Function at 0x6d61c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x16c]
cmp eax, dword [ecx + 8]
jbe 0x6d7439
sub esp, 0x1ec
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x98], 0
call fcn.00442910
mov eax, dword [esp + 0x1f0]
mov ecx, dword [eax + 8]
mov dword [esp], ecx
lea ecx, [esp + 0x30]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 8], ecx
lea ecx, [esp + 0x98]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 0xffffffff
call fcn.005291e0
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
test eax, eax
je 0x6d64d4
mov dword [esp + 0xd4], eax
test ecx, ecx
je 0x6d64cd
mov dword [esp + 0x90], ebx
mov dword [esp + 0xd0], esi
mov dword [esp + 0x94], ebp
mov dword [esp + 0xcc], edx
lea ecx, [0x844994]
cmp edx, ecx
jne 0x6d62f5
mov dword [esp], edx
mov dword [esp + 4], ebx
lea eax, [0x843184]
mov dword [esp + 8], eax
call fcn.00403870
movzx eax, byte [esp + 0xc]
test al, al
je 0x6d62c3
mov dword [esp + 0x30], 0xc
mov eax, dword [esp + 0xd4]
jmp 0x6d64cd
mov eax, dword [esp + 0xcc]
lea ecx, [0x844994]
cmp eax, ecx
mov eax, dword [esp + 0xd4]
mov edx, dword [esp + 0xcc]
mov ebx, dword [esp + 0x90]
mov ebp, dword [esp + 0x94]
mov esi, dword [esp + 0xd0]
jne 0x6d6340
mov dword [esp], edx
mov dword [esp + 4], ebx
lea eax, [0x843174]
mov dword [esp + 8], eax
call fcn.00403870
movzx eax, byte [esp + 0xc]
test al, al
jne 0x6d645b
mov eax, dword [esp + 0xcc]
lea ecx, [0x844994]
cmp eax, ecx
mov edx, eax
mov ebx, dword [esp + 0x90]
mov ebp, dword [esp + 0x94]
mov esi, dword [esp + 0xd0]
jne 0x6d6365
mov dword [esp], edx
mov dword [esp + 4], ebx
lea eax, [0x843160]
mov dword [esp + 8], eax
call fcn.00403870
movzx eax, byte [esp + 0xc]
test al, al
jne 0x6d6203
lea eax, [0x774e20]
mov dword [esp], eax
call fcn.0040bcc0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x17
lea ecx, [0x7c24a1]
mov dword [eax], ecx
mov edx, dword [esp + 0xd0]
mov dword [eax + 8], edx
mov edx, dword [0xaab020]
test edx, edx
jne 0x6d63a6
mov edx, dword [esp + 0x94]
mov dword [eax + 0xc], edx
jmp 0x6d63b9
lea edi, [eax + 0xc]
mov edx, eax
mov eax, dword [esp + 0x94]
call fcn.004643b0
mov eax, edx
mov ecx, dword [esp + 0x1f0]
mov edx, dword [ecx + 4]
lea ebx, [0x844444]
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x17c], 0
mov dword [esp + 0x180], 0
mov dword [esp + 0x184], 0
mov dword [esp + 0x188], 0
mov dword [esp + 0x17c], edx
lea edx, [esp + 0xe8]
mov dword [esp + 0x180], edx
mov dword [esp + 0x184], eax
lea eax, [esp + 0x17c]
mov dword [esp], eax
lea eax, [esp + 0x70]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
mov byte [esp + 0x14], 1
call fcn.00447d90
jmp 0x6d6203
mov eax, dword [esp + 0xd4]
mov ecx, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
mov ebx, dword [eax + 0x24]
mov ebp, dword [esp + 0x1f0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0x10], 0
and ebx, 0x400
mov dword [esp + 0xc], ebx
call fcn.006d4520
mov eax, dword [esp + 0x1f0]
mov dword [esp], eax
mov ecx, dword [esp + 0xd4]
mov dword [esp + 4], ecx
call fcn.006d5a80
mov eax, dword [esp + 0x1f0]
mov dword [esp], eax
mov ecx, dword [esp + 0xd4]
mov dword [esp + 4], ecx
call fcn.006d5c40
jmp 0x6d6203
xor ecx, ecx
jmp 0x6d6941
mov eax, dword [esp + 0x1f0]
mov ecx, dword [eax + 0x10]
mov dword [esp + 0xb0], 0
mov edx, dword [eax + 0xc]
mov dword [esp + 0xac], 0
mov dword [esp + 0xfc], 0
mov dword [esp + 0x100], 0
mov dword [esp + 0x104], 0
mov dword [esp + 0x108], 0
mov dword [esp + 0x104], ecx
lea ecx, [esp + 0xb0]
mov dword [esp + 0x108], ecx
mov dword [esp + 0xfc], edx
lea ecx, [esp + 0xac]
mov dword [esp + 0x100], ecx
lea ecx, [esp + 0xfc]
mov dword [esp], ecx
lea ecx, [esp + 0x50]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 2
mov byte [esp + 0x14], 0
call fcn.00447d90
mov eax, dword [esp + 0x18]
test eax, eax
jl 0x6d6203
jne 0x6d6670
mov eax, dword [esp + 0xac]
mov dword [esp + 0xa4], eax
mov ecx, dword [eax]
test ecx, ecx
je 0x6d6605
cmp ecx, 1
jne 0x6d6203
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov ebx, dword [esp + 0x1f0]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.006d5480
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], ecx
mov eax, dword [esp + 0xa4]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
lea eax, [esp + 0xe8]
mov dword [esp + 4], eax
call fcn.00404d40
jmp 0x6d6203
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov ebx, dword [eax + 0xc]
mov ebp, dword [eax + 0x10]
mov esi, dword [esp + 0x1f0]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], ebp
call fcn.006d4f70
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], ecx
mov eax, dword [esp + 0xa4]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
lea eax, [esp + 0xe8]
mov dword [esp + 4], eax
call fcn.00404d40
jmp 0x6d6203
mov eax, dword [esp + 0xb0]
mov dword [esp + 0xa8], eax
mov ecx, dword [esp + 0x1f0]
lea edx, [ecx + 0x14]
mov dword [esp + 0xc8], edx
mov dword [esp], edx
call fcn.0046dc50
mov eax, dword [esp + 0x1f0]
mov ecx, dword [eax + 0x1c]
mov dword [esp + 0xc4], ecx
lea edi, [esp + 0x1bc]
xor eax, eax
call fcn.00464654
lea ecx, [0x784ae0]
mov dword [esp], ecx
mov ecx, dword [esp + 0xc4]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x1bc]
mov dword [esp + 8], ecx
call fcn.0040d940
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x6d6700
lea eax, [esp + 0x1bc]
mov dword [esp], eax
call fcn.0040db70
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x9c]
mov edx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x1bc]
test ebx, ebx
je 0x6d6787
mov ebx, dword [esp + 0x1c0]
mov ebx, dword [ebx]
inc edx
cmp eax, edx
jae 0x6d6755
mov dword [esp + 0xa0], ebx
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
lea eax, [0x767180]
mov dword [esp + 0x10], eax
call fcn.0044b1b0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0xa0]
mov dword [esp + 0x9c], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
mov ebp, dword [0xaab020]
lea edi, [ecx + edx*4 - 4]
test ebp, ebp
jne 0x6d677b
mov dword [ecx + edx*4 - 4], ebx
jmp 0x6d66e2
mov eax, ebx
call fcn.004643b0
jmp 0x6d66e2
mov dword [esp + 0x3c], edx
mov dword [esp + 0xc0], ecx
mov eax, dword [esp + 0xc8]
mov dword [esp], eax
call fcn.0046dfd0
xor eax, eax
jmp 0x6d67ac
mov ecx, dword [esp + 0x4c]
lea eax, [ecx + 1]
mov ecx, dword [esp + 0x3c]
cmp eax, ecx
jge 0x6d67f2
mov dword [esp + 0x4c], eax
mov ecx, dword [esp + 0xc0]
mov edx, dword [ecx + eax*4]
lea edi, [esp + 0x18c]
xor eax, eax
call fcn.00464654
lea ecx, [0x767180]
mov dword [esp], ecx
mov dword [esp + 4], edx
lea edx, [esp + 0x18c]
mov dword [esp + 8], edx
call fcn.0040d940
jmp 0x6d6928
mov eax, dword [esp + 0x1f0]
mov ecx, dword [eax + 8]
mov dword [esp], ecx
call fcn.00528b80
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe4], ecx
test edx, edx
je 0x6d6898
mov dword [esp + 0xd0], ecx
mov dword [esp + 0xbc], eax
lea eax, [0x774e20]
mov dword [esp], eax
call fcn.0040bcc0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0xb
lea ecx, [0x7b8dbb]
mov dword [eax], ecx
mov ecx, dword [esp + 0xbc]
mov dword [eax + 8], ecx
mov ecx, dword [0xaab020]
test ecx, ecx
jne 0x6d6871
mov ecx, dword [esp + 0xd0]
mov dword [eax + 0xc], ecx
jmp 0x6d6884
lea edi, [eax + 0xc]
mov ecx, eax
mov eax, dword [esp + 0xd0]
call fcn.004643b0
mov eax, ecx
lea ecx, [0x844444]
mov dword [esp + 0xe0], ecx
mov dword [esp + 0xe4], eax
mov eax, dword [esp + 0x1f0]
mov ecx, dword [eax]
mov dword [esp], ecx
call fcn.004054f0
mov eax, dword [esp + 0x1f0]
mov eax, dword [eax + 4]
mov dword [esp], eax
call fcn.004054f0
mov eax, dword [esp + 0xa8]
mov dword [esp], eax
lea eax, [esp + 0xe0]
mov dword [esp + 4], eax
call fcn.00404d40
add esp, 0x1ec
ret
mov eax, dword [esp + 0x190]
mov eax, dword [eax]
mov dword [esp + 0x88], eax
mov ecx, dword [esp + 0x1f0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.006d5a80
mov eax, dword [esp + 0x1f0]
mov dword [esp], eax
mov ecx, dword [esp + 0x88]
mov dword [esp + 4], ecx
call fcn.006d5c40
lea eax, [esp + 0x18c]
mov dword [esp], eax
call fcn.0040db70
mov ecx, dword [esp + 0x18c]
test ecx, ecx
jne 0x6d68dc
jmp 0x6d67a5
mov eax, dword [esp + 0xd4]
mov ecx, edx
mov edx, dword [esp + 0x30]
test edx, edx
je 0x6d701a
mov edx, dword [eax + 0x38]
mov ebx, dword [eax + 0x3c]
cmp ecx, ebx
jae 0x6d742f
mov dword [esp + 0xb8], edx
mov dword [esp + 0x2c], ecx
mov eax, dword [edx + ecx + 8]
mov dword [esp + 0xf0], 0
mov dword [esp + 0xf4], 0
mov dword [esp + 0xf8], 0
lea ebx, [edx + ecx + 0xc]
mov dword [esp + 0xf0], ebx
shr eax, 1
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], eax
mov ebx, dword [esp + 0xf0]
mov ebp, dword [esp + 0xf4]
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
call fcn.004736c0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x7c], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x15c], 0
mov dword [esp + 0x160], 0
mov dword [esp + 0x164], 0
mov dword [esp + 0x168], 0
mov edx, dword [esp + 0xd4]
mov ebx, dword [edx + 0x20]
mov ebp, dword [edx + 0x1c]
mov dword [esp + 0x15c], ebp
mov dword [esp + 0x160], ebx
mov dword [esp + 0x164], eax
mov dword [esp + 0x168], ecx
lea ebx, [esp + 0x15c]
mov dword [esp], ebx
mov dword [esp + 4], 2
mov dword [esp + 8], 2
call fcn.004ee6f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], ecx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0xb8]
lea edx, [ecx + eax + 4]
mov dword [esp + 0xb4], edx
mov ebx, dword [eax + ecx + 4]
cmp ebx, 3
ja 0x6d6ab9
cmp ebx, 2
jne 0x6d6a9b
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0xd4]
mov esi, dword [esp + 0x7c]
mov edi, 0x400
jmp 0x6d6d26
cmp ebx, 3
jne 0x6d6aff
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0xd4]
mov esi, dword [esp + 0x7c]
mov edi, 2
jmp 0x6d6d26
cmp ebx, 4
jne 0x6d6afa
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0xd4]
mov dword [ebp + 0x34], ebx
mov esi, dword [0xaab020]
test esi, esi
jne 0x6d6adf
mov esi, dword [esp + 0x7c]
mov dword [ebp + 0x30], esi
jmp 0x6d6af3
lea edi, [ebp + 0x30]
mov esi, eax
mov eax, dword [esp + 0x7c]
call fcn.004643b0
mov eax, esi
mov esi, dword [esp + 0x7c]
xor edi, edi
jmp 0x6d6d26
cmp ebx, 5
je 0x6d6b15
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0xd4]
mov esi, dword [esp + 0x7c]
xor edi, edi
jmp 0x6d6d26
mov dword [esp + 0x14c], 0
mov dword [esp + 0x150], 0
mov dword [esp + 0x154], 0
mov dword [esp + 0x158], 0
mov eax, dword [esp + 0xd4]
mov ecx, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
mov dword [esp + 0x14c], ecx
mov dword [esp + 0x150], edx
mov ecx, dword [eax + 0x30]
mov edx, dword [eax + 0x34]
mov dword [esp + 0x154], ecx
mov dword [esp + 0x158], edx
lea ecx, [esp + 0x14c]
mov dword [esp], ecx
mov dword [esp + 4], 2
mov dword [esp + 8], 2
call fcn.004ee6f0
mov eax, dword [esp + 0x1f0]
lea ecx, [eax + 0x14]
mov dword [esp + 0xc8], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x20], edx
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x78], ebx
mov dword [esp], ecx
call fcn.0046dc50
mov eax, dword [esp + 0x1f0]
mov ecx, dword [eax + 0x1c]
mov dword [esp + 0xc4], ecx
lea edi, [esp + 0x1bc]
xor eax, eax
call fcn.00464654
lea ecx, [0x784ae0]
mov dword [esp], ecx
mov ebx, dword [esp + 0xc4]
mov dword [esp + 4], ebx
lea ebx, [esp + 0x1bc]
mov dword [esp + 8], ebx
call fcn.0040d940
jmp 0x6d7196
mov eax, dword [esp + 0xc8]
mov dword [esp], eax
call fcn.0046dfd0
mov eax, dword [esp + 0xd4]
mov ecx, dword [eax + 0x2c]
mov edx, dword [eax + 0x30]
mov ebx, dword [eax + 0x34]
lea ebp, [0x75d9e0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.00410370
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
test ecx, ecx
setne cl
mov eax, dword [eax + 4]
test eax, eax
setne al
or eax, ecx
test al, al
jne 0x6d6c59
xor eax, eax
jmp 0x6d6d03
mov eax, dword [esp + 0xd4]
mov ecx, dword [eax + 0x2c]
mov edx, dword [eax + 0x30]
mov ebx, dword [eax + 0x34]
lea ebp, [0x75d9e0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.00410370
mov eax, dword [esp + 0xd4]
mov ecx, dword [eax + 0x2c]
mov edx, dword [esp + 0x10]
mov ebx, dword [edx]
mov dword [esp + 0x48], ebx
mov edx, dword [edx + 4]
mov dword [esp + 0x44], edx
lea ebp, [0x75d9e0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 8], ecx
mov esi, dword [esp + 0x24]
mov dword [esp + 0xc], esi
call fcn.00410a00
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x44]
or ecx, dword [eax + 4]
mov edx, dword [esp + 0x48]
or dword [eax], edx
mov dword [eax + 4], ecx
mov eax, dword [esp + 0xd4]
mov ecx, dword [eax + 0x2c]
mov edx, dword [eax + 0x30]
mov ebx, dword [eax + 0x34]
lea ebp, [0x75d9e0]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.00410d90
mov eax, 0x800
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0xb4]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0xd4]
mov esi, dword [esp + 0x7c]
mov edi, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x34], edi
cmp dword [edx], 5
je 0x6d6db6
nop
mov eax, dword [ebp + 0x2c]
lea ecx, [0x75d9e0]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebx
call fcn.00410370
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xdc]
mov edx, dword [esp + 0x10]
mov ebx, dword [edx]
mov edx, dword [edx + 4]
mov ebp, dword [esp + 0x1f0]
mov dword [esp], ebp
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
xor eax, eax
and edx, eax
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x34]
and ebx, ecx
mov dword [esp + 0xc], ebx
call fcn.006d4520
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0xb4]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0xd4]
mov esi, dword [esp + 0x7c]
mov edi, dword [esp + 0x34]
cmp dword [edx], 2
jne 0x6d6e6a
mov eax, dword [ebp + 0x2c]
lea ecx, [0x75d9e0]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebx
call fcn.00410370
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xdc]
mov edx, dword [esp + 0x10]
mov edx, dword [edx]
mov ebx, dword [esp + 0x1f0]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0x10], 0
and edx, 0x8000
mov dword [esp + 0xc], edx
call fcn.006d4520
mov eax, dword [esp + 0xd4]
mov ecx, dword [eax + 0x2c]
lea edx, [0x75d9e0]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 8], ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], ebx
call fcn.00410d90
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0xb4]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0xd4]
mov esi, dword [esp + 0x7c]
mov edi, dword [esp + 0x34]
mov edi, dword [eax + ecx + 4]
cmp edi, 2
ja 0x6d6e8b
cmp edi, 1
jne 0x6d6e7f
mov edi, 0x100
jmp 0x6d6eb1
cmp edi, 2
jne 0x6d6eaf
mov edi, 0x200
jmp 0x6d6eb1
cmp edi, 3
jne 0x6d6e97
mov edi, 2
jmp 0x6d6eb1
cmp edi, 4
jne 0x6d6ea3
mov edi, 0x40
jmp 0x6d6eb1
cmp edi, 5
jne 0x6d6eaf
mov edi, pe_nt_image_headers32
jmp 0x6d6eb1
xor edi, edi
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xdc]
and edi, dword [ebp + 0x24]
xor edx, edx
and edx, dword [ebp + 0x28]
mov ebx, dword [esp + 0x1f0]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edi
call fcn.006d4520
mov eax, dword [esp + 0xb4]
cmp dword [eax], 5
jne 0x6d6ff3
mov dword [esp + 0x12c], 0
mov dword [esp + 0x130], 0
mov dword [esp + 0x134], 0
mov dword [esp + 0x138], 0
mov eax, dword [esp + 0xd4]
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
mov dword [esp + 0x12c], edx
mov dword [esp + 0x130], ecx
mov ecx, dword [eax + 0x30]
mov edx, dword [eax + 0x34]
mov dword [esp + 0x134], ecx
mov dword [esp + 0x138], edx
lea ecx, [esp + 0x12c]
mov dword [esp], ecx
mov dword [esp + 4], 2
mov dword [esp + 8], 2
call fcn.004ee6f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], ecx
nop
mov eax, dword [esp + 0xd4]
mov ecx, dword [eax + 0x2c]
lea edx, [0x75d9e0]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
call fcn.00410370
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xdc]
mov edx, dword [esp + 0x10]
mov ebx, dword [edx]
mov edx, dword [edx + 4]
mov ebp, dword [esp + 0x1f0]
mov dword [esp], ebp
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
xor eax, eax
and edx, eax
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x34]
and ebx, ecx
mov dword [esp + 0xc], ebx
call fcn.006d4520
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0xb8]
mov ebx, dword [ebx + edx]
test ebx, ebx
je 0x6d70bd
add edx, ebx
cmp dword [esp + 0x30], edx
ja 0x6d6938
jmp 0x6d71f0
mov eax, dword [0xa840a8]
mov ecx, dword [0xa840ac]
mov edx, dword [esp + 0x1f0]
mov ebx, dword [edx + 4]
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], ecx
mov eax, dword [edx + 0x10]
mov dword [esp + 0x16c], 0
mov dword [esp + 0x170], 0
mov dword [esp + 0x174], 0
mov dword [esp + 0x178], 0
mov dword [esp + 0x16c], ebx
lea ecx, [esp + 0xe8]
mov dword [esp + 0x170], ecx
mov dword [esp + 0x174], eax
lea eax, [esp + 0x16c]
mov dword [esp], eax
lea eax, [esp + 0x68]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
mov byte [esp + 0x14], 1
call fcn.00447d90
mov eax, dword [esp + 0x1f0]
mov dword [esp], eax
mov ecx, dword [esp + 0xd4]
mov dword [esp + 4], ecx
call fcn.006d5c40
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
test eax, eax
je 0x6d6203
mov eax, dword [esp + 0x1f0]
mov ebx, dword [eax + 4]
mov dword [esp + 0xe8], ecx
mov dword [esp + 0xec], edx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x10c], 0
mov dword [esp + 0x110], 0
mov dword [esp + 0x114], 0
mov dword [esp + 0x118], 0
mov dword [esp + 0x10c], ebx
lea edx, [esp + 0xe8]
mov dword [esp + 0x110], edx
mov dword [esp + 0x114], ecx
lea ecx, [esp + 0x10c]
mov dword [esp], ecx
lea ecx, [esp + 0x58]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
mov byte [esp + 0x14], 1
call fcn.00447d90
jmp 0x6d6203
lea eax, [esp + 0x1bc]
mov dword [esp], eax
call fcn.0040db70
mov ecx, dword [esp + 0x1bc]
test ecx, ecx
je 0x6d6c00
mov ecx, dword [esp + 0x1c0]
mov ecx, dword [ecx]
mov dword [esp + 0x84], ecx
lea edi, [esp + 0x18c]
xor eax, eax
call fcn.00464654
lea ecx, [0x767180]
mov dword [esp], ecx
mov edx, dword [esp + 0x84]
mov dword [esp + 4], edx
lea edx, [esp + 0x18c]
mov dword [esp + 8], edx
call fcn.0040d940
mov ecx, dword [esp + 0x20]
jmp 0x6d72c8
lea eax, [0x769820]
mov dword [esp], eax
call fcn.0040bcc0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x4f
lea ecx, [0x7d869b]
mov dword [eax], ecx
mov edx, dword [esp + 0x1f0]
mov ebx, dword [edx + 4]
lea ebp, [0x844124]
mov dword [esp + 0xe8], ebp
mov dword [esp + 0xec], eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x11c], 0
mov dword [esp + 0x120], 0
mov dword [esp + 0x124], 0
mov dword [esp + 0x128], 0
mov dword [esp + 0x11c], ebx
lea ebx, [esp + 0xe8]
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], eax
lea eax, [esp + 0x11c]
mov dword [esp], eax
lea eax, [esp + 0x60]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
mov byte [esp + 0x14], 1
call fcn.00447d90
jmp 0x6d70bd
lea eax, [esp + 0x18c]
mov dword [esp], eax
call fcn.0040db70
mov eax, dword [esp + 0x20]
mov ecx, eax
mov edx, dword [esp + 0x18c]
test edx, edx
je 0x6d7187
mov edx, dword [esp + 0x190]
mov edx, dword [edx]
mov dword [esp + 0x80], edx
mov ebx, dword [edx + 0x1c]
cmp dword [edx + 0x20], ecx
jge 0x6d72f3
xor eax, eax
jmp 0x6d7317
mov dword [esp], ebx
mov eax, dword [esp + 0x78]
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.00402a70
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x80]
test al, al
je 0x6d72b3
mov ebx, dword [edx + 0x20]
mov ebp, dword [edx + 0x1c]
cmp ecx, ebx
jle 0x6d7329
xor eax, eax
jmp 0x6d7363
mov dword [esp + 0x28], ebx
mov dword [esp + 0x8c], ebp
mov dword [esp], ebp
mov eax, dword [esp + 0x78]
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.00402a70
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x80]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x8c]
test al, al
je 0x6d737e
cmp ecx, ebx
ja 0x6d7426
sub ebx, ecx
mov eax, ebx
neg ebx
sar ebx, 0x1f
and ebx, ecx
add ebp, ebx
jmp 0x6d7380
mov eax, ebx
mov dword [esp + 0x13c], 0
mov dword [esp + 0x140], 0
mov dword [esp + 0x144], 0
mov dword [esp + 0x148], 0
mov ecx, dword [esp + 0xdc]
mov edx, dword [esp + 0xd8]
mov dword [esp + 0x13c], edx
mov dword [esp + 0x140], ecx
mov dword [esp + 0x144], ebp
mov dword [esp + 0x148], eax
lea eax, [esp + 0x13c]
mov dword [esp], eax
mov dword [esp + 4], 2
mov dword [esp + 8], 2
call fcn.004ee6f0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x80]
mov dword [edx + 0x20], ecx
mov ecx, dword [0xaab020]
test ecx, ecx
jne 0x6d7419
mov dword [edx + 0x1c], eax
jmp 0x6d72b3
lea edi, [edx + 0x1c]
call fcn.004643b0
jmp 0x6d72b3
mov eax, ecx
mov ecx, ebx
call fcn.00464490
mov eax, ecx
mov ecx, ebx
call fcn.00464440
nop
call fcn.00462fa0
jmp fcn.006d61c0