### FUNC 180017200 - 180017329 (297 bytes) name=sub_180017200
180017200: mov     [rsp+arg_8], rbx
180017205: mov     [rsp+arg_10], rbp
18001720A: mov     [rsp+arg_18], rsi
18001720F: push    rdi
180017210: push    r13
180017212: push    r14
180017214: push    r15
180017216: mov     rbp, [rcx+41858h]
18001721D: mov     rsi, rdx
180017220: xor     edx, edx
180017222: cmp     [rcx+41F0Ch], edx
180017228: jz      short loc_180017233
18001722A: mov     rdi, [rcx+41EF0h]
180017231: jmp     short loc_180017236
180017233: mov     rdi, rdx
180017236: mov     ebx, [rcx+47938h]
18001723C: mov     r10d, [rcx+41554h]
180017243: mov     r13, [rcx+41870h]
18001724A: mov     r14d, [rcx+11Ch]
180017251: mov     r11, [rcx+270h]
180017258: sub     r10d, 1
18001725C: test    ebx, ebx
18001725E: lea     r15d, [rbx+rbx]
180017262: jz      loc_180017312
180017268: mov     [rsp+20h+arg_0], r12
18001726D: mov     r12d, r10d
180017270: add     r12, r12
180017273: nop
180017274: xchg    ax, ax
180017278: xchg    ax, ax
18001727C: xchg    ax, ax
180017280: movzx   eax, word ptr [rdi]
180017283: movzx   r8d, word ptr [rsi]
180017287: add     rdi, 2
18001728B: sub     r8d, eax
18001728E: add     rsi, 2
180017292: sar     r8d, 1
180017295: test    r10d, r10d
180017298: jz      short loc_1800172B4
18001729A: mov     rcx, rbp
18001729D: xchg    ax, ax
1800172A0: movsx   eax, word ptr [rcx]
1800172A3: cmp     r8d, eax
1800172A6: jle     short loc_1800172B4
1800172A8: add     edx, 1
1800172AB: add     rcx, 2
1800172AF: cmp     edx, r10d
1800172B2: jb      short loc_1800172A0
1800172B4: imul    edx, r15d
1800172B8: mov     ecx, r14d
1800172BB: add     rbp, r12
1800172BE: movzx   r9d, word ptr [r13+rdx*2+0]
1800172C4: movzx   eax, word ptr [r13+rdx*2+2]
1800172CA: lea     rdx, [r13+rdx*2+0]
1800172CF: imul    r9d, r8d
1800172D3: sar     r9d, cl
1800172D6: add     r13, 4
1800172DA: add     r9d, eax
1800172DD: cmp     r9d, 0FFFFh
1800172E4: jle     short loc_1800172F0
1800172E6: xor     edx, edx
1800172E8: mov     r9d, 0FFFFh
1800172EE: jmp     short loc_1800172FC
1800172F0: test    r9d, r9d
1800172F3: mov     edx, 0
1800172F8: cmovs   r9d, edx
1800172FC: mov     [r11], r9w
180017300: add     r11, 2
180017304: add     ebx, 0FFFFFFFFh
180017307: jnz     loc_180017280
18001730D: mov     r12, [rsp+20h+arg_0]
180017312: mov     rbx, [rsp+20h+arg_8]
180017317: mov     rbp, [rsp+20h+arg_10]
18001731C: mov     rsi, [rsp+20h+arg_18]
180017321: pop     r15
180017323: pop     r14
180017325: pop     r13
180017327: pop     rdi
180017328: retn

  data refs from:
    180066084
    180066098
    1800DD044
  code refs from:
    18000C9A2 (func 18000C950)
    18000C9FA (func 18000C950)

==================================================================

### FUNC 180017330 - 18001759C (620 bytes) name=sub_180017330
180017330: push    rbx
180017332: mov     eax, [rcx+41840h]
180017338: mov     r9, [rcx+41878h]
18001733F: xor     r11d, r11d
180017342: mov     ebx, [rcx+rax*4+41654h]
180017349: mov     r10, rdx
18001734C: test    ebx, ebx
18001734E: jz      loc_180017581
180017354: mov     [rsp+8+arg_0], rdi
180017359: lea     rdi, __ImageBase
180017360: mov     eax, [r9+4]
180017364: add     eax, 0FFFFFFFDh; switch 6 cases
180017367: cmp     eax, 5
18001736A: ja      def_18001737A; jumptable 000000018001737A default case
180017370: mov     ecx, ds:(jpt_18001737A - 180000000h)[rdi+rax*4]
180017377: add     rcx, rdi
18001737A: jmp     rcx; switch jump
18001737C: mov     eax, [r9+20h]; jumptable 000000018001737A case 8
180017380: movzx   edx, word ptr [r10+rax*2]
180017385: mov     eax, [r9+1Ch]
180017389: movzx   ecx, word ptr [r10+rax*2]
18001738E: mov     eax, [r9+18h]
180017392: add     edx, ecx
180017394: movzx   ecx, word ptr [r10+rax*2]
180017399: mov     eax, [r9+14h]
18001739D: add     edx, ecx
18001739F: movzx   ecx, word ptr [r10+rax*2]
1800173A4: mov     eax, [r9+10h]
1800173A8: add     edx, ecx
1800173AA: movzx   ecx, word ptr [r10+rax*2]
1800173AF: mov     eax, [r9+0Ch]
1800173B3: add     edx, ecx
1800173B5: movzx   ecx, word ptr [r10+rax*2]
1800173BA: mov     eax, [r9+8]
1800173BE: add     edx, ecx
1800173C0: movzx   ecx, word ptr [r10+rax*2]
1800173C5: mov     eax, [r9+24h]
1800173C9: add     edx, ecx
1800173CB: movzx   ecx, word ptr [r10+rax*2]
1800173D0: mov     eax, [r9]
1800173D3: add     edx, ecx
1800173D5: sar     edx, 3
1800173D8: mov     [r10+rax*2], dx
1800173DD: jmp     loc_18001756B
1800173E2: mov     eax, [r9+20h]; jumptable 000000018001737A case 7
1800173E6: movzx   r8d, word ptr [r10+rax*2]
1800173EB: mov     eax, [r9+1Ch]
1800173EF: movzx   ecx, word ptr [r10+rax*2]
1800173F4: mov     eax, [r9+18h]
1800173F8: add     r8d, ecx
1800173FB: movzx   ecx, word ptr [r10+rax*2]
180017400: mov     eax, [r9+14h]
180017404: add     r8d, ecx
180017407: movzx   ecx, word ptr [r10+rax*2]
18001740C: mov     eax, [r9+10h]
180017410: add     r8d, ecx
180017413: movzx   ecx, word ptr [r10+rax*2]
180017418: mov     eax, [r9+0Ch]
18001741C: add     r8d, ecx
18001741F: movzx   ecx, word ptr [r10+rax*2]
180017424: mov     eax, [r9+8]
180017428: add     r8d, ecx
18001742B: movzx   ecx, word ptr [r10+rax*2]
180017430: mov     eax, 92492493h
180017435: add     r8d, ecx
180017438: imul    r8d
18001743B: add     edx, r8d
18001743E: sar     edx, 2
180017441: mov     eax, edx
180017443: shr     eax, 1Fh
180017446: add     edx, eax
180017448: mov     eax, [r9]
18001744B: mov     [r10+rax*2], dx
180017450: jmp     loc_18001756B
180017455: mov     eax, [r9+1Ch]; jumptable 000000018001737A case 6
180017459: movzx   edx, word ptr [r10+rax*2]
18001745E: mov     eax, [r9+18h]
180017462: movzx   ecx, word ptr [r10+rax*2]
180017467: mov     eax, [r9+14h]
18001746B: add     edx, ecx
18001746D: movzx   ecx, word ptr [r10+rax*2]
180017472: mov     eax, [r9+10h]
180017476: add     edx, ecx
180017478: movzx   ecx, word ptr [r10+rax*2]
18001747D: mov     eax, [r9+0Ch]
180017481: add     edx, ecx
180017483: movzx   ecx, word ptr [r10+rax*2]
180017488: mov     eax, [r9+8]
18001748C: add     edx, ecx
18001748E: movzx   ecx, word ptr [r10+rax*2]
180017493: mov     eax, 2AAAAAABh
180017498: add     edx, ecx
18001749A: imul    edx
18001749C: mov     eax, edx
18001749E: shr     eax, 1Fh
1800174A1: add     edx, eax
1800174A3: mov     eax, [r9]
1800174A6: mov     [r10+rax*2], dx
1800174AB: jmp     loc_18001756B
1800174B0: mov     eax, [r9+18h]; jumptable 000000018001737A case 5
1800174B4: movzx   edx, word ptr [r10+rax*2]
1800174B9: mov     eax, [r9+14h]
1800174BD: movzx   ecx, word ptr [r10+rax*2]
1800174C2: mov     eax, [r9+10h]
1800174C6: add     edx, ecx
1800174C8: movzx   ecx, word ptr [r10+rax*2]
1800174CD: mov     eax, [r9+0Ch]
1800174D1: add     edx, ecx
1800174D3: movzx   ecx, word ptr [r10+rax*2]
1800174D8: mov     eax, [r9+8]
1800174DC: add     edx, ecx
1800174DE: movzx   ecx, word ptr [r10+rax*2]
1800174E3: mov     eax, 66666667h
1800174E8: add     edx, ecx
1800174EA: imul    edx
1800174EC: sar     edx, 1
1800174EE: mov     eax, edx
1800174F0: shr     eax, 1Fh
1800174F3: add     edx, eax
1800174F5: mov     eax, [r9]
1800174F8: mov     [r10+rax*2], dx
1800174FD: jmp     short loc_18001756B
1800174FF: mov     eax, [r9+14h]; jumptable 000000018001737A case 4
180017503: movzx   edx, word ptr [r10+rax*2]
180017508: mov     eax, [r9+10h]
18001750C: movzx   ecx, word ptr [r10+rax*2]
180017511: mov     eax, [r9+0Ch]
180017515: add     edx, ecx
180017517: movzx   ecx, word ptr [r10+rax*2]
18001751C: mov     eax, [r9+8]
180017520: add     edx, ecx
180017522: movzx   ecx, word ptr [r10+rax*2]
180017527: mov     eax, [r9]
18001752A: add     edx, ecx
18001752C: sar     edx, 2
18001752F: mov     [r10+rax*2], dx
180017534: jmp     short loc_18001756B
180017536: mov     eax, [r9+10h]; jumptable 000000018001737A case 3
18001753A: movzx   edx, word ptr [r10+rax*2]
18001753F: mov     eax, [r9+0Ch]
180017543: movzx   ecx, word ptr [r10+rax*2]
180017548: mov     eax, [r9+8]
18001754C: add     edx, ecx
18001754E: movzx   ecx, word ptr [r10+rax*2]
180017553: mov     eax, 55555556h
180017558: add     edx, ecx
18001755A: imul    edx
18001755C: mov     eax, edx
18001755E: shr     eax, 1Fh
180017561: add     edx, eax
180017563: mov     eax, [r9]
180017566: mov     [r10+rax*2], dx
18001756B: add     r11d, 1
18001756F: add     r9, 28h ; '('
180017573: cmp     r11d, ebx
180017576: jb      loc_180017360
18001757C: mov     rdi, [rsp+8+arg_0]; jumptable 000000018001737A default case
180017581: pop     rbx
180017582: retn
180017583: align 4
180017584: dd offset loc_180017536 - 180000000h; jump table for switch statement

  data refs from:
    180065AB8
    180065AC8
    180065ADC
    1800DD068
  code refs from:
    18000C9B1 (func 18000C950)
    18000CA09 (func 18000C950)

==================================================================

### FUNC 180016AE0 - 180016D5E (638 bytes) name=sub_180016AE0
180016AE0: mov     rax, rsp
180016AE3: push    r12
180016AE5: push    r13
180016AE7: push    r14
180016AE9: sub     rsp, 60h
180016AED: mov     [rsp+78h+var_58], 0FFFFFFFFFFFFFFFEh
180016AF6: mov     [rax+8], rbx
180016AFA: mov     [rax+10h], rsi
180016AFE: mov     [rax+18h], rdi
180016B02: mov     rbx, rcx
180016B05: xor     r14d, r14d
180016B08: mov     [rcx+41348h], r14d
180016B0F: mov     edi, r14d
180016B12: cmp     dword ptr [rcx+41558h], 2
180016B19: jz      short loc_180016B3D
180016B1B: mov     edx, [rcx+54h]
180016B1E: add     rcx, 41568h
180016B25: cmp     edx, [rcx]
180016B27: jle     short loc_180016B3D
180016B29: add     edi, 1
180016B2C: add     rcx, 4
180016B30: mov     eax, [rbx+41558h]
180016B36: sub     eax, 2
180016B39: cmp     edi, eax
180016B3B: jb      short loc_180016B25
180016B3D: mov     [rbx+41840h], edi
180016B43: mov     eax, [rbx+41554h]
180016B49: lea     ecx, [rax+rax*2-1]
180016B4D: imul    ecx, [rbx+47938h]
180016B54: mov     eax, [rbx+41560h]
180016B5A: lea     r13d, [rax+rcx*2]
180016B5E: add     r13d, [rbx+4155Ch]
180016B65: mov     eax, [rbx+41840h]
180016B6B: add     eax, 1
180016B6E: cmp     edi, eax
180016B70: ja      loc_180016CC6
180016B76: mov     esi, edi
180016B78: cmp     dword ptr [rbx+rsi*4+416B8h], 0
180016B80: jnz     loc_180016CBE
180016B86: lea     rcx, [rsp+78h+var_38]; this
180016B8B: call    ??0CFile@@QEAA@XZ; CFile::CFile(void)
180016B90: nop
180016B91: lea     rdx, [rbx+4134Ch]; wchar_t *
180016B98: xor     r9d, r9d; struct CFileException *
180016B9B: lea     r8d, [r9+40h]; unsigned int
180016B9F: lea     rcx, [rsp+78h+var_38]; this
180016BA4: call    ?Open@CFile@@UEAAHPEB_WIPEAVCFileException@@@Z; CFile::Open(wchar_t const *,uint,CFileException *)
180016BA9: test    eax, eax
180016BAB: jnz     short loc_180016BBC
180016BAD: lea     rcx, [rsp+78h+var_38]; this
180016BB2: call    ??1CFile@@UEAA@XZ; CFile::~CFile(void)
180016BB7: jmp     loc_180016D43
180016BBC: lea     rcx, [rsp+78h+var_48]; this
180016BC1: call    ??0AFX_EXCEPTION_LINK@@QEAA@XZ; AFX_EXCEPTION_LINK::AFX_EXCEPTION_LINK(void)
180016BC6: nop
180016BC7: mov     edx, [rbx+rsi*4+41708h]; __int64
180016BCE: xor     r8d, r8d; unsigned int
180016BD1: lea     rcx, [rsp+78h+var_38]; this
180016BD6: call    ?Seek@CFile@@UEAA_K_JI@Z; CFile::Seek(__int64,uint)
180016BDB: mov     edx, [rbx+rsi*4+41758h]
180016BE2: add     rdx, [rbx+416A0h]; void *
180016BE9: mov     r8d, r13d; unsigned int
180016BEC: lea     rcx, [rsp+78h+var_38]; this
180016BF1: call    ?Read@CFile@@UEAAIPEAXI@Z; CFile::Read(void *,uint)
180016BF6: mov     r12d, 1
180016BFC: cmp     eax, r13d
180016BFF: cmovnz  r12d, r14d
180016C03: cmp     dword ptr [rbx+rsi*4+41654h], 0
180016C0B: jbe     short loc_180016C6F
180016C0D: mov     eax, [rbx+41558h]
180016C13: sub     eax, 2
180016C16: cmp     edi, eax
180016C18: ja      short loc_180016C6F
180016C1A: mov     edx, [rbx+rsi*4+417A8h]; __int64
180016C21: xor     r8d, r8d; unsigned int
180016C24: lea     rcx, [rsp+78h+var_38]; this
180016C29: call    ?Seek@CFile@@UEAA_K_JI@Z; CFile::Seek(__int64,uint)
180016C2E: mov     eax, [rbx+rsi*4+41654h]
180016C35: lea     r8d, [rax+rax*4]
180016C39: shl     r8d, 3; unsigned int
180016C3D: mov     edx, [rbx+rsi*4+417F4h]
180016C44: add     rdx, [rbx+416B0h]; void *
180016C4B: lea     rcx, [rsp+78h+var_38]; this
180016C50: call    ?Read@CFile@@UEAAIPEAXI@Z; CFile::Read(void *,uint)
180016C55: mov     ecx, [rbx+rsi*4+41654h]
180016C5C: lea     edx, [rcx+rcx*4]
180016C5F: lea     ecx, [rdx+rdx]
180016C62: shl     rcx, 2
180016C66: mov     eax, eax
180016C68: cmp     rax, rcx
180016C6B: cmovnz  r12d, r14d
180016C6F: call    ?AfxTryCleanup@@YAXXZ; AfxTryCleanup(void)
180016C74: lea     rcx, [rsp+78h+var_38]; this
180016C79: call    ?Close@CFile@@UEAAXXZ; CFile::Close(void)
180016C7E: test    r12d, r12d
180016C81: jz      short loc_180016C9A
180016C83: mov     dword ptr [rbx+rsi*4+416B8h], 1
180016C8E: lea     rcx, [rsp+78h+var_38]; this
180016C93: call    ??1CFile@@UEAA@XZ; CFile::~CFile(void)
180016C98: jmp     short loc_180016CBE
180016C9A: lea     rcx, [rsp+78h+var_38]; this
180016C9F: call    ??1CFile@@UEAA@XZ; CFile::~CFile(void)
180016CA4: jmp     loc_180016D43
180016CA9: call    ?AfxTryCleanup@@YAXXZ; AfxTryCleanup(void)
180016CAE: nop
180016CAF: lea     rcx, [rsp+78h+var_38]; this
180016CB4: call    ??1CFile@@UEAA@XZ; CFile::~CFile(void)
180016CB9: jmp     loc_180016D43
180016CBE: add     edi, 1
180016CC1: jmp     loc_180016B65
180016CC6: mov     r9d, [rbx+41840h]
180016CCD: mov     r8, [rbx+416A0h]
180016CD4: mov     ecx, [rbx+r9*4+41758h]
180016CDC: add     rcx, r8
180016CDF: mov     [rbx+41848h], rcx
180016CE6: mov     edx, [rbx+41554h]
180016CEC: sub     edx, 1
180016CEF: imul    edx, [rbx+47938h]
180016CF6: mov     eax, [rbx+4155Ch]
180016CFC: shr     rax, 1
180016CFF: add     rdx, rax
180016D02: lea     rax, [rcx+rdx*2]
180016D06: mov     [rbx+41860h], rax
180016D0D: lea     eax, [r9+1]
180016D11: mov     ecx, [rbx+rax*4+41758h]
180016D18: add     rcx, r8
180016D1B: mov     [rbx+41850h], rcx
180016D22: lea     rax, [rcx+rdx*2]
180016D26: mov     [rbx+41868h], rax
180016D2D: mov     eax, [rbx+r9*4+417F4h]
180016D35: add     rax, [rbx+416B0h]
180016D3C: mov     [rbx+41878h], rax
180016D43: lea     r11, [rsp+78h+var_18]
180016D48: mov     rbx, [r11+20h]
180016D4C: mov     rsi, [r11+28h]
180016D50: mov     rdi, [r11+30h]
180016D54: mov     rsp, r11
180016D57: pop     r14
180016D59: pop     r13
180016D5B: pop     r12
180016D5D: retn

  data refs from:
    180066134
    1800DCFE4
  code refs from:
    18000C7A3 (func 18000C760)

==================================================================

### FUNC 180016DD0 - 180016F0C (316 bytes) name=sub_180016DD0
180016DD0: mov     [rsp+arg_0], rbx
180016DD5: mov     [rsp+arg_8], rsi
180016DDA: mov     [rsp+arg_10], rdi
180016DDF: mov     edi, [rcx+54h]
180016DE2: xor     esi, esi
180016DE4: mov     r10, r8
180016DE7: cmp     edi, [rcx+41564h]
180016DED: mov     r11, rdx
180016DF0: mov     rbx, rcx
180016DF3: jl      short loc_180016E07
180016DF5: mov     eax, [rcx+41558h]
180016DFB: sub     eax, 1
180016DFE: cmp     edi, [rcx+rax*4+41564h]
180016E05: jle     short loc_180016E0C
180016E07: mov     esi, 1
180016E0C: mov     ecx, [rcx+41840h]
180016E12: mov     r8d, [rbx+rcx*4+41564h]
180016E1A: add     ecx, 1
180016E1D: mov     ecx, [rbx+rcx*4+41564h]
180016E24: sub     edi, r8d
180016E27: sub     ecx, r8d
180016E2A: shl     edi, 0Ch
180016E2D: mov     eax, edi
180016E2F: cdq
180016E30: idiv    ecx
180016E32: cmp     eax, 4000h
180016E37: mov     r8d, eax
180016E3A: jl      short loc_180016E44
180016E3C: mov     r8d, 3FFFh
180016E42: jmp     short loc_180016E54
180016E44: mov     eax, 0FFFFC001h
180016E49: cmp     r8d, 0FFFFC000h
180016E50: cmovle  r8d, eax
180016E54: test    esi, esi
180016E56: mov     edx, [rsp+arg_20]
180016E5A: jnz     short loc_180016EAA
180016E5C: test    edx, edx
180016E5E: jz      loc_180016EFC
180016E64: xchg    ax, ax
180016E68: xchg    ax, ax
180016E6C: xchg    ax, ax
180016E70: movsx   ecx, word ptr [r11]
180016E74: movsx   eax, word ptr [r10]
180016E78: add     r9, 2
180016E7C: sub     eax, ecx
180016E7E: add     r11, 2
180016E82: add     r10, 2
180016E86: imul    eax, r8d
180016E8A: sar     eax, 0Ch
180016E8D: add     ax, cx
180016E90: add     edx, 0FFFFFFFFh
180016E93: mov     [r9-2], ax
180016E98: jnz     short loc_180016E70
180016E9A: mov     rbx, [rsp+arg_0]
180016E9F: mov     rsi, [rsp+arg_8]
180016EA4: mov     rdi, [rsp+arg_10]
180016EA9: retn
180016EAA: test    edx, edx
180016EAC: jz      short loc_180016EFC
180016EAE: mov     ebx, 0FFFF8000h
180016EB3: nop
180016EB4: xchg    ax, ax
180016EB8: xchg    ax, ax
180016EBC: xchg    ax, ax
180016EC0: movsx   eax, word ptr [r11]
180016EC4: movsx   ecx, word ptr [r10]
180016EC8: add     r11, 2
180016ECC: sub     ecx, eax
180016ECE: add     r10, 2
180016ED2: imul    ecx, r8d
180016ED6: sar     ecx, 0Ch
180016ED9: add     ecx, eax
180016EDB: cmp     ecx, 7FFFh
180016EE1: jle     short loc_180016EEA
180016EE3: mov     ecx, 7FFFh
180016EE8: jmp     short loc_180016EEF
180016EEA: cmp     ecx, ebx
180016EEC: cmovl   ecx, ebx
180016EEF: mov     [r9], cx
180016EF3: add     r9, 2
180016EF7: add     edx, 0FFFFFFFFh
180016EFA: jnz     short loc_180016EC0
180016EFC: mov     rbx, [rsp+arg_0]
180016F01: mov     rsi, [rsp+arg_8]
180016F06: mov     rdi, [rsp+arg_10]
180016F0B: retn

  data refs from:
    1800DD014
  code refs from:
    18000C8AE (func 18000C760)

==================================================================

### FUNC 180016F10 - 180017031 (289 bytes) name=sub_180016F10
180016F10: mov     [rsp+arg_0], rbx
180016F15: mov     [rsp+arg_8], rbp
180016F1A: mov     [rsp+arg_10], rsi
180016F1F: mov     [rsp+arg_18], rdi
180016F24: mov     edi, [rcx+54h]
180016F27: xor     ebp, ebp
180016F29: mov     r10, r8
180016F2C: cmp     edi, [rcx+41564h]
180016F32: mov     r11, rdx
180016F35: mov     rbx, rcx
180016F38: mov     esi, ebp
180016F3A: jl      short loc_180016F4E
180016F3C: mov     eax, [rcx+41558h]
180016F42: sub     eax, 1
180016F45: cmp     edi, [rcx+rax*4+41564h]
180016F4C: jle     short loc_180016F53
180016F4E: mov     esi, 1
180016F53: mov     ecx, [rcx+41840h]
180016F59: mov     r8d, [rbx+rcx*4+41564h]
180016F61: add     ecx, 1
180016F64: mov     ecx, [rbx+rcx*4+41564h]
180016F6B: sub     edi, r8d
180016F6E: sub     ecx, r8d
180016F71: shl     edi, 0Ch
180016F74: mov     eax, edi
180016F76: cdq
180016F77: idiv    ecx
180016F79: cmp     eax, 4000h
180016F7E: mov     r8d, eax
180016F81: jl      short loc_180016F8B
180016F83: mov     r8d, 3FFFh
180016F89: jmp     short loc_180016F9B
180016F8B: mov     eax, 0FFFFC001h
180016F90: cmp     r8d, 0FFFFC000h
180016F97: cmovle  r8d, eax
180016F9B: test    esi, esi
180016F9D: mov     edx, [rsp+arg_20]
180016FA1: jnz     short loc_180016FDC
180016FA3: test    edx, edx
180016FA5: jz      short loc_18001701C
180016FA7: xchg    ax, ax
180016FAA: xchg    ax, ax
180016FAD: xchg    ax, ax
180016FB0: movzx   ecx, word ptr [r11]
180016FB4: movzx   eax, word ptr [r10]
180016FB8: add     r9, 2
180016FBC: sub     eax, ecx
180016FBE: add     r11, 2
180016FC2: add     r10, 2
180016FC6: imul    eax, r8d
180016FCA: sar     eax, 0Ch
180016FCD: add     ax, cx
180016FD0: add     edx, 0FFFFFFFFh
180016FD3: mov     [r9-2], ax
180016FD8: jnz     short loc_180016FB0
180016FDA: jmp     short loc_18001701C
180016FDC: test    edx, edx
180016FDE: jz      short loc_18001701C
180016FE0: movzx   eax, word ptr [r11]
180016FE4: movzx   ecx, word ptr [r10]
180016FE8: add     r11, 2
180016FEC: sub     ecx, eax
180016FEE: add     r10, 2
180016FF2: imul    ecx, r8d
180016FF6: sar     ecx, 0Ch
180016FF9: add     ecx, eax
180016FFB: cmp     ecx, 0FFFFh
180017001: jle     short loc_18001700A
180017003: mov     ecx, 0FFFFh
180017008: jmp     short loc_18001700F
18001700A: test    ecx, ecx
18001700C: cmovs   ecx, ebp
18001700F: mov     [r9], cx
180017013: add     r9, 2
180017017: add     edx, 0FFFFFFFFh
18001701A: jnz     short loc_180016FE0
18001701C: mov     rbx, [rsp+arg_0]
180017021: mov     rbp, [rsp+arg_8]
180017026: mov     rsi, [rsp+arg_10]
18001702B: mov     rdi, [rsp+arg_18]
180017030: retn

  data refs from:
    1800DD020
  code refs from:
    18000C900 (func 18000C760)

==================================================================

### FUNC 18000C760 - 18000C948 (488 bytes) name=sub_18000C760
18000C760: mov     [rsp+arg_18], rbx
18000C765: push    rsi
18000C766: push    rdi
18000C767: push    r12
18000C769: sub     rsp, 30h
18000C76D: mov     rdi, rcx
18000C770: add     rcx, 238h; lpCriticalSection
18000C777: mov     r12d, r8d
18000C77A: mov     ebx, edx
18000C77C: call    cs:EnterCriticalSection
18000C782: cmp     dword ptr [rdi+228h], 0
18000C789: jz      loc_18000C92D
18000C78F: cmp     dword ptr [rdi+41340h], 0
18000C796: jz      loc_18000C92D
18000C79C: test    ebx, ebx
18000C79E: jnz     short loc_18000C7CD
18000C7A0: mov     rcx, rdi
18000C7A3: call    sub_180016AE0
18000C7A8: cmp     [rdi+41340h], ebx
18000C7AE: jz      loc_18000C92D
18000C7B4: cmp     [rdi+41344h], ebx
18000C7BA: jz      loc_18000C92D
18000C7C0: mov     rcx, rdi
18000C7C3: call    sub_18000FFB0
18000C7C8: jmp     loc_18000C92D
18000C7CD: mov     [rsp+48h+arg_0], rbp
18000C7D2: xor     ebp, ebp
18000C7D4: cmp     ebx, 1
18000C7D7: mov     [rsp+48h+arg_8], r13
18000C7DC: mov     [rsp+48h+arg_10], r14
18000C7E1: jnz     short loc_18000C847
18000C7E3: cmp     r12d, ebx
18000C7E6: jbe     short loc_18000C850
18000C7E8: mov     eax, [rdi+41554h]
18000C7EE: mov     r13d, [rdi+47938h]
18000C7F5: lea     ecx, [r12-1]
18000C7FA: lea     r8d, [rax-1]
18000C7FE: xor     edx, edx
18000C800: mov     ebx, ebp
18000C802: mov     r14d, ebp
18000C805: mov     cs:dword_18009A43C, ebp
18000C80B: mov     cs:dword_18009A438, ebx
18000C811: imul    r8d, r13d
18000C815: imul    r13d, eax
18000C819: add     r13d, r13d
18000C81C: mov     cs:dword_18009A440, r8d
18000C823: lea     eax, [r13+r8+0]
18000C828: mov     cs:dword_18009A444, r13d
18000C82F: lea     eax, [rax+r12-2]
18000C834: div     ecx
18000C836: lea     r12d, [rax+7]
18000C83A: and     r12d, 0FFFFFFF8h
18000C83E: mov     cs:dword_18009A448, r12d
18000C845: jmp     short loc_18000C872
18000C847: cmp     ebx, 1
18000C84A: jl      loc_18000C91E
18000C850: mov     r8d, cs:dword_18009A440
18000C857: mov     r13d, cs:dword_18009A444
18000C85E: mov     r12d, cs:dword_18009A448
18000C865: mov     ebx, cs:dword_18009A438
18000C86B: mov     r14d, cs:dword_18009A43C
18000C872: cmp     ebx, r8d
18000C875: jge     short loc_18000C8BB
18000C877: mov     rax, [rdi+41858h]
18000C87E: movsxd  rcx, ebx
18000C881: mov     ebp, r8d
18000C884: lea     r9, [rax+rcx*2]
18000C888: mov     rax, [rdi+41850h]
18000C88F: sub     ebp, ebx
18000C891: lea     r8, [rax+rcx*2]
18000C895: mov     rax, [rdi+41848h]
18000C89C: cmp     r12d, ebp
18000C89F: lea     rdx, [rax+rcx*2]
18000C8A3: cmovl   ebp, r12d
18000C8A7: mov     rcx, rdi
18000C8AA: mov     [rsp+48h+var_28], ebp
18000C8AE: call    sub_180016DD0
18000C8B3: add     ebx, ebp
18000C8B5: mov     cs:dword_18009A438, ebx
18000C8BB: cmp     ebp, r12d
18000C8BE: jge     short loc_18000C91E
18000C8C0: cmp     r14d, r13d
18000C8C3: jge     short loc_18000C91E
18000C8C5: mov     rax, [rdi+41870h]
18000C8CC: movsxd  rdx, r14d
18000C8CF: sub     r12d, ebp
18000C8D2: lea     r9, [rax+rdx*2]
18000C8D6: mov     rax, [rdi+41868h]
18000C8DD: mov     ebx, r13d
18000C8E0: lea     r8, [rax+rdx*2]
18000C8E4: mov     rax, [rdi+41860h]
18000C8EB: sub     ebx, r14d
18000C8EE: cmp     r12d, ebx
18000C8F1: lea     rdx, [rax+rdx*2]
18000C8F5: mov     rcx, rdi
18000C8F8: cmovl   ebx, r12d
18000C8FC: mov     [rsp+48h+var_28], ebx
18000C900: call    sub_180016F10
18000C905: add     r14d, ebx
18000C908: cmp     r14d, r13d
18000C90B: mov     cs:dword_18009A43C, r14d
18000C912: jnz     short loc_18000C91E
18000C914: mov     dword ptr [rdi+41348h], 1
18000C91E: mov     r13, [rsp+48h+arg_8]
18000C923: mov     rbp, [rsp+48h+arg_0]
18000C928: mov     r14, [rsp+48h+arg_10]
18000C92D: lea     rcx, [rdi+238h]
18000C934: mov     rbx, [rsp+48h+arg_18]
18000C939: add     rsp, 30h
18000C93D: pop     r12
18000C93F: pop     rdi
18000C940: pop     rsi
18000C941: jmp     cs:LeaveCriticalSection

  data refs from:
    180066228
    180066244
    1800DCAEC
  code refs from:
    18000A071 (func 180009EE0)
    18000A127 (func 180009EE0)
    18000A14E (func 180009EE0)

==================================================================

### FUNC 18000C620 - 18000C755 (309 bytes) name=sub_18000C620
18000C620: mov     [rsp+arg_0], rbx
18000C625: mov     [rsp+arg_8], rbp
18000C62A: mov     [rsp+arg_10], rsi
18000C62F: push    rdi
18000C630: sub     rsp, 20h
18000C634: mov     rbx, rcx
18000C637: add     rcx, 238h; lpCriticalSection
18000C63E: mov     edi, r8d
18000C641: mov     rbp, rdx
18000C644: call    cs:EnterCriticalSection
18000C64A: cmp     dword ptr [rbx+228h], 0
18000C651: jnz     short loc_18000C667
18000C653: lea     rcx, [rbx+238h]; lpCriticalSection
18000C65A: call    cs:LeaveCriticalSection
18000C660: xor     eax, eax
18000C662: jmp     loc_18000C740
18000C667: test    edi, edi
18000C669: jz      loc_18000C712
18000C66F: xor     edi, edi
18000C671: mov     [rbx+22Ch], edi
18000C677: mov     [rbx+41FFCh], edi
18000C67D: mov     [rbx+42004h], edi
18000C683: cmp     [rbx+41F0Ch], edi
18000C689: jz      short loc_18000C691
18000C68B: mov     [rbx+41F00h], edi
18000C691: cmp     [rbx+41F3Ch], edi
18000C697: jz      short loc_18000C69F
18000C699: mov     [rbx+41F30h], edi
18000C69F: cmp     dword ptr [rbx+41FE0h], 1
18000C6A6: jbe     short loc_18000C6DD
18000C6A8: cmp     [rbx+41F7Ch], edi
18000C6AE: jz      short loc_18000C6DD
18000C6B0: mov     r8d, [rbx+41F74h]
18000C6B7: mov     rax, [rbx+41F50h]
18000C6BE: mov     rcx, [rbx+41F58h]; void *
18000C6C5: shl     r8, 2; Size
18000C6C9: xor     edx, edx; Val
18000C6CB: mov     [rbx+41F70h], edi
18000C6D1: mov     [rbx+41F68h], rax
18000C6D8: call    memset
18000C6DD: cmp     [rbx+41FBCh], edi
18000C6E3: jz      short loc_18000C712
18000C6E5: mov     r8d, [rbx+41FB4h]
18000C6EC: mov     rax, [rbx+41F90h]
18000C6F3: mov     rcx, [rbx+41F98h]; void *
18000C6FA: shl     r8, 2; Size
18000C6FE: xor     edx, edx; Val
18000C700: mov     [rbx+41FB0h], edi
18000C706: mov     [rbx+41FA8h], rax
18000C70D: call    memset
18000C712: lea     rcx, [rbx+41EE0h]
18000C719: mov     rdx, rbp
18000C71C: call    sub_1800011A0
18000C721: test    eax, eax
18000C723: mov     edi, eax
18000C725: jz      short loc_18000C731
18000C727: mov     dword ptr [rbx+22Ch], 1
18000C731: lea     rcx, [rbx+238h]; lpCriticalSection
18000C738: call    cs:LeaveCriticalSection
18000C73E: mov     eax, edi
18000C740: mov     rbx, [rsp+28h+arg_0]
18000C745: mov     rbp, [rsp+28h+arg_8]
18000C74A: mov     rsi, [rsp+28h+arg_10]
18000C74F: add     rsp, 20h
18000C753: pop     rdi
18000C754: retn

  data refs from:
    1800DCAE0
  code refs from:
    18000A0FA (func 180009EE0)

==================================================================

### FUNC 1800011A0 - 180001389 (489 bytes) name=sub_1800011A0
1800011A0: push    rbx
1800011A2: sub     rsp, 20h
1800011A6: cmp     dword ptr [rcx+2Ch], 0
1800011AA: mov     r9, rdx
1800011AD: mov     rbx, rcx
1800011B0: jz      loc_180001381
1800011B6: add     dword ptr [rcx+20h], 1
1800011BA: mov     eax, [rbx+28h]
1800011BD: mov     ecx, [rcx+20h]
1800011C0: cmp     eax, 1
1800011C3: jnz     short loc_1800011DA
1800011C5: mov     r8d, [rbx+24h]
1800011C9: mov     rcx, [rbx+10h]; void *
1800011CD: add     r8, r8; Size
1800011D0: call    memmove
1800011D5: jmp     loc_180001367
1800011DA: cmp     eax, 2
1800011DD: jnz     short loc_180001255
1800011DF: cmp     ecx, 1
1800011E2: jz      short loc_1800011C5
1800011E4: mov     r8d, [rbx+24h]
1800011E8: mov     rdx, [rbx+10h]
1800011EC: shr     r8d, 2
1800011F0: jz      loc_180001367
1800011F6: xchg    ax, ax
1800011FA: xchg    ax, ax
1800011FD: xchg    ax, ax
180001200: movzx   eax, word ptr [rdx]
180001203: movzx   ecx, word ptr [r9]
180001207: add     rdx, 8
18000120B: add     ecx, eax
18000120D: add     r9, 8
180001211: sar     ecx, 1
180001213: mov     [rdx-8], cx
180001217: movzx   eax, word ptr [rdx-6]
18000121B: movzx   ecx, word ptr [r9-6]
180001220: add     ecx, eax
180001222: sar     ecx, 1
180001224: mov     [rdx-6], cx
180001228: movzx   eax, word ptr [rdx-4]
18000122C: movzx   ecx, word ptr [r9-4]
180001231: add     ecx, eax
180001233: sar     ecx, 1
180001235: mov     [rdx-4], cx
180001239: movzx   ecx, word ptr [r9-2]
18000123E: movzx   eax, word ptr [rdx-2]
180001242: add     ecx, eax
180001244: sar     ecx, 1
180001246: add     r8d, 0FFFFFFFFh
18000124A: mov     [rdx-2], cx
18000124E: jnz     short loc_180001200
180001250: jmp     loc_180001367
180001255: cmp     ecx, 1
180001258: mov     r8, [rbx+18h]
18000125C: jnz     short loc_1800012A5
18000125E: mov     ecx, [rbx+24h]
180001261: shr     ecx, 2
180001264: jz      loc_180001367
18000126A: xchg    ax, ax
18000126D: xchg    ax, ax
180001270: movzx   eax, word ptr [r9]
180001274: add     r8, 10h
180001278: add     r9, 8
18000127C: add     ecx, 0FFFFFFFFh
18000127F: mov     [r8-10h], eax
180001283: movzx   eax, word ptr [r9-6]
180001288: mov     [r8-0Ch], eax
18000128C: movzx   eax, word ptr [r9-4]
180001291: mov     [r8-8], eax
180001295: movzx   eax, word ptr [r9-2]
18000129A: mov     [r8-4], eax
18000129E: jnz     short loc_180001270
1800012A0: jmp     loc_180001367
1800012A5: cmp     ecx, eax
1800012A7: jz      short loc_1800012F2
1800012A9: mov     ecx, [rbx+24h]
1800012AC: shr     ecx, 2
1800012AF: jz      loc_180001367
1800012B5: xchg    ax, ax
1800012B9: xchg    ax, ax
1800012BC: xchg    ax, ax
1800012C0: movzx   eax, word ptr [r9]
1800012C4: add     r8, 10h
1800012C8: add     r9, 8
1800012CC: add     [r8-10h], eax
1800012D0: movzx   eax, word ptr [r9-6]
1800012D5: add     [r8-0Ch], eax
1800012D9: movzx   eax, word ptr [r9-4]
1800012DE: add     [r8-8], eax
1800012E2: movzx   eax, word ptr [r9-2]
1800012E7: add     [r8-4], eax
1800012EB: add     ecx, 0FFFFFFFFh
1800012EE: jnz     short loc_1800012C0
1800012F0: jmp     short loc_180001367
1800012F2: cmp     eax, 4
1800012F5: mov     r10, [rbx+10h]
1800012F9: jnz     short loc_180001300
1800012FB: lea     ecx, [rax-2]
1800012FE: jmp     short loc_18000132B
180001300: cmp     eax, 8
180001303: jnz     short loc_18000130A
180001305: lea     ecx, [rax-5]
180001308: jmp     short loc_18000132B
18000130A: cmp     eax, 10h
18000130D: jnz     short loc_180001314
18000130F: lea     ecx, [rax-0Ch]
180001312: jmp     short loc_18000132B
180001314: cmp     eax, 20h ; ' '
180001317: jnz     short loc_18000131E
180001319: lea     ecx, [rax-1Bh]
18000131C: jmp     short loc_18000132B
18000131E: xor     ecx, ecx
180001320: mov     edx, 6
180001325: cmp     eax, 40h ; '@'
180001328: cmovz   ecx, edx
18000132B: mov     r11d, [rbx+24h]
18000132F: test    r11d, r11d
180001332: jz      short loc_180001367
180001334: xchg    ax, ax
180001338: xchg    ax, ax
18000133C: xchg    ax, ax
180001340: movzx   edx, word ptr [r9]
180001344: add     r8, 4
180001348: add     r9, 2
18000134C: add     edx, [r8-4]
180001350: add     r10, 2
180001354: mov     eax, edx
180001356: shr     eax, cl
180001358: add     r11d, 0FFFFFFFFh
18000135C: mov     [r10-2], ax
180001361: mov     [r8-4], edx
180001365: jnz     short loc_180001340
180001367: mov     eax, [rbx+28h]
18000136A: cmp     [rbx+20h], eax
18000136D: jnz     short loc_180001381
18000136F: mov     dword ptr [rbx+20h], 0
180001376: mov     eax, 1
18000137B: add     rsp, 20h
18000137F: pop     rbx
180001380: retn
180001381: xor     eax, eax
180001383: add     rsp, 20h
180001387: pop     rbx
180001388: retn

  data refs from:
    1800DC024
  code refs from:
    18000C71C (func 18000C620)
    18000C96D (func 18000C950)
    18000C9BF (func 18000C950)

==================================================================

### FUNC 18001E920 - 18001E9EE (206 bytes) name=sub_18001E920
18001E920: push    rbx
18001E922: sub     rsp, 20h
18001E926: cmp     dword ptr [rcx+3Ch], 0
18001E92A: mov     r10d, r8d
18001E92D: mov     rbx, rcx
18001E930: jnz     short loc_18001E93A
18001E932: xor     eax, eax
18001E934: add     rsp, 20h
18001E938: pop     rbx
18001E939: retn
18001E93A: mov     eax, [rcx+38h]
18001E93D: add     dword ptr [rcx+30h], 1
18001E941: cmp     [rcx+30h], eax
18001E944: jbe     short loc_18001E99E
18001E946: cmp     eax, 1
18001E949: jnz     short loc_18001E932
18001E94B: mov     r8d, [rcx+34h]
18001E94F: mov     r11, [rcx+10h]
18001E953: test    r8d, r8d
18001E956: jz      short loc_18001E9AE
18001E958: xchg    ax, ax
18001E95C: xchg    ax, ax
18001E960: movzx   eax, word ptr [r11]
18001E964: movzx   r9d, word ptr [rdx]
18001E968: add     r11, 2
18001E96C: mov     ecx, r9d
18001E96F: mov     [r11-2], r9w
18001E974: sub     ecx, eax
18001E976: cmp     ecx, r10d
18001E979: jg      short loc_18001E992
18001E97B: mov     eax, ecx
18001E97D: neg     eax
18001E97F: cmp     eax, r10d
18001E982: jg      short loc_18001E992
18001E984: test    ecx, ecx
18001E986: jz      short loc_18001E992
18001E988: sar     ecx, 1
18001E98A: sub     r9w, cx
18001E98E: mov     [rdx], r9w
18001E992: add     rdx, 2; Src
18001E996: add     r8d, 0FFFFFFFFh
18001E99A: jnz     short loc_18001E960
18001E99C: jmp     short loc_18001E9AE
18001E99E: mov     r8d, [rcx+34h]
18001E9A2: mov     rcx, [rcx+28h]; void *
18001E9A6: add     r8, r8; Size
18001E9A9: call    memmove
18001E9AE: mov     r8d, [rbx+30h]
18001E9B2: mov     ecx, [rbx+38h]
18001E9B5: xor     edx, edx
18001E9B7: mov     eax, r8d
18001E9BA: div     ecx
18001E9BC: test    edx, edx
18001E9BE: jnz     short loc_18001E9D6
18001E9C0: mov     rax, [rbx+10h]
18001E9C4: mov     [rbx+28h], rax
18001E9C8: xor     eax, eax
18001E9CA: cmp     r8d, ecx
18001E9CD: setnb   al
18001E9D0: add     rsp, 20h
18001E9D4: pop     rbx
18001E9D5: retn
18001E9D6: mov     eax, [rbx+34h]
18001E9D9: add     rax, rax
18001E9DC: add     [rbx+28h], rax
18001E9E0: xor     eax, eax
18001E9E2: cmp     r8d, ecx
18001E9E5: setnb   al
18001E9E8: add     rsp, 20h
18001E9EC: pop     rbx
18001E9ED: retn

  data refs from:
    1800DD77C
    1800DD788
  code refs from:
    18000CB84 (func 18000CA30)

==================================================================

### FUNC 180009EE0 - 18000A410 (1328 bytes) name=sub_180009EE0
180009EE0: push    rbx
180009EE2: push    rbp
180009EE3: push    rdi
180009EE4: push    r13
180009EE6: push    r14
180009EE8: sub     rsp, 70h
180009EEC: mov     ebx, ecx
180009EEE: lea     r14, __ImageBase
180009EF5: mov     rdi, rdx
180009EF8: mov     ebp, ecx
180009EFA: imul    rbx, 4A8h
180009F01: cmp     dword ptr [rbx+r14+73778h], 0
180009F0A: jz      loc_18000A3E8
180009F10: mov     edx, [rdx+0Ch]
180009F13: test    dl, 3
180009F16: jz      short loc_180009F3A
180009F18: mov     eax, [rbx+r14+737B8h]
180009F20: cmp     [rdi+14h], eax
180009F23: jnz     loc_18000A3E8
180009F29: mov     eax, [rbx+r14+737BCh]
180009F31: cmp     [rdi+18h], eax
180009F34: jnz     loc_18000A3E8
180009F3A: test    dl, 4
180009F3D: jz      short loc_180009F61
180009F3F: mov     eax, [rbx+r14+737F8h]
180009F47: cmp     [rdi+14h], eax
180009F4A: jnz     loc_18000A3E8
180009F50: mov     eax, [rbx+r14+737FCh]
180009F58: cmp     [rdi+18h], eax
180009F5B: jnz     loc_18000A3E8
180009F61: xor     ecx, ecx; Time
180009F63: mov     [rsp+98h+arg_0], rsi
180009F6B: mov     [rsp+98h+arg_10], r12
180009F73: call    _time64
180009F78: add     dword ptr [rbx+r14+73BF0h], 1
180009F81: mov     rsi, [rbx+r14+73758h]
180009F89: xor     r12d, r12d
180009F8C: mov     [rbx+r14+73810h], rax
180009F94: mov     eax, [rbx+r14+73BF0h]
180009F9C: mov     [rbx+r14+73818h], r12
180009FA4: mov     [rbx+r14+73820h], r12
180009FAC: mov     [rbx+r14+73828h], r12d
180009FB4: movzx   r8d, byte ptr [rsi+2D47h]
180009FBC: cmp     r8d, 1
180009FC0: jz      short loc_180009FD9
180009FC2: cmp     r8d, 2
180009FC6: jz      short loc_180009FD9
180009FC8: cmp     r8d, 4
180009FCC: jnz     short loc_180009FE2
180009FCE: cmp     eax, 8
180009FD1: jb      loc_18000A3D8
180009FD7: jmp     short loc_180009FE2
180009FD9: cmp     eax, 14h
180009FDC: jb      loc_18000A3D8
180009FE2: movsx   eax, word ptr [rsi+2D86h]
180009FE9: add     [rdi+28h], eax
180009FEC: movsx   eax, word ptr [rsi+2D86h]
180009FF3: add     [rdi+2Ch], eax
180009FF6: mov     eax, [rdi+28h]
180009FF9: mov     rcx, [rbx+r14+73750h]
18000A001: mov     [rcx+60h], eax
18000A004: mov     eax, [rdi+2Ch]
18000A007: mov     rcx, [rbx+r14+73750h]
18000A00F: mov     [rcx+5Ch], eax
18000A012: mov     eax, [rdi+28h]
18000A015: mov     edx, [rbx+r14+73BECh]
18000A01D: test    edx, edx
18000A01F: mov     [rbx+r14+73800h], eax
18000A027: mov     eax, [rdi+2Ch]
18000A02A: mov     [rbx+r14+73804h], eax
18000A032: jns     short loc_18000A040
18000A034: mov     ecx, ebp
18000A036: call    sub_180002F50
18000A03B: jmp     loc_18000A3D8
18000A040: add     edx, 1
18000A043: mov     [rbx+r14+73BECh], edx
18000A04B: mov     ecx, [rsi+2D88h]
18000A051: cmp     edx, ecx
18000A053: ja      short loc_18000A07B
18000A055: mov     r8d, [rsi+2D8Ch]
18000A05C: add     edx, 0FFFFFFFFh
18000A05F: add     r8d, ecx
18000A062: mov     rcx, [rbx+r14+73750h]
18000A06A: add     r8d, [rsi+2D78h]
18000A071: call    sub_18000C760
18000A076: jmp     loc_18000A3D8
18000A07B: mov     r9d, [rsi+2D78h]
18000A082: lea     eax, [r9+rcx]
18000A086: cmp     edx, eax
18000A088: ja      loc_18000A131
18000A08E: cmp     edx, eax
18000A090: jnz     short loc_18000A0D6
18000A092: mov     rcx, [rbx+r14+73758h]
18000A09A: cmp     [rcx+14h], r12d
18000A09E: jnz     short loc_18000A0AD
18000A0A0: mov     ecx, 0E4AE0005h; dwErrCode
18000A0A5: call    cs:SetLastError
18000A0AB: jmp     short loc_18000A0D6
18000A0AD: lea     rdx, [rsp+98h+arg_8]
18000A0B5: mov     r8d, 8
18000A0BB: mov     [rsp+98h+arg_8], 6BB6B672h
18000A0C6: mov     [rsp+98h+arg_C], 1
18000A0D1: call    sub_18001C670
18000A0D6: mov     eax, [rsi+2D88h]
18000A0DC: mov     rcx, [rbx+r14+73750h]
18000A0E4: lea     rdx, [rdi+4Ch]
18000A0E8: add     eax, 1
18000A0EB: cmp     [rbx+r14+73BECh], eax
18000A0F3: setz    r12b
18000A0F7: mov     r8d, r12d
18000A0FA: call    sub_18000C620
18000A0FF: mov     r8d, [rsi+2D8Ch]
18000A106: mov     edx, [rbx+r14+73BECh]
18000A10E: add     r8d, [rsi+2D78h]
18000A115: mov     rcx, [rbx+r14+73750h]
18000A11D: sub     edx, 1
18000A120: add     r8d, [rsi+2D88h]
18000A127: call    sub_18000C760
18000A12C: jmp     loc_18000A3D8
18000A131: add     r9d, [rsi+2D8Ch]
18000A138: add     r9d, ecx
18000A13B: cmp     edx, r9d
18000A13E: ja      short loc_18000A158
18000A140: mov     rcx, [rbx+r14+73750h]
18000A148: add     edx, 0FFFFFFFFh
18000A14B: mov     r8d, r9d
18000A14E: call    sub_18000C760
18000A153: jmp     loc_18000A3D8
18000A158: cmp     r8d, 6; switch 7 cases
18000A15C: mov     r10d, r12d
18000A15F: ja      short def_18000A16C; jumptable 000000018000A16C default case
18000A161: mov     ecx, ds:(jpt_18000A16C - 180000000h)[r14+r8*4]
18000A169: add     rcx, r14
18000A16C: jmp     rcx; switch jump
18000A16E: cmp     [rbx+r14+73BF4h], r10d; jumptable 000000018000A16C cases 0,3,5,6
18000A176: jnz     short loc_18000A18D
18000A178: cmp     edx, 4Bh ; 'K'
18000A17B: jnz     short loc_18000A18D
18000A17D: mov     dword ptr [rbx+r14+73BF4h], 1
18000A189: lea     r10d, [rdx-4Ah]
18000A18D: mov     r8d, 1Eh
18000A193: jmp     short loc_18000A1C5
18000A195: mov     ecx, [rbx+r14+73BF4h]; jumptable 000000018000A16C cases 1,2,4
18000A19D: cmp     ecx, 5
18000A1A0: jnb     short loc_18000A1BF
18000A1A2: mov     eax, 82h
18000A1A7: sub     eax, r9d
18000A1AA: cmp     edx, eax
18000A1AC: jnz     short loc_18000A1BF
18000A1AE: lea     eax, [rcx+1]
18000A1B1: mov     r10d, 1
18000A1B7: mov     [rbx+r14+73BF4h], eax
18000A1BF: mov     r8d, 64h ; 'd'
18000A1C5: test    r10d, r10d
18000A1C8: jnz     short loc_18000A203
18000A1CA: jmp     short loc_18000A1D2
18000A1CC: mov     r8d, 64h ; 'd'; jumptable 000000018000A16C default case
18000A1D2: mov     eax, [rsi+2D90h]
18000A1D8: lea     ecx, [r9+rax]
18000A1DC: cmp     edx, ecx
18000A1DE: jnb     short loc_18000A203
18000A1E0: lea     eax, [r8+r9]
18000A1E4: cmp     edx, eax
18000A1E6: jb      short loc_18000A20A
18000A1E8: mov     rax, [rbx+r14+73750h]
18000A1F0: mov     eax, [rax+54h]
18000A1F3: sub     eax, [rdi+2Ch]
18000A1F6: cdq
18000A1F7: xor     eax, edx
18000A1F9: sub     eax, edx
18000A1FB: cmp     eax, [rsi+2D94h]
18000A201: jbe     short loc_18000A20A
18000A203: mov     ecx, ebp
18000A205: call    sub_180002F50
18000A20A: mov     rcx, [rbx+r14+73750h]
18000A212: lea     rdx, [rdi+4Ch]
18000A216: mov     r9d, 1
18000A21C: xor     r8d, r8d
18000A21F: mov     dword ptr [rsp+98h+var_70], 1
18000A227: mov     [rsp+98h+var_78], r12d
18000A22C: call    sub_18000CA30
18000A231: test    al, 1
18000A233: jz      loc_18000A3D8
18000A239: mov     rax, [rbx+r14+73768h]
18000A241: mov     ecx, [rax+44h]
18000A244: test    ecx, ecx
18000A246: jz      loc_18000A32E
18000A24C: add     dword ptr [rbx+r14+73BA4h], 1
18000A255: mov     eax, [rbx+r14+73BA4h]
18000A25D: cmp     eax, [rbx+r14+73BA8h]
18000A265: jl      loc_18000A32E
18000A26B: xor     eax, eax
18000A26D: lea     rcx, [rsp+98h+var_60]
18000A272: mov     [rbx+r14+73BA4h], r12d
18000A27A: mov     [rsp+98h+var_68], rax
18000A27F: mov     [rsp+98h+var_60], rax
18000A284: mov     [rsp+98h+var_58], rax
18000A289: mov     [rsp+98h+var_50], rax
18000A28E: mov     [rsp+98h+var_48], rax
18000A293: mov     [rsp+98h+var_40], rax
18000A298: mov     [rsp+98h+var_38], rax
18000A29D: mov     [rsp+98h+var_30], rax
18000A2A2: mov     eax, [rbx+r14+73800h]
18000A2AA: mov     dword ptr [rsp+98h+var_68], 40h ; '@'
18000A2B2: mov     dword ptr [rsp+98h+var_68+4], 10100h
18000A2BA: mov     [rcx], eax
18000A2BC: mov     eax, [rbx+r14+73804h]
18000A2C4: mov     [rcx+4], eax
18000A2C7: mov     eax, [rbx+r14+73808h]
18000A2CF: mov     [rcx+8], eax
18000A2D2: mov     eax, [rbx+r14+7380Ch]
18000A2DA: mov     [rcx+0Ch], eax
18000A2DD: xor     ecx, ecx; Time
18000A2DF: call    _time64
18000A2E4: mov     [rsp+98h+var_50], rax
18000A2E9: call    cs:GetTickCount
18000A2EF: mov     r9, [rbx+r14+73750h]
18000A2F7: mov     rcx, [rbx+r14+73768h]
18000A2FF: mov     dword ptr [rsp+98h+var_48], eax
18000A303: mov     eax, [rdi+38h]
18000A306: mov     dword ptr [rsp+98h+var_48+4], eax
18000A30A: mov     eax, [rdi+18h]
18000A30D: mov     r9, [r9+270h]
18000A314: imul    eax, [rdi+14h]
18000A318: add     eax, eax
18000A31A: lea     rdx, [rsp+98h+var_68]
18000A31F: mov     r8d, 40h ; '@'
18000A325: mov     [rsp+98h+var_78], eax
18000A329: call    sub_18001B1B0
18000A32E: mov     rax, [rbx+r14+73760h]
18000A336: cmp     [rax+44h], r12d
18000A33A: jz      short loc_18000A3A6
18000A33C: mov     rcx, [rbx+r14+73750h]
18000A344: call    sub_1800110A0
18000A349: mov     r9, [rbx+r14+73750h]
18000A351: add     r9, 6C8h
18000A358: test    rax, rax
18000A35B: mov     r11, rax
18000A35E: jz      short loc_18000A3A6
18000A360: test    r9, r9
18000A363: jz      short loc_18000A3A6
18000A365: movzx   eax, word ptr [r9+0Eh]
18000A36A: mov     rcx, [rbx+r14+73760h]
18000A372: imul    eax, [r9+8]
18000A377: imul    eax, [r9+4]
18000A37C: cdq
18000A37D: and     edx, 7
18000A380: add     eax, edx
18000A382: sar     eax, 3
18000A385: cdq
18000A386: xor     eax, edx
18000A388: sub     eax, edx
18000A38A: mov     rdx, r11
18000A38D: mov     r8d, eax
18000A390: call    sub_180001CD0
18000A395: test    eax, eax
18000A397: jnz     short loc_18000A3A6
18000A399: mov     rcx, [rbx+r14+73760h]
18000A3A1: call    sub_180001C50
18000A3A6: mov     r10, [rbx+r14+73790h]
18000A3AE: test    r10, r10
18000A3B1: jz      short loc_18000A3D8
18000A3B3: mov     rax, [rbx+r14+73770h]
18000A3BB: mov     r9d, [rdi+44h]
18000A3BF: mov     r8d, [rdi+38h]
18000A3C3: mov     edx, [rdi+28h]
18000A3C6: mov     [rsp+98h+var_70], rax
18000A3CB: mov     ecx, ebp
18000A3CD: mov     [rsp+98h+var_78], 2
18000A3D5: call    r10
18000A3D8: mov     rsi, [rsp+98h+arg_0]
18000A3E0: mov     r12, [rsp+98h+arg_10]
18000A3E8: add     rsp, 70h
18000A3EC: pop     r14
18000A3EE: pop     r13
18000A3F0: pop     rdi
18000A3F1: pop     rbp
18000A3F2: pop     rbx
18000A3F3: retn
18000A3F4: dd offset loc_18000A16E - 180000000h; jump table for switch statement

  data refs from:
    18001D30C
    180068330
    180068340
    180068358
    1800DC8B8

==================================================================

### FUNC 180002F50 - 180002FEB (155 bytes) name=sub_180002F50
180002F50: mov     [rsp+arg_0], rbx
180002F55: push    rdi
180002F56: sub     rsp, 20h
180002F5A: mov     ebx, ecx
180002F5C: lea     rdi, qword_180073750
180002F63: imul    rbx, 4A8h
180002F6A: mov     rcx, [rbx+rdi+8]
180002F6F: cmp     dword ptr [rcx+14h], 0
180002F73: jnz     short loc_180002F8D
180002F75: mov     ecx, 0E4AE0005h; dwErrCode
180002F7A: call    cs:SetLastError
180002F80: xor     eax, eax
180002F82: mov     rbx, [rsp+28h+arg_0]
180002F87: add     rsp, 20h
180002F8B: pop     rdi
180002F8C: retn
180002F8D: lea     rdx, [rsp+28h+arg_8]
180002F92: mov     r8d, 8
180002F98: mov     [rsp+28h+arg_8], 6BB6B672h
180002FA0: mov     [rsp+28h+arg_C], 0
180002FA8: call    sub_18001C670
180002FAD: test    eax, eax
180002FAF: jnz     short loc_180002FBC
180002FB1: mov     rbx, [rsp+28h+arg_0]
180002FB6: add     rsp, 20h
180002FBA: pop     rdi
180002FBB: retn
180002FBC: mov     rcx, [rbx+rdi]
180002FC0: mov     eax, [rcx+60h]
180002FC3: mov     [rcx+58h], eax
180002FC6: mov     rcx, [rbx+rdi]
180002FCA: mov     eax, [rcx+5Ch]
180002FCD: mov     [rcx+54h], eax
180002FD0: mov     dword ptr [rbx+rdi+49Ch], 0
180002FDB: mov     rbx, [rsp+28h+arg_0]
180002FE0: mov     eax, 1
180002FE5: add     rsp, 20h
180002FE9: pop     rdi
180002FEA: retn

  data refs from:
    1800DC300
  code refs from:
    180009DD9 (func 180009B50)
    18000A036 (func 180009EE0)
    18000A205 (func 180009EE0)

==================================================================

### FUNC 180010780 - 180010891 (273 bytes) name=sub_180010780
180010780: mov     [rsp+arg_8], rbx
180010785: mov     [rsp+arg_10], rbp
18001078A: push    rdi
18001078B: push    r12
18001078D: push    r13
18001078F: sub     rsp, 20h
180010793: mov     r13d, [rcx+47938h]
18001079A: movzx   r9d, word ptr [rdx]
18001079E: xor     r11d, r11d
1800107A1: test    r13d, r13d
1800107A4: mov     r12, rcx
1800107A7: mov     ebp, r11d
1800107AA: movzx   r10d, r9w
1800107AE: mov     rbx, r11
1800107B1: mov     rdi, r11
1800107B4: mov     r8d, r11d
1800107B7: jz      short loc_18001080C
1800107B9: mov     [rsp+38h+arg_0], rsi
1800107BE: mov     esi, [rcx+47938h]
1800107C4: xchg    ax, ax
1800107C8: xchg    ax, ax
1800107CC: xchg    ax, ax
1800107D0: movzx   ecx, word ptr [rdx]
1800107D3: add     rdx, 2
1800107D7: mov     eax, ecx
1800107D9: add     rbx, rcx
1800107DC: imul    eax, eax
1800107DF: add     rdi, rax
1800107E2: cmp     r10w, cx
1800107E6: jnb     short loc_1800107F1
1800107E8: mov     r10w, cx
1800107EC: mov     ebp, r8d
1800107EF: jmp     short loc_1800107FE
1800107F1: cmp     cx, r9w
1800107F5: jnb     short loc_1800107FE
1800107F7: mov     r9w, cx
1800107FB: mov     r11d, r8d
1800107FE: add     r8d, 1
180010802: cmp     r8d, esi
180010805: jb      short loc_1800107D0
180010807: mov     rsi, [rsp+38h+arg_0]
18001080C: movzx   eax, r10w
180010810: cvtsi2sd xmm1, r13
180010815: cvtsi2sd xmm2, rbx
18001081A: mov     [r12+42010h], eax
180010822: movzx   eax, r9w
180010826: lea     ecx, [r13-1]
18001082A: mov     [r12+42014h], eax
180010832: mov     rax, rbx
180010835: mov     [r12+42020h], ebp
18001083D: mulsd   xmm2, xmm2
180010841: divsd   xmm2, xmm1
180010845: cqo
180010847: mov     [r12+42024h], r11d
18001084F: cvtsi2sd xmm1, rcx
180010854: cvtsi2sd xmm0, rdi
180010859: idiv    r13
18001085C: subsd   xmm0, xmm2
180010860: divsd   xmm0, xmm1; X
180010864: mov     [r12+42018h], eax
18001086C: call    sqrt
180010871: mov     rbx, [rsp+38h+arg_8]
180010876: mov     rbp, [rsp+38h+arg_10]
18001087B: cvttsd2si eax, xmm0
18001087F: mov     [r12+4201Ch], eax
180010887: add     rsp, 20h
18001088B: pop     r13
18001088D: pop     r12
18001088F: pop     rdi
180010890: retn

  data refs from:
    180065BF8
    180065C0C
    1800DCC30
  code refs from:
    18000CBFE (func 18000CA30)
    18000CC9F (func 18000CA30)

==================================================================

