Function at 0x64bed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x12c
mov edx, dword [esp + 0x150]
mov ebx, dword [esp + 0x14c]
mov esi, dword [esp + 0x148]
mov edi, dword [esp + 0x140]
test edi, edi
jne 0x64bf35
cmp dword [esp + 0x144], 0
jne 0x64bf35
test esi, esi
jne 0x64bf35
cmp ebx, 0xfffffc19
jne 0x64bf35
cmp edx, 0xfffffc19
jne 0x64bf35
sub esp, 0xc
xor ecx, ecx
xor edx, edx
push 0
push 0
push 0
push 0
push 0
call fcn.0064d1b0
add esp, 0x20
mov ebp, eax
jmp 0x64bf49
mov ecx, dword [esp + 0x154]
mov ebp, 0xfffffffd
test ecx, 0xe20f5a6f
je 0x64bf56
mov eax, ebp
add esp, 0x12c
pop esi
pop edi
pop ebx
pop ebp
ret
test edi, edi
mov ebp, 0xfffffffe
je 0x64bf49
test esi, esi
je 0x64bf49
mov eax, dword [esp + 0x15c]
cmp dword [esp + 0x158], 0
jne 0x64bf7d
mov ebp, 0xfffffffe
test eax, eax
jg 0x64bf49
test eax, eax
js 0x64c063
test ebx, ebx
js 0x64c06d
test edx, edx
mov ebp, 0xffffffe8
js 0x64bf49
cmp edx, ebx
jg 0x64bf49
mov eax, dword [edi]
cmp eax, 0x50435245
jne 0x64c077
mov ebp, 0xffffffe4
test byte [edi + 0xc], 2
je 0x64bf49
mov eax, 0x800
and eax, dword [edi + 8]
mov dword [esp + 0x30], eax
mov ebp, eax
shr ebp, 0xb
mov eax, ecx
shr eax, 0xf
and eax, 1
test ecx, 0x8000000
mov ecx, 2
cmove ecx, eax
mov dword [esp + 0x3c], ebp
mov dword [esp + 0xbc], ebp
mov dword [esp + 0xf8], ecx
lea eax, [esi + edx*2]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x154]
test ah, 0x20
jne 0x64c0b9
cmp dword [esp + 0x30], 0
je 0x64c0b9
sub esp, 4
lea eax, [esp + 0x12c]
push eax
push ebx
push esi
call fcn.0065a530
add esp, 0x10
test eax, eax
je 0x64c08e
cmp dword [esp + 0x15c], 2
jl 0x64c043
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x158]
mov dword [edx], ecx
mov dword [edx + 4], eax
cmp dword [esp + 0xf8], 1
mov ebp, 0xffffffe7
mov ecx, 0xfffffff6
cmovle ebp, ecx
cmp eax, 2
cmovge ebp, ecx
jmp 0x64bf49
mov ebp, 0xfffffff1
jmp 0x64bf49
mov ebp, 0xffffffe0
jmp 0x64bf49
cmp eax, 0x45524350
mov eax, 0xffffffe3
mov ebp, 0xfffffffc
cmove ebp, eax
jmp 0x64bf49
mov eax, dword [esp + 0x150]
test eax, eax
jle 0x64c0b9
cmp eax, ebx
jge 0x64c0b9
mov eax, dword [esp + 0x58]
movzx eax, word [eax]
and eax, 0xfc00
mov ebp, 0xfffffff5
cmp eax, 0xdc00
je 0x64bf49
movzx eax, word [edi + 0x22]
lea eax, [edi + eax*2]
mov dword [esp + 0xc], eax
mov dword [esp + 0x9c], eax
movzx eax, word [edi + 0x26]
mov dword [esp + 8], eax
mov dword [esp + 0x8c], eax
movzx edx, word [edi + 0x24]
mov dword [esp + 0x90], edx
mov dword [esp + 0x70], 0x989680
mov dword [esp + 0x74], 0x989680
mov dword [esp + 0x118], 0
mov eax, dword [edi + 0x30]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x144]
test ecx, ecx
je 0x64c151
mov eax, dword [ecx]
mov dword [esp + 0x2c], 0
test al, 1
je 0x64c127
mov ebp, dword [ecx + 4]
mov dword [esp + 0x2c], ebp
mov ebp, 0x989680
test al, 2
je 0x64c137
mov ebp, dword [ecx + 8]
mov dword [esp + 0x70], ebp
mov dword [esp + 0x10], 0x989680
test al, 0x10
jne 0x64c16c
test al, 4
jne 0x64c183
test al, 8
jne 0x64c19f
mov ecx, dword [esp + 0x18]
jmp 0x64c1a2
mov dword [esp + 0x2c], 0
mov dword [esp + 0x10], 0x989680
mov ebp, 0x989680
mov ecx, dword [esp + 0x18]
jmp 0x64c1a2
mov dword [esp + 0x14], ebp
mov ebp, dword [ecx + 0x14]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x74], ebp
mov ebp, dword [esp + 0x14]
test al, 4
je 0x64c147
mov ecx, dword [esp + 0x144]
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x118], ecx
mov ecx, dword [esp + 0x144]
test al, 8
je 0x64c14b
mov ecx, dword [ecx + 0x10]
mov eax, dword [edi + 0xc]
mov dword [esp + 0x38], eax
test ah, 0x20
je 0x64c1b9
mov eax, dword [edi + 0x10]
cmp eax, ebp
jae 0x64c1b9
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x38]
test ah, 0x40
je 0x64c1cf
mov eax, dword [edi + 0x14]
cmp eax, dword [esp + 0x10]
jae 0x64c1cf
mov dword [esp + 0x74], eax
test ecx, ecx
mov eax, 0x7ed6f4
cmovne eax, ecx
imul edx, dword [esp + 8]
mov ebp, dword [edi + 8]
mov ecx, dword [esp + 0xc]
lea ecx, [ecx + edx*2]
mov dword [esp + 0xe0], ecx
mov dword [esp + 0xe4], esi
mov ecx, dword [esp + 0x150]
mov dword [esp + 0x104], ecx
lea ecx, [esi + ebx*2]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xe8], ecx
mov ecx, ebp
shr ecx, 5
and ecx, 1
mov dword [esp + 0xc8], ecx
mov ecx, ebp
shr ecx, 0x1d
and ecx, 1
mov dword [esp + 0xc4], ecx
mov ecx, ebp
shr ecx, 0x19
and ecx, 1
mov dword [esp + 0xc0], ecx
mov dword [esp + 0x98], 0
mov edx, dword [esp + 0x154]
mov ecx, edx
shr ecx, 7
and ecx, 1
mov dword [esp + 0xb4], ecx
mov ecx, edx
shr ecx, 8
and ecx, 1
mov dword [esp + 0xb8], ecx
mov ecx, edx
shr ecx, 0xa
and ecx, 1
mov dword [esp + 0xcc], ecx
mov ecx, edx
shr ecx, 0x1c
and ecx, 1
mov dword [esp + 0xd0], ecx
mov dword [esp + 0xd4], 0
mov dword [esp + 0x120], 0
mov dword [esp + 0x11c], 0
mov dword [esp + 0x114], 0
mov ecx, dword [esp + 0x38]
shr ecx, 0xc
and ecx, 1
mov dword [esp + 0xdc], ecx
mov dword [esp + 0xa8], eax
lea ecx, [eax + 0x100]
mov dword [esp + 0xac], ecx
add eax, 0x340
mov dword [esp + 0xb0], eax
mov ecx, edx
and ecx, 0x1800000
cmp ecx, 0x1000000
mov dword [esp + 0x14], ebp
je 0x64c330
cmp ecx, sym.imp.KERNEL32.DLL_QueryPerformanceFrequency
mov eax, dword [esp + 0x15c]
je 0x64c33b
mov ebp, 0xffffffe9
test ecx, ecx
jne 0x64bf49
mov ebp, dword [esp + 0x14]
test ebp, 0x1800000
je 0x64c342
mov ecx, ebp
shr ecx, 0x17
and ecx, 1
jmp 0x64c344
xor ecx, ecx
mov eax, dword [esp + 0x15c]
jmp 0x64c344
mov ecx, 1
jmp 0x64c344
xor ecx, ecx
mov dword [esp + 0xd8], ecx
mov ecx, dword [esp + 0x154]
test ecx, 0x700000
mov edx, ecx
cmove edx, ebp
shr edx, 0x14
mov ecx, edx
and cl, 7
cmp cl, 5
ja case.default.0x64c371
mov cx, 0xa
and edx, 7
jmp dword [edx*4 + 0x64d180]
mov cx, 0xd
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 1
mov word [esp + 0xa0], cx
jmp 0x64c3e1
mov ebp, 0xffffffe9
jmp 0x64bf49
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 2
mov dword [esp + 0xa0], 0xa000d
jmp 0x64c3e1
mov dword [esp + 0x84], 1
jmp 0x64c3e1
mov dword [esp + 0x84], 2
mov ecx, dword [esp + 0x38]
test ch, 2
je 0x64c3fe
mov ecx, dword [esp + 0xf8]
mov ebp, 0xfffffff3
test ecx, ecx
jne 0x64bf49
mov ecx, 0xaaaaaaab
mul ecx
mov ecx, edx
shr ecx, 1
lea eax, [ecx + ecx*2]
mov dword [esp + 0x64], eax
lea eax, [eax + eax]
mov edx, 0x55555556
imul edx
mov dword [esp + 0x34], edx
movzx ebp, word [edi + 0x20]
test ebp, ebp
je 0x64c466
cmp ecx, ebp
ja 0x64c466
lea eax, [ebp + ebp*2]
lea eax, [eax*4 + 0xc]
sub esp, 0xc
push eax
call dword [0x7d97a8]
add esp, 0x10
mov ecx, eax
mov dword [esp + 0x78], ecx
test ecx, ecx
je 0x64c623
lea ebp, [ebp + ebp*2 + 3]
lea eax, [esp + 0x78]
mov dword [esp + 0x50], eax
mov dword [esp + 0x40], 1
jmp 0x64c485
lea eax, [esp + 0x78]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x158]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x40], 0
mov ebp, dword [esp + 0x64]
mov eax, dword [esp + 0x14]
or eax, dword [esp + 0x154]
and eax, 0x10
mov dword [esp + 0x48], eax
mov dword [esp + 0x7c], ebp
lea eax, [ebp + ebp]
mov edx, 0x55555556
imul edx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x80], eax
mov dword [esp + 0x100], 0
test ecx, ecx
je 0x64c50d
movzx edx, word [edi + 0x1e]
lea eax, [ecx + ebp*4 - 4]
sub ebp, edx
lea edx, [ecx + ebp*4]
mov dword [esp + 0xc], edx
lea edx, [ecx + 8]
cmp ebp, 2
cmovge edx, dword [esp + 0xc]
cmp eax, edx
jb 0x64c4f0
mov dword [eax], 0xffffffff
add eax, 0xfffffffc
cmp eax, edx
jae 0x64c4e3
mov edx, dword [esp + 0x15c]
test edx, edx
jle 0x64c50d
mov dword [ecx], 0xffffffff
cmp edx, 1
je 0x64c50d
mov dword [ecx + 4], 0xffffffff
cmp dword [esp + 0x48], 0
mov edx, dword [edi + 0xc]
je 0x64c566
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x1c], 0
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x34]
shr ecx, 0x1f
test dl, 0x40
jne 0x64c5dc
mov al, 1
mov dword [esp + 0x44], eax
mov dword [esp + 0x60], 0
mov dword [esp + 0x24], 0
jmp 0x64c69f
test dl, 0x10
jne 0x64c5f9
mov dword [esp + 0x18], 0
cmp dword [esp + 0x2c], 0
je 0x64c51f
mov ecx, dword [esp + 0x38]
and ecx, 0x100
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x1c], 0
mov ebp, dword [esp + 0x14]
jne 0x64c53b
mov ebp, dword [esp + 0x2c]
mov ecx, dword [ebp + 4]
and ecx, 1
neg ecx
lea eax, [ebp + 8]
mov ebp, dword [esp + 0x14]
and eax, ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x1c], 0
jmp 0x64c53b
mov ax, word [edi + 0x1a]
test dl, dl
mov dword [esp + 0x60], eax
js 0x64c62d
mov dword [esp + 0x44], 0
mov dword [esp + 0x24], eax
jmp 0x64c69f
mov bp, word [edi + 0x18]
test dl, 0x20
mov dword [esp + 0x28], ebp
jne 0x64d009
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], ebp
jmp 0x64c537
mov ebp, 0xfffffffa
jmp 0x64bf49
movzx ebp, ax
cmp ebp, 0xff
mov dword [esp + 0x24], eax
ja 0x64c64b
mov edx, dword [esp + 0xac]
movzx eax, byte [edx + ebp]
mov dword [esp + 0x24], eax
mov dword [esp + 0x44], 0
cmp dword [esp + 0x30], 0
je 0x64c69b
mov eax, ebp
cmp ebp, 0x80
jb 0x64c69b
mov edx, eax
and edx, 0xff80
shr edx, 7
movzx edx, byte [edx + 0x7dd1f4]
shl edx, 7
mov ebp, eax
and ebp, 0x7f
or ebp, edx
movzx edx, word [ebp + ebp + 0x7df3f4]
add eax, dword [edx*8 + 0x7dbb78]
mov dword [esp + 0x44], 0
mov dword [esp + 0x24], eax
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x150]
lea eax, [esi + eax*2 - 2]
mov dword [esp + 0x68], eax
add dword [esp + 0x34], ecx
mov dword [esp + 0x5c], 0
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov dword [esp + 0x4c], 0
mov ecx, dword [esp + 0x154]
jmp 0x64cb56
add eax, 2
cmp eax, dword [esp + 0x10]
jae 0x64c6e4
cmp word [eax], bp
jne 0x64c6d6
cmp eax, dword [esp + 0x10]
mov dword [esp + 0x68], eax
mov ebp, dword [esp + 8]
jae 0x64d092
mov dword [esp + 0xec], ebp
mov dword [esp + 0xf4], ebp
mov dword [esp + 0x6c], 0
mov dword [esp + 0x108], 0
mov dword [esp + 0xfc], 0
mov dword [esp + 0x94], 0
mov edx, dword [esp + 0xe0]
sub esp, 0xc
mov ecx, ebp
push 0
push 0
lea eax, [esp + 0x80]
push eax
push 2
push ebp
call fcn.0064d1b0
add esp, 0x20
mov ebp, eax
cmp dword [esp + 0xd4], 0
setne al
mov edx, dword [esp + 0x5c]
test edx, edx
sete cl
and cl, al
cmovne edx, dword [esp + 0xf4]
mov dword [esp + 0x5c], edx
test cl, cl
mov eax, dword [esp + 0x4c]
cmovne eax, dword [esp + 8]
mov dword [esp + 0x4c], eax
lea eax, [ebp + 0x3e4]
cmp eax, 4
ja case.default.0x64c795
mov edx, dword [esp + 0x15c]
jmp dword [eax*4 + 0x64d198]
mov ebp, dword [esp + 0xec]
cmp ebp, dword [esp + 8]
jbe case.0x64c795.995
jmp 0x64c812
test ebp, ebp
mov edx, dword [esp + 0x15c]
jne 0x64cead
mov eax, dword [esp + 8]
lea ebp, [eax + 2]
cmp dword [esp + 0x30], 0
mov dword [esp + 0x98], 0
je 0x64c812
cmp ebp, dword [esp + 0x10]
jae 0x64c812
mov ecx, dword [esp + 8]
movzx eax, word [ecx + 2]
and eax, 0xfc00
lea ecx, [ecx + 4]
cmp eax, 0xdc00
cmove ebp, ecx
test dword [esp + 0x14], 0x40000
jne 0x64c820
jmp 0x64c8ed
mov eax, dword [esp + 0x94]
mov dword [esp + 0x98], eax
mov ebp, dword [esp + 8]
test dword [esp + 0x14], 0x40000
je 0x64c8ed
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0xe8]
test ecx, ecx
je 0x64c880
cmp dword [esp + 8], eax
jae 0x64c8ed
sub esp, 0xc
push dword [esp + 0x48]
lea edx, [esp + 0x98]
push edx
push eax
push ecx
push dword [esp + 0x24]
call fcn.0065a200
add esp, 0x20
or eax, dword [esp + 0x48]
jne 0x64d092
cmp ebp, dword [esp + 0x10]
mov edx, dword [esp + 0x15c]
mov ecx, dword [esp + 0x154]
jbe 0x64c909
jmp case.0x64c795.996
mov ecx, dword [esp + 0x88]
lea edx, [ecx + ecx]
sub eax, edx
mov edx, dword [esp + 0x15c]
cmp dword [esp + 8], eax
ja 0x64c8ed
mov eax, dword [esp + 8]
movzx eax, word [eax]
cmp ax, word [esp + 0xa0]
jne 0x64c8ed
cmp ecx, 1
je case.0x64c795.996
cmp dword [esp + 0x48], 0
mov ecx, dword [esp + 0x154]
jne case.0x64c795.996
cmp ebp, dword [esp + 0x10]
ja 0x64d092
movzx eax, word [esp + 0xa2]
mov edx, dword [esp + 8]
cmp word [edx + 2], ax
mov edx, dword [esp + 0x15c]
jne 0x64c909
jmp case.0x64c795.996
cmp dword [esp + 0x48], 0
mov ecx, dword [esp + 0x154]
jne case.0x64c795.996
cmp ebp, dword [esp + 0x10]
ja case.0x64c795.996
cmp ebp, dword [esp + 0x58]
jbe 0x64cb43
cmp ebp, dword [esp + 0x10]
jae 0x64cb43
movzx eax, word [ebp - 2]
cmp eax, 0xd
jne 0x64cb43
movzx eax, word [ebp]
cmp eax, 0xa
jne 0x64cb43
test byte [edi + 0xd], 8
jne 0x64cb43
mov eax, dword [esp + 0x84]
dec eax
lea ecx, [ebp + 2]
cmp dword [esp + 0x88], 2
cmove ebp, ecx
cmp eax, 2
cmovb ebp, ecx
mov ecx, dword [esp + 0x154]
jmp 0x64cb43
mov eax, dword [esp + 0xe4]
mov ecx, dword [esp + 0x150]
lea ecx, [eax + ecx*2]
mov ebp, dword [esp + 8]
cmp ebp, ecx
jbe 0x64cb1f
cmp dword [esp + 0x30], 0
je 0x64ca4f
cmp ebp, edx
jb 0x64c9a1
jmp 0x64caf1
mov eax, dword [esp + 0xe4]
mov ecx, dword [esp + 0x84]
test ecx, ecx
je 0x64c9d7
cmp ebp, eax
jbe 0x64ca1b
sub esp, 0xc
push dword [esp + 0x48]
lea edx, [esp + 0x98]
push edx
push eax
push ecx
push ebp
call fcn.0065a2b0
mov edx, dword [esp + 0x2c]
add esp, 0x20
test eax, eax
je 0x64ca1b
jmp 0x64caf1
mov ecx, dword [esp + 0x88]
lea eax, [eax + ecx*2]
cmp ebp, eax
jb 0x64ca1b
lea eax, [ecx + ecx]
mov edx, ebp
sub edx, eax
movzx eax, word [edx]
mov edx, dword [esp + 0xc]
cmp ax, word [esp + 0xa0]
jne 0x64ca1b
cmp ecx, 1
je 0x64caf1
neg ecx
movzx eax, word [ebp + ecx*2 + 2]
cmp ax, word [esp + 0xa2]
je 0x64caf1
lea eax, [ebp + 2]
cmp eax, edx
jae 0x64ca34
movzx ecx, word [ebp + 2]
and ecx, 0xfc00
cmp ecx, 0xdc00
je 0x64ca38
mov ebp, eax
jmp 0x64ca3b
add ebp, 4
cmp ebp, edx
jb 0x64c99a
jmp 0x64caf1
mov edx, eax
jmp 0x64cdeb
cmp ebp, edx
jae 0x64caf1
lea ecx, [ebp + 2]
jmp 0x64ca66
mov eax, dword [esp + 0xe4]
add ecx, 2
mov dword [esp + 0x54], ecx
lea ecx, [ecx - 2]
mov edx, dword [esp + 0x84]
test edx, edx
je 0x64caa7
cmp ecx, eax
jbe 0x64cade
sub esp, 0xc
push dword [esp + 0x48]
mov dword [esp + 0x18], ebp
lea ebp, [esp + 0x98]
push ebp
mov ebp, dword [esp + 0x1c]
push eax
push edx
push ecx
call fcn.0065a2b0
add esp, 0x20
test eax, eax
je 0x64cade
jmp 0x64cb2d
mov edx, dword [esp + 0x88]
lea eax, [eax + edx*2]
cmp ecx, eax
jb 0x64cade
lea ecx, [edx + edx]
mov eax, dword [esp + 0x54]
sub eax, ecx
movzx ecx, word [eax - 2]
cmp cx, word [esp + 0xa0]
jne 0x64cade
cmp edx, 1
je 0x64cb36
movzx eax, word [eax]
cmp ax, word [esp + 0xa2]
je 0x64cb36
add ebp, 2
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x54]
cmp ecx, edx
jb 0x64ca5c
mov ecx, dword [esp + 0x154]
movzx eax, word [ebp - 2]
cmp eax, 0xd
jne 0x64cb26
cmp ebp, edx
jae 0x64cb26
mov eax, dword [esp + 0x84]
dec eax
cmp eax, 1
ja 0x64cb1f
movzx eax, word [ebp]
lea ecx, [ebp + 2]
cmp eax, 0xa
cmove ebp, ecx
mov ecx, dword [esp + 0x154]
mov edx, ebp
jmp 0x64cdeb
mov eax, dword [esp + 0x54]
add eax, 0xfffffffe
mov ebp, eax
mov ecx, dword [esp + 0x154]
mov edx, dword [esp + 0xc]
jmp 0x64caf8
mov dword [esp + 0x11c], 0
mov dword [esp + 8], ebp
mov ebp, dword [esp + 0x14]
test ebp, 0x40000
mov edx, dword [esp + 0x10]
je 0x64cceb
cmp dword [esp + 0x30], 0
mov eax, dword [esp + 0xe8]
je 0x64cc2a
mov edx, dword [esp + 8]
cmp edx, eax
jae 0x64cceb
mov ebp, dword [esp + 8]
mov ecx, dword [esp + 0x84]
test ecx, ecx
je 0x64cbb6
sub esp, 0xc
push dword [esp + 0x48]
lea edx, [esp + 0x98]
push edx
push eax
push ecx
push ebp
call fcn.0065a200
add esp, 0x20
test eax, eax
je 0x64cbef
jmp 0x64ccd5
mov ecx, dword [esp + 0x88]
lea edx, [ecx + ecx]
sub eax, edx
cmp ebp, eax
ja 0x64cbef
movzx eax, word [ebp]
cmp ax, word [esp + 0xa0]
jne 0x64cbef
cmp ecx, 1
je 0x64ccd5
movzx eax, word [ebp + 2]
cmp ax, word [esp + 0xa2]
je 0x64ccd5
lea edx, [ebp + 2]
cmp edx, dword [esp + 0x10]
jae 0x64cc0d
movzx eax, word [ebp + 2]
and eax, 0xfc00
cmp eax, 0xdc00
jne 0x64cc0d
add ebp, 4
mov edx, ebp
mov ecx, dword [esp + 0x154]
mov eax, dword [esp + 0xe8]
cmp edx, eax
mov ebp, edx
jb 0x64cb88
jmp 0x64cceb
mov edx, dword [esp + 8]
cmp edx, eax
jae 0x64cceb
mov edx, dword [esp + 8]
mov dword [esp + 0xc], edx
mov ecx, dword [esp + 0x84]
test ecx, ecx
je 0x64cc7e
sub esp, 0xc
push dword [esp + 0x48]
lea edx, [esp + 0x98]
push edx
push eax
push ecx
push dword [esp + 0x28]
call fcn.0065a200
add esp, 0x20
test eax, eax
jne 0x64cce0
mov eax, dword [esp + 0xe8]
mov ecx, dword [esp + 0x154]
mov edx, dword [esp + 0xc]
jmp 0x64ccc8
mov ecx, dword [esp + 0x88]
lea edx, [ecx + ecx]
mov ebp, eax
sub ebp, edx
mov edx, dword [esp + 0xc]
cmp edx, ebp
jbe 0x64cc9d
mov ecx, dword [esp + 0x154]
jmp 0x64ccc8
movzx edx, word [edx]
cmp dx, word [esp + 0xa0]
jne 0x64cc71
cmp ecx, 1
je 0x64cce0
mov edx, dword [esp + 0xc]
movzx ecx, word [edx + 2]
cmp cx, word [esp + 0xa2]
mov ecx, dword [esp + 0x154]
je 0x64cceb
add edx, 2
cmp edx, eax
jb 0x64cc3a
jmp 0x64cceb
mov edx, ebp
mov ecx, dword [esp + 0x154]
jmp 0x64cceb
mov ecx, dword [esp + 0x154]
mov edx, dword [esp + 0xc]
mov eax, dword [edi + 8]
or eax, ecx
test eax, 0x4000000
jne 0x64cde7
cmp dword [esp + 0x1c], 0
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], edx
je 0x64cd3e
cmp ax, word [esp + 0x18]
jne 0x64cdb1
cmp dword [esp + 8], edx
jae 0x64cde7
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x18]
cmp word [edx], ax
je 0x64cdeb
add edx, 2
cmp edx, dword [esp + 0xc]
jb 0x64cd23
jmp 0x64cdeb
mov eax, dword [esp + 0x38]
test ah, 1
jne 0x64c969
cmp dword [esp + 0x20], 0
mov eax, dword [esp + 8]
je 0x64ca48
cmp eax, edx
jae 0x64cde7
mov edx, dword [esp + 8]
movzx ecx, word [edx]
cmp ecx, 0xff
mov ebp, edx
jb 0x64cd78
mov ecx, 0xff
mov eax, ecx
shr eax, 3
mov edx, dword [esp + 0x20]
movzx edx, byte [edx + eax]
and cl, 7
mov eax, 1
shl eax, cl
and eax, edx
jne 0x64cd96
add ebp, 2
mov ecx, dword [esp + 0x154]
mov edx, dword [esp + 0xc]
test eax, eax
jne 0x64cb26
cmp ebp, edx
mov edx, ebp
jb 0x64cd66
jmp 0x64cdeb
cmp dword [esp + 8], edx
jae 0x64cde7
mov dword [esp + 0x28], eax
mov edx, dword [esp + 8]
mov ebp, edx
movzx eax, word [edx]
cmp ax, word [esp + 0x28]
je 0x64cb26
cmp ax, word [esp + 0x18]
je 0x64cb26
mov edx, ebp
add edx, 2
cmp edx, dword [esp + 0xc]
jb 0x64cdbf
jmp 0x64cdeb
mov edx, dword [esp + 8]
mov dword [esp + 8], edx
mov eax, dword [edi + 8]
or eax, ecx
and eax, 0x4000000
or eax, dword [esp + 0xf8]
je 0x64ce0b
mov ebp, dword [esp + 8]
jmp 0x64c6f6
mov eax, dword [esp + 0x2c]
test eax, eax
mov ebp, dword [esp + 8]
je 0x64ce32
test byte [eax + 4], 2
je 0x64ce32
mov eax, dword [esp + 0x10]
sub eax, ebp
sar eax, 1
mov ecx, dword [esp + 0x2c]
cmp eax, dword [ecx + 0x28]
jb 0x64d092
cmp byte [esp + 0x44], 0
jne 0x64c6f6
mov eax, dword [esp + 0x10]
sub eax, ebp
cmp eax, 0x7cf
jg 0x64c6f6
mov eax, dword [esp + 0x1c]
lea eax, [ebp + eax*2]
cmp eax, dword [esp + 0x68]
jbe 0x64c6f6
mov ebp, dword [esp + 0x60]
cmp bp, word [esp + 0x24]
je 0x64c6d9
cmp eax, dword [esp + 0x10]
jae 0x64c6e4
movzx ecx, word [eax]
cmp cx, word [esp + 0x24]
mov edx, eax
je 0x64ce88
lea edx, [eax + 2]
cmp cx, bp
cmovne eax, edx
cmp eax, dword [esp + 0x10]
jae 0x64c6e4
cmp cx, bp
je 0x64c6e4
cmp cx, word [esp + 0x24]
jne 0x64ce79
jmp 0x64c6e4
cmp ebp, 1
je 0x64cebe
cmp ebp, 0xfffffc19
jne 0x64d15b
cmp dword [esp + 0x40], 0
je 0x64cf1d
cmp dword [esp + 0x64], 6
jl 0x64cef6
mov eax, dword [esp + 0x158]
lea eax, [eax + 8]
mov ecx, dword [esp + 0x78]
add ecx, 8
mov edx, dword [esp + 0x34]
lea edx, [edx*4 - 8]
sub esp, 4
push edx
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0x10
mov eax, dword [esp + 0x34]
cmp dword [esp + 0xfc], eax
jle 0x64cf0b
or byte [esp + 0x102], 1
sub esp, 0xc
mov eax, dword [esp + 0x5c]
push dword [eax]
call dword [0x7d97ac]
add esp, 0x10
mov eax, dword [esp + 0xfc]
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
xor esi, esi
cmp eax, dword [esp + 0x34]
cmovl esi, ecx
test byte [esp + 0x102], 1
cmove esi, ecx
cmp dword [esp + 0x158], 0
je 0x64cfa1
movzx edx, word [edi + 0x1e]
cmp ecx, edx
jg 0x64cfa1
lea ecx, [edx + edx + 2]
mov edx, dword [esp + 0x15c]
cmp ecx, edx
cmovg ecx, edx
cmp eax, ecx
jge 0x64cfa1
mov edx, dword [esp + 0x158]
mov ebx, edx
lea ecx, [ebx + ecx*4]
lea edx, [ebx + eax*4]
lea edi, [ebx + eax*4 + 4]
shl eax, 2
cmp ecx, edi
cmova edi, ecx
sub edi, eax
mov eax, ebx
not eax
lea eax, [edi + eax + 4]
and eax, 0xfffffffc
sub esp, 4
push eax
push 0xff
push edx
call sub.msvcrt.dll_memset
add esp, 0x10
xor ebp, ebp
cmp dword [esp + 0x15c], 2
jl 0x64cfd8
mov eax, dword [esp + 0xe4]
mov ecx, dword [esp + 0xec]
sub ecx, eax
sar ecx, 1
mov edx, dword [esp + 0x158]
mov dword [edx], ecx
mov ecx, dword [esp + 0xf0]
sub ecx, eax
sar ecx, 1
mov dword [edx + 4], ecx
mov ebp, esi
cmp dword [esp + 0x144], 0
je 0x64bf49
mov eax, dword [esp + 0x144]
test byte [eax], 0x20
je 0x64bf49
mov eax, dword [esp + 0x11c]
mov ecx, dword [esp + 0x144]
jmp 0x64d151
mov eax, edx
movzx ecx, bp
cmp ecx, 0xff
mov dword [esp + 0x18], ebp
ja 0x64d029
mov edx, dword [esp + 0xac]
movzx edx, byte [edx + ecx]
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], 0
cmp dword [esp + 0x30], 0
mov dword [esp + 0x1c], 1
je 0x64d087
cmp ecx, 0x80
jb 0x64d087
mov edx, ecx
and edx, 0xff80
shr edx, 7
movzx edx, byte [edx + 0x7dd1f4]
shl edx, 7
mov ebp, ecx
and ebp, 0x7f
or ebp, edx
movzx edx, word [ebp + ebp + 0x7df3f4]
add ecx, dword [edx*8 + 0x7dbb78]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], ecx
mov ebp, dword [esp + 0x14]
mov edx, eax
jmp 0x64c53b
mov edx, dword [esp + 0x15c]
xor ebp, ebp
cmp dword [esp + 0x40], 0
mov ecx, dword [esp + 0x144]
mov eax, dword [esp + 0x158]
je 0x64d0e4
sub esp, 0xc
mov eax, dword [esp + 0x5c]
push dword [eax]
call dword [0x7d97ac]
mov edx, dword [esp + 0x16c]
mov eax, dword [esp + 0x168]
mov ecx, dword [esp + 0x154]
add esp, 0x10
test ebp, ebp
je 0x64d0e4
cmp ebp, 0xfffffff4
jne 0x64bf49
cmp dword [esp + 0x4c], 0
je 0x64d134
mov dword [esp + 0x11c], 0
mov ebp, 0xfffffff4
cmp edx, 2
jl 0x64d139
mov edi, dword [esp + 0x5c]
sub edi, esi
sar edi, 1
mov dword [eax], edi
add ebx, ebx
sar ebx, 1
mov dword [eax + 4], ebx
mov ebp, 0xfffffff4
cmp edx, 2
je 0x64d139
mov edx, dword [esp + 0x4c]
sub edx, esi
sar edx, 1
mov dword [eax + 8], edx
mov ebp, 0xfffffff4
test ecx, ecx
jne 0x64d141
jmp 0x64bf49
mov ebp, 0xffffffff
test ecx, ecx
je 0x64bf49
test byte [ecx], 0x20
je 0x64bf49
mov eax, dword [esp + 0x120]
mov ecx, dword [ecx + 0x18]
mov dword [ecx], eax
jmp 0x64bf49
cmp dword [esp + 0x40], 0
mov ecx, dword [esp + 0x144]
mov eax, dword [esp + 0x158]
mov edx, dword [esp + 0x15c]
jne 0x64d0b0
jmp 0x64d0d7