Function at 0x662114
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xe4
push 0
push 0
dec ecx
jne 0x66211c
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 0x290]
mov edx, dword [0x41b1d0]
call fcn.0040b2b0
lea edi, [ebp - 0x4c8]
xor eax, eax
push ebp
push 0x66470d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x294], 0x103
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x294]
call fcn.0040ac18
lea eax, [ebp - 0x294]
push eax
mov eax, dword [ebp - 8]
call fcn.0040aa84
push eax
call fcn.004138d4
push 0x8db49c
mov ecx, dword [ebp - 0x294]
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040aec0
lea edx, [ebp - 0x4d0]
xor eax, eax
call fcn.004072b0
mov eax, dword [ebp - 0x4d0]
lea edx, [ebp - 0x4cc]
call fcn.00423e4c
mov edx, dword [ebp - 0x4cc]
mov eax, 0x8db70c
call fcn.0040a10c
push 0x208
push edi
call fcn.00413d08
lea eax, [ebp - 0x4d4]
mov edx, edi
mov ecx, 0x104
call fcn.0040ab40
mov eax, dword [ebp - 0x4d4]
lea edx, [ebp - 4]
call fcn.00423eb0
mov eax, 0x8db4e0
mov edx, edi
mov ecx, 0x104
call fcn.0040ab40
lea edx, [ebp - 0x4d8]
mov eax, dword [0x8db4e0]
call fcn.0042a550
mov edx, dword [ebp - 0x4d8]
mov eax, 0x8db4e0
call fcn.0040a10c
push 0x208
push edi
call fcn.00413c48
mov eax, 0x8db4e4
mov edx, edi
mov ecx, 0x104
call fcn.0040ab40
lea edx, [ebp - 0x4dc]
mov eax, dword [0x8db4e4]
call fcn.0042a550
mov edx, dword [ebp - 0x4dc]
mov eax, 0x8db4e4
call fcn.0040a10c
push edi
push 0
push 0
push 0x1a
push 0
call fcn.00535794
mov eax, 0x8db4ec
mov edx, edi
mov ecx, 0x104
call fcn.0040ab40
push edi
push 0
push 0
push 0x1c
push 0
call fcn.00535794
mov eax, 0x8db4f0
mov edx, edi
mov ecx, 0x104
call fcn.0040ab40
push edi
push 0
push 0
push 0x26
push 0
call fcn.00535794
mov eax, 0x8db4f4
mov edx, edi
mov ecx, 0x104
call fcn.0040ab40
push edi
push 0
push 0
push 0x2b
push 0
call fcn.00535794
mov eax, 0x8db4f8
mov edx, edi
mov ecx, 0x104
call fcn.0040ab40
push edi
push 0
push 0
push 5
push 0
call fcn.00535794
mov eax, 0x8db508
mov edx, edi
mov ecx, 0x104
call fcn.0040ab40
push edi
push 0
push 0
push 8
push 0
call fcn.00535794
mov eax, 0x8db500
mov edx, edi
mov ecx, 0x104
call fcn.0040ab40
lea edx, [ebp - 0x4e0]
mov eax, dword [0x8db4ec]
call fcn.0042a550
mov edx, dword [ebp - 0x4e0]
mov eax, 0x8db4ec
call fcn.0040a10c
lea edx, [ebp - 0x4e4]
mov eax, dword [0x8db4f0]
call fcn.0042a550
mov edx, dword [ebp - 0x4e4]
mov eax, 0x8db4f0
call fcn.0040a10c
lea edx, [ebp - 0x4e8]
mov eax, dword [0x8db4f4]
call fcn.0042a550
mov edx, dword [ebp - 0x4e8]
mov eax, 0x8db4f4
call fcn.0040a10c
lea edx, [ebp - 0x4ec]
mov eax, dword [0x8db4f8]
call fcn.0042a550
mov edx, dword [ebp - 0x4ec]
mov eax, 0x8db4f8
call fcn.0040a10c
lea edx, [ebp - 0x4f0]
mov eax, dword [0x8db508]
call fcn.0042a550
mov edx, dword [ebp - 0x4f0]
mov eax, 0x8db508
call fcn.0040a10c
lea edx, [ebp - 0x4f4]
mov eax, dword [0x8db500]
call fcn.0042a550
mov edx, dword [ebp - 0x4f4]
mov eax, 0x8db500
call fcn.0040a10c
mov eax, 0x8db504
mov ecx, 0x664728
mov edx, dword [0x8db4ec]
call fcn.0040acf0
cmp dword [0x8db4d8], 5
jne 0x66240f
push dword [ebp - 4]
push 0x664768
push dword [0x8db49c]
mov eax, 0x8db4e8
mov edx, 3
call fcn.0040ad78
jmp 0x66242c
push dword [ebp - 4]
push 0x6647a8
push dword [0x8db49c]
mov eax, 0x8db4e8
mov edx, 3
call fcn.0040ad78
lea edx, [ebp - 0x4f8]
mov eax, dword [0x8db4e8]
call fcn.0042a550
mov edx, dword [ebp - 0x4f8]
mov eax, 0x8db4e8
call fcn.0040a10c
lea edx, [ebp - 0x4fc]
mov eax, dword [0x8db4f4]
call fcn.004221d0
mov edx, dword [ebp - 0x4fc]
mov ecx, 1
mov eax, 0x6647c4
call fcn.0040b0d0
test eax, eax
jle 0x66247e
mov byte [0x8db4dc], 1
jmp 0x662485
mov byte [0x8db4dc], 0
push edi
push 0
push 0
push 0x10
push 0
call fcn.00535794
mov eax, 0x8db4fc
mov edx, edi
mov ecx, 0x104
call fcn.0040ab40
lea edx, [ebp - 0x500]
mov eax, dword [0x8db4fc]
call fcn.0042254c
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x2b0]
test eax, eax
je 0x6624cf
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x6624fe
lea eax, [ebp - 0x504]
push eax
mov ecx, 0x6647dc
mov edx, 0x6647f8
mov eax, 0x80000001
call fcn.005d4440
mov edx, dword [ebp - 0x504]
mov eax, 0x8db4fc
call fcn.0040a10c
lea edx, [ebp - 0x508]
mov eax, dword [0x8db4fc]
call fcn.0042254c
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
test eax, eax
je 0x662529
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x662542
mov eax, 0x8db4fc
mov ecx, 0x664888
mov edx, dword [0x8db4e8]
call fcn.0040acf0
lea edx, [ebp - 0x50c]
mov eax, dword [0x8db4fc]
call fcn.0042a550
mov edx, dword [ebp - 0x50c]
mov eax, 0x8db4fc
call fcn.0040a10c
mov ecx, 1
mov edx, dword [0x8db4fc]
mov eax, dword [ebp - 4]
call fcn.0040b0d0
dec eax
je 0x66258b
mov eax, 0x8db4fc
mov ecx, dword [0x8db4fc]
mov edx, dword [ebp - 4]
call fcn.0040acf0
push edi
push 0
push 0
push 7
push 0
call fcn.00535794
mov eax, 0x8db514
mov edx, edi
mov ecx, 0x104
call fcn.0040ab40
mov eax, dword [0x8db514]
test eax, eax
je 0x6625b8
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x6625e7
lea eax, [ebp - 0x510]
push eax
mov ecx, 0x6648a8
mov edx, 0x6647f8
mov eax, 0x80000001
call fcn.005d4440
mov edx, dword [ebp - 0x510]
mov eax, 0x8db514
call fcn.0040a10c
mov eax, dword [0x8db514]
test eax, eax
je 0x6625f5
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x662624
lea eax, [ebp - 0x514]
push eax
mov ecx, 0x6648c4
mov edx, 0x6647f8
mov eax, 0x80000001
call fcn.005d4440
mov edx, dword [ebp - 0x514]
mov eax, 0x8db514
call fcn.0040a10c
push edi
push 0
push 0
push 0x18
push 0
call fcn.00535794
mov eax, 0x8db518
mov edx, edi
mov ecx, 0x104
call fcn.0040ab40
mov eax, dword [0x8db518]
test eax, eax
je 0x662651
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x662680
lea eax, [ebp - 0x518]
push eax
mov ecx, 0x6648a8
mov edx, 0x6647f8
mov eax, 0x80000002
call fcn.005d4440
mov edx, dword [ebp - 0x518]
mov eax, 0x8db518
call fcn.0040a10c
mov eax, dword [0x8db518]
test eax, eax
je 0x66268e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x6626bd
lea eax, [ebp - 0x51c]
push eax
mov ecx, 0x6648e8
mov edx, 0x6647f8
mov eax, 0x80000002
call fcn.005d4440
mov edx, dword [ebp - 0x51c]
mov eax, 0x8db518
call fcn.0040a10c
lea edx, [ebp - 0x520]
mov eax, dword [0x8db514]
call fcn.0042a550
mov edx, dword [ebp - 0x520]
mov eax, 0x8db514
call fcn.0040a10c
lea edx, [ebp - 0x524]
mov eax, dword [0x8db518]
call fcn.0042a550
mov edx, dword [ebp - 0x524]
mov eax, 0x8db518
call fcn.0040a10c
push edi
push 0
push 0
push 0xb
push 0
call fcn.00535794
mov eax, 0x8db51c
mov edx, edi
mov ecx, 0x104
call fcn.0040ab40
lea edx, [ebp - 0x528]
mov eax, dword [0x8db51c]
call fcn.0042a550
mov edx, dword [ebp - 0x528]
mov eax, 0x8db51c
call fcn.0040a10c
push edi
push 0
push 0
push 0x16
push 0
call fcn.00535794
mov eax, 0x8db520
mov edx, edi
mov ecx, 0x104
call fcn.0040ab40
lea edx, [ebp - 0x52c]
mov eax, dword [0x8db520]
call fcn.0042a550
mov edx, dword [ebp - 0x52c]
mov eax, 0x8db520
call fcn.0040a10c
push edi
push 0
push 0
push 2
push 0
call fcn.00535794
mov eax, 0x8db50c
mov edx, edi
mov ecx, 0x104
call fcn.0040ab40
lea edx, [ebp - 0x530]
mov eax, dword [0x8db50c]
call fcn.0042a550
mov edx, dword [ebp - 0x530]
mov eax, 0x8db50c
call fcn.0040a10c
push edi
push 0
push 0
push 0x17
push 0
call fcn.00535794
mov eax, 0x8db510
mov edx, edi
mov ecx, 0x104
call fcn.0040ab40
lea edx, [ebp - 0x534]
mov eax, dword [0x8db510]
call fcn.0042a550
mov edx, dword [ebp - 0x534]
mov eax, 0x8db510
call fcn.0040a10c
push dword [0x8db4ec]
push 0x664914
push 0x66493c
mov eax, 0x8db710
mov edx, 3
call fcn.0040ad78
push dword [0x8db4ec]
push 0x664914
push 0x664954
mov eax, 0x8db714
mov edx, 3
call fcn.0040ad78
lea eax, [ebp - 8]
mov edx, 0x66496c
call fcn.0040a154
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.004238d8
test al, al
je 0x662866
mov eax, 0x8db718
mov ecx, 0x664914
mov edx, dword [ebp - 8]
call fcn.0040acf0
jmp 0x66287b
mov eax, 0x8db718
mov ecx, 0x664914
mov edx, dword [0x8db508]
call fcn.0040acf0
mov eax, 0x8db720
mov ecx, 0x664998
mov edx, dword [0x8db4fc]
call fcn.0040acf0
push dword [0x8db4ec]
push 0x664914
push 0x6649c4
mov eax, 0x8db71c
mov edx, 3
call fcn.0040ad78
mov eax, dword [0x8db71c]
push eax
mov ecx, 0x6649e0
mov edx, 0x664a00
mov eax, 0x80000001
call fcn.005d494c
mov eax, 0x8db730
mov edx, 0x664a3c
call fcn.0040a10c
mov dl, 1
mov eax, dword [0x8db710]
call fcn.004238d8
test al, al
jne 0x6628f2
mov eax, dword [0x8db710]
call fcn.004239b8
mov dl, 1
mov eax, dword [0x8db714]
call fcn.004238d8
test al, al
jne 0x66290c
mov eax, dword [0x8db714]
call fcn.004239b8
mov dl, 1
mov eax, dword [0x8db71c]
call fcn.004238d8
test al, al
jne 0x662926
mov eax, dword [0x8db71c]
call fcn.004239b8
mov dl, 1
mov eax, dword [0x8db718]
call fcn.004238d8
test al, al
jne 0x662940
mov eax, dword [0x8db718]
call fcn.004239b8
mov ecx, 0x664a74
mov edx, 0x664a00
mov eax, 0x80000001
call fcn.005d4548
cmp edx, 0
jne 0x6629f6
cmp eax, 1
jne 0x6629f6
lea eax, [ebp - 0x538]
mov ecx, 0x664a94
mov edx, dword [0x8db71c]
call fcn.0040acf0
mov eax, dword [ebp - 0x538]
mov dl, 1
call fcn.00423840
test al, al
je 0x6629ae
lea eax, [ebp - 0x53c]
mov ecx, 0x664a94
mov edx, dword [0x8db71c]
call fcn.0040acf0
mov eax, dword [ebp - 0x53c]
call fcn.00423cc8
lea eax, [ebp - 0x540]
mov ecx, 0x664abc
mov edx, dword [0x8db71c]
call fcn.0040acf0
mov eax, dword [ebp - 0x540]
mov dl, 1
call fcn.00423840
test al, al
je 0x6629f6
lea eax, [ebp - 0x544]
mov ecx, 0x664abc
mov edx, dword [0x8db71c]
call fcn.0040acf0
mov eax, dword [ebp - 0x544]
call fcn.00423cc8
push edi
push 0
push 0
push 0x20
push 0
call fcn.00535794
lea eax, [ebp - 0x548]
mov edx, edi
mov ecx, 0x104
call fcn.0040ab40
mov eax, dword [ebp - 0x548]
lea edx, [ebp - 8]
call fcn.0042a550
lea eax, [ebp - 0x54c]
mov ecx, dword [ebp - 8]
mov edx, 0x664ae4
call fcn.0040acf0
mov edx, dword [ebp - 0x54c]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x664ae4
push dword [0x8db4f0]
push 0x664afc
lea eax, [ebp - 0x550]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x550]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x664ae4
push dword [0x8db4f0]
push 0x664b44
lea eax, [ebp - 0x554]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x554]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x664ae4
push dword [0x8db4f0]
push 0x664bac
lea eax, [ebp - 0x558]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x558]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x664ae4
push dword [0x8db4f0]
push 0x664c1c
lea eax, [ebp - 0x55c]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x55c]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x664ae4
push dword [0x8db4f0]
push 0x664c98
lea eax, [ebp - 0x560]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x560]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x664ae4
push dword [0x8db4e8]
push 0x664cd4
lea eax, [ebp - 0x564]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x564]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push edi
push 0
push 0
push 0x22
push 0
call fcn.00535794
lea eax, [ebp - 0x568]
mov edx, edi
mov ecx, 0x104
call fcn.0040ab40
mov eax, dword [ebp - 0x568]
lea edx, [ebp - 8]
call fcn.0042a550
lea eax, [ebp - 0x56c]
mov ecx, dword [ebp - 8]
mov edx, 0x664ae4
call fcn.0040acf0
mov edx, dword [ebp - 0x56c]
mov eax, dword [0x8db700]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push edi
push 0
push 0
push 0x21
push 0
call fcn.00535794
lea eax, [ebp - 0x570]
mov edx, edi
mov ecx, 0x104
call fcn.0040ab40
mov eax, dword [ebp - 0x570]
lea edx, [ebp - 8]
call fcn.0042a550
lea eax, [ebp - 0x574]
mov ecx, 0x664d3c
mov edx, dword [ebp - 8]
call fcn.0040acf0
mov eax, dword [ebp - 0x574]
mov dl, 1
call fcn.004238d8
test al, al
je 0x662c17
lea eax, [ebp - 8]
mov edx, 0x664d50
call fcn.0040ac98
lea eax, [ebp - 0x578]
mov ecx, dword [ebp - 8]
mov edx, 0x664ae4
call fcn.0040acf0
mov edx, dword [ebp - 0x578]
mov eax, dword [0x8db704]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x664ae4
push dword [0x8db4e8]
push 0x664d68
lea eax, [ebp - 0x57c]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x57c]
mov eax, dword [0x8db704]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x664ae4
push dword [0x8db4e8]
push 0x664ddc
lea eax, [ebp - 0x580]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x580]
mov eax, dword [0x8db704]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x664ae4
push dword [0x8db4f0]
push 0x664e58
lea eax, [ebp - 0x584]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x584]
mov eax, dword [0x8db704]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, 0x8db6e0
mov ecx, 0x664ea4
mov edx, dword [0x8db4ec]
call fcn.0040acf0
lea eax, [ebp - 0x588]
mov ecx, 0x664ed4
mov edx, dword [0x8db6e0]
call fcn.0040acf0
mov ecx, dword [ebp - 0x588]
mov dl, 1
mov eax, dword [0x4cb488]
call fcn.004ce72c
mov dword [ebp - 0x29c], eax
mov dl, 1
mov eax, dword [0x47a398]
call fcn.0049c83c
mov dword [ebp - 0x2a0], eax
mov edx, dword [ebp - 0x2a0]
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x2a0]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x662f6f
mov eax, dword [ebp - 0x2a0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x662f6f
inc eax
mov dword [ebp - 0x2ac], eax
mov dword [ebp - 0x298], 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x58c]
mov edx, dword [ebp - 0x298]
mov eax, dword [ebp - 0x2a0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x58c]
mov ecx, 0x664efc
mov eax, dword [ebp - 0x29c]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x662da7
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x662f5d
movzx eax, byte [0x664f08]
push eax
lea eax, [ebp - 0x590]
push eax
mov ecx, 0x664f18
mov edx, 0x664f28
mov eax, dword [ebp - 0x20]
call fcn.0042a7f8
mov edx, dword [ebp - 0x590]
lea eax, [ebp - 0x20]
call fcn.0040a154
push dword [0x8db6e0]
push dword [ebp - 0x20]
push 0x664f18
lea eax, [ebp - 0x594]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x594]
mov eax, dword [0x8db6f0]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov esi, 1
mov ebx, 0x8bf5d0
push 0x664f38
push dword [0x8db4f0]
push 0x664ea4
push dword [ebp - 0x20]
push 0x664f18
push dword [ebx]
push 0x664f18
lea eax, [ebp - 0x598]
mov edx, 7
call fcn.0040ad78
mov edx, dword [ebp - 0x598]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc esi
add ebx, 4
cmp esi, 6
jne 0x662e16
push 0x664f38
push dword [0x8db6e0]
push dword [ebp - 0x20]
push 0x664f50
lea eax, [ebp - 0x59c]
mov edx, 4
call fcn.0040ad78
mov edx, dword [ebp - 0x59c]
mov eax, dword [0x8db700]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x664f38
push dword [0x8db6e0]
push dword [ebp - 0x20]
push 0x664f84
lea eax, [ebp - 0x5a0]
mov edx, 4
call fcn.0040ad78
mov edx, dword [ebp - 0x5a0]
mov eax, dword [0x8db700]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x664f38
push dword [0x8db6e0]
push dword [ebp - 0x20]
push 0x664fb4
lea eax, [ebp - 0x5a4]
mov edx, 4
call fcn.0040ad78
mov edx, dword [ebp - 0x5a4]
mov eax, dword [0x8db700]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x664f38
push dword [0x8db6e0]
push dword [ebp - 0x20]
push 0x664fec
lea eax, [ebp - 0x5a8]
mov edx, 4
call fcn.0040ad78
mov edx, dword [ebp - 0x5a8]
mov eax, dword [0x8db704]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x664f38
push dword [0x8db6e0]
push dword [ebp - 0x20]
push 0x665018
lea eax, [ebp - 0x5ac]
mov edx, 4
call fcn.0040ad78
mov edx, dword [ebp - 0x5ac]
mov eax, dword [0x8db704]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc dword [ebp - 0x298]
dec dword [ebp - 0x2ac]
jne 0x662d68
mov eax, dword [ebp - 0x29c]
call fcn.00407f90
mov eax, dword [ebp - 0x2a0]
call fcn.00407f90
mov eax, 0x8db6e4
mov ecx, 0x665050
mov edx, dword [0x8db4f0]
call fcn.0040acf0
push 0x665090
push dword [0x8db6e4]
push 0x6650a8
lea eax, [ebp - 0x5b0]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x5b0]
mov eax, dword [0x8db704]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x665090
push dword [0x8db6e4]
push 0x6650d4
lea eax, [ebp - 0x5b4]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x5b4]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x5b8]
mov ecx, 0x6650fc
mov edx, dword [0x8db6e4]
call fcn.0040acf0
mov eax, dword [ebp - 0x5b8]
lea ecx, [ebp - 0x290]
mov edx, 0x1ff
call fcn.00423c38
test eax, eax
jne 0x663075
push 0x665090
push dword [0x8db6e4]
push dword [ebp - 0x27c]
lea eax, [ebp - 0x5bc]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x5bc]
mov eax, dword [0x8db700]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x290]
call fcn.00423c88
test eax, eax
je 0x66302a
lea eax, [ebp - 0x290]
call fcn.00423cac
xor eax, eax
mov dword [ebp - 0x298], eax
mov dl, 1
mov eax, dword [0x8db6e4]
call fcn.004238d8
test al, al
je 0x6632ca
cmp dword [ebp - 0x298], 0
jne 0x6630a9
lea eax, [ebp - 0x20]
mov edx, 0x66511c
call fcn.0040a154
jmp 0x6630d7
push 0x66513c
lea edx, [ebp - 0x5c0]
mov eax, dword [ebp - 0x298]
call fcn.00422ef8
push dword [ebp - 0x5c0]
push 0x664f18
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040ad78
lea eax, [ebp - 0x5c4]
mov ecx, dword [ebp - 0x20]
mov edx, dword [0x8db6e4]
call fcn.0040acf0
mov eax, dword [ebp - 0x5c4]
mov dl, 1
call fcn.004238d8
test al, al
je 0x66329b
lea eax, [ebp - 0x5c8]
mov ecx, dword [ebp - 0x20]
mov edx, dword [0x8db6e4]
call fcn.0040acf0
mov edx, dword [ebp - 0x5c8]
mov eax, dword [0x8db6f4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov esi, 1
mov ebx, 0x8bf578
push 0x665090
push dword [0x8db6e4]
push dword [ebp - 0x20]
push dword [ebx]
push 0x664f18
lea eax, [ebp - 0x5cc]
mov edx, 5
call fcn.0040ad78
mov edx, dword [ebp - 0x5cc]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc esi
add ebx, 4
cmp esi, 0xc
jne 0x66312e
mov esi, 1
mov ebx, 0x8bf5a4
push 0x665090
push dword [0x8db6e4]
push dword [ebp - 0x20]
push dword [ebx]
lea eax, [ebp - 0x5d0]
mov edx, 4
call fcn.0040ad78
mov edx, dword [ebp - 0x5d0]
mov eax, dword [0x8db700]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc esi
add ebx, 4
cmp esi, 0xc
jne 0x663176
push 0x665090
push dword [0x8db6e4]
push dword [ebp - 0x20]
push 0x66515c
lea eax, [ebp - 0x5d4]
mov edx, 4
call fcn.0040ad78
mov edx, dword [ebp - 0x5d4]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x665090
push dword [0x8db6e4]
push dword [ebp - 0x20]
push 0x6651b8
lea eax, [ebp - 0x5d8]
mov edx, 4
call fcn.0040ad78
mov edx, dword [ebp - 0x5d8]
mov eax, dword [0x8db700]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push dword [0x8db6e4]
push dword [ebp - 0x20]
push 0x6650fc
lea eax, [ebp - 0x5dc]
mov edx, 3
call fcn.0040ad78
mov eax, dword [ebp - 0x5dc]
lea ecx, [ebp - 0x290]
mov edx, 0x1ff
call fcn.00423c38
test eax, eax
jne 0x66329b
push 0x665090
push dword [0x8db6e4]
push dword [ebp - 0x20]
push dword [ebp - 0x27c]
lea eax, [ebp - 0x5e0]
mov edx, 4
call fcn.0040ad78
mov edx, dword [ebp - 0x5e0]
mov eax, dword [0x8db700]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x290]
call fcn.00423c88
test eax, eax
je 0x66324d
lea eax, [ebp - 0x290]
call fcn.00423cac
inc dword [ebp - 0x298]
lea eax, [ebp - 0x5e4]
mov ecx, dword [ebp - 0x20]
mov edx, dword [0x8db6e4]
call fcn.0040acf0
mov eax, dword [ebp - 0x5e4]
mov dl, 1
call fcn.004238d8
test al, al
jne 0x663091
mov eax, 0x8db6e8
mov ecx, 0x6651dc
mov edx, dword [0x8db4f0]
call fcn.0040acf0
push 0x665210
push dword [0x8db6e8]
push 0x6650a8
lea eax, [ebp - 0x5e8]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x5e8]
mov eax, dword [0x8db704]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x665210
push dword [0x8db6e8]
push 0x6650d4
lea eax, [ebp - 0x5ec]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x5ec]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x5f0]
mov ecx, 0x6650fc
mov edx, dword [0x8db6e8]
call fcn.0040acf0
mov eax, dword [ebp - 0x5f0]
lea ecx, [ebp - 0x290]
mov edx, 0x1ff
call fcn.00423c38
test eax, eax
jne 0x6633ba
push 0x665210
push dword [0x8db6e8]
push dword [ebp - 0x27c]
lea eax, [ebp - 0x5f4]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x5f4]
mov eax, dword [0x8db700]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x290]
call fcn.00423c88
test eax, eax
je 0x66336f
lea eax, [ebp - 0x290]
call fcn.00423cac
xor eax, eax
mov dword [ebp - 0x298], eax
mov dl, 1
mov eax, dword [0x8db6e8]
call fcn.004238d8
test al, al
je 0x66360f
cmp dword [ebp - 0x298], 0
jne 0x6633ee
lea eax, [ebp - 0x20]
mov edx, 0x66511c
call fcn.0040a154
jmp 0x66341c
push 0x66513c
lea edx, [ebp - 0x5f8]
mov eax, dword [ebp - 0x298]
call fcn.00422ef8
push dword [ebp - 0x5f8]
push 0x664f18
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040ad78
lea eax, [ebp - 0x5fc]
mov ecx, dword [ebp - 0x20]
mov edx, dword [0x8db6e8]
call fcn.0040acf0
mov eax, dword [ebp - 0x5fc]
mov dl, 1
call fcn.004238d8
test al, al
je 0x6635e0
lea eax, [ebp - 0x600]
mov ecx, dword [ebp - 0x20]
mov edx, dword [0x8db6e8]
call fcn.0040acf0
mov edx, dword [ebp - 0x600]
mov eax, dword [0x8db6f8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov esi, 1
mov ebx, 0x8bf578
push 0x665210
push dword [0x8db6e8]
push dword [ebp - 0x20]
push dword [ebx]
push 0x664f18
lea eax, [ebp - 0x604]
mov edx, 5
call fcn.0040ad78
mov edx, dword [ebp - 0x604]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc esi
add ebx, 4
cmp esi, 0xc
jne 0x663473
mov esi, 1
mov ebx, 0x8bf5a4
push 0x665210
push dword [0x8db6e8]
push dword [ebp - 0x20]
push dword [ebx]
lea eax, [ebp - 0x608]
mov edx, 4
call fcn.0040ad78
mov edx, dword [ebp - 0x608]
mov eax, dword [0x8db700]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc esi
add ebx, 4
cmp esi, 0xc
jne 0x6634bb
push 0x665210
push dword [0x8db6e8]
push dword [ebp - 0x20]
push 0x66515c
lea eax, [ebp - 0x60c]
mov edx, 4
call fcn.0040ad78
mov edx, dword [ebp - 0x60c]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x665210
push dword [0x8db6e8]
push dword [ebp - 0x20]
push 0x6651b8
lea eax, [ebp - 0x610]
mov edx, 4
call fcn.0040ad78
mov edx, dword [ebp - 0x610]
mov eax, dword [0x8db700]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push dword [0x8db6e8]
push dword [ebp - 0x20]
push 0x6650fc
lea eax, [ebp - 0x614]
mov edx, 3
call fcn.0040ad78
mov eax, dword [ebp - 0x614]
lea ecx, [ebp - 0x290]
mov edx, 0x1ff
call fcn.00423c38
test eax, eax
jne 0x6635e0
push 0x665210
push dword [0x8db6e8]
push dword [ebp - 0x20]
push dword [ebp - 0x27c]
lea eax, [ebp - 0x618]
mov edx, 4
call fcn.0040ad78
mov edx, dword [ebp - 0x618]
mov eax, dword [0x8db700]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x290]
call fcn.00423c88
test eax, eax
je 0x663592
lea eax, [ebp - 0x290]
call fcn.00423cac
inc dword [ebp - 0x298]
lea eax, [ebp - 0x61c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [0x8db6e8]
call fcn.0040acf0
mov eax, dword [ebp - 0x61c]
mov dl, 1
call fcn.004238d8
test al, al
jne 0x6633d6
mov eax, 0x8db6ec
mov ecx, 0x665228
mov edx, dword [0x8db4e8]
call fcn.0040acf0
mov dl, 1
mov eax, dword [0x8db6ec]
call fcn.004238d8
test al, al
je 0x663984
push 0x6652b8
push dword [0x8db6ec]
push 0x6652d0
lea eax, [ebp - 0x620]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x620]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x6652b8
push dword [0x8db6ec]
push 0x6652e8
lea eax, [ebp - 0x624]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x624]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x6652b8
push dword [0x8db6ec]
push 0x665320
lea eax, [ebp - 0x628]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x628]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x6652b8
push dword [0x8db6ec]
push 0x665378
lea eax, [ebp - 0x62c]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x62c]
mov eax, dword [0x8db700]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x6652b8
push dword [0x8db6ec]
push 0x6653b4
lea eax, [ebp - 0x630]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x630]
mov eax, dword [0x8db700]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x6652b8
push dword [0x8db6ec]
push 0x665418
lea eax, [ebp - 0x634]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x634]
mov eax, dword [0x8db704]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x638]
mov ecx, 0x66546c
mov edx, dword [0x8db6ec]
call fcn.0040acf0
mov eax, dword [ebp - 0x638]
lea ecx, [ebp - 0x290]
mov edx, 0x10
call fcn.00423c38
test eax, eax
jne 0x663984
push dword [0x8db6ec]
push dword [ebp - 0x27c]
push 0x665484
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040ad78
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.004238d8
test al, al
je 0x6637db
lea eax, [ebp - 0x63c]
mov ecx, dword [ebp - 8]
mov edx, 0x6652b8
call fcn.0040acf0
mov edx, dword [ebp - 0x63c]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push dword [0x8db6ec]
push dword [ebp - 0x27c]
push 0x6654a0
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040ad78
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.004238d8
test al, al
je 0x66382a
lea eax, [ebp - 0x640]
mov ecx, dword [ebp - 8]
mov edx, 0x6652b8
call fcn.0040acf0
mov edx, dword [ebp - 0x640]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push dword [0x8db6ec]
push dword [ebp - 0x27c]
push 0x6654d8
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040ad78
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.004238d8
test al, al
je 0x663879
lea eax, [ebp - 0x644]
mov ecx, dword [ebp - 8]
mov edx, 0x6652b8
call fcn.0040acf0
mov edx, dword [ebp - 0x644]
mov eax, dword [0x8db6fc]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push dword [0x8db6ec]
push dword [ebp - 0x27c]
push 0x665530
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040ad78
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.004238d8
test al, al
je 0x6638c8
lea eax, [ebp - 0x648]
mov ecx, dword [ebp - 8]
mov edx, 0x6652b8
call fcn.0040acf0
mov edx, dword [ebp - 0x648]
mov eax, dword [0x8db700]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push dword [0x8db6ec]
push dword [ebp - 0x27c]
push 0x66556c
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040ad78
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.004238d8
test al, al
je 0x663917
lea eax, [ebp - 0x64c]
mov ecx, dword [ebp - 8]
mov edx, 0x6652b8
call fcn.0040acf0
mov edx, dword [ebp - 0x64c]
mov eax, dword [0x8db704]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push dword [0x8db6ec]
push dword [ebp - 0x27c]
push 0x6655a8
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040ad78
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.004238d8
test al, al
je 0x663966
lea eax, [ebp - 0x650]
mov ecx, dword [ebp - 8]
mov edx, 0x6652b8
call fcn.0040acf0
mov edx, dword [ebp - 0x650]
mov eax, dword [0x8db704]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x290]
call fcn.00423c88
test eax, eax
je 0x66378c
lea eax, [ebp - 0x290]
call fcn.00423cac
lea edx, [ebp - 0x654]
mov eax, 0x665600
call fcn.0042b92c
mov eax, dword [ebp - 0x654]
lea edx, [ebp - 8]
call fcn.006675c4
mov eax, dword [ebp - 8]
test eax, eax
je 0x6639ae
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6639d0
lea edx, [ebp - 0x658]
mov eax, dword [ebp - 8]
call fcn.0042a550
mov edx, dword [ebp - 0x658]
mov eax, dword [0x8db524]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x65c]
mov ecx, 0x6652d0
mov edx, dword [0x8db4f0]
call fcn.0040acf0
mov eax, dword [ebp - 0x65c]
mov dl, 1
call fcn.004238d8
test al, al
je 0x663a47
lea eax, [ebp - 0x660]
mov ecx, 0x6652d0
mov edx, dword [0x8db4f0]
call fcn.0040acf0
mov edx, dword [ebp - 0x660]
mov eax, dword [0x8db524]
mov ecx, dword [eax]
call dword [ecx + 0x58]
test eax, eax
jge 0x663a47
lea eax, [ebp - 0x664]
mov ecx, 0x6652d0
mov edx, dword [0x8db4f0]
call fcn.0040acf0
mov edx, dword [ebp - 0x664]
mov eax, dword [0x8db524]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x668]
mov ecx, 0x6652d0
mov edx, dword [0x8db4e0]
call fcn.0040acf0
mov eax, dword [ebp - 0x668]
mov dl, 1
call fcn.004238d8
test al, al
je 0x663abe
lea eax, [ebp - 0x66c]
mov ecx, 0x6652d0
mov edx, dword [0x8db4e0]
call fcn.0040acf0
mov edx, dword [ebp - 0x66c]
mov eax, dword [0x8db524]
mov ecx, dword [eax]
call dword [ecx + 0x58]
test eax, eax
jge 0x663abe
lea eax, [ebp - 0x670]
mov ecx, 0x6652d0
mov edx, dword [0x8db4e0]
call fcn.0040acf0
mov edx, dword [ebp - 0x670]
mov eax, dword [0x8db524]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov dl, 1
mov eax, 0x665618
call fcn.004238d8
test al, al
je 0x663add
mov edx, 0x665618
mov eax, dword [0x8db524]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x674]
mov ecx, 0x665650
mov edx, dword [0x8db4e8]
call fcn.0040acf0
mov eax, dword [ebp - 0x674]
mov dl, 1
call fcn.004238d8
test al, al
je 0x663b2a
lea eax, [ebp - 0x678]
mov ecx, 0x665650
mov edx, dword [0x8db4e8]
call fcn.0040acf0
mov edx, dword [ebp - 0x678]
mov eax, dword [0x8db524]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea edx, [ebp - 8]
mov eax, 0x66568c
call fcn.0042b92c
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x6656a4
call fcn.0040b0d0
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
jle 0x663bc4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x298]
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040aec0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x298]
mov edx, 1
call fcn.0040af08
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x663b8f
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x663bc4
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x663b9f
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
cmp word [edx + eax*2 - 2], 0x5c
je 0x663bb7
lea eax, [ebp - 0xc]
mov edx, 0x664f18
call fcn.0040ac98
mov edx, dword [ebp - 0xc]
mov eax, dword [0x8db528]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
cmp dword [ebp - 0x298], 0
jne 0x663b37
mov eax, dword [ebp - 8]
test eax, eax
je 0x663bdd
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x663c40
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
je 0x663c04
mov eax, dword [ebp - 0x2b8]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x2b8]
cmp word [eax + edx*2 - 2], 0x5c
je 0x663c22
lea eax, [ebp - 8]
mov edx, 0x664f18
call fcn.0040ac98
mov edx, dword [ebp - 8]
mov eax, dword [0x8db528]
mov ecx, dword [eax]
call dword [ecx + 0x58]
test eax, eax
jge 0x663c40
mov edx, dword [ebp - 8]
mov eax, dword [0x8db528]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
call fcn.00413b94
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x298]
cmp eax, 0x1f
ja 0x663c5d
bt ebx, eax
jae 0x663d45
mov eax, dword [ebp - 0x298]
add eax, 0x41
cmp ax, 0x41
je 0x663d45
lea eax, [ebp - 0x67c]
mov edx, dword [ebp - 0x298]
add edx, 0x41
call fcn.0040aaac
lea eax, [ebp - 0x67c]
mov edx, 0x6656b4
call fcn.0040ac98
mov eax, dword [ebp - 0x67c]
call fcn.0040aa84
push eax
call fcn.00413b34
cmp eax, 3
jne 0x663d45
cmp dword [0x8db4d8], 5
jne 0x663ce8
lea eax, [ebp - 0x680]
mov edx, dword [ebp - 0x298]
add edx, 0x41
call fcn.0040aaac
mov edx, dword [ebp - 0x680]
mov eax, 0x8db724
mov ecx, 0x6656c8
call fcn.0040acf0
jmp 0x663d11
lea eax, [ebp - 0x684]
mov edx, dword [ebp - 0x298]
add edx, 0x41
call fcn.0040aaac
mov edx, dword [ebp - 0x684]
mov eax, 0x8db724
mov ecx, 0x6656ec
call fcn.0040acf0
mov edx, dword [0x8db724]
mov eax, dword [0x8db52c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
test eax, eax
jge 0x663d45
mov dl, 1
mov eax, dword [0x8db724]
call fcn.004238d8
test al, al
je 0x663d45
mov edx, dword [0x8db724]
mov eax, dword [0x8db52c]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc dword [ebp - 0x298]
cmp dword [ebp - 0x298], 0x1a
jne 0x663c4f
cmp dword [0x8db4d8], 5
jne 0x663d75
mov eax, 0x8db724
mov ecx, 0x665718
mov edx, dword [ebp - 4]
call fcn.0040acf0
jmp 0x663d87
mov eax, 0x8db724
mov ecx, 0x66573c
mov edx, dword [ebp - 4]
call fcn.0040acf0
mov edx, dword [0x8db724]
mov eax, dword [0x8db52c]
mov ecx, dword [eax]
call dword [ecx + 0x58]
test eax, eax
jge 0x663dab
mov edx, dword [0x8db724]
mov eax, dword [0x8db52c]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x14]
call fcn.00409d2c
lea eax, [ebp - 0x18]
call fcn.00409d2c
lea eax, [ebp - 0x10]
call fcn.00409d2c
lea eax, [ebp - 0x688]
mov ecx, 0x665768
mov edx, dword [0x8db4ec]
call fcn.0040acf0
mov eax, dword [ebp - 0x688]
mov dl, 1
call fcn.00423840
test al, al
je 0x663f88
mov dl, 1
mov eax, dword [0x47a398]
call fcn.0049c83c
mov dword [ebp - 0x2a4], eax
push 0x40
lea eax, [ebp - 0x68c]
mov ecx, 0x665768
mov edx, dword [0x8db4ec]
call fcn.0040acf0
mov ecx, dword [ebp - 0x68c]
mov dl, 1
mov eax, dword [0x47d34c]
call fcn.0049d0f0
mov dword [ebp - 0x2a8], eax
xor eax, eax
push ebp
push 0x663e59
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x2a8]
mov eax, dword [ebp - 0x2a4]
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x663e63
mov eax, dword [ebp - 0x2a8]
call fcn.00407f90
mov eax, dword [ebp - 0x2a4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x663f7d
or esi, 0xffffffff
inc esi
lea ecx, [ebp - 0x694]
mov edx, esi
mov eax, dword [ebp - 0x2a4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x694]
lea edx, [ebp - 0x690]
call fcn.00422220
mov edx, dword [ebp - 0x690]
mov ecx, 1
mov eax, 0x665798
call fcn.0040b0d0
test eax, eax
jg 0x663ed2
mov eax, dword [ebp - 0x2a4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
cmp esi, eax
jne 0x663e84
mov eax, dword [ebp - 0x2a4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
cmp esi, eax
je 0x663f7d
lea ecx, [ebp - 0x10]
mov edx, esi
mov eax, dword [ebp - 0x2a4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, 1
mov edx, dword [ebp - 0x10]
mov eax, 0x6657b8
call fcn.0040b0d0
mov ecx, eax
lea eax, [ebp - 0x10]
mov edx, 1
call fcn.0040af08
lea eax, [ebp - 0x10]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x10]
mov eax, 0x6657c8
call fcn.0040b0d0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040aec0
push dword [0x8db4ec]
push 0x6657d8
push dword [ebp - 0x10]
push 0x6657f4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040ad78
push dword [0x8db4ec]
push 0x6657d8
push dword [ebp - 0x10]
push 0x665818
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.0040ad78
mov eax, dword [ebp - 0x2a4]
call fcn.00407f90
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x663f94
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x663fc9
mov dl, 1
mov eax, dword [ebp - 0x14]
call fcn.004238d8
test al, al
je 0x663fc9
lea eax, [ebp - 0x698]
mov ecx, dword [ebp - 0x14]
mov edx, 0x665868
call fcn.0040acf0
mov edx, dword [ebp - 0x698]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0
je 0x663fec
mov eax, dword [ebp - 0x2bc]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0
jle 0x664026
mov dl, 1
mov eax, dword [ebp - 0x18]
call fcn.004238d8
test al, al
je 0x664026
lea eax, [ebp - 0x69c]
mov ecx, dword [ebp - 0x18]
mov edx, 0x665868
call fcn.0040acf0
mov edx, dword [ebp - 0x69c]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x6a0]
mov ecx, 0x665880
mov edx, dword [0x8db4ec]
call fcn.0040acf0
mov eax, dword [ebp - 0x6a0]
mov dl, 1
call fcn.004238d8
test al, al
je 0x66407d
push 0x665868
push dword [0x8db4ec]
push 0x665880
lea eax, [ebp - 0x6a4]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x6a4]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x6a8]
mov ecx, 0x6658d4
mov edx, dword [0x8db4ec]
call fcn.0040acf0
mov eax, dword [ebp - 0x6a8]
mov dl, 1
call fcn.004238d8
test al, al
je 0x6640d4
push 0x665868
push dword [0x8db4ec]
push 0x6658d4
lea eax, [ebp - 0x6ac]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x6ac]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x6b0]
mov ecx, 0x66592c
mov edx, dword [0x8db4ec]
call fcn.0040acf0
mov eax, dword [ebp - 0x6b0]
mov dl, 1
call fcn.004238d8
test al, al
je 0x66412b
push 0x665868
push dword [0x8db4ec]
push 0x66592c
lea eax, [ebp - 0x6b4]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x6b4]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x1c]
call fcn.00409d2c
lea eax, [ebp - 0x6b8]
mov ecx, 0x66597c
mov edx, dword [0x8db4f0]
call fcn.0040acf0
mov eax, dword [ebp - 0x6b8]
lea ecx, [ebp - 0x290]
mov edx, 0x1ff
call fcn.00423c38
test eax, eax
jne 0x6641ae
mov eax, dword [ebp - 0x280]
and eax, 0x10
cmp eax, 0x10
jne 0x664194
push dword [0x8db4f0]
push 0x6659c4
push dword [ebp - 0x27c]
push 0x664f18
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.0040ad78
lea eax, [ebp - 0x290]
call fcn.00423c88
test eax, eax
je 0x664163
lea eax, [ebp - 0x290]
call fcn.00423cac
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0
je 0x6641d1
mov eax, dword [ebp - 0x2c0]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0
jle 0x66435b
push 0x665868
push dword [ebp - 0x1c]
push 0x6659e4
lea eax, [ebp - 0x6bc]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x6bc]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x665868
push dword [ebp - 0x1c]
push 0x665a04
lea eax, [ebp - 0x6c0]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x6c0]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x665868
push dword [ebp - 0x1c]
push 0x665a60
lea eax, [ebp - 0x6c4]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x6c4]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0x665868
push dword [ebp - 0x1c]
push 0x665a90
lea eax, [ebp - 0x6c8]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x6c8]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x6cc]
mov ecx, 0x665ab4
mov edx, dword [ebp - 0x1c]
call fcn.0040acf0
mov eax, dword [ebp - 0x6cc]
lea ecx, [ebp - 0x290]
mov edx, 0x1ff
call fcn.00423c38
test eax, eax
jne 0x66435b
mov eax, dword [ebp - 0x280]
and eax, 0x10
cmp eax, 0x10
jne 0x66433d
push dword [ebp - 0x1c]
push 0x665ae0
push dword [ebp - 0x27c]
push 0x665b04
lea eax, [ebp - 0x6d0]
mov edx, 4
call fcn.0040ad78
mov eax, dword [ebp - 0x6d0]
mov dl, 1
call fcn.004238d8
test al, al
je 0x66433d
push 0x665868
push dword [ebp - 0x1c]
push 0x665ae0
push dword [ebp - 0x27c]
push 0x665818
lea eax, [ebp - 0x6d4]
mov edx, 5
call fcn.0040ad78
mov edx, dword [ebp - 0x6d4]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x290]
call fcn.00423c88
test eax, eax
je 0x6642c3
lea eax, [ebp - 0x290]
call fcn.00423cac
lea eax, [ebp - 0x6d8]
mov ecx, 0x665b50
mov edx, dword [0x8db4f4]
call fcn.0040acf0
mov eax, dword [ebp - 0x6d8]
mov dl, 1
call fcn.004238d8
test al, al
je 0x6643b2
push 0x665b8c
push dword [0x8db4f4]
push 0x665b50
lea eax, [ebp - 0x6dc]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x6dc]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x6e0]
mov ecx, 0x665ba4
mov edx, dword [0x8db4f0]
call fcn.0040acf0
mov eax, dword [ebp - 0x6e0]
mov dl, 1
call fcn.004238d8
test al, al
je 0x664409
push 0x665b8c
push dword [0x8db4f0]
push 0x665ba4
lea eax, [ebp - 0x6e4]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x6e4]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x6e8]
mov ecx, 0x665c18
mov edx, dword [0x8db4f0]
call fcn.0040acf0
mov eax, dword [ebp - 0x6e8]
mov dl, 1
call fcn.004238d8
test al, al
je 0x664460
push 0x665b8c
push dword [0x8db4f0]
push 0x665c18
lea eax, [ebp - 0x6ec]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x6ec]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x6f0]
mov ecx, 0x665c98
mov edx, dword [0x8db4ec]
call fcn.0040acf0
mov eax, dword [ebp - 0x6f0]
mov dl, 1
call fcn.004238d8
test al, al
je 0x6644b7
push 0x665b8c
push dword [0x8db4ec]
push 0x665c98
lea eax, [ebp - 0x6f4]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x6f4]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x6f8]
mov ecx, 0x665cd4
mov edx, dword [0x8db4ec]
call fcn.0040acf0
mov eax, dword [ebp - 0x6f8]
mov dl, 1
call fcn.004238d8
test al, al
je 0x66450e
push 0x665b8c
push dword [0x8db4ec]
push 0x665cd4
lea eax, [ebp - 0x6fc]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x6fc]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x700]
mov ecx, 0x665d14
mov edx, dword [0x8db508]
call fcn.0040acf0
mov eax, dword [ebp - 0x700]
mov dl, 1
call fcn.004238d8
test al, al
je 0x664565
push 0x665d38
push dword [0x8db508]
push 0x665d14
lea eax, [ebp - 0x704]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x704]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x708]
mov ecx, 0x665d50
mov edx, dword [0x8db4ec]
call fcn.0040acf0
mov eax, dword [ebp - 0x708]
mov dl, 1
call fcn.004238d8
test al, al
je 0x6645bc
push 0x665d38
push dword [0x8db4ec]
push 0x665d50
lea eax, [ebp - 0x70c]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x70c]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x710]
mov ecx, 0x665d88
mov edx, dword [0x8db4f0]
call fcn.0040acf0
mov eax, dword [ebp - 0x710]
mov dl, 1
call fcn.004238d8
test al, al
je 0x664613
push 0x665d38
push dword [0x8db4f0]
push 0x665d88
lea eax, [ebp - 0x714]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x714]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x718]
mov ecx, 0x665dcc
mov edx, dword [0x8db4ec]
call fcn.0040acf0
mov eax, dword [ebp - 0x718]
mov dl, 1
call fcn.004238d8
test al, al
je 0x66466a
push 0x665e0c
push dword [0x8db4ec]
push 0x665dcc
lea eax, [ebp - 0x71c]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x71c]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x720]
mov ecx, 0x665e24
mov edx, dword [0x8db4ec]
call fcn.0040acf0
mov eax, dword [ebp - 0x720]
mov dl, 1
call fcn.004238d8
test al, al
je 0x6646c1
push 0x665e50
push dword [0x8db4ec]
push 0x665e24
lea eax, [ebp - 0x724]
mov edx, 3
call fcn.0040ad78
mov edx, dword [ebp - 0x724]
mov eax, dword [0x8db708]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x664714
lea eax, [ebp - 0x724]
mov edx, 0x64
call fcn.00409d8c
lea eax, [ebp - 0x594]
mov edx, 0x33
call fcn.00409d8c
lea eax, [ebp - 0x290]
mov edx, dword [0x41b1d0]
call fcn.0040b38c
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00409d8c
ret