Function at 0x647740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x12c]
cmp eax, dword [ecx + 8]
jbe 0x6488c2
sub esp, 0x1ac
mov eax, dword [esp + 0x1b0]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x38]
mov edx, dword [eax + 8]
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.00644fb0
mov eax, dword [esp + 0x1b0]
mov ecx, dword [eax + 4]
mov edx, dword [esp + 8]
mov dword [esp + 0xc0], edx
mov ebx, dword [eax + 8]
mov ebp, dword [ecx + 4]
mov ecx, dword [ecx + 8]
cmp ebx, ecx
jae 0x6488bb
lea ecx, [ebx + ebx*2]
mov ebx, dword [ebp + ecx*4]
mov dword [esp + 0xf8], ebx
mov esi, dword [ebp + ecx*4 + 4]
mov dword [esp + 0x5c], esi
mov ecx, dword [ebp + ecx*4 + 8]
mov dword [esp + 0x60], ecx
mov ebp, dword [eax + 4]
mov edi, dword [eax + 8]
mov edx, dword [ebp + 4]
mov ebp, dword [ebp + 8]
lea ecx, [edi + 1]
cmp ecx, ebp
jge 0x6488ae
jae 0x6488a7
lea ecx, [edi + edi*2]
mov ebp, dword [edx + ecx*4 + 0xc]
mov edi, dword [edx + ecx*4 + 0x10]
mov ecx, dword [edx + ecx*4 + 0x14]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x54], edi
mov dword [esp + 0x138], ebp
mov edx, dword [eax]
mov ecx, dword [eax + 0x18]
mov dword [esp + 0xfc], ecx
mov ecx, dword [eax + 0x1c]
mov dword [esp + 0x64], ecx
mov ecx, dword [eax + 0x20]
mov dword [esp + 0x68], ecx
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x100], ecx
mov edi, dword [eax + 0x10]
mov dword [esp + 0x6c], edi
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x70], ebp
mov edx, dword [edx + 0x3c]
mov dword [esp + 0xc], edx
mov dword [esp], ecx
mov dword [esp + 4], edi
mov dword [esp + 8], ebp
call fcn.0064cd50
mov eax, dword [esp + 0x10]
mov dword [esp + 0x104], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x78], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x7c], edx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x108], ebx
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x80], ebp
mov esi, dword [esp + 0x24]
mov dword [esp + 0x84], esi
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.00644470
mov eax, dword [esp + 0xc]
mov dword [esp + 0x134], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xbc], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0xb8], edx
mov ebx, dword [esp + 0x108]
mov dword [esp], ebx
mov ebp, dword [esp + 0x80]
mov dword [esp + 4], ebp
mov esi, dword [esp + 0x84]
mov dword [esp + 8], esi
call fcn.00644470
mov eax, dword [esp + 0x1b0]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x3c]
mov edx, dword [eax + 8]
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
test edx, edx
sete dl
mov byte [esp + 0x34], dl
mov edx, dword [esp + 0xf8]
mov dword [esp], edx
mov edi, dword [esp + 0x5c]
mov dword [esp + 4], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x100]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x6c]
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x70]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x134]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0xbc]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], esi
call fcn.0064c9b0
mov eax, dword [esp + 0x1b0]
lea ecx, [eax + 0xc]
mov dword [esp + 0x130], ecx
lea edx, [eax + 0x18]
mov dword [esp + 0x12c], edx
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x100], ebx
mov ebp, dword [esp + 0x3c]
mov dword [esp + 0x6c], ebp
mov esi, dword [esp + 0x40]
mov dword [esp + 0x70], esi
mov edi, dword [eax + 0x10]
cmp ebp, edi
jne 0x64882d
mov edi, dword [esp + 0x78]
mov dword [esp + 0x78], edi
mov edx, dword [esp + 0x104]
mov dword [esp], edx
mov dword [esp + 4], edi
mov ecx, dword [esp + 0x7c]
mov dword [esp + 8], ecx
call fcn.00644470
mov eax, dword [esp + 0xc]
mov dword [esp + 0x128], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xbc], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0xb8], edx
mov ebx, dword [esp + 0x108]
mov dword [esp], ebx
mov ebp, dword [esp + 0x80]
mov dword [esp + 4], ebp
mov esi, dword [esp + 0x84]
mov dword [esp + 8], esi
call fcn.00644470
mov eax, dword [esp + 0x1b0]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x3c]
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x138]
mov dword [esp], ecx
mov esi, dword [esp + 0x54]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x58]
mov dword [esp + 8], edi
mov edi, dword [esp + 0xfc]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x64]
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x68]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x128]
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0xbc]
mov dword [esp + 0x20], edi
mov edi, dword [esp + 0xb8]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebp
mov byte [esp + 0x34], 0
call fcn.0064c9b0
mov eax, dword [esp + 0x38]
mov dword [esp + 0xfc], eax
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x64], ecx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x68], edx
mov ebx, dword [esp + 0x6c]
lea ebp, [ebx + ecx]
mov dword [esp + 0xbc], ebp
mov esi, dword [esp + 0x70]
cmp ebp, esi
ja 0x6487d6
mov edi, esi
mov esi, dword [esp + 0x100]
mov dword [esp + 0x124], esi
mov esi, edi
mov dword [esp + 0xb8], esi
cmp ebp, esi
ja 0x6487cf
cmp ebx, ebp
ja 0x6487cf
sub esi, ebx
lea edi, [esi - 1]
sar edi, 0x1f
shl ebx, 2
xor edi, 0xffffffff
and ebx, edi
mov edi, dword [esp + 0x124]
add ebx, edi
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], esi
lea ebx, [0x6da080]
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
call fcn.0040d910
mov eax, dword [esp + 0x1b0]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x3c]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x124]
mov dword [esp], ecx
mov ecx, dword [esp + 0xbc]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0xb8]
mov dword [esp + 8], ecx
call fcn.0064cd50
mov eax, dword [esp + 0x10]
mov dword [esp + 0x114], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x98], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x9c], edx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x118], ebx
mov ebp, dword [esp + 0x20]
mov dword [esp + 0xa0], ebp
mov esi, dword [esp + 0x24]
mov dword [esp + 0xa4], esi
mov edi, dword [esp + 0x64]
test edi, edi
jg 0x647ebe
mov dword [esp + 0xe8], eax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x138], eax
mov dword [esp + 0xe0], ecx
mov ecx, dword [esp + 0xfc]
mov dword [esp + 0x124], ecx
mov eax, dword [esp + 0xe8]
mov ecx, dword [esp + 0xe0]
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa0], ebp
mov dword [esp + 0x118], ebx
mov dword [esp + 0x64], edi
mov esi, dword [esp + 0x1b0]
mov ebp, dword [esi + 4]
mov ebx, dword [esi + 8]
mov dword [esp + 0xc0], ebx
mov ebp, dword [ebp + 8]
add ebx, 2
mov dword [esp + 0x74], ebx
cmp ebx, ebp
jl 0x647d50
mov eax, dword [esp + 0x6c]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x70]
mov dword [esi + 0x14], eax
mov eax, dword [0x884700]
test eax, eax
jne 0x647d26
mov eax, dword [esp + 0x138]
mov dword [esi + 0xc], eax
mov dword [esi + 0x1c], edi
mov eax, dword [esp + 0x68]
mov dword [esi + 0x20], eax
mov eax, dword [0x884700]
test eax, eax
jne 0x647d00
mov eax, dword [esp + 0x124]
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x78]
mov dword [esi + 0x4c], eax
mov eax, dword [esp + 0x7c]
mov dword [esi + 0x50], eax
mov eax, dword [0x884700]
lea ecx, [esi + 0x48]
test eax, eax
jne 0x647ce4
mov eax, dword [esp + 0x104]
mov dword [esi + 0x48], eax
mov eax, dword [esp + 0x80]
mov dword [esi + 0x58], eax
mov eax, dword [esp + 0x84]
mov dword [esi + 0x5c], eax
mov eax, dword [0x884700]
lea ecx, [esi + 0x54]
test eax, eax
jne 0x647ccf
mov eax, dword [esp + 0x108]
mov dword [esi + 0x54], eax
add esp, 0x1ac
ret
mov dword [esp], ecx
mov eax, dword [esp + 0x108]
mov dword [esp + 4], eax
call fcn.0040d5a0
jmp 0x647cc8
mov dword [esp], ecx
mov eax, dword [esp + 0x104]
mov dword [esp + 4], eax
call fcn.0040d5a0
mov esi, dword [esp + 0x1b0]
jmp 0x647c9d
mov eax, dword [esp + 0x12c]
mov dword [esp], eax
mov eax, dword [esp + 0x124]
mov dword [esp + 4], eax
call fcn.0040d5a0
mov esi, dword [esp + 0x1b0]
jmp 0x647c78
mov eax, dword [esp + 0x130]
mov dword [esp], eax
mov eax, dword [esp + 0x138]
mov dword [esp + 4], eax
call fcn.0040d5a0
mov esi, dword [esp + 0x1b0]
mov edi, dword [esp + 0x64]
jmp 0x647c56
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.00644470
mov eax, dword [esp + 0xc]
mov dword [esp + 0x120], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xbc], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0xb8], edx
mov ebx, dword [esp + 0x118]
mov dword [esp], ebx
mov ebx, dword [esp + 0xa0]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0xa4]
mov dword [esp + 8], ebx
call fcn.00644470
mov eax, dword [esp + 0x1b0]
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x11c], edx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0xb4], ebx
mov ebp, dword [esp + 0x14]
mov dword [esp + 0xb0], ebp
mov esi, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov edi, dword [esp + 0x74]
cmp edi, ecx
jae 0x647eb7
mov ecx, dword [eax]
mov edi, dword [esp + 0xc0]
lea edi, [edi + edi*2]
mov ebp, dword [esi + edi*4 + 0x18]
mov ebx, dword [esi + edi*4 + 0x1c]
mov esi, dword [esi + edi*4 + 0x20]
mov ecx, dword [ecx + 0x3c]
mov edi, dword [eax + 0x2c]
mov edx, dword [eax + 0x30]
mov eax, dword [eax + 0x34]
mov dword [esp + 0x18], ecx
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x120]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xbc]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xb8]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x11c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x30], eax
mov byte [esp + 0x34], 0
call fcn.0064c9b0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov ebx, dword [esp + 0x1b0]
mov dword [ebx + 0x30], ecx
mov dword [ebx + 0x34], edx
mov ecx, dword [0x884700]
lea edx, [ebx + 0x2c]
test ecx, ecx
jne 0x647ea2
mov dword [ebx + 0x2c], eax
mov esi, ebx
mov edi, dword [esp + 0x64]
jmp 0x647c30
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0040d5a0
mov ebx, dword [esp + 0x1b0]
jmp 0x647e97
call fcn.00424680
ud2
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.00644470
mov eax, dword [esp + 0xc]
mov dword [esp + 0x128], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xbc], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0xb8], edx
mov ebx, dword [esp + 0x118]
mov dword [esp], ebx
mov ebp, dword [esp + 0xa0]
mov dword [esp + 4], ebp
mov esi, dword [esp + 0xa4]
mov dword [esp + 8], esi
call fcn.00644470
mov eax, dword [esp + 0x1b0]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x3c]
mov edx, dword [eax + 8]
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
test edx, edx
sete dl
mov byte [esp + 0x34], dl
mov edx, dword [esp + 0xf8]
mov dword [esp], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x60]
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x128]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0xbc]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], esi
call fcn.0064c9b0
mov eax, dword [esp + 0x38]
mov dword [esp + 0x110], eax
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x90], ecx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x94], edx
mov ebx, dword [esp + 0x6c]
cmp ecx, ebx
jg 0x648029
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0xa4]
mov ebp, dword [esp + 0xa0]
mov esi, dword [esp + 0x118]
mov edi, dword [esp + 0x9c]
mov eax, dword [esp + 0x100]
mov dword [esp + 0x138], eax
mov eax, dword [esp + 0xfc]
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0x114]
mov dword [esp + 0x6c], ebx
mov ebx, esi
mov esi, edx
mov edx, edi
mov edi, dword [esp + 0x64]
jmp 0x647bf1
mov ebp, dword [esp + 0xfc]
mov dword [esp], ebp
mov esi, dword [esp + 0x64]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x68]
mov dword [esp + 8], edi
call fcn.0064c680
mov eax, dword [esp + 0xc]
mov dword [esp + 0xac], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xa8], ecx
mov edx, dword [esp + 0x110]
mov dword [esp], edx
mov ebx, dword [esp + 0x90]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x94]
mov dword [esp + 8], ebp
call fcn.0064c680
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xac]
mov edx, eax
add eax, ecx
mov ebx, dword [esp + 0xc0]
mov ebp, ebx
sar ebx, 0x1f
mov esi, dword [esp + 0x10]
add edx, ecx
mov ecx, dword [esp + 0xa8]
adc ecx, esi
cmp eax, ebp
setb al
cmp ecx, ebx
sete dl
and eax, edx
cmp ecx, ebx
setl cl
or eax, ecx
test al, al
jne 0x6480cd
mov ebx, dword [esp + 0x6c]
jmp 0x647fc9
mov eax, dword [esp + 0x1b0]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x3c]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x110]
mov dword [esp], ecx
mov edx, dword [esp + 0x90]
mov dword [esp + 4], edx
mov ebx, dword [esp + 0x94]
mov dword [esp + 8], ebx
call fcn.0064cd50
mov eax, dword [esp + 0x10]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x44], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x48], edx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0xf4], ebx
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x4c], ebp
mov esi, dword [esp + 0x24]
mov dword [esp + 0x50], esi
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.00644470
mov eax, dword [esp + 0xc]
mov dword [esp + 0x128], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc0], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0xbc], edx
mov ebx, dword [esp + 0xf4]
mov dword [esp], ebx
mov ebp, dword [esp + 0x4c]
mov dword [esp + 4], ebp
mov esi, dword [esp + 0x50]
mov dword [esp + 8], esi
call fcn.00644470
mov eax, dword [esp + 0x1b0]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x3c]
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x138]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x58]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x128]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0xc0]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xbc]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebp
mov byte [esp + 0x34], 0
call fcn.0064c9b0
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10c], eax
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x88], ecx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x8c], edx
mov ebx, dword [esp + 0x64]
cmp ecx, ebx
je 0x6482a4
mov eax, dword [esp + 0x118]
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 0xa4]
mov ebp, dword [esp + 0x114]
mov esi, dword [esp + 0x98]
mov edi, dword [esp + 0x9c]
mov eax, dword [esp + 0xfc]
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x138], eax
mov eax, dword [esp + 0x118]
mov dword [esp + 0x64], ebx
mov ebx, dword [esp + 0x6c]
mov dword [esp + 0xd8], eax
mov eax, ebp
mov ebp, ecx
mov ecx, esi
mov esi, dword [esp + 0xd8]
jmp 0x648016
mov ebp, dword [esp + 0x1b0]
mov esi, dword [ebp + 8]
inc esi
mov dword [esp + 0xd4], esi
mov esi, dword [esp + 0x6c]
mov dword [esp + 0xd0], esi
mov edi, dword [esp + 0x100]
mov dword [esp], edi
mov dword [esp + 4], esi
mov esi, dword [esp + 0x70]
mov dword [esp + 8], esi
call fcn.0064c680
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.0064e7b0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x154], eax
mov dword [esp + 0x158], ecx
mov eax, dword [esp + 0x64]
mov dword [esp + 0xcc], eax
mov ecx, dword [esp + 0xfc]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 8], eax
call fcn.0064c680
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.0064e7b0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], ecx
mov eax, dword [esp + 0x90]
mov dword [esp + 0xc8], eax
mov ecx, dword [esp + 0x110]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov edx, dword [esp + 0x94]
mov dword [esp + 8], edx
call fcn.0064c680
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.0064e7b0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x144], eax
mov dword [esp + 0x148], ecx
mov eax, dword [esp + 0x88]
mov dword [esp + 0xc4], eax
mov ecx, dword [esp + 0x10c]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov edx, dword [esp + 0x8c]
mov dword [esp + 8], edx
call fcn.0064c680
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.0064e7b0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
lea edi, [esp + 0x15c]
xor eax, eax
call fcn.0044a36c
mov eax, dword [esp + 0x1b0]
lea ecx, [eax + 8]
mov dword [esp + 4], ecx
lea ecx, [0x6b4260]
mov dword [esp], ecx
call fcn.0040a880
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x15c], eax
mov dword [esp + 0x160], ecx
lea eax, [0x6b4260]
mov dword [esp], eax
lea ecx, [esp + 0xd4]
mov dword [esp + 4], ecx
call fcn.0040a880
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x164], eax
mov dword [esp + 0x168], ecx
lea eax, [0x6b4260]
mov dword [esp], eax
lea ecx, [esp + 0xd0]
mov dword [esp + 4], ecx
call fcn.0040a880
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], ecx
lea eax, [0x6b4960]
mov dword [esp], eax
lea ecx, [esp + 0x154]
mov dword [esp + 4], ecx
call fcn.0040a880
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], ecx
lea eax, [0x6b4260]
mov dword [esp], eax
lea ecx, [esp + 0xcc]
mov dword [esp + 4], ecx
call fcn.0040a880
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x17c], eax
mov dword [esp + 0x180], ecx
lea eax, [0x6b4960]
mov dword [esp], eax
lea ecx, [esp + 0x14c]
mov dword [esp + 4], ecx
call fcn.0040a880
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x184], eax
mov dword [esp + 0x188], ecx
lea eax, [0x6b4260]
mov dword [esp], eax
lea ecx, [esp + 0xc8]
mov dword [esp + 4], ecx
call fcn.0040a880
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18c], eax
mov dword [esp + 0x190], ecx
lea eax, [0x6b4960]
mov dword [esp], eax
lea ecx, [esp + 0x144]
mov dword [esp + 4], ecx
call fcn.0040a880
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x194], eax
mov dword [esp + 0x198], ecx
lea eax, [0x6b4260]
mov dword [esp], eax
lea eax, [esp + 0xc4]
mov dword [esp + 4], eax
call fcn.0040a880
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x19c], eax
mov dword [esp + 0x1a0], ecx
lea eax, [0x6b4960]
mov dword [esp], eax
lea eax, [esp + 0x13c]
mov dword [esp + 4], eax
call fcn.0040a880
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x1a4], eax
mov dword [esp + 0x1a8], ecx
mov eax, dword [esp + 0x1b0]
mov ecx, dword [eax]
mov dword [esp], ecx
lea ecx, [0x718799]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x5d
lea ecx, [esp + 0x15c]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 0xa
mov dword [esp + 0x14], 0xa
call fcn.0064b2a0
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x90]
lea edx, [ecx + eax]
mov dword [esp + 0xc0], edx
mov ebx, dword [esp + 0x94]
cmp edx, ebx
ja 0x648781
mov ebp, ebx
mov esi, dword [esp + 0x110]
mov dword [esp + 0x138], esi
mov dword [esp + 0xbc], ebx
cmp edx, ebx
ja 0x64877a
cmp ecx, edx
ja 0x64877a
sub ebx, ecx
lea ebp, [ebx - 1]
sar ebp, 0x1f
shl ecx, 2
xor ebp, 0xffffffff
and ecx, ebp
add ecx, esi
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
lea ecx, [0x6da080]
mov dword [esp], ecx
mov ecx, dword [esp + 0x10c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x8c]
mov dword [esp + 0x18], ebx
call fcn.0040d910
mov eax, dword [esp + 0x1b0]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x3c]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x138]
mov dword [esp], ecx
mov ecx, dword [esp + 0xc0]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0xbc]
mov dword [esp + 8], ecx
call fcn.0064cd50
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x10c]
mov dword [esp + 0x124], ebx
mov ebx, dword [esp + 0x88]
mov ebx, dword [esp + 0x8c]
mov dword [esp + 0x68], ebx
mov ebx, dword [esp + 0x110]
mov dword [esp + 0x138], ebx
mov ebx, dword [esp + 0x90]
mov dword [esp + 0x6c], ebx
mov ebx, dword [esp + 0x94]
mov dword [esp + 0x70], ebx
mov ebx, dword [esp + 0xf4]
mov dword [esp + 0x108], ebx
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x84], ebx
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x80], ebx
mov ebx, dword [esp + 0x48]
mov dword [esp + 0x7c], ebx
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x78], ebx
mov ebx, dword [esp + 0xf0]
mov dword [esp + 0x104], ebx
mov ebx, dword [esp + 0x88]
jmp 0x648283
call fcn.004246e0
ud2
lea ebp, [0x6da080]
mov dword [esp], ebp
mov esi, dword [esp + 0x110]
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
call fcn.00437660
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0xc0]
mov ebp, dword [esp + 0x94]
jmp 0x648637
call fcn.004246e0
ud2
lea edi, [0x6da080]
mov dword [esp], edi
mov edx, dword [esp + 0x100]
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebp
call fcn.00437660
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0xbc]
mov edi, dword [esp + 0x70]
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0xfc]
jmp 0x647ae0
mov edi, dword [eax]
mov edi, dword [edi + 0x3c]
mov dword [esp + 0xc], edi
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
call fcn.0064cd50
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x70]
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x84], ebp
mov dword [esp + 0x108], edx
mov dword [esp + 0x104], eax
mov dword [esp + 0x80], ebx
mov eax, dword [esp + 0x1b0]
mov ecx, dword [esp + 0x130]
mov edx, dword [esp + 0x12c]
mov ebx, dword [esp + 0x100]
mov ebp, dword [esp + 0x6c]
jmp 0x6479ac
call fcn.00424680
ud2
xor ecx, ecx
xor edi, edi
lea ebp, [esp + 0x44]
jmp 0x6477ee
call fcn.00424680
ud2
call fcn.004486b0
jmp fcn.00647740