Function at 0x646140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x90]
cmp eax, dword [ecx + 8]
jbe 0x646e9e
sub esp, 0x110
mov dword [0x8f800c], 0
mov dword [0x8f8010], 0
mov edx, dword [0x91eb10]
test edx, edx
jne 0x64618f
lea eax, [0x91e8c0]
mov dword [0x8f8008], eax
jmp 0x6461a0
lea edi, [0x8f8008]
lea eax, [0x91e8c0]
call fcn.00462ed0
mov dword [0x8f801c], 0
mov dword [0x8f8020], 0
mov edx, dword [0x91eb10]
test edx, edx
jne 0x6461c6
mov dword [0x8f8018], eax
jmp 0x6461d1
lea edi, [0x8f8018]
call fcn.00462ed0
mov edx, dword [0x8f1c68]
mov dword [esp + 0x64], edx
mov ebx, dword [0x8f1c6c]
mov dword [esp + 0x34], ebx
xor eax, eax
jmp 0x6461f8
mov ebp, dword [esp + 0x30]
lea eax, [ebp + 1]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x34]
cmp eax, ebx
jge 0x6463de
mov dword [esp + 0x30], eax
lea ecx, [edx + eax*8]
mov ebx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp], 0
lea ebp, [0x6c7dc2]
mov dword [esp + 4], ebp
mov dword [esp + 8], 6
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
lea ecx, [0x6c70c5]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], 2
call fcn.0044eda0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00617b40
mov eax, dword [esp + 8]
mov dword [esp + 0x44], eax
mov ecx, dword [0x8f800c]
lea edx, [ecx + 1]
mov ebx, dword [0x8f8008]
mov ebp, dword [0x8f8010]
cmp ebp, edx
jae 0x6462cc
lea eax, [0x69d760]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], edx
call fcn.0044b5e0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [0x8f8010], edx
mov edx, dword [0x91eb10]
test edx, edx
jne 0x6462bb
mov dword [0x8f8008], eax
jmp 0x6462c6
lea edi, [0x8f8008]
call fcn.00462ed0
mov ebx, eax
mov eax, dword [esp + 0x44]
lea edx, [ecx + 1]
mov dword [0x8f800c], edx
lea edx, [ecx + ecx*2]
mov dword [ebx + edx*4 + 8], 4
mov ebp, dword [0x91eb10]
lea edi, [ebx + edx*4]
lea esi, [ebx + edx*4 + 4]
test ebp, ebp
jne 0x646300
mov dword [ebx + edx*4], eax
lea ebp, [0x6c7495]
mov dword [ebx + edx*4 + 4], ebp
jmp 0x64631c
call fcn.00462ed0
mov edi, esi
mov ecx, eax
lea eax, [0x6c7495]
call fcn.00462ed0
mov eax, ecx
lea ebp, [0x6c7495]
mov edx, dword [0x8f801c]
lea ebx, [edx + 1]
mov esi, dword [0x8f8018]
mov ebp, dword [0x8f8020]
cmp ebp, ebx
jae 0x64638a
lea eax, [0x69d760]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
call fcn.0044b5e0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [0x8f8020], edx
mov edx, dword [0x91eb10]
test edx, edx
jne 0x646377
mov dword [0x8f8018], eax
jmp 0x646382
lea edi, [0x8f8018]
call fcn.00462ed0
mov esi, eax
mov edx, ecx
mov eax, dword [esp + 0x44]
lea ebx, [edx + 1]
mov dword [0x8f801c], ebx
lea edx, [edx + edx*2]
mov dword [esi + edx*4 + 8], 4
mov ebx, dword [0x91eb10]
lea edi, [esi + edx*4]
lea ebp, [esi + edx*4 + 4]
test ebx, ebx
jne 0x6463c1
mov dword [esi + edx*4], eax
lea ebx, [0x6c7495]
mov dword [esi + edx*4 + 4], ebx
jmp 0x6461e9
call fcn.00462ed0
mov edi, ebp
lea eax, [0x6c7495]
call fcn.00462ed0
lea ebx, [0x6c7495]
jmp 0x6461e9
mov edx, dword [0x8f1c3c]
mov ebx, dword [0x8f1c38]
test edx, edx
je 0x6463f9
mov dword [esp + 0x34], edx
xor eax, eax
jmp 0x646bc8
mov edx, dword [0x8f1c3c]
mov ebx, dword [0x8f1c38]
test edx, edx
je 0x646414
mov dword [esp + 0x34], edx
xor eax, eax
jmp 0x6468e8
mov edx, dword [0x8f1c4c]
dec edx
jmp 0x646424
mov ebx, dword [esp + 0x28]
lea edx, [ebx - 1]
test edx, edx
jl 0x646667
mov ebx, dword [0x8f1c48]
mov ecx, dword [0x8f1c4c]
cmp edx, ecx
jae 0x6468d6
mov dword [esp + 0x28], edx
shl edx, 4
mov ecx, dword [ebx + edx]
mov dword [esp + 0x60], ecx
mov ebp, dword [ebx + edx + 4]
mov dword [esp + 0x34], ebp
mov esi, dword [ebx + edx + 8]
mov dword [esp + 0x5c], esi
mov edx, dword [ebx + edx + 0xc]
mov dword [esp + 0x30], edx
mov dword [esp], ecx
mov dword [esp + 4], ebp
call fcn.004d4570
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00617b40
mov eax, dword [esp + 8]
mov dword [esp + 0x58], eax
mov ecx, dword [esp + 0x5c]
mov dword [esp], ecx
mov edx, dword [esp + 0x30]
mov dword [esp + 4], edx
call fcn.004d4570
mov eax, dword [esp + 8]
mov dword [esp + 0x54], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x2c], ecx
mov edx, dword [esp + 0x60]
mov dword [esp], edx
mov ebx, dword [esp + 0x34]
mov dword [esp + 4], ebx
call fcn.00617b40
mov eax, dword [esp + 8]
mov dword [esp + 0x50], eax
mov dword [esp], 0
lea ecx, [0x6c74a9]
mov dword [esp + 4], ecx
mov dword [esp + 8], 4
mov edx, dword [esp + 0x60]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x10], edx
call fcn.0044ed00
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00617b40
mov eax, dword [esp + 8]
mov dword [esp + 0x4c], eax
lea edi, [esp + 0xa4]
xor eax, eax
call fcn.00463147
mov eax, dword [esp + 0x58]
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xb4], eax
mov ecx, dword [esp + 0x30]
mov dword [esp + 0xb8], ecx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0xbc], edx
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], ecx
mov eax, dword [0x8f800c]
lea ecx, [eax + 3]
mov dword [esp + 0x34], ecx
mov edx, dword [0x8f8010]
mov ebx, dword [0x8f8008]
cmp edx, ecx
jae 0x6465d0
mov dword [esp + 0x30], eax
lea ebp, [0x69d760]
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
call fcn.0044b5e0
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov ebp, dword [0x8f800c]
cmp ebp, ecx
ja 0x6468cf
mov dword [esp + 0x30], edx
mov dword [esp + 0x48], ebx
lea ecx, [0x69d760]
mov dword [esp], ecx
sub edx, ebp
lea edi, [ebp + ebp*2]
neg edx
shl edi, 2
sar edx, 0x1f
and edx, edi
add edx, ebx
mov dword [esp + 4], edx
sub eax, ebp
add eax, 3
mov dword [esp + 8], eax
lea eax, [esp + 0xa4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 3
call fcn.00410c90
mov eax, dword [esp + 0x34]
mov dword [0x8f800c], eax
mov eax, dword [esp + 0x30]
mov dword [0x8f8010], eax
mov eax, dword [0x91eb10]
test eax, eax
jne 0x646653
mov edx, dword [esp + 0x48]
mov dword [0x8f8008], edx
jmp 0x64641d
lea edi, [0x8f8008]
mov eax, dword [esp + 0x48]
call fcn.00462ed0
jmp 0x64641d
mov edx, dword [0x8f1c5c]
dec edx
jmp 0x646677
mov ebx, dword [esp + 0x24]
lea edx, [ebx - 1]
test edx, edx
jl 0x6468ba
mov ebx, dword [0x8f1c58]
mov ecx, dword [0x8f1c5c]
cmp edx, ecx
jae 0x6468c8
mov dword [esp + 0x24], edx
shl edx, 4
mov ecx, dword [ebx + edx]
mov dword [esp + 0x60], ecx
mov ebp, dword [ebx + edx + 4]
mov dword [esp + 0x34], ebp
mov esi, dword [ebx + edx + 8]
mov dword [esp + 0x5c], esi
mov edx, dword [ebx + edx + 0xc]
mov dword [esp + 0x30], edx
mov dword [esp], ecx
mov dword [esp + 4], ebp
call fcn.004d4570
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00617b40
mov eax, dword [esp + 8]
mov dword [esp + 0x58], eax
mov ecx, dword [esp + 0x5c]
mov dword [esp], ecx
mov edx, dword [esp + 0x30]
mov dword [esp + 4], edx
call fcn.004d4570
mov eax, dword [esp + 8]
mov dword [esp + 0x54], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x2c], ecx
mov edx, dword [esp + 0x60]
mov dword [esp], edx
mov ebx, dword [esp + 0x34]
mov dword [esp + 4], ebx
call fcn.00617b40
mov eax, dword [esp + 8]
mov dword [esp + 0x50], eax
mov dword [esp], 0
lea ecx, [0x6c74a9]
mov dword [esp + 4], ecx
mov dword [esp + 8], 4
mov edx, dword [esp + 0x60]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x10], edx
call fcn.0044ed00
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00617b40
mov eax, dword [esp + 8]
mov dword [esp + 0x4c], eax
lea edi, [esp + 0x80]
xor eax, eax
call fcn.00463147
mov eax, dword [esp + 0x58]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x90], eax
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x94], ecx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x98], edx
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], ecx
mov eax, dword [0x8f801c]
lea ecx, [eax + 3]
mov dword [esp + 0x34], ecx
mov edx, dword [0x8f8020]
mov ebx, dword [0x8f8018]
cmp edx, ecx
jae 0x646823
mov dword [esp + 0x30], eax
lea ebp, [0x69d760]
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
call fcn.0044b5e0
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov ebp, dword [0x8f801c]
cmp ebp, ecx
ja 0x6468c1
mov dword [esp + 0x30], edx
mov dword [esp + 0x7c], ebx
lea ecx, [0x69d760]
mov dword [esp], ecx
lea esi, [ebp + ebp*2]
sub edx, ebp
neg edx
shl esi, 2
sar edx, 0x1f
and edx, esi
add edx, ebx
mov dword [esp + 4], edx
sub eax, ebp
add eax, 3
mov dword [esp + 8], eax
lea eax, [esp + 0x80]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 3
call fcn.00410c90
mov eax, dword [esp + 0x34]
mov dword [0x8f801c], eax
mov eax, dword [esp + 0x30]
mov dword [0x8f8020], eax
mov eax, dword [0x91eb10]
test eax, eax
jne 0x6468a6
mov edx, dword [esp + 0x7c]
mov dword [0x8f8018], edx
jmp 0x646670
lea edi, [0x8f8018]
mov eax, dword [esp + 0x7c]
call fcn.00462ed0
jmp 0x646670
add esp, 0x110
ret
mov eax, ebp
call fcn.00462fb0
mov eax, edx
call fcn.00462f50
mov eax, ebp
call fcn.00462fb0
mov eax, edx
call fcn.00462f50
mov ecx, dword [esp + 0x78]
add ecx, 0x10
mov ebx, ecx
mov eax, edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x78], ebx
mov ecx, dword [ebx]
mov dword [esp + 0x60], ecx
mov edx, dword [ebx + 4]
mov dword [esp + 0x2c], edx
mov ebp, dword [ebx + 8]
mov dword [esp + 0x5c], ebp
mov esi, dword [ebx + 0xc]
mov dword [esp + 0x40], esi
mov dword [esp], ebp
mov dword [esp + 4], esi
call fcn.004d4570
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
lea eax, str.__149__EHILNPUXY_abdeiux
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 1
call fcn.0044ed00
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00617b40
mov eax, dword [esp + 8]
mov dword [esp + 0x58], eax
mov ecx, dword [esp + 0x60]
mov dword [esp], ecx
mov edx, dword [esp + 0x2c]
mov dword [esp + 4], edx
call fcn.004d4570
mov eax, dword [esp + 8]
mov dword [esp + 0x54], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x3c], ecx
mov edx, dword [esp + 0x5c]
mov dword [esp], edx
mov ebx, dword [esp + 0x40]
mov dword [esp + 4], ebx
call fcn.004d4b10
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
lea eax, str.__149__EHILNPUXY_abdeiux
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 1
call fcn.0044ed00
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00617b40
mov eax, dword [esp + 8]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x60]
mov dword [esp], ecx
mov edx, dword [esp + 0x2c]
mov dword [esp + 4], edx
call fcn.004d4b10
mov eax, dword [esp + 8]
mov dword [esp + 0x74], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x38], ecx
mov dword [esp], 0
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 8], edx
lea edx, str.__149__EHILNPUXY_abdeiux
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 1
call fcn.0044ed00
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00617b40
mov eax, dword [esp + 8]
mov dword [esp + 0x4c], eax
lea edi, [esp + 0xc8]
xor eax, eax
call fcn.00463147
mov eax, dword [esp + 0x58]
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xcc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xd0], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0xd4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0xd8], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xdc], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0xe4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xe8], eax
mov eax, dword [0x8f801c]
lea ecx, [eax + 3]
mov dword [esp + 0x2c], ecx
mov edx, dword [0x8f8020]
mov ebx, dword [0x8f8018]
cmp edx, ecx
jae 0x646b11
mov dword [esp + 0x40], eax
lea ebp, [0x69d760]
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
call fcn.0044b5e0
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x2c]
mov ebp, dword [0x8f801c]
cmp ebp, ecx
ja 0x646bb6
mov dword [esp + 0x40], edx
mov dword [esp + 0x70], ebx
lea ecx, [0x69d760]
mov dword [esp], ecx
sub edx, ebp
lea edi, [ebp + ebp*2]
neg edx
shl edi, 2
sar edx, 0x1f
and edx, edi
add edx, ebx
mov dword [esp + 4], edx
sub eax, ebp
add eax, 3
mov dword [esp + 8], eax
lea eax, [esp + 0xc8]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 3
call fcn.00410c90
mov eax, dword [esp + 0x2c]
mov dword [0x8f801c], eax
mov eax, dword [esp + 0x40]
mov dword [0x8f8020], eax
mov eax, dword [0x91eb10]
test eax, eax
jne 0x646b91
mov edx, dword [esp + 0x70]
mov dword [0x8f8018], edx
jmp 0x646ba0
lea edi, [0x8f8018]
mov eax, dword [esp + 0x70]
call fcn.00462ed0
mov edx, dword [esp + 0x30]
inc edx
mov ebx, dword [esp + 0x34]
cmp ebx, edx
jg 0x6468dd
jmp 0x646414
mov eax, ebp
call fcn.00462fb0
mov ecx, dword [esp + 0x6c]
add ecx, 0x10
mov ebx, ecx
mov eax, edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x6c], ebx
mov ecx, dword [ebx]
mov dword [esp + 0x60], ecx
mov edx, dword [ebx + 4]
mov dword [esp + 0x2c], edx
mov ebp, dword [ebx + 8]
mov dword [esp + 0x5c], ebp
mov esi, dword [ebx + 0xc]
mov dword [esp + 0x40], esi
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.004d4570
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
lea eax, str.__149__EHILNPUXY_abdeiux
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 1
call fcn.0044ed00
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00617b40
mov eax, dword [esp + 8]
mov dword [esp + 0x58], eax
mov ecx, dword [esp + 0x5c]
mov dword [esp], ecx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], edx
call fcn.004d4570
mov eax, dword [esp + 8]
mov dword [esp + 0x54], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x3c], ecx
mov edx, dword [esp + 0x60]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
call fcn.004d4b10
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
lea eax, str.__149__EHILNPUXY_abdeiux
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 1
call fcn.0044ed00
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00617b40
mov eax, dword [esp + 8]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x5c]
mov dword [esp], ecx
mov edx, dword [esp + 0x40]
mov dword [esp + 4], edx
call fcn.004d4b10
mov eax, dword [esp + 8]
mov dword [esp + 0x74], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x38], ecx
mov dword [esp], 0
mov edx, dword [esp + 0x60]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], edx
lea edx, str.__149__EHILNPUXY_abdeiux
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 1
call fcn.0044ed00
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00617b40
mov eax, dword [esp + 8]
mov dword [esp + 0x4c], eax
lea edi, [esp + 0xec]
xor eax, eax
call fcn.00463147
mov eax, dword [esp + 0x58]
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xf0], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xf4], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0xf8], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0xfc], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10c], eax
mov eax, dword [0x8f800c]
lea ecx, [eax + 3]
mov dword [esp + 0x2c], ecx
mov edx, dword [0x8f8010]
mov ebx, dword [0x8f8008]
cmp edx, ecx
jae 0x646df1
mov dword [esp + 0x40], eax
lea ebp, [0x69d760]
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
call fcn.0044b5e0
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x2c]
mov ebp, dword [0x8f800c]
cmp ebp, ecx
ja 0x646e96
mov dword [esp + 0x40], edx
mov dword [esp + 0x68], ebx
lea ecx, [0x69d760]
mov dword [esp], ecx
sub edx, ebp
lea edi, [ebp + ebp*2]
neg edx
shl edi, 2
sar edx, 0x1f
and edx, edi
add edx, ebx
mov dword [esp + 4], edx
sub eax, ebp
add eax, 3
mov dword [esp + 8], eax
lea eax, [esp + 0xec]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 3
call fcn.00410c90
mov eax, dword [esp + 0x2c]
mov dword [0x8f800c], eax
mov eax, dword [esp + 0x40]
mov dword [0x8f8010], eax
mov eax, dword [0x91eb10]
test eax, eax
jne 0x646e71
mov edx, dword [esp + 0x68]
mov dword [0x8f8008], edx
jmp 0x646e80
lea edi, [0x8f8008]
mov eax, dword [esp + 0x68]
call fcn.00462ed0
mov edx, dword [esp + 0x30]
inc edx
mov ebx, dword [esp + 0x34]
cmp ebx, edx
jg 0x646bbd
jmp 0x6463f9
mov eax, ebp
call fcn.00462fb0
nop
call fcn.00461ac0
jmp fcn.00646140