Function at 0x85aea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x12c
mov edx, dword [esp + 0x150]
mov ebx, dword [esp + 0x14c]
mov esi, dword [esp + 0x148]
mov ecx, dword [esp + 0x144]
mov edi, dword [esp + 0x140]
test edi, edi
jne 0x85af06
test ecx, ecx
jne 0x85af06
test esi, esi
jne 0x85af06
cmp ebx, 0xfffffc19
jne 0x85af06
cmp edx, 0xfffffc19
jne 0x85af06
sub esp, 0xc
xor ecx, ecx
xor edx, edx
push 0
push 0
push 0
push 0
push 0
call fcn.0085c1c0
add esp, 0x20
mov ebp, eax
jmp 0x85af18
mov ebp, 0xfffffffd
test dword [esp + 0x154], 0xe20f5a6f
je 0x85af25
mov eax, ebp
add esp, 0x12c
pop esi
pop edi
pop ebx
pop ebp
ret
test edi, edi
mov ebp, 0xfffffffe
je 0x85af18
test esi, esi
je 0x85af18
mov eax, dword [esp + 0x15c]
cmp dword [esp + 0x158], 0
jne 0x85af4c
mov ebp, 0xfffffffe
test eax, eax
jg 0x85af18
test eax, eax
js 0x85afa4
test ebx, ebx
js 0x85afae
test edx, edx
mov ebp, 0xffffffe8
js 0x85af18
cmp edx, ebx
jg 0x85af18
mov eax, dword [edi]
cmp eax, 0x50435245
jne 0x85afb8
mov ebp, 0xffffffe4
test byte [edi + 0xc], 2
je 0x85af18
mov eax, 0x800
and eax, dword [edi + 8]
mov dword [esp + 0x30], eax
shr eax, 0xb
mov dword [esp + 0x3c], eax
mov dword [esp + 0xbc], eax
mov eax, dword [esp + 0x154]
test eax, 0x8000000
je 0x85afd2
mov eax, 2
jmp 0x85afd8
mov ebp, 0xfffffff1
jmp 0x85af18
mov ebp, 0xffffffe0
jmp 0x85af18
cmp eax, 0x45524350
mov ebp, 0xffffffe3
je 0x85af18
mov ebp, 0xfffffffc
jmp 0x85af18
shr eax, 0xf
and eax, 1
lea edx, [esi + edx*2]
mov dword [esp + 0x58], edx
mov dword [esp + 0xf8], eax
mov eax, dword [esp + 0x154]
test ah, 0x20
jne 0x85b090
cmp dword [esp + 0x30], 0
je 0x85b090
sub esp, 4
lea eax, [esp + 0x12c]
push eax
push ebx
push esi
call fcn.00869390
add esp, 0x10
test eax, eax
je 0x85b05e
cmp dword [esp + 0x15c], 2
jl 0x85b037
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x158]
mov dword [edx], ecx
mov dword [edx + 4], eax
cmp dword [esp + 0xf8], 1
mov ebp, 0xffffffe7
jg 0x85b04b
mov ebp, 0xfffffff6
cmp eax, 2
jl 0x85af18
mov ebp, 0xfffffff6
jmp 0x85af18
mov eax, dword [esp + 0x150]
test eax, eax
jle 0x85b089
cmp eax, ebx
jge 0x85b089
mov eax, dword [esp + 0x58]
movzx eax, word [eax]
and eax, 0xfc00
mov ebp, 0xfffffff5
cmp eax, 0xdc00
je 0x85af18
mov ecx, dword [esp + 0x144]
movzx eax, word [edi + 0x22]
lea eax, [edi + eax*2]
mov dword [esp + 0xc], eax
mov dword [esp + 0x9c], eax
movzx ebp, word [edi + 0x26]
mov dword [esp + 0x8c], ebp
movzx edx, word [edi + 0x24]
mov dword [esp + 0x90], edx
mov dword [esp + 0x70], 0x989680
mov dword [esp + 0x74], 0x989680
mov dword [esp + 0x118], 0
mov eax, dword [edi + 0x30]
mov dword [esp + 8], eax
test ecx, ecx
je 0x85b165
mov eax, dword [ecx]
mov dword [esp + 0x2c], 0
test al, 1
je 0x85b0f7
mov ecx, dword [ecx + 4]
mov dword [esp + 0x2c], ecx
mov ecx, 0x989680
test al, 2
je 0x85b10e
mov ecx, dword [esp + 0x144]
mov ecx, dword [ecx + 8]
mov dword [esp + 0x70], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0x989680
test al, 0x10
mov dword [esp + 0x18], ebp
je 0x85b138
mov ebp, dword [esp + 0x144]
mov ecx, dword [ebp + 0x14]
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x74], ecx
test al, 4
je 0x85b151
mov ebp, dword [esp + 0x144]
mov ebp, dword [ebp + 0xc]
mov dword [esp + 0x118], ebp
mov ebp, dword [esp + 0x18]
test al, 8
mov ecx, dword [esp + 8]
je 0x85b181
mov eax, dword [esp + 0x144]
mov ecx, dword [eax + 0x10]
jmp 0x85b181
mov dword [esp + 0x2c], 0
mov dword [esp + 0x14], 0x989680
mov dword [esp + 0x10], 0x989680
mov ecx, dword [esp + 8]
mov eax, dword [edi + 0xc]
mov dword [esp + 0x38], eax
test ah, 0x20
je 0x85b19a
mov eax, dword [edi + 0x10]
cmp eax, dword [esp + 0x10]
jae 0x85b19a
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x38]
test ah, 0x40
je 0x85b1b0
mov eax, dword [edi + 0x14]
cmp eax, dword [esp + 0x14]
jae 0x85b1b0
mov dword [esp + 0x74], eax
test ecx, ecx
mov eax, 0x8b0d04
je 0x85b1bb
mov eax, ecx
imul edx, ebp
mov ebp, dword [edi + 8]
mov ecx, dword [esp + 0xc]
lea ecx, [ecx + edx*2]
mov dword [esp + 0xe0], ecx
mov dword [esp + 0xe4], esi
mov ecx, dword [esp + 0x150]
mov dword [esp + 0x104], ecx
lea ecx, [esi + ebx*2]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xe8], ecx
mov ecx, ebp
shr ecx, 5
and ecx, 1
mov dword [esp + 0xc8], ecx
mov ecx, ebp
shr ecx, 0x1d
and ecx, 1
mov dword [esp + 0xc4], ecx
mov ecx, ebp
shr ecx, 0x19
and ecx, 1
mov dword [esp + 0xc0], ecx
mov dword [esp + 0x98], 0
mov edx, dword [esp + 0x154]
mov ecx, edx
shr ecx, 7
and ecx, 1
mov dword [esp + 0xb4], ecx
mov ecx, edx
shr ecx, 8
and ecx, 1
mov dword [esp + 0xb8], ecx
mov ecx, edx
shr ecx, 0xa
and ecx, 1
mov dword [esp + 0xcc], ecx
mov ecx, edx
shr ecx, 0x1c
and ecx, 1
mov dword [esp + 0xd0], ecx
mov dword [esp + 0xd4], 0
mov dword [esp + 0x120], 0
mov dword [esp + 0x11c], 0
mov dword [esp + 0x114], 0
mov ecx, dword [esp + 0x38]
shr ecx, 0xc
and ecx, 1
mov dword [esp + 0xdc], ecx
mov dword [esp + 0xa8], eax
lea ecx, [eax + 0x100]
mov dword [esp + 0xac], ecx
add eax, 0x340
mov dword [esp + 0xb0], eax
mov ecx, edx
and ecx, 0x1800000
cmp ecx, 0x1000000
mov dword [esp + 0x10], ebp
je 0x85b310
cmp ecx, 0x800000
mov eax, dword [esp + 0x15c]
je 0x85b31b
mov ebp, 0xffffffe9
test ecx, ecx
jne 0x85af18
mov ebp, dword [esp + 0x10]
test ebp, 0x1800000
je 0x85b322
mov ecx, ebp
shr ecx, 0x17
and ecx, 1
jmp 0x85b324
xor ecx, ecx
mov eax, dword [esp + 0x15c]
jmp 0x85b32b
mov ecx, 1
jmp 0x85b32b
xor ecx, ecx
mov edx, dword [esp + 0x154]
mov dword [esp + 0xd8], ecx
test edx, 0x700000
mov edx, ebp
je 0x85b343
mov edx, dword [esp + 0x154]
shr edx, 0x14
mov ecx, edx
and cl, 7
cmp cl, 5
ja case.default.0x85b357
mov cx, 0xa
and edx, 7
jmp dword [edx*4 + 0x85c194]
mov cx, 0xd
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 1
mov word [esp + 0xa0], cx
jmp 0x85b3c7
mov ebp, 0xffffffe9
jmp 0x85af18
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 2
mov dword [esp + 0xa0], 0xa000d
jmp 0x85b3c7
mov dword [esp + 0x84], 1
jmp 0x85b3c7
mov dword [esp + 0x84], 2
mov ecx, dword [esp + 0x38]
test ch, 2
je 0x85b3e4
mov ecx, dword [esp + 0xf8]
mov ebp, 0xfffffff3
test ecx, ecx
jne 0x85af18
mov ecx, 0xaaaaaaab
mul ecx
mov ecx, edx
shr ecx, 1
lea eax, [ecx + ecx*2]
mov dword [esp + 0x64], eax
lea eax, [eax + eax]
mov edx, 0x55555556
imul edx
mov dword [esp + 0x34], edx
movzx ebp, word [edi + 0x20]
test ebp, ebp
je 0x85b44c
cmp ecx, ebp
ja 0x85b44c
lea eax, [ebp + ebp*2]
lea eax, [eax*4 + 0xc]
sub esp, 0xc
push eax
call dword [0x89cdb8]
add esp, 0x10
mov ecx, eax
mov dword [esp + 0x78], ecx
test ecx, ecx
je 0x85b615
lea ebp, [ebp + ebp*2 + 3]
lea eax, [esp + 0x78]
mov dword [esp + 0x50], eax
mov dword [esp + 0x40], 1
jmp 0x85b46b
lea eax, [esp + 0x78]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x158]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x40], 0
mov ebp, dword [esp + 0x64]
mov eax, dword [esp + 0x154]
mov edx, dword [esp + 0x10]
or edx, eax
and edx, 0x10
mov dword [esp + 0x48], edx
mov dword [esp + 0x7c], ebp
lea eax, [ebp + ebp]
mov edx, 0x55555556
imul edx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x80], eax
mov dword [esp + 0x100], 0
test ecx, ecx
mov edx, dword [esp + 0x15c]
je 0x85b4f9
movzx edx, word [edi + 0x1e]
mov eax, ebp
sub eax, edx
cmp eax, 2
jl 0x85b4c4
lea eax, [ecx + eax*4]
jmp 0x85b4c7
lea eax, [ecx + 8]
lea edx, [ecx + ebp*4 - 4]
cmp edx, eax
jb 0x85b4dc
mov dword [edx], 0xffffffff
add edx, 0xfffffffc
cmp edx, eax
jae 0x85b4cf
mov edx, dword [esp + 0x15c]
test edx, edx
jle 0x85b4f9
mov dword [ecx], 0xffffffff
cmp edx, 1
je 0x85b4f9
mov dword [ecx + 4], 0xffffffff
cmp dword [esp + 0x48], 0
mov eax, dword [edi + 0xc]
je 0x85b551
mov dword [esp + 0x24], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
shr ecx, 0x1f
test al, 0x40
jne 0x85b5c8
mov al, 1
mov dword [esp + 0x44], eax
mov dword [esp + 0x60], 0
mov dword [esp + 0x28], 0
jmp 0x85b698
test al, 0x10
jne 0x85b5ec
mov dword [esp + 0x24], 0
cmp dword [esp + 0x2c], 0
je 0x85b50b
mov ecx, dword [esp + 0x38]
and ecx, 0x100
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov ebp, dword [esp + 0x10]
jne 0x85b527
mov ebp, dword [esp + 0x2c]
mov ecx, dword [ebp + 4]
and ecx, 1
neg ecx
lea ebp, [ebp + 8]
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x10]
and dword [esp + 0x1c], ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
jmp 0x85b527
mov dword [esp + 0xc], eax
mov ax, word [edi + 0x1a]
cmp byte [esp + 0xc], 0
mov dword [esp + 0x60], eax
js 0x85b61f
mov dword [esp + 0x44], 0
mov dword [esp + 0x28], eax
jmp 0x85b698
mov bp, word [edi + 0x18]
test al, 0x20
mov dword [esp + 0x18], ebp
jne 0x85c0d4
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], ebp
jmp 0x85b523
mov ebp, 0xfffffffa
jmp 0x85af18
movzx ebp, ax
cmp ebp, 0xff
mov dword [esp + 0x28], eax
ja 0x85b63d
mov edx, dword [esp + 0xac]
movzx eax, byte [edx + ebp]
mov dword [esp + 0x28], eax
mov dword [esp + 0x44], 0
cmp dword [esp + 0x30], 0
je 0x85b68d
mov eax, ebp
cmp ebp, 0x80
jb 0x85b68d
mov edx, eax
and edx, 0xff80
shr edx, 7
movzx edx, byte [edx + 0x8a0804]
shl edx, 7
mov ebp, eax
and ebp, 0x7f
or ebp, edx
movzx edx, word [ebp + ebp + 0x8a2a04]
add eax, dword [edx*8 + 0x89f188]
mov dword [esp + 0x44], 0
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x15c]
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x150]
lea eax, [esi + eax*2 - 2]
mov dword [esp + 0x68], eax
add dword [esp + 0x34], ecx
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov dword [esp + 0x4c], 0
jmp 0x85b940
add eax, 2
cmp eax, dword [esp + 0x14]
jae 0x85b6d6
cmp word [eax], bp
jne 0x85b6c8
cmp eax, dword [esp + 0x14]
mov dword [esp + 0x68], eax
jae 0x85c181
mov ecx, dword [esp + 8]
mov dword [esp + 0xec], ecx
mov dword [esp + 0xf4], ecx
mov dword [esp + 0x6c], 0
mov dword [esp + 0x108], 0
mov dword [esp + 0xfc], 0
mov dword [esp + 0x94], 0
mov edx, dword [esp + 0xe0]
sub esp, 0xc
push 0
push 0
lea eax, [esp + 0x80]
push eax
push 2
push ecx
call fcn.0085c1c0
add esp, 0x20
mov ebp, eax
cmp dword [esp + 0xd4], 0
setne cl
cmp dword [esp + 0x5c], 0
sete al
and al, cl
je 0x85b764
mov ecx, dword [esp + 0xf4]
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x144]
mov edx, dword [esp + 0x15c]
test al, al
mov eax, dword [esp + 8]
jne 0x85b77e
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x4c], eax
lea eax, [ebp + 0x3e4]
cmp eax, 4
ja case.default.0x85b78d
jmp dword [eax*4 + 0x85c1ac]
mov ebp, dword [esp + 0xec]
cmp ebp, dword [esp + 8]
jbe case.0x85b78d.995
jmp 0x85b800
test ebp, ebp
jne 0x85bf6d
mov eax, dword [esp + 8]
lea ebp, [eax + 2]
cmp dword [esp + 0x30], 0
mov dword [esp + 0x98], 0
je 0x85b800
cmp ebp, dword [esp + 0x14]
jae 0x85b800
mov ecx, eax
movzx eax, word [ecx + 2]
and eax, 0xfc00
cmp eax, 0xdc00
jne 0x85b800
lea ebp, [ecx + 4]
test dword [esp + 0x10], 0x40000
jne 0x85b80e
jmp 0x85b8c2
mov eax, dword [esp + 0x94]
mov dword [esp + 0x98], eax
mov ebp, dword [esp + 8]
test dword [esp + 0x10], 0x40000
je 0x85b8c2
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0xe8]
test ecx, ecx
je 0x85b863
cmp dword [esp + 8], eax
jae 0x85b8c2
sub esp, 0xc
push dword [esp + 0x48]
lea edx, [esp + 0x98]
push edx
push eax
push ecx
push dword [esp + 0x24]
call fcn.00869060
add esp, 0x20
or eax, dword [esp + 0x48]
jne 0x85c181
cmp ebp, dword [esp + 0x14]
mov edx, dword [esp + 0x15c]
jbe 0x85b8d7
jmp 0x85beab
mov ecx, dword [esp + 0x88]
lea edx, [ecx + ecx]
sub eax, edx
mov edx, dword [esp + 0x15c]
cmp dword [esp + 8], eax
ja 0x85b8c2
mov eax, dword [esp + 8]
movzx eax, word [eax]
cmp ax, word [esp + 0xa0]
jne 0x85b8c2
cmp ecx, 1
je 0x85beab
cmp dword [esp + 0x48], 0
jne 0x85beab
cmp ebp, dword [esp + 0x14]
ja 0x85beab
movzx eax, word [esp + 0xa2]
mov ecx, dword [esp + 8]
cmp word [ecx + 2], ax
jne 0x85b8d7
jmp 0x85beab
cmp dword [esp + 0x48], 0
jne 0x85beab
cmp ebp, dword [esp + 0x14]
ja 0x85beab
cmp ebp, dword [esp + 0x58]
jbe 0x85b92d
cmp ebp, dword [esp + 0x14]
jae 0x85b92d
movzx eax, word [ebp - 2]
cmp eax, 0xd
jne 0x85b92d
movzx eax, word [ebp]
cmp eax, 0xa
jne 0x85b92d
test byte [edi + 0xd], 8
jne 0x85b92d
mov ecx, dword [esp + 0x84]
dec ecx
lea eax, [ebp + 2]
cmp dword [esp + 0x88], 2
mov edx, eax
je 0x85b914
mov edx, ebp
cmp ecx, 2
jb 0x85b91b
mov eax, edx
mov ebp, eax
mov edx, dword [esp + 0x15c]
jmp 0x85b92d
mov eax, ecx
jmp 0x85bdd7
mov dword [esp + 0x11c], 0
mov dword [esp + 8], ebp
mov ebp, dword [esp + 0x10]
test ebp, 0x40000
mov ecx, dword [esp + 0x14]
je 0x85badd
cmp dword [esp + 0x30], 0
mov eax, dword [esp + 0xe8]
je 0x85ba1b
mov ecx, dword [esp + 8]
cmp ecx, eax
jae 0x85badd
mov ebp, dword [esp + 8]
mov ecx, dword [esp + 0x84]
test ecx, ecx
je 0x85b9a7
sub esp, 0xc
push dword [esp + 0x48]
lea edx, [esp + 0x98]
push edx
push eax
push ecx
push ebp
call fcn.00869060
add esp, 0x20
test eax, eax
mov edx, dword [esp + 0x15c]
je 0x85b9e7
jmp 0x85bace
mov ecx, dword [esp + 0x88]
lea edx, [ecx + ecx]
sub eax, edx
cmp ebp, eax
mov edx, dword [esp + 0x15c]
ja 0x85b9e7
movzx eax, word [ebp]
cmp ax, word [esp + 0xa0]
jne 0x85b9e7
cmp ecx, 1
je 0x85bace
movzx eax, word [ebp + 2]
cmp ax, word [esp + 0xa2]
je 0x85bace
lea ecx, [ebp + 2]
cmp ecx, dword [esp + 0x14]
jae 0x85ba05
movzx eax, word [ebp + 2]
and eax, 0xfc00
cmp eax, 0xdc00
jne 0x85ba05
add ebp, 4
mov ecx, ebp
mov eax, dword [esp + 0xe8]
cmp ecx, eax
mov ebp, ecx
jb 0x85b972
jmp 0x85badd
mov ecx, dword [esp + 8]
cmp ecx, eax
jae 0x85badd
mov ecx, dword [esp + 8]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x84]
test ecx, ecx
je 0x85ba6f
sub esp, 0xc
push dword [esp + 0x48]
lea edx, [esp + 0x98]
push edx
push eax
push ecx
push dword [esp + 0x28]
call fcn.00869060
add esp, 0x20
test eax, eax
jne 0x85bad2
mov eax, dword [esp + 0xe8]
mov edx, dword [esp + 0x15c]
mov ecx, dword [esp + 0xc]
jmp 0x85bac1
mov ecx, dword [esp + 0x88]
mov dword [esp + 0x54], ecx
lea edx, [ecx + ecx]
mov ebp, eax
sub ebp, edx
mov ecx, dword [esp + 0xc]
cmp ecx, ebp
jbe 0x85ba92
mov edx, dword [esp + 0x15c]
jmp 0x85bac1
movzx edx, word [ecx]
cmp dx, word [esp + 0xa0]
jne 0x85ba62
cmp dword [esp + 0x54], 1
mov edx, dword [esp + 0x15c]
je 0x85bad9
mov ebp, dword [esp + 0xc]
movzx ecx, word [ebp + 2]
cmp cx, word [esp + 0xa2]
mov ecx, ebp
je 0x85badd
add ecx, 2
cmp ecx, eax
jb 0x85ba2b
jmp 0x85badd
mov ecx, ebp
jmp 0x85badd
mov edx, dword [esp + 0x15c]
mov ecx, dword [esp + 0xc]
mov eax, dword [edi + 8]
or eax, dword [esp + 0x154]
test eax, 0x4000000
jne 0x85bdd3
cmp dword [esp + 0x20], 0
mov edx, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 8]
mov dword [esp + 0xc], ecx
je 0x85bb3a
mov dword [esp + 0x18], edx
cmp dx, bp
jne 0x85bbab
cmp eax, ecx
mov edx, dword [esp + 0x15c]
jae 0x85bdd7
cmp word [eax], bp
je 0x85bdd7
add eax, 2
cmp eax, ecx
jb 0x85bb25
jmp 0x85bdd7
mov eax, dword [esp + 0x38]
test ah, 1
jne 0x85bbe7
cmp dword [esp + 0x1c], 0
mov edx, dword [esp + 0x15c]
je 0x85bdd3
mov eax, dword [esp + 8]
cmp eax, ecx
jae 0x85bdd7
mov ebp, eax
movzx ecx, word [eax]
cmp ecx, 0xff
jb 0x85bb77
mov ecx, 0xff
mov eax, ecx
shr eax, 3
mov edx, dword [esp + 0x1c]
movzx edx, byte [edx + eax]
and cl, 7
mov eax, 1
shl eax, cl
and eax, edx
jne 0x85bb95
add ebp, 2
mov ecx, dword [esp + 0xc]
test eax, eax
mov edx, dword [esp + 0x15c]
mov eax, ebp
je 0x85bb5d
jmp 0x85bdd7
cmp eax, ecx
mov edx, dword [esp + 0x15c]
jae 0x85bdd7
mov ecx, edx
mov edx, eax
movzx eax, word [eax]
cmp ax, word [esp + 0x18]
je 0x85bcdf
cmp ax, bp
je 0x85bcdf
mov eax, edx
add eax, 2
cmp eax, dword [esp + 0xc]
mov edx, ecx
jb 0x85bbba
jmp 0x85bdd7
mov eax, dword [esp + 0xe4]
mov ecx, dword [esp + 0x150]
lea ecx, [eax + ecx*2]
cmp dword [esp + 8], ecx
mov edx, dword [esp + 0x15c]
jbe 0x85bdd3
cmp dword [esp + 0x30], 0
je 0x85bce8
mov ecx, dword [esp + 0xc]
cmp dword [esp + 8], ecx
jb 0x85bc2a
jmp 0x85bd97
mov eax, dword [esp + 0xe4]
mov ecx, dword [esp + 0x84]
test ecx, ecx
je 0x85bc60
mov ebp, dword [esp + 8]
cmp ebp, eax
jbe 0x85bca8
sub esp, 0xc
push dword [esp + 0x48]
lea edx, [esp + 0x98]
push edx
push eax
push ecx
push ebp
call fcn.00869110
add esp, 0x20
test eax, eax
je 0x85bca8
jmp 0x85bd90
mov ecx, dword [esp + 0x88]
lea eax, [eax + ecx*2]
mov ebp, dword [esp + 8]
cmp ebp, eax
jb 0x85bca8
lea eax, [ecx + ecx]
mov edx, ebp
sub edx, eax
movzx eax, word [edx]
cmp ax, word [esp + 0xa0]
jne 0x85bca8
cmp ecx, 1
je 0x85bd90
neg ecx
mov ebp, dword [esp + 8]
movzx eax, word [ebp + ecx*2 + 2]
cmp ax, word [esp + 0xa2]
je 0x85bd90
lea eax, [ebp + 2]
mov ecx, dword [esp + 0xc]
cmp eax, ecx
jae 0x85bcce
movzx ecx, word [ebp + 2]
and ecx, 0xfc00
cmp ecx, 0xdc00
jne 0x85bcca
add ebp, 4
mov eax, ebp
mov ecx, dword [esp + 0xc]
mov dword [esp + 8], eax
cmp eax, ecx
jb 0x85bc23
jmp 0x85bd90
mov eax, edx
mov edx, ecx
jmp 0x85bdd7
mov ecx, dword [esp + 0xc]
cmp dword [esp + 8], ecx
jae 0x85bd97
mov ecx, dword [esp + 8]
lea ebp, [ecx + 2]
jmp 0x85bd09
mov eax, dword [esp + 0xe4]
add ebp, 2
lea ecx, [ebp - 2]
mov edx, dword [esp + 0x84]
test edx, edx
je 0x85bd43
cmp ecx, eax
jbe 0x85bd78
sub esp, 0xc
push dword [esp + 0x48]
mov dword [esp + 0x64], ebp
lea ebp, [esp + 0x98]
push ebp
mov ebp, dword [esp + 0x68]
push eax
push edx
push ecx
call fcn.00869110
add esp, 0x20
test eax, eax
je 0x85bd78
jmp 0x85bd89
mov edx, dword [esp + 0x88]
lea eax, [eax + edx*2]
cmp ecx, eax
jb 0x85bd78
lea ecx, [edx + edx]
mov eax, ebp
sub eax, ecx
movzx ecx, word [eax - 2]
cmp cx, word [esp + 0xa0]
jne 0x85bd78
cmp edx, 1
je 0x85bd90
movzx eax, word [eax]
cmp ax, word [esp + 0xa2]
je 0x85bd90
add dword [esp + 8], 2
cmp ebp, dword [esp + 0xc]
jb 0x85bcff
jmp 0x85bd90
add ebp, 0xfffffffe
mov dword [esp + 8], ebp
mov edx, dword [esp + 0x15c]
mov ecx, dword [esp + 8]
movzx eax, word [ecx - 2]
cmp eax, 0xd
jne 0x85b926
cmp ecx, dword [esp + 0xc]
jae 0x85bdd3
mov eax, dword [esp + 0x84]
dec eax
cmp eax, 1
ja 0x85bdd3
mov eax, dword [esp + 8]
movzx eax, word [eax]
cmp eax, 0xa
jne 0x85bdcc
add dword [esp + 8], 2
mov edx, dword [esp + 0x15c]
mov eax, dword [esp + 8]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
or eax, dword [esp + 0x154]
and eax, 0x4000000
or eax, dword [esp + 0xf8]
jne 0x85b6e4
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x85be1c
test byte [eax + 4], 2
je 0x85be1c
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 8]
sar eax, 1
mov ecx, dword [esp + 0x2c]
cmp eax, dword [ecx + 0x28]
jb 0x85beab
cmp byte [esp + 0x44], 0
jne 0x85b6e4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
sub eax, ecx
cmp eax, 0x7cf
jg 0x85b6e4
mov eax, dword [esp + 0x20]
lea eax, [ecx + eax*2]
cmp eax, dword [esp + 0x68]
jbe 0x85b6e4
mov ebp, dword [esp + 0x60]
cmp bp, word [esp + 0x28]
je 0x85b6cb
cmp eax, dword [esp + 0x14]
jae 0x85b6d6
movzx ecx, word [eax]
cmp cx, word [esp + 0x28]
mov edx, eax
je 0x85be85
lea edx, [eax + 2]
cmp cx, bp
jne 0x85be8a
cmp eax, dword [esp + 0x14]
jb 0x85be96
jmp 0x85b6d6
cmp cx, bp
je 0x85be7a
mov eax, edx
cmp eax, dword [esp + 0x14]
jae 0x85b6d6
cmp cx, bp
je 0x85b6d6
cmp cx, word [esp + 0x28]
jne 0x85be66
jmp 0x85b6d6
mov ecx, dword [esp + 0x144]
xor ebp, ebp
cmp dword [esp + 0x40], 0
mov eax, dword [esp + 0x158]
je 0x85bef6
sub esp, 0xc
mov eax, dword [esp + 0x5c]
push dword [eax]
call dword [0x89cdbc]
mov edx, dword [esp + 0x16c]
mov eax, dword [esp + 0x168]
mov ecx, dword [esp + 0x154]
add esp, 0x10
test ebp, ebp
je 0x85bef6
cmp ebp, 0xfffffff4
jne 0x85af18
cmp dword [esp + 0x4c], 0
je 0x85bf46
mov dword [esp + 0x11c], 0
mov ebp, 0xfffffff4
cmp edx, 2
jl 0x85bf4b
mov edi, dword [esp + 0x5c]
sub edi, esi
sar edi, 1
mov dword [eax], edi
add ebx, ebx
sar ebx, 1
mov dword [eax + 4], ebx
mov ebp, 0xfffffff4
cmp edx, 2
je 0x85bf4b
mov edx, dword [esp + 0x4c]
sub edx, esi
sar edx, 1
mov dword [eax + 8], edx
mov ebp, 0xfffffff4
test ecx, ecx
jne 0x85bf53
jmp 0x85af18
mov ebp, 0xffffffff
test ecx, ecx
je 0x85af18
test byte [ecx], 0x20
je 0x85af18
mov eax, dword [esp + 0x120]
mov ecx, dword [ecx + 0x18]
mov dword [ecx], eax
jmp 0x85af18
cmp ebp, 1
je 0x85bf7e
cmp ebp, 0xfffffc19
jne 0x85c15c
cmp dword [esp + 0x40], 0
je 0x85bfdd
cmp dword [esp + 0x64], 6
jl 0x85bfb6
mov eax, dword [esp + 0x158]
lea eax, [eax + 8]
mov ecx, dword [esp + 0x78]
add ecx, 8
mov edx, dword [esp + 0x34]
lea edx, [edx*4 - 8]
sub esp, 4
push edx
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0x10
mov eax, dword [esp + 0x34]
cmp dword [esp + 0xfc], eax
jle 0x85bfcb
or byte [esp + 0x102], 1
sub esp, 0xc
mov eax, dword [esp + 0x5c]
push dword [eax]
call dword [0x89cdbc]
add esp, 0x10
mov eax, dword [esp + 0xfc]
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
cmp eax, dword [esp + 0x34]
mov edx, ecx
jl 0x85bff7
xor edx, edx
test byte [esp + 0x102], 1
mov esi, ecx
je 0x85c005
mov esi, edx
cmp dword [esp + 0x158], 0
je 0x85c06c
movzx edx, word [edi + 0x1e]
cmp ecx, edx
jg 0x85c06c
lea edx, [edx + edx + 2]
mov ecx, dword [esp + 0x15c]
cmp edx, ecx
jg 0x85c028
mov ecx, edx
cmp eax, ecx
jge 0x85c06c
mov edx, dword [esp + 0x158]
mov edi, edx
lea edx, [edi + ecx*4]
lea ecx, [edi + eax*4]
lea edi, [edi + eax*4 + 4]
shl eax, 2
cmp edx, edi
ja 0x85c048
mov edx, edi
sub edx, eax
mov eax, dword [esp + 0x158]
not eax
lea eax, [edx + eax + 4]
and eax, 0xfffffffc
sub esp, 4
push eax
push 0xff
push ecx
call sub.msvcrt.dll_memset
add esp, 0x10
xor ebp, ebp
cmp dword [esp + 0x15c], 2
jl 0x85c0a3
mov eax, dword [esp + 0xe4]
mov ecx, dword [esp + 0xec]
sub ecx, eax
sar ecx, 1
mov edx, dword [esp + 0x158]
mov dword [edx], ecx
mov ecx, dword [esp + 0xf0]
sub ecx, eax
sar ecx, 1
mov dword [edx + 4], ecx
mov ebp, esi
cmp dword [esp + 0x144], 0
je 0x85af18
mov eax, dword [esp + 0x144]
test byte [eax], 0x20
je 0x85af18
mov eax, dword [esp + 0x11c]
mov ecx, dword [esp + 0x144]
jmp 0x85bf63
movzx ecx, bp
cmp ecx, 0xff
mov dword [esp + 0x24], ebp
ja 0x85c0f2
mov edx, dword [esp + 0xac]
movzx edx, byte [edx + ecx]
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], 0
cmp dword [esp + 0x30], 0
mov dword [esp + 0x20], 1
je 0x85c150
cmp ecx, 0x80
jb 0x85c150
mov edx, ecx
and edx, 0xff80
shr edx, 7
movzx edx, byte [edx + 0x8a0804]
shl edx, 7
mov ebp, ecx
and ebp, 0x7f
or ebp, edx
movzx edx, word [ebp + ebp + 0x8a2a04]
add ecx, dword [edx*8 + 0x89f188]
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x15c]
jmp 0x85b523
cmp dword [esp + 0x40], 0
mov ecx, dword [esp + 0x144]
mov eax, dword [esp + 0x158]
mov edx, dword [esp + 0x15c]
jne 0x85bec2
jmp 0x85bee9
mov ecx, dword [esp + 0x144]
mov edx, dword [esp + 0x15c]
jmp case.0x85b78d.996