebp - 0xe0], edx
jmp 0x663450
push 6
mov ecx, dword [ebp + 8]
call fcn.0065bc20
push 0
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0xb8]
push ecx
push 4
mov edx, dword [ebp - 0xb4]
push edx
mov eax, dword [ebp - 0xe0]
push eax
mov ecx, dword [ebp + 8]
call fcn.00505fa0
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x130], ecx
mov edx, dword [ebp - 0x130]
push edx
call fcn.0065a9fc
add esp, 4
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0xb8]
lea edx, [ecx + eax - 2]
mov dword [ebp - 0xb8], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xe4]
call fcn.0065a9ea
jmp 0x6632c4
jmp 0x663297
mov eax, dword [ebp + 0x10]
cmp dword [eax + 8], 1
jle 0x663695
mov ecx, dword [ebp - 0xac]
mov dword [ebp - 0xb4], ecx
mov edx, dword [ebp - 0x170]
mov eax, dword [ebp - 0xb4]
add eax, dword [edx + 0x210]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0x94], 4
je 0x66350b
cmp dword [ebp - 0x94], 5
je 0x66350b
cmp dword [ebp - 0x94], 6
jne 0x663523
mov eax, dword [ebp - 0x80]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 0x24]
sub edx, eax
mov dword [ebp - 0xb8], edx
jmp 0x66352f
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0xdc], 0
jmp 0x66354a
mov edx, dword [ebp - 0xdc]
add edx, 1
mov dword [ebp - 0xdc], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xdc]
cmp ecx, dword [eax + 8]
jge 0x663695
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 0xc]
imul eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xb8]
add ecx, eax
mov dword [ebp - 0xb0], ecx
mov edx, dword [ebp - 0xdc]
imul edx, edx, 0x1f
mov eax, dword [ebp + 0x18]
add eax, edx
push eax
call fcn.0065c696
add esp, 4
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0xb0]
sub ecx, 2
mov dword [ebp - 0xb0], ecx
mov edx, dword [ebp - 0xb8]
add edx, 2
mov dword [ebp - 0xb8], edx
push 0
mov ecx, dword [ebp + 8]
call fcn.0065bc20
mov eax, dword [ebp - 0xb8]
add eax, dword [ebp - 0xb0]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0x94], 4
je 0x66364a
cmp dword [ebp - 0x94], 5
je 0x66364a
cmp dword [ebp - 0x94], 6
je 0x66364a
mov eax, dword [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0xdc]
imul ecx, ecx, 0x1f
mov edx, dword [ebp + 0x18]
add edx, ecx
push edx
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp + 8]
call fcn.004f7f10
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0xf8], ecx
mov dword [ebp - 0xf4], edx
mov eax, dword [ebp - 0xb0]
sub eax, dword [ebp - 0xb8]
cmp dword [ebp - 0xf8], eax
jl 0x663640
mov ecx, dword [ebp - 0xb8]
mov dword [ebp - 0xf0], ecx
jmp 0x66364a
push 6
mov ecx, dword [ebp + 8]
call fcn.0065bc20
push 0
mov edx, dword [ebp - 0x74]
push edx
mov eax, dword [ebp - 0xdc]
imul eax, eax, 0x1f
mov ecx, dword [ebp + 0x18]
add ecx, eax
push ecx
lea edx, [ebp - 0xb8]
push edx
push 0
mov eax, dword [ebp - 0xb4]
push eax
mov ecx, dword [ebp - 0xf0]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
call dword [eax + 0x68]
mov ecx, dword [ebp - 0xb0]
add ecx, 2
mov dword [ebp - 0xb8], ecx
jmp 0x66353b
jmp 0x663805
mov edx, dword [ebp + 0x14]
cmp dword [edx + 0x70], 0
je 0x6636c0
mov eax, dword [ebp + 0x14]
movsx ecx, word [eax + 0x74]
mov edx, dword [ebp - 0x30]
imul edx, ecx
imul edx, edx, 0x58
mov eax, dword [ebp + 0xc]
add eax, edx
mov dword [ebp - 0xd0], eax
jmp 0x6636d5
mov ecx, dword [ebp + 0x14]
movsx edx, word [ecx + 0x74]
imul edx, edx, 0x58
mov eax, dword [ebp + 0xc]
add eax, edx
mov dword [ebp - 0xd0], eax
lea ecx, [ebp - 0x74]
push ecx
mov edx, dword [ebp - 0xd0]
push edx
mov ecx, dword [ebp - 0x170]
call fcn.00663081
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jne 0x663721
mov dword [ebp - 0x13c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8]
call fcn.004619e0
mov eax, dword [ebp - 0x13c]
jmp 0x663fb7
mov eax, dword [ebp - 0x170]
mov ecx, dword [eax + 0x204]
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
lea ecx, [eax + ecx*2]
mov dword [ebp - 0x108], ecx
mov edx, dword [ebp - 0x170]
mov eax, dword [edx + 0x208]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 4]
lea eax, [edx + eax*2]
mov dword [ebp - 0x104], eax
mov ecx, dword [ebp - 0x170]
mov edx, dword [ecx + 0x204]
shl edx, 1
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 8]
sub ecx, edx
mov dword [ebp - 0x100], ecx
mov edx, dword [ebp - 0x170]
mov eax, dword [edx + 0x208]
shl eax, 1
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0xc]
sub edx, eax
mov dword [ebp - 0xfc], edx
push 0
mov ecx, dword [ebp + 8]
call fcn.0065bc20
mov eax, dword [ebp - 0xb8]
add eax, dword [ebp - 0xb0]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x10c], eax
push 0
mov eax, dword [ebp - 0x8c]
push eax
call fcn.0065c696
add esp, 4
push eax
mov ecx, dword [ebp - 0x8c]
push ecx
lea edx, [ebp - 0xb8]
push edx
push 0
mov eax, dword [ebp - 0xb4]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
call dword [eax + 0x68]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x140], ecx
mov edx, dword [ebp - 0x140]
push edx
call fcn.0065a9fc
add esp, 4
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
call dword [edx + 0x30]
lea ecx, [ebp - 0xc8]
call fcn.0065ac12
push 8
call fcn.004036f0
mov dword [ebp - 0x144], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0x144], 0
je 0x66384c
mov ecx, dword [ebp - 0x144]
call fcn.004c3200
mov dword [ebp - 0x174], eax
jmp 0x663856
mov dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x148], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x148]
mov dword [ebp - 0x90], ecx
push 0
push 1
push 0
lea ecx, [ebp - 0x88]
call fcn.0065bc26
mov byte [ebp - 4], 3
lea edx, [ebp - 0x88]
push edx
mov ecx, dword [ebp + 8]
call fcn.0065b488
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0x94], 0
je 0x6638c0
cmp dword [ebp - 0x94], 6
je 0x6638c0
cmp dword [ebp - 0x94], 4
je 0x6638c0
cmp dword [ebp - 0x94], 8
jne 0x6638dd
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xcc], 0
mov eax, dword [ebp + 0x14]
movsx ecx, word [eax + 0x74]
mov dword [ebp - 0x34], ecx
jmp 0x66393b
cmp dword [ebp - 0x94], 7
jne 0x6638f8
mov edx, dword [ebp + 0x14]
xor eax, eax
cmp dword [edx + 0x70], 0
sete al
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 0x70], eax
mov edx, dword [ebp + 0x14]
cmp dword [edx + 0x70], 0
je 0x66390c
mov eax, dword [ebp - 0x7c]
sub eax, 1
mov dword [ebp - 0x14], eax
jmp 0x663915
mov ecx, dword [ebp - 0x30]
sub ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x94], 1
jne 0x66392a
mov dword [ebp - 0xcc], 0
jmp 0x663934
mov dword [ebp - 0xcc], 1
mov dword [ebp - 0x34], 1
mov edx, dword [ebp + 0x14]
add edx, 0x10
mov eax, dword [edx]
mov dword [ebp - 0x24], eax
mov ecx, dword [edx + 4]
mov dword [ebp - 0x20], ecx
mov eax, dword [edx + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0xa8], 8
mov eax, dword [ebp - 0xa8]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ebp - 0x20]
add ecx, eax
mov dword [ebp - 0x78], ecx
mov edx, dword [ebp - 0xa8]
imul edx, edx, 3
mov eax, dword [ebp - 0x24]
add eax, edx
mov dword [ebp - 0xd8], eax
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0xa8]
mov dword [ebp - 0xd4], ecx
cmp dword [ebp - 0xcc], 0
jne 0x6639c1
push 5
call dword [0x705a44]
push eax
call fcn.00508940
push eax
mov ecx, dword [ebp + 8]
call fcn.0065b47c
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0x14]
movsx eax, word [edx + 0x16c]
test eax, eax
je 0x663ef3
mov dword [ebp - 0xa0], 0
jmp 0x6639ee
mov ecx, dword [ebp - 0xa0]
add ecx, 1
mov dword [ebp - 0xa0], ecx
mov edx, dword [ebp - 0xa0]
cmp edx, dword [ebp - 0x14]
jge 0x663c6b
mov eax, dword [ebp + 0x14]
cmp dword [eax + 0x70], 0
je 0x663a1b
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0xa0]
imul ecx, dword [ebp - 0x30]
mov dword [ebp - 0xbc], ecx
jmp 0x663a2a
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0xa0]
mov dword [ebp - 0xbc], edx
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0xbc]
imul ecx, ecx, 0x58
mov edx, dword [ebp + 0xc]
add edx, ecx
push edx
mov ecx, dword [ebp - 0x170]
call fcn.00663081
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jne 0x663a8d
mov dword [ebp - 0x14c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x88]
call fcn.004c3780
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8]
call fcn.004619e0
mov eax, dword [ebp - 0x14c]
jmp 0x663fb7
mov eax, dword [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0x8c]
push ecx
lea edx, [ebp - 0x154]
push edx
mov ecx, dword [ebp + 8]
call fcn.004f7f10
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], edx
cmp dword [ebp - 0xcc], 0
je 0x663b75
mov eax, dword [ebp - 0xa0]
cdq
xor eax, edx
sub eax, edx
and eax, 0xf
xor eax, edx
sub eax, edx
mov eax, dword [eax*4 + 0x6e68b0]
push eax
mov ecx, dword [ebp - 0x90]
call fcn.005047d0
mov ecx, dword [ebp - 0x90]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0065b47c
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x170]
mov eax, dword [edx + 0x210]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ebp - 0x78]
add ecx, eax
mov eax, dword [ebp - 0xa8]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
push ecx
mov edx, dword [ebp - 0xd4]
add edx, dword [ebp - 0xa8]
push edx
mov eax, dword [ebp - 0x170]
mov eax, dword [eax + 0x210]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ebp - 0x78]
add ecx, eax
mov eax, dword [ebp - 0xa8]
cdq
sub eax, edx
sar eax, 1
add ecx, eax
push ecx
mov edx, dword [ebp - 0xd4]
push edx
mov ecx, dword [ebp + 8]
call fcn.0049b280
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.0065b47c
mov ecx, eax
call fcn.0065ac12
jmp 0x663bd9
mov ecx, dword [ebp - 0x170]
mov eax, dword [ecx + 0x210]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ebp - 0x78]
add ecx, eax
mov eax, dword [ebp - 0xa8]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
push ecx
mov edx, dword [ebp - 0xd4]
add edx, dword [ebp - 0xa8]
push edx
mov eax, dword [ebp - 0x170]
mov eax, dword [eax + 0x210]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ebp - 0x78]
add ecx, eax
mov eax, dword [ebp - 0xa8]
cdq
sub eax, edx
sar eax, 1
add ecx, eax
push ecx
mov edx, dword [ebp - 0xd4]
push edx
mov ecx, dword [ebp + 8]
call fcn.0049b280
push 0
mov ecx, dword [ebp + 8]
call fcn.0065bc20
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0x8c]
push ecx
mov edx, dword [ebp - 0x78]
push edx
mov eax, dword [ebp - 0xd8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
call dword [edx + 0x64]
mov eax, dword [ebp - 0x110]
push eax
mov ecx, dword [ebp + 8]
call fcn.0065bc20
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x158], ecx
mov edx, dword [ebp - 0x158]
push edx
call fcn.0065a9fc
add esp, 4
mov eax, dword [ebp - 0xd8]
add eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x1c]
jle 0x663c54
mov ecx, dword [ebp - 0xd8]
add ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x170]
mov eax, dword [ebp - 0x78]
add eax, dword [edx + 0x210]
mov dword [ebp - 0x78], eax
jmp 0x6639df
cmp dword [ebp - 0x94], 7
jne 0x663ea9
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 8], 1
jle 0x663ea9
mov dword [ebp - 0xa0], 0
jmp 0x663ca0
mov edx, dword [ebp - 0xa0]
add edx, 1
mov dword [ebp - 0xa0], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xa0]
cmp ecx, dword [eax + 8]
jge 0x663e90
cmp dword [ebp - 0xa0], 0
jne 0x663cd1
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
jmp 0x663d15
mov dword [ebp - 0x11c], 2
mov eax, dword [ebp - 0xa0]
sub eax, 1
cdq
mov ecx, 6
idiv ecx
mov edx, dword [edx*4 + 0x6e68f0]
mov dword [ebp - 0x114], edx
cmp dword [ebp - 0xa0], 7
jne 0x663d15
push 0
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
call dword [edx + 0x34]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp - 0x90]
call fcn.004c3250
mov ecx, dword [ebp - 0x90]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0065b47c
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xa0]
imul edx, edx, 0x1f
mov eax, dword [ebp + 0x18]
add eax, edx
push eax
call fcn.0065c696
add esp, 4
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x74]
push ecx
mov edx, dword [ebp - 0xa0]
imul edx, edx, 0x1f
mov eax, dword [ebp + 0x18]
add eax, edx
push eax
lea ecx, [ebp - 0x160]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004f7f10
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x98], eax
push 2
mov ecx, dword [ebp + 8]
call fcn.0065ad5c
mov ecx, dword [ebp - 0x170]
mov eax, dword [ecx + 0x210]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ebp - 0x78]
add ecx, eax
mov eax, dword [ebp - 0xa8]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
push ecx
mov edx, dword [ebp - 0xd4]
add edx, dword [ebp - 0xa8]
push edx
mov eax, dword [ebp - 0x170]
mov eax, dword [eax + 0x210]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ebp - 0x78]
add ecx, eax
mov eax, dword [ebp - 0xa8]
cdq
sub eax, edx
sar eax, 1
add ecx, eax
push ecx
mov edx, dword [ebp - 0xd4]
push edx
mov ecx, dword [ebp + 8]
call fcn.0049b280
push 1
mov ecx, dword [ebp + 8]
call fcn.0065ad5c
push 8
mov ecx, dword [ebp + 8]
call fcn.0065bc20
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0xa0]
imul ecx, ecx, 0x1f
mov edx, dword [ebp + 0x18]
add edx, ecx
push edx
mov eax, dword [ebp - 0x78]
push eax
mov ecx, dword [ebp - 0xd8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
call dword [eax + 0x64]
mov ecx, dword [ebp - 0x120]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0065bc20
mov edx, dword [ebp - 0xd8]
add edx, dword [ebp - 0x9c]
cmp edx, dword [ebp - 0x1c]
jle 0x663e66
mov eax, dword [ebp - 0xd8]
add eax, dword [ebp - 0x9c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x170]
mov edx, dword [ebp - 0x78]
add edx, dword [ecx + 0x210]
mov dword [ebp - 0x78], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.0065b47c
mov ecx, eax
call fcn.0065ac12
jmp 0x663c91
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 8], 6
jle 0x663ea9
push 0xffffff
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
call dword [eax + 0x34]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0xa8]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0xa8]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [ebp - 0x78]
add edx, eax
mov dword [ebp - 0x18], edx
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
mov edx, dword [ebp - 0x20]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x18]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x170]
call fcn.006688e0
mov ecx, dword [ebp - 0x28]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0065ad5c
mov edx, dword [ebp - 0xa4]
push edx
mov ecx, dword [ebp + 8]
call fcn.0065b488
cmp dword [ebp - 0xcc], 0
jne 0x663f23
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.0065b47c
mov ecx, dword [ebp + 0x14]
add ecx, 0x10
mov edx, dword [ebp - 0x24]
mov dword [ecx], edx
mov eax, dword [ebp - 0x20]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x18]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x90]
mov dword [ebp - 0x168], ecx
mov edx, dword [ebp - 0x168]
mov dword [ebp - 0x164], edx
cmp dword [ebp - 0x164], 0
je 0x663f7c
push 1
mov eax, dword [ebp - 0x164]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x164]
call dword [edx + 4]
mov dword [ebp - 0x178], eax
jmp 0x663f86
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x16c], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x88]
call fcn.004c3780
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8]
call fcn.004619e0
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x14