Function at 0x64bfb0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Check os version
Encrypt data using rc4 ksa
Get kernel32 base address
Get number of processors
Get process heap flags
Get process heap force flags
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x65
push 0
push 0
dec ecx
jne 0x64bfb8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x64e5f1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
add eax, 0xa4
mov ecx, 1
mov edx, dword [0x649a04]
call fcn.004067f8
add esp, 4
push 0
mov eax, dword [ebp - 4]
add eax, 0x60
mov ecx, 1
mov edx, dword [0x64b3b0]
call fcn.004067f8
add esp, 4
push 0
mov eax, dword [ebp - 4]
add eax, 0x64
mov ecx, 1
mov edx, dword [0x64b3d4]
call fcn.004067f8
add esp, 4
push 0
mov eax, dword [ebp - 4]
add eax, 0x68
mov ecx, 1
mov edx, dword [0x64b3f8]
call fcn.004067f8
add esp, 4
push 0
mov eax, dword [ebp - 4]
add eax, 0x6c
mov ecx, 1
mov edx, dword [0x64b41c]
call fcn.004067f8
add esp, 4
push 0
mov eax, dword [ebp - 4]
add eax, 0x70
mov ecx, 1
mov edx, dword [0x64b440]
call fcn.004067f8
add esp, 4
push 0
mov eax, dword [ebp - 4]
add eax, 0x5c
mov ecx, 1
mov edx, dword [0x64b38c]
call fcn.004067f8
add esp, 4
push 0
mov eax, dword [ebp - 4]
add eax, 0x74
mov ecx, 1
mov edx, dword [0x64b464]
call fcn.004067f8
add esp, 4
push 0
mov eax, dword [ebp - 4]
add eax, 0x78
mov ecx, 1
mov edx, dword [0x64b488]
call fcn.004067f8
add esp, 4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 4]
add eax, 0x14
call fcn.004052bc
mov eax, dword [ebp - 4]
add eax, 0x18
call fcn.004052bc
mov eax, dword [ebp - 4]
add eax, 0x1c
call fcn.004052bc
mov eax, dword [ebp - 4]
add eax, 0x20
call fcn.004052bc
mov eax, dword [ebp - 4]
add eax, 0x24
call fcn.004052bc
mov eax, dword [ebp - 4]
add eax, 0x28
call fcn.004052bc
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.004052bc
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x30], edx
mov eax, dword [ebp - 4]
add eax, 0x34
call fcn.004052bc
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004052bc
mov eax, dword [ebp - 4]
add eax, 0x3c
call fcn.004052bc
mov eax, dword [ebp - 4]
add eax, 0x40
call fcn.004052bc
mov eax, dword [ebp - 4]
add eax, 0x44
call fcn.004052bc
mov eax, dword [ebp - 4]
add eax, 0x98
call fcn.004052bc
mov eax, dword [ebp - 4]
add eax, 0x9c
call fcn.004052bc
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.004052bc
mov eax, dword [ebp - 4]
add eax, 0x4c
call fcn.004052bc
mov eax, dword [ebp - 4]
add eax, 0x50
call fcn.004052bc
mov eax, dword [ebp - 4]
add eax, 0x90
call fcn.004052bc
mov eax, dword [ebp - 4]
mov byte [eax + 0x54], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x85], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x86], 1
mov eax, dword [ebp - 4]
mov dl, byte [0x64e600]
mov byte [eax + 0x87], dl
mov eax, dword [ebp - 4]
mov dx, word [0x64e600]
mov word [eax + 0x88], dx
mov eax, dword [ebp - 4]
mov dl, byte [0x64e600]
mov byte [eax + 0x8a], dl
mov eax, dword [ebp - 4]
mov word [eax + 0x8c], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x84], 0
mov eax, dword [ebp - 4]
add eax, 0x58
call fcn.004052bc
mov eax, dword [ebp - 4]
mov word [eax + 0x7e], 0
mov eax, dword [ebp - 4]
mov word [eax + 0x7c], 0
cmp ebx, 1
jne 0x64c4f7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov ecx, 0xffff
mov edx, 0xf0000
call fcn.00648e54
mov ebx, eax
test bl, bl
je 0x64c2ca
mov esi, 0xf0000
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, esi
call fcn.00649370
mov edx, 0x64e60c
cmp al, byte [edx]
jne 0x64c2c1
lea eax, [ebp - 0x123]
mov edx, 0xff
call fcn.0040863c
lea eax, [ebp - 0x123]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov cl, 4
mov edx, esi
call fcn.006491b0
lea eax, [ebp - 0x128]
lea edx, [ebp - 0x123]
mov ecx, 0xff
call fcn.0040552c
mov edx, dword [ebp - 0x128]
mov eax, 0x64e60c
call fcn.004058c0
dec eax
jne 0x64c2c1
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], esi
jmp 0x64c2ca
inc esi
cmp esi, 0x100000
jne 0x64c254
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jne 0x64c359
mov esi, 0xf0000
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, esi
call fcn.00649370
mov edx, 0x64e61c
cmp al, byte [edx]
jne 0x64c350
lea eax, [ebp - 0x123]
mov edx, 0xff
call fcn.0040863c
lea eax, [ebp - 0x123]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov cl, 5
mov edx, esi
call fcn.006491b0
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x123]
mov ecx, 0xff
call fcn.0040552c
mov eax, dword [ebp - 0x12c]
push eax
mov eax, 0x64e61c
pop edx
call fcn.004058c0
dec eax
jne 0x64c350
mov eax, esi
sub eax, 0x10
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
jmp 0x64c359
inc esi
cmp esi, 0x100000
jne 0x64c2dc
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jbe 0x64c51b
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
add edx, 7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.0064923c
mov edx, dword [ebp - 4]
mov byte [edx + 0x95], al
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
add edx, 6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.0064923c
mov edx, dword [ebp - 4]
mov byte [edx + 0x94], al
lea eax, [ebp - 0x130]
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x94]
mov dword [ebp - 0x140], eax
mov byte [ebp - 0x13c], 0
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x95]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 0
lea edx, [ebp - 0x140]
mov ecx, 1
mov eax, 0x64e62c
call fcn.0040b5bc
mov edx, dword [ebp - 0x130]
mov eax, dword [ebp - 4]
add eax, 0x24
call fcn.00405310
lea eax, [ebp - 0x144]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
add edx, 0x1f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.0064923c
and eax, 0xff
movzx eax, ax
mov dword [ebp - 0x140], eax
mov byte [ebp - 0x13c], 0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
add edx, 0x1f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.0064923c
and eax, 0xff
shr ax, 8
movzx eax, ax
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 0
lea edx, [ebp - 0x140]
mov ecx, 1
mov eax, 0x64e62c
call fcn.0040b5bc
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 4]
add eax, 0x80
call fcn.00405310
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
add edx, 0x18
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.0064928c
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
add edx, 0x1c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.006492f4
mov edx, dword [ebp - 4]
mov word [edx + 0x7c], ax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
add edx, 0x16
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.006492f4
mov edx, dword [ebp - 4]
mov word [edx + 0x7e], ax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jbe 0x64e580
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x7e]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00648e54
jmp 0x64c51b
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 4]
mov word [eax + 0x7c], 0xffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov ax, word [eax + 0x10]
mov edx, dword [ebp - 4]
mov word [edx + 0x7e], ax
mov bl, 1
test bl, bl
je 0x64e580
mov eax, dword [ebp - 4]
call fcn.0064bcc8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x24c]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0064be90
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
cmp eax, dword [ebp - 0x10]
ja 0x64c685
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jne 0x64c685
mov edx, dword [ebp - 0x10]
inc edx
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov byte [ebp - 9], al
mov edx, dword [ebp - 0x10]
add edx, 9
mov eax, dword [ebp - 0x18]
call fcn.0064923c
and eax, 0xff
inc eax
shl eax, 6
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64c5f1
lea eax, [ebp - 0x250]
push eax
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x250]
mov eax, dword [ebp - 4]
add eax, 0x28
call fcn.00405310
mov edx, dword [ebp - 0x10]
add edx, 5
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64c63b
lea eax, [ebp - 0x254]
push eax
mov edx, dword [ebp - 0x10]
add edx, 5
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x254]
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00405310
mov edx, dword [ebp - 0x10]
add edx, 8
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64c685
lea eax, [ebp - 0x258]
push eax
mov edx, dword [ebp - 0x10]
add edx, 8
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x258]
mov eax, dword [ebp - 4]
add eax, 0x20
call fcn.00405310
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0064bf30
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 0x24c]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0064be90
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
cmp eax, dword [ebp - 0x10]
ja 0x64c894
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064923c
cmp al, 1
jne 0x64c894
mov edx, dword [ebp - 0x10]
inc edx
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov byte [ebp - 9], al
mov eax, dword [ebp - 4]
add eax, 0x58
call fcn.004052bc
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 5
add eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xa4]
cmp byte [edx + eax*8 + 5], 8
jbe 0x64c76c
xor esi, esi
lea eax, [ebp - 0x25c]
push eax
mov edx, dword [ebp - 0x10]
add edx, 8
add edx, esi
mov eax, dword [ebp - 0x18]
call fcn.0064923c
and eax, 0xff
mov dword [ebp - 0x264], eax
mov byte [ebp - 0x260], 0
lea edx, [ebp - 0x264]
xor ecx, ecx
mov eax, 0x64e63c
call fcn.0040b5bc
mov edx, dword [ebp - 0x25c]
mov eax, dword [ebp - 4]
add eax, 0x58
call fcn.00405584
inc esi
cmp esi, 0x10
jne 0x64c71a
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64c7b6
lea eax, [ebp - 0x268]
push eax
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x268]
mov eax, dword [ebp - 4]
add eax, 0x18
call fcn.00405310
mov edx, dword [ebp - 0x10]
add edx, 5
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64c800
lea eax, [ebp - 0x26c]
push eax
mov edx, dword [ebp - 0x10]
add edx, 5
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x26c]
mov eax, dword [ebp - 4]
add eax, 0x1c
call fcn.00405310
mov edx, dword [ebp - 0x10]
add edx, 6
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64c84a
lea eax, [ebp - 0x270]
push eax
mov edx, dword [ebp - 0x10]
add edx, 6
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x270]
mov eax, dword [ebp - 4]
add eax, 0x34
call fcn.00405310
mov edx, dword [ebp - 0x10]
add edx, 7
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64c894
lea eax, [ebp - 0x274]
push eax
mov edx, dword [ebp - 0x10]
add edx, 7
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x274]
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00405310
push 0
lea eax, [ebp - 0x24c]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 2
mov eax, dword [ebp - 4]
call fcn.0064be90
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
cmp eax, dword [ebp - 0x10]
ja 0x64cacf
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064923c
cmp al, 2
jne 0x64cacf
mov edx, dword [ebp - 0x10]
inc edx
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov byte [ebp - 9], al
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64c934
lea eax, [ebp - 0x278]
push eax
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x278]
mov eax, dword [ebp - 4]
add eax, 0x40
call fcn.00405310
mov edx, dword [ebp - 0x10]
add edx, 5
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64c97e
lea eax, [ebp - 0x27c]
push eax
mov edx, dword [ebp - 0x10]
add edx, 5
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x27c]
mov eax, dword [ebp - 4]
add eax, 0x14
call fcn.00405310
mov edx, dword [ebp - 0x10]
add edx, 6
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64c9c8
lea eax, [ebp - 0x280]
push eax
mov edx, dword [ebp - 0x10]
add edx, 6
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x280]
mov eax, dword [ebp - 4]
add eax, 0x44
call fcn.00405310
mov edx, dword [ebp - 0x10]
add edx, 7
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64ca12
lea eax, [ebp - 0x284]
push eax
mov edx, dword [ebp - 0x10]
add edx, 7
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x284]
mov eax, dword [ebp - 4]
add eax, 0x3c
call fcn.00405310
mov edx, dword [ebp - 0x10]
add edx, 8
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64ca5e
lea eax, [ebp - 0x288]
push eax
mov edx, dword [ebp - 0x10]
add edx, 8
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 4]
add eax, 0x98
call fcn.00405310
push 0
lea eax, [ebp - 0x24c]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 2
mov eax, dword [ebp - 4]
call fcn.0064be90
cmp byte [ebp - 0x247], 0xa
jb 0x64cacf
mov edx, dword [ebp - 0x10]
add edx, 0xa
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64cacf
lea eax, [ebp - 0x28c]
push eax
mov edx, dword [ebp - 0x10]
add edx, 0xa
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x28c]
mov eax, dword [ebp - 4]
add eax, 0x9c
call fcn.00405310
push 0
lea eax, [ebp - 0x24c]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 3
mov eax, dword [ebp - 4]
call fcn.0064be90
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
cmp eax, dword [ebp - 0x10]
ja 0x64cc66
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064923c
cmp al, 3
jne 0x64cc66
mov edx, dword [ebp - 0x10]
inc edx
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov byte [ebp - 9], al
mov edx, dword [ebp - 0x10]
add edx, 5
mov eax, dword [ebp - 0x18]
call fcn.0064923c
and al, 0x7f
dec eax
mov edx, dword [ebp - 4]
mov byte [edx + 0x54], al
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64cb86
lea eax, [ebp - 0x290]
push eax
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x290]
mov eax, dword [ebp - 4]
add eax, 0x50
call fcn.00405310
mov edx, dword [ebp - 0x10]
add edx, 6
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64cbd0
lea eax, [ebp - 0x294]
push eax
mov edx, dword [ebp - 0x10]
add edx, 6
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x294]
mov eax, dword [ebp - 4]
add eax, 0x4c
call fcn.00405310
mov edx, dword [ebp - 0x10]
add edx, 7
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64cc1a
lea eax, [ebp - 0x298]
push eax
mov edx, dword [ebp - 0x10]
add edx, 7
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x298]
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.00405310
mov edx, dword [ebp - 0x10]
add edx, 8
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64cc66
lea eax, [ebp - 0x29c]
push eax
mov edx, dword [ebp - 0x10]
add edx, 8
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x29c]
mov eax, dword [ebp - 4]
add eax, 0x90
call fcn.00405310
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.0064bf30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jle 0x64d0ca
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 5
add eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xa4]
mov eax, dword [edx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
cmp eax, dword [ebp - 0x10]
ja 0x64d001
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064923c
cmp al, 4
jne 0x64d001
mov edx, dword [ebp - 0x10]
inc edx
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov byte [ebp - 9], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
call fcn.0040663c
inc eax
push eax
mov eax, dword [ebp - 4]
add eax, 0x5c
mov ecx, 1
mov edx, dword [0x64b38c]
call fcn.004067f8
add esp, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
call fcn.00406644
imul eax, eax, 0xc3
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
lea esi, [edx + eax*8]
mov edx, dword [ebp - 0x10]
add edx, 0x11
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ebx, eax
mov edi, ebx
and edi, 0xff
mov eax, edi
mov dl, 7
call fcn.0063d2b4
test al, al
je 0x64cd58
sub edi, 0x80
mov dword [ebp - 0x2a0], edi
fild dword [ebp - 0x2a0]
fdiv dword [0x64e644]
fstp qword [esi + 0x308]
wait
jmp 0x64cdbd
mov eax, edi
xor edx, edx
call fcn.0063d2b4
test al, al
je 0x64cd79
xor eax, eax
mov dword [esi + 0x308], eax
mov dword [esi + 0x30c], 0x40140000
jmp 0x64cdbd
mov eax, edi
mov dl, 1
call fcn.0063d2b4
test al, al
je 0x64cd9c
mov dword [esi + 0x308], 0x66666666
mov dword [esi + 0x30c], 0x400a6666
jmp 0x64cdbd
mov eax, edi
mov dl, 2
call fcn.0063d2b4
test al, al
je 0x64cdbd
mov dword [esi + 0x308], 0x33333333
mov dword [esi + 0x30c], 0x40073333
mov edx, dword [ebp - 0x10]
add edx, 0x19
mov eax, dword [ebp - 0x18]
call fcn.0064923c
dec eax
mov byte [esi + 0x300], al
mov edx, dword [ebp - 0x10]
add edx, 0x12
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov ebx, eax
mov word [esi + 0x312], bx
mov edx, dword [ebp - 0x10]
add edx, 0x16
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov ebx, eax
mov word [esi + 0x310], bx
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64ce49
lea eax, [ebp - 0x2a4]
push eax
mov edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x2a4]
mov eax, esi
mov ecx, 0xff
call fcn.00405558
mov ebx, dword [ebp - 0x10]
add ebx, 7
mov edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64ce96
lea eax, [ebp - 0x2a8]
push eax
mov edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x2a8]
lea eax, [esi + 0x100]
mov ecx, 0xff
call fcn.00405558
mov ebx, dword [ebp - 0x10]
add ebx, 0x10
mov edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64cee3
lea eax, [ebp - 0x2ac]
push eax
mov edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x2ac]
lea eax, [esi + 0x200]
mov ecx, 0xff
call fcn.00405558
mov byte [esi + 0x314], 0
mov byte [esi + 0x514], 0
mov byte [esi + 0x414], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x94], 2
ja 0x64cf14
mov eax, dword [ebp - 4]
cmp byte [eax + 0x95], 3
jb 0x64d001
mov edx, dword [ebp - 0x10]
add edx, 0x20
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64cf63
lea eax, [ebp - 0x2b0]
push eax
mov edx, dword [ebp - 0x10]
add edx, 0x20
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x2b0]
lea eax, [esi + 0x314]
mov ecx, 0xff
call fcn.00405558
mov edx, dword [ebp - 0x10]
add edx, 0x21
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64cfb2
lea eax, [ebp - 0x2b4]
push eax
mov edx, dword [ebp - 0x10]
add edx, 0x21
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x2b4]
lea eax, [esi + 0x414]
mov ecx, 0xff
call fcn.00405558
mov edx, dword [ebp - 0x10]
add edx, 0x22
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64d001
lea eax, [ebp - 0x2b8]
push eax
mov edx, dword [ebp - 0x10]
add edx, 0x22
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x2b8]
lea eax, [esi + 0x514]
mov ecx, 0xff
call fcn.00405558
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
call fcn.00406644
imul eax, eax, 0xc3
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
lea edx, [edx + eax*8 + 0x200]
lea eax, [ebp - 0x2c0]
call fcn.00405520
mov eax, dword [ebp - 0x2c0]
lea edx, [ebp - 0x2bc]
call fcn.00409c30
cmp dword [ebp - 0x2bc], 0
jne 0x64d0a5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
call fcn.00406644
imul eax, eax, 0xc3
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
lea eax, [edx + eax*8 + 0x200]
push eax
lea eax, [ebp - 0x2c4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
call fcn.00406644
mov dword [ebp - 0x264], eax
mov byte [ebp - 0x260], 0
lea edx, [ebp - 0x264]
xor ecx, ecx
mov eax, 0x64e650
call fcn.0040b5bc
mov edx, dword [ebp - 0x2c4]
pop eax
mov ecx, 0xff
call fcn.00405558
mov eax, dword [ebp - 8]
inc eax
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.0064bf30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x64cc88
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 5
mov eax, dword [ebp - 4]
call fcn.0064bf30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jle 0x64d321
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 5
add eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xa4]
mov eax, dword [edx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
cmp eax, dword [ebp - 0x10]
ja 0x64d2fc
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064923c
cmp al, 5
jne 0x64d2fc
mov edx, dword [ebp - 0x10]
add edx, 6
mov eax, dword [ebp - 0x18]
call fcn.0064923c
dec eax
mov edx, dword [ebp - 4]
mov byte [edx + 0x86], al
mov edx, dword [ebp - 0x10]
add edx, 7
mov eax, dword [ebp - 0x18]
call fcn.0064923c
dec eax
mov edx, dword [ebp - 4]
mov byte [edx + 0x85], al
xor eax, eax
push ebp
push 0x64d1b5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4000
push 0x80000000
push 0
mov edx, dword [ebp - 0x10]
add edx, 8
mov eax, dword [ebp - 0x18]
call fcn.0064923c
and eax, 0xff
mov dword [ebp - 0x2a0], eax
fild dword [ebp - 0x2a0]
add esp, 0xfffffff4
fstp xword [esp]
wait
call fcn.00430838
call fcn.00402ff4
mov edx, dword [ebp - 4]
mov word [edx + 0x8c], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64d1cb
mov edx, dword [ebp - 0x10]
add edx, 9
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov ebx, eax
mov eax, dword [ebp - 4]
mov dl, byte [0x64e600]
mov byte [eax + 0x87], dl
xor esi, esi
mov edx, esi
movzx eax, bx
call fcn.0063d2b4
test al, al
je 0x64d221
mov edx, esi
lea eax, [ebp - 0x2c8]
mov cl, 1
call fcn.00403c3c
mov al, byte [ebp - 0x2c8]
mov edx, dword [ebp - 4]
or al, byte [edx + 0x87]
mov edx, dword [ebp - 4]
mov byte [edx + 0x87], al
inc esi
cmp esi, 5
jne 0x64d1ec
mov edx, dword [ebp - 0x10]
add edx, 0xb
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov ebx, eax
mov eax, dword [ebp - 4]
mov dx, word [0x64e600]
mov word [eax + 0x88], dx
xor esi, esi
mov edx, esi
movzx eax, bx
call fcn.0063d2b4
test al, al
je 0x64d282
mov edx, esi
lea eax, [ebp - 0x2cc]
mov cl, 2
call fcn.00403c3c
mov ax, word [ebp - 0x2cc]
mov edx, dword [ebp - 4]
or ax, word [edx + 0x88]
mov edx, dword [ebp - 4]
mov word [edx + 0x88], ax
inc esi
cmp esi, 0xb
jne 0x64d24a
mov edx, dword [ebp - 0x10]
add edx, 0xd
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ebx, eax
mov eax, dword [ebp - 4]
mov dl, byte [0x64e600]
mov byte [eax + 0x8a], dl
xor esi, esi
mov edx, esi
xor eax, eax
mov al, bl
call fcn.0063d2b4
test al, al
je 0x64d2df
mov edx, esi
lea eax, [ebp - 0x2c8]
mov cl, 1
call fcn.00403c3c
mov al, byte [ebp - 0x2c8]
mov edx, dword [ebp - 4]
or al, byte [edx + 0x8a]
mov edx, dword [ebp - 4]
mov byte [edx + 0x8a], al
inc esi
cmp esi, 3
jne 0x64d2a9
mov edx, dword [ebp - 0x10]
add edx, 0xe
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov edx, dword [ebp - 4]
mov byte [edx + 0x84], al
mov eax, dword [ebp - 8]
inc eax
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 5
mov eax, dword [ebp - 4]
call fcn.0064bf30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x64d0ec
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 6
mov eax, dword [ebp - 4]
call fcn.0064bf30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jle 0x64d54c
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 5
add eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xa4]
mov eax, dword [edx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
cmp eax, dword [ebp - 0x10]
ja 0x64d527
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064923c
cmp al, 6
jne 0x64d527
mov edx, dword [ebp - 0x10]
inc edx
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov byte [ebp - 9], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x60]
call fcn.0040663c
inc eax
push eax
mov eax, dword [ebp - 4]
add eax, 0x60
mov ecx, 1
mov edx, dword [0x64b3b0]
call fcn.004067f8
add esp, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x60]
call fcn.00406644
imul eax, eax, 0x43
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x60]
lea eax, [edx + eax*4]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64d419
lea eax, [ebp - 0x2d0]
push eax
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x1c]
mov ecx, 0xff
call fcn.00405558
mov edx, dword [ebp - 0x10]
add edx, 6
mov eax, dword [ebp - 0x18]
call fcn.0064923c
and eax, 0xff
mov edx, dword [ebp - 0x1c]
mov word [edx + 0x100], ax
mov edx, dword [ebp - 0x10]
add edx, 7
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov ebx, eax
mov eax, dword [ebp - 0x1c]
mov dx, word [0x64e600]
mov word [eax + 0x108], dx
xor esi, esi
mov edx, esi
movzx eax, bx
call fcn.0063d2b4
test al, al
je 0x64d491
mov edx, esi
lea eax, [ebp - 0x2cc]
mov cl, 2
call fcn.00403c3c
mov ax, word [ebp - 0x2cc]
mov edx, dword [ebp - 0x1c]
or ax, word [edx + 0x108]
mov edx, dword [ebp - 0x1c]
mov word [edx + 0x108], ax
inc esi
cmp esi, 0xb
jne 0x64d459
mov edx, dword [ebp - 0x10]
add edx, 9
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ebx, eax
cmp bl, 0x80
jb 0x64d4af
xor bl, 0x80
mov eax, ebx
add al, 0x83
sub al, 3
jae 0x64d4c4
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [eax + 0x104], edx
jmp 0x64d527
xor eax, eax
push ebp
push 0x64d512
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4000
push 0x80000000
push 0
xor eax, eax
mov al, bl
mov dword [ebp - 0x2a0], eax
fild dword [ebp - 0x2a0]
add esp, 0xfffffff4
fstp xword [esp]
wait
call fcn.00430838
call fcn.00402ff4
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x104], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64d527
mov eax, dword [ebp - 8]
inc eax
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 6
mov eax, dword [ebp - 4]
call fcn.0064bf30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x64d343
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 7
mov eax, dword [ebp - 4]
call fcn.0064bf30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jle 0x64d909
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 5
add eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xa4]
mov eax, dword [edx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
cmp eax, dword [ebp - 0x10]
ja 0x64d8e4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064923c
cmp al, 7
jne 0x64d8e4
mov edx, dword [ebp - 0x10]
inc edx
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov byte [ebp - 9], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
call fcn.0040663c
inc eax
push eax
mov eax, dword [ebp - 4]
add eax, 0x70
mov ecx, 1
mov edx, dword [0x64b440]
call fcn.004067f8
add esp, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
call fcn.00406644
imul eax, eax, 0x85
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x70]
lea eax, [edx + eax*2]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64d647
lea eax, [ebp - 0x2d4]
push eax
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x2d4]
mov eax, dword [ebp - 0x20]
mov ecx, 0xff
call fcn.00405558
mov esi, dword [ebp - 0x10]
add esi, 7
mov edx, esi
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov ebx, eax
cmp bx, 0x8000
jb 0x64d665
xor bx, 0x8000
mov edx, esi
mov eax, dword [ebp - 0x18]
call fcn.006492f4
movzx eax, ax
mov dl, 0xf
call fcn.0063d2b4
test al, al
je 0x64d68e
mov eax, ebx
shl eax, 6
mov edx, dword [ebp - 0x20]
mov word [edx + 0x100], ax
jmp 0x64d698
mov eax, dword [ebp - 0x20]
mov word [eax + 0x100], bx
mov esi, dword [ebp - 0x10]
add esi, 9
mov edx, esi
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov ebx, eax
cmp bx, 0x8000
jb 0x64d6b6
xor bx, 0x8000
mov edx, esi
mov eax, dword [ebp - 0x18]
call fcn.006492f4
movzx eax, ax
mov dl, 0xf
call fcn.0063d2b4
test al, al
je 0x64d6df
mov eax, ebx
shl eax, 6
mov edx, dword [ebp - 0x20]
mov word [edx + 0x102], ax
jmp 0x64d6e9
mov eax, dword [ebp - 0x20]
mov word [eax + 0x102], bx
mov edx, dword [ebp - 0x10]
add edx, 0xd
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov ebx, eax
xor esi, esi
mov edx, esi
movzx eax, bx
call fcn.0063d2b4
test al, al
je 0x64d714
mov eax, esi
mov edx, dword [ebp - 0x20]
mov byte [edx + 0x104], al
inc esi
cmp esi, 7
jne 0x64d6fb
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 5
add eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xa4]
cmp byte [edx + eax*8 + 5], 0xf
ja 0x64d759
mov eax, dword [ebp - 0x20]
mov byte [eax + 0x106], 1
mov eax, dword [ebp - 0x20]
mov byte [eax + 0x105], 1
mov eax, dword [ebp - 0x20]
mov word [eax + 0x108], 0
jmp 0x64d848
xor eax, eax
push ebp
push 0x64d7ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x10]
add edx, 0x12
mov eax, dword [ebp - 0x18]
call fcn.0064923c
and eax, 0xff
dec eax
sub eax, 8
jae 0x64d79a
mov edx, dword [ebp - 0x10]
add edx, 0x12
mov eax, dword [ebp - 0x18]
call fcn.0064923c
dec eax
mov edx, dword [ebp - 0x20]
mov byte [edx + 0x106], al
jmp 0x64d7a4
mov eax, dword [ebp - 0x20]
mov byte [eax + 0x106], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64d7c2
xor eax, eax
push ebp
push 0x64d817
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x10]
add edx, 0x11
mov eax, dword [ebp - 0x18]
call fcn.0064923c
and eax, 0xff
dec eax
sub eax, 5
jae 0x64d803
mov edx, dword [ebp - 0x10]
add edx, 0x11
mov eax, dword [ebp - 0x18]
call fcn.0064923c
dec eax
mov edx, dword [ebp - 0x20]
mov byte [edx + 0x105], al
jmp 0x64d80d
mov eax, dword [ebp - 0x20]
mov byte [eax + 0x105], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64d82b
mov edx, dword [ebp - 0x10]
add edx, 0xf
mov eax, dword [ebp - 0x18]
call fcn.0064923c
and eax, 0xff
mov edx, dword [ebp - 0x20]
mov word [edx + 0x108], ax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
call fcn.00406644
imul eax, eax, 0x85
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x70]
lea edx, [edx + eax*2]
lea eax, [ebp - 0x2dc]
call fcn.00405520
mov eax, dword [ebp - 0x2dc]
lea edx, [ebp - 0x2d8]
call fcn.00409c30
cmp dword [ebp - 0x2d8], 0
jne 0x64d8e4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
call fcn.00406644
imul eax, eax, 0x85
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x70]
lea eax, [edx + eax*2]
push eax
lea eax, [ebp - 0x2e0]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
call fcn.00406644
mov dword [ebp - 0x264], eax
mov byte [ebp - 0x260], 0
lea edx, [ebp - 0x264]
xor ecx, ecx
mov eax, 0x64e668
call fcn.0040b5bc
mov edx, dword [ebp - 0x2e0]
pop eax
mov ecx, 0xff
call fcn.00405558
mov eax, dword [ebp - 8]
inc eax
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 7
mov eax, dword [ebp - 4]
call fcn.0064bf30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x64d56e
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 8
mov eax, dword [ebp - 4]
call fcn.0064bf30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jle 0x64db8c
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 5
add eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xa4]
mov eax, dword [edx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
cmp eax, dword [ebp - 0x10]
ja 0x64db67
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064923c
cmp al, 8
jne 0x64db67
mov edx, dword [ebp - 0x10]
inc edx
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov byte [ebp - 9], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
call fcn.0040663c
inc eax
push eax
mov eax, dword [ebp - 4]
add eax, 0x68
mov ecx, 1
mov edx, dword [0x64b3f8]
call fcn.004067f8
add esp, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
call fcn.00406644
imul eax, eax, 0x203
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x68]
lea esi, [edx + eax]
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64da00
lea eax, [ebp - 0x2e4]
push eax
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x2e4]
mov eax, esi
mov ecx, 0xff
call fcn.00405558
mov edx, dword [ebp - 0x10]
add edx, 5
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ebx, eax
cmp bl, 0xff
jae 0x64da1d
mov byte [esi + 0x200], bl
jmp 0x64da24
mov byte [esi + 0x200], 0x27
mov edx, dword [ebp - 0x10]
add edx, 6
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64da73
lea eax, [ebp - 0x2e8]
push eax
mov edx, dword [ebp - 0x10]
add edx, 6
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x2e8]
lea eax, [esi + 0x100]
mov ecx, 0xff
call fcn.00405558
mov edx, dword [ebp - 0x10]
add edx, 7
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ebx, eax
cmp bl, 0xff
jae 0x64da90
mov byte [esi + 0x201], bl
jmp 0x64da97
mov byte [esi + 0x201], 0x27
mov edx, dword [ebp - 0x10]
add edx, 8
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ebx, eax
cmp bl, 0xff
jae 0x64dabc
cmp bl, 0x1f
jbe 0x64dab4
sub bl, 0x80
mov byte [esi + 0x202], bl
jmp 0x64dac3
mov byte [esi + 0x202], 0x22
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
call fcn.00406644
imul eax, eax, 0x203
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x68]
lea edx, [edx + eax + 0x100]
lea eax, [ebp - 0x2f0]
call fcn.00405520
mov eax, dword [ebp - 0x2f0]
lea edx, [ebp - 0x2ec]
call fcn.00409c30
cmp dword [ebp - 0x2ec], 0
jne 0x64db67
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
call fcn.00406644
imul eax, eax, 0x203
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x68]
lea eax, [edx + eax + 0x100]
push eax
lea eax, [ebp - 0x2f4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
call fcn.00406644
mov dword [ebp - 0x264], eax
mov byte [ebp - 0x260], 0
lea edx, [ebp - 0x264]
xor ecx, ecx
mov eax, 0x64e67c
call fcn.0040b5bc
mov edx, dword [ebp - 0x2f4]
pop eax
mov ecx, 0xff
call fcn.00405558
mov eax, dword [ebp - 8]
inc eax
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 8
mov eax, dword [ebp - 4]
call fcn.0064bf30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x64d92b
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 9
mov eax, dword [ebp - 4]
call fcn.0064bf30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jle 0x64de0a
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 5
add eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xa4]
mov eax, dword [edx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
cmp eax, dword [ebp - 0x10]
ja 0x64dde5
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064923c
cmp al, 9
jne 0x64dde5
mov edx, dword [ebp - 0x10]
inc edx
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov byte [ebp - 9], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
call fcn.0040663c
inc eax
push eax
mov eax, dword [ebp - 4]
add eax, 0x6c
mov ecx, 1
mov edx, dword [0x64b41c]
call fcn.004067f8
add esp, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
call fcn.00406644
imul eax, eax, 0x83
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x6c]
lea esi, [edx + eax*2]
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64dc83
lea eax, [ebp - 0x2f8]
push eax
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x2f8]
mov eax, esi
mov ecx, 0xff
call fcn.00405558
mov edx, dword [ebp - 0x10]
add edx, 5
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ebx, eax
cmp bl, 0x13
jbe 0x64dcee
xor eax, eax
mov al, bl
add eax, 0xffffff60
cmp eax, 4
ja case.default.0x64dca6
jmp dword [eax*4 + 0x64dcad]
mov byte [esi + 0x100], 0x13
jmp case.default.0x64dca6
mov byte [esi + 0x100], 0x14
jmp case.default.0x64dca6
mov byte [esi + 0x100], 0x15
jmp case.default.0x64dca6
mov byte [esi + 0x100], 0x16
jmp case.default.0x64dca6
mov byte [esi + 0x100], 0x17
jmp case.default.0x64dca6
dec ebx
mov byte [esi + 0x100], bl
mov edx, dword [ebp - 0x10]
add edx, 6
mov eax, dword [ebp - 0x18]
call fcn.0064923c
dec eax
mov byte [esi + 0x101], al
mov edx, dword [ebp - 0x10]
add edx, 7
mov eax, dword [ebp - 0x18]
call fcn.0064923c
dec eax
mov byte [esi + 0x104], al
mov edx, dword [ebp - 0x10]
add edx, 8
mov eax, dword [ebp - 0x18]
call fcn.0064923c
dec eax
mov byte [esi + 0x105], al
mov edx, dword [ebp - 0x10]
add edx, 9
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov word [esi + 0x102], ax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
call fcn.00406644
imul eax, eax, 0x83
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x6c]
lea edx, [edx + eax*2]
lea eax, [ebp - 0x300]
call fcn.00405520
mov eax, dword [ebp - 0x300]
lea edx, [ebp - 0x2fc]
call fcn.00409c30
cmp dword [ebp - 0x2fc], 0
jne 0x64dde5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
call fcn.00406644
imul eax, eax, 0x83
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x6c]
lea eax, [edx + eax*2]
push eax
lea eax, [ebp - 0x304]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
call fcn.00406644
mov dword [ebp - 0x264], eax
mov byte [ebp - 0x260], 0
lea edx, [ebp - 0x264]
xor ecx, ecx
mov eax, 0x64e690
call fcn.0040b5bc
mov edx, dword [ebp - 0x304]
pop eax
mov ecx, 0xff
call fcn.00405558
mov eax, dword [ebp - 8]
inc eax
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 9
mov eax, dword [ebp - 4]
call fcn.0064bf30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x64dbae
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 0xa
mov eax, dword [ebp - 4]
call fcn.0064bf30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jle 0x64dfa3
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 5
add eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xa4]
mov eax, dword [edx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
cmp eax, dword [ebp - 0x10]
ja 0x64df7e
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064923c
cmp al, 0xa
jne 0x64df7e
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 5
add eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xa4]
xor ebx, ebx
mov bl, byte [edx + eax*8 + 5]
sub ebx, 4
sar ebx, 1
jns 0x64de8a
adc ebx, 0
mov edx, dword [ebp - 0x10]
inc edx
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov byte [ebp - 9], al
dec ebx
test ebx, ebx
jl 0x64df7e
inc ebx
mov dword [ebp - 0x24], ebx
xor esi, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
call fcn.0040663c
inc eax
push eax
mov eax, dword [ebp - 4]
add eax, 0x74
mov ecx, 1
mov edx, dword [0x64b464]
call fcn.004067f8
add esp, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
call fcn.00406644
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x74]
lea edi, [edx + eax*8]
mov edx, dword [ebp - 0x10]
add edx, 4
lea eax, [esi + 1]
dec eax
add eax, eax
add edx, eax
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ebx, eax
xor eax, eax
mov al, bl
dec eax
cmp eax, 6
jg 0x64df0c
mov eax, ebx
dec eax
mov byte [edi + 4], al
jmp 0x64df10
mov byte [edi + 4], 0
xor eax, eax
mov al, bl
mov dl, 7
call fcn.0063d2b4
mov byte [edi + 5], al
mov edx, dword [ebp - 0x10]
add edx, 5
lea eax, [esi + 1]
dec eax
add eax, eax
add edx, eax
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64df74
lea eax, [ebp - 0x308]
push eax
mov edx, dword [ebp - 0x10]
add edx, 5
lea eax, [esi + 1]
dec eax
add eax, eax
add edx, eax
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x308]
mov eax, edi
call fcn.00405310
inc esi
dec dword [ebp - 0x24]
jne 0x64dea8
mov eax, dword [ebp - 8]
inc eax
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 0xa
mov eax, dword [ebp - 4]
call fcn.0064bf30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x64de2c
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 0x11
mov eax, dword [ebp - 4]
call fcn.0064bf30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jle 0x64e383
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 5
add eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xa4]
mov eax, dword [edx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
cmp eax, dword [ebp - 0x10]
ja 0x64e35e
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064923c
cmp al, 0x11
jne 0x64e35e
mov edx, dword [ebp - 0x10]
inc edx
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov byte [ebp - 9], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
call fcn.0040663c
inc eax
push eax
mov eax, dword [ebp - 4]
add eax, 0x64
mov ecx, 1
mov edx, dword [0x64b3d4]
call fcn.004067f8
add esp, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
call fcn.00406644
imul eax, eax, 0x183
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x64]
lea edi, [edx + eax*4]
mov edx, dword [ebp - 0x10]
add edx, 8
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov word [edi], ax
mov edx, dword [ebp - 0x10]
add edx, 0xa
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov word [edi + 2], ax
mov edx, dword [ebp - 0x10]
add edx, 0xc
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov word [edi + 4], ax
mov edx, dword [ebp - 0x10]
add edx, 0xe
mov eax, dword [ebp - 0x18]
call fcn.0064923c
dec eax
mov byte [edi + 6], al
mov edx, dword [ebp - 0x10]
add edx, 0x10
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64e0e2
lea eax, [ebp - 0x30c]
push eax
mov edx, dword [ebp - 0x10]
add edx, 0x10
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x30c]
lea eax, [edi + 7]
mov ecx, 0xff
call fcn.00405558
mov edx, dword [ebp - 0x10]
add edx, 0x11
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64e131
lea eax, [ebp - 0x310]
push eax
mov edx, dword [ebp - 0x10]
add edx, 0x11
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x310]
lea eax, [edi + 0x107]
mov ecx, 0xff
call fcn.00405558
mov edx, dword [ebp - 0x10]
add edx, 0x12
mov eax, dword [ebp - 0x18]
call fcn.0064923c
dec eax
mov byte [edi + 0x207], al
mov edx, dword [ebp - 0x10]
add edx, 0x13
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov ebx, eax
mov ax, word [0x64e600]
mov word [edi + 0x208], ax
xor esi, esi
mov edx, esi
movzx eax, bx
call fcn.0063d2b4
test al, al
je 0x64e197
mov edx, esi
lea eax, [ebp - 0x2cc]
mov cl, 2
call fcn.00403c3c
mov ax, word [ebp - 0x2cc]
or ax, word [edi + 0x208]
mov word [edi + 0x208], ax
inc esi
cmp esi, 0xd
jne 0x64e165
mov word [edi + 0x20a], 0
mov byte [edi + 0x20c], 0
mov byte [edi + 0x30c], 0
mov byte [edi + 0x50c], 0
mov byte [edi + 0x40c], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x94], 2
ja 0x64e1de
mov eax, dword [ebp - 4]
cmp byte [eax + 0x95], 3
jb 0x64e35e
mov edx, dword [ebp - 0x10]
add edx, 0x15
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov word [edi + 0x20a], ax
cmp word [edi + 0x20a], 0
jbe 0x64e222
mov edx, dword [ebp - 0x10]
add edx, 0x15
mov eax, dword [ebp - 0x18]
call fcn.006492f4
movzx eax, ax
push eax
mov eax, 0x3e8
pop edx
mov ecx, edx
xor edx, edx
div ecx
mov word [edi + 0x20a], ax
mov edx, dword [ebp - 0x10]
add edx, 0x17
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64e271
lea eax, [ebp - 0x314]
push eax
mov edx, dword [ebp - 0x10]
add edx, 0x17
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x314]
lea eax, [edi + 0x20c]
mov ecx, 0xff
call fcn.00405558
mov edx, dword [ebp - 0x10]
add edx, 0x18
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64e2c0
lea eax, [ebp - 0x318]
push eax
mov edx, dword [ebp - 0x10]
add edx, 0x18
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x318]
lea eax, [edi + 0x30c]
mov ecx, 0xff
call fcn.00405558
mov edx, dword [ebp - 0x10]
add edx, 0x19
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64e30f
lea eax, [ebp - 0x31c]
push eax
mov edx, dword [ebp - 0x10]
add edx, 0x19
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x31c]
lea eax, [edi + 0x40c]
mov ecx, 0xff
call fcn.00405558
mov edx, dword [ebp - 0x10]
add edx, 0x1a
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64e35e
lea eax, [ebp - 0x320]
push eax
mov edx, dword [ebp - 0x10]
add edx, 0x1a
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov edx, dword [ebp - 0x320]
lea eax, [edi + 0x50c]
mov ecx, 0xff
call fcn.00405558
mov eax, dword [ebp - 8]
inc eax
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 0x11
mov eax, dword [ebp - 4]
call fcn.0064bf30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x64dfc5
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 0x1c
mov eax, dword [ebp - 4]
call fcn.0064bf30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jle 0x64e580
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 5
add eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xa4]
mov eax, dword [edx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
cmp eax, dword [ebp - 0x10]
ja 0x64e55b
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064923c
cmp al, 0x1c
jne 0x64e55b
mov edx, dword [ebp - 0x10]
inc edx
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov byte [ebp - 9], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x78]
call fcn.0040663c
inc eax
push eax
mov eax, dword [ebp - 4]
add eax, 0x78
mov ecx, 1
mov edx, dword [0x64b488]
call fcn.004067f8
add esp, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x78]
call fcn.00406644
imul eax, eax, 0x87
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x78]
lea esi, [edx + eax*2]
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0064923c
test al, al
jbe 0x64e48b
lea eax, [ebp - 0x328]
push eax
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ecx, eax
xor edx, edx
mov dl, byte [ebp - 9]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0064939c
mov eax, dword [ebp - 0x328]
lea edx, [ebp - 0x324]
call fcn.00409c30
mov edx, dword [ebp - 0x324]
mov eax, esi
mov ecx, 0xff
call fcn.00405558
mov edx, dword [ebp - 0x10]
add edx, 5
mov eax, dword [ebp - 0x18]
call fcn.0064923c
mov ebx, eax
xor eax, eax
mov al, bl
mov edx, eax
shr edx, 4
dec edx
mov byte [esi + 0x101], dl
shl eax, 4
xchg al, ah
shr eax, 0xc
dec eax
mov byte [esi + 0x100], al
mov ebx, dword [ebp - 0x10]
add ebx, 6
mov edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov word [esi + 0x104], ax
mov edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov word [esi + 0x102], ax
mov edx, dword [ebp - 0x10]
add edx, 0xa
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov word [esi + 0x106], ax
mov edx, dword [ebp - 0x10]
add edx, 0xc
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov word [esi + 0x108], ax
mov edx, dword [ebp - 0x10]
add edx, 0xe
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov word [esi + 0x10a], ax
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 5
add eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xa4]
cmp byte [edx + eax*8 + 5], 0x14
jbe 0x64e552
mov edx, dword [ebp - 0x10]
add edx, 0x14
mov eax, dword [ebp - 0x18]
call fcn.006492f4
mov word [esi + 0x10c], ax
jmp 0x64e55b
mov word [esi + 0x10c], 0
mov eax, dword [ebp - 8]
inc eax
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
mov dl, 0x1c
mov eax, dword [ebp - 4]
call fcn.0064bf30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x64e3a5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64e5f8
lea eax, [ebp - 0x328]
mov edx, 0x17
call fcn.004052e0
lea eax, [ebp - 0x2c4]
mov edx, 9
call fcn.004052e0
lea eax, [ebp - 0x29c]
mov edx, 0xe
call fcn.004052e0
lea eax, [ebp - 0x25c]
mov edx, 4
call fcn.004052e0
lea eax, [ebp - 0x144]
call fcn.004052bc
lea eax, [ebp - 0x130]
mov edx, 3
call fcn.004052e0
lea eax, [ebp - 0x14]
call fcn.004052bc
ret