X-Git-Url: https://notaz.gp2x.de/cgi-bin/gitweb.cgi?p=ia32rtools.git;a=blobdiff_plain;f=tools%2Ftranslate.c;h=dadf7a915098cf64c3d2c4acebca801228046f30;hp=704d4bc85c83e4ecbcd676dd44442ac44e6ba1ae;hb=d4a985bd88473515445c6f9f0ae51be9895b9d60;hpb=4e81a3a2e191ccf8498da6d23e96c03fc8b36c83

diff --git a/tools/translate.c b/tools/translate.c
index 704d4bc..dadf7a9 100644
--- a/tools/translate.c
+++ b/tools/translate.c
@@ -13,6 +13,7 @@
 
 #include "my_assert.h"
 #include "my_str.h"
+#include "common.h"
 
 #define ARRAY_SIZE(x) (sizeof(x) / sizeof(x[0]))
 #define IS(w, y) !strcmp(w, y)
@@ -41,7 +42,7 @@ enum op_flags {
   OPF_DATA   = (1 << 1), /* data processing - writes to dst opr */
   OPF_FLAGS  = (1 << 2), /* sets flags */
   OPF_JMP    = (1 << 3), /* branch, call */
-  OPF_CJMP   = (1 << 4), /* cond. branch (cc or jecxz) */
+  OPF_CJMP   = (1 << 4), /* cond. branch (cc or jecxz/loop) */
   OPF_CC     = (1 << 5), /* uses flags */
   OPF_TAIL   = (1 << 6), /* ret or tail call */
   OPF_RSAVE  = (1 << 7), /* push/pop is local reg save/load */
@@ -57,6 +58,11 @@ enum op_flags {
   OPF_LOCK   = (1 << 17), /* op has lock prefix */
   OPF_VAPUSH = (1 << 18), /* vararg ptr push (as call arg) */
   OPF_DONE   = (1 << 19), /* already fully handled by analysis */
+  OPF_PPUSH  = (1 << 20), /* part of complex push-pop graph */
+  OPF_NOREGS = (1 << 21), /* don't track regs of this op */
+  OPF_FPUSH  = (1 << 22), /* pushes x87 stack */
+  OPF_FPOP   = (1 << 23), /* pops x87 stack */
+  OPF_FSHIFT = (1 << 24), /* x87 stack shift is actually needed */
 };
 
 enum op_op {
@@ -71,6 +77,7 @@ enum op_op {
 	OP_MOVSX,
 	OP_XCHG,
 	OP_NOT,
+	OP_XLAT,
 	OP_CDQ,
 	OP_LODS,
 	OP_STOS,
@@ -88,6 +95,7 @@ enum op_op {
 	OP_SHL,
 	OP_SHR,
 	OP_SAR,
+	OP_SHLD,
 	OP_SHRD,
 	OP_ROL,
 	OP_ROR,
@@ -108,13 +116,32 @@ enum op_op {
 	OP_CALL,
 	OP_JMP,
 	OP_JECXZ,
+	OP_LOOP,
 	OP_JCC,
 	OP_SCC,
-	// x87
-	// mmx
-	OP_EMMS,
-	// undefined
-	OP_UD2,
+  // x87
+  OP_FLD,
+  OP_FILD,
+  OP_FLDc,
+  OP_FST,
+  OP_FADD,
+  OP_FDIV,
+  OP_FMUL,
+  OP_FSUB,
+  OP_FDIVR,
+  OP_FSUBR,
+  OP_FIADD,
+  OP_FIDIV,
+  OP_FIMUL,
+  OP_FISUB,
+  OP_FIDIVR,
+  OP_FISUBR,
+  // mmx
+  OP_EMMS,
+  // pseudo-ops for lib calls
+  OPP_FTOL,
+  // undefined
+  OP_UD2,
 };
 
 enum opr_type {
@@ -135,12 +162,18 @@ enum opr_lenmod {
 	OPLM_QWORD,
 };
 
+#define MAX_EXITS 128
+
 #define MAX_OPERANDS 3
 #define NAMELEN 112
 
+#define OPR_INIT(type_, lmod_, reg_) \
+  { type_, lmod_, reg_, }
+
 struct parsed_opr {
   enum opr_type type;
   enum opr_lenmod lmod;
+  int reg;
   unsigned int is_ptr:1;   // pointer in C
   unsigned int is_array:1; // array in C
   unsigned int type_from_var:1; // .. in header, sometimes wrong
@@ -148,7 +181,6 @@ struct parsed_opr {
   unsigned int size_lt:1;  // type override is larger than C
   unsigned int had_ds:1;   // had ds: prefix
   const struct parsed_proto *pp; // for OPT_LABEL
-  int reg;
   unsigned int val;
   char name[NAMELEN];
 };
@@ -176,9 +208,10 @@ struct parsed_op {
 };
 
 // datap:
-// OP_CALL - parser proto hint (str)
+// OP_CALL  - parser proto hint (str)
 // (OPF_CC) - points to one of (OPF_FLAGS) that affects cc op
-// OP_POP - points to OP_PUSH in push/pop pair
+// OP_PUSH  - points to OP_POP in complex push/pop graph
+// OP_POP   - points to OP_PUSH in simple push/pop pair
 
 struct parsed_equ {
   char name[64];
@@ -215,6 +248,16 @@ enum ida_func_attr {
   IDAFA_FPD      = (1 << 5),
 };
 
+enum x87_const {
+  X87_CONST_1 = 1,
+  X87_CONST_2T,
+  X87_CONST_2E,
+  X87_CONST_PI,
+  X87_CONST_LG2,
+  X87_CONST_LN2,
+  X87_CONST_Z,
+};
+
 // note: limited to 32k due to p_argnext
 #define MAX_OPS     4096
 #define MAX_ARG_GRP 2
@@ -227,6 +270,7 @@ static struct label_ref g_label_refs[MAX_OPS];
 static const struct parsed_proto *g_func_pp;
 static struct parsed_data *g_func_pd;
 static int g_func_pd_cnt;
+static int g_func_lmods;
 static char g_func[256];
 static char g_comment[256];
 static int g_bp_frame;
@@ -240,8 +284,8 @@ static int g_quiet_pp;
 static int g_header_mode;
 
 #define ferr(op_, fmt, ...) do { \
-  printf("%s:%d: error: [%s] '%s': " fmt, asmfn, (op_)->asmln, g_func, \
-    dump_op(op_), ##__VA_ARGS__); \
+  printf("%s:%d: error %u: [%s] '%s': " fmt, asmfn, (op_)->asmln, \
+    __LINE__, g_func, dump_op(op_), ##__VA_ARGS__); \
   fcloseall(); \
   exit(1); \
 } while (0)
@@ -250,20 +294,33 @@ static int g_header_mode;
     dump_op(op_), ##__VA_ARGS__)
 
 #define ferr_assert(op_, cond) do { \
-  if (!(cond)) ferr(op_, "assertion '%s' failed on ln :%d\n", #cond, \
-                    __LINE__); \
+  if (!(cond)) ferr(op_, "assertion '%s' failed\n", #cond); \
 } while (0)
 
 const char *regs_r32[] = {
   "eax", "ebx", "ecx", "edx", "esi", "edi", "ebp", "esp",
   // not r32, but list here for easy parsing and printing
   "mm0", "mm1", "mm2", "mm3", "mm4", "mm5", "mm6", "mm7",
+  "st", "st(1)", "st(2)", "st(3)", "st(4)", "st(5)", "st(6)", "st(7)"
 };
 const char *regs_r16[] = { "ax", "bx", "cx", "dx", "si", "di", "bp", "sp" };
 const char *regs_r8l[] = { "al", "bl", "cl", "dl" };
 const char *regs_r8h[] = { "ah", "bh", "ch", "dh" };
 
-enum x86_regs { xUNSPEC = -1, xAX, xBX, xCX, xDX, xSI, xDI, xBP, xSP };
+enum x86_regs {
+  xUNSPEC = -1,
+  xAX, xBX, xCX, xDX,
+  xSI, xDI, xBP, xSP,
+  xMM0, xMM1, xMM2, xMM3, // mmx
+  xMM4, xMM5, xMM6, xMM7,
+  xST0, xST1, xST2, xST3, // x87
+  xST4, xST5, xST6, xST7,
+};
+
+#define mxAX     (1 << xAX)
+#define mxDX     (1 << xDX)
+#define mxST0    (1 << xST0)
+#define mxST1    (1 << xST1)
 
 // possible basic comparison types (without inversion)
 enum parsed_flag_op {
@@ -506,19 +563,19 @@ static const char *parse_stack_el(const char *name, char *extra_reg,
 
 static int guess_lmod_from_name(struct parsed_opr *opr)
 {
-  if (!strncmp(opr->name, "dword_", 6)) {
+  if (IS_START(opr->name, "dword_") || IS_START(opr->name, "off_")) {
     opr->lmod = OPLM_DWORD;
     return 1;
   }
-  if (!strncmp(opr->name, "word_", 5)) {
+  if (IS_START(opr->name, "word_")) {
     opr->lmod = OPLM_WORD;
     return 1;
   }
-  if (!strncmp(opr->name, "byte_", 5)) {
+  if (IS_START(opr->name, "byte_")) {
     opr->lmod = OPLM_BYTE;
     return 1;
   }
-  if (!strncmp(opr->name, "qword_", 6)) {
+  if (IS_START(opr->name, "qword_")) {
     opr->lmod = OPLM_QWORD;
     return 1;
   }
@@ -742,6 +799,9 @@ static int parse_operand(struct parsed_opr *opr,
         equ_find(NULL, parse_stack_el(opr->name, NULL, 1), &i);
       if (eq)
         opr->lmod = eq->lmod;
+
+      // might be unaligned access
+      g_func_lmods |= 1 << OPLM_BYTE;
     }
     return wordc;
   }
@@ -840,6 +900,7 @@ static const struct {
   { "movsx",OP_MOVSX,  2, 2, OPF_DATA },
   { "xchg", OP_XCHG,   2, 2, OPF_DATA },
   { "not",  OP_NOT,    1, 1, OPF_DATA },
+  { "xlat", OP_XLAT,   0, 0, OPF_DATA },
   { "cdq",  OP_CDQ,    0, 0, OPF_DATA },
   { "lodsb",OP_LODS,   0, 0, OPF_DATA },
   { "lodsw",OP_LODS,   0, 0, OPF_DATA },
@@ -867,6 +928,7 @@ static const struct {
   { "shr",  OP_SHR,    2, 2, OPF_DATA|OPF_FLAGS },
   { "sal",  OP_SHL,    2, 2, OPF_DATA|OPF_FLAGS },
   { "sar",  OP_SAR,    2, 2, OPF_DATA|OPF_FLAGS },
+  { "shld", OP_SHLD,   3, 3, OPF_DATA|OPF_FLAGS },
   { "shrd", OP_SHRD,   3, 3, OPF_DATA|OPF_FLAGS },
   { "rol",  OP_ROL,    2, 2, OPF_DATA|OPF_FLAGS },
   { "ror",  OP_ROR,    2, 2, OPF_DATA|OPF_FLAGS },
@@ -888,6 +950,7 @@ static const struct {
   { "call", OP_CALL,   1, 1, OPF_JMP|OPF_DATA|OPF_FLAGS },
   { "jmp",  OP_JMP,    1, 1, OPF_JMP },
   { "jecxz",OP_JECXZ,  1, 1, OPF_JMP|OPF_CJMP },
+  { "loop", OP_LOOP,   1, 1, OPF_JMP|OPF_CJMP|OPF_DATA },
   { "jo",   OP_JCC,    1, 1, OPF_CJMP_CC, PFO_O,  0 }, // 70 OF=1
   { "jno",  OP_JCC,    1, 1, OPF_CJMP_CC, PFO_O,  1 }, // 71 OF=0
   { "jc",   OP_JCC,    1, 1, OPF_CJMP_CC, PFO_C,  0 }, // 72 CF=1
@@ -947,9 +1010,35 @@ static const struct {
   { "setg",   OP_SCC,  1, 1, OPF_DATA|OPF_CC, PFO_LE, 1 },
   { "setnle", OP_SCC,  1, 1, OPF_DATA|OPF_CC, PFO_LE, 1 },
   // x87
+  { "fld",    OP_FLD,    1, 1, OPF_FPUSH },
+  { "fild",   OP_FILD,   1, 1, OPF_FPUSH },
+  { "fld1",   OP_FLDc,   0, 0, OPF_FPUSH },
+  { "fldz",   OP_FLDc,   0, 0, OPF_FPUSH },
+  { "fstp",   OP_FST,    1, 1, OPF_FPOP },
+  { "fst",    OP_FST,    1, 1, 0 },
+  { "fadd",   OP_FADD,   0, 2, 0 },
+  { "faddp",  OP_FADD,   0, 2, OPF_FPOP },
+  { "fdiv",   OP_FDIV,   0, 2, 0 },
+  { "fdivp",  OP_FDIV,   0, 2, OPF_FPOP },
+  { "fmul",   OP_FMUL,   0, 2, 0 },
+  { "fmulp",  OP_FMUL,   0, 2, OPF_FPOP },
+  { "fsub",   OP_FSUB,   0, 2, 0 },
+  { "fsubp",  OP_FSUB,   0, 2, OPF_FPOP },
+  { "fdivr",  OP_FDIVR,  0, 2, 0 },
+  { "fdivrp", OP_FDIVR,  0, 2, OPF_FPOP },
+  { "fsubr",  OP_FSUBR,  0, 2, 0 },
+  { "fsubrp", OP_FSUBR,  0, 2, OPF_FPOP },
+  { "fiadd",  OP_FIADD,  1, 1, 0 },
+  { "fidiv",  OP_FIDIV,  1, 1, 0 },
+  { "fimul",  OP_FIMUL,  1, 1, 0 },
+  { "fisub",  OP_FISUB,  1, 1, 0 },
+  { "fidivr", OP_FIDIVR, 1, 1, 0 },
+  { "fisubr", OP_FISUBR, 1, 1, 0 },
   // mmx
-  { "emms",   OP_EMMS, 0, 0, OPF_DATA },
-  { "movq",   OP_MOV,  2, 2, OPF_DATA },
+  { "emms",   OP_EMMS,   0, 0, OPF_DATA },
+  { "movq",   OP_MOV,    2, 2, OPF_DATA },
+  // pseudo-ops for lib calls
+  { "_ftol",  OPP_FTOL },
   // must be last
   { "ud2",    OP_UD2 },
 };
@@ -963,7 +1052,7 @@ static void parse_op(struct parsed_op *op, char words[16][256], int wordc)
   int op_w = 0;
   int opr = 0;
   int w = 0;
-  int i;
+  int i, j;
 
   for (i = 0; i < ARRAY_SIZE(pref_table); i++) {
     if (IS(words[w], pref_table[i].name)) {
@@ -1014,6 +1103,9 @@ static void parse_op(struct parsed_op *op, char words[16][256], int wordc)
     else
       op->regmask_src |= regmask;
     op->regmask_src |= regmask_ind;
+
+    if (op->operand[opr].lmod != OPLM_UNSPEC)
+      g_func_lmods |= 1 << op->operand[opr].lmod;
   }
 
   if (w < wordc)
@@ -1069,6 +1161,13 @@ static void parse_op(struct parsed_op *op, char words[16][256], int wordc)
     break;
 
   // ops with implicit argumets
+  case OP_XLAT:
+    op->operand_cnt = 2;
+    setup_reg_opr(&op->operand[0], xAX, OPLM_BYTE, &op->regmask_src);
+    op->regmask_dst = op->regmask_src;
+    setup_reg_opr(&op->operand[1], xBX, OPLM_DWORD, &op->regmask_src);
+    break;
+
   case OP_CDQ:
     op->operand_cnt = 2;
     setup_reg_opr(&op->operand[0], xDX, OPLM_DWORD, &op->regmask_dst);
@@ -1078,49 +1177,62 @@ static void parse_op(struct parsed_op *op, char words[16][256], int wordc)
   case OP_LODS:
   case OP_STOS:
   case OP_SCAS:
-    if (op->operand_cnt != 0)
-      break;
     if      (words[op_w][4] == 'b')
       lmod = OPLM_BYTE;
     else if (words[op_w][4] == 'w')
       lmod = OPLM_WORD;
     else if (words[op_w][4] == 'd')
       lmod = OPLM_DWORD;
-    op->operand_cnt = 3;
-    setup_reg_opr(&op->operand[0], op->op == OP_LODS ? xSI : xDI,
-      lmod, &op->regmask_src);
-    setup_reg_opr(&op->operand[1], xCX, OPLM_DWORD, &op->regmask_src);
+    j = 0;
+    op->regmask_src = 0;
+    setup_reg_opr(&op->operand[j++], op->op == OP_LODS ? xSI : xDI,
+      OPLM_DWORD, &op->regmask_src);
     op->regmask_dst = op->regmask_src;
-    setup_reg_opr(&op->operand[2], xAX, OPLM_DWORD,
+    setup_reg_opr(&op->operand[j++], xAX, lmod,
       op->op == OP_LODS ? &op->regmask_dst : &op->regmask_src);
+    if (op->flags & OPF_REP) {
+      setup_reg_opr(&op->operand[j++], xCX, OPLM_DWORD, &op->regmask_src);
+      op->regmask_dst |= 1 << xCX;
+    }
+    op->operand_cnt = j;
     break;
 
   case OP_MOVS:
   case OP_CMPS:
-    if (op->operand_cnt != 0)
-      break;
     if      (words[op_w][4] == 'b')
       lmod = OPLM_BYTE;
     else if (words[op_w][4] == 'w')
       lmod = OPLM_WORD;
     else if (words[op_w][4] == 'd')
       lmod = OPLM_DWORD;
-    op->operand_cnt = 3;
-    setup_reg_opr(&op->operand[0], xDI, lmod, &op->regmask_src);
-    setup_reg_opr(&op->operand[1], xSI, OPLM_DWORD, &op->regmask_src);
-    setup_reg_opr(&op->operand[2], xCX, OPLM_DWORD, &op->regmask_src);
+    j = 0;
+    op->regmask_src = 0;
+    // note: lmod is not correct, don't have where to place it
+    setup_reg_opr(&op->operand[j++], xDI, lmod, &op->regmask_src);
+    setup_reg_opr(&op->operand[j++], xSI, OPLM_DWORD, &op->regmask_src);
+    if (op->flags & OPF_REP)
+      setup_reg_opr(&op->operand[j++], xCX, OPLM_DWORD, &op->regmask_src);
+    op->operand_cnt = j;
     op->regmask_dst = op->regmask_src;
     break;
 
+  case OP_LOOP:
+    op->regmask_dst = 1 << xCX;
+    // fallthrough
   case OP_JECXZ:
-    op->operand_cnt = 1;
+    op->operand_cnt = 2;
     op->regmask_src = 1 << xCX;
-    op->operand[0].type = OPT_REG;
-    op->operand[0].reg = xCX;
-    op->operand[0].lmod = OPLM_DWORD;
+    op->operand[1].type = OPT_REG;
+    op->operand[1].reg = xCX;
+    op->operand[1].lmod = OPLM_DWORD;
     break;
 
   case OP_IMUL:
+    if (op->operand_cnt == 2) {
+      if (op->operand[0].type != OPT_REG)
+        aerr("reg expected\n");
+      op->regmask_src |= 1 << op->operand[0].reg;
+    }
     if (op->operand_cnt != 1)
       break;
     // fallthrough
@@ -1152,6 +1264,7 @@ static void parse_op(struct parsed_op *op, char words[16][256], int wordc)
       op->operand[1].lmod = OPLM_BYTE;
     break;
 
+  case OP_SHLD:
   case OP_SHRD:
     op->regmask_src |= op->regmask_dst;
     if (op->operand[2].lmod == OPLM_UNSPEC)
@@ -1176,7 +1289,7 @@ static void parse_op(struct parsed_op *op, char words[16][256], int wordc)
      && op->operand[0].reg == op->operand[1].reg
      && IS(op->operand[0].name, op->operand[1].name)) // ! ah, al..
     {
-      op->flags |= OPF_RMD | OPF_DONE;
+      op->flags |= OPF_RMD | OPF_DONE | OPF_NOREGS;
       op->regmask_src = op->regmask_dst = 0;
     }
     break;
@@ -1188,7 +1301,7 @@ static void parse_op(struct parsed_op *op, char words[16][256], int wordc)
       char buf[16];
       snprintf(buf, sizeof(buf), "%s+0", op->operand[0].name);
       if (IS(buf, op->operand[1].name))
-        op->flags |= OPF_RMD | OPF_DONE;
+        op->flags |= OPF_RMD | OPF_DONE | OPF_NOREGS;
     }
     break;
 
@@ -1202,9 +1315,73 @@ static void parse_op(struct parsed_op *op, char words[16][256], int wordc)
     op->regmask_src =  1 << xBP;
     break;
 
+  case OP_FLD:
+  case OP_FILD:
+    op->regmask_dst |= mxST0;
+    break;
+
+  case OP_FLDc:
+    op->regmask_dst |= mxST0;
+    if      (IS(words[op_w] + 3, "1"))
+      op->operand[0].val = X87_CONST_1;
+    else if (IS(words[op_w] + 3, "z"))
+      op->operand[0].val = X87_CONST_Z;
+    else
+      aerr("TODO\n");
+    break;
+
+  case OP_FST:
+    op->regmask_src |= mxST0;
+    break;
+
+  case OP_FADD:
+  case OP_FDIV:
+  case OP_FMUL:
+  case OP_FSUB:
+  case OP_FDIVR:
+  case OP_FSUBR:
+    op->regmask_src |= mxST0;
+    if (op->operand_cnt == 2)
+      op->regmask_src |= op->regmask_dst;
+    else if (op->operand_cnt == 1) {
+      memcpy(&op->operand[1], &op->operand[0], sizeof(op->operand[1]));
+      op->operand[0].type = OPT_REG;
+      op->operand[0].lmod = OPLM_QWORD;
+      op->operand[0].reg = xST0;
+      op->regmask_dst |= mxST0;
+    }
+    else
+      // IDA doesn't use this
+      aerr("no operands?\n");
+    break;
+
+  case OP_FIADD:
+  case OP_FIDIV:
+  case OP_FIMUL:
+  case OP_FISUB:
+  case OP_FIDIVR:
+  case OP_FISUBR:
+    op->regmask_src |= mxST0;
+    op->regmask_dst |= mxST0;
+    break;
+
   default:
     break;
   }
+
+  if (op->operand[0].type == OPT_REG
+   && op->operand[1].type == OPT_CONST)
+  {
+    struct parsed_opr *op1 = &op->operand[1];
+    if ((op->op == OP_AND && op1->val == 0)
+     || (op->op == OP_OR
+      && (op1->val == ~0
+       || (op->operand[0].lmod == OPLM_WORD && op1->val == 0xffff)
+       || (op->operand[0].lmod == OPLM_BYTE && op1->val == 0xff))))
+    {
+      op->regmask_src = 0;
+    }
+  }
 }
 
 static const char *op_name(struct parsed_op *po)
@@ -1372,10 +1549,45 @@ static const char *opr_reg_p(struct parsed_op *po, struct parsed_opr *popr)
   return regs_r32[popr->reg];
 }
 
+static int check_simple_cast(const char *cast, int *bits, int *is_signed)
+{
+  if      (IS_START(cast, "(s8)") || IS_START(cast, "(u8)"))
+    *bits = 8;
+  else if (IS_START(cast, "(s16)") || IS_START(cast, "(u16)"))
+    *bits = 16;
+  else if (IS_START(cast, "(s32)") || IS_START(cast, "(u32)"))
+    *bits = 32;
+  else if (IS_START(cast, "(s64)") || IS_START(cast, "(u64)"))
+    *bits = 64;
+  else
+    return -1;
+
+  *is_signed = cast[1] == 's' ? 1 : 0;
+  return 0;
+}
+
+static int check_deref_cast(const char *cast, int *bits)
+{
+  if      (IS_START(cast, "*(u8 *)"))
+    *bits = 8;
+  else if (IS_START(cast, "*(u16 *)"))
+    *bits = 16;
+  else if (IS_START(cast, "*(u32 *)"))
+    *bits = 32;
+  else if (IS_START(cast, "*(u64 *)"))
+    *bits = 64;
+  else
+    return -1;
+
+  return 0;
+}
+
 // cast1 is the "final" cast
 static const char *simplify_cast(const char *cast1, const char *cast2)
 {
   static char buf[256];
+  int bits1, bits2;
+  int s1, s2;
 
   if (cast1[0] == 0)
     return cast2;
@@ -1383,14 +1595,22 @@ static const char *simplify_cast(const char *cast1, const char *cast2)
     return cast1;
   if (IS(cast1, cast2))
     return cast1;
-  if (IS(cast1, "(s8)") && IS(cast2, "(u8)"))
-    return cast1;
-  if (IS(cast1, "(s16)") && IS(cast2, "(u16)"))
-    return cast1;
-  if (IS(cast1, "(u8)") && IS_START(cast2, "*(u8 *)"))
-    return cast2;
-  if (IS(cast1, "(u16)") && IS_START(cast2, "*(u16 *)"))
-    return cast2;
+
+  if (check_simple_cast(cast1, &bits1, &s1) == 0
+    && check_simple_cast(cast2, &bits2, &s2) == 0)
+  {
+    if (bits1 <= bits2)
+      return cast1;
+  }
+  if (check_simple_cast(cast1, &bits1, &s1) == 0
+    && check_deref_cast(cast2, &bits2) == 0)
+  {
+    if (bits1 == bits2) {
+      snprintf(buf, sizeof(buf), "*(%c%d *)", s1 ? 's' : 'u', bits1);
+      return buf;
+    }
+  }
+
   if (strchr(cast1, '*') && IS_START(cast2, "(u32)"))
     return cast1;
 
@@ -1694,6 +1914,14 @@ static int stack_frame_access(struct parsed_op *po,
       snprintf(buf, buf_size, "%ssf.d[%d]", prefix, sf_ofs / 4);
       break;
 
+    case OPLM_QWORD:
+      ferr_assert(po, !(sf_ofs & 7));
+      ferr_assert(po, ofs_reg[0] == 0);
+      // float callers set is_lea
+      ferr_assert(po, is_lea);
+      snprintf(buf, buf_size, "%ssf.q[%d]", prefix, sf_ofs / 8);
+      break;
+
     default:
       ferr(po, "bp_stack bad lmod: %d\n", popr->lmod);
     }
@@ -1928,6 +2156,52 @@ static char *out_src_opr_u32(char *buf, size_t buf_size,
   return out_src_opr(buf, buf_size, po, popr, NULL, 0);
 }
 
+static char *out_src_opr_float(char *buf, size_t buf_size,
+  struct parsed_op *po, struct parsed_opr *popr)
+{
+  const char *cast = NULL;
+  char tmp[256];
+
+  switch (popr->type) {
+  case OPT_REG:
+    if (popr->reg < xST0 || popr->reg > xST7)
+      ferr(po, "bad reg: %d\n", popr->reg);
+
+    snprintf(buf, buf_size, "f_st%d", popr->reg - xST0);
+    break;
+
+  case OPT_REGMEM:
+  case OPT_LABEL:
+  case OPT_OFFSET:
+    switch (popr->lmod) {
+    case OPLM_QWORD:
+      cast = "double";
+      break;
+    case OPLM_DWORD:
+      cast = "float";
+      break;
+    default:
+      ferr(po, "unhandled lmod: %d\n", popr->lmod);
+      break;
+    }
+    out_src_opr(tmp, sizeof(tmp), po, popr, "", 1);
+    snprintf(buf, buf_size, "*((%s *)%s)", cast, tmp);
+    break;
+
+  default:
+    ferr(po, "invalid float type: %d\n", popr->type);
+  }
+
+  return buf;
+}
+
+static char *out_dst_opr_float(char *buf, size_t buf_size,
+  struct parsed_op *po, struct parsed_opr *popr)
+{
+  // same?
+  return out_src_opr_float(buf, buf_size, po, popr);
+}
+
 static void out_test_for_cc(char *buf, size_t buf_size,
   struct parsed_op *po, enum parsed_flag_op pfo, int is_inv,
   enum opr_lenmod lmod, const char *expr)
@@ -2127,66 +2401,60 @@ static const char *op_to_c(struct parsed_op *po)
   }
 }
 
-static void op_set_clear_flag(struct parsed_op *po,
-  enum op_flags flag_set, enum op_flags flag_clear)
-{
-  po->flags |= flag_set;
-  po->flags &= ~flag_clear;
-}
-
 // last op in stream - unconditional branch or ret
 #define LAST_OP(_i) ((ops[_i].flags & OPF_TAIL) \
   || ((ops[_i].flags & (OPF_JMP|OPF_CJMP|OPF_RMD)) == OPF_JMP \
       && ops[_i].op != OP_CALL))
 
-static int scan_for_pop(int i, int opcnt, const char *reg,
-  int magic, int depth, int *maxdepth, int do_flags)
+#define check_i(po, i) \
+  if ((i) < 0) \
+    ferr(po, "bad " #i ": %d\n", i)
+
+// note: this skips over calls and rm'd stuff assuming they're handled
+// so it's intended to use at one of final passes
+static int scan_for_pop(int i, int opcnt, int magic, int reg,
+  int depth, int flags_set)
 {
-  const struct parsed_proto *pp;
   struct parsed_op *po;
+  int relevant;
   int ret = 0;
   int j;
 
   for (; i < opcnt; i++) {
     po = &ops[i];
     if (po->cc_scratch == magic)
-      break; // already checked
+      return ret; // already checked
     po->cc_scratch = magic;
 
     if (po->flags & OPF_TAIL) {
       if (po->op == OP_CALL) {
-        pp = proto_parse(g_fhdr, po->operand[0].name, g_quiet_pp);
-        if (pp != NULL && pp->is_noreturn)
-          // no stack cleanup for noreturn
-          return ret;
+        if (po->pp != NULL && po->pp->is_noreturn)
+          // assume no stack cleanup for noreturn
+          return 1;
       }
       return -1; // deadend
     }
 
-    if ((po->flags & (OPF_RMD|OPF_DONE))
-        || (po->op == OP_PUSH && po->p_argnum != 0)) // arg push
+    if (po->flags & (OPF_RMD|OPF_DONE|OPF_FARG))
       continue;
 
     if ((po->flags & OPF_JMP) && po->op != OP_CALL) {
       if (po->btj != NULL) {
         // jumptable
         for (j = 0; j < po->btj->count; j++) {
-          ret |= scan_for_pop(po->btj->d[j].bt_i, opcnt, reg, magic,
-                   depth, maxdepth, do_flags);
+          check_i(po, po->btj->d[j].bt_i);
+          ret |= scan_for_pop(po->btj->d[j].bt_i, opcnt, magic, reg,
+                   depth, flags_set);
           if (ret < 0)
             return ret; // dead end
         }
         return ret;
       }
 
-      if (po->bt_i < 0) {
-        ferr(po, "dead branch\n");
-        return -1;
-      }
-
+      check_i(po, po->bt_i);
       if (po->flags & OPF_CJMP) {
-        ret |= scan_for_pop(po->bt_i, opcnt, reg, magic,
-                 depth, maxdepth, do_flags);
+        ret |= scan_for_pop(po->bt_i, opcnt, magic, reg,
+                 depth, flags_set);
         if (ret < 0)
           return ret; // dead end
       }
@@ -2196,182 +2464,467 @@ static int scan_for_pop(int i, int opcnt, const char *reg,
       continue;
     }
 
+    relevant = 0;
     if ((po->op == OP_POP || po->op == OP_PUSH)
-        && po->operand[0].type == OPT_REG
-        && IS(po->operand[0].name, reg))
+      && po->operand[0].type == OPT_REG && po->operand[0].reg == reg)
     {
-      if (po->op == OP_PUSH && !(po->flags & OPF_FARGNR)) {
-        depth++;
-        if (depth > *maxdepth)
-          *maxdepth = depth;
-        if (do_flags)
-          op_set_clear_flag(po, OPF_RSAVE, OPF_RMD);
-      }
-      else if (po->op == OP_POP) {
-        if (depth == 0) {
-          if (do_flags)
-            op_set_clear_flag(po, OPF_RMD, OPF_RSAVE);
-          return 1;
-        }
-        else {
-          depth--;
-          if (depth < 0) // should not happen
-            ferr(po, "fail with depth\n");
-          if (do_flags)
-            op_set_clear_flag(po, OPF_RSAVE, OPF_RMD);
-        }
+      relevant = 1;
+    }
+
+    if (po->op == OP_PUSH) {
+      depth++;
+    }
+    else if (po->op == OP_POP) {
+      if (relevant && depth == 0) {
+        po->flags |= flags_set;
+        return 1;
       }
+      depth--;
     }
   }
 
-  return ret;
+  return -1;
 }
 
-// scan for pop starting from 'ret' op (all paths)
-static int scan_for_pop_ret(int i, int opcnt, const char *reg,
-  int flag_set)
+// scan for 'reg' pop backwards starting from i
+// intended to use for register restore search, so other reg
+// references are considered an error
+static int scan_for_rsave_pop_reg(int i, int magic, int reg, int set_flags)
 {
-  int found = 0;
-  int j;
-
-  for (; i < opcnt; i++) {
-    if (!(ops[i].flags & OPF_TAIL))
-      continue;
+  struct parsed_op *po;
+  struct label_ref *lr;
+  int ret = 0;
 
-    for (j = i - 1; j >= 0; j--) {
-      if (ops[j].flags & (OPF_RMD|OPF_DONE))
-        continue;
-      if (ops[j].flags & OPF_JMP)
-        return -1;
+  ops[i].cc_scratch = magic;
 
-      if (ops[j].op == OP_POP && ops[j].datap == NULL
-          && ops[j].operand[0].type == OPT_REG
-          && IS(ops[j].operand[0].name, reg))
-      {
-        found = 1;
-        ops[j].flags |= flag_set;
-        break;
+  while (1)
+  {
+    if (g_labels[i] != NULL) {
+      lr = &g_label_refs[i];
+      for (; lr != NULL; lr = lr->next) {
+        check_i(&ops[i], lr->i);
+        ret |= scan_for_rsave_pop_reg(lr->i, magic, reg, set_flags);
+        if (ret < 0)
+          return ret;
       }
-
-      if (g_labels[j] != NULL)
-        return -1;
+      if (i > 0 && LAST_OP(i - 1))
+        return ret;
     }
-  }
 
-  return found ? 0 : -1;
-}
+    i--;
+    if (i < 0)
+      break;
 
-static void scan_for_pop_const(int i, int opcnt)
-{
-  int j;
+    if (ops[i].cc_scratch == magic)
+      return ret;
+    ops[i].cc_scratch = magic;
 
-  for (j = i + 1; j < opcnt; j++) {
-    if ((ops[j].flags & (OPF_JMP|OPF_TAIL|OPF_RSAVE))
-      || ops[j].op == OP_PUSH || g_labels[i] != NULL)
-    {
-      break;
-    }
+    po = &ops[i];
+    if (po->op == OP_POP && po->operand[0].reg == reg) {
+      if (po->flags & (OPF_RMD|OPF_DONE))
+        return -1;
 
-    if (ops[j].op == OP_POP && !(ops[j].flags & (OPF_RMD|OPF_DONE)))
-    {
-      ops[i].flags |= OPF_RMD | OPF_DONE;
-      ops[j].flags |= OPF_DONE;
-      ops[j].datap = &ops[i];
-      break;
+      po->flags |= set_flags;
+      return 1;
     }
+
+    // this also covers the case where we reach corresponding push
+    if ((po->regmask_dst | po->regmask_src) & (1 << reg))
+      return -1;
   }
+
+  // nothing interesting on this path
+  return 0;
 }
 
-static void scan_propagate_df(int i, int opcnt)
+static void find_reachable_exits(int i, int opcnt, int magic,
+  int *exits, int *exit_count)
 {
-  struct parsed_op *po = &ops[i];
+  struct parsed_op *po;
   int j;
 
-  for (; i < opcnt; i++) {
+  for (; i < opcnt; i++)
+  {
     po = &ops[i];
-    if (po->flags & OPF_DF)
-      return; // already resolved
-    po->flags |= OPF_DF;
+    if (po->cc_scratch == magic)
+      return;
+    po->cc_scratch = magic;
 
-    if (po->op == OP_CALL)
-      ferr(po, "call with DF set?\n");
+    if (po->flags & OPF_TAIL) {
+      ferr_assert(po, *exit_count < MAX_EXITS);
+      exits[*exit_count] = i;
+      (*exit_count)++;
+      return;
+    }
 
-    if (po->flags & OPF_JMP) {
-      if (po->btj != NULL) {
-        // jumptable
-        for (j = 0; j < po->btj->count; j++)
-          scan_propagate_df(po->btj->d[j].bt_i, opcnt);
-        return;
-      }
+    if ((po->flags & OPF_JMP) && po->op != OP_CALL) {
+      if (po->flags & OPF_RMD)
+        continue;
 
-      if (po->bt_i < 0) {
-        ferr(po, "dead branch\n");
+      if (po->btj != NULL) {
+        for (j = 0; j < po->btj->count; j++) {
+          check_i(po, po->btj->d[j].bt_i);
+          find_reachable_exits(po->btj->d[j].bt_i, opcnt, magic,
+                  exits, exit_count);
+        }
         return;
       }
 
+      check_i(po, po->bt_i);
       if (po->flags & OPF_CJMP)
-        scan_propagate_df(po->bt_i, opcnt);
+        find_reachable_exits(po->bt_i, opcnt, magic, exits, exit_count);
       else
         i = po->bt_i - 1;
       continue;
     }
-
-    if (po->flags & OPF_TAIL)
-      break;
-
-    if (po->op == OP_CLD) {
-      po->flags |= OPF_RMD | OPF_DONE;
-      return;
-    }
   }
-
-  ferr(po, "missing DF clear?\n");
 }
 
-// is operand 'opr' modified by parsed_op 'po'?
-static int is_opr_modified(const struct parsed_opr *opr,
-  const struct parsed_op *po)
+// scan for 'reg' pop backwards starting from exits (all paths)
+static int scan_for_pop_ret(int i, int opcnt, int reg, int set_flags)
 {
-  int mask;
+  static int exits[MAX_EXITS];
+  static int exit_count;
+  int j, ret;
 
-  if ((po->flags & OPF_RMD) || !(po->flags & OPF_DATA))
-    return 0;
-
-  if (opr->type == OPT_REG) {
-    if (po->op == OP_CALL) {
-      mask = (1 << xAX) | (1 << xCX) | (1 << xDX);
-      if ((1 << opr->reg) & mask)
-        return 1;
-      else
-        return 0;
-    }
+  if (!set_flags) {
+    exit_count = 0;
+    find_reachable_exits(i, opcnt, i + opcnt * 15, exits,
+      &exit_count);
+    ferr_assert(&ops[i], exit_count > 0);
+  }
 
-    if (po->operand[0].type == OPT_REG) {
-      if (po->regmask_dst & (1 << opr->reg))
-        return 1;
-      else
-        return 0;
-    }
+  for (j = 0; j < exit_count; j++) {
+    ret = scan_for_rsave_pop_reg(exits[j], i + opcnt * 16 + set_flags,
+            reg, set_flags);
+    if (ret == -1)
+      return -1;
   }
 
-  return IS(po->operand[0].name, opr->name);
+  return 1;
 }
 
-// is any operand of parsed_op 'po_test' modified by parsed_op 'po'?
-static int is_any_opr_modified(const struct parsed_op *po_test,
-  const struct parsed_op *po, int c_mode)
+// scan for one or more pop of push <const>
+static int scan_for_pop_const_r(int i, int opcnt, int magic,
+  int push_i, int is_probe)
 {
-  int mask;
-  int i;
+  struct parsed_op *po;
+  struct label_ref *lr;
+  int ret = 0;
+  int j;
 
-  if ((po->flags & OPF_RMD) || !(po->flags & OPF_DATA))
-    return 0;
+  for (; i < opcnt; i++)
+  {
+    po = &ops[i];
+    if (po->cc_scratch == magic)
+      return ret; // already checked
+    po->cc_scratch = magic;
 
-  if (po_test->operand_cnt == 1 && po_test->operand[0].type == OPT_CONST)
-    return 0;
+    if (po->flags & OPF_JMP) {
+      if (po->flags & OPF_RMD)
+        continue;
+      if (po->op == OP_CALL)
+        return -1;
 
-  if ((po_test->regmask_src | po_test->regmask_dst) & po->regmask_dst)
-    return 1;
+      if (po->btj != NULL) {
+        for (j = 0; j < po->btj->count; j++) {
+          check_i(po, po->btj->d[j].bt_i);
+          ret |= scan_for_pop_const_r(po->btj->d[j].bt_i, opcnt, magic,
+                  push_i, is_probe);
+          if (ret < 0)
+            return ret;
+        }
+        return ret;
+      }
+
+      check_i(po, po->bt_i);
+      if (po->flags & OPF_CJMP) {
+        ret |= scan_for_pop_const_r(po->bt_i, opcnt, magic, push_i,
+                 is_probe);
+        if (ret < 0)
+          return ret;
+      }
+      else {
+        i = po->bt_i - 1;
+      }
+      continue;
+    }
+
+    if ((po->flags & (OPF_TAIL|OPF_RSAVE)) || po->op == OP_PUSH)
+      return -1;
+
+    if (g_labels[i] != NULL) {
+      // all refs must be visited
+      lr = &g_label_refs[i];
+      for (; lr != NULL; lr = lr->next) {
+        check_i(po, lr->i);
+        if (ops[lr->i].cc_scratch != magic)
+          return -1;
+      }
+      if (i > 0 && !LAST_OP(i - 1) && ops[i - 1].cc_scratch != magic)
+        return -1;
+    }
+
+    if (po->op == OP_POP)
+    {
+      if (po->flags & (OPF_RMD|OPF_DONE))
+        return -1;
+
+      if (!is_probe) {
+        po->flags |= OPF_DONE;
+        po->datap = &ops[push_i];
+      }
+      return 1;
+    }
+  }
+
+  return -1;
+}
+
+static void scan_for_pop_const(int i, int opcnt, int magic)
+{
+  int ret;
+
+  ret = scan_for_pop_const_r(i + 1, opcnt, magic, i, 1);
+  if (ret == 1) {
+    ops[i].flags |= OPF_RMD | OPF_DONE;
+    scan_for_pop_const_r(i + 1, opcnt, magic + 1, i, 0);
+  }
+}
+
+// check if all branch targets within a marked path are also marked
+// note: the path checked must not be empty or end with a branch
+static int check_path_branches(int opcnt, int magic)
+{
+  struct parsed_op *po;
+  int i, j;
+
+  for (i = 0; i < opcnt; i++) {
+    po = &ops[i];
+    if (po->cc_scratch != magic)
+      continue;
+
+    if (po->flags & OPF_JMP) {
+      if ((po->flags & OPF_RMD) || po->op == OP_CALL)
+        continue;
+
+      if (po->btj != NULL) {
+        for (j = 0; j < po->btj->count; j++) {
+          check_i(po, po->btj->d[j].bt_i);
+          if (ops[po->btj->d[j].bt_i].cc_scratch != magic)
+            return 0;
+        }
+      }
+
+      check_i(po, po->bt_i);
+      if (ops[po->bt_i].cc_scratch != magic)
+        return 0;
+      if ((po->flags & OPF_CJMP) && ops[i + 1].cc_scratch != magic)
+        return 0;
+    }
+  }
+
+  return 1;
+}
+
+// scan for multiple pushes for given pop
+static int scan_pushes_for_pop_r(int i, int magic, int pop_i,
+  int is_probe)
+{
+  int reg = ops[pop_i].operand[0].reg;
+  struct parsed_op *po;
+  struct label_ref *lr;
+  int ret = 0;
+
+  ops[i].cc_scratch = magic;
+
+  while (1)
+  {
+    if (g_labels[i] != NULL) {
+      lr = &g_label_refs[i];
+      for (; lr != NULL; lr = lr->next) {
+        check_i(&ops[i], lr->i);
+        ret |= scan_pushes_for_pop_r(lr->i, magic, pop_i, is_probe);
+        if (ret < 0)
+          return ret;
+      }
+      if (i > 0 && LAST_OP(i - 1))
+        return ret;
+    }
+
+    i--;
+    if (i < 0)
+      break;
+
+    if (ops[i].cc_scratch == magic)
+      return ret;
+    ops[i].cc_scratch = magic;
+
+    po = &ops[i];
+    if (po->op == OP_CALL)
+      return -1;
+    if ((po->flags & (OPF_TAIL|OPF_RSAVE)) || po->op == OP_POP)
+      return -1;
+
+    if (po->op == OP_PUSH)
+    {
+      if (po->datap != NULL)
+        return -1;
+      if (po->operand[0].type == OPT_REG && po->operand[0].reg == reg)
+        // leave this case for reg save/restore handlers
+        return -1;
+
+      if (!is_probe) {
+        po->flags |= OPF_PPUSH | OPF_DONE;
+        po->datap = &ops[pop_i];
+      }
+      return 1;
+    }
+  }
+
+  return -1;
+}
+
+static void scan_pushes_for_pop(int i, int opcnt, int *regmask_pp)
+{
+  int magic = i + opcnt * 14;
+  int ret;
+
+  ret = scan_pushes_for_pop_r(i, magic, i, 1);
+  if (ret == 1) {
+    ret = check_path_branches(opcnt, magic);
+    if (ret == 1) {
+      ops[i].flags |= OPF_PPUSH | OPF_DONE;
+      *regmask_pp |= 1 << ops[i].operand[0].reg;
+      scan_pushes_for_pop_r(i, magic + 1, i, 0);
+    }
+  }
+}
+
+static void scan_propagate_df(int i, int opcnt)
+{
+  struct parsed_op *po = &ops[i];
+  int j;
+
+  for (; i < opcnt; i++) {
+    po = &ops[i];
+    if (po->flags & OPF_DF)
+      return; // already resolved
+    po->flags |= OPF_DF;
+
+    if (po->op == OP_CALL)
+      ferr(po, "call with DF set?\n");
+
+    if (po->flags & OPF_JMP) {
+      if (po->btj != NULL) {
+        // jumptable
+        for (j = 0; j < po->btj->count; j++) {
+          check_i(po, po->btj->d[j].bt_i);
+          scan_propagate_df(po->btj->d[j].bt_i, opcnt);
+        }
+        return;
+      }
+
+      if (po->flags & OPF_RMD)
+        continue;
+      check_i(po, po->bt_i);
+      if (po->flags & OPF_CJMP)
+        scan_propagate_df(po->bt_i, opcnt);
+      else
+        i = po->bt_i - 1;
+      continue;
+    }
+
+    if (po->flags & OPF_TAIL)
+      break;
+
+    if (po->op == OP_CLD) {
+      po->flags |= OPF_RMD | OPF_DONE;
+      return;
+    }
+  }
+
+  ferr(po, "missing DF clear?\n");
+}
+
+// is operand 'opr' referenced by parsed_op 'po'?
+static int is_opr_referenced(const struct parsed_opr *opr,
+  const struct parsed_op *po)
+{
+  int i, mask;
+
+  if (opr->type == OPT_REG) {
+    mask = po->regmask_dst | po->regmask_src;
+    if (po->op == OP_CALL)
+      mask |= (1 << xAX) | (1 << xCX) | (1 << xDX);
+    if ((1 << opr->reg) & mask)
+      return 1;
+    else
+      return 0;
+  }
+
+  for (i = 0; i < po->operand_cnt; i++)
+    if (IS(po->operand[0].name, opr->name))
+      return 1;
+
+  return 0;
+}
+
+// is operand 'opr' read by parsed_op 'po'?
+static int is_opr_read(const struct parsed_opr *opr,
+  const struct parsed_op *po)
+{
+  if (opr->type == OPT_REG) {
+    if (po->regmask_src & (1 << opr->reg))
+      return 1;
+    else
+      return 0;
+  }
+
+  // yes I'm lazy
+  return 0;
+}
+
+// is operand 'opr' modified by parsed_op 'po'?
+static int is_opr_modified(const struct parsed_opr *opr,
+  const struct parsed_op *po)
+{
+  int mask;
+
+  if (opr->type == OPT_REG) {
+    if (po->op == OP_CALL) {
+      mask = po->regmask_dst;
+      mask |= (1 << xAX) | (1 << xCX) | (1 << xDX); // ?
+      if (mask & (1 << opr->reg))
+        return 1;
+      else
+        return 0;
+    }
+
+    if (po->regmask_dst & (1 << opr->reg))
+      return 1;
+    else
+      return 0;
+  }
+
+  return IS(po->operand[0].name, opr->name);
+}
+
+// is any operand of parsed_op 'po_test' modified by parsed_op 'po'?
+static int is_any_opr_modified(const struct parsed_op *po_test,
+  const struct parsed_op *po, int c_mode)
+{
+  int mask;
+  int i;
+
+  if ((po->flags & OPF_RMD) || !(po->flags & OPF_DATA))
+    return 0;
+
+  if (po_test->operand_cnt == 1 && po_test->operand[0].type == OPT_CONST)
+    return 0;
+
+  if ((po_test->regmask_src | po_test->regmask_dst) & po->regmask_dst)
+    return 1;
 
   // in reality, it can wreck any register, but in decompiled C
   // version it can only overwrite eax or edx:eax
@@ -2417,10 +2970,6 @@ static int scan_for_mod_opr0(struct parsed_op *po_test,
   return -1;
 }
 
-#define check_i(po, i) \
-  if ((i) < 0) \
-    ferr(po, "bad " #i ": %d\n", i)
-
 static int scan_for_flag_set(int i, int magic, int *branched,
   int *setters, int *setter_cnt)
 {
@@ -2429,8 +2978,9 @@ static int scan_for_flag_set(int i, int magic, int *branched,
 
   while (i >= 0) {
     if (ops[i].cc_scratch == magic) {
-      ferr(&ops[i], "%s looped\n", __func__);
-      return -1;
+      // is this a problem?
+      //ferr(&ops[i], "%s looped\n", __func__);
+      return 0;
     }
     ops[i].cc_scratch = magic;
 
@@ -2543,10 +3093,16 @@ static void patch_esp_adjust(struct parsed_op *po, int adj)
 static int scan_for_esp_adjust(int i, int opcnt,
   int adj_expect, int *adj, int *is_multipath, int do_update)
 {
+  int adj_expect_unknown = 0;
   struct parsed_op *po;
   int first_pop = -1;
+  int adj_best = 0;
 
   *adj = *is_multipath = 0;
+  if (adj_expect < 0) {
+    adj_expect_unknown = 1;
+    adj_expect = 32 * 4; // enough?
+  }
 
   for (; i < opcnt && *adj < adj_expect; i++) {
     if (g_labels[i] != NULL)
@@ -2586,10 +3142,12 @@ static int scan_for_esp_adjust(int i, int opcnt,
       if (do_update && *adj >= 0) {
         po->flags |= OPF_RMD;
         if (!*is_multipath)
-          po->flags |= OPF_DONE;
+          po->flags |= OPF_DONE | OPF_NOREGS;
       }
 
       *adj += lmod_bytes(po, po->operand[0].lmod);
+      if (*adj > adj_best)
+        adj_best = *adj;
     }
     else if (po->flags & (OPF_JMP|OPF_TAIL)) {
       if (po->op == OP_JMP && po->btj == NULL) {
@@ -2604,12 +3162,15 @@ static int scan_for_esp_adjust(int i, int opcnt,
         break;
       if (po->pp != NULL && po->pp->is_stdcall)
         break;
+      if (adj_expect_unknown && first_pop >= 0)
+        break;
       // assume it's another cdecl call
     }
   }
 
   if (first_pop >= 0) {
-    // probably 'pop ecx' was used..
+    // probably only 'pop ecx' was used
+    *adj = adj_best;
     return first_pop;
   }
 
@@ -2714,7 +3275,8 @@ static const struct parsed_proto *try_recover_pp(
 }
 
 static void scan_for_call_type(int i, const struct parsed_opr *opr,
-  int magic, const struct parsed_proto **pp_found, int *multi)
+  int magic, const struct parsed_proto **pp_found, int *pp_i,
+  int *multi)
 {
   const struct parsed_proto *pp = NULL;
   struct parsed_op *po;
@@ -2727,7 +3289,7 @@ static void scan_for_call_type(int i, const struct parsed_opr *opr,
       lr = &g_label_refs[i];
       for (; lr != NULL; lr = lr->next) {
         check_i(&ops[i], lr->i);
-        scan_for_call_type(lr->i, opr, magic, pp_found, multi);
+        scan_for_call_type(lr->i, opr, magic, pp_found, pp_i, multi);
       }
       if (i > 0 && LAST_OP(i - 1))
         return;
@@ -2760,7 +3322,7 @@ static void scan_for_call_type(int i, const struct parsed_opr *opr,
 
   if (i < 0) {
     // reached the top - can only be an arg-reg
-    if (opr->type != OPT_REG)
+    if (opr->type != OPT_REG || g_func_pp == NULL)
       return;
 
     for (i = 0; i < g_func_pp->argc; i++) {
@@ -2792,24 +3354,237 @@ static void scan_for_call_type(int i, const struct parsed_opr *opr,
     }
     *multi = 1;
   }
-  if (pp != NULL)
+  if (pp != NULL) {
     *pp_found = pp;
+    *pp_i = po - ops;
+  }
+}
+
+static void add_label_ref(struct label_ref *lr, int op_i)
+{
+  struct label_ref *lr_new;
+
+  if (lr->i == -1) {
+    lr->i = op_i;
+    return;
+  }
+
+  lr_new = calloc(1, sizeof(*lr_new));
+  lr_new->i = op_i;
+  lr_new->next = lr->next;
+  lr->next = lr_new;
+}
+
+static struct parsed_data *try_resolve_jumptab(int i, int opcnt)
+{
+  struct parsed_op *po = &ops[i];
+  struct parsed_data *pd;
+  char label[NAMELEN], *p;
+  int len, j, l;
+
+  p = strchr(po->operand[0].name, '[');
+  if (p == NULL)
+    return NULL;
+
+  len = p - po->operand[0].name;
+  strncpy(label, po->operand[0].name, len);
+  label[len] = 0;
+
+  for (j = 0, pd = NULL; j < g_func_pd_cnt; j++) {
+    if (IS(g_func_pd[j].label, label)) {
+      pd = &g_func_pd[j];
+      break;
+    }
+  }
+  if (pd == NULL)
+    //ferr(po, "label '%s' not parsed?\n", label);
+    return NULL;
+
+  if (pd->type != OPT_OFFSET)
+    ferr(po, "label '%s' with non-offset data?\n", label);
+
+  // find all labels, link
+  for (j = 0; j < pd->count; j++) {
+    for (l = 0; l < opcnt; l++) {
+      if (g_labels[l] != NULL && IS(g_labels[l], pd->d[j].u.label)) {
+        add_label_ref(&g_label_refs[l], i);
+        pd->d[j].bt_i = l;
+        break;
+      }
+    }
+  }
+
+  return pd;
+}
+
+static void clear_labels(int count)
+{
+  int i;
+
+  for (i = 0; i < count; i++) {
+    if (g_labels[i] != NULL) {
+      free(g_labels[i]);
+      g_labels[i] = NULL;
+    }
+  }
+}
+
+static int get_pp_arg_regmask_src(const struct parsed_proto *pp)
+{
+  int regmask = 0;
+  int i, reg;
+
+  for (i = 0; i < pp->argc; i++) {
+    if (pp->arg[i].reg != NULL) {
+      reg = char_array_i(regs_r32,
+              ARRAY_SIZE(regs_r32), pp->arg[i].reg);
+      if (reg < 0)
+        ferr(ops, "arg '%s' of func '%s' is not a reg?\n",
+          pp->arg[i].reg, pp->name);
+      regmask |= 1 << reg;
+    }
+  }
+
+  return regmask;
 }
 
-// early check for tail call or branch back
-static int is_like_tailjmp(int j)
-{
-  if (!(ops[j].flags & OPF_JMP))
-    return 0;
+static int get_pp_arg_regmask_dst(const struct parsed_proto *pp)
+{
+  if (strstr(pp->ret_type.name, "int64"))
+    return (1 << xAX) | (1 << xDX);
+  if (IS(pp->ret_type.name, "float")
+   || IS(pp->ret_type.name, "double"))
+  {
+    return mxST0;
+  }
+  if (strcasecmp(pp->ret_type.name, "void") == 0)
+    return 0;
+
+  return mxAX;
+}
+
+static void resolve_branches_parse_calls(int opcnt)
+{
+  static const struct {
+    const char *name;
+    enum op_op op;
+    unsigned int flags;
+    unsigned int regmask_src;
+    unsigned int regmask_dst;
+  } pseudo_ops[] = {
+    { "__ftol", OPP_FTOL, OPF_FPOP, mxST0, mxAX | mxDX },
+  };
+  const struct parsed_proto *pp_c;
+  struct parsed_proto *pp;
+  struct parsed_data *pd;
+  struct parsed_op *po;
+  const char *tmpname;
+  int i, l;
+  int ret;
+
+  for (i = 0; i < opcnt; i++)
+  {
+    po = &ops[i];
+    po->bt_i = -1;
+    po->btj = NULL;
+
+    if (po->op == OP_CALL) {
+      pp = NULL;
+
+      if (po->operand[0].type == OPT_LABEL) {
+        tmpname = opr_name(po, 0);
+        if (IS_START(tmpname, "loc_"))
+          ferr(po, "call to loc_*\n");
+
+        // convert some calls to pseudo-ops
+        for (l = 0; l < ARRAY_SIZE(pseudo_ops); l++) {
+          if (!IS(tmpname, pseudo_ops[l].name))
+            continue;
+
+          po->op = pseudo_ops[l].op;
+          po->operand_cnt = 0;
+          po->regmask_src = pseudo_ops[l].regmask_src;
+          po->regmask_dst = pseudo_ops[l].regmask_dst;
+          po->flags = pseudo_ops[l].flags;
+          po->flags |= po->regmask_dst ? OPF_DATA : 0;
+          break;
+        }
+        if (l < ARRAY_SIZE(pseudo_ops))
+          continue;
+
+        pp_c = proto_parse(g_fhdr, tmpname, g_header_mode);
+        if (!g_header_mode && pp_c == NULL)
+          ferr(po, "proto_parse failed for call '%s'\n", tmpname);
+
+        if (pp_c != NULL) {
+          pp = proto_clone(pp_c);
+          my_assert_not(pp, NULL);
+        }
+      }
+      else if (po->datap != NULL) {
+        pp = calloc(1, sizeof(*pp));
+        my_assert_not(pp, NULL);
+
+        ret = parse_protostr(po->datap, pp);
+        if (ret < 0)
+          ferr(po, "bad protostr supplied: %s\n", (char *)po->datap);
+        free(po->datap);
+        po->datap = NULL;
+      }
+
+      if (pp != NULL) {
+        if (pp->is_fptr)
+          check_func_pp(po, pp, "fptr var call");
+        if (pp->is_noreturn)
+          po->flags |= OPF_TAIL;
+      }
+      po->pp = pp;
+      continue;
+    }
+
+    if (!(po->flags & OPF_JMP) || po->op == OP_RET)
+      continue;
+
+    if (po->operand[0].type == OPT_REGMEM) {
+      pd = try_resolve_jumptab(i, opcnt);
+      if (pd == NULL)
+        goto tailcall;
+
+      po->btj = pd;
+      continue;
+    }
+
+    for (l = 0; l < opcnt; l++) {
+      if (g_labels[l] != NULL
+          && IS(po->operand[0].name, g_labels[l]))
+      {
+        if (l == i + 1 && po->op == OP_JMP) {
+          // yet another alignment type..
+          po->flags |= OPF_RMD|OPF_DONE;
+          break;
+        }
+        add_label_ref(&g_label_refs[l], i);
+        po->bt_i = l;
+        break;
+      }
+    }
+
+    if (po->bt_i != -1 || (po->flags & OPF_RMD))
+      continue;
 
-  if (ops[j].op == OP_JMP && !ops[j].operand[0].had_ds)
-    // probably local branch back..
-    return 1;
-  if (ops[j].op == OP_CALL)
-    // probably noreturn call..
-    return 1;
+    if (po->operand[0].type == OPT_LABEL)
+      // assume tail call
+      goto tailcall;
 
-  return 0;
+    ferr(po, "unhandled branch\n");
+
+tailcall:
+    po->op = OP_CALL;
+    po->flags |= OPF_TAIL;
+    if (i > 0 && ops[i - 1].op == OP_POP)
+      po->flags |= OPF_ATAIL;
+    i--; // reprocess
+  }
 }
 
 static void scan_prologue_epilogue(int opcnt)
@@ -2824,13 +3599,13 @@ static void scan_prologue_epilogue(int opcnt)
       && IS(opr_name(&ops[1], 1), "esp"))
   {
     g_bp_frame = 1;
-    ops[0].flags |= OPF_RMD | OPF_DONE;
-    ops[1].flags |= OPF_RMD | OPF_DONE;
+    ops[0].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS;
+    ops[1].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS;
     i = 2;
 
     if (ops[2].op == OP_SUB && IS(opr_name(&ops[2], 0), "esp")) {
       g_stack_fsz = opr_const(&ops[2], 1);
-      ops[2].flags |= OPF_RMD | OPF_DONE;
+      ops[2].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS;
       i++;
     }
     else {
@@ -2838,7 +3613,7 @@ static void scan_prologue_epilogue(int opcnt)
       i = 2;
       while (ops[i].op == OP_PUSH && IS(opr_name(&ops[i], 0), "ecx")) {
         g_stack_fsz += 4;
-        ops[i].flags |= OPF_RMD | OPF_DONE;
+        ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS;
         ecx_push++;
         i++;
       }
@@ -2849,9 +3624,9 @@ static void scan_prologue_epilogue(int opcnt)
           && IS(opr_name(&ops[i + 1], 0), "__alloca_probe"))
       {
         g_stack_fsz += ops[i].operand[1].val;
-        ops[i].flags |= OPF_RMD | OPF_DONE;
+        ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS;
         i++;
-        ops[i].flags |= OPF_RMD | OPF_DONE;
+        ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS;
         i++;
       }
     }
@@ -2859,40 +3634,52 @@ static void scan_prologue_epilogue(int opcnt)
     found = 0;
     do {
       for (; i < opcnt; i++)
-        if (ops[i].op == OP_RET)
+        if (ops[i].flags & OPF_TAIL)
           break;
       j = i - 1;
       if (i == opcnt && (ops[j].flags & OPF_JMP)) {
-        if (found && is_like_tailjmp(j))
-            break;
+        if (ops[j].bt_i != -1 || ops[j].btj != NULL)
+          break;
+        i--;
         j--;
       }
 
       if ((ops[j].op == OP_POP && IS(opr_name(&ops[j], 0), "ebp"))
           || ops[j].op == OP_LEAVE)
       {
-        ops[j].flags |= OPF_RMD | OPF_DONE;
+        ops[j].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS;
+      }
+      else if (ops[i].op == OP_CALL && ops[i].pp != NULL
+        && ops[i].pp->is_noreturn)
+      {
+        // on noreturn, msvc sometimes cleans stack, sometimes not
+        i++;
+        found = 1;
+        continue;
       }
       else if (!(g_ida_func_attr & IDAFA_NORETURN))
         ferr(&ops[j], "'pop ebp' expected\n");
 
       if (g_stack_fsz != 0) {
-        if (ops[j - 1].op == OP_MOV
+        if (ops[j].op == OP_LEAVE)
+          j--;
+        else if (ops[j].op == OP_POP
+            && ops[j - 1].op == OP_MOV
             && IS(opr_name(&ops[j - 1], 0), "esp")
             && IS(opr_name(&ops[j - 1], 1), "ebp"))
         {
-          ops[j - 1].flags |= OPF_RMD | OPF_DONE;
+          ops[j - 1].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS;
+          j -= 2;
         }
-        else if (ops[j].op != OP_LEAVE
-          && !(g_ida_func_attr & IDAFA_NORETURN))
+        else if (!(g_ida_func_attr & IDAFA_NORETURN))
         {
-          ferr(&ops[j - 1], "esp restore expected\n");
+          ferr(&ops[j], "esp restore expected\n");
         }
 
-        if (ecx_push && ops[j - 2].op == OP_POP
-          && IS(opr_name(&ops[j - 2], 0), "ecx"))
+        if (ecx_push && j >= 0 && ops[j].op == OP_POP
+          && IS(opr_name(&ops[j], 0), "ecx"))
         {
-          ferr(&ops[j - 2], "unexpected ecx pop\n");
+          ferr(&ops[j], "unexpected ecx pop\n");
         }
       }
 
@@ -2900,13 +3687,15 @@ static void scan_prologue_epilogue(int opcnt)
       i++;
     } while (i < opcnt);
 
+    if (!found)
+      ferr(ops, "missing ebp epilogue\n");
     return;
   }
 
   // non-bp frame
   i = 0;
   while (ops[i].op == OP_PUSH && IS(opr_name(&ops[i], 0), "ecx")) {
-    ops[i].flags |= OPF_RMD | OPF_DONE;
+    ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS;
     g_stack_fsz += 4;
     ecx_push++;
     i++;
@@ -2919,7 +3708,7 @@ static void scan_prologue_epilogue(int opcnt)
       && ops[i].operand[1].type == OPT_CONST)
     {
       g_stack_fsz = ops[i].operand[1].val;
-      ops[i].flags |= OPF_RMD | OPF_DONE;
+      ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS;
       esp_sub = 1;
       break;
     }
@@ -2938,7 +3727,7 @@ static void scan_prologue_epilogue(int opcnt)
       while (i > 0 && j > 0) {
         i--;
         if (ops[i].op == OP_PUSH) {
-          ops[i].flags &= ~(OPF_RMD | OPF_DONE);
+          ops[i].flags &= ~(OPF_RMD | OPF_DONE | OPF_NOREGS);
           j--;
         }
       }
@@ -2965,12 +3754,13 @@ static void scan_prologue_epilogue(int opcnt)
     i++;
     do {
       for (; i < opcnt; i++)
-        if (ops[i].op == OP_RET)
+        if (ops[i].flags & OPF_TAIL)
           break;
       j = i - 1;
       if (i == opcnt && (ops[j].flags & OPF_JMP)) {
-        if (found && is_like_tailjmp(j))
-            break;
+        if (ops[j].bt_i != -1 || ops[j].btj != NULL)
+          break;
+        i--;
         j--;
       }
 
@@ -2988,7 +3778,7 @@ static void scan_prologue_epilogue(int opcnt)
           else
             ferr(&ops[j], "'pop ecx' expected\n");
 
-          ops[j].flags |= OPF_RMD | OPF_DONE;
+          ops[j].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS;
           j--;
         }
         if (l != ecx_push)
@@ -3004,23 +3794,27 @@ static void scan_prologue_epilogue(int opcnt)
             || ops[j].operand[1].val != g_stack_fsz)
           ferr(&ops[j], "'add esp' expected\n");
 
-        ops[j].flags |= OPF_RMD | OPF_DONE;
+        ops[j].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS;
         ops[j].operand[1].val = 0; // hack for stack arg scanner
         found = 1;
       }
 
       i++;
     } while (i < opcnt);
+
+    if (!found)
+      ferr(ops, "missing esp epilogue\n");
   }
 }
 
 static const struct parsed_proto *resolve_icall(int i, int opcnt,
-  int *multi_src)
+  int *pp_i, int *multi_src)
 {
   const struct parsed_proto *pp = NULL;
   int search_advice = 0;
 
   *multi_src = 0;
+  *pp_i = -1;
 
   switch (ops[i].operand[0].type) {
   case OPT_REGMEM:
@@ -3032,7 +3826,7 @@ static const struct parsed_proto *resolve_icall(int i, int opcnt,
     // fallthrough
   default:
     scan_for_call_type(i, &ops[i].operand[0], i + opcnt * 9, &pp,
-      multi_src);
+      pp_i, multi_src);
     break;
   }
 
@@ -3040,7 +3834,7 @@ static const struct parsed_proto *resolve_icall(int i, int opcnt,
 }
 
 // find an instruction that changed opr before i op
-// *op_i must be set to -1 by caller
+// *op_i must be set to -1 by the caller
 // *entry is set to 1 if one source is determined to be the caller
 // returns 1 if found, *op_i is then set to origin
 static int resolve_origin(int i, const struct parsed_opr *opr,
@@ -3072,7 +3866,7 @@ static int resolve_origin(int i, const struct parsed_opr *opr,
     }
 
     if (ops[i].cc_scratch == magic)
-      return 0;
+      return ret;
     ops[i].cc_scratch = magic;
 
     if (!(ops[i].flags & OPF_DATA))
@@ -3082,14 +3876,124 @@ static int resolve_origin(int i, const struct parsed_opr *opr,
 
     if (*op_i >= 0) {
       if (*op_i == i)
-        return 1;
+        return ret | 1;
+
       // XXX: could check if the other op does the same
       return -1;
     }
 
+    *op_i = i;
+    return ret | 1;
+  }
+}
+
+// find an instruction that previously referenced opr
+// if multiple results are found - fail
+// *op_i must be set to -1 by the caller
+// returns 1 if found, *op_i is then set to referencer insn
+static int resolve_last_ref(int i, const struct parsed_opr *opr,
+  int magic, int *op_i)
+{
+  struct label_ref *lr;
+  int ret = 0;
+
+  if (ops[i].cc_scratch == magic)
+    return 0;
+  ops[i].cc_scratch = magic;
+
+  while (1) {
+    if (g_labels[i] != NULL) {
+      lr = &g_label_refs[i];
+      for (; lr != NULL; lr = lr->next) {
+        check_i(&ops[i], lr->i);
+        ret |= resolve_last_ref(lr->i, opr, magic, op_i);
+      }
+      if (i > 0 && LAST_OP(i - 1))
+        return ret;
+    }
+
+    i--;
+    if (i < 0)
+      return -1;
+
+    if (ops[i].cc_scratch == magic)
+      return 0;
+    ops[i].cc_scratch = magic;
+
+    if (!is_opr_referenced(opr, &ops[i]))
+      continue;
+
+    if (*op_i >= 0)
+      return -1;
+
+    *op_i = i;
+    return 1;
+  }
+}
+
+// find next instruction that reads opr
+// *op_i must be set to -1 by the caller
+// on return, *op_i is set to first referencer insn
+// returns 1 if exactly 1 referencer is found
+static int find_next_read(int i, int opcnt,
+  const struct parsed_opr *opr, int magic, int *op_i)
+{
+  struct parsed_op *po;
+  int j, ret = 0;
+
+  for (; i < opcnt; i++)
+  {
+    if (ops[i].cc_scratch == magic)
+      return ret;
+    ops[i].cc_scratch = magic;
+
+    po = &ops[i];
+    if ((po->flags & OPF_JMP) && po->op != OP_CALL) {
+      if (po->btj != NULL) {
+        // jumptable
+        for (j = 0; j < po->btj->count; j++) {
+          check_i(po, po->btj->d[j].bt_i);
+          ret |= find_next_read(po->btj->d[j].bt_i, opcnt, opr,
+                   magic, op_i);
+        }
+        return ret;
+      }
+
+      if (po->flags & OPF_RMD)
+        continue;
+      check_i(po, po->bt_i);
+      if (po->flags & OPF_CJMP) {
+        ret |= find_next_read(po->bt_i, opcnt, opr, magic, op_i);
+        if (ret < 0)
+          return ret;
+      }
+      else
+        i = po->bt_i - 1;
+      continue;
+    }
+
+    if (!is_opr_read(opr, po)) {
+      if (is_opr_modified(opr, po)
+        && (po->op == OP_CALL
+         || ((po->flags & OPF_DATA)
+           && po->operand[0].lmod == OPLM_DWORD)))
+      {
+        // it's overwritten
+        return ret;
+      }
+      if (po->flags & OPF_TAIL)
+        return ret;
+      continue;
+    }
+
+    if (*op_i >= 0)
+      return -1;
+
     *op_i = i;
     return 1;
   }
+
+  return 0;
 }
 
 static int try_resolve_const(int i, const struct parsed_opr *opr,
@@ -3118,7 +4022,7 @@ static struct parsed_proto *process_call_early(int i, int opcnt,
   struct parsed_proto *pp;
   int multipath = 0;
   int adj = 0;
-  int ret;
+  int j, ret;
 
   pp = po->pp;
   if (pp == NULL || pp->is_vararg || pp->argc_reg != 0)
@@ -3135,8 +4039,15 @@ static struct parsed_proto *process_call_early(int i, int opcnt,
       return NULL;
     if (multipath)
       return NULL;
-    if (ops[ret].op == OP_POP && adj != 4)
-      return NULL;
+    if (ops[ret].op == OP_POP) {
+      for (j = 1; j < adj / 4; j++) {
+        if (ops[ret + j].op != OP_POP
+          || ops[ret + j].operand[0].reg != xCX)
+        {
+          return NULL;
+        }
+      }
+    }
   }
 
   *adj_i = ret;
@@ -3149,6 +4060,7 @@ static struct parsed_proto *process_call(int i, int opcnt)
   const struct parsed_proto *pp_c;
   struct parsed_proto *pp;
   const char *tmpname;
+  int call_i = -1, ref_i = -1;
   int adj = 0, multipath = 0;
   int ret, arg;
 
@@ -3157,7 +4069,7 @@ static struct parsed_proto *process_call(int i, int opcnt)
   if (pp == NULL)
   {
     // indirect call
-    pp_c = resolve_icall(i, opcnt, &multipath);
+    pp_c = resolve_icall(i, opcnt, &call_i, &multipath);
     if (pp_c != NULL) {
       if (!pp_c->is_func && !pp_c->is_fptr)
         ferr(po, "call to non-func: %s\n", pp_c->name);
@@ -3171,6 +4083,23 @@ static struct parsed_proto *process_call(int i, int opcnt)
       case OPT_REG:
         // we resolved this call and no longer need the register
         po->regmask_src &= ~(1 << po->operand[0].reg);
+
+        if (!multipath && i != call_i && ops[call_i].op == OP_MOV
+          && ops[call_i].operand[1].type == OPT_LABEL)
+        {
+          // no other source users?
+          ret = resolve_last_ref(i, &po->operand[0], i + opcnt * 10,
+                  &ref_i);
+          if (ret == 1 && call_i == ref_i) {
+            // and nothing uses it after us?
+            ref_i = -1;
+            find_next_read(i + 1, opcnt, &po->operand[0],
+              i + opcnt * 11, &ref_i);
+            if (ref_i == -1)
+              // then also don't need the source mov
+              ops[call_i].flags |= OPF_RMD | OPF_NOREGS;
+          }
+        }
         break;
       case OPT_REGMEM:
         pp->is_fptr = 1;
@@ -3185,7 +4114,7 @@ static struct parsed_proto *process_call(int i, int opcnt)
 
       pp->is_fptr = 1;
       ret = scan_for_esp_adjust(i + 1, opcnt,
-              32*4, &adj, &multipath, 0);
+              -1, &adj, &multipath, 0);
       if (ret < 0 || adj < 0) {
         if (!g_allow_regfunc)
           ferr(po, "non-__cdecl indirect call unhandled yet\n");
@@ -3206,9 +4135,11 @@ static struct parsed_proto *process_call(int i, int opcnt)
   // look for and make use of esp adjust
   multipath = 0;
   ret = -1;
-  if (!pp->is_stdcall && pp->argc_stack > 0)
+  if (!pp->is_stdcall && pp->argc_stack > 0) {
+    int adj_expect = pp->is_vararg ? -1 : pp->argc_stack * 4;
     ret = scan_for_esp_adjust(i + 1, opcnt,
-            pp->argc_stack * 4, &adj, &multipath, 0);
+            adj_expect, &adj, &multipath, 0);
+  }
   if (ret >= 0) {
     if (pp->is_vararg) {
       if (adj / 4 < pp->argc_stack) {
@@ -3408,7 +4339,8 @@ static int collect_call_args_r(struct parsed_op *po, int i,
       if (pp->is_unresolved)
         break;
 
-      ferr(po, "arg collect %d/%d hit esp adjust of %d\n",
+      fnote(po, "(this call)\n");
+      ferr(&ops[j], "arg collect %d/%d hit esp adjust of %d\n",
         arg, pp->argc, ops[j].operand[1].val);
     }
     else if (ops[j].op == OP_POP && !(ops[j].flags & OPF_DONE))
@@ -3416,7 +4348,8 @@ static int collect_call_args_r(struct parsed_op *po, int i,
       if (pp->is_unresolved)
         break;
 
-      ferr(po, "arg collect %d/%d hit pop\n", arg, pp->argc);
+      fnote(po, "(this call)\n");
+      ferr(&ops[j], "arg collect %d/%d hit pop\n", arg, pp->argc);
     }
     else if (ops[j].flags & OPF_CJMP)
     {
@@ -3482,25 +4415,31 @@ static int collect_call_args_r(struct parsed_op *po, int i,
       ops[j].flags &= ~OPF_RSAVE;
 
       // check for __VALIST
-      if (!pp->is_unresolved && pp->arg[arg].type.is_va_list) {
+      if (!pp->is_unresolved && g_func_pp != NULL
+        && pp->arg[arg].type.is_va_list)
+      {
         k = -1;
         ret = resolve_origin(j, &ops[j].operand[0],
                 magic + 1, &k, NULL);
         if (ret == 1 && k >= 0)
         {
           if (ops[k].op == OP_LEA) {
+            if (!g_func_pp->is_vararg)
+              ferr(&ops[k], "lea <arg> used, but %s is not vararg?\n",
+                   g_func_pp->name);
+
             snprintf(buf, sizeof(buf), "arg_%X",
               g_func_pp->argc_stack * 4);
-            if (!g_func_pp->is_vararg
-              || strstr(ops[k].operand[1].name, buf))
+            if (strstr(ops[k].operand[1].name, buf)
+             || strstr(ops[k].operand[1].name, "arglist"))
             {
-              ops[k].flags |= OPF_RMD | OPF_DONE;
-              ops[j].flags |= OPF_RMD | OPF_VAPUSH;
+              ops[k].flags |= OPF_RMD | OPF_NOREGS | OPF_DONE;
+              ops[j].flags |= OPF_RMD | OPF_NOREGS | OPF_VAPUSH;
               save_args &= ~(1 << arg);
               reg = -1;
             }
             else
-              ferr(&ops[j], "lea va_list used, but no vararg?\n");
+              ferr(&ops[k], "va_list arg detection failed\n");
           }
           // check for va_list from g_func_pp arg too
           else if (ops[k].op == OP_MOV
@@ -3601,91 +4540,210 @@ static int collect_call_args(struct parsed_op *po, int i,
   return ret;
 }
 
-static void pp_insert_reg_arg(struct parsed_proto *pp, const char *reg)
+static void reg_use_pass(int i, int opcnt, unsigned char *cbits,
+  int regmask_now, int *regmask,
+  int regmask_save_now, int *regmask_save,
+  int *regmask_init, int regmask_arg)
 {
-  int i;
+  struct parsed_op *po;
+  unsigned int mask;
+  int already_saved;
+  int regmask_new;
+  int regmask_op;
+  int flags_set;
+  int ret, reg;
+  int j;
 
-  for (i = 0; i < pp->argc; i++)
-    if (pp->arg[i].reg == NULL)
-      break;
+  for (; i < opcnt; i++)
+  {
+    po = &ops[i];
+    if (cbits[i >> 3] & (1 << (i & 7)))
+      return;
+    cbits[i >> 3] |= (1 << (i & 7));
 
-  if (pp->argc_stack)
-    memmove(&pp->arg[i + 1], &pp->arg[i],
-      sizeof(pp->arg[0]) * pp->argc_stack);
-  memset(&pp->arg[i], 0, sizeof(pp->arg[i]));
-  pp->arg[i].reg = strdup(reg);
-  pp->arg[i].type.name = strdup("int");
-  pp->argc++;
-  pp->argc_reg++;
-}
+    if ((po->flags & OPF_JMP) && po->op != OP_CALL) {
+      if (po->flags & (OPF_RMD|OPF_DONE))
+        continue;
+      if (po->btj != NULL) {
+        for (j = 0; j < po->btj->count; j++) {
+          check_i(po, po->btj->d[j].bt_i);
+          reg_use_pass(po->btj->d[j].bt_i, opcnt, cbits,
+            regmask_now, regmask, regmask_save_now, regmask_save,
+            regmask_init, regmask_arg);
+        }
+        return;
+      }
 
-static void add_label_ref(struct label_ref *lr, int op_i)
-{
-  struct label_ref *lr_new;
+      check_i(po, po->bt_i);
+      if (po->flags & OPF_CJMP)
+        reg_use_pass(po->bt_i, opcnt, cbits,
+          regmask_now, regmask, regmask_save_now, regmask_save,
+          regmask_init, regmask_arg);
+      else
+        i = po->bt_i - 1;
+      continue;
+    }
 
-  if (lr->i == -1) {
-    lr->i = op_i;
-    return;
-  }
+    if (po->op == OP_PUSH && !(po->flags & (OPF_FARG|OPF_DONE))
+      && !g_func_pp->is_userstack
+      && po->operand[0].type == OPT_REG)
+    {
+      reg = po->operand[0].reg;
+      ferr_assert(po, reg >= 0);
 
-  lr_new = calloc(1, sizeof(*lr_new));
-  lr_new->i = op_i;
-  lr_new->next = lr->next;
-  lr->next = lr_new;
-}
+      already_saved = 0;
+      flags_set = OPF_RSAVE | OPF_RMD | OPF_DONE;
+      if (regmask_now & (1 << reg)) {
+        already_saved = regmask_save_now & (1 << reg);
+        flags_set = OPF_RSAVE | OPF_DONE;
+      }
 
-static struct parsed_data *try_resolve_jumptab(int i, int opcnt)
-{
-  struct parsed_op *po = &ops[i];
-  struct parsed_data *pd;
-  char label[NAMELEN], *p;
-  int len, j, l;
+      ret = scan_for_pop(i + 1, opcnt, i + opcnt * 3, reg, 0, 0);
+      if (ret == 1) {
+        scan_for_pop(i + 1, opcnt, i + opcnt * 4, reg, 0, flags_set);
+      }
+      else {
+        ret = scan_for_pop_ret(i + 1, opcnt, po->operand[0].reg, 0);
+        if (ret == 1) {
+          scan_for_pop_ret(i + 1, opcnt, po->operand[0].reg,
+            flags_set);
+        }
+      }
+      if (ret == 1) {
+        ferr_assert(po, !already_saved);
+        po->flags |= flags_set;
 
-  p = strchr(po->operand[0].name, '[');
-  if (p == NULL)
-    return NULL;
+        if (regmask_now & (1 << reg)) {
+          regmask_save_now |= (1 << reg);
+          *regmask_save |= regmask_save_now;
+        }
+        continue;
+      }
+    }
+    else if (po->op == OP_POP && (po->flags & OPF_RSAVE)) {
+      reg = po->operand[0].reg;
+      ferr_assert(po, reg >= 0);
 
-  len = p - po->operand[0].name;
-  strncpy(label, po->operand[0].name, len);
-  label[len] = 0;
+      if (regmask_save_now & (1 << reg))
+        regmask_save_now &= ~(1 << reg);
+      else
+        regmask_now &= ~(1 << reg);
+      continue;
+    }
+    else if (po->op == OP_CALL) {
+      if ((po->regmask_dst & (1 << xAX))
+        && !(po->regmask_dst & (1 << xDX)))
+      {
+        if (po->flags & OPF_TAIL)
+          // don't need eax, will do "return f();" or "f(); return;"
+          po->regmask_dst &= ~(1 << xAX);
+        else {
+          struct parsed_opr opr = OPR_INIT(OPT_REG, OPLM_DWORD, xAX);
+          j = -1;
+          find_next_read(i + 1, opcnt, &opr, i + opcnt * 17, &j);
+          if (j == -1)
+            // not used
+            po->regmask_dst &= ~(1 << xAX);
+        }
+      }
+    }
 
-  for (j = 0, pd = NULL; j < g_func_pd_cnt; j++) {
-    if (IS(g_func_pd[j].label, label)) {
-      pd = &g_func_pd[j];
-      break;
+    if (po->flags & OPF_NOREGS)
+      continue;
+
+    if (po->flags & OPF_FPUSH) {
+      if (regmask_now & mxST1)
+        ferr(po, "TODO: FPUSH on active ST1\n");
+      if (regmask_now & mxST0)
+        po->flags |= OPF_FSHIFT;
+      mask = mxST0 | mxST1;
+      regmask_now = (regmask_now & ~mask) | ((regmask_now & mxST0) << 1);
     }
-  }
-  if (pd == NULL)
-    //ferr(po, "label '%s' not parsed?\n", label);
-    return NULL;
 
-  if (pd->type != OPT_OFFSET)
-    ferr(po, "label '%s' with non-offset data?\n", label);
+    // if incomplete register is used, clear it on init to avoid
+    // later use of uninitialized upper part in some situations
+    if ((po->flags & OPF_DATA) && po->operand[0].type == OPT_REG
+        && po->operand[0].lmod != OPLM_DWORD)
+    {
+      reg = po->operand[0].reg;
+      ferr_assert(po, reg >= 0);
 
-  // find all labels, link
-  for (j = 0; j < pd->count; j++) {
-    for (l = 0; l < opcnt; l++) {
-      if (g_labels[l] != NULL && IS(g_labels[l], pd->d[j].u.label)) {
-        add_label_ref(&g_label_refs[l], i);
-        pd->d[j].bt_i = l;
-        break;
+      if (!(regmask_now & (1 << reg)))
+        *regmask_init |= 1 << reg;
+    }
+
+    regmask_op = po->regmask_src | po->regmask_dst;
+
+    regmask_new = po->regmask_src & ~regmask_now & ~regmask_arg;
+    regmask_new &= ~(1 << xSP);
+    if (g_bp_frame && !(po->flags & OPF_EBP_S))
+      regmask_new &= ~(1 << xBP);
+
+    if (po->op == OP_CALL) {
+      // allow fastcall calls from anywhere, calee may be also sitting
+      // in some fastcall table even when it's not using reg args
+      if (regmask_new & po->regmask_src & (1 << xCX)) {
+        *regmask_init |= (1 << xCX);
+        regmask_now |= (1 << xCX);
+        regmask_new &= ~(1 << xCX);
+      }
+      if (regmask_new & po->regmask_src & (1 << xDX)) {
+        *regmask_init |= (1 << xDX);
+        regmask_now |= (1 << xDX);
+        regmask_new &= ~(1 << xDX);
+      }
+    }
+
+    if (regmask_new != 0)
+      fnote(po, "uninitialized reg mask: %x\n", regmask_new);
+
+    if (regmask_op & (1 << xBP)) {
+      if (g_bp_frame && !(po->flags & OPF_EBP_S)) {
+        if (po->regmask_dst & (1 << xBP))
+          // compiler decided to drop bp frame and use ebp as scratch
+          scan_fwd_set_flags(i + 1, opcnt, i + opcnt * 5, OPF_EBP_S);
+        else
+          regmask_op &= ~(1 << xBP);
       }
     }
+
+    regmask_now |= regmask_op;
+    *regmask |= regmask_now;
+
+    // released regs
+    if (po->flags & OPF_FPOP) {
+      mask = mxST0 | mxST1;
+      if (!(regmask_now & mask))
+        ferr(po, "float pop on empty stack?\n");
+      if (regmask_now & mxST1)
+        po->flags |= OPF_FSHIFT;
+      regmask_now = (regmask_now & ~mask) | ((regmask_now & mxST1) >> 1);
+    }
+
+    if (po->flags & OPF_TAIL) {
+      if (regmask_now & (mxST0 | mxST1))
+        ferr(po, "float regs on tail: %x\n", regmask_now);
+      return;
+    }
   }
-
-  return pd;
 }
 
-static void clear_labels(int count)
+static void pp_insert_reg_arg(struct parsed_proto *pp, const char *reg)
 {
   int i;
 
-  for (i = 0; i < count; i++) {
-    if (g_labels[i] != NULL) {
-      free(g_labels[i]);
-      g_labels[i] = NULL;
-    }
-  }
+  for (i = 0; i < pp->argc; i++)
+    if (pp->arg[i].reg == NULL)
+      break;
+
+  if (pp->argc_stack)
+    memmove(&pp->arg[i + 1], &pp->arg[i],
+      sizeof(pp->arg[0]) * pp->argc_stack);
+  memset(&pp->arg[i], 0, sizeof(pp->arg[i]));
+  pp->arg[i].reg = strdup(reg);
+  pp->arg[i].type.name = strdup("int");
+  pp->argc++;
+  pp->argc_reg++;
 }
 
 static void output_std_flags(FILE *fout, struct parsed_op *po,
@@ -3766,25 +4824,6 @@ static void output_pp(FILE *fout, const struct parsed_proto *pp,
   fprintf(fout, ")");
 }
 
-static int get_pp_arg_regmask(const struct parsed_proto *pp)
-{
-  int regmask = 0;
-  int i, reg;
-
-  for (i = 0; i < pp->argc; i++) {
-    if (pp->arg[i].reg != NULL) {
-      reg = char_array_i(regs_r32,
-              ARRAY_SIZE(regs_r32), pp->arg[i].reg);
-      if (reg < 0)
-        ferr(ops, "arg '%s' of func '%s' is not a reg?\n",
-          pp->arg[i].reg, pp->name);
-      regmask |= 1 << reg;
-    }
-  }
-
-  return regmask;
-}
-
 static char *saved_arg_name(char *buf, size_t buf_size, int grp, int num)
 {
   char buf1[16];
@@ -3804,25 +4843,25 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt)
   struct parsed_op *po, *delayed_flag_op = NULL, *tmp_op;
   struct parsed_opr *last_arith_dst = NULL;
   char buf1[256], buf2[256], buf3[256], cast[64];
-  const struct parsed_proto *pp_c;
   struct parsed_proto *pp, *pp_tmp;
   struct parsed_data *pd;
-  const char *tmpname;
   unsigned int uval;
   int save_arg_vars[MAX_ARG_GRP] = { 0, };
+  unsigned char cbits[MAX_OPS / 8];
   int cond_vars = 0;
   int need_tmp_var = 0;
   int need_tmp64 = 0;
   int had_decl = 0;
   int label_pending = 0;
-  int regmask_save = 0;
-  int regmask_arg = 0;
-  int regmask_now = 0;
-  int regmask_init = 0;
-  int regmask = 0;
+  int regmask_save = 0; // regs saved/restored in this func
+  int regmask_arg;      // regs from this function args (fastcall, etc)
+  int regmask_ret;      // regs needed on ret
+  int regmask_now;      // temp
+  int regmask_init = 0; // regs that need zero initialization
+  int regmask_pp = 0;   // regs used in complex push-pop graph
+  int regmask = 0;      // used regs
   int pfomask = 0;
   int found = 0;
-  int depth = 0;
   int no_output;
   int i, j, l;
   int arg;
@@ -3836,106 +4875,32 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt)
   if (g_func_pp == NULL)
     ferr(ops, "proto_parse failed for '%s'\n", funcn);
 
-  regmask_arg = get_pp_arg_regmask(g_func_pp);
-
-  // pass1:
-  // - handle ebp/esp frame, remove ops related to it
-  scan_prologue_epilogue(opcnt);
-
-  // pass2:
-  // - parse calls with labels
-  // - resolve all branches
-  for (i = 0; i < opcnt; i++)
-  {
-    po = &ops[i];
-    po->bt_i = -1;
-    po->btj = NULL;
-
-    if (po->flags & (OPF_RMD|OPF_DONE))
-      continue;
-
-    if (po->op == OP_CALL) {
-      pp = NULL;
-
-      if (po->operand[0].type == OPT_LABEL) {
-        tmpname = opr_name(po, 0);
-        if (IS_START(tmpname, "loc_"))
-          ferr(po, "call to loc_*\n");
-        pp_c = proto_parse(fhdr, tmpname, 0);
-        if (pp_c == NULL)
-          ferr(po, "proto_parse failed for call '%s'\n", tmpname);
-
-        pp = proto_clone(pp_c);
-        my_assert_not(pp, NULL);
-      }
-      else if (po->datap != NULL) {
-        pp = calloc(1, sizeof(*pp));
-        my_assert_not(pp, NULL);
-
-        ret = parse_protostr(po->datap, pp);
-        if (ret < 0)
-          ferr(po, "bad protostr supplied: %s\n", (char *)po->datap);
-        free(po->datap);
-        po->datap = NULL;
-      }
-
-      if (pp != NULL) {
-        if (pp->is_fptr)
-          check_func_pp(po, pp, "fptr var call");
-        if (pp->is_noreturn)
-          po->flags |= OPF_TAIL;
-      }
-      po->pp = pp;
-      continue;
-    }
-
-    if (!(po->flags & OPF_JMP) || po->op == OP_RET)
-      continue;
-
-    if (po->operand[0].type == OPT_REGMEM) {
-      pd = try_resolve_jumptab(i, opcnt);
-      if (pd == NULL)
-        goto tailcall;
-
-      po->btj = pd;
-      continue;
-    }
+  regmask_arg = get_pp_arg_regmask_src(g_func_pp);
+  regmask_ret = get_pp_arg_regmask_dst(g_func_pp);
 
-    for (l = 0; l < opcnt; l++) {
-      if (g_labels[l] != NULL
-          && IS(po->operand[0].name, g_labels[l]))
-      {
-        if (l == i + 1 && po->op == OP_JMP) {
-          // yet another alignment type..
-          po->flags |= OPF_RMD|OPF_DONE;
-          break;
-        }
-        add_label_ref(&g_label_refs[l], i);
-        po->bt_i = l;
-        break;
+  if (g_func_pp->has_retreg) {
+    for (arg = 0; arg < g_func_pp->argc; arg++) {
+      if (g_func_pp->arg[arg].type.is_retreg) {
+        reg = char_array_i(regs_r32,
+                ARRAY_SIZE(regs_r32), g_func_pp->arg[arg].reg);
+        ferr_assert(ops, reg >= 0);
+        regmask_ret |= 1 << reg;
       }
     }
+  }
 
-    if (po->bt_i != -1 || (po->flags & OPF_RMD))
-      continue;
-
-    if (po->operand[0].type == OPT_LABEL)
-      // assume tail call
-      goto tailcall;
-
-    ferr(po, "unhandled branch\n");
+  // pass1:
+  // - resolve all branches
+  // - parse calls with labels
+  resolve_branches_parse_calls(opcnt);
 
-tailcall:
-    po->op = OP_CALL;
-    po->flags |= OPF_TAIL;
-    if (i > 0 && ops[i - 1].op == OP_POP)
-      po->flags |= OPF_ATAIL;
-    i--; // reprocess
-  }
+  // pass2:
+  // - handle ebp/esp frame, remove ops related to it
+  scan_prologue_epilogue(opcnt);
 
   // pass3:
   // - remove dead labels
-  // - process trivial calls
+  // - set regs needed at ret
   for (i = 0; i < opcnt; i++)
   {
     if (g_labels[i] != NULL && g_label_refs[i].i == -1) {
@@ -3943,6 +4908,14 @@ tailcall:
       g_labels[i] = NULL;
     }
 
+    if (ops[i].op == OP_RET)
+      ops[i].regmask_src |= regmask_ret;
+  }
+
+  // pass4:
+  // - process trivial calls
+  for (i = 0; i < opcnt; i++)
+  {
     po = &ops[i];
     if (po->flags & (OPF_RMD|OPF_DONE))
       continue;
@@ -3960,11 +4933,12 @@ tailcall:
       if (pp != NULL) {
         if (j >= 0) {
           // commit esp adjust
-          ops[j].flags |= OPF_RMD;
           if (ops[j].op != OP_POP)
             patch_esp_adjust(&ops[j], pp->argc_stack * 4);
-          else
-            ops[j].flags |= OPF_DONE;
+          else {
+            for (l = 0; l < pp->argc_stack; l++)
+              ops[j + l].flags |= OPF_DONE | OPF_RMD | OPF_NOREGS;
+          }
         }
 
         if (strstr(pp->ret_type.name, "int64"))
@@ -3975,39 +4949,70 @@ tailcall:
     }
   }
 
-  // pass4:
-  // - process calls
-  // - handle push <const>/pop pairs
+  // pass5:
+  // - process calls, stage 2
+  // - handle some push/pop pairs
+  // - scan for STD/CLD, propagate DF
   for (i = 0; i < opcnt; i++)
   {
     po = &ops[i];
-    if (po->flags & (OPF_RMD|OPF_DONE))
+    if (po->flags & OPF_RMD)
       continue;
 
-    if (po->op == OP_CALL && !(po->flags & OPF_DONE))
+    if (po->op == OP_CALL)
     {
-      pp = process_call(i, opcnt);
+      if (!(po->flags & OPF_DONE)) {
+        pp = process_call(i, opcnt);
 
-      if (!pp->is_unresolved && !(po->flags & OPF_ATAIL)) {
-        // since we know the args, collect them
-        collect_call_args(po, i, pp, &regmask, save_arg_vars,
-          i + opcnt * 2);
+        if (!pp->is_unresolved && !(po->flags & OPF_ATAIL)) {
+          // since we know the args, collect them
+          collect_call_args(po, i, pp, &regmask, save_arg_vars,
+            i + opcnt * 2);
+        }
+        // for unresolved, collect after other passes
       }
 
+      pp = po->pp;
+      ferr_assert(po, pp != NULL);
+
+      po->regmask_src |= get_pp_arg_regmask_src(pp);
+      po->regmask_dst |= get_pp_arg_regmask_dst(pp);
+
+      if (po->regmask_dst & mxST0)
+        po->flags |= OPF_FPUSH;
+
       if (strstr(pp->ret_type.name, "int64"))
         need_tmp64 = 1;
+
+      continue;
     }
-    else if (po->op == OP_PUSH && !(po->flags & OPF_FARG)
+
+    if (po->flags & OPF_DONE)
+      continue;
+
+    if (po->op == OP_PUSH && !(po->flags & OPF_FARG)
       && !(po->flags & OPF_RSAVE) && po->operand[0].type == OPT_CONST)
-        scan_for_pop_const(i, opcnt);
+    {
+      scan_for_pop_const(i, opcnt, i + opcnt * 12);
+    }
+    else if (po->op == OP_POP)
+      scan_pushes_for_pop(i, opcnt, &regmask_pp);
+    else if (po->op == OP_STD) {
+      po->flags |= OPF_DF | OPF_RMD | OPF_DONE;
+      scan_propagate_df(i + 1, opcnt);
+    }
   }
 
-  // pass5:
+  // pass6:
   // - find POPs for PUSHes, rm both
-  // - scan for STD/CLD, propagate DF
   // - scan for all used registers
+  memset(cbits, 0, sizeof(cbits));
+  reg_use_pass(0, opcnt, cbits, 0, &regmask,
+    0, &regmask_save, &regmask_init, regmask_arg);
+
+  // pass7:
   // - find flag set ops for their users
-  // - do unreselved calls
+  // - do unresolved calls
   // - declare indirect functions
   for (i = 0; i < opcnt; i++)
   {
@@ -4015,69 +5020,6 @@ tailcall:
     if (po->flags & (OPF_RMD|OPF_DONE))
       continue;
 
-    if (po->op == OP_PUSH && (po->flags & OPF_RSAVE)) {
-      reg = po->operand[0].reg;
-      if (!(regmask & (1 << reg)))
-        // not a reg save after all, rerun scan_for_pop
-        po->flags &= ~OPF_RSAVE;
-      else
-        regmask_save |= 1 << reg;
-    }
-
-    if (po->op == OP_PUSH && !(po->flags & OPF_FARG)
-      && !(po->flags & OPF_RSAVE) && !g_func_pp->is_userstack)
-    {
-      if (po->operand[0].type == OPT_REG)
-      {
-        reg = po->operand[0].reg;
-        if (reg < 0)
-          ferr(po, "reg not set for push?\n");
-
-        depth = 0;
-        ret = scan_for_pop(i + 1, opcnt,
-                po->operand[0].name, i + opcnt * 3, 0, &depth, 0);
-        if (ret == 1) {
-          if (depth > 1)
-            ferr(po, "too much depth: %d\n", depth);
-
-          po->flags |= OPF_RMD;
-          scan_for_pop(i + 1, opcnt, po->operand[0].name,
-            i + opcnt * 4, 0, &depth, 1);
-          continue;
-        }
-        ret = scan_for_pop_ret(i + 1, opcnt, po->operand[0].name, 0);
-        if (ret == 0) {
-          arg = OPF_RMD;
-          if (regmask & (1 << reg)) {
-            if (regmask_save & (1 << reg))
-              ferr(po, "%s already saved?\n", po->operand[0].name);
-            arg = OPF_RSAVE;
-          }
-          po->flags |= arg;
-          scan_for_pop_ret(i + 1, opcnt, po->operand[0].name, arg);
-          continue;
-        }
-      }
-    }
-
-    if (po->op == OP_STD) {
-      po->flags |= OPF_DF | OPF_RMD | OPF_DONE;
-      scan_propagate_df(i + 1, opcnt);
-    }
-
-    regmask_now = po->regmask_src | po->regmask_dst;
-    if (regmask_now & (1 << xBP)) {
-      if (g_bp_frame && !(po->flags & OPF_EBP_S)) {
-        if (po->regmask_dst & (1 << xBP))
-          // compiler decided to drop bp frame and use ebp as scratch
-          scan_fwd_set_flags(i + 1, opcnt, i + opcnt * 5, OPF_EBP_S);
-        else
-          regmask_now &= ~(1 << xBP);
-      }
-    }
-
-    regmask |= regmask_now;
-
     if (po->flags & OPF_CC)
     {
       int setters[16], cnt = 0, branched = 0;
@@ -4148,8 +5090,7 @@ tailcall:
     else if (po->op == OP_CALL) {
       // note: resolved non-reg calls are OPF_DONE already
       pp = po->pp;
-      if (pp == NULL)
-        ferr(po, "NULL pp\n");
+      ferr_assert(po, pp != NULL);
 
       if (pp->is_unresolved) {
         int regmask_stack = 0;
@@ -4193,19 +5134,6 @@ tailcall:
         if (pp->argc_stack > 0)
           pp->is_stdcall = 1;
       }
-
-      for (arg = 0; arg < pp->argc; arg++) {
-        if (pp->arg[arg].reg != NULL) {
-          reg = char_array_i(regs_r32,
-                  ARRAY_SIZE(regs_r32), pp->arg[arg].reg);
-          if (reg < 0)
-            ferr(ops, "arg '%s' is not a reg?\n", pp->arg[arg].reg);
-          if (!(regmask & (1 << reg))) {
-            regmask_init |= 1 << reg;
-            regmask |= 1 << reg;
-          }
-        }
-      }
     }
     else if (po->op == OP_MOV && po->operand[0].pp != NULL
       && po->operand[1].pp != NULL)
@@ -4226,40 +5154,33 @@ tailcall:
         }
       }
     }
-    else if (po->op == OP_RET && !IS(g_func_pp->ret_type.name, "void"))
-      regmask |= 1 << xAX;
     else if (po->op == OP_DIV || po->op == OP_IDIV) {
-      // 32bit division is common, look for it
-      if (po->op == OP_DIV)
-        ret = scan_for_reg_clear(i, xDX);
-      else
-        ret = scan_for_cdq_edx(i);
-      if (ret >= 0)
-        po->flags |= OPF_32BIT;
+      if (po->operand[0].lmod == OPLM_DWORD) {
+        // 32bit division is common, look for it
+        if (po->op == OP_DIV)
+          ret = scan_for_reg_clear(i, xDX);
+        else
+          ret = scan_for_cdq_edx(i);
+        if (ret >= 0)
+          po->flags |= OPF_32BIT;
+        else
+          need_tmp64 = 1;
+      }
       else
-        need_tmp64 = 1;
+        need_tmp_var = 1;
     }
     else if (po->op == OP_CLD)
       po->flags |= OPF_RMD | OPF_DONE;
-
-    if (po->op == OP_RCL || po->op == OP_RCR || po->op == OP_XCHG) {
-      need_tmp_var = 1;
+    else if (po->op == OPP_FTOL) {
+      struct parsed_opr opr = OPR_INIT(OPT_REG, OPLM_DWORD, xDX);
+      j = -1;
+      find_next_read(i + 1, opcnt, &opr, i + opcnt * 18, &j);
+      if (j == -1)
+        po->flags |= OPF_32BIT;
     }
-  }
-
-  // pass6:
-  // - confirm regmask_save, it might have been reduced
-  if (regmask_save != 0)
-  {
-    regmask_save = 0;
-    for (i = 0; i < opcnt; i++) {
-      po = &ops[i];
-      if (po->flags & OPF_RMD)
-        continue;
 
-      if (po->op == OP_PUSH && (po->flags & OPF_RSAVE))
-        regmask_save |= 1 << po->operand[0].reg;
-    }
+    if (po->op == OP_RCL || po->op == OP_RCR || po->op == OP_XCHG)
+      need_tmp_var = 1;
   }
 
   // output starts here
@@ -4345,8 +5266,14 @@ tailcall:
 
   // declare stack frame, va_arg
   if (g_stack_fsz) {
-    fprintf(fout, "  union { u32 d[%d]; u16 w[%d]; u8 b[%d]; } sf;\n",
-      (g_stack_fsz + 3) / 4, (g_stack_fsz + 1) / 2, g_stack_fsz);
+    fprintf(fout, "  union { u32 d[%d];", (g_stack_fsz + 3) / 4);
+    if (g_func_lmods & (1 << OPLM_WORD))
+      fprintf(fout, " u16 w[%d];", (g_stack_fsz + 1) / 2);
+    if (g_func_lmods & (1 << OPLM_BYTE))
+      fprintf(fout, " u8 b[%d];", g_stack_fsz);
+    if (g_func_lmods & (1 << OPLM_QWORD))
+      fprintf(fout, " double q[%d];", (g_stack_fsz + 7) / 8);
+    fprintf(fout, " } sf;\n");
     had_decl = 1;
   }
 
@@ -4385,6 +5312,7 @@ tailcall:
     }
   }
 
+  // declare normal registers
   regmask_now = regmask & ~regmask_arg;
   regmask_now &= ~(1 << xSP);
   if (regmask_now & 0x00ff) {
@@ -4398,12 +5326,25 @@ tailcall:
       }
     }
   }
-  if (regmask_now & 0xff00) {
-    for (reg = 8; reg < 16; reg++) {
+  // ... mmx
+  if (regmask_now & 0xff00) {
+    for (reg = 8; reg < 16; reg++) {
+      if (regmask_now & (1 << reg)) {
+        fprintf(fout, "  mmxr %s", regs_r32[reg]);
+        if (regmask_init & (1 << reg))
+          fprintf(fout, " = { 0, }");
+        fprintf(fout, ";\n");
+        had_decl = 1;
+      }
+    }
+  }
+  // ... x87
+  if (regmask_now & 0xff0000) {
+    for (reg = 16; reg < 24; reg++) {
       if (regmask_now & (1 << reg)) {
-        fprintf(fout, "  mmxr %s", regs_r32[reg]);
+        fprintf(fout, "  double f_st%d", reg - 16);
         if (regmask_init & (1 << reg))
-          fprintf(fout, " = { 0, }");
+          fprintf(fout, " = 0");
         fprintf(fout, ";\n");
         had_decl = 1;
       }
@@ -4431,6 +5372,16 @@ tailcall:
     }
   }
 
+  // declare push-pop temporaries
+  if (regmask_pp) {
+    for (reg = 0; reg < 8; reg++) {
+      if (regmask_pp & (1 << reg)) {
+        fprintf(fout, "  u32 pp_%s;\n", regs_r32[reg]);
+        had_decl = 1;
+      }
+    }
+  }
+
   if (cond_vars) {
     for (i = 0; i < 8; i++) {
       if (cond_vars & (1 << i)) {
@@ -4540,10 +5491,7 @@ tailcall:
     pfomask = po->pfomask;
 
     if (po->flags & (OPF_REPZ|OPF_REPNZ)) {
-      struct parsed_opr opr = {0,};
-      opr.type = OPT_REG;
-      opr.reg = xCX;
-      opr.lmod = OPLM_DWORD;
+      struct parsed_opr opr = OPR_INIT(OPT_REG, OPLM_DWORD, xCX);
       ret = try_resolve_const(i, &opr, opcnt * 7 + i, &uval);
 
       if (ret != 1 || uval == 0) {
@@ -4635,6 +5583,14 @@ tailcall:
         fprintf(fout, "  %s = ~%s;", buf1, buf1);
         break;
 
+      case OP_XLAT:
+        assert_operand_cnt(2);
+        out_dst_opr(buf1, sizeof(buf1), po, &po->operand[0]);
+        out_src_opr_u32(buf2, sizeof(buf2), po, &po->operand[1]);
+        fprintf(fout, "  %s = *(u8 *)(%s + %s);", buf1, buf2, buf1);
+        strcpy(g_comment, "xlat");
+        break;
+
       case OP_CDQ:
         assert_operand_cnt(2);
         fprintf(fout, "  %s = (s32)%s >> 31;",
@@ -4644,45 +5600,48 @@ tailcall:
         break;
 
       case OP_LODS:
-        assert_operand_cnt(3);
         if (po->flags & OPF_REP) {
+          assert_operand_cnt(3);
           // hmh..
           ferr(po, "TODO\n");
         }
         else {
-          fprintf(fout, "  eax = %sesi; esi %c= %d;",
-            lmod_cast_u_ptr(po, po->operand[0].lmod),
+          assert_operand_cnt(2);
+          fprintf(fout, "  %s = %sesi; esi %c= %d;",
+            out_dst_opr(buf1, sizeof(buf1), po, &po->operand[1]),
+            lmod_cast_u_ptr(po, po->operand[1].lmod),
             (po->flags & OPF_DF) ? '-' : '+',
-            lmod_bytes(po, po->operand[0].lmod));
+            lmod_bytes(po, po->operand[1].lmod));
           strcpy(g_comment, "lods");
         }
         break;
 
       case OP_STOS:
-        assert_operand_cnt(3);
         if (po->flags & OPF_REP) {
+          assert_operand_cnt(3);
           fprintf(fout, "  for (; ecx != 0; ecx--, edi %c= %d)\n",
             (po->flags & OPF_DF) ? '-' : '+',
-            lmod_bytes(po, po->operand[0].lmod));
+            lmod_bytes(po, po->operand[1].lmod));
           fprintf(fout, "    %sedi = eax;",
-            lmod_cast_u_ptr(po, po->operand[0].lmod));
+            lmod_cast_u_ptr(po, po->operand[1].lmod));
           strcpy(g_comment, "rep stos");
         }
         else {
+          assert_operand_cnt(2);
           fprintf(fout, "  %sedi = eax; edi %c= %d;",
-            lmod_cast_u_ptr(po, po->operand[0].lmod),
+            lmod_cast_u_ptr(po, po->operand[1].lmod),
             (po->flags & OPF_DF) ? '-' : '+',
-            lmod_bytes(po, po->operand[0].lmod));
+            lmod_bytes(po, po->operand[1].lmod));
           strcpy(g_comment, "stos");
         }
         break;
 
       case OP_MOVS:
-        assert_operand_cnt(3);
         j = lmod_bytes(po, po->operand[0].lmod);
         strcpy(buf1, lmod_cast_u_ptr(po, po->operand[0].lmod));
         l = (po->flags & OPF_DF) ? '-' : '+';
         if (po->flags & OPF_REP) {
+          assert_operand_cnt(3);
           fprintf(fout,
             "  for (; ecx != 0; ecx--, edi %c= %d, esi %c= %d)\n",
             l, j, l, j);
@@ -4691,6 +5650,7 @@ tailcall:
           strcpy(g_comment, "rep movs");
         }
         else {
+          assert_operand_cnt(2);
           fprintf(fout, "  %sedi = %sesi; edi %c= %d; esi %c= %d;",
             buf1, buf1, l, j, l, j);
           strcpy(g_comment, "movs");
@@ -4699,11 +5659,11 @@ tailcall:
 
       case OP_CMPS:
         // repe ~ repeat while ZF=1
-        assert_operand_cnt(3);
         j = lmod_bytes(po, po->operand[0].lmod);
         strcpy(buf1, lmod_cast_u_ptr(po, po->operand[0].lmod));
         l = (po->flags & OPF_DF) ? '-' : '+';
         if (po->flags & OPF_REP) {
+          assert_operand_cnt(3);
           fprintf(fout,
             "  for (; ecx != 0; ecx--) {\n");
           if (pfomask & (1 << PFO_C)) {
@@ -4724,6 +5684,7 @@ tailcall:
             (po->flags & OPF_REPZ) ? "e" : "ne");
         }
         else {
+          assert_operand_cnt(2);
           fprintf(fout,
             "  cond_z = (%sesi == %sedi); esi %c= %d; edi %c= %d;",
             buf1, buf1, l, j, l, j);
@@ -4737,16 +5698,16 @@ tailcall:
       case OP_SCAS:
         // only does ZF (for now)
         // repe ~ repeat while ZF=1
-        assert_operand_cnt(3);
-        j = lmod_bytes(po, po->operand[0].lmod);
+        j = lmod_bytes(po, po->operand[1].lmod);
         l = (po->flags & OPF_DF) ? '-' : '+';
         if (po->flags & OPF_REP) {
+          assert_operand_cnt(3);
           fprintf(fout,
             "  for (; ecx != 0; ecx--) {\n");
           fprintf(fout,
             "    cond_z = (%seax == %sedi); edi %c= %d;\n",
-              lmod_cast_u(po, po->operand[0].lmod),
-              lmod_cast_u_ptr(po, po->operand[0].lmod), l, j);
+              lmod_cast_u(po, po->operand[1].lmod),
+              lmod_cast_u_ptr(po, po->operand[1].lmod), l, j);
           fprintf(fout,
             "    if (cond_z %s 0) break;\n",
               (po->flags & OPF_REPZ) ? "==" : "!=");
@@ -4756,9 +5717,10 @@ tailcall:
             (po->flags & OPF_REPZ) ? "e" : "ne");
         }
         else {
+          assert_operand_cnt(2);
           fprintf(fout, "  cond_z = (%seax == %sedi); edi %c= %d;",
-              lmod_cast_u(po, po->operand[0].lmod),
-              lmod_cast_u_ptr(po, po->operand[0].lmod), l, j);
+              lmod_cast_u(po, po->operand[1].lmod),
+              lmod_cast_u_ptr(po, po->operand[1].lmod), l, j);
           strcpy(g_comment, "scas");
         }
         pfomask &= ~(1 << PFO_Z);
@@ -4768,9 +5730,20 @@ tailcall:
 
       // arithmetic w/flags
       case OP_AND:
+        if (po->operand[1].type == OPT_CONST && !po->operand[1].val)
+          goto dualop_arith_const;
+        propagate_lmod(po, &po->operand[0], &po->operand[1]);
+        goto dualop_arith;
+
       case OP_OR:
         propagate_lmod(po, &po->operand[0], &po->operand[1]);
-        // fallthrough
+        if (po->operand[1].type == OPT_CONST) {
+          j = lmod_bytes(po, po->operand[0].lmod);
+          if (((1ull << j * 8) - 1) == po->operand[1].val)
+            goto dualop_arith_const;
+        }
+        goto dualop_arith;
+
       dualop_arith:
         assert_operand_cnt(2);
         fprintf(fout, "  %s %s= %s;",
@@ -4782,6 +5755,18 @@ tailcall:
         delayed_flag_op = NULL;
         break;
 
+      dualop_arith_const:
+        // and 0, or ~0 used instead mov
+        assert_operand_cnt(2);
+        fprintf(fout, "  %s = %s;",
+          out_dst_opr(buf1, sizeof(buf1), po, &po->operand[0]),
+          out_src_opr(buf2, sizeof(buf2), po, &po->operand[1],
+           default_cast_to(buf3, sizeof(buf3), &po->operand[0]), 0));
+        output_std_flags(fout, po, &pfomask, buf1);
+        last_arith_dst = &po->operand[0];
+        delayed_flag_op = NULL;
+        break;
+
       case OP_SHL:
       case OP_SHR:
         assert_operand_cnt(2);
@@ -4806,8 +5791,11 @@ tailcall:
             ferr(po, "TODO\n");
           pfomask &= ~(1 << PFO_C);
         }
-        fprintf(fout, "  %s %s= %s;", buf1, op_to_c(po),
+        fprintf(fout, "  %s %s= %s", buf1, op_to_c(po),
             out_src_opr_u32(buf2, sizeof(buf2), po, &po->operand[1]));
+        if (po->operand[1].type != OPT_CONST)
+          fprintf(fout, " & 0x1f");
+        fprintf(fout, ";");
         output_std_flags(fout, po, &pfomask, buf1);
         last_arith_dst = &po->operand[0];
         delayed_flag_op = NULL;
@@ -4824,16 +5812,29 @@ tailcall:
         delayed_flag_op = NULL;
         break;
 
+      case OP_SHLD:
       case OP_SHRD:
         assert_operand_cnt(3);
         propagate_lmod(po, &po->operand[0], &po->operand[1]);
         l = lmod_bytes(po, po->operand[0].lmod) * 8;
-        out_dst_opr(buf1, sizeof(buf1), po, &po->operand[0]);
-        out_src_opr_u32(buf2, sizeof(buf2), po, &po->operand[1]);
         out_src_opr_u32(buf3, sizeof(buf3), po, &po->operand[2]);
-        fprintf(fout, "  %s >>= %s; %s |= %s << (%d - %s);",
-          buf1, buf3, buf1, buf2, l, buf3);
-        strcpy(g_comment, "shrd");
+        if (po->operand[2].type != OPT_CONST) {
+          // no handling for "undefined" case, hopefully not needed
+          snprintf(buf2, sizeof(buf2), "(%s & 0x1f)", buf3);
+          strcpy(buf3, buf2);
+        }
+        out_src_opr_u32(buf2, sizeof(buf2), po, &po->operand[1]);
+        out_dst_opr(buf1, sizeof(buf1), po, &po->operand[0]);
+        if (po->op == OP_SHLD) {
+          fprintf(fout, "  %s <<= %s; %s |= %s >> (%d - %s);",
+            buf1, buf3, buf1, buf2, l, buf3);
+          strcpy(g_comment, "shld");
+        }
+        else {
+          fprintf(fout, "  %s >>= %s; %s |= %s << (%d - %s);",
+            buf1, buf3, buf1, buf2, l, buf3);
+          strcpy(g_comment, "shrd");
+        }
         output_std_flags(fout, po, &pfomask, buf1);
         last_arith_dst = &po->operand[0];
         delayed_flag_op = NULL;
@@ -4923,7 +5924,7 @@ tailcall:
             fprintf(fout, "  cond_c = tmp64 >> 32;\n");
             fprintf(fout, "  %s = (u32)tmp64;",
               out_dst_opr(buf1, sizeof(buf1), po, &po->operand[0]));
-            strcat(g_comment, "add64");
+            strcat(g_comment, " add64");
           }
           else {
             fprintf(fout, "  cond_c = ((u32)%s + %s) >> %d;\n",
@@ -4989,7 +5990,7 @@ tailcall:
         output_std_flags(fout, po, &pfomask, buf1);
         last_arith_dst = &po->operand[0];
         delayed_flag_op = NULL;
-        strcat(g_comment, "bsf");
+        strcat(g_comment, " bsf");
         break;
 
       case OP_DEC:
@@ -5075,34 +6076,51 @@ tailcall:
       case OP_DIV:
       case OP_IDIV:
         assert_operand_cnt(1);
-        if (po->operand[0].lmod != OPLM_DWORD)
-          ferr(po, "unhandled lmod %d\n", po->operand[0].lmod);
-
         out_src_opr_u32(buf1, sizeof(buf1), po, &po->operand[0]);
-        strcpy(buf2, lmod_cast(po, po->operand[0].lmod,
+        strcpy(cast, lmod_cast(po, po->operand[0].lmod,
           po->op == OP_IDIV));
         switch (po->operand[0].lmod) {
         case OPLM_DWORD:
           if (po->flags & OPF_32BIT)
-            snprintf(buf3, sizeof(buf3), "%seax", buf2);
+            snprintf(buf2, sizeof(buf2), "%seax", cast);
           else {
             fprintf(fout, "  tmp64 = ((u64)edx << 32) | eax;\n");
-            snprintf(buf3, sizeof(buf3), "%stmp64",
+            snprintf(buf2, sizeof(buf2), "%stmp64",
               (po->op == OP_IDIV) ? "(s64)" : "");
           }
           if (po->operand[0].type == OPT_REG
             && po->operand[0].reg == xDX)
           {
-            fprintf(fout, "  eax = %s / %s%s;", buf3, buf2, buf1);
-            fprintf(fout, "  edx = %s %% %s%s;\n", buf3, buf2, buf1);
+            fprintf(fout, "  eax = %s / %s%s;\n", buf2, cast, buf1);
+            fprintf(fout, "  edx = %s %% %s%s;", buf2, cast, buf1);
           }
           else {
-            fprintf(fout, "  edx = %s %% %s%s;\n", buf3, buf2, buf1);
-            fprintf(fout, "  eax = %s / %s%s;", buf3, buf2, buf1);
+            fprintf(fout, "  edx = %s %% %s%s;\n", buf2, cast, buf1);
+            fprintf(fout, "  eax = %s / %s%s;", buf2, cast, buf1);
           }
           break;
+        case OPLM_WORD:
+          fprintf(fout, "  tmp = (edx << 16) | (eax & 0xffff);\n");
+          snprintf(buf2, sizeof(buf2), "%stmp",
+            (po->op == OP_IDIV) ? "(s32)" : "");
+          if (po->operand[0].type == OPT_REG
+            && po->operand[0].reg == xDX)
+          {
+            fprintf(fout, "  LOWORD(eax) = %s / %s%s;\n",
+              buf2, cast, buf1);
+            fprintf(fout, "  LOWORD(edx) = %s %% %s%s;",
+              buf2, cast, buf1);
+          }
+          else {
+            fprintf(fout, "  LOWORD(edx) = %s %% %s%s;\n",
+              buf2, cast, buf1);
+            fprintf(fout, "  LOWORD(eax) = %s / %s%s;",
+              buf2, cast, buf1);
+          }
+          strcat(g_comment, " div16");
+          break;
         default:
-          ferr(po, "unhandled division type\n");
+          ferr(po, "unhandled div lmod %d\n", po->operand[0].lmod);
         }
         last_arith_dst = NULL;
         delayed_flag_op = NULL;
@@ -5139,7 +6157,13 @@ tailcall:
       case OP_JECXZ:
         fprintf(fout, "  if (ecx == 0)\n");
         fprintf(fout, "    goto %s;", po->operand[0].name);
-        strcat(g_comment, "jecxz");
+        strcat(g_comment, " jecxz");
+        break;
+
+      case OP_LOOP:
+        fprintf(fout, "  if (--ecx != 0)\n");
+        fprintf(fout, "    goto %s;", po->operand[0].name);
+        strcat(g_comment, " loop");
         break;
 
       case OP_JMP:
@@ -5192,17 +6216,22 @@ tailcall:
         }
         else if (!IS(pp->ret_type.name, "void")) {
           if (po->flags & OPF_TAIL) {
-            if (!IS(g_func_pp->ret_type.name, "void")) {
+            if (regmask_ret & mxAX) {
               fprintf(fout, "return ");
               if (g_func_pp->ret_type.is_ptr != pp->ret_type.is_ptr)
                 fprintf(fout, "(%s)", g_func_pp->ret_type.name);
             }
+            else if (regmask_ret & mxST0)
+              ferr(po, "float tailcall\n");
           }
-          else if (regmask & (1 << xAX)) {
+          else if (po->regmask_dst & mxAX) {
             fprintf(fout, "eax = ");
             if (pp->ret_type.is_ptr)
               fprintf(fout, "(u32)");
           }
+          else if (po->regmask_dst & mxST0) {
+            fprintf(fout, "f_st0 = ");
+          }
         }
 
         if (pp->name[0] == 0)
@@ -5300,21 +6329,22 @@ tailcall:
             ret = 0;
           else if (IS(pp->ret_type.name, "void"))
             ret = 1;
-          else if (IS(g_func_pp->ret_type.name, "void"))
+          else if (!(regmask_ret & (1 << xAX)))
             ret = 1;
           // else already handled as 'return f()'
 
           if (ret) {
-            if (!IS(g_func_pp->ret_type.name, "void")) {
-              ferr(po, "int func -> void func tailcall?\n");
-            }
-            else {
-              fprintf(fout, "\n%sreturn;", buf3);
-              strcat(g_comment, " ^ tailcall");
-            }
+            fprintf(fout, "\n%sreturn;", buf3);
+            strcat(g_comment, " ^ tailcall");
           }
           else
             strcat(g_comment, " tailcall");
+
+          if ((regmask_ret & (1 << xAX))
+            && IS(pp->ret_type.name, "void") && !pp->is_noreturn)
+          {
+            ferr(po, "int func -> void func tailcall?\n");
+          }
         }
         if (pp->is_noreturn)
           strcat(g_comment, " noreturn");
@@ -5340,7 +6370,7 @@ tailcall:
                 g_func_pp->arg[arg].reg, g_func_pp->arg[arg].reg);
         }
  
-        if (IS(g_func_pp->ret_type.name, "void")) {
+        if (!(regmask_ret & (1 << xAX))) {
           if (i != opcnt - 1 || label_pending)
             fprintf(fout, "  return;");
         }
@@ -5370,6 +6400,13 @@ tailcall:
           fprintf(fout, "  s_%s = %s;", buf1, buf1);
           break;
         }
+        else if (po->flags & OPF_PPUSH) {
+          tmp_op = po->datap;
+          ferr_assert(po, tmp_op != NULL);
+          out_dst_opr(buf2, sizeof(buf2), po, &tmp_op->operand[0]);
+          fprintf(fout, "  pp_%s = %s;", buf2, buf1);
+          break;
+        }
         else if (g_func_pp->is_userstack) {
           fprintf(fout, "  *(--esp) = %s;", buf1);
           break;
@@ -5380,15 +6417,20 @@ tailcall:
         break;
 
       case OP_POP:
+        out_dst_opr(buf1, sizeof(buf1), po, &po->operand[0]);
         if (po->flags & OPF_RSAVE) {
-          out_dst_opr(buf1, sizeof(buf1), po, &po->operand[0]);
           fprintf(fout, "  %s = s_%s;", buf1, buf1);
           break;
         }
+        else if (po->flags & OPF_PPUSH) {
+          // push/pop graph / non-const
+          ferr_assert(po, po->datap == NULL);
+          fprintf(fout, "  %s = pp_%s;", buf1, buf1);
+          break;
+        }
         else if (po->datap != NULL) {
           // push/pop pair
           tmp_op = po->datap;
-          out_dst_opr(buf1, sizeof(buf1), po, &po->operand[0]);
           fprintf(fout, "  %s = %s;", buf1,
             out_src_opr(buf2, sizeof(buf2),
               tmp_op, &tmp_op->operand[0],
@@ -5396,8 +6438,7 @@ tailcall:
           break;
         }
         else if (g_func_pp->is_userstack) {
-          fprintf(fout, "  %s = *esp++;",
-            out_dst_opr(buf1, sizeof(buf1), po, &po->operand[0]));
+          fprintf(fout, "  %s = *esp++;", buf1);
           break;
         }
         else
@@ -5408,9 +6449,123 @@ tailcall:
         no_output = 1;
         break;
 
+      // x87
+      case OP_FLD:
+        if (po->flags & OPF_FSHIFT)
+          fprintf(fout, "  f_st1 = f_st0;\n");
+        if (po->operand[0].type == OPT_REG
+          && po->operand[0].reg == xST0)
+        {
+          strcat(g_comment, " fld st");
+          break;
+        }
+        fprintf(fout, "  f_st0 = %s;",
+          out_src_opr_float(buf1, sizeof(buf1), po, &po->operand[0]));
+        strcat(g_comment, " fld");
+        break;
+
+      case OP_FILD:
+        if (po->flags & OPF_FSHIFT)
+          fprintf(fout, "  f_st1 = f_st0;\n");
+        fprintf(fout, "  f_st0 = (double)%s;",
+          out_src_opr(buf1, sizeof(buf1), po, &po->operand[0],
+            lmod_cast(po, po->operand[0].lmod, 1), 0));
+        strcat(g_comment, " fild");
+        break;
+
+      case OP_FLDc:
+        if (po->flags & OPF_FSHIFT)
+          fprintf(fout, "  f_st1 = f_st0;\n");
+        fprintf(fout, "  f_st0 = ");
+        switch (po->operand[0].val) {
+        case X87_CONST_1: fprintf(fout, "1.0;"); break;
+        case X87_CONST_Z: fprintf(fout, "0.0;"); break;
+        default: ferr(po, "TODO\n"); break;
+        }
+        break;
+
+      case OP_FST:
+        if ((po->flags & OPF_FPOP) && po->operand[0].type == OPT_REG
+          && po->operand[0].reg == xST0)
+        {
+          no_output = 1;
+          break;
+        }
+        fprintf(fout, "  %s = f_st0;",
+          out_dst_opr_float(buf1, sizeof(buf1), po, &po->operand[0]));
+        if (po->flags & OPF_FSHIFT)
+          fprintf(fout, "\n  f_st0 = f_st1;");
+        strcat(g_comment, " fst");
+        break;
+
+      case OP_FADD:
+      case OP_FDIV:
+      case OP_FMUL:
+      case OP_FSUB:
+        switch (po->op) {
+        case OP_FADD: j = '+'; break;
+        case OP_FDIV: j = '/'; break;
+        case OP_FMUL: j = '*'; break;
+        case OP_FSUB: j = '-'; break;
+        default: j = 'x'; break;
+        }
+        if (po->flags & OPF_FSHIFT) {
+          fprintf(fout, "  f_st0 = f_st1 %c f_st0;", j);
+        }
+        else {
+          fprintf(fout, "  %s %c= %s;",
+           out_dst_opr_float(buf1, sizeof(buf1), po, &po->operand[0]),
+           j,
+           out_src_opr_float(buf2, sizeof(buf2), po, &po->operand[1]));
+        }
+        break;
+
+      case OP_FDIVR:
+      case OP_FSUBR:
+        if (po->flags & OPF_FSHIFT)
+          snprintf(buf1, sizeof(buf1), "f_st0");
+        else
+          out_dst_opr_float(buf1, sizeof(buf1), po, &po->operand[0]);
+        fprintf(fout, "  %s = %s %c %s;", buf1,
+          out_src_opr_float(buf2, sizeof(buf2), po, &po->operand[1]),
+          po->op == OP_FDIVR ? '/' : '-',
+          out_src_opr_float(buf3, sizeof(buf3), po, &po->operand[0]));
+        break;
+
+      case OP_FIADD:
+      case OP_FIDIV:
+      case OP_FIMUL:
+      case OP_FISUB:
+        switch (po->op) {
+        case OP_FIADD: j = '+'; break;
+        case OP_FIDIV: j = '/'; break;
+        case OP_FIMUL: j = '*'; break;
+        case OP_FISUB: j = '-'; break;
+        default: j = 'x'; break;
+        }
+        fprintf(fout, "  f_st0 %c= (double)%s;", j,
+          out_src_opr(buf1, sizeof(buf1), po, &po->operand[0],
+            lmod_cast(po, po->operand[0].lmod, 1), 0));
+        break;
+
+      case OP_FIDIVR:
+      case OP_FISUBR:
+        fprintf(fout, "  f_st0 = %s %c f_st0;",
+          out_src_opr_float(buf2, sizeof(buf2), po, &po->operand[1]),
+          po->op == OP_FIDIVR ? '/' : '-');
+        break;
+
+      case OPP_FTOL:
+        ferr_assert(po, po->flags & OPF_32BIT);
+        fprintf(fout, "  eax = (s32)f_st0;");
+        if (po->flags & OPF_FSHIFT)
+          fprintf(fout, "\n  f_st0 = f_st1;");
+        strcat(g_comment, " ftol");
+        break;
+
       // mmx
       case OP_EMMS:
-        strcpy(g_comment, "(emms)");
+        strcpy(g_comment, " (emms)");
         break;
 
       default:
@@ -5530,6 +6685,25 @@ static int hg_var_cnt;
 static void output_hdr_fp(FILE *fout, const struct func_prototype *fp,
   int count);
 
+struct func_prototype *hg_fp_add(const char *funcn)
+{
+  struct func_prototype *fp;
+
+  if ((hg_fp_cnt & 0xff) == 0) {
+    hg_fp = realloc(hg_fp, sizeof(hg_fp[0]) * (hg_fp_cnt + 0x100));
+    my_assert_not(hg_fp, NULL);
+    memset(hg_fp + hg_fp_cnt, 0, sizeof(hg_fp[0]) * 0x100);
+  }
+
+  fp = &hg_fp[hg_fp_cnt];
+  snprintf(fp->name, sizeof(fp->name), "%s", funcn);
+  fp->id = hg_fp_cnt;
+  fp->argc_stack = -1;
+  hg_fp_cnt++;
+
+  return fp;
+}
+
 static struct func_proto_dep *hg_fp_find_dep(struct func_prototype *fp,
   const char *name)
 {
@@ -5584,7 +6758,6 @@ static void gen_hdr_dep_pass(int i, int opcnt, unsigned char *cbits,
   struct func_proto_dep *dep;
   struct parsed_op *po;
   int from_caller = 0;
-  int depth;
   int j, l;
   int reg;
   int ret;
@@ -5598,20 +6771,20 @@ static void gen_hdr_dep_pass(int i, int opcnt, unsigned char *cbits,
     po = &ops[i];
 
     if ((po->flags & OPF_JMP) && po->op != OP_CALL) {
+      if (po->flags & OPF_RMD)
+        continue;
+
       if (po->btj != NULL) {
         // jumptable
         for (j = 0; j < po->btj->count; j++) {
+          check_i(po, po->btj->d[j].bt_i);
           gen_hdr_dep_pass(po->btj->d[j].bt_i, opcnt, cbits, fp,
             regmask_save, regmask_dst, regmask_dep, has_ret);
         }
         return;
       }
 
-      if (po->bt_i < 0) {
-        ferr(po, "dead branch\n");
-        return;
-      }
-
+      check_i(po, po->bt_i);
       if (po->flags & OPF_CJMP) {
         gen_hdr_dep_pass(po->bt_i, opcnt, cbits, fp,
           regmask_save, regmask_dst, regmask_dep, has_ret);
@@ -5627,8 +6800,7 @@ static void gen_hdr_dep_pass(int i, int opcnt, unsigned char *cbits,
     else if (po->op == OP_PUSH && po->operand[0].type == OPT_REG)
     {
       reg = po->operand[0].reg;
-      if (reg < 0)
-        ferr(po, "reg not set for push?\n");
+      ferr_assert(po, reg >= 0);
 
       if (po->flags & OPF_RSAVE) {
         regmask_save |= 1 << reg;
@@ -5637,14 +6809,11 @@ static void gen_hdr_dep_pass(int i, int opcnt, unsigned char *cbits,
       if (po->flags & OPF_DONE)
         continue;
 
-      depth = 0;
-      ret = scan_for_pop(i + 1, opcnt,
-              po->operand[0].name, i + opcnt * 2, 0, &depth, 0);
+      ret = scan_for_pop(i + 1, opcnt, i + opcnt * 2, reg, 0, 0);
       if (ret == 1) {
         regmask_save |= 1 << reg;
         po->flags |= OPF_RMD;
-        scan_for_pop(i + 1, opcnt,
-          po->operand[0].name, i + opcnt * 3, 0, &depth, 1);
+        scan_for_pop(i + 1, opcnt, i + opcnt * 3, reg, 0, OPF_RMD);
         continue;
       }
     }
@@ -5667,27 +6836,27 @@ static void gen_hdr_dep_pass(int i, int opcnt, unsigned char *cbits,
       }
     }
 
+    // if has_ret is 0, there is uninitialized eax path,
+    // which means it's most likely void func
     if (*has_ret != 0 && (po->flags & OPF_TAIL)) {
       if (po->op == OP_CALL) {
         j = i;
         ret = 1;
       }
       else {
-        struct parsed_opr opr = { 0, };
-        opr.type = OPT_REG;
-        opr.reg = xAX;
+        struct parsed_opr opr = OPR_INIT(OPT_REG, OPLM_DWORD, xAX);
         j = -1;
         from_caller = 0;
         ret = resolve_origin(i, &opr, i + opcnt * 4, &j, &from_caller);
       }
 
-      if (ret == -1 && from_caller) {
+      if (ret != 1 && from_caller) {
         // unresolved eax - probably void func
         *has_ret = 0;
       }
       else {
-        if (ops[j].op == OP_CALL) {
-          dep = hg_fp_find_dep(fp, po->operand[0].name);
+        if (j >= 0 && ops[j].op == OP_CALL) {
+          dep = hg_fp_find_dep(fp, ops[j].operand[0].name);
           if (dep != NULL)
             dep->ret_dep = 1;
           else
@@ -5723,124 +6892,56 @@ static void gen_hdr(const char *funcn, int opcnt)
   const struct parsed_proto *pp_c;
   struct parsed_proto *pp;
   struct func_prototype *fp;
-  struct parsed_data *pd;
   struct parsed_op *po;
-  const char *tmpname;
   int regmask_dummy = 0;
   int regmask_dep;
   int max_bp_offset = 0;
   int has_ret;
-  int i, j, l, ret;
-
-  if ((hg_fp_cnt & 0xff) == 0) {
-    hg_fp = realloc(hg_fp, sizeof(hg_fp[0]) * (hg_fp_cnt + 0x100));
-    my_assert_not(hg_fp, NULL);
-    memset(hg_fp + hg_fp_cnt, 0, sizeof(hg_fp[0]) * 0x100);
-  }
-
-  fp = &hg_fp[hg_fp_cnt];
-  snprintf(fp->name, sizeof(fp->name), "%s", funcn);
-  fp->id = hg_fp_cnt;
-  fp->argc_stack = -1;
-  hg_fp_cnt++;
+  int i, j, l;
+  int ret;
 
-  // perhaps already in seed header?
-  fp->pp = proto_parse(g_fhdr, funcn, 1);
-  if (fp->pp != NULL) {
-    fp->argc_stack = fp->pp->argc_stack;
-    fp->is_stdcall = fp->pp->is_stdcall;
-    fp->regmask_dep = get_pp_arg_regmask(fp->pp);
-    fp->has_ret = !IS(fp->pp->ret_type.name, "void");
+  pp_c = proto_parse(g_fhdr, funcn, 1);
+  if (pp_c != NULL)
+    // already in seed, will add to hg_fp later
     return;
-  }
+
+  fp = hg_fp_add(funcn);
 
   g_bp_frame = g_sp_frame = g_stack_fsz = 0;
   g_stack_frame_used = 0;
 
   // pass1:
+  // - resolve all branches
+  // - parse calls with labels
+  resolve_branches_parse_calls(opcnt);
+
+  // pass2:
   // - handle ebp/esp frame, remove ops related to it
   scan_prologue_epilogue(opcnt);
 
-  // pass2:
+  // pass3:
+  // - remove dead labels
   // - collect calls
-  // - resolve all branches
   for (i = 0; i < opcnt; i++)
   {
-    po = &ops[i];
-    po->bt_i = -1;
-    po->btj = NULL;
+    if (g_labels[i] != NULL && g_label_refs[i].i == -1) {
+      free(g_labels[i]);
+      g_labels[i] = NULL;
+    }
 
+    po = &ops[i];
     if (po->flags & (OPF_RMD|OPF_DONE))
       continue;
 
     if (po->op == OP_CALL) {
-      tmpname = opr_name(po, 0);
-      pp = NULL;
-      if (po->operand[0].type == OPT_LABEL) {
-        hg_fp_add_dep(fp, tmpname);
-
-        // perhaps a call to already known func?
-        pp_c = proto_parse(g_fhdr, tmpname, 1);
-        if (pp_c != NULL)
-          pp = proto_clone(pp_c);
-      }
-      else if (po->datap != NULL) {
-        pp = calloc(1, sizeof(*pp));
-        my_assert_not(pp, NULL);
-
-        ret = parse_protostr(po->datap, pp);
-        if (ret < 0)
-          ferr(po, "bad protostr supplied: %s\n", (char *)po->datap);
-        free(po->datap);
-        po->datap = NULL;
-      }
-      if (pp != NULL && pp->is_noreturn)
-        po->flags |= OPF_TAIL;
-
-      po->pp = pp;
-      continue;
-    }
-
-    if (!(po->flags & OPF_JMP) || po->op == OP_RET)
-      continue;
-
-    if (po->operand[0].type == OPT_REGMEM) {
-      pd = try_resolve_jumptab(i, opcnt);
-      if (pd == NULL)
-        goto tailcall;
-
-      po->btj = pd;
-      continue;
-    }
-
-    for (l = 0; l < opcnt; l++) {
-      if (g_labels[l] != NULL
-          && IS(po->operand[0].name, g_labels[l]))
-      {
-        add_label_ref(&g_label_refs[l], i);
-        po->bt_i = l;
-        break;
-      }
+      if (po->operand[0].type == OPT_LABEL)
+        hg_fp_add_dep(fp, opr_name(po, 0));
+      else if (po->pp != NULL)
+        hg_fp_add_dep(fp, po->pp->name);
     }
-
-    if (po->bt_i != -1 || (po->flags & OPF_RMD))
-      continue;
-
-    if (po->operand[0].type == OPT_LABEL)
-      // assume tail call
-      goto tailcall;
-
-    ferr(po, "unhandled branch\n");
-
-tailcall:
-    po->op = OP_CALL;
-    po->flags |= OPF_TAIL;
-    if (i > 0 && ops[i - 1].op == OP_POP)
-      po->flags |= OPF_ATAIL;
-    i--; // reprocess
   }
 
-  // pass3:
+  // pass4:
   // - remove dead labels
   // - handle push <const>/pop pairs
   for (i = 0; i < opcnt; i++)
@@ -5855,10 +6956,10 @@ tailcall:
       continue;
 
     if (po->op == OP_PUSH && po->operand[0].type == OPT_CONST)
-      scan_for_pop_const(i, opcnt);
+      scan_for_pop_const(i, opcnt, i + opcnt * 13);
   }
 
-  // pass4:
+  // pass5:
   // - process trivial calls
   for (i = 0; i < opcnt; i++)
   {
@@ -5879,11 +6980,12 @@ tailcall:
       if (pp != NULL) {
         if (j >= 0) {
           // commit esp adjust
-          ops[j].flags |= OPF_RMD;
           if (ops[j].op != OP_POP)
             patch_esp_adjust(&ops[j], pp->argc_stack * 4);
-          else
-            ops[j].flags |= OPF_DONE;
+          else {
+            for (l = 0; l < pp->argc_stack; l++)
+              ops[j + l].flags |= OPF_DONE | OPF_RMD | OPF_NOREGS;
+          }
         }
 
         po->flags |= OPF_DONE;
@@ -5891,7 +6993,7 @@ tailcall:
     }
   }
 
-  // pass5:
+  // pass6:
   // - track saved regs (simple)
   // - process calls
   for (i = 0; i < opcnt; i++)
@@ -5900,16 +7002,17 @@ tailcall:
     if (po->flags & (OPF_RMD|OPF_DONE))
       continue;
 
-    if (po->op == OP_PUSH && po->operand[0].type == OPT_REG)
+    if (po->op == OP_PUSH && po->operand[0].type == OPT_REG
+      && po->operand[0].reg != xCX)
     {
-      ret = scan_for_pop_ret(i + 1, opcnt, po->operand[0].name, 0);
-      if (ret == 0) {
+      ret = scan_for_pop_ret(i + 1, opcnt, po->operand[0].reg, 0);
+      if (ret == 1) {
         // regmask_save |= 1 << po->operand[0].reg; // do it later
         po->flags |= OPF_RSAVE | OPF_RMD | OPF_DONE;
-        scan_for_pop_ret(i + 1, opcnt, po->operand[0].name, OPF_RMD);
+        scan_for_pop_ret(i + 1, opcnt, po->operand[0].reg, OPF_RMD);
       }
     }
-    else if (po->op == OP_CALL && !(po->flags & OPF_DONE))
+    else if (po->op == OP_CALL)
     {
       pp = process_call(i, opcnt);
 
@@ -5921,7 +7024,7 @@ tailcall:
     }
   }
 
-  // pass6
+  // pass7
   memset(cbits, 0, sizeof(cbits));
   regmask_dep = 0;
   has_ret = -1;
@@ -5934,13 +7037,17 @@ tailcall:
     if (cbits[i >> 3] & (1 << (i & 7)))
       continue;
 
+    if (g_labels[i] == NULL && i > 0 && ops[i - 1].op == OP_CALL
+      && ops[i - 1].pp != NULL && ops[i - 1].pp->is_osinc)
+    {
+      // the compiler sometimes still generates code after
+      // noreturn OS functions
+      break;
+    }
     if (ops[i].op != OP_NOP)
       ferr(&ops[i], "unreachable code\n");
   }
 
-  if (has_ret == -1 && (regmask_dep & (1 << xAX)))
-    has_ret = 1;
-
   for (i = 0; i < g_eqcnt; i++) {
     if (g_eqs[i].offset > max_bp_offset && g_eqs[i].offset < 4*32)
       max_bp_offset = g_eqs[i].offset;
@@ -5959,7 +7066,7 @@ tailcall:
   printf("// has_ret %d, regmask_dep %x\n",
     fp->has_ret, fp->regmask_dep);
   output_hdr_fp(stdout, fp, 1);
-  if (IS(funcn, "sub_100073FD")) exit(1);
+  if (IS(funcn, "sub_10007F72")) exit(1);
 #endif
 
   gen_x_cleanup(opcnt);
@@ -5988,7 +7095,7 @@ static void hg_fp_resolve_deps(struct func_prototype *fp)
       // printf("dep %s %s |= %x\n", fp->name,
       //   fp->dep_func[i].name, dep);
 
-      if (fp->has_ret == -1)
+      if (fp->has_ret == -1 && fp->dep_func[i].ret_dep)
         fp->has_ret = fp->dep_func[i].proto->has_ret;
     }
   }
@@ -6108,9 +7215,25 @@ static void output_hdr(FILE *fout)
     [OPLM_QWORD] = "uint64_t",
   };
   const struct scanned_var *var;
+  struct func_prototype *fp;
   char line[256] = { 0, };
+  char name[256];
   int i;
 
+  // add stuff from headers
+  for (i = 0; i < pp_cache_size; i++) {
+    if (pp_cache[i].is_cinc && !pp_cache[i].is_stdcall)
+      snprintf(name, sizeof(name), "_%s", pp_cache[i].name);
+    else
+      snprintf(name, sizeof(name), "%s", pp_cache[i].name);
+    fp = hg_fp_add(name);
+    fp->pp = &pp_cache[i];
+    fp->argc_stack = fp->pp->argc_stack;
+    fp->is_stdcall = fp->pp->is_stdcall;
+    fp->regmask_dep = get_pp_arg_regmask_src(fp->pp);
+    fp->has_ret = !IS(fp->pp->ret_type.name, "void");
+  }
+
   // resolve deps
   qsort(hg_fp, hg_fp_cnt, sizeof(hg_fp[0]), hg_fp_cmp_name);
   for (i = 0; i < hg_fp_cnt; i++)
@@ -6150,30 +7273,6 @@ static void output_hdr(FILE *fout)
     fwrite(line, 1, strlen(line), fout);
 }
 
-// read a line, truncating it if it doesn't fit
-static char *my_fgets(char *s, size_t size, FILE *stream)
-{
-  char *ret, *ret2;
-  char buf[64];
-  int p;
-
-  p = size - 2;
-  if (p >= 0)
-    s[p] = 0;
-
-  ret = fgets(s, size, stream);
-  if (ret != NULL && p >= 0 && s[p] != 0 && s[p] != '\n') {
-    p = sizeof(buf) - 2;
-    do {
-      buf[p] = 0;
-      ret2 = fgets(buf, sizeof(buf), stream);
-    }
-    while (ret2 != NULL && buf[p] != 0 && buf[p] != '\n');
-  }
-
-  return ret;
-}
-
 // '=' needs special treatment
 // also ' quote
 static char *next_word_s(char *w, size_t wsize, char *s)
@@ -6273,6 +7372,11 @@ static void scan_variables(FILE *fasm)
       if (wordc < 2)
         continue;
 
+      if (IS_START(words[0], "__IMPORT_DESCRIPTOR_")) {
+        // when this starts, we don't need anything from this section
+        break;
+      }
+
       if ((hg_var_cnt & 0xff) == 0) {
         hg_vars = realloc(hg_vars, sizeof(hg_vars[0])
                    * (hg_var_cnt + 0x100));
@@ -6670,8 +7774,8 @@ int main(int argc, char *argv[])
           unsigned long addr = strtoul(p, NULL, 16);
           unsigned long f_addr = strtoul(g_func + 4, NULL, 16);
           if (addr > f_addr && !scanned_ahead) {
-            anote("scan_ahead caused by '%s', addr %lx\n",
-              g_func, addr);
+            //anote("scan_ahead caused by '%s', addr %lx\n",
+            //  g_func, addr);
             scan_ahead(fasm);
             scanned_ahead = 1;
             func_chunks_sorted = 0;
@@ -6816,6 +7920,7 @@ do_pending_endp:
         pd->d = NULL;
       }
       g_func_pd_cnt = 0;
+      g_func_lmods = 0;
       pd = NULL;
 
       if (end)