Function at 0x650f70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x87e616
mov eax, dword fs:[0]
push eax
sub esp, 0x3e8
mov eax, dword [0x8ce6f4]
xor eax, esp
mov dword [esp + 0x3b0], eax
push ebx
push esi
push edi
mov eax, dword [0x8ce6f4]
xor eax, esp
push eax
lea eax, [esp + 0x3f8]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x20]
fld qword [ebp + 0x18]
mov esi, dword [ebp + 0xc]
fstp qword [esp + 0xc4]
mov ecx, dword [esi + 8]
mov ebx, dword [ebp + 8]
mov dword [esp + 0xcc], eax
xor eax, eax
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], eax
mov eax, dword [esi + 4]
add eax, eax
add ecx, ecx
add eax, eax
add ecx, ecx
add eax, eax
add ecx, ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], esi
cmp dword [ebx + 0x54], eax
jne 0x651062
cmp dword [ebx + 0x58], ecx
jne 0x651062
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x30]
mov edi, dword [esi + 0x24]
add ecx, ecx
add edx, edx
add ecx, ecx
add ecx, ecx
add edx, edx
add eax, eax
add edx, edx
add edi, edi
mov dword [esp + 0x14c], ecx
lea ecx, [esp + 0x144]
add eax, eax
mov dword [esp + 0x148], edx
add edi, edi
push ecx
lea edx, [ebx + 0x5c]
add eax, eax
add edi, edi
push edx
mov dword [esp + 0x14c], edi
mov dword [esp + 0x158], eax
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
jne 0x651089
sub esp, 0x10
mov dword [esp + 0x60], esp
mov eax, esp
lea ecx, [esi + 0x24]
push ecx
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [esi + 8]
mov esi, dword [esi + 4]
push eax
push esi
lea ecx, [ebx - 0xa4]
call fcn.00648240
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push 0
push 0x2710
push edx
push eax
call fcn.00803a40
fld qword [esp + 0xc4]
push 0
lea edx, [esp + 0xc4]
push edx
sub esp, 8
fstp qword [esp]
lea ecx, [ebx - 0xa4]
push eax
mov dword [esp + 0xac], eax
call fcn.00635ed0
mov dword [esp + 0x58], eax
test eax, eax
jne 0x6510d9
mov eax, 1
jmp 0x652b0d
xor eax, eax
cmp dword [ebx + 0x10], eax
je 0x6510ff
mov edx, dword [ebx + 0x14]
test edx, edx
je 0x6510fd
mov esi, dword [ebx + 0xc]
mov ecx, esi
lea esp, [esp]
cmp dword [ecx], 0
jne 0x651124
inc eax
add ecx, 4
cmp eax, edx
jb 0x6510f0
xor eax, eax
mov esi, eax
test eax, eax
je 0x6511ac
xor eax, eax
test esi, esi
setne al
test eax, eax
je 0x6513a2
mov edi, esi
mov dword [esp + 0x44], edi
test esi, esi
jne 0x651129
jmp 0x651159
mov eax, dword [esi + eax*4]
jmp 0x6510ff
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x651157
mov eax, dword [esi + 0xc]
mov esi, dword [ebx + 0x14]
xor edx, edx
div esi
inc edx
jmp 0x651140
cmp edx, esi
jae 0x651157
mov eax, dword [ebx + 0xc]
cmp dword [eax + edx*4], 0
lea eax, [eax + edx*4]
je 0x651152
mov ecx, dword [eax]
inc edx
test ecx, ecx
je 0x651140
mov esi, ecx
mov edi, dword [edi]
mov ecx, dword [esp + 0x44]
mov ecx, dword [ecx + 4]
cmp edi, dword [ebx - 0x98]
jae 0x6513ac
mov edx, dword [esp + 0x98]
mov eax, edi
imul eax, eax, 0x34
add eax, dword [ebx - 0x9c]
cmp dword [eax + 0x2c], edx
jge 0x6511a0
test ecx, ecx
je 0x651191
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov ebx, dword [esp + 0x24]
push edi
lea ecx, [ebx + 0xc]
call fcn.005d0e90
jmp 0x6511a4
mov ebx, dword [esp + 0x24]
test esi, esi
jne 0x651109
mov esi, dword [esp + 0x58]
mov ecx, dword [esp + 0x24]
lea eax, [esi + 8]
push eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0xc4]
add ecx, 0x3c
push eax
call fcn.006471f0
xor ebx, ebx
xor edi, edi
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], edi
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
mov eax, dword [esi + 0xc]
mov dword [esp + 0x400], ebx
mov dword [esp + 0x44], eax
cmp eax, ebx
jle 0x6512bd
lea esp, [esp]
mov ecx, dword [esp + 0x58]
cmp ebx, dword [ecx + 4]
jae 0x6513ac
mov edx, ecx
mov eax, dword [edx]
mov edx, dword [eax + ebx*4]
lea ecx, [eax + ebx*4]
mov eax, edx
mov dword [esp + 0xa4], edx
mov edx, dword [esp + 0x24]
mov esi, dword [edx - 0x98]
cmp eax, esi
jae 0x6513ac
mov edx, dword [edx - 0x9c]
imul eax, eax, 0x34
mov eax, dword [eax + edx + 0x24]
mov dword [esp + 0xa8], eax
mov eax, dword [ecx]
cmp eax, esi
jae 0x6513ac
imul eax, eax, 0x34
mov ecx, dword [eax + edx + 0x30]
mov dword [esp + 0xac], ecx
mov esi, edi
cmp edi, dword [esp + 0x80]
jb 0x651280
inc edi
push edi
lea ecx, [esp + 0x7c]
call fcn.006468d0
test al, al
je 0x6513b6
mov edi, dword [esp + 0x7c]
mov eax, dword [esp + 0x78]
lea edx, [esi + esi*2]
lea eax, [eax + edx*4]
test eax, eax
je 0x6512ab
mov ecx, dword [esp + 0xa4]
mov edx, dword [esp + 0xa8]
mov dword [eax], ecx
mov ecx, dword [esp + 0xac]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
inc edi
inc ebx
mov dword [esp + 0x7c], edi
cmp ebx, dword [esp + 0x44]
jl 0x651200
xor ebx, ebx
mov edx, dword [esp + 0x78]
push 0x646290
push 0xc
push edi
push edx
call fcn.008044b0
add esp, 0x10
mov dword [esp + 0x58], ebx
cmp edi, ebx
jle 0x652aad
mov ecx, dword [esp + 0x7c]
mov eax, ebx
cmp eax, ecx
jae 0x6513ac
mov ecx, dword [esp + 0x78]
mov esi, dword [esp + 0x24]
lea eax, [eax + eax*2]
mov ebx, dword [ecx + eax*4]
lea eax, [ecx + eax*4]
mov dword [esp + 0x50], ebx
cmp ebx, dword [esi - 0x98]
jae 0x6513ac
mov eax, ebx
imul eax, eax, 0x34
add eax, dword [esi - 0x9c]
lea ecx, [esp + 0xe0]
push eax
call fcn.00559a40
fld qword [esp + 0xc4]
sub esp, 8
fstp qword [esp]
add esi, 0xffffff5c
push ebx
mov ecx, esi
mov byte [esp + 0x40c], 1
call fcn.00635aa0
fld qword [esp + 0xc4]
mov edx, dword [esp + 0x98]
mov edi, eax
mov eax, dword [esp + 0x24]
sub esp, 8
fstp qword [esp]
sub edx, edi
push ebx
mov ecx, esi
mov dword [eax + 0x6c], edx
call fcn.00635b20
mov ecx, dword [esp + 0x24]
sub eax, edi
mov dword [ecx + 0x70], eax
push ebx
mov ecx, esi
call fcn.00650240
mov esi, eax
mov dword [esp + 0x64], esi
test esi, esi
jne 0x6513c0
lea ecx, [esp + 0xe0]
mov byte [esp + 0x400], al
call fcn.00559310
jmp 0x652a94
push 0x80004005
call fcn.004a8210
push 0x80070057
call fcn.004a8210
push 0x8007000e
call fcn.004a8210
mov edx, dword [esi + 0x70]
mov dword [esp + 0x114], edx
mov eax, dword [esi + 0x74]
mov dword [esp + 0x118], eax
mov ecx, dword [esi + 0x78]
mov dword [esp + 0x11c], ecx
mov edx, dword [esi + 0x7c]
mov dword [esp + 0x120], edx
mov edx, dword [esi + 0x60]
mov dword [esp + 0x134], edx
mov edi, dword [esi + 0x64]
mov dword [esp + 0x138], edi
mov eax, dword [esi + 0x68]
mov dword [esp + 0x13c], eax
mov ecx, dword [esi + 0x6c]
sub eax, edx
mov dword [esp + 0x140], ecx
sub ecx, edi
xor edi, edi
mov dword [esp + 0x9c], eax
mov eax, dword [esi + 0x5c]
xor bl, bl
mov dword [esp + 0x40], ecx
mov byte [esp + 0x4b], bl
mov dword [esp + 0x28], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
cmp eax, edi
je 0x65144c
mov eax, dword [eax + 0x1c4]
mov dword [esp + 0x30], eax
xor eax, eax
mov dword [esp + 0x44], eax
jmp 0x651462
xor eax, eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x44], eax
jmp 0x651462
xor edi, edi
cmp dword [esi + eax*4 + 0x30], edi
je case.default.0x651475
cmp eax, 4
ja case.default.0x651475
jmp dword [eax*4 + 0x652b34]
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 8]
mov ebx, dword [eax + 4]
mov edx, dword [eax + 0x10]
mov edi, dword [eax + 0xc]
mov dword [esp + 0x3c], ecx
mov ecx, dword [eax + 0x28]
mov eax, dword [eax + 0x2c]
mov dword [esp + 0xd0], ebx
mov dword [esp + 0x4c], edx
mov dword [esp + 0xd8], edi
cmp eax, ecx
jge 0x6514b1
mov edx, ecx
mov ecx, eax
mov eax, edx
test ecx, ecx
jg 0x6514c2
test eax, eax
jg 0x6514c2
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x70]
xor ecx, ecx
mov edx, dword [esp + 0x24]
mov edx, dword [edx + 0x6c]
cmp edx, ecx
jg 0x6514d5
mov ecx, dword [esp + 0x3c]
mov edi, ebx
jmp 0x65154b
cmp ebx, edi
jne 0x6514f5
mov ebx, dword [esp + 0x3c]
cmp ebx, dword [esp + 0x4c]
jne 0x6514ee
mov edi, dword [esp + 0xd0]
mov ecx, ebx
jmp 0x65154b
mov edi, dword [esp + 0xd8]
cmp ecx, edx
jge 0x651547
cmp edx, eax
jge 0x651547
sub edx, ecx
mov dword [esp + 0x54], edx
fild dword [esp + 0x54]
sub eax, ecx
mov dword [esp + 0x54], eax
fild dword [esp + 0x54]
fdivp st(1)
fld1
fsub st(1)
fild dword [esp + 0xd0]
fmul st(1)
fild dword [esp + 0xd8]
fmul st(3)
faddp st(1)
call fcn.00802da0
fimul dword [esp + 0x3c]
mov edi, eax
fild dword [esp + 0x4c]
fmulp st(2)
faddp st(1)
call fcn.00802da0
mov ecx, eax
jmp 0x65154b
mov ecx, dword [esp + 0x4c]
mov ebx, dword [esi + 0x20]
cmp ebx, 3
jg 0x651559
sub ecx, dword [esp + 0x40]
jmp 0x65156a
cmp ebx, 6
jg 0x65156a
mov eax, dword [esp + 0x40]
inc eax
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
mov eax, ebx
cdq
mov ebx, 3
idiv ebx
cmp edx, 1
je 0x651595
test edx, edx
jne 0x651586
sub edi, dword [esp + 0x9c]
jmp 0x651595
mov eax, dword [esp + 0x9c]
inc eax
cdq
sub eax, edx
sar eax, 1
sub edi, eax
mov edx, dword [esp + 0x9c]
mov eax, edi
mov edi, dword [esp + 0x40]
add edx, eax
add edi, ecx
mov dword [esp + 0x134], eax
mov dword [esp + 0x138], ecx
mov dword [esp + 0x13c], edx
mov dword [esp + 0x140], edi
cmp dword [esi + 0x2c], 1
jne 0x651882
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx + 0x5c]
mov ecx, dword [ecx + 0x60]
push ecx
push eax
lea eax, [esp + 0x13c]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x651882
mov eax, dword [esi + 0x34]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], ecx
mov byte [esp + 0x4b], 1
jmp case.default.0x651475
mov eax, dword [esi + 0x38]
mov edx, dword [eax + 0x2c]
mov ecx, dword [eax + 0x28]
mov edi, dword [eax + 0x30]
mov dword [esp + 0x4c], edx
mov edx, dword [eax + 0x34]
cmp ecx, 0xffffffff
jne 0x651631
cmp edx, ecx
jne 0x651631
mov eax, dword [esp + 0x24]
mov edx, dword [eax + 0x70]
mov eax, edx
xor ecx, ecx
sub eax, edi
mov edi, eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x6c]
cmp eax, ecx
jge 0x65164b
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx + 4]
mov dword [esp + 0x28], edx
jmp case.default.0x651475
cmp eax, dword [esp + 0x4c]
jge 0x65168a
sub eax, ecx
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x4c]
fild dword [esp + 0x54]
sub eax, ecx
mov dword [esp + 0x54], eax
fild dword [esp + 0x54]
mov eax, dword [esi + 0x38]
fdivp st(1)
fld1
fsub st(1)
fimul dword [eax + 4]
fild dword [eax + 8]
fmulp st(2)
faddp st(1)
call fcn.00802da0
mov dword [esp + 0x28], eax
jmp case.default.0x651475
cmp eax, edi
jge 0x65169d
mov eax, dword [esi + 0x38]
mov ecx, dword [eax + 8]
mov dword [esp + 0x28], ecx
jmp case.default.0x651475
cmp eax, edx
jge 0x6516d6
sub eax, edi
mov dword [esp + 0x54], eax
fild dword [esp + 0x54]
sub edx, edi
mov dword [esp + 0x54], edx
fild dword [esp + 0x54]
mov eax, dword [esi + 0x38]
fdivp st(1)
fld1
fsub st(1)
fimul dword [eax + 8]
fild dword [eax + 0xc]
fmulp st(2)
faddp st(1)
call fcn.00802da0
mov dword [esp + 0x28], eax
jmp case.default.0x651475
mov edx, dword [esi + 0x38]
mov eax, dword [edx + 0xc]
mov dword [esp + 0x28], eax
jmp case.default.0x651475
mov eax, dword [esi + 0x2c]
cmp eax, 1
jne 0x6516fb
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x5c]
mov edx, ecx
mov ebx, dword [edx + 0x64]
jmp 0x651702
mov eax, dword [esp + 0x24]
mov ebx, dword [eax + 0x54]
mov eax, dword [esi + 0x3c]
cmp dword [eax + 8], 0
je 0x65172d
mov ecx, dword [esp + 0x24]
fild dword [ecx + 0x6c]
fmul qword [0x443058]
fidiv dword [eax + 4]
call fcn.00802da0
mov ecx, edi
sub ecx, eax
sub ecx, dword [esp + 0x9c]
jmp 0x651746
mov edx, dword [esp + 0x24]
fild dword [edx + 0x6c]
fmul qword [0x43a3f0]
fidiv dword [eax + 4]
call fcn.00802da0
mov ecx, ebx
sub ecx, eax
mov edx, dword [esp + 0x120]
mov dword [esp + 0x134], ecx
add ecx, dword [esp + 0x9c]
lea eax, [esp + 0x1a4]
mov dword [esp + 0x13c], ecx
mov ecx, dword [esp + 0x118]
mov dword [esp + 0x1a8], ecx
push eax
lea ecx, [esp + 0x118]
sar edi, 3
mov dword [esp + 0x1b4], edx
sar ebx, 3
push ecx
mov edx, ecx
mov dword [esp + 0x1ac], edi
mov dword [esp + 0x1b4], ebx
push edx
jmp 0x65187c
mov eax, dword [esi + 0x40]
cmp dword [eax + 0x10], edi
mov edi, eax
je 0x6517cd
mov ecx, dword [esp + 0x24]
fild dword [ecx + 0x6c]
fmul qword [0x443058]
fidiv dword [edi + 0xc]
call fcn.00802da0
mov edx, dword [edi + 4]
sub edx, eax
sub edx, dword [esp + 0x40]
jmp 0x6517e7
mov edx, dword [esp + 0x24]
fild dword [edx + 0x6c]
fmul qword [0x43a3f0]
fidiv dword [edi + 0xc]
call fcn.00802da0
mov edx, dword [edi + 8]
sub edx, eax
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x2c]
mov edi, dword [edi + 4]
add eax, edx
mov dword [esp + 0x140], eax
mov dword [esp + 0x138], edx
mov ecx, dword [esi + 0x40]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 4]
add eax, 4
add ecx, 4
sar eax, 3
sar ecx, 3
cmp dword [esi + 0x2c], 1
mov dword [esp + 0x144], 0
mov dword [esp + 0x148], ecx
mov dword [esp + 0x14c], edi
mov dword [esp + 0x150], eax
jne 0x651869
mov edi, dword [esp + 0x24]
mov edi, dword [edi + 0x60]
add dword [esp + 0x140], edi
add edx, edi
sar edi, 3
add ecx, edi
add eax, edi
mov dword [esp + 0x138], edx
mov dword [esp + 0x148], ecx
mov dword [esp + 0x150], eax
lea ecx, [esp + 0x144]
push ecx
lea edx, [esp + 0x118]
push edx
mov eax, edx
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
mov bl, 1
mov eax, dword [esp + 0x44]
inc eax
mov dword [esp + 0x44], eax
cmp eax, 5
jl 0x651460
test bl, bl
jne 0x6518fa
cmp byte [esp + 0x4b], bl
jne 0x6518fa
cmp byte [esi + 0x28], bl
jne 0x6518fa
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx - 0x58]
mov eax, dword [esp + 0x104]
push edx
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0xc8]
push edx
push eax
push esi
lea edx, [esp + 0x278]
push edx
add ecx, 0x3c
call fcn.00647f80
mov ecx, dword [eax]
mov dword [esp + 0x134], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x138], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x13c], ecx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x140], edx
mov ecx, dword [esi + 0x20]
mov eax, ecx
cdq
mov edi, 3
idiv edi
cmp edx, 1
jne 0x651915
mov edi, dword [esp + 0x134]
jmp 0x651938
cmp edx, 2
jne 0x651931
mov eax, dword [esp + 0x13c]
add eax, dword [esp + 0x134]
cdq
sub eax, edx
mov edi, eax
sar edi, 1
jmp 0x651938
mov edi, dword [esp + 0x13c]
mov dword [esp + 0x68], edi
cmp ecx, 3
jg 0x65194a
mov eax, dword [esp + 0x140]
jmp 0x65196b
cmp ecx, 6
jg 0x651964
mov eax, dword [esp + 0x140]
add eax, dword [esp + 0x138]
cdq
sub eax, edx
sar eax, 1
jmp 0x65196b
mov eax, dword [esp + 0x138]
cmp byte [esp + 0x4b], 0
jne 0x65197a
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], eax
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x118]
mov ebx, dword [esp + 0x138]
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x5c], eax
mov eax, dword [edx + 4]
xor edx, edx
mov dword [esp + 0x304], ecx
mov dword [esp + 0x314], ecx
mov ecx, dword [esp + 0x11c]
mov dword [esp + 0x308], edx
mov edx, dword [esp + 0x114]
mov dword [esp + 0x324], ecx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [ecx + 8]
mov dword [esp + 0x310], edi
mov dword [esp + 0x318], edi
mov dword [esp + 0x31c], edx
mov edx, dword [esp + 0x120]
mov dword [esp + 0x328], edi
xor edi, edi
mov dword [esp + 0x30c], eax
mov dword [esp + 0x320], edx
mov dword [esp + 0x32c], eax
mov dword [esp + 0x330], edx
mov dword [esp + 0x334], edi
mov dword [esp + 0x338], edx
mov dword [esp + 0x33c], eax
mov dword [esp + 0x340], ecx
mov eax, dword [esi + 8]
mov dword [esp + 0xa8], ebx
test eax, eax
je 0x651c20
lea esp, [esp]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x6513a2
mov edx, dword [eax]
mov edi, dword [eax + 8]
mov eax, dword [esi + 0x20]
mov dword [esp + 0x40], edx
cdq
mov ecx, 3
idiv ecx
mov esi, dword [esp + 0x68]
cmp edx, 1
je 0x651a7f
test edx, edx
jne 0x651a75
sub esi, dword [edi + 0x1c]
jmp 0x651a7f
mov eax, dword [edi + 0x1c]
cdq
sub eax, edx
sar eax, 1
sub esi, eax
mov edx, dword [esp + 0x64]
cmp byte [edx + 0x88], 0
je 0x651bbc
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0x6c]
mov ecx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x38]
push eax
push ecx
mov ecx, dword [esp + 0x3c]
push ebx
push esi
push edx
lea eax, [esp + 0x320]
push eax
push ecx
lea edx, [esp + 0x308]
push edx
mov ecx, edi
call fcn.0064b900
push eax
lea eax, [esp + 0x128]
push eax
mov ecx, eax
push ecx
call dword [sym.imp.USER32.dll_UnionRect]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x6c]
mov eax, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x38]
push edx
push eax
mov eax, dword [esp + 0x3c]
push ebx
push esi
push ecx
lea edx, [esp + 0x330]
push edx
push eax
lea ecx, [esp + 0x2e8]
push ecx
mov ecx, edi
call fcn.0064b900
push eax
lea edx, [esp + 0x128]
push edx
mov eax, edx
push eax
call dword [sym.imp.USER32.dll_UnionRect]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov eax, dword [edx + 0x6c]
mov edx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x38]
push ecx
push edx
mov edx, dword [esp + 0x3c]
push ebx
push esi
push eax
lea ecx, [esp + 0x340]
push ecx
push edx
lea eax, [esp + 0x208]
push eax
mov ecx, edi
call fcn.0064b900
push eax
lea ecx, [esp + 0x128]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.USER32.dll_UnionRect]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0x6c]
mov ecx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x38]
push eax
push ecx
mov ecx, dword [esp + 0x3c]
push ebx
push esi
push edx
lea eax, [esp + 0x350]
push eax
push ecx
lea edx, [esp + 0x318]
push edx
mov ecx, edi
call fcn.0064b900
push eax
lea eax, [esp + 0x128]
push eax
mov ecx, eax
push ecx
jmp 0x651c02
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x6c]
mov eax, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x38]
push edx
push eax
mov eax, dword [esp + 0x3c]
push ebx
push esi
push ecx
lea edx, [esp + 0x130]
push edx
push eax
lea ecx, [esp + 0x228]
push ecx
mov ecx, edi
call fcn.0064b900
push eax
lea edx, [esp + 0x128]
push edx
mov eax, edx
push eax
call dword [sym.imp.USER32.dll_UnionRect]
mov ecx, dword [edi + 0x24]
add ecx, dword [edi + 0x20]
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x64]
add ebx, ecx
test eax, eax
jne 0x651a40
mov edx, dword [esp + 0xa8]
xor eax, eax
mov dword [esp + 0x5c], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x60], edx
mov dword [esp + 0x40], eax
test eax, eax
je 0x6527fe
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x24]
xor edi, edi
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
je 0x6513a2
mov ecx, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [esi + 0x20]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ecx
cdq
mov ecx, 3
idiv ecx
cmp edx, 1
jne 0x651c7c
mov eax, dword [esp + 0x68]
jmp 0x651ca1
cmp edx, edi
jne 0x651c8d
mov eax, dword [esp + 0x68]
mov edx, dword [esp + 0x3c]
sub eax, dword [edx + 0x1c]
jmp 0x651ca1
mov eax, dword [esp + 0x3c]
mov eax, dword [eax + 0x1c]
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x68]
sar ecx, 1
sub eax, ecx
cmp byte [esi + 0x88], 0
mov dword [esp + 0x5c], eax
je 0x6525aa
mov edx, dword [ebx + 0x6c]
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 4]
mov dword [esp + 0x50], edx
mov dword [esp + 0x154], edi
mov dword [esp + 0x158], edi
mov dword [esp + 0x15c], edi
mov dword [esp + 0x160], edi
cmp ecx, edi
je 0x651ed0
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x6513a2
mov esi, dword [ecx + 8]
cmp byte [esi + 0x91], 0
mov ecx, dword [ecx]
mov dword [esp + 0x4c], ecx
jne 0x651ed0
fld qword [esi + 0xb8]
fadd qword [esi + 0xb0]
fcomp qword [0x404980]
fnstsw ax
test ah, 0x41
jne 0x651ebb
cmp dword [esi + 0x15c], 2
jne 0x651d46
mov edx, dword [esp + 0x50]
cmp edx, dword [esi + 0x160]
jl 0x651ebb
mov eax, dword [esp + 0x3c]
mov edi, dword [eax + 0x20]
sub edi, dword [esi + 0x16c]
movzx ebx, byte [esi + 0xe2]
add edi, dword [esp + 0x60]
cmp dword [esp + 0x28], 0
jle 0x651d86
mov ecx, 0xff
sub ecx, ebx
imul ecx, dword [esp + 0x28]
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ebx, ecx
mov eax, dword [esi + 0xd8]
mov edx, eax
movzx ecx, al
sar edx, 0x10
and edx, 0xff
and eax, 0xff00
shl ecx, 0x10
add edx, ecx
mov ecx, dword [esp + 0x38]
add edx, eax
or eax, 0xffffffff
sub eax, ebx
shl eax, 0x18
or edx, eax
xor eax, eax
push ecx
mov dword [esp + 0x34c], edx
mov edx, dword [esp + 0x38]
push edx
mov dword [esp + 0x358], eax
mov dword [esp + 0x35c], eax
mov dword [esp + 0x360], eax
mov dword [esp + 0x364], eax
mov eax, dword [esp + 0xb8]
push edi
push eax
mov ecx, esi
mov dword [esp + 0x35c], 0xffffffff
call fcn.0064b2d0
mov eax, dword [esi + 0xac]
test eax, eax
jne 0x651e63
cmp byte [esi + 0xe0], al
jne 0x651e1e
cmp byte [esi + 0xe1], al
jne 0x651e1e
cmp dword [esp + 0x28], eax
jne 0x651e1e
mov al, 1
jmp 0x651e20
xor al, al
mov edx, dword [esp + 0xb0]
push 1
push eax
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x350]
push ecx
push edi
push edx
mov edx, dword [esp + 0x40]
push eax
lea ecx, [esp + 0x31c]
push ecx
push edx
lea eax, [esp + 0x2d4]
push eax
mov ecx, esi
call fcn.0066d510
push eax
lea ecx, [esp + 0x158]
push ecx
mov edx, ecx
push edx
jmp 0x651eb1
cmp eax, 1
jne 0x651eb7
mov ecx, dword [esi + 0x158]
test ecx, ecx
je 0x651eb7
mov edx, dword [esp + 0xb0]
push 0
push eax
lea eax, [esp + 0x350]
push eax
mov eax, dword [esp + 0x3c]
push edi
push edx
push eax
mov eax, dword [esp + 0x44]
lea edx, [esp + 0x31c]
push edx
push eax
lea edx, [esp + 0x244]
push edx
call fcn.0066d510
push eax
lea eax, [esp + 0x158]
push eax
mov ecx, eax
push ecx
call dword [sym.imp.USER32.dll_UnionRect]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esi + 0x168]
add dword [esp + 0xb0], edx
test ecx, ecx
jne 0x651ceb
lea eax, [esp + 0x154]
push eax
lea ecx, [esp + 0x128]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.USER32.dll_UnionRect]
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x6c]
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
xor edi, edi
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x74], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x70], edx
mov dword [esp + 0x164], edi
mov dword [esp + 0x168], edi
mov dword [esp + 0x16c], edi
mov dword [esp + 0x170], edi
cmp eax, edi
je 0x652110
jmp 0x651f37
mov eax, dword [esp + 0x44]
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
je 0x6513a2
mov esi, dword [eax + 8]
cmp byte [esi + 0x91], 0
mov edx, dword [eax]
mov dword [esp + 0x44], edx
jne 0x652110
fld qword [esi + 0xb8]
fadd qword [esi + 0xb0]
fcomp qword [0x404980]
fnstsw ax
test ah, 0x41
jne 0x6520fa
cmp dword [esi + 0x15c], 2
jne 0x651f92
mov eax, dword [esp + 0x50]
cmp eax, dword [esi + 0x160]
jl 0x6520fa
mov ecx, dword [esp + 0x3c]
mov edi, dword [ecx + 0x20]
sub edi, dword [esi + 0x16c]
movzx ebx, byte [esi + 0xe2]
add edi, dword [esp + 0x74]
cmp dword [esp + 0x28], 0
jle 0x651fd2
mov ecx, 0xff
sub ecx, ebx
imul ecx, dword [esp + 0x28]
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebx, eax
mov eax, dword [esi + 0xd8]
mov ecx, eax
movzx edx, al
sar ecx, 0x10
and ecx, 0xff
and eax, 0xff00
shl edx, 0x10
add ecx, edx
mov edx, dword [esp + 0x34]
add ecx, eax
or eax, 0xffffffff
sub eax, ebx
shl eax, 0x18
or ecx, eax
mov dword [esp + 0x378], ecx
mov ecx, dword [esp + 0x38]
xor eax, eax
push ecx
push edx
mov dword [esp + 0x388], eax
mov dword [esp + 0x38c], eax
mov dword [esp + 0x390], eax
mov dword [esp + 0x394], eax
mov eax, dword [esp + 0x78]
push edi
push eax
mov ecx, esi
mov dword [esp + 0x38c], 0xffffffff
call fcn.0064b2d0
mov eax, dword [esi + 0xac]
test eax, eax
jne 0x6520a9
cmp byte [esi + 0xe0], al
jne 0x652067
cmp byte [esi + 0xe1], al
jne 0x652067
cmp dword [esp + 0x28], eax
jne 0x652067
mov al, 1
jmp 0x652069
xor al, al
mov edx, dword [esp + 0x70]
push 1
push eax
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x380]
push ecx
push edi
push edx
mov edx, dword [esp + 0x40]
push eax
lea ecx, [esp + 0x32c]
push ecx
push edx
lea eax, [esp + 0x2f4]
push eax
mov ecx, esi
call fcn.0066d510
push eax
lea ecx, [esp + 0x168]
push ecx
mov edx, ecx
push edx
jmp 0x6520f4
cmp eax, 1
jne 0x6520fa
mov ecx, dword [esi + 0x158]
test ecx, ecx
je 0x6520fa
mov edx, dword [esp + 0x70]
push 0
push eax
lea eax, [esp + 0x380]
push eax
mov eax, dword [esp + 0x3c]
push edi
push edx
push eax
mov eax, dword [esp + 0x44]
lea edx, [esp + 0x32c]
push edx
push eax
lea edx, [esp + 0x264]
push edx
call fcn.0066d510
push eax
lea eax, [esp + 0x168]
push eax
mov ecx, eax
push ecx
call dword [sym.imp.USER32.dll_UnionRect]
mov edx, dword [esi + 0x168]
add dword [esp + 0x70], edx
xor edi, edi
cmp dword [esp + 0x44], edi
jne 0x651f33
lea eax, [esp + 0x164]
push eax
lea ecx, [esp + 0x128]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.USER32.dll_UnionRect]
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x6c]
mov eax, dword [esp + 0x3c]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x50], ecx
mov dword [esp + 0xb8], edx
mov dword [esp + 0x174], edi
mov dword [esp + 0x178], edi
mov dword [esp + 0x17c], edi
mov dword [esp + 0x180], edi
cmp eax, edi
je 0x652358
jmp 0x652174
mov eax, dword [esp + 0x44]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x6513a2
mov esi, dword [eax + 8]
cmp byte [esi + 0x91], 0
mov ecx, dword [eax]
mov dword [esp + 0x44], ecx
jne 0x652358
fld qword [esi + 0xb8]
fadd qword [esi + 0xb0]
fcomp qword [0x404980]
fnstsw ax
test ah, 0x41
jne 0x652340
cmp dword [esi + 0x15c], 2
jne 0x6521cf
mov edx, dword [esp + 0x50]
cmp edx, dword [esi + 0x160]
jl 0x652340
mov eax, dword [esp + 0x3c]
mov edi, dword [eax + 0x20]
sub edi, dword [esi + 0x16c]
movzx ebx, byte [esi + 0xe2]
add edi, dword [esp + 0x60]
cmp dword [esp + 0x28], 0
jle 0x65220f
mov ecx, 0xff
sub ecx, ebx
imul ecx, dword [esp + 0x28]
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ebx, ecx
mov eax, dword [esi + 0xd8]
mov edx, eax
movzx ecx, al
sar edx, 0x10
and edx, 0xff
and eax, 0xff00
shl ecx, 0x10
add edx, ecx
mov ecx, dword [esp + 0x38]
add edx, eax
or eax, 0xffffffff
sub eax, ebx
shl eax, 0x18
or edx, eax
xor eax, eax
push ecx
mov dword [esp + 0x3ac], edx
mov edx, dword [esp + 0x38]
push edx
mov dword [esp + 0x3b8], eax
mov dword [esp + 0x3bc], eax
mov dword [esp + 0x3c0], eax
mov dword [esp + 0x3c4], eax
mov eax, dword [esp + 0xc0]
push edi
push eax
mov ecx, esi
mov dword [esp + 0x3bc], 0xffffffff
call fcn.0064b2d0
mov eax, dword [esi + 0xac]
test eax, eax
jne 0x6522ec
cmp byte [esi + 0xe0], al
jne 0x6522a7
cmp byte [esi + 0xe1], al
jne 0x6522a7
cmp dword [esp + 0x28], eax
jne 0x6522a7
mov al, 1
jmp 0x6522a9
xor al, al
mov edx, dword [esp + 0xb8]
push 1
push eax
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x3b0]
push ecx
push edi
push edx
mov edx, dword [esp + 0x40]
push eax
lea ecx, [esp + 0x33c]
push ecx
push edx
lea eax, [esp + 0x2b4]
push eax
mov ecx, esi
call fcn.0066d510
push eax
lea ecx, [esp + 0x178]
push ecx
mov edx, ecx
push edx
jmp 0x65233a
cmp eax, 1
jne 0x652340
mov ecx, dword [esi + 0x158]
test ecx, ecx
je 0x652340
mov edx, dword [esp + 0xb8]
push 0
push eax
lea eax, [esp + 0x3b0]
push eax
mov eax, dword [esp + 0x3c]
push edi
push edx
push eax
mov eax, dword [esp + 0x44]
lea edx, [esp + 0x33c]
push edx
push eax
lea edx, [esp + 0x1d4]
push edx
call fcn.0066d510
push eax
lea eax, [esp + 0x178]
push eax
mov ecx, eax
push ecx
call dword [sym.imp.USER32.dll_UnionRect]
mov edx, dword [esi + 0x168]
add dword [esp + 0xb8], edx
cmp dword [esp + 0x44], 0
jne 0x652170
lea eax, [esp + 0x174]
push eax
lea ecx, [esp + 0x128]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.USER32.dll_UnionRect]
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x6c]
mov eax, dword [esp + 0x3c]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x50], ecx
xor ecx, ecx
mov dword [esp + 0x90], edx
mov dword [esp + 0x184], ecx
mov dword [esp + 0x188], ecx
mov dword [esp + 0x18c], ecx
mov dword [esp + 0x190], ecx
cmp eax, ecx
je 0x65259e
jmp 0x6523ba
mov eax, dword [esp + 0x44]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x6513a2
mov esi, dword [eax + 8]
cmp byte [esi + 0x91], 0
mov ecx, dword [eax]
mov dword [esp + 0x44], ecx
jne 0x65259e
fld qword [esi + 0xb8]
fadd qword [esi + 0xb0]
fcomp qword [0x404980]
fnstsw ax
test ah, 0x41
jne 0x652586
cmp dword [esi + 0x15c], 2
jne 0x652415
mov edx, dword [esp + 0x50]
cmp edx, dword [esi + 0x160]
jl 0x652586
mov eax, dword [esp + 0x3c]
mov edi, dword [eax + 0x20]
sub edi, dword [esi + 0x16c]
movzx ebx, byte [esi + 0xe2]
add edi, dword [esp + 0x60]
cmp dword [esp + 0x28], 0
jle 0x652455
mov ecx, 0xff
sub ecx, ebx
imul ecx, dword [esp + 0x28]
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ebx, ecx
mov eax, dword [esi + 0xd8]
mov edx, eax
movzx ecx, al
sar edx, 0x10
and edx, 0xff
and eax, 0xff00
shl ecx, 0x10
add edx, ecx
mov ecx, dword [esp + 0x38]
add edx, eax
or eax, 0xffffffff
sub eax, ebx
shl eax, 0x18
or edx, eax
xor eax, eax
push ecx
mov dword [esp + 0x394], edx
mov edx, dword [esp + 0x38]
push edx
mov dword [esp + 0x3a0], eax
mov dword [esp + 0x3a4], eax
mov dword [esp + 0x3a8], eax
mov dword [esp + 0x3ac], eax
mov eax, dword [esp + 0x98]
push edi
push eax
mov ecx, esi
mov dword [esp + 0x3a4], 0xffffffff
call fcn.0064b2d0
mov eax, dword [esi + 0xac]
test eax, eax
jne 0x652532
cmp byte [esi + 0xe0], al
jne 0x6524ed
cmp byte [esi + 0xe1], al
jne 0x6524ed
cmp dword [esp + 0x28], eax
jne 0x6524ed
mov al, 1
jmp 0x6524ef
xor al, al
mov edx, dword [esp + 0x90]
push 1
push eax
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x398]
push ecx
push edi
push edx
mov edx, dword [esp + 0x40]
push eax
lea ecx, [esp + 0x34c]
push ecx
push edx
lea eax, [esp + 0x2c4]
push eax
mov ecx, esi
call fcn.0066d510
push eax
lea ecx, [esp + 0x188]
push ecx
mov edx, ecx
push edx
jmp 0x652580
cmp eax, 1
jne 0x652586
mov ecx, dword [esi + 0x158]
test ecx, ecx
je 0x652586
mov edx, dword [esp + 0x90]
push 0
push eax
lea eax, [esp + 0x398]
push eax
mov eax, dword [esp + 0x3c]
push edi
push edx
push eax
mov eax, dword [esp + 0x44]
lea edx, [esp + 0x34c]
push edx
push eax
lea edx, [esp + 0x2a4]
push edx
call fcn.0066d510
push eax
lea eax, [esp + 0x188]
push eax
mov ecx, eax
push ecx
call dword [sym.imp.USER32.dll_UnionRect]
mov edx, dword [esi + 0x168]
add dword [esp + 0x90], edx
cmp dword [esp + 0x44], 0
jne 0x6523b6
lea eax, [esp + 0x184]
jmp 0x6527cf
mov ecx, dword [ebx + 0x6c]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x50], ecx
mov ecx, dword [edx + 4]
mov dword [esp + 0x88], eax
mov dword [esp + 0x194], edi
mov dword [esp + 0x198], edi
mov dword [esp + 0x19c], edi
mov dword [esp + 0x1a0], edi
cmp ecx, edi
je 0x6527c8
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x6513a2
mov esi, dword [ecx + 8]
cmp byte [esi + 0x91], 0
mov ecx, dword [ecx]
mov dword [esp + 0x4c], ecx
jne 0x6527c8
fld qword [esi + 0xb8]
fadd qword [esi + 0xb0]
fcomp qword [0x404980]
fnstsw ax
test ah, 0x41
jne 0x6527b3
cmp dword [esi + 0x15c], 2
jne 0x65263e
mov eax, dword [esp + 0x50]
cmp eax, dword [esi + 0x160]
jl 0x6527b3
mov ecx, dword [esp + 0x3c]
mov edi, dword [ecx + 0x20]
sub edi, dword [esi + 0x16c]
movzx ebx, byte [esi + 0xe2]
add edi, dword [esp + 0x60]
cmp dword [esp + 0x28], 0
jle 0x65267e
mov ecx, 0xff
sub ecx, ebx
imul ecx, dword [esp + 0x28]
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebx, eax
mov eax, dword [esi + 0xd8]
mov ecx, eax
movzx edx, al
sar ecx, 0x10
and ecx, 0xff
and eax, 0xff00
shl edx, 0x10
add ecx, edx
mov edx, dword [esp + 0x34]
add ecx, eax
or eax, 0xffffffff
sub eax, ebx
shl eax, 0x18
or ecx, eax
mov dword [esp + 0x360], ecx
mov ecx, dword [esp + 0x38]
xor eax, eax
push ecx
push edx
mov dword [esp + 0x370], eax
mov dword [esp + 0x374], eax
mov dword [esp + 0x378], eax
mov dword [esp + 0x37c], eax
mov eax, dword [esp + 0x90]
push edi
push eax
mov ecx, esi
mov dword [esp + 0x374], 0xffffffff
call fcn.0064b2d0
mov eax, dword [esi + 0xac]
test eax, eax
jne 0x65275b
cmp byte [esi + 0xe0], al
jne 0x652716
cmp byte [esi + 0xe1], al
jne 0x652716
cmp dword [esp + 0x28], eax
jne 0x652716
mov al, 1
jmp 0x652718
xor al, al
mov edx, dword [esp + 0x88]
push 1
push eax
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x368]
push ecx
push edi
push edx
mov edx, dword [esp + 0x40]
push eax
lea ecx, [esp + 0x12c]
push ecx
push edx
lea eax, [esp + 0x1e4]
push eax
mov ecx, esi
call fcn.0066d510
push eax
lea ecx, [esp + 0x198]
push ecx
mov edx, ecx
push edx
jmp 0x6527a9
cmp eax, 1
jne 0x6527af
mov ecx, dword [esi + 0x158]
test ecx, ecx
je 0x6527af
mov edx, dword [esp + 0x88]
push 0
push eax
lea eax, [esp + 0x368]
push eax
mov eax, dword [esp + 0x3c]
push edi
push edx
push eax
mov eax, dword [esp + 0x44]
lea edx, [esp + 0x12c]
push edx
push eax
lea edx, [esp + 0x1f4]
push edx
call fcn.0066d510
push eax
lea eax, [esp + 0x198]
push eax
mov ecx, eax
push ecx
call dword [sym.imp.USER32.dll_UnionRect]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esi + 0x168]
add dword [esp + 0x88], edx
test ecx, ecx
jne 0x6525e3
lea eax, [esp + 0x194]
push eax
lea ecx, [esp + 0x128]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.USER32.dll_UnionRect]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0x24]
add ecx, dword [eax + 0x20]
mov esi, dword [esp + 0x64]
add dword [esp + 0x60], ecx
cmp dword [esp + 0x40], 0
jne 0x651c40
mov ebx, dword [esp + 0xa8]
xor eax, eax
mov dword [esp + 0x5c], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x40], eax
test eax, eax
je 0x652a00
jmp 0x652824
mov esi, dword [esp + 0x64]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x6513a2
mov edx, dword [eax]
mov edi, dword [eax + 8]
mov eax, dword [esi + 0x20]
mov dword [esp + 0x40], edx
cdq
mov ecx, 3
idiv ecx
mov esi, dword [esp + 0x68]
cmp edx, 1
je 0x652863
test edx, edx
jne 0x652859
sub esi, dword [edi + 0x1c]
jmp 0x652863
mov eax, dword [edi + 0x1c]
cdq
sub eax, edx
sar eax, 1
sub esi, eax
mov edx, dword [esp + 0x64]
cmp byte [edx + 0x88], 0
je 0x6529a0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0x6c]
mov ecx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x38]
push eax
push ecx
mov ecx, dword [esp + 0x3c]
push ebx
push esi
push edx
lea eax, [esp + 0x320]
push eax
push ecx
lea edx, [esp + 0x218]
push edx
mov ecx, edi
call fcn.0064bba0
push eax
lea eax, [esp + 0x128]
push eax
mov ecx, eax
push ecx
call dword [sym.imp.USER32.dll_UnionRect]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x6c]
mov eax, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x38]
push edx
push eax
mov eax, dword [esp + 0x3c]
push ebx
push esi
push ecx
lea edx, [esp + 0x330]
push edx
push eax
lea ecx, [esp + 0x238]
push ecx
mov ecx, edi
call fcn.0064bba0
push eax
lea edx, [esp + 0x128]
push edx
mov eax, edx
push eax
call dword [sym.imp.USER32.dll_UnionRect]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov eax, dword [edx + 0x6c]
mov edx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x38]
push ecx
push edx
mov edx, dword [esp + 0x3c]
push ebx
push esi
push eax
lea ecx, [esp + 0x340]
push ecx
push edx
lea eax, [esp + 0x258]
push eax
mov ecx, edi
call fcn.0064bba0
push eax
lea ecx, [esp + 0x128]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.USER32.dll_UnionRect]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0x6c]
mov ecx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x38]
push eax
push ecx
mov ecx, dword [esp + 0x3c]
push ebx
push esi
push edx
lea eax, [esp + 0x350]
push eax
push ecx
lea edx, [esp + 0x278]
push edx
mov ecx, edi
call fcn.0064bba0
push eax
lea eax, [esp + 0x128]
push eax
mov ecx, eax
push ecx
jmp 0x6529e6
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x6c]
mov eax, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x38]
push edx
push eax
mov eax, dword [esp + 0x3c]
push ebx
push esi
push ecx
lea edx, [esp + 0x130]
push edx
push eax
lea ecx, [esp + 0x298]
push ecx
mov ecx, edi
call fcn.0064bba0
push eax
lea edx, [esp + 0x128]
push edx
mov eax, edx
push eax
call dword [sym.imp.USER32.dll_UnionRect]
mov ecx, dword [edi + 0x24]
add ecx, dword [edi + 0x20]
mov eax, dword [esp + 0x40]
add ebx, ecx
test eax, eax
jne 0x652820
mov eax, dword [esp + 0xf0]
add eax, 0xfffffff0
mov byte [esp + 0x400], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x652a2b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xec]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x652a4e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xe8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x652a71
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xe0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x652a94
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x7c]
inc eax
mov dword [esp + 0x58], eax
cmp eax, ecx
jl 0x6512e6
mov edi, ecx
xor ebx, ebx
mov eax, dword [esp + 0xcc]
mov ecx, dword [esp + 0x124]
mov edx, dword [esp + 0x128]
mov dword [eax], ecx
mov ecx, dword [esp + 0x12c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x130]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
cmp edi, ebx
je 0x652af5
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x652af5
xor esi, esi
jmp 0x652afa
mov esi, 1
mov eax, dword [esp + 0x78]
cmp eax, ebx
je 0x652b0b
push eax
call fcn.00803053
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x3f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3b0]
xor ecx, esp
call fcn.0080262b
mov esp, ebp
pop ebp
ret 0x1c