Function at 0x67b74b
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x80], eax
mov eax, ecx
and eax, 0xfff00000
cmp eax, 0x20500000
push edi
jne 0x67b7ec
mov eax, dword [ebp + 0x1c]
and eax, 4
xor edx, edx
or eax, edx
je 0x67b7ec
mov edx, ecx
and edx, 0xfffff
mov dword [ebp - 0x2c], 0
jbe 0x67b7d6
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x18]
sub ebx, edi
mov dword [ebp - 0xc], ebx
jmp 0x67b7b0
mov ebx, dword [ebp - 0xc]
mov eax, dword [edi]
cmp eax, dword [ebx + edi]
jne 0x67b7d6
mov ebx, dword [esi + 8]
mov ebx, dword [ebx + 0x1c]
mov eax, dword [ebx + eax*4]
mov eax, dword [eax]
and eax, 1
xor ebx, ebx
or eax, ebx
je 0x67b7d6
inc dword [ebp - 0x2c]
add edi, 4
cmp dword [ebp - 0x2c], edx
jb 0x67b7ad
cmp dword [ebp - 0x2c], edx
jne 0x67b7ec
and edx, 0xfffff
or edx, 0x10000000
mov ecx, edx
mov dword [ebp + 0xc], ecx
cmp ecx, 0x50000001
jne 0x67b825
push 0
push 0
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x20500001
push dword [ebp + 8]
mov ecx, esi
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
jmp 0x67dbc2
cmp ecx, 0x50000002
jne 0x67b8cd
mov eax, dword [esi + 8]
test byte [eax + 0x94], 0x80
jne 0x67b8cd
or eax, 0xffffffff
lea edi, [ebp - 0x44]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 0x1c]
xor eax, eax
push eax
push eax
push eax
and edi, 0x8180
push edi
push dword [ebp + 0x18]
lea eax, [ebp - 0x44]
push dword [ebp + 0x14]
mov ecx, esi
push eax
push 0x20500001
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
push 0
push 0
xor eax, eax
push eax
mov eax, dword [ebp + 0x18]
push edi
add eax, 4
push eax
mov eax, dword [ebp + 0x14]
add eax, 4
push eax
lea eax, [ebp - 0x40]
push eax
push 0x20500001
push dword [ebp + 8]
mov ecx, esi
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
push 0
push 0
push dword [ebp + 0x20]
lea eax, [ebp - 0x40]
push dword [ebp + 0x1c]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0x10]
push 0x20400001
jmp 0x67b80c
mov ebx, dword [esi + 8]
test word [ebx + 0x94], 0x200
je 0x67baa6
mov eax, ecx
and eax, 0xfff00000
cmp eax, 0x20000000
mov dword [ebp - 0x2c], eax
je 0x67b909
cmp eax, 0x20100000
je 0x67b909
cmp eax, 0x20200000
je 0x67b909
cmp eax, 0x20300000
jne 0x67baa6
and ecx, 0xfffff
mov ebx, ecx
mov edi, ebx
shl edi, 2
xor ecx, ecx
push 4
pop edx
mov eax, edi
mul edx
seto cl
mov dword [ebp + 0xc], ebx
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ecx, eax
test ecx, ecx
mov dword [ebp + 0x28], ecx
je 0x67c073
xor eax, eax
mov dword [ebp + eax*4 - 0x4c], ecx
inc eax
add ecx, edi
cmp eax, 4
jb 0x67b93f
test ebx, ebx
jbe 0x67b9bb
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x40]
sub edx, eax
sub edi, eax
sub ecx, eax
mov dword [ebp + 0x24], ebx
mov ebx, dword [ebp - 0x2c]
cmp ebx, 0x20000000
je 0x67b9a5
cmp ebx, 0x20100000
je 0x67b99b
cmp ebx, 0x20200000
je 0x67b991
cmp ebx, 0x20300000
jne 0x67b9b0
mov ebx, dword [esi + 0x68]
mov dword [eax], ebx
mov ebx, dword [esi + 0x6c]
jmp 0x67b9ad
mov ebx, dword [esi + 0x6c]
mov dword [eax], ebx
mov ebx, dword [esi + 0x68]
jmp 0x67b9ad
mov ebx, dword [edi + eax]
mov dword [eax], ebx
mov ebx, dword [edx + eax]
jmp 0x67b9ad
mov ebx, dword [edx + eax]
mov dword [eax], ebx
mov ebx, dword [edi + eax]
mov dword [ecx + eax], ebx
add eax, 4
dec dword [ebp + 0x24]
jne 0x67b964
mov ebx, dword [ebp + 0xc]
push ebx
push dword [ebp - 0x4c]
mov ecx, esi
call fcn.0055719a
mov edi, eax
test edi, edi
jl 0x67ba96
push ebx
push dword [ebp - 0x48]
mov ecx, esi
call fcn.0055719a
mov edi, eax
test edi, edi
jl 0x67ba96
mov edi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0xc]
xor eax, eax
push eax
push eax
push eax
and edi, 0x8180
push edi
push eax
push dword [ebp + 0x18]
and ebx, 0xfffff
push dword [ebp - 0x4c]
mov eax, ebx
or eax, 0x10100000
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.0067b74b
test eax, eax
mov dword [ebp + 0x18], eax
jl 0x67ba85
push 0
push 0
xor eax, eax
push eax
push edi
push dword [ebp - 0x4c]
mov eax, ebx
push dword [ebp + 0x14]
or eax, 0x20400000
push dword [ebp - 0x48]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.0067b74b
test eax, eax
mov dword [ebp + 0x18], eax
jl 0x67ba85
mov edi, dword [ebp + 0x28]
mov eax, dword [ebp + 0xc]
push 0
push 0
push dword [ebp + 0x20]
lea eax, [edi + eax*8]
push dword [ebp + 0x1c]
or ebx, 0x30000000
push eax
push dword [ebp - 0x48]
mov ecx, esi
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.0067b74b
test eax, eax
mov dword [ebp + 0x18], eax
jl 0x67ba85
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x67dbc2
push dword [ebp + 0x28]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp + 0x18]
pop ecx
jmp 0x67dbe1
push dword [ebp + 0x28]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, edi
jmp 0x67dbe1
push ecx
mov dword [ebp - 0x30], ecx
call fcn.00679a42
or dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x34], eax
xor eax, eax
test dword [ebx + 0x98], 0x200000
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], eax
je 0x67c426
mov edi, dword [ebp + 0xc]
and edi, 0xfff00000
cmp edi, 0x10000000
je 0x67c426
cmp edi, 0x11d00000
je 0x67c426
cmp edi, 0x20700000
je 0x67c426
cmp edi, 0x11400000
je 0x67c426
cmp edi, 0x11900000
je 0x67c426
cmp edi, 0x11c00000
je 0x67c426
cmp edi, 0x11100000
je 0x67c426
cmp edi, 0x24200000
je 0x67c426
cmp edi, 0x11500000
je 0x67c426
cmp edi, 0x24300000
je 0x67c426
cmp edi, 0x50700000
je 0x67c426
cmp edi, 0x50400000
je 0x67c426
cmp edi, 0x50500000
je 0x67c426
mov eax, dword [ebp + 0xc]
and eax, 0xf0000000
cmp eax, 0x60000000
je 0x67c426
cmp eax, 0x90000000
je 0x67c426
mov ebx, dword [ebp + 0xc]
and ebx, 0xfffff
cmp dword [ebp + 0x14], 0
mov dword [ebp - 8], ebx
je 0x67bbd4
cmp edi, 0x30100000
je 0x67bbd4
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x14]
mov ecx, esi
push ebx
call fcn.00679c8d
test eax, eax
jge 0x67bbd4
mov dword [ebp - 0xc], 1
cmp dword [ebp + 0x18], 0
je 0x67bbf4
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0x18]
mov ecx, esi
push ebx
call fcn.00679c8d
test eax, eax
jge 0x67bbf4
mov dword [ebp - 0xc], 1
cmp edi, 0x23000000
jne 0x67bd5b
cmp dword [ebp + 0x14], 0
jne 0x67bc0d
mov dword [ebp - 0xc], 1
cmp dword [ebp + 0x18], 0
je 0x67bd3a
mov ecx, dword [ebp - 0x14]
mov ebx, 0x92
and ecx, ebx
xor eax, eax
or eax, ecx
mov edx, 0x80000000
je 0x67bc31
mov dword [ebp - 0x40], ebx
jmp 0x67bc44
mov ecx, dword [ebp - 0x14]
and ecx, 0x49
xor eax, eax
or eax, ecx
je 0x67bc4f
mov dword [ebp - 0x40], 0x49
and dword [ebp - 0x44], 0
mov edi, 0x124
jmp 0x67bc7e
mov eax, dword [ebp - 0x18]
and eax, edx
xor ecx, ecx
or eax, ecx
mov edi, 0x124
je 0x67bc67
and dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], edx
jmp 0x67bc7e
mov ecx, dword [ebp - 0x14]
xor eax, eax
and dword [ebp - 0x44], eax
and ecx, edi
or eax, ecx
je 0x67bc7a
mov dword [ebp - 0x40], edi
jmp 0x67bc7e
and dword [ebp - 0x40], 0
mov ecx, dword [ebp - 0x24]
and ecx, ebx
xor eax, eax
or eax, ecx
jne 0x67bc95
mov ecx, dword [ebp - 0x24]
push 0x49
pop ebx
and ecx, ebx
or eax, ecx
je 0x67bc99
xor eax, eax
jmp 0x67bcbd
mov eax, dword [ebp - 0x28]
and eax, edx
xor ecx, ecx
or eax, ecx
je 0x67bca8
mov eax, edx
jmp 0x67bcbb
mov ecx, dword [ebp - 0x24]
and ecx, edi
xor eax, eax
or eax, ecx
je 0x67bcb9
xor eax, eax
mov ebx, edi
jmp 0x67bcbd
xor eax, eax
xor ebx, ebx
cmp dword [ebp - 0x44], eax
jne 0x67bcc7
cmp dword [ebp - 0x40], ebx
je 0x67bd3a
mov ebx, dword [ebp - 0x14]
mov eax, 0xdb
and ebx, eax
xor ecx, ecx
or ecx, ebx
je 0x67bcf3
mov ebx, dword [ebp - 0x24]
and ebx, eax
xor ecx, ecx
or ecx, ebx
je 0x67bcf3
mov ecx, dword [ebp - 0x24]
or ecx, dword [ebp - 0x14]
and ecx, 0x92
jmp 0x67be91
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
and ecx, edx
and ebx, eax
or ecx, ebx
je 0x67bd13
mov ecx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
and ecx, edx
and ebx, eax
or ecx, ebx
jne 0x67be89
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edx
and ecx, edi
or eax, ecx
je 0x67bd33
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
and eax, edx
and ecx, edi
or eax, ecx
jne 0x67be51
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
je 0x67beb0
push 0x441f44
push 0
push 0
push esi
call fcn.0067afcf
add esp, 0x10
jmp 0x67cb90
cmp edi, 0x30100000
je 0x67bea4
cmp dword [ebp + 0x14], 0
jne 0x67bd74
mov dword [ebp - 0xc], 1
cmp dword [ebp + 0x18], 0
je 0x67bd3a
mov ecx, dword [ebp - 0x14]
mov edi, 0x92
and ecx, edi
xor eax, eax
or eax, ecx
mov edx, 0x80000000
je 0x67bd96
xor ebx, ebx
mov dword [ebp - 0x40], edi
jmp 0x67bdda
mov ecx, dword [ebp - 0x14]
and ecx, 0x49
xor eax, eax
or eax, ecx
je 0x67bdad
xor ebx, ebx
mov dword [ebp - 0x40], 0x49
jmp 0x67bdda
mov eax, dword [ebp - 0x18]
and eax, edx
xor ecx, ecx
or eax, ecx
je 0x67bdbf
and dword [ebp - 0x40], ecx
mov ebx, edx
jmp 0x67bdda
mov ecx, dword [ebp - 0x14]
and ecx, 0x124
xor eax, eax
xor ebx, ebx
or eax, ecx
mov dword [ebp - 0x40], 0x124
jne 0x67bdda
mov dword [ebp - 0x40], ebx
mov ecx, dword [ebp - 0x24]
and ecx, edi
xor eax, eax
or eax, ecx
je 0x67bdeb
xor eax, eax
mov ecx, edi
jmp 0x67be29
mov ecx, dword [ebp - 0x24]
and ecx, 0x49
xor eax, eax
or eax, ecx
je 0x67bdfe
push 0x49
xor eax, eax
pop ecx
jmp 0x67be29
mov eax, dword [ebp - 0x28]
and eax, edx
xor ecx, ecx
or eax, ecx
je 0x67be0d
mov eax, edx
jmp 0x67be27
mov ecx, dword [ebp - 0x24]
and ecx, 0x124
xor eax, eax
or eax, ecx
je 0x67be25
xor eax, eax
mov ecx, 0x124
jmp 0x67be29
xor eax, eax
xor ecx, ecx
cmp ebx, eax
jne 0x67be36
cmp dword [ebp - 0x40], ecx
je 0x67bd3a
mov ebx, dword [ebp - 0x14]
mov eax, 0xdb
and ebx, eax
xor ecx, ecx
or ecx, ebx
je 0x67be5b
mov ebx, dword [ebp - 0x24]
and ebx, eax
xor ecx, ecx
or ecx, ebx
je 0x67be5b
mov ecx, dword [ebp - 0x24]
or ecx, dword [ebp - 0x14]
and ecx, edi
jmp 0x67be91
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
and ecx, edx
and ebx, eax
or ecx, ebx
je 0x67bd33
mov ecx, dword [ebp - 0x28]
and ecx, edx
mov edx, dword [ebp - 0x24]
and edx, eax
or ecx, edx
je 0x67bd33
cmp dword [ebp - 0x34], 0
jne 0x67bd3a
mov ecx, dword [ebp - 0x24]
or ecx, dword [ebp - 0x14]
and ecx, eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
jmp 0x67bd3a
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x34], 0
je 0x67c426
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov ecx, edx
and ecx, 0x92
xor eax, eax
xor edi, edi
or eax, ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], edx
je 0x67bfa8
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 8]
cmp ecx, edi
je 0x67beec
mov dword [ebp - 0x30], ecx
jmp 0x67c195
mov dword [ebp - 4], 0x13000000
mov dword [ebp - 0x2c], 0x13200000
mov eax, dword [eax + 4]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x128]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x12c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
push dword [ebp - 8]
mov ecx, esi
push eax
mov dword [ebp - 0x3c], eax
call fcn.0055719a
mov ebx, eax
cmp ebx, edi
jl 0x67dbc4
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 4]
xor edi, edi
push edi
push edi
push dword [ebp + 0x20]
and eax, 0xfffff
push dword [ebp + 0x1c]
xor eax, dword [ebp - 4]
push edi
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp - 0x3c]
push eax
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
cmp ebx, edi
jl 0x67dbc4
xor ecx, ecx
cmp dword [ebp - 8], ecx
jbe 0x67bf9d
mov edx, dword [esi + 8]
mov edx, dword [edx + 0x1c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + ecx*4]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 0x20]
or dword [eax], edx
mov edx, dword [ebp - 0x1c]
or dword [eax + 4], edx
inc ecx
cmp ecx, dword [ebp - 8]
jb 0x67bf7d
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], eax
jmp 0x67c195
mov eax, ebx
and eax, 0x80000000
or eax, edi
je 0x67c07d
mov ebx, dword [ebp - 0x34]
mov eax, dword [ebx + 0xc]
cmp eax, edi
je 0x67c009
mov ebx, eax
cmp ebx, 0x21200000
mov dword [ebp - 0x30], ebx
je 0x67c195
cmp eax, 0x21300000
je 0x67c195
mov ecx, dword [esi + 8]
push 8
xor edi, edi
push edi
push edi
push 1
push edi
push edi
push dword [ecx + 0x2a54]
call fcn.006b57cb
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x120]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x124]
jmp 0x67c06a
cmp dword [ebx + 8], edi
mov ecx, dword [esi + 8]
push 8
push edi
je 0x67c03e
push edi
push 1
push edi
push edi
push dword [ecx + 0x2a54]
call fcn.006b57cb
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x118]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x11c]
jmp 0x67c06a
fld1
push ecx
push ecx
fstp qword [esp]
push edi
push edi
push dword [ecx + 0x2a54]
call fcn.006b574c
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x128]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x12c]
cmp dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], eax
jne 0x67c0bf
mov ebx, 0x8007000e
jmp 0x67dbc4
mov ecx, edx
xor eax, eax
and ecx, 0x49
or eax, ecx
mov eax, dword [ebp - 0x34]
je 0x67c0b4
mov ecx, dword [eax + 0xc]
cmp ecx, edi
jne 0x67bee4
mov ecx, dword [eax + 8]
cmp ecx, edi
jne 0x67bee4
mov dword [ebp - 4], 0x13100000
mov dword [ebp - 0x2c], 0x13300000
jmp 0x67befa
mov eax, dword [eax + 4]
mov dword [ebp - 0x30], eax
jmp 0x67c195
mov eax, dword [ebp - 8]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp dword [ebp - 0x3c], edi
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x67c073
cmp eax, edi
je 0x67c073
cmp dword [ebp - 8], edi
jbe 0x67c118
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
rep stosd dword es:[edi], eax
xor edi, edi
push dword [ebp - 8]
mov ecx, esi
push dword [ebp - 0x3c]
call fcn.0055719a
mov ebx, eax
cmp ebx, edi
jl 0x67dbc4
mov edi, dword [ebp - 0x3c]
xor eax, eax
push eax
push eax
push eax
push eax
push dword [ebp - 0xc]
mov eax, dword [ebp - 8]
push dword [ebp + 0x14]
and eax, 0xfffff
push edi
or eax, 0x23000000
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jge 0x67c165
push dword [ebp - 0xc]
jmp 0x67c3eb
xor ecx, ecx
cmp dword [ebp - 8], ecx
jbe 0x67c189
mov edx, dword [esi + 8]
mov edx, dword [edx + 0x1c]
mov eax, dword [edi + ecx*4]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 0x20]
or dword [eax], edx
mov edx, dword [ebp - 0x1c]
or dword [eax + 4], edx
inc ecx
cmp ecx, dword [ebp - 8]
jb 0x67c16c
push dword [ebp - 0xc]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [ebp - 4], edi
mov edx, dword [ebp - 0x24]
mov ecx, edx
and ecx, 0x92
xor eax, eax
or eax, ecx
je 0x67c262
mov eax, dword [ebp - 0x34]
cmp dword [eax + 8], 0
jne 0x67c426
mov edi, 0x13000000
mov eax, dword [esi + 0x128]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x12c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
push dword [ebp - 8]
mov ecx, esi
push eax
mov dword [ebp - 0x38], eax
call fcn.0055719a
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push dword [ebp + 0x20]
mov ecx, esi
push dword [ebp + 0x1c]
push eax
push dword [ebp + 0x18]
mov eax, dword [ebp - 8]
push dword [ebp - 0x38]
xor eax, edi
and eax, 0xfffff
xor eax, edi
push eax
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor ecx, ecx
cmp dword [ebp - 8], ecx
jbe 0x67c257
mov edx, dword [esi + 8]
mov edx, dword [edx + 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + ecx*4]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 0x20]
or dword [eax], edx
mov edx, dword [ebp - 0x1c]
or dword [eax + 4], edx
inc ecx
cmp ecx, dword [ebp - 8]
jb 0x67c237
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x10], eax
jmp 0x67c426
and edx, 0x49
xor eax, eax
or eax, edx
je 0x67c28c
mov eax, dword [ebp - 0x34]
cmp dword [eax + 8], 0
jne 0x67c426
cmp dword [eax + 0xc], 0
jne 0x67c426
mov edi, 0x13100000
jmp 0x67c1bc
mov eax, dword [ebp - 0x28]
and eax, 0x80000000
xor ecx, ecx
or eax, ecx
je 0x67c426
mov ecx, dword [ebp - 0x34]
mov eax, dword [ecx + 0xc]
xor edi, edi
cmp eax, edi
je 0x67c2e9
cmp eax, 0x21200000
je 0x67c426
cmp eax, 0x21300000
je 0x67c426
mov ecx, dword [esi + 8]
push 8
push edi
push edi
push 1
push edi
push edi
push dword [ecx + 0x2a54]
call fcn.006b57cb
mov ebx, eax
mov eax, dword [esi + 0x120]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x124]
jmp 0x67c33f
cmp dword [ecx + 8], edi
mov ecx, dword [esi + 8]
je 0x67c317
push 0x10
push edi
push edi
push 1
push edi
push edi
push dword [ecx + 0x2a54]
call fcn.006b57cb
mov ebx, eax
mov eax, dword [esi + 0x118]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x11c]
jmp 0x67c33f
fld1
push 0x20
push edi
push ecx
push ecx
fstp qword [esp]
push edi
push edi
push dword [ecx + 0x2a54]
call fcn.006b574c
mov ebx, eax
mov eax, dword [esi + 0x128]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x12c]
cmp ebx, 0xffffffff
mov dword [ebp - 0x1c], eax
je 0x67c073
mov eax, dword [ebp - 8]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp dword [ebp - 0x38], edi
pop ecx
pop ecx
mov dword [ebp + 0x14], eax
je 0x67c073
cmp eax, edi
je 0x67c073
cmp dword [ebp - 8], edi
jbe 0x67c3a3
mov ecx, dword [ebp - 8]
mov edi, dword [ebp + 0x14]
mov eax, ebx
rep stosd dword es:[edi], eax
xor edi, edi
push dword [ebp - 8]
mov ecx, esi
push dword [ebp - 0x38]
call fcn.0055719a
mov ebx, eax
cmp ebx, edi
jl 0x67dbc4
mov edi, dword [ebp - 0x38]
xor eax, eax
push eax
push eax
push eax
push eax
push dword [ebp + 0x14]
mov eax, dword [ebp - 8]
push dword [ebp + 0x18]
and eax, 0xfffff
push edi
or eax, 0x23000000
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jge 0x67c3f6
push dword [ebp + 0x14]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x67dbc4
xor ecx, ecx
cmp dword [ebp - 8], ecx
jbe 0x67c41a
mov edx, dword [esi + 8]
mov edx, dword [edx + 0x1c]
mov eax, dword [edi + ecx*4]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 0x20]
or dword [eax], edx
mov edx, dword [ebp - 0x1c]
or dword [eax + 4], edx
inc ecx
cmp ecx, dword [ebp - 8]
jb 0x67c3fd
push dword [ebp + 0x14]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp - 0x30]
and ecx, 0xfff00000
cmp ecx, 0x21700000
jne 0x67c7b2
mov eax, dword [esi + 8]
test byte [eax + 0x94], 0x40
jne 0x67c7b2
mov edi, dword [ebp + 0xc]
and edi, 0xfffff
mov eax, edi
imul eax, eax, 0xc
push eax
mov ecx, esi
mov dword [ebp - 0xc], edi
call fcn.00679900
xor ebx, ebx
cmp eax, ebx
mov dword [ebp + 0x14], eax
je 0x67c073
mov ecx, dword [esi + 8]
push 8
push ebx
push ebx
push 0x80000000
push ebx
push ebx
push dword [ecx + 0x2a54]
call fcn.006b57cb
cmp eax, 0xffffffff
mov dword [ebp + 0x20], eax
je 0x67c073
mov edx, dword [ebp + 0x14]
mov ecx, edi
xor eax, eax
shl ecx, 2
mov dword [ebp + eax*4 - 0x6c], edx
inc eax
add edx, ecx
cmp eax, 0xc
jb 0x67c4a0
cmp edi, ebx
mov edx, dword [ebp - 0x68]
mov dword [ebp + 0xc], 1
jbe 0x67c537
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x6c]
sub eax, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
sub eax, edx
mov dword [ebp + 0x24], eax
mov eax, dword [ebp - 0x10]
sub ecx, edx
sub eax, edx
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x28], ecx
mov dword [ebp + 0x18], edi
mov eax, 0x800
jmp 0x67c4e7
mov ecx, dword [ebp + 0x28]
mov edi, dword [ebp + 0x24]
add edi, edx
mov ebx, dword [edi]
mov dword [ecx + edx], ebx
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx + edx]
mov ebx, dword [ebp - 0x2c]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x20]
mov dword [ebx + edx], ecx
mov ecx, dword [esi + 8]
mov ebx, dword [ecx + 0x1c]
mov ecx, dword [edi]
mov ecx, dword [ebx + ecx*4]
mov ecx, dword [ecx]
and ecx, eax
xor edi, edi
or ecx, edi
je 0x67c528
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx + edx]
mov ebx, dword [ebx + ecx*4]
mov ecx, dword [ebx]
and ecx, eax
or ecx, edi
jne 0x67c52c
and dword [ebp + 0xc], 0
add edx, 4
dec dword [ebp + 0x18]
jne 0x67c4e4
mov edi, dword [ebp - 0xc]
push edi
push dword [ebp - 0x60]
mov ecx, esi
call fcn.0055719a
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
push edi
push dword [ebp - 0x5c]
mov ecx, esi
call fcn.0055719a
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
push edi
push dword [ebp - 0x58]
mov ecx, esi
call fcn.0055719a
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
push edi
push dword [ebp - 0x54]
mov ecx, esi
call fcn.0055719a
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
push edi
push dword [ebp - 0x50]
mov ecx, esi
call fcn.0055719a
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
push edi
push dword [ebp - 0x4c]
mov ecx, esi
call fcn.0055719a
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
push edi
push dword [ebp - 0x48]
mov ecx, esi
call fcn.0055719a
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
push edi
push dword [ebp - 0x44]
mov ecx, esi
call fcn.0055719a
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
push edi
push dword [ebp - 0x40]
mov ecx, esi
call fcn.0055719a
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp - 0x6c]
and edi, 0xfffff
push dword [ebp - 0x60]
mov dword [ebp + 0x14], edi
or dword [ebp + 0x14], 0x12000000
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp - 0x68]
mov ecx, esi
push dword [ebp - 0x5c]
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push eax
push eax
push dword [ebp - 0x68]
mov eax, edi
push dword [ebp - 0x6c]
or eax, 0x23300000
push dword [ebp - 0x58]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push 8
push eax
push dword [ebp - 0x6c]
mov dword [ebp + 0x18], edi
push dword [ebp - 0x60]
or dword [ebp + 0x18], 0x21e00000
push dword [ebp - 0x54]
mov ecx, esi
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push 8
push eax
push dword [ebp - 0x68]
mov ecx, esi
push dword [ebp - 0x5c]
push dword [ebp - 0x50]
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push eax
push eax
push dword [ebp - 0x50]
mov eax, edi
push dword [ebp - 0x54]
or eax, 0x21a00000
push dword [ebp - 0x48]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp - 0x48]
mov ecx, esi
push dword [ebp - 0x4c]
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push eax
push eax
push dword [ebp - 0x64]
mov eax, edi
push dword [ebp - 0x58]
or eax, 0x23000000
push dword [ebp - 0x44]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp - 0x44]
mov eax, edi
push dword [ebp - 0x40]
or eax, 0x13600000
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push 0x10
push eax
push dword [ebp - 0x4c]
or edi, 0x30100000
push dword [ebp - 0x40]
mov ecx, esi
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
jne 0x67dbc4
push 0x441f00
jmp 0x67cafa
cmp ecx, 0x21800000
jne 0x67cb10
mov eax, dword [esi + 8]
test byte [eax + 0x94], 0x40
jne 0x67cb10
mov edi, dword [ebp + 0xc]
and edi, 0xfffff
mov eax, edi
imul eax, eax, 0xb
push eax
mov ecx, esi
mov dword [ebp - 0xc], edi
call fcn.00679900
xor ebx, ebx
cmp eax, ebx
mov dword [ebp + 0x14], eax
je 0x67c073
mov ecx, dword [esi + 8]
push 8
push ebx
push ebx
push 0x80000000
push ebx
push ebx
push dword [ecx + 0x2a54]
call fcn.006b57cb
cmp eax, 0xffffffff
mov dword [ebp - 0x2c], eax
je 0x67c073
mov edx, dword [ebp + 0x14]
mov ecx, edi
xor eax, eax
shl ecx, 2
mov dword [ebp + eax*4 - 0x68], edx
inc eax
add edx, ecx
cmp eax, 0xb
jb 0x67c823
cmp edi, ebx
mov edx, dword [ebp - 0x64]
mov dword [ebp + 0xc], 1
jbe 0x67c8c4
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x68]
mov ebx, dword [ebp - 0x10]
sub eax, edx
mov dword [ebp + 0x20], eax
mov eax, dword [ebp - 4]
sub eax, edx
sub ecx, edx
sub ebx, edx
mov dword [ebp + 0x24], eax
mov dword [ebp + 0x28], ecx
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], edi
mov eax, 0x800
jmp 0x67c871
mov ecx, dword [ebp + 0x28]
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x24]
add edi, edx
mov dword [ebp - 0x10], edi
mov edi, dword [edi]
mov dword [ecx + edx], edi
mov ecx, dword [ebx + edx]
mov edi, dword [ebp - 0x2c]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x20]
mov dword [ecx + edx], edi
mov ecx, dword [esi + 8]
mov ebx, dword [ecx + 0x1c]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov ecx, dword [ebx + ecx*4]
mov ecx, dword [ecx]
and ecx, eax
xor edi, edi
or ecx, edi
je 0x67c8b5
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx + edx]
mov ebx, dword [ebx + ecx*4]
mov ecx, dword [ebx]
and ecx, eax
or ecx, edi
jne 0x67c8b9
and dword [ebp + 0xc], 0
add edx, 4
dec dword [ebp + 0x18]
jne 0x67c86b
mov edi, dword [ebp - 0xc]
push edi
push dword [ebp - 0x5c]
mov ecx, esi
call fcn.0055719a
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
push edi
push dword [ebp - 0x58]
mov ecx, esi
call fcn.0055719a
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
push edi
push dword [ebp - 0x54]
mov ecx, esi
call fcn.0055719a
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
push edi
push dword [ebp - 0x50]
mov ecx, esi
call fcn.0055719a
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
push edi
push dword [ebp - 0x4c]
mov ecx, esi
call fcn.0055719a
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
push edi
push dword [ebp - 0x48]
mov ecx, esi
call fcn.0055719a
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
push edi
push dword [ebp - 0x44]
mov ecx, esi
call fcn.0055719a
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
push edi
push dword [ebp - 0x40]
mov ecx, esi
call fcn.0055719a
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp - 0x68]
and edi, 0xfffff
push dword [ebp - 0x5c]
mov dword [ebp + 0x14], edi
or dword [ebp + 0x14], 0x12000000
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp - 0x64]
mov ecx, esi
push dword [ebp - 0x58]
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push eax
push eax
push dword [ebp - 0x60]
mov eax, edi
push dword [ebp - 0x68]
or eax, 0x23000000
push dword [ebp - 0x54]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push 8
push eax
push dword [ebp - 0x68]
mov dword [ebp + 0x18], edi
push dword [ebp - 0x5c]
or dword [ebp + 0x18], 0x21e00000
push dword [ebp - 0x50]
mov ecx, esi
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push 8
push eax
push dword [ebp - 0x64]
mov ecx, esi
push dword [ebp - 0x58]
push dword [ebp - 0x4c]
push dword [ebp + 0x18]
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push eax
push eax
push dword [ebp - 0x4c]
mov eax, edi
push dword [ebp - 0x50]
or eax, 0x21b00000
push dword [ebp - 0x44]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp - 0x44]
mov ecx, esi
push dword [ebp - 0x48]
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp - 0x54]
mov eax, edi
push dword [ebp - 0x40]
or eax, 0x13600000
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push 0x10
push eax
push dword [ebp - 0x48]
or edi, 0x30100000
push dword [ebp - 0x40]
mov ecx, esi
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
jne 0x67dbc4
push 0x441eb8
push 0xde4
push dword [ebp + 8]
push esi
call fcn.0067b049
add esp, 0x10
jmp 0x67dbc4
mov eax, dword [ebp + 0xc]
push 0xffffffffffffffff
and eax, 0xfffff
or eax, ecx
mov ecx, dword [esi + 8]
push 0xffffffffffffffff
push eax
call fcn.006b5848
mov ecx, dword [esi + 8]
cmp eax, dword [ecx + 0x10]
mov dword [ebp - 0x30], eax
jae 0x67cb3a
mov ecx, dword [ecx + 0x20]
mov edi, dword [ecx + eax*4]
jmp 0x67cb3c
xor edi, edi
xor ebx, ebx
cmp edi, ebx
je 0x67c073
mov ecx, dword [ebp + 0x28]
cmp ecx, ebx
je 0x67cb4f
mov dword [ecx], eax
cmp dword [edi + 0xc], ebx
jne 0x67cb60
cmp dword [edi + 4], ebx
jne 0x67cb60
mov dword [edi], ebx
jmp 0x67dbc4
xor ebx, ebx
push ebx
push ebx
mov ecx, edi
call fcn.006b7b7b
push ebx
push ebx
mov ecx, edi
mov dword [ebp + 0x14], eax
call fcn.006b5e80
mov ebx, dword [edi + 4]
sub ebx, eax
test eax, eax
je 0x67cb86
cmp dword [ebp - 4], 0
je 0x67cb90
test ebx, ebx
je 0x67cb9a
cmp dword [ebp - 0x10], 0
jne 0x67cb9a
mov ebx, 0x80004005
jmp 0x67dbc4
shl eax, 2
push eax
push dword [ebp - 4]
mov dword [ebp + 0x18], eax
push dword [edi + 8]
call sub.msvcrt.dll_memcpy
mov eax, ebx
shl eax, 2
push eax
mov eax, dword [edi + 8]
add eax, dword [ebp + 0x18]
push dword [ebp - 0x10]
push eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [edi]
mov eax, dword [edi + 4]
and ecx, 0xfffff
xor edx, edx
div ecx
and dword [ebp - 4], 0
add esp, 0x18
mov dword [ebp - 0x10], ecx
test eax, eax
mov dword [ebp - 0xc], eax
jbe 0x67cd8b
and dword [ebp + 0xc], 0
xor edx, edx
inc edx
test ecx, ecx
jbe 0x67cc74
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x28], ecx
mov ecx, dword [ebp + 0x18]
mov eax, dword [edi + 8]
mov eax, dword [ecx + eax]
mov ecx, dword [esi + 8]
cmp eax, dword [ecx + 0xc]
jae 0x67cc16
mov ecx, dword [ecx + 0x1c]
mov ecx, dword [ecx + eax*4]
jmp 0x67cc18
xor ecx, ecx
inc dword [ecx + 0x54]
test edx, edx
je 0x67cc5e
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x18]
mov edx, dword [ecx + 8]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 8]
and eax, 0x100
xor ebx, ebx
or eax, ebx
jne 0x67cc44
mov eax, dword [esi + 8]
cmp edx, dword [eax + 0x2a6c]
jne 0x67cc5e
mov eax, dword [ecx]
and eax, 0x800
xor ecx, ecx
or eax, ecx
je 0x67cc5e
cmp dword [esi + 0xdc], ecx
jne 0x67cc5e
xor edx, edx
inc edx
jmp 0x67cc60
xor edx, edx
add dword [ebp + 0x18], 4
dec dword [ebp + 0x28]
jne 0x67cbfd
test edx, edx
je 0x67cd71
mov ecx, dword [ebp - 0x10]
and dword [ebp + 0x28], 0
test ecx, ecx
jbe 0x67cd71
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x18], eax
mov eax, dword [edi + 8]
mov ecx, dword [ebp + 0x18]
mov ecx, dword [ecx + eax]
mov eax, dword [esi + 8]
cmp ecx, dword [eax + 0xc]
jae 0x67cc9f
mov edx, dword [eax + 0x1c]
mov ebx, dword [edx + ecx*4]
jmp 0x67cca1
xor ebx, ebx
mov ecx, dword [ebx + 8]
cmp ecx, dword [eax + 0x2a6c]
jne 0x67cd5e
lea eax, [ebp - 0x44]
push eax
mov ecx, ebx
call fcn.006b8498
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov ecx, dword [esi + 8]
and eax, 0x80000000
and edx, 0x1ff
push edx
or eax, 0x7800
push eax
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 0
push 0
push dword [ecx + 0x2a54]
call fcn.006b57cb
mov ecx, dword [ebp + 0x18]
mov edx, dword [edi + 8]
mov dword [ecx + edx], eax
mov eax, dword [edi + 8]
mov eax, dword [ecx + eax]
cmp eax, 0xffffffff
je 0x67cdc7
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 0x1c]
mov eax, dword [ecx + eax*4]
and dword [eax], 0x7fffffff
and dword [eax + 4], 0xfffffe00
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
and ecx, 0x80000000
or dword [eax], ecx
mov ecx, dword [ebp + 0x18]
and edx, 0x1ff
or dword [eax + 4], edx
mov eax, dword [edi + 8]
mov eax, dword [eax + ecx]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 0x1c]
mov ecx, dword [ecx + eax*4]
push ebx
call fcn.006b863e
mov eax, dword [edi + 8]
mov ecx, dword [ebp + 0x18]
mov eax, dword [eax + ecx]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 0x1c]
mov eax, dword [ecx + eax*4]
mov ecx, dword [ebx + 0x28]
mov dword [eax + 0x28], ecx
inc dword [ebp + 0x28]
mov eax, dword [ebp + 0x28]
add dword [ebp + 0x18], 4
cmp eax, dword [ebp - 0x10]
jb 0x67cc86
mov ecx, dword [ebp - 0x10]
inc dword [ebp - 4]
mov eax, ecx
shl eax, 2
add dword [ebp + 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jb 0x67cbe9
mov eax, dword [ebp + 0x14]
and dword [ebp + 0x18], 0
test eax, eax
jbe 0x67d2fd
shl eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp + 0x28], ebx
je 0x67cdde
mov ecx, dword [ebp + 0x18]
mov eax, dword [eax + ecx*4]
cmp eax, 0xffffffff
je 0x67cdde
mov ecx, dword [esi + 8]
cmp eax, dword [ecx + 0xc]
jae 0x67cdd1
mov ecx, dword [ecx + 0x1c]
mov eax, dword [ecx + eax*4]
jmp 0x67cdd3
mov eax, 0x8007000e
jmp 0x67dbe1
xor eax, eax
cmp eax, ebx
mov dword [ebp + 0x28], eax
je 0x67d507
mov eax, dword [edi]
and eax, 0xfff00000
cmp eax, 0x50400000
je 0x67cdf3
cmp eax, 0x50500000
jne 0x67ce2a
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
push ebx
lea eax, [ecx + eax*2]
mov ecx, dword [edi + 8]
push 0x200000
push dword [ecx + eax*4]
mov ecx, dword [esi + 8]
call fcn.006b5351
test eax, eax
je 0x67ce2a
mov ecx, dword [esi + 8]
fldz
push ebx
push ebx
push ecx
push ecx
fstp qword [esp]
push ebx
push ebx
push dword [ecx + 0x2aa8]
jmp 0x67ce8f
mov eax, dword [edi]
and eax, 0xfff00000
cmp eax, 0x11100000
je 0x67ce4a
cmp eax, 0x24200000
je 0x67ce4a
mov ecx, edi
call fcn.006b6510
test eax, eax
je 0x67ce7b
mov eax, dword [edi + 8]
mov ecx, dword [ebp + 0x18]
push ebx
push 0x200000
push dword [eax + ecx*4]
mov ecx, dword [esi + 8]
call fcn.006b5351
test eax, eax
je 0x67ce7b
mov ecx, dword [esi + 8]
fldz
push ebx
push ebx
push ecx
push ecx
fstp qword [esp]
push ebx
push ebx
push dword [ecx + 0x2aac]
jmp 0x67ce8f
mov ecx, dword [esi + 8]
fldz
push ebx
push ebx
push ecx
push ecx
fstp qword [esp]
push ebx
push ebx
push dword [ecx + 0x2a6c]
call fcn.006b574c
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
je 0x67c073
mov eax, dword [esi + 8]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax + 0xc]
jae 0x67ceb3
mov eax, dword [eax + 0x1c]
mov ebx, dword [eax + ecx*4]
jmp 0x67ceb5
xor ebx, ebx
test ebx, ebx
je 0x67c073
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp + 0x20]
mov dword [ebx + 0x40], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebx], eax
mov ecx, edx
and eax, 0x80000000
and ecx, 0x1c1ff
or eax, ecx
mov dword [ebx + 4], edx
jne 0x67d193
mov eax, dword [esi + 8]
test dword [eax + 0x98], 0x200000
je 0x67d17d
mov eax, dword [edi]
and eax, 0xfff00000
cmp eax, 0x6b500000
je 0x67d16a
cmp eax, 0x6b900000
je 0x67d16a
cmp eax, 0x6bc00000
je 0x67d16a
cmp eax, 0x6b700000
je 0x67d16a
cmp eax, 0x6ba00000
je 0x67d16a
mov ecx, edi
call fcn.006b6b48
test eax, eax
jne 0x67d16a
mov ecx, dword [edi]
mov eax, ecx
and eax, 0xfff00000
cmp eax, 0x6b600000
je 0x67d15a
cmp eax, 0x6b800000
je 0x67d15a
cmp eax, 0x6bb00000
je 0x67d15a
and ecx, 0xf0000000
cmp ecx, 0x60000000
je 0x67cf89
cmp ecx, 0xa0000000
jne 0x67cfab
cmp eax, 0x6a200000
je 0x67cfab
mov eax, dword [edi + 8]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 0x1c]
mov eax, dword [eax]
mov eax, dword [ecx + eax*4]
mov ecx, dword [eax]
and ecx, 0x80000014
jmp 0x67d051
cmp eax, 0x30100000
jne 0x67d001
mov eax, dword [edi + 8]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 0x1c]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + eax]
mov dword [ebp - 4], ecx
mov ecx, dword [ecx + edx*4]
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0x18]
lea ecx, [ecx + edx*2]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + eax*4]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
and eax, 0x80000000
and ecx, 0x1ff
mov edx, eax
or edx, ecx
jne 0x67d12c
mov eax, dword [ebp - 4]
jmp 0x67d049
cmp eax, 0x20700000
jne 0x67d060
mov eax, dword [edi + 8]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 0x1c]
mov edx, dword [ebp + 0x18]
mov edx, dword [eax + edx*4]
mov edx, dword [ecx + edx*4]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + eax]
mov eax, dword [ecx + eax*4]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
and eax, 0x80000000
and ecx, 0x1ff
mov edx, eax
or edx, ecx
jne 0x67d12c
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
and ecx, 0x80000000
mov eax, dword [eax + 4]
and eax, 0x1ff
or dword [ebx], ecx
jmp 0x67d178
cmp eax, 0x10000000
je 0x67d133
cmp eax, 0x11d00000
je 0x67d133
cmp eax, 0x11100000
je 0x67d133
cmp eax, 0x24200000
je 0x67d133
cmp eax, 0x11900000
je 0x67d133
cmp eax, 0x11c00000
je 0x67d133
cmp eax, 0x11400000
je 0x67d133
cmp eax, 0x50500000
je 0x67d133
cmp eax, 0x50400000
je 0x67d133
mov ecx, edi
call fcn.006b6629
test eax, eax
je 0x67d0d9
mov eax, dword [esi + 0x118]
or dword [ebx], eax
mov eax, dword [esi + 0x11c]
jmp 0x67d178
mov ecx, edi
call fcn.006b664a
test eax, eax
jne 0x67d15a
mov ecx, edi
call fcn.006b6596
test eax, eax
je 0x67d100
mov eax, dword [ebx + 4]
or dword [ebx], 0x80000000
mov dword [ebx + 4], eax
jmp 0x67d193
mov ecx, edi
call fcn.006b6601
test eax, eax
jne 0x67d16a
mov eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x1c]
je 0x67d11b
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
jmp 0x67d121
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
and eax, 0x80000000
and ecx, 0x1c1ff
or dword [ebx], eax
or dword [ebx + 4], ecx
jmp 0x67d193
mov ecx, dword [ebp + 0x18]
mov eax, dword [edi + 8]
mov eax, dword [eax + ecx*4]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 0x1c]
mov eax, dword [ecx + eax*4]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
and ecx, 0x80000000
and eax, 0x1c1ff
jmp 0x67d059
mov eax, dword [esi + 0x120]
or dword [ebx], eax
mov eax, dword [esi + 0x124]
jmp 0x67d178
mov eax, dword [esi + 0x128]
or dword [ebx], eax
mov eax, dword [esi + 0x12c]
or dword [ebx + 4], eax
jmp 0x67d193
mov eax, dword [esi + 0x128]
mov ecx, dword [esi + 0x12c]
or eax, dword [ebp + 0x1c]
or ecx, edx
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov eax, dword [esi + 0x90]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x94]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 8]
test dword [eax + 0x98], 0x40000000
je 0x67d220
mov ecx, edi
call fcn.006b6510
test eax, eax
je 0x67d1db
mov ecx, dword [ebp + 0x18]
mov eax, dword [edi + 8]
mov eax, dword [eax + ecx*4]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 0x1c]
mov eax, dword [ecx + eax*4]
cmp dword [eax + 8], 0
jne 0x67d1db
and dword [ebx + 8], 0
mov eax, dword [edi]
and eax, 0xfff00000
cmp eax, 0x30100000
jne 0x67d220
mov ecx, dword [esi + 8]
mov eax, dword [edi + 8]
mov ecx, dword [ecx + 0x1c]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + eax]
mov dword [ebp - 4], ecx
mov ecx, dword [ecx + edx*4]
cmp dword [ecx + 8], 0
jne 0x67d220
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
lea ecx, [edx + ecx*2]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + eax*4]
cmp dword [eax + 8], 0
jne 0x67d220
and dword [ebx + 8], 0
mov ecx, dword [ebp + 0x18]
mov edx, dword [edi + 0x10]
mov eax, dword [ebp + 0xc]
shl ecx, 2
mov dword [ecx + edx], eax
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x67d239
mov dword [ecx + edx], eax
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x67d26f
mov eax, dword [eax + 8]
mov edx, dword [esi + 8]
mov edx, dword [edx + 0x18]
mov eax, dword [edx + eax*4]
mov eax, dword [eax + 8]
and eax, 0x8000000
xor edx, edx
or eax, edx
mov eax, dword [ebp + 0x28]
jne 0x67d263
mov edx, dword [eax + 0x28]
mov dword [ebx + 0x28], edx
mov edx, dword [eax + 0x5c]
mov dword [ebx + 0x5c], edx
mov eax, dword [eax + 0x60]
mov dword [ebx + 0x60], eax
mov edx, dword [esi + 8]
mov edx, dword [edx + 0x18]
mov eax, dword [ebx + 8]
mov eax, dword [edx + eax*4]
mov edx, dword [ebx + 0x28]
cmp edx, 0xffffffff
mov dword [ebp + 0x28], eax
je 0x67d2ea
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x20]
cmp edx, eax
jb 0x67d297
add eax, 0xb
cmp edx, eax
jb 0x67d2ea
cmp dword [esi + 0xc0], 0
jne 0x67d2ea
mov eax, dword [edi + 0x10]
mov ecx, dword [ecx + eax]
mov edx, dword [esi + 0x18]
mov eax, dword [ebx + 0x28]
mov dword [edx + eax*4], ecx
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x40], eax
mov eax, ecx
and eax, 0x8200000
xor edx, edx
or eax, edx
jne 0x67d2ea
cmp dword [ebx + 0x5c], eax
jne 0x67d2ea
and ecx, 0x200000
or ecx, eax
jne 0x67d2ea
push dword [ebp + 0xc]
push 0x417b80
push ecx
push ecx
push esi
call fcn.0067afcf
add esp, 0x14
inc dword [ebp + 0x18]
mov eax, dword [ebp + 0x18]
add dword [ebp - 0x10], 4
cmp eax, dword [ebp + 0x14]
jb 0x67cda0
mov eax, dword [ebp + 8]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0xa0]
mov dword [edi + 0x3c], eax
mov eax, dword [ebp + 0x14]
xor ecx, ecx
push 0x40
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
xor ebx, ebx
cmp dword [ebp + 0x14], ebx
pop ecx
mov dword [ebp - 0x80], eax
jbe 0x67d34b
mov dword [ebp + 0x18], eax
push dword [ebp + 0x18]
mov eax, dword [edi + 0x10]
push dword [eax + ebx*4]
mov ecx, esi
call fcn.0067e786
add dword [ebp + 0x18], 0x40
inc ebx
cmp ebx, dword [ebp + 0x14]
jb 0x67d331
test byte [esi + 0x14], 4
jne 0x67d432
mov ecx, edi
call fcn.006b6661
test eax, eax
jne 0x67d432
xor ebx, ebx
cmp ebx, dword [ebp + 0x14]
jae 0x67d3a0
mov eax, dword [edi + 0x10]
mov ecx, dword [eax + ebx*4]
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax]
and eax, 0x8180
xor edx, edx
or eax, edx
jne 0x67d39d
lea eax, [ebp - 0x54]
push eax
push ecx
mov ecx, esi
call fcn.0067a283
test eax, eax
jl 0x67d39d
inc ebx
cmp ebx, dword [ebp + 0x14]
jb 0x67d36b
cmp ebx, dword [ebp + 0x14]
jne 0x67d432
mov eax, dword [ebp + 0x14]
and dword [ebp + 0x18], 0
and eax, 0xfffff
or eax, 0x10000000
cmp dword [ebp + 0x14], 0
mov dword [edi], eax
mov eax, dword [edi + 0xc]
mov dword [edi + 4], eax
jbe 0x67d432
mov eax, dword [edi + 0x10]
mov ecx, dword [ebp + 0x18]
mov eax, dword [eax + ecx*4]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 0x1c]
mov ebx, dword [ecx + eax*4]
lea eax, [ebp + 0x1c]
push eax
mov ecx, ebx
call fcn.006b8498
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov ecx, dword [esi + 8]
and eax, 0x80000000
and edx, 0x1ff
push edx
or eax, 0x800
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push 0
push 0
push dword [ecx + 0x2a54]
call fcn.006b57cb
mov ecx, dword [ebp + 0x18]
mov edx, dword [edi + 8]
mov dword [edx + ecx*4], eax
mov eax, dword [edi + 8]
cmp dword [eax + ecx*4], 0xffffffff
je 0x67c073
inc dword [ebp + 0x18]
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp + 0x14]
jb 0x67d3c5
mov eax, dword [edi]
mov ecx, eax
and ecx, 0xfff00000
mov edx, 0x11d00000
cmp ecx, edx
ja 0x67d661
je 0x67d521
cmp ecx, 0x10000000
je 0x67d521
cmp ecx, 0x11400000
je 0x67d477
cmp ecx, 0x11900000
je 0x67d477
cmp ecx, 0x11c00000
jne 0x67db43
and dword [ebp + 0x18], 0
cmp dword [ebp + 0x14], 0
jbe 0x67db43
mov eax, dword [ebp + 0x18]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 0x1c]
mov edx, dword [edi + 0x10]
shl eax, 2
mov edx, dword [eax + edx]
mov ebx, dword [ecx + edx*4]
mov edx, dword [edi + 8]
mov eax, dword [eax + edx]
mov ecx, dword [ecx + eax*4]
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
and eax, 0x7fffffff
or dword [ebx], eax
and edx, 0xfffffe00
or dword [ebx + 4], edx
mov eax, dword [ecx]
xor eax, dword [ebx]
mov dword [ebp + 0xc], ecx
mov ecx, dword [ecx + 4]
xor ecx, dword [ebx + 4]
and eax, 0x80000000
and ecx, 0x1ff
or eax, ecx
jne 0x67d4f7
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x7c]
push eax
call fcn.006b86cf
lea eax, [ebp - 0x7c]
push eax
mov ecx, ebx
call fcn.006b8291
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
and eax, 0x27f
or dword [ebx], eax
inc dword [ebp + 0x18]
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp + 0x14]
jb 0x67d485
jmp 0x67db43
push 0x417b58
push ebx
push ebx
push esi
call fcn.0067afcf
add esp, 0x10
mov eax, 0x80004005
jmp 0x67dbe1
and dword [ebp + 0xc], 0
cmp dword [ebp + 0x14], 0
jbe 0x67db43
mov edx, dword [ebp + 0xc]
mov ecx, dword [esi + 8]
mov ebx, dword [edi + 0x10]
mov eax, dword [ecx + 0x1c]
shl edx, 2
mov ebx, dword [edx + ebx]
mov ebx, dword [eax + ebx*4]
mov dword [ebp + 0x18], ebx
mov ebx, dword [edi + 8]
push 0
mov dword [ebp + 0x28], edx
mov edx, dword [edx + ebx]
mov ebx, dword [eax + edx*4]
push 0x80000000
push edx
call fcn.006b5351
test eax, eax
jne 0x67d64d
mov eax, dword [ebx]
mov ebx, dword [ebx + 4]
mov dword [ebp - 0x44], eax
mov ecx, ebx
mov edx, 0x92
and ecx, edx
xor eax, eax
or eax, ecx
je 0x67d588
and dword [ebp + 0x1c], 0
mov dword [ebp + 0x20], edx
jmp 0x67d5b9
mov ecx, ebx
and ecx, 0x49
xor eax, eax
or eax, ecx
je 0x67d5a0
and dword [ebp + 0x1c], 0
mov dword [ebp + 0x20], 0x49
jmp 0x67d5b9
mov eax, dword [ebp - 0x44]
and eax, 0x80000000
xor ecx, ecx
or eax, ecx
je 0x67d5de
mov dword [ebp + 0x1c], 0x80000000
and dword [ebp + 0x20], 0
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov ecx, dword [eax + 4]
mov ebx, ecx
and ebx, edx
xor eax, eax
or eax, ebx
jne 0x67d614
mov edx, ecx
and edx, 0x49
or eax, edx
je 0x67d5f3
push 0x49
xor eax, eax
pop edx
jmp 0x67d61c
mov ecx, 0x124
xor eax, eax
and dword [ebp + 0x1c], eax
and ebx, ecx
or eax, ebx
je 0x67d5b5
mov dword [ebp + 0x20], ecx
jmp 0x67d5b9
mov eax, dword [ebp - 0x20]
mov edx, 0x80000000
and eax, edx
xor ebx, ebx
or eax, ebx
je 0x67d607
mov eax, edx
jmp 0x67d61a
mov edx, 0x124
and ecx, edx
xor eax, eax
or eax, ecx
je 0x67d618
xor eax, eax
jmp 0x67d61c
xor eax, eax
xor edx, edx
cmp dword [ebp + 0x1c], eax
jne 0x67d626
cmp dword [ebp + 0x20], edx
je 0x67d63e
mov eax, dword [esi + 8]
test dword [eax + 0x98], 0x200000
je 0x67d63e
mov eax, dword [ebp + 0x18]
or dword [eax + 0x2c], 0xffffffff
jmp 0x67d64d
mov eax, dword [edi + 8]
mov ecx, dword [ebp + 0x28]
mov eax, dword [ecx + eax]
mov ecx, dword [ebp + 0x18]
mov dword [ecx + 0x2c], eax
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x14]
jb 0x67d52f
jmp 0x67db43
cmp ecx, 0x20700000
je 0x67dacc
cmp ecx, 0x30000000
je 0x67d8d8
cmp ecx, 0x30100000
je 0x67d70b
cmp ecx, 0x50000000
jne 0x67db43
mov ecx, dword [edi + 0x10]
mov edx, dword [esi + 8]
mov ecx, dword [ecx]
mov edx, dword [edx + 0x1c]
mov ecx, dword [edx + ecx*4]
and eax, 0xfffff
mov dword [ebp + 0x20], ecx
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x18], 0
jbe 0x67d6f1
mov ebx, dword [edi + 8]
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 0x1c]
mov dword [ebp + 0xc], ebx
lea ebx, [ebx + eax*4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov eax, dword [ecx + eax*4]
mov edx, dword [ebx]
mov eax, dword [eax]
mov edx, dword [ecx + edx*4]
and eax, dword [edx]
xor edx, edx
and eax, 2
or eax, edx
je 0x67d6ee
inc dword [ebp + 0x18]
mov eax, dword [ebp + 0x18]
add dword [ebp + 0xc], 4
add ebx, 4
cmp eax, dword [ebp + 0x28]
jb 0x67d6c2
mov ecx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x28]
cmp dword [ebp + 0x18], eax
jne 0x67db43
mov eax, dword [ecx + 4]
or dword [ecx], 2
mov dword [ecx + 4], eax
jmp 0x67db43
and dword [ebp + 0x18], 0
cmp dword [ebp + 0x14], 0
jbe 0x67db43
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 0x1c]
mov ebx, dword [ebp + 0x18]
mov ecx, dword [edi + 0x10]
mov eax, dword [edi]
shl ebx, 2
mov ecx, dword [ebx + ecx]
mov ecx, dword [edx + ecx*4]
mov dword [ebp + 0x28], ecx
mov ecx, dword [edi + 8]
mov ebx, dword [ebx + ecx]
mov ebx, dword [edx + ebx*4]
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp + 0x18]
and eax, 0xfffff
add ebx, eax
shl ebx, 2
mov dword [ebp - 0x10], ebx
mov ebx, dword [ecx + ebx]
mov ebx, dword [edx + ebx*4]
mov dword [ebp + 0x20], ebx
mov ebx, dword [ebp + 0x18]
lea ebx, [ebx + eax*2]
shl ebx, 2
mov eax, dword [ecx + ebx]
mov eax, dword [edx + eax*4]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ecx]
and eax, 0x800
xor edx, edx
or eax, edx
je 0x67d8bf
lea eax, [ebp - 0x20]
push eax
call fcn.006b8498
cmp dword [ebp - 0x20], 0
je 0x67d79e
mov ecx, dword [ebp + 0x20]
mov eax, dword [edi + 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + eax]
mov dword [ebp + 0xc], ecx
jmp 0x67d7ad
mov eax, dword [ebp - 4]
mov dword [ebp + 0xc], eax
mov eax, dword [edi + 8]
mov eax, dword [ebx + eax]
mov ecx, dword [ebp + 0xc]
mov dword [ebp + 0x20], eax
mov eax, dword [esi + 8]
test dword [eax + 0x98], 0x200000
je 0x67d8d3
mov edx, dword [ecx + 4]
mov ebx, dword [ecx]
mov ecx, edx
and ecx, 0x92
xor eax, eax
or eax, ecx
je 0x67d7e3
and dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0x92
jmp 0x67d828
mov ecx, edx
and ecx, 0x49
xor eax, eax
or eax, ecx
je 0x67d7fb
and dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0x49
jmp 0x67d828
mov eax, 0x80000000
and ebx, eax
xor ecx, ecx
or ebx, ecx
je 0x67d810
and dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
jmp 0x67d828
mov ebx, 0x124
and edx, ebx
xor ecx, ecx
xor eax, eax
or eax, edx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ebx
jne 0x67d828
mov dword [ebp - 0x40], ecx
mov ebx, dword [ebp + 0x28]
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [ebp - 0x28], eax
mov ecx, edx
and ecx, 0x92
xor eax, eax
or eax, ecx
je 0x67d84a
xor eax, eax
mov ecx, 0x92
jmp 0x67d886
mov ecx, edx
and ecx, 0x49
xor eax, eax
or eax, ecx
je 0x67d85c
push 0x49
xor eax, eax
pop ecx
jmp 0x67d886
mov eax, dword [ebp - 0x28]
and eax, 0x80000000
xor ecx, ecx
or eax, ecx
je 0x67d871
mov eax, 0x80000000
jmp 0x67d884
mov ecx, 0x124
and edx, ecx
xor eax, eax
or eax, edx
je 0x67d882
xor eax, eax
jmp 0x67d886
xor eax, eax
xor ecx, ecx
cmp dword [ebp - 0x44], eax
jne 0x67d8bf
cmp dword [ebp - 0x40], ecx
jne 0x67d8bf
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x2c], eax
lea eax, [ebp - 0xc0]
push eax
call fcn.006b86cf
lea eax, [ebp - 0xc0]
push eax
mov ecx, ebx
call fcn.006b8291
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
and eax, 0x27f
or dword [ebx], eax
inc dword [ebp + 0x18]
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp + 0x14]
jb 0x67d719
jmp 0x67db43
mov ebx, dword [ebp + 0x28]
jmp 0x67d893
and dword [ebp + 0x18], 0
cmp dword [ebp + 0x14], 0
jbe 0x67db43
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 0x1c]
mov ebx, dword [ebp + 0x18]
mov ecx, dword [edi + 0x10]
mov eax, dword [edi]
shl ebx, 2
mov ecx, dword [ecx + ebx]
mov ecx, dword [edx + ecx*4]
mov dword [ebp + 0x28], ecx
mov ecx, dword [edi + 8]
mov ebx, dword [ecx + ebx]
mov ebx, dword [edx + ebx*4]
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp + 0x18]
and eax, 0xfffff
add ebx, eax
shl ebx, 2
mov dword [ebp - 0x10], ebx
mov ebx, dword [ecx + ebx]
mov ebx, dword [edx + ebx*4]
mov dword [ebp + 0x20], ebx
mov ebx, dword [ebp + 0x18]
lea ebx, [ebx + eax*2]
shl ebx, 2
mov eax, dword [ecx + ebx]
mov eax, dword [edx + eax*4]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ecx]
and eax, 0x1000
xor edx, edx
or eax, edx
je 0x67dab6
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.006b83ea
fld qword [ebp - 0x20]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fldz
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 5
jp 0x67d981
mov ecx, dword [ebp + 0x20]
fstp st(0)
mov eax, dword [edi + 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + eax]
mov dword [ebp + 0xc], ecx
jmp 0x67d9a4
fld qword [ebp - 0x28]
fstp dword [ebp + 0xc]
fcomp dword [ebp + 0xc]
fnstsw ax
test ah, 0x41
jne 0x67dab6
mov eax, dword [ebp - 4]
mov dword [ebp + 0xc], eax
mov eax, dword [edi + 8]
mov eax, dword [ebx + eax]
mov ecx, dword [ebp + 0xc]
mov dword [ebp + 0x20], eax
mov eax, dword [esi + 8]
test dword [eax + 0x98], 0x200000
je 0x67dac7
mov edx, dword [ecx + 4]
mov ebx, dword [ecx]
mov ecx, edx
and ecx, 0x92
xor eax, eax
or eax, ecx
je 0x67d9da
and dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0x92
jmp 0x67da1f
mov ecx, edx
and ecx, 0x49
xor eax, eax
or eax, ecx
je 0x67d9f2
and dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0x49
jmp 0x67da1f
mov eax, 0x80000000
and ebx, eax
xor ecx, ecx
or ebx, ecx
je 0x67da07
and dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
jmp 0x67da1f
mov ebx, 0x124
and edx, ebx
xor ecx, ecx
xor eax, eax
or eax, edx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ebx
jne 0x67da1f
mov dword [ebp - 0x40], ecx
mov ebx, dword [ebp + 0x28]
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [ebp - 0x18], eax
mov ecx, edx
and ecx, 0x92
xor eax, eax
or eax, ecx
je 0x67da41
xor eax, eax
mov ecx, 0x92
jmp 0x67da7d
mov ecx, edx
and ecx, 0x49
xor eax, eax
or eax, ecx
je 0x67da53
push 0x49
xor eax, eax
pop ecx
jmp 0x67da7d
mov eax, dword [ebp - 0x18]
and eax, 0x80000000
xor ecx, ecx
or eax, ecx
je 0x67da68
mov eax, 0x80000000
jmp 0x67da7b
mov ecx, 0x124
and edx, ecx
xor eax, eax
or eax, edx
je 0x67da79
xor eax, eax
jmp 0x67da7d
xor eax, eax
xor ecx, ecx
cmp dword [ebp - 0x44], eax
jne 0x67dab6
cmp dword [ebp - 0x40], ecx
jne 0x67dab6
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x2c], eax
lea eax, [ebp - 0xc0]
push eax
call fcn.006b86cf
lea eax, [ebp - 0xc0]
push eax
mov ecx, ebx
call fcn.006b8291
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
and eax, 0x27f
or dword [ebx], eax
inc dword [ebp + 0x18]
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp + 0x14]
jb 0x67d8e6
jmp 0x67db43
mov ebx, dword [ebp + 0x28]
jmp 0x67da8a
and dword [ebp + 0x18], 0
cmp dword [ebp + 0x14], 0
jbe 0x67db43
mov edx, dword [ebp + 0x18]
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x1c]
mov ecx, dword [edi + 0x10]
mov ebx, dword [edi + 0xc]
add ebx, dword [ebp + 0x18]
shl edx, 2
mov ecx, dword [ecx + edx]
mov ecx, dword [eax + ecx*4]
mov dword [ebp + 0xc], ecx
mov ecx, dword [edi + 8]
mov edx, dword [ecx + edx]
mov edx, dword [eax + edx*4]
mov ecx, dword [ecx + ebx*4]
mov eax, dword [eax + ecx*4]
mov ecx, dword [edx]
and ecx, dword [eax]
mov edx, dword [edx + 4]
and edx, dword [eax + 4]
mov eax, ecx
mov dword [ebp + 0x20], edx
and eax, 1
xor edx, edx
or eax, edx
je 0x67db23
mov eax, dword [ebp + 0xc]
or dword [eax], 0x17
jmp 0x67db32
and ecx, 2
xor eax, eax
or ecx, eax
je 0x67db38
mov eax, dword [ebp + 0xc]
or dword [eax], 2
mov ecx, dword [eax + 4]
mov dword [eax + 4], ecx
inc dword [ebp + 0x18]
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp + 0x14]
jb 0x67dad6
cmp dword [ebp + 0x24], 0
je 0x67dbb3
cmp dword [ebp - 0x2c], 0xffffffff
je 0x67dbb3
push dword [ebp + 0x14]
mov ecx, esi
call fcn.00679900
push dword [ebp + 0x14]
mov ecx, esi
push eax
mov dword [ebp + 0x18], eax
call fcn.0055719a
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
mov eax, dword [ebp + 0x14]
xor eax, dword [ebp - 0x2c]
push dword [ebp + 0x10]
and eax, 0xfffff
push dword [ebp + 0x18]
xor eax, dword [ebp - 0x2c]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.0067b74b
mov ebx, eax
test ebx, ebx
jl 0x67dbc4
mov edx, dword [ebp + 0x14]
test edx, edx
jbe 0x67dbb3
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
sub ecx, eax
mov ebx, dword [ecx + eax]
mov dword [eax], ebx
add eax, 4
dec edx
jne 0x67dba8
mov eax, dword [ebp + 8]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0xa0]
mov dword [edi + 0x3c], eax
xor ebx, ebx
push dword [ebp - 0x80]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x38]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0x24