Function at 0x669510
Capabilities:
Access peb ldr_data
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
xor eax, eax
push ebp
push 0x66a430
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi]
cmp dword [eax + 0xcc], 0
setne byte [ebp - 0x15]
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, dword [edx + 8]
mov dword [eax + 0x10], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0x14], ecx
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
cdq
mov ecx, dword [esi]
add eax, dword [ecx + 0x98]
adc edx, dword [ecx + 0x9c]
mov ecx, dword [esi]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, dword [edx + 0x20]
mov dword [eax + 0x28], ecx
mov ecx, dword [edx + 0x24]
mov dword [eax + 0x2c], ecx
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
cdq
mov ecx, dword [esi]
add eax, dword [ecx + 0x98]
adc edx, dword [ecx + 0x9c]
mov ecx, dword [esi]
mov dword [ecx + 0x38], eax
mov dword [ecx + 0x3c], edx
mov eax, dword [esi]
mov dword [eax + 0x4c], 0xffffffff
mov eax, dword [esi]
mov dword [eax + 0x50], 0xffffffff
mov eax, dword [esi]
xor edx, edx
mov dword [eax + 0x54], edx
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
cmp eax, dword [edx + 0x88]
jle 0x6695dd
xor edi, edi
jmp 0x66a408
mov edx, dword [esi]
cmp dword [edx + 0x60], 0
jne 0x6695f1
mov edx, dword [esi]
mov edx, dword [edx + 0x74]
movzx ebx, word [edx + eax*2 - 2]
jmp 0x669603
mov edx, eax
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
mov eax, dword [esi]
call fcn.0066aef4
mov eax, dword [esi]
mov dword [eax + 0x50], 0xffffffff
mov eax, dword [esi]
xor edx, edx
mov dword [eax + 0x54], edx
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
mov dword [edx + 0x4c], eax
mov eax, ebx
sub ax, 9
je 0x6696e5
dec ax
je 0x6696b0
sub ax, 3
je 0x66965c
sub ax, 0x13
jne 0x669703
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
jmp 0x669620
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
cmp bx, 0xa
jne 0x669694
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
mov eax, dword [esi]
add dword [eax + 0x20], 1
adc dword [eax + 0x24], 0
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
mov dword [edx + 0x30], eax
jmp 0x669620
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
mov eax, dword [esi]
add dword [eax + 0x20], 1
adc dword [eax + 0x24], 0
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
mov dword [edx + 0x30], eax
jmp 0x669620
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
jmp 0x669620
mov eax, dword [esi]
mov eax, dword [eax + 0x4c]
mov edx, dword [esi]
mov edx, dword [edx + 0x8c]
cmp eax, edx
jge 0x669723
mov ecx, edx
sub ecx, eax
mov edx, eax
mov eax, dword [esi]
call fcn.0066afa8
jmp 0x66972c
mov eax, dword [esi]
mov dword [eax + 0x4c], 0xffffffff
mov eax, dword [esi]
cmp byte [eax + 0x18], 0
jne 0x669746
mov eax, dword [esi]
cmp dword [eax + 0x54], 0
je 0x669746
mov edi, 0xffffff95
jmp 0x66a408
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
cmp eax, dword [edx + 0x88]
jle 0x66975f
xor edi, edi
jmp 0x66a408
mov eax, dword [esi]
mov dword [eax + 0x50], 0xffffffff
mov eax, dword [esi]
xor edx, edx
mov dword [eax + 0x54], edx
mov byte [ebp - 0x11], 0
mov eax, dword [esi]
cmp byte [eax + 0x1a], 0
jne 0x6697f2
mov eax, dword [esi]
mov ecx, dword [eax + 0x8c]
mov edx, ebx
mov eax, dword [esi]
mov edi, dword [eax]
call dword [edi + 0x20]
test al, al
je 0x6697f2
mov byte [ebp - 0x11], 1
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
mov dword [edx + 0x4c], eax
jmp 0x6697bc
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
cmp eax, dword [edx + 0x88]
jg 0x6697da
cmp bx, 0xd
je 0x6697da
cmp bx, 0xa
jne 0x6697a3
mov edx, dword [esi]
mov ecx, dword [edx + 0x8c]
mov eax, dword [esi]
mov eax, dword [eax + 0x4c]
sub ecx, eax
mov edx, eax
mov eax, dword [esi]
call fcn.0066afa8
push ebp
mov eax, ebx
call fcn.00669484
pop ecx
test al, al
je 0x669963
mov byte [ebp - 0x11], 1
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
cmp eax, dword [edx + 0x88]
jg 0x669963
mov edx, dword [esi]
mov dword [edx + 0x4c], eax
jmp 0x669935
mov eax, ebx
sub ax, 0xa
je 0x66988d
sub ax, 3
jne 0x6698bf
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
cmp bx, 0xa
jne 0x669871
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
mov eax, dword [esi]
add dword [eax + 0x20], 1
adc dword [eax + 0x24], 0
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
mov dword [edx + 0x30], eax
jmp 0x669935
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
mov eax, dword [esi]
add dword [eax + 0x20], 1
adc dword [eax + 0x24], 0
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
mov dword [edx + 0x30], eax
jmp 0x669935
xor edi, edi
mov eax, dword [esi]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x6698e0
mov eax, dword [ebp - 0x34]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
jmp 0x6698e9
inc edi
cmp edi, dword [ebp - 0x10]
jge 0x66990a
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
add edx, edi
mov eax, dword [esi]
call fcn.0066aeac
mov edx, dword [esi]
mov edx, dword [edx + 0x48]
cmp ax, word [edx + edi*2]
je 0x6698e8
cmp edi, dword [ebp - 0x10]
jne 0x66991c
mov eax, dword [esi]
mov edx, dword [ebp - 0x10]
add dword [eax + 0x8c], edx
jmp 0x66994b
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
cmp eax, dword [edx + 0x88]
jle 0x669827
mov edx, dword [esi]
mov ecx, dword [edx + 0x8c]
mov eax, dword [esi]
mov eax, dword [eax + 0x4c]
sub ecx, eax
mov edx, eax
mov eax, dword [esi]
call fcn.0066afa8
mov eax, dword [esi]
movzx eax, byte [eax + 0x19]
xor al, 1
and al, byte [ebp - 0x11]
je 0x66997a
mov edi, 0xffffff94
jmp 0x66a408
cmp byte [ebp - 0x11], 0
jne 0x6695c2
mov eax, dword [esi]
mov dword [eax + 0x50], 0xffffffff
mov eax, dword [esi]
xor edx, edx
mov dword [eax + 0x54], edx
mov edx, ebx
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 8]
test al, al
je 0x669c9d
mov edi, 0xffffff99
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
mov dword [edx + 0x4c], eax
mov word [ebp - 0x26], bx
cmp byte [ebp - 0x15], 0
je 0x669a2c
mov eax, 0x66a440
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov edx, ebx
cmp dx, 0xff
ja 0x6699db
movzx edx, dx
bt dword [eax], edx
setb al
test al, al
je 0x6699e6
sub bx, 0x20
mov eax, dword [esi]
mov eax, dword [eax + 0xcc]
test eax, eax
je 0x6699f7
sub eax, 4
mov eax, dword [eax]
mov edx, dword [esi]
mov edx, dword [edx + 0x8c]
mov ecx, dword [esi]
sub edx, dword [ecx + 0x4c]
inc edx
cmp eax, edx
jl 0x669a27
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
sub eax, dword [edx + 0x4c]
mov edx, dword [esi]
mov edx, dword [edx + 0xcc]
cmp bx, word [edx + eax*2]
sete al
jmp 0x669a29
xor eax, eax
mov byte [ebp - 0x15], al
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
mov edx, ebx
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 8]
test al, al
jne 0x6699bb
mov edx, ebx
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0xc]
test al, al
jne 0x6699bb
cmp bx, 0x24
je 0x6699bb
mov eax, dword [esi]
cmp byte [eax + 0x84], 0
je 0x669c74
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
sub eax, dword [edx + 0x4c]
dec eax
jne 0x669c74
cmp word [ebp - 0x26], 0x71
je 0x669aa6
cmp word [ebp - 0x26], 0x51
jne 0x669c74
mov edx, ebx
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x10]
test al, al
je 0x669c74
mov edi, 0xffffff96
mov word [ebp - 0x14], bx
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
cmp eax, dword [edx + 0x88]
jg 0x669c14
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov word [ebp - 0x26], ax
movzx eax, word [ebp - 0x26]
sub ax, 0x28
je 0x669b27
sub ax, 0x14
je 0x669b1f
sub ax, 0x1f
je 0x669b0f
sub ax, 0x20
je 0x669b17
jmp 0x669b2d
mov word [ebp - 0x26], 0x5d
jmp 0x669b2d
mov word [ebp - 0x26], 0x7d
jmp 0x669b2d
mov word [ebp - 0x26], 0x3e
jmp 0x669b2d
mov word [ebp - 0x26], 0x29
mov byte [ebp - 0x27], 0
mov eax, dword [esi]
inc dword [eax + 0x8c]
jmp 0x669bfe
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, ebx
sub ax, 0xa
je 0x669bba
sub ax, 3
jne 0x669bea
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
cmp bx, 0xa
jne 0x669ba1
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
mov eax, dword [esi]
add dword [eax + 0x20], 1
adc dword [eax + 0x24], 0
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
mov dword [edx + 0x30], eax
jmp 0x669bea
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
mov eax, dword [esi]
add dword [eax + 0x20], 1
adc dword [eax + 0x24], 0
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
mov dword [edx + 0x30], eax
cmp byte [ebp - 0x27], 0
je 0x669bf6
cmp bx, word [ebp - 0x14]
je 0x669c14
cmp bx, word [ebp - 0x26]
sete byte [ebp - 0x27]
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
cmp eax, dword [edx + 0x88]
jle 0x669b3e
mov eax, dword [esi]
cmp byte [eax + 0x40], 0
je 0x669c3a
mov eax, dword [esi]
mov ecx, dword [eax + 0x8c]
mov eax, dword [esi]
sub ecx, dword [eax + 0x4c]
mov eax, dword [esi]
mov edx, dword [eax + 0x4c]
mov eax, dword [esi]
call fcn.0066afa8
jmp 0x66a3ec
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
sub eax, dword [edx + 0x4c]
cmp eax, 5
jle 0x66a3ec
mov eax, dword [esi]
mov ecx, dword [eax + 0x8c]
mov eax, dword [esi]
sub ecx, dword [eax + 0x4c]
sub ecx, 5
mov eax, dword [esi]
mov edx, dword [eax + 0x4c]
add edx, 3
mov eax, dword [esi]
call fcn.0066afa8
jmp 0x66a3ec
mov eax, dword [esi]
movzx edx, byte [ebp - 0x15]
mov byte [eax + 0xd0], dl
mov edx, dword [esi]
mov ecx, dword [edx + 0x8c]
mov eax, dword [esi]
mov eax, dword [eax + 0x4c]
sub ecx, eax
mov edx, eax
mov eax, dword [esi]
call fcn.0066afa8
jmp 0x66a3ec
mov edx, ebx
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0xc]
test al, al
je 0x669dfe
mov edi, 0xffffff97
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov dword [ebp - 0x24], eax
mov edx, dword [esi]
mov dword [edx + 0x4c], eax
cmp byte [ebp - 0x15], 0
je 0x669d04
mov eax, dword [esi]
mov eax, dword [eax + 0xcc]
mov edx, eax
test edx, edx
je 0x669cdc
sub edx, 4
mov edx, dword [edx]
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
sub eax, dword [ebp - 0x24]
mov ecx, eax
inc ecx
cmp edx, ecx
jl 0x669cff
mov edx, dword [esi]
mov edx, dword [edx + 0xcc]
cmp bx, word [edx + eax*2]
sete al
jmp 0x669d01
xor eax, eax
mov byte [ebp - 0x15], al
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
mov edx, ebx
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0xc]
test al, al
jne 0x669cc3
mov edx, dword [esi]
mov ecx, dword [edx + 0x8c]
mov eax, dword [esi]
mov eax, dword [eax + 0x4c]
sub ecx, eax
mov edx, eax
mov eax, dword [esi]
call fcn.0066afa8
mov eax, dword [esi]
movzx edx, byte [ebp - 0x15]
mov byte [eax + 0xd0], dl
mov eax, dword [esi]
cmp bx, word [eax + 0x42]
jne 0x66a3ec
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
inc eax
mov edx, dword [esi]
cmp eax, dword [edx + 0x88]
jg 0x66a3ec
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
inc edx
mov eax, dword [esi]
call fcn.0066aeac
mov edx, eax
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0xc]
test al, al
je 0x66a3ec
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
mov dword [edx + 0x4c], eax
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
jmp 0x669dd3
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
mov edx, ebx
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0xc]
test al, al
jne 0x669dba
mov eax, dword [esi]
mov ecx, dword [eax + 0x8c]
mov eax, dword [esi]
sub ecx, dword [eax + 0x4c]
mov eax, dword [esi]
mov edx, dword [eax + 0x4c]
mov eax, dword [esi]
call fcn.0066afa8
jmp 0x66a3ec
mov edx, ebx
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x66a383
mov edx, ebx
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x10]
test al, al
je 0x669ecc
mov edi, 0xffffff96
mov word [ebp - 0x14], bx
mov eax, dword [esi]
cmp byte [eax + 0x40], 0
je 0x669e45
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov ecx, 1
mov eax, dword [esi]
call fcn.0066afa8
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
mov dword [edx + 0x4c], eax
movzx edx, word [ebp - 0x14]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [esi]
mov eax, dword [eax + 0x4c]
mov edx, dword [esi]
cmp eax, dword [edx + 0x8c]
jge 0x669e8d
mov eax, dword [esi]
mov ecx, dword [eax + 0x8c]
mov eax, dword [esi]
sub ecx, dword [eax + 0x4c]
mov eax, dword [esi]
mov edx, dword [eax + 0x4c]
mov eax, dword [esi]
call fcn.0066afa8
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
cmp eax, dword [edx + 0x88]
jg 0x66a3ec
mov eax, dword [esi]
cmp byte [eax + 0x40], 0
je 0x669ebf
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov ecx, 1
mov eax, dword [esi]
call fcn.0066afa8
mov eax, dword [esi]
inc dword [eax + 0x8c]
jmp 0x66a3ec
mov edx, ebx
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test al, al
je 0x669f79
mov edi, 0xffffff99
mov word [ebp - 0x14], bx
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov ecx, 1
mov eax, dword [esi]
call fcn.0066afa8
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
mov dword [edx + 0x4c], eax
movzx edx, word [ebp - 0x14]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [esi]
mov eax, dword [eax + 0x4c]
mov edx, dword [esi]
cmp eax, dword [edx + 0x8c]
jge 0x669f42
mov eax, dword [esi]
mov ecx, dword [eax + 0x8c]
mov eax, dword [esi]
sub ecx, dword [eax + 0x4c]
mov eax, dword [esi]
mov edx, dword [eax + 0x4c]
mov eax, dword [esi]
call fcn.0066afa8
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
cmp eax, dword [edx + 0x88]
jg 0x66a3ec
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov ecx, 1
mov eax, dword [esi]
call fcn.0066afa8
mov eax, dword [esi]
inc dword [eax + 0x8c]
jmp 0x66a3ec
mov eax, dword [esi]
cmp byte [eax + 0x85], 0
je 0x66a1db
cmp bx, 0x24
jne 0x66a1db
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
cmp eax, dword [edx + 0x88]
jge 0x66a1db
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
inc edx
mov eax, dword [esi]
call fcn.0066aeac
mov edx, eax
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0xc]
test al, al
jne 0x66a1db
mov edi, 0xffffff96
mov eax, dword [esi]
cmp byte [eax + 0x40], 0
je 0x669fea
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov ecx, 1
mov eax, dword [esi]
call fcn.0066afa8
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
mov dword [edx + 0x4c], eax
mov dx, 0x24
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea eax, [ebp - 8]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x8c]
mov eax, dword [esi]
sub ecx, dword [eax + 0x4c]
mov eax, dword [esi]
mov edx, dword [eax + 0x4c]
mov eax, dword [esi]
call fcn.0066afbc
mov eax, dword [esi]
cmp byte [eax + 0x40], 0
je 0x66a057
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
cmp eax, dword [edx + 0x4c]
jle 0x66a057
mov eax, dword [esi]
mov ecx, dword [eax + 0x8c]
mov eax, dword [esi]
sub ecx, dword [eax + 0x4c]
mov eax, dword [esi]
mov edx, dword [eax + 0x4c]
mov eax, dword [esi]
call fcn.0066afa8
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
cmp eax, dword [edx + 0x88]
jg 0x66a3ec
mov eax, dword [esi]
cmp byte [eax + 0x40], 0
je 0x66a089
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov ecx, 1
mov eax, dword [esi]
call fcn.0066afa8
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
mov dword [edx + 0x4c], eax
mov dx, 0x24
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [esi]
mov eax, dword [eax + 0x4c]
mov edx, dword [esi]
cmp eax, dword [edx + 0x8c]
jge 0x66a0d1
mov eax, dword [esi]
mov ecx, dword [eax + 0x8c]
mov eax, dword [esi]
sub ecx, dword [eax + 0x4c]
mov eax, dword [esi]
mov edx, dword [eax + 0x4c]
mov eax, dword [esi]
call fcn.0066afa8
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
cmp eax, dword [edx + 0x88]
jg 0x66a167
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov ecx, 1
mov eax, dword [esi]
call fcn.0066afa8
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
mov dword [edx + 0x4c], eax
mov dx, 0x24
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x8c]
mov eax, dword [esi]
sub ecx, dword [eax + 0x4c]
mov eax, dword [esi]
mov edx, dword [eax + 0x4c]
mov eax, dword [esi]
call fcn.0066afbc
mov eax, dword [esi]
mov eax, dword [eax + 0x4c]
mov edx, dword [esi]
cmp eax, dword [edx + 0x8c]
jge 0x66a167
mov eax, dword [esi]
mov ecx, dword [eax + 0x8c]
mov eax, dword [esi]
sub ecx, dword [eax + 0x4c]
mov eax, dword [esi]
mov edx, dword [eax + 0x4c]
mov eax, dword [esi]
call fcn.0066afa8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040adbc
je 0x66a18a
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
cmp eax, dword [edx + 0x88]
jle 0x66a091
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
cmp eax, dword [edx + 0x88]
jg 0x66a3ec
mov eax, dword [esi]
cmp byte [eax + 0x40], 0
je 0x66a1be
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov ecx, 1
mov eax, dword [esi]
call fcn.0066afa8
jmp 0x66a1ce
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
sub eax, dword [ebp - 0x2c]
mov edx, dword [esi]
sub dword [edx + 0x54], eax
mov eax, dword [esi]
inc dword [eax + 0x8c]
jmp 0x66a3ec
mov edi, 0xffffff9a
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov edx, dword [esi]
mov dword [edx + 0x50], eax
mov eax, dword [esi]
xor edx, edx
mov dword [eax + 0x54], edx
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov dword [ebp - 0x20], eax
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov ecx, 1
mov eax, dword [esi]
call fcn.0066afa8
mov eax, dword [esi]
inc dword [eax + 0x8c]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov ebx, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x50]
mov eax, dword [esi]
call fcn.0066aeac
mov edx, dword [esi]
movzx eax, al
bt dword [edx + 0xa4], eax
jb 0x66a25b
mov dword [ebp - 0x1c], 0xffffffff
jmp 0x66a278
mov eax, dword [esi]
mov eax, dword [eax + 0xa0]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x54]
mov eax, dword [esi]
mov edx, dword [eax + 0x50]
mov eax, dword [esi]
call fcn.00669220
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x66a2d5
lea ecx, [ebp - 0x44]
mov eax, dword [esi]
mov eax, dword [eax + 0xa0]
mov edx, dword [ebp - 0x1c]
call fcn.0065f9e4
mov edx, dword [ebp - 0x44]
mov eax, dword [esi]
add eax, 0x5c
call fcn.00409fec
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
mov dword [ebp - 0x24], eax
mov eax, dword [esi]
mov eax, dword [eax + 0xa0]
mov edx, dword [ebp - 0x1c]
call fcn.0065fa04
mov edi, eax
test edi, edi
jg 0x66a2da
mov ecx, 0x40d
mov edx, 0x66a46c
mov eax, 0x66a4fc
call fcn.00409a58
jmp 0x66a2da
mov eax, dword [esi]
dec dword [eax + 0x54]
mov edx, ebx
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
jne 0x66a20b
cmp edi, 0xffffff9a
jne 0x66a353
mov eax, dword [esi]
mov edx, dword [ebp - 0x20]
mov dword [eax + 0x50], edx
mov eax, dword [esi]
mov dword [eax + 0x54], 1
cmp byte [ebp - 0x15], 0
je 0x66a376
mov eax, dword [esi]
mov eax, dword [eax + 0xcc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x66a329
mov eax, dword [ebp - 0x40]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jne 0x66a376
mov eax, dword [esi]
mov edx, dword [eax + 0x50]
mov eax, dword [esi]
call fcn.0066aeac
mov edx, dword [esi]
mov edx, dword [edx + 0xcc]
cmp ax, word [edx]
sete al
mov edx, dword [esi]
mov byte [edx + 0xd0], al
jmp 0x66a376
cmp byte [ebp - 0x15], 0
je 0x66a376
mov eax, dword [esi]
mov eax, dword [eax + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x5c]
call fcn.0040adbc
sete al
mov edx, dword [esi]
mov byte [edx + 0xd0], al
mov eax, dword [esi]
mov edx, dword [ebp - 0x24]
mov dword [eax + 0x8c], edx
jmp 0x66a3ec
push 0x66a52c
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040aa58
push dword [ebp - 0x4c]
push 0x66a574
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov eax, dword [esi]
call fcn.0066aeac
movzx eax, ax
lea ecx, [ebp - 0x50]
mov edx, 4
call fcn.004246c8
push dword [ebp - 0x50]
lea eax, [ebp - 0x48]
mov edx, 4
call fcn.0040ad0c
mov ecx, dword [ebp - 0x48]
mov dl, 1
mov eax, dword [0x41caf0]
call fcn.0042aa70
call fcn.00409250
cmp edi, 0x80000001
jne 0x66a408
mov ecx, 0x426
mov edx, 0x66a46c
mov eax, 0x66a4fc
call fcn.00409a58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66a437
lea eax, [ebp - 0x50]
mov edx, 4
call fcn.00409c6c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00409c6c
ret