Function at 0x1004c1b2
Capabilities:
Contain obfuscated stackstrings
Delete directory
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008c096
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xfa8
push esi
and dword [ebp - 0x20], 0
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10052b6b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x28], 1
mov dword [ebp - 0xb0], 0
jmp 0x1004c210
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x1004c22c
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x150], 0x8bbca631
jmp 0x1004c203
mov dword [ebp - 0xb0], 0
jmp 0x1004c245
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x1004c261
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0xd30], 0
jmp 0x1004c238
mov dword [ebp - 0x28], 0
jmp 0x1004c271
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jg 0x1004c41c
mov dword [ebp - 0x850], 0x39e071a0
mov dword [ebp - 0x904], 0x30dfddae
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x150]
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x150]
mov dword [ebp - 0xbcc], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x150]
mov dword [ebp - 0xbd4], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp + ecx*4 - 0x150]
cmp dword [ebp + eax*4 - 0x150], ecx
jl 0x1004c2e1
mov dword [ebp - 0x564], 1
jmp 0x1004c2e8
and dword [ebp - 0x564], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x150]
cmp dword [ebp - 0x564], eax
jge 0x1004c309
mov dword [ebp - 0x81c], 1
jmp 0x1004c310
and dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 6
je 0x1004c325
mov dword [ebp - 0x824], 1
jmp 0x1004c32c
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x824]
neg eax
cmp eax, dword [ebp - 0x28]
jge 0x1004c345
mov dword [ebp - 0x82c], 1
jmp 0x1004c34c
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x150]
cmp dword [ebp - 0x82c], eax
jne 0x1004c36a
mov dword [ebp - 0x864], 1
jmp 0x1004c371
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x150]
cmp dword [ebp - 0x864], eax
jne 0x1004c38f
mov dword [ebp - 0x88c], 1
jmp 0x1004c396
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x150]
cmp dword [ebp - 0x88c], eax
jne 0x1004c3b4
mov dword [ebp - 0x894], 1
jmp 0x1004c3bb
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0x850], eax
mov eax, dword [ebp - 0x850]
mov ecx, dword [ebp - 0x28]
add eax, dword [ebp + ecx*4 - 0x150]
jne 0x1004c3e5
mov dword [ebp - 0x838], 1
jmp 0x1004c3ec
and dword [ebp - 0x838], 0
cmp dword [ebp - 0x838], 0xa624cdb8
jne 0x1004c404
mov dword [ebp - 0x428], 1
jmp 0x1004c40b
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x904], eax
jmp 0x1004c26a
mov dword [ebp - 0x28], 0xffffffe6
jmp 0x1004c42c
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x1a
jle 0x1004c6f0
mov dword [ebp - 0xd4], 0xa814b11f
mov dword [ebp - 0xbdc], 0x39bf5bf8
mov dword [ebp - 0x9b8], 0x61e7ff51
mov dword [ebp - 0x358], 0x759f32f5
mov dword [ebp - 0x9c0], 0x231d
mov dword [ebp - 0x294], 0
jmp 0x1004c481
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 3
jge 0x1004c49d
mov eax, dword [ebp - 0x294]
mov dword [ebp + eax*4 - 0xe20], 1
jmp 0x1004c474
mov dword [ebp - 0xd4], 0
jmp 0x1004c4b6
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 1
jg 0x1004c6eb
mov dword [ebp - 0xbe4], 1
mov dword [ebp - 0x9c8], 0xfffffffc
mov dword [ebp - 0x29c], 0
jmp 0x1004c4f0
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 1
jge 0x1004c50c
mov eax, dword [ebp - 0x29c]
mov dword [ebp + eax*4 - 0x430], 0x2097e65f
jmp 0x1004c4e3
mov eax, dword [ebp - 0xd4]
cmp dword [ebp + eax*4 - 0x150], 0
je 0x1004c67a
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xbec], eax
mov eax, dword [ebp - 0x358]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x150]
mov dword [ebp - 0x9a8], eax
mov eax, dword [ebp - 0x358]
dec eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x9a8], 0x7dc4
jne 0x1004c56a
mov dword [ebp - 0x814], 1
jmp 0x1004c571
and dword [ebp - 0x814], 0
cmp dword [ebp - 0x814], 0xb4ab19f8
jne 0x1004c589
mov dword [ebp - 0x668], 1
jmp 0x1004c590
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x668]
add eax, 0x23d3
mov dword [ebp - 0x9b0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9b0]
mov dword [ebp + eax - 0xe20], ecx
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp + eax*4 - 0x150]
mov dword [ebp - 0xbf4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x430], 0
jae 0x1004c5e6
mov dword [ebp - 0x3bc], 1
jmp 0x1004c5ed
and dword [ebp - 0x3bc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3bc]
mov dword [ebp + eax - 0x430], ecx
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp + eax*4 - 0x150]
cmp eax, dword [ebp - 0x3bc]
jne 0x1004c621
mov dword [ebp - 0x788], 1
jmp 0x1004c628
and dword [ebp - 0x788], 0
cmp dword [ebp - 0x788], 1
jae 0x1004c63d
mov dword [ebp - 0x438], 1
jmp 0x1004c644
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x9b8]
cmp dword [ebp - 0x438], eax
je 0x1004c65e
mov dword [ebp - 0x670], 1
jmp 0x1004c665
and dword [ebp - 0x670], 0
cmp dword [ebp - 0x670], 0
je 0x1004c67a
mov dword [ebp - 0x440], 1
jmp 0x1004c681
and dword [ebp - 0x440], 0
cmp dword [ebp - 0x440], 1
jge 0x1004c696
mov dword [ebp - 0x818], 1
jmp 0x1004c69d
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x9c0]
cmp dword [ebp - 0x818], eax
je 0x1004c6b7
mov dword [ebp - 0x448], 1
jmp 0x1004c6be
and dword [ebp - 0x448], 0
cmp dword [ebp - 0x448], 1
jg 0x1004c6d3
mov dword [ebp - 0x678], 1
jmp 0x1004c6da
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x9c8], eax
jmp 0x1004c4a9
jmp 0x1004c425
mov eax, dword [ebp - 0x468]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1004c705
jmp 0x10052b91
mov dword [ebp - 0x1a4], 0x4a4e7fb1
mov dword [ebp - 0x2a8], 0
jmp 0x1004c728
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 4
jge 0x1004c744
mov eax, dword [ebp - 0x2a8]
mov dword [ebp + eax*4 - 0x8c0], 1
jmp 0x1004c71b
mov byte [ebp - 0x11b], 0
movzx eax, byte [ebp - 0x11b]
test eax, eax
je 0x1004c77a
push 0x25d0
push 0
push 0
push 0
push 0
push 0xb15
push 0xdf8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x8c0], 0
jmp 0x1004c7a5
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8c0]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x8c0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x8c0], 7
jne 0x1004cb93
mov dword [ebp - 0x168], 0
mov dword [ebp - 0xae0], 0xfffffffe
mov dword [ebp - 0xadc], 0xfffffffe
mov dword [ebp - 0xad8], 0xfffffffe
mov dword [ebp - 0xad4], 0xfffffffe
mov dword [ebp - 0x50], 0
jmp 0x1004c7fa
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x1004c810
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x8d4], 0x8f8
jmp 0x1004c7f3
mov dword [ebp - 0x50], 0
jmp 0x1004c820
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x1004c836
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xe68], 1
jmp 0x1004c819
mov dword [ebp - 0x50], 0
jmp 0x1004c846
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x1004c85c
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xe80], 0xfffffffc
jmp 0x1004c83f
mov dword [ebp - 0x168], 1
jmp 0x1004c875
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jl 0x1004cb8e
mov dword [ebp - 0x38], 0xd65121ac
mov dword [ebp - 0x38], 1
jmp 0x1004c899
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1004caa1
mov dword [ebp - 0x3c4], 0x7d77fc7d
mov dword [ebp - 0xa40], 0x653649d9
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x8d4]
mov dword [ebp - 0xbfc], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 3
mov eax, dword [ebp + eax - 0x8c0]
mov dword [ebp + ecx - 0xae0], eax
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x8c0]
cmp dword [ebp + eax - 0x8c0], ecx
jne 0x1004c907
mov dword [ebp - 0x450], 1
jmp 0x1004c90e
and dword [ebp - 0x450], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x8c0]
imul eax, dword [ebp - 0x450]
test eax, eax
jne 0x1004c932
mov dword [ebp - 0xa28], 1
jmp 0x1004c939
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xc04], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc0c], eax
cmp dword [ebp - 0x38], 0xcff29c21
jne 0x1004c963
mov dword [ebp - 0x790], 1
jmp 0x1004c96a
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x790]
add eax, 0xc177
jne 0x1004c983
mov dword [ebp - 0x458], 1
jmp 0x1004c98a
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x8d4]
add eax, dword [ebp - 0x458]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0xe68]
mov ecx, dword [ebp - 0x38]
cmp eax, dword [ebp + ecx*4 - 0x8d4]
jne 0x1004c9be
mov dword [ebp - 0xa30], 1
jmp 0x1004c9c5
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x680], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x680]
mov dword [ebp + eax - 0xe80], ecx
cmp dword [ebp - 0x680], 0x8dad
jge 0x1004c9fb
mov dword [ebp - 0xa38], 1
jmp 0x1004ca02
and dword [ebp - 0xa38], 0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xc14], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xae0]
mov dword [ebp - 0xca4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8c0], 0x73c1
je 0x1004ca40
mov dword [ebp - 0x460], 1
jmp 0x1004ca47
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x8d4]
cmp dword [ebp - 0x460], eax
jge 0x1004ca65
mov dword [ebp - 0x860], 1
jmp 0x1004ca6c
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x3c4]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x8c0]
mov dword [ebp - 0xa40], eax
cmp dword [ebp - 0x38], 0
je 0x1004ca9c
jmp 0x1004c892
jmp 0x1004c892
mov dword [ebp - 0x38], 0
jmp 0x1004cab1
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jg 0x1004cb89
mov dword [ebp - 0x2a4], 0x8d58945c
mov dword [ebp - 0x2a4], 0
jmp 0x1004cade
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 1
jg 0x1004cb84
push 0
lea eax, [ebp - 0x1a4]
push eax
push 0x64f7
call fcn.1004b72c
add esp, 0xc
mov dword [ebp - 0x1a4], 0
jmp 0x1004cb1a
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 2
jg 0x1004cb7f
mov dword [ebp - 0x278], 0xfffffffb
mov dword [ebp - 0x278], 0
jmp 0x1004cb46
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 3
jg 0x1004cb7d
mov byte [ebp - 0x11c], 0
lea eax, [ebp - 0x11c]
push eax
push 0x3242
push 0
push 0x7c7
push 0x20ff
push 0x2051
call fcn.1004c04b
add esp, 0x18
jmp 0x1004cb39
jmp 0x1004cb0d
jmp 0x1004cad1
jmp 0x1004caaa
jmp 0x1004c868
jmp 0x1004c78c
mov eax, dword [ebp - 0x468]
mov ecx, dword [ebp - 0x3c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x128], ecx
mov eax, dword [ebp - 0x128]
cmp dword [eax], 0x4550
je 0x1004cbb8
jmp 0x10052b91
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x128]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
cmp dword [eax + 4], 0
jne 0x1004cbd9
jmp 0x10052b91
mov dword [ebp - 0x5c], 0xfb0b0297
mov dword [ebp - 0x470], 0x74b1b055
mov dword [ebp - 0xa4], 0
jmp 0x1004cc03
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x1004cc1f
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x884], 3
jmp 0x1004cbf6
mov dword [ebp - 0xa4], 0
jmp 0x1004cc38
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x1004cc54
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0xafc], 0xfc88eb98
jmp 0x1004cc2b
mov dword [ebp - 0x5c], 2
jmp 0x1004cc64
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x1004cf1d
mov dword [ebp - 0xc4], 0
jmp 0x1004cc87
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jge 0x1004cca3
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x874], 0x114768c0
jmp 0x1004cc7a
mov dword [ebp - 0xc4], 0
jmp 0x1004ccbc
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jge 0x1004ccd8
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0xe5c], 0xffffffff
jmp 0x1004ccaf
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x1004ccf2
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x874], 0
jmp 0x1004cd20
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x874]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x874], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x874], 2
jg 0x1004cf18
mov dword [ebp - 0x28c], 0
jmp 0x1004cd4d
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 4
jge 0x1004cd69
mov eax, dword [ebp - 0x28c]
mov dword [ebp + eax*4 - 0xb38], 0x350d8af
jmp 0x1004cd40
mov eax, dword [ebp - 0x5c]
cmp dword [ebp + eax*4 - 0x884], 0
jne 0x1004cd82
mov dword [ebp - 0x688], 1
jmp 0x1004cd89
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x688]
mov dword [ebp - 0x470], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x470]
mov dword [ebp + eax - 0xafc], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x874]
cmp dword [ebp + eax*4 - 0x884], 6
ja 0x1004cdcb
mov dword [ebp - 0x3cc], 1
jmp 0x1004cdd2
and dword [ebp - 0x3cc], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x3cc]
mov dword [ebp + eax - 0xb38], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x874]
cmp dword [ebp - 0x3cc], eax
jl 0x1004ce13
cmp dword [ebp - 0x5c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x874]
cmp dword [ebp + eax*4 - 0x884], 0
mov eax, dword [ebp - 0x5c]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x884]
test eax, eax
jne 0x1004ce41
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb38], 0
jne 0x1004ce41
and dword [ebp - 0xa48], 0
jmp 0x1004ce4b
mov dword [ebp - 0xa48], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x874]
mov dword [ebp - 0xcac], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb38]
neg eax
mov ecx, dword [ebp - 0x5c]
cmp eax, dword [ebp + ecx*4 - 0x884]
jl 0x1004ce85
mov dword [ebp - 0x798], 1
jmp 0x1004ce8c
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x798]
sub eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x5c]
cmp eax, dword [ebp + ecx*4 - 0x884]
jl 0x1004cead
mov dword [ebp - 0x478], 1
jmp 0x1004ceb4
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x884]
add eax, dword [ebp - 0x478]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xe5c], eax
mov eax, dword [ebp - 0x5c]
cmp dword [ebp + eax*4 - 0x884], 0
jne 0x1004cef6
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xb38], 0
jne 0x1004cef6
and dword [ebp - 0x690], 0
jmp 0x1004cf00
mov dword [ebp - 0x690], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x690]
mov dword [ebp + eax - 0xafc], ecx
jmp 0x1004cd05
jmp 0x1004cc5d
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5c]
mov dword [ebp + eax - 0xafc], ecx
and dword [ebp - 0x34], 0
push 1
push 0x4418
call fcn.1004af96
pop ecx
pop ecx
mov eax, dword [ebp - 0x128]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x128]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x164], eax
and dword [ebp - 0x3d4], 0
jmp 0x1004cf7e
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0x164]
add eax, 0x28
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x128]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x3d4], eax
jge 0x1004d009
mov eax, dword [ebp - 0x164]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x480]
jb 0x1004d004
mov eax, dword [ebp - 0x128]
push dword [eax + 0x38]
mov eax, dword [ebp - 0x164]
push dword [eax + 8]
call fcn.1004af67
pop ecx
pop ecx
add eax, dword [ebp - 0x480]
mov dword [ebp - 0xa50], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xa50]
jae 0x1004d004
push 0x5ff4
push 0x6bc5
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x2121
push 0
call fcn.1004b300
add esp, 0x18
jmp 0x1004d009
jmp 0x1004cf62
mov dword [ebp - 0xe8], 0xf6af1124
mov dword [ebp - 0x41c], 0xffffffff
mov dword [ebp - 0x418], 0xffffffff
mov dword [ebp - 0x414], 0xffffffff
mov dword [ebp - 0x410], 0xffffffff
mov dword [ebp - 0x280], 0xfffffffd
mov dword [ebp - 0x408], 0
mov dword [ebp - 0x7b8], 0xd1e93126
mov dword [ebp - 0x500], 0x50a8e066
mov dword [ebp - 0xe8], 0
jmp 0x1004d07c
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x1a
jg 0x1004d911
mov dword [ebp - 0xac], 0x603fa75c
mov dword [ebp - 0xf0], 0x9a22db78
mov dword [ebp - 0xf8], 6
mov dword [ebp - 0x170], 0xba8b
mov dword [ebp - 0x508], 0x1c63
mov dword [ebp - 0x360], 0xfffffffc
mov dword [ebp - 0x3b0], 0xfffffffb
mov dword [ebp - 0x90c], 0x501d8dd5
mov dword [ebp - 0xac], 0
jmp 0x1004d0f2
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xffffffe3
jge 0x1004d714
mov dword [ebp - 0x1ac], 0xfffffffe
mov dword [ebp - 0x8b0], 0xfffffff9
mov dword [ebp - 0x8ac], 0xfffffff9
mov dword [ebp - 0x8a8], 0xfffffff9
mov dword [ebp - 0x8a4], 0xfffffff9
mov dword [ebp - 0x1f4], 0xfffffffd
mov dword [ebp - 0x4e0], 0x5315
mov dword [ebp - 0x6c0], 0x5532cf2d
mov dword [ebp - 0x1ec], 0
jmp 0x1004d168
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 2
jge 0x1004d184
mov eax, dword [ebp - 0x1ec]
mov dword [ebp + eax*4 - 0x8dc], 0xfffffff7
jmp 0x1004d15b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x8dc], 0xffffffff
jmp 0x1004d1b2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8dc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x8dc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8dc], 4
jle 0x1004d6f2
mov dword [ebp - 0x9a0], 0x672d
mov dword [ebp - 0x4b0], 0xee676845
mov dword [ebp - 0xa70], 5
mov dword [ebp - 0xa80], 8
mov dword [ebp - 0x8fc], 1
mov dword [ebp - 0xcb4], 0
mov dword [ebp - 0x4d0], 0xfffffff9
mov dword [ebp - 0x250], 0
jmp 0x1004d225
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 2
jge 0x1004d241
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0xc20], 0x30bd
jmp 0x1004d218
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0xe8], eax
jne 0x1004d268
mov dword [ebp - 0xa68], 1
jmp 0x1004d26f
and dword [ebp - 0xa68], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x8b0]
cmp dword [ebp + eax - 0x41c], ecx
jge 0x1004d3fc
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x8b0], 0xc0266d99
ja 0x1004d2b9
mov dword [ebp - 0x820], 1
jmp 0x1004d2c0
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0xf0]
cmp eax, dword [ebp - 0x820]
je 0x1004d2da
mov dword [ebp - 0x488], 1
jmp 0x1004d2e1
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x488], eax
jg 0x1004d2fb
mov dword [ebp - 0x698], 1
jmp 0x1004d302
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x698]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x41c]
jge 0x1004d324
mov dword [ebp - 0x490], 1
jmp 0x1004d32b
and dword [ebp - 0x490], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x490]
sub ecx, dword [ebp + eax - 0x8b0]
push 4
pop eax
shl eax, 1
imul ecx, dword [ebp + eax - 0x41c]
cmp ecx, 0xc38
je 0x1004d35f
mov dword [ebp - 0x7a0], 1
jmp 0x1004d366
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x7a0], eax
je 0x1004d380
mov dword [ebp - 0x498], 1
jmp 0x1004d387
and dword [ebp - 0x498], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x41c]
cmp dword [ebp - 0x498], eax
jge 0x1004d3a8
mov dword [ebp - 0x6a0], 1
jmp 0x1004d3af
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x4b0]
cmp dword [ebp - 0x1ac], eax
jle 0x1004d3d5
mov dword [ebp - 0x4a0], 1
jmp 0x1004d3dc
and dword [ebp - 0x4a0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8b0]
cmp dword [ebp - 0x4a0], eax
je 0x1004d3fc
mov dword [ebp - 0x890], 1
jmp 0x1004d403
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x4d0]
cmp dword [ebp - 0x890], eax
jle 0x1004d41d
mov dword [ebp - 0x4a8], 1
jmp 0x1004d424
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0xa70]
cmp dword [ebp - 0x4a8], eax
jl 0x1004d43e
mov dword [ebp - 0xa78], 1
jmp 0x1004d445
and dword [ebp - 0xa78], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xac]
cmp dword [ebp + eax - 0x41c], ecx
jl 0x1004d466
mov dword [ebp - 0x6a8], 1
jmp 0x1004d46d
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x6a8], eax
jg 0x1004d487
mov dword [ebp - 0x7a8], 1
jmp 0x1004d48e
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x4b0]
imul eax, dword [ebp - 0x7a8]
cmp eax, dword [ebp - 0x170]
jne 0x1004d4b5
cmp dword [ebp - 0xf8], 0
jne 0x1004d4b5
and dword [ebp - 0x4b8], 0
jmp 0x1004d4bf
mov dword [ebp - 0x4b8], 1
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0xf0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8b0]
mov dword [ebp - 0x1ac], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8b0]
cmp eax, dword [ebp - 0x1ac]
jge 0x1004d4fe
mov dword [ebp - 0x6b0], 1
jmp 0x1004d505
and dword [ebp - 0x6b0], 0
imul eax, dword [ebp - 0x6b0], 0xffff
mov dword [ebp - 0x4c0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4c0]
mov dword [ebp + eax - 0x8b0], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x41c]
cmp dword [ebp - 0x4c0], eax
jge 0x1004d548
mov dword [ebp - 0x828], 1
jmp 0x1004d54f
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
cmp eax, dword [ebp - 0x828]
je 0x1004d575
mov dword [ebp - 0x4c8], 1
jmp 0x1004d57c
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0xa80]
imul eax, dword [ebp - 0x4c8]
sub eax, dword [ebp - 0x4e0]
jne 0x1004d5a3
mov eax, 0xfaab
test eax, eax
jne 0x1004d5a3
and dword [ebp - 0x6b8], 0
jmp 0x1004d5ad
mov dword [ebp - 0x6b8], 1
mov eax, dword [ebp - 0x6b8]
add eax, 0x937b
cmp eax, dword [ebp - 0x4d0]
jg 0x1004d5cc
mov dword [ebp - 0x7b0], 1
jmp 0x1004d5d3
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0x170]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x41c]
add eax, dword [ebp - 0x1f4]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0xc20]
cmp eax, 0xf1c74f34
je 0x1004d612
mov dword [ebp - 0x4d8], 1
jmp 0x1004d619
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp - 0x280]
cmp dword [ebp - 0x6c0], eax
jl 0x1004d63f
mov dword [ebp - 0xa88], 1
jmp 0x1004d646
and dword [ebp - 0xa88], 0
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0xcbc], eax
mov eax, dword [ebp - 0xac]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x41c]
cmp eax, 1
je 0x1004d675
mov dword [ebp - 0xa5c], 1
jmp 0x1004d67c
and dword [ebp - 0xa5c], 0
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0xcc4], eax
cmp dword [ebp - 0x1ac], 8
jge 0x1004d69d
mov dword [ebp - 0xa4c], 1
jmp 0x1004d6a4
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0x8fc]
mov dword [ebp - 0xccc], eax
cmp dword [ebp - 0x9a0], 0xdfbf
jge 0x1004d6c8
mov dword [ebp - 0x40c], 1
jmp 0x1004d6cf
and dword [ebp - 0x40c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x40c]
mov dword [ebp + eax - 0x41c], ecx
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x408], eax
jmp 0x1004d197
mov byte [ebp - 0x11e], 0
push 0
lea eax, [ebp - 0x11e]
push eax
push 0x598c
call fcn.1004ba63
add esp, 0xc
jmp 0x1004d0e5
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x41c]
mov dword [ebp - 0xcd4], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0xcdc], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xce4], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x408], eax
imul eax, dword [ebp - 0x408], 0
add eax, 0xb730
mov dword [ebp - 0x834], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x834]
mov dword [ebp + eax - 0x41c], ecx
cmp dword [ebp - 0x834], 0
jae 0x1004d784
mov dword [ebp - 0x4e8], 1
jmp 0x1004d78b
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0xac], eax
imul eax, dword [ebp - 0xac], 0xc253
cmp eax, dword [ebp - 0x170]
jg 0x1004d7b5
mov dword [ebp - 0x6c8], 1
jmp 0x1004d7bc
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x360], eax
jge 0x1004d7e2
mov dword [ebp - 0x4f0], 1
jmp 0x1004d7e9
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x7b8], eax
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x7b8], eax
jne 0x1004d81b
mov dword [ebp - 0x4f8], 1
jmp 0x1004d822
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 8
je 0x1004d843
mov dword [ebp - 0x6d0], 1
jmp 0x1004d84a
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0x500], eax
cmp dword [ebp - 0x500], 0
je 0x1004d874
mov eax, 0xffff
test eax, eax
je 0x1004d874
mov dword [ebp - 0x830], 1
jmp 0x1004d87b
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x830]
sub eax, dword [ebp - 0x280]
cmp eax, dword [ebp - 0x508]
je 0x1004d89b
mov dword [ebp - 0x6d8], 1
jmp 0x1004d8a2
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x6d8], eax
jg 0x1004d8bc
mov dword [ebp - 0x9f0], 1
jmp 0x1004d8c3
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0xcec], eax
mov eax, dword [ebp - 0xf8]
add eax, 0x6be8
neg eax
je 0x1004d8f3
cmp dword [ebp - 0x3b0], 0
je 0x1004d8f3
mov dword [ebp - 0x510], 1
jmp 0x1004d8fa
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x280]
add eax, dword [ebp - 0x510]
mov dword [ebp - 0x90c], eax
jmp 0x1004d06f
cmp dword [ebp - 0x34], 0
jne 0x1004d91c
jmp 0x10052b91
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x34]
add ecx, dword [eax]
add ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
call fcn.10034ce5
push eax
call fcn.10074ed8
pop ecx
mov dword [ebp - 0x3f8], 8
mov dword [ebp - 0x3f4], 8
mov dword [ebp - 0x3f0], 8
mov dword [ebp - 0x3ec], 8
mov dword [ebp - 0x368], 0xbbb66efe
mov dword [ebp - 0xa18], 0x467bb1a8
mov dword [ebp - 0x83c], 0x9482
mov dword [ebp - 0x8c], 0
jmp 0x1004d997
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1004d9b3
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x9d4], 0xb5009892
jmp 0x1004d98a
mov dword [ebp - 0x8c], 0
jmp 0x1004d9cc
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x1004d9e8
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xcfc], 0
jmp 0x1004d9bf
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3f8], 0
jmp 0x1004da16
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3f8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3f8], 0x1d
jge 0x1004db20
mov dword [ebp - 0xbc], 0
jmp 0x1004da43
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x1004da5f
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0xc2c], 0x14d2
jmp 0x1004da36
mov dword [ebp - 0xbc], 0
jmp 0x1004da78
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x1004da94
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x180], 0xcefa9d19
jmp 0x1004da6b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x180], 1
jmp 0x1004dac2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x180]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x180], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x180], 0
jl 0x1004db1b
mov dword [ebp - 0x1fc], 0xf38c0887
mov dword [ebp - 0x1fc], 0
jmp 0x1004daf5
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 1
jg 0x1004db19
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x180]
cmp dword [ebp + eax*4 - 0xc2c], 0
je 0x1004db17
jmp 0x1004db19
jmp 0x1004dae8
jmp 0x1004daa7
jmp 0x1004d9fb
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3f8]
mov dword [ebp - 0xd70], eax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0xd78], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
mov dword [ebp - 0xd80], eax
mov eax, dword [ebp - 0xa18]
mov dword [ebp - 0xd88], eax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0xd90], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3f8]
cmp dword [ebp - 0x83c], eax
jne 0x1004db90
mov eax, 0xc3ae5071
test eax, eax
jne 0x1004db90
and dword [ebp - 0x7c0], 0
jmp 0x1004db9a
mov dword [ebp - 0x7c0], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3f8]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x3f8]
cmp eax, dword [ebp - 0x7c0]
jl 0x1004dbc8
mov dword [ebp - 0x914], 1
jmp 0x1004dbcf
and dword [ebp - 0x914], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9d4]
mov dword [ebp - 0xd98], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x9d4]
cmp dword [ebp + eax - 0x3f8], ecx
jne 0x1004dc09
mov dword [ebp - 0x518], 1
jmp 0x1004dc10
and dword [ebp - 0x518], 0
cmp dword [ebp - 0x518], 0x272b
jne 0x1004dc28
mov dword [ebp - 0x6e0], 1
jmp 0x1004dc2f
and dword [ebp - 0x6e0], 0
cmp dword [ebp - 0x6e0], 1
jl 0x1004dc44
mov dword [ebp - 0x520], 1
jmp 0x1004dc4b
and dword [ebp - 0x520], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x520]
mov dword [ebp + eax - 0xcfc], ecx
mov eax, dword [ebp - 0x83c]
mov dword [ebp - 0xda0], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x3f8]
cmp dword [ebp + eax - 0x9d4], ecx
jge 0x1004dc9f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xcfc], 0
jne 0x1004dc9f
and dword [ebp - 0x528], 0
jmp 0x1004dca9
mov dword [ebp - 0x528], 1
cmp dword [ebp - 0x528], 0xeeb4
jl 0x1004dcc1
mov dword [ebp - 0x6e8], 1
jmp 0x1004dcc8
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x368]
add eax, dword [ebp - 0x6e8]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x3f8], eax
mov byte [ebp - 0x2f0], 0
mov byte [ebp - 0x2ef], 0x78
mov byte [ebp - 0x2ee], 0x30
mov byte [ebp - 0x2ed], 0x63
mov byte [ebp - 0x2ec], 0x6f
mov byte [ebp - 0x2eb], 0x1c
mov byte [ebp - 0x2ea], 0x47
mov byte [ebp - 0x2e9], 0x7f
mov byte [ebp - 0x2e8], 0xfe
mov byte [ebp - 0x2e7], 0x4f
mov byte [ebp - 0x2e6], 0xca
mov byte [ebp - 0x2e5], 0x4c
mov byte [ebp - 0x2e4], 0x86
mov byte [ebp - 0x2e3], 7
mov byte [ebp - 0x2e2], 0xf7
mov byte [ebp - 0x2e1], 0x20
mov byte [ebp - 0x2e0], 0xc
mov byte [ebp - 0x2df], 0x57
mov byte [ebp - 0x2de], 0xcf
mov byte [ebp - 0x2dd], 0xed
mov byte [ebp - 0x2dc], 0xfe
mov byte [ebp - 0x2db], 0x44
mov byte [ebp - 0x2da], 0x20
mov byte [ebp - 0x2d9], 0x16
mov byte [ebp - 0x2d8], 0xaf
mov byte [ebp - 0x2d7], 0xdb
mov byte [ebp - 0x2d6], 0x6b
mov byte [ebp - 0x2d5], 0x37
mov byte [ebp - 0x2d4], 0xf
mov byte [ebp - 0x2d3], 0x1a
mov byte [ebp - 0x2d2], 0x28
mov byte [ebp - 0x2d1], 0xfa
mov byte [ebp - 0x2d0], 0xaf
mov byte [ebp - 0x2cf], 0xe3
mov byte [ebp - 0x2ce], 0xd
mov byte [ebp - 0x2cd], 0xd0
mov byte [ebp - 0x2cc], 0xd5
mov byte [ebp - 0x2cb], 0x6b
mov byte [ebp - 0x2ca], 0x35
mov byte [ebp - 0x2c9], 0
mov byte [ebp - 0x2c8], 0x98
mov byte [ebp - 0x2c7], 0x68
mov byte [ebp - 0x2c6], 0xd6
mov byte [ebp - 0x2c5], 0x1c
mov byte [ebp - 0x2c4], 0xcf
mov byte [ebp - 0x2c3], 0x4c
mov byte [ebp - 0x2c2], 0x65
mov byte [ebp - 0x2c1], 0xb5
mov byte [ebp - 0x2c0], 0xe1
mov byte [ebp - 0x2bf], 0x79
mov byte [ebp - 0x2be], 0x41
mov byte [ebp - 0x2bd], 1
mov byte [ebp - 0x2bc], 4
mov byte [ebp - 0x2bb], 7
mov byte [ebp - 0x2ba], 3
mov byte [ebp - 0x2b9], 4
mov byte [ebp - 0x2b8], 0xe
mov byte [ebp - 0x2b7], 5
mov byte [ebp - 0x2b6], 9
mov byte [ebp - 0x2b5], 3
mov byte [ebp - 0x2b4], 6
mov byte [ebp - 0x2b3], 2
mov byte [ebp - 0x2b2], 0
mov byte [ebp - 0x2b1], 6
mov byte [ebp - 0x2b0], 6
mov byte [ebp - 0x2af], 8
mov byte [ebp - 0x2ae], 1
mov byte [ebp - 0x2ad], 9
mov byte [ebp - 0x2ac], 0
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x2f0]
or eax, 0x49
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x2f0]
and ecx, 0x49
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x2f0]
mov byte [ebp + ecx - 0x8cc], al
mov dword [ebp - 0x58], 2
and dword [ebp - 0x258], 0
jmp 0x1004df15
mov eax, dword [ebp - 0x58]
inc eax
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0x45
jae 0x1004dfd4
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x2f0]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x58], eax
jne 0x1004df5f
mov eax, dword [ebp - 0x58]
movzx eax, byte [ebp + eax - 0x2f0]
inc eax
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [ebp + eax - 0x2f0]
mov ecx, dword [ebp - 0x58]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x58], eax
jmp 0x1004df0d
mov eax, dword [ebp - 0x58]
movzx eax, byte [ebp + eax - 0x2ef]
mov ecx, dword [ebp - 0x58]
sub ecx, dword [ebp - 0x258]
movzx ecx, byte [ebp + ecx - 0x2f2]
movsx ecx, byte [ebp + ecx - 0x8cc]
or eax, ecx
mov ecx, dword [ebp - 0x58]
movzx ecx, byte [ebp + ecx - 0x2ef]
mov edx, dword [ebp - 0x58]
sub edx, dword [ebp - 0x258]
movzx edx, byte [ebp + edx - 0x2f2]
movsx edx, byte [ebp + edx - 0x8cc]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x58]
movzx ecx, byte [ebp + ecx - 0x2f0]
mov byte [ebp + ecx - 0x8cc], al
lea eax, [ebp - 0x258]
push eax
push 1
call fcn.1004b1f0
pop ecx
pop ecx
jmp 0x1004df0d
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x8cc], 0
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x68], 0x17
jmp 0x1004dff9
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xf
jle 0x1004e353
mov dword [ebp - 0x17c], 0x34d0069
mov dword [ebp - 0x100], 1
mov dword [ebp - 0x19c], 0x5378470e
mov dword [ebp - 0x298], 1
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x17c], eax
jne 0x1004e045
mov dword [ebp - 0x6f8], 1
jmp 0x1004e04c
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x17c], eax
je 0x1004e063
mov dword [ebp - 0x530], 1
jmp 0x1004e06a
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x530]
jl 0x1004e081
mov dword [ebp - 0x7c8], 1
jmp 0x1004e088
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x7c8], eax
jg 0x1004e09f
mov dword [ebp - 0x538], 1
jmp 0x1004e0a6
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x538], eax
jl 0x1004e0c0
mov dword [ebp - 0x6f0], 1
jmp 0x1004e0c7
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x17c]
add eax, dword [ebp - 0x6f0]
cmp eax, dword [ebp - 0x68]
jle 0x1004e0e4
mov dword [ebp - 0x540], 1
jmp 0x1004e0eb
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
cmp eax, dword [ebp - 0x540]
jl 0x1004e10e
mov dword [ebp - 0x844], 1
jmp 0x1004e115
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x298], eax
jge 0x1004e13b
mov dword [ebp - 0x548], 1
jmp 0x1004e142
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x548]
sub eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x6f8]
lea eax, [ecx + eax - 0xb8a9717]
cmp eax, 0x3e458c45
je 0x1004e346
cmp dword [ebp - 0x68], 0
je 0x1004e346
mov dword [ebp - 0x108], 0x9d1fe905
mov dword [ebp - 0x560], 0x6568c077
mov dword [ebp - 0x100], 2
jmp 0x1004e19d
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0xfffffff4
jge 0x1004e344
mov dword [ebp - 0xa20], 7
mov dword [ebp - 0x3d8], 0x953c5357
mov dword [ebp - 0x204], 0
jmp 0x1004e1d7
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 3
jge 0x1004e1f3
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0xe44], 0x57b06f86
jmp 0x1004e1ca
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xda8], eax
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x19c], eax
jg 0x1004e219
mov dword [ebp - 0x700], 1
jmp 0x1004e220
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x108]
cmp eax, 0xcac2
jg 0x1004e23c
mov dword [ebp - 0x550], 1
jmp 0x1004e243
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0xa20], eax
mov eax, 0xdbb389e7
cmp eax, 0xffffffff
jne 0x1004e265
mov dword [ebp - 0x7d0], 1
jmp 0x1004e26c
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0x7d0]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0xdb0], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xdb8], eax
mov eax, dword [ebp - 0x108]
add eax, 0xfffc
jne 0x1004e2a9
mov dword [ebp - 0x558], 1
jmp 0x1004e2b0
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x3d8]
add eax, dword [ebp - 0x558]
mov dword [ebp - 0x560], eax
mov eax, dword [ebp - 0x700]
sub eax, dword [ebp - 0x560]
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xdc0], eax
mov eax, 0x30f0
imul eax, eax, 0
cmp eax, dword [ebp - 0x108]
jle 0x1004e301
xor eax, eax
inc eax
jne 0x1004e301
cmp dword [ebp - 0x19c], 0
jne 0x1004e301
and dword [ebp - 0x868], 0
jmp 0x1004e30b
mov dword [ebp - 0x868], 1
mov eax, dword [ebp - 0x868]
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp - 0x3d8]
imul eax, dword [ebp - 0x17c]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xe44], eax
cmp dword [ebp - 0x108], 0
je 0x1004e33f
jmp 0x1004e190
jmp 0x1004e190
jmp 0x1004e34e
cmp dword [ebp - 0x68], 0
je 0x1004e34e
jmp 0x1004e353
jmp 0x1004dff2
lea eax, [ebp - 0x8cc]
push eax
lea ecx, [ebp - 0xf08]
call fcn.1002a0b2
mov dword [ebp - 0x91c], eax
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x9fc], eax
and dword [ebp - 4], 0
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x9fc]
call fcn.10034ca5
pop ecx
mov dword [ebp - 0x96c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf08]
call fcn.100197a6
mov dword [ebp - 0x260], 0x68206240
mov dword [ebp - 0xdc8], 0xdde9ab5c
mov dword [ebp - 0xdd0], 0x85734cb4
mov dword [ebp - 0xe00], 0xffffffff
mov dword [ebp - 0xaa0], 0xffffffff
mov dword [ebp - 0xd9c], 0xcd953295
mov dword [ebp - 0xd4c], 0x300ca3c4
mov dword [ebp - 0xdbc], 8
mov dword [ebp - 0xb68], 0xa644184e
mov dword [ebp - 0xcd8], 0xe1a0e1c2
mov dword [ebp - 0xb70], 0xfffffff6
mov dword [ebp - 0xd8c], 1
mov dword [ebp - 0xb78], 0xfffffffa
mov dword [ebp - 0xce0], 0xd8d34108
mov dword [ebp - 0xb80], 0x1e758769
mov dword [ebp - 0xdfc], 0xfffffff7
mov dword [ebp - 0xb88], 4
mov dword [ebp - 0xce8], 0xe3f0e26a
mov dword [ebp - 0xb90], 0x69097d9
mov dword [ebp - 0x92c], 0
mov dword [ebp - 0x20c], 0
jmp 0x1004e481
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jge 0x1004e49d
mov eax, dword [ebp - 0x20c]
mov dword [ebp + eax*4 - 0xe88], 0x1ce094bf
jmp 0x1004e474
mov dword [ebp - 0x260], 0x13
jmp 0x1004e4b6
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0x1d
jle 0x1004e51e
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x924], 0xc8b9ba5e
cmp dword [ebp - 0x214], 1
jge 0x1004e4ee
cmp dword [ebp - 0x214], 0
jne 0x1004e4ee
and dword [ebp - 0x568], 0
jmp 0x1004e4f8
mov dword [ebp - 0x568], 1
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x924], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0xd94], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0xaa0], eax
jmp 0x1004e4a9
push 0
push 0x28ea
lea eax, [ebp - 0x92c]
push eax
push 0x7e24
call fcn.1004b682
add esp, 0x10
and dword [ebp - 0x288], 0
jmp 0x1004e54f
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0xb
jae 0x1004e568
mov eax, dword [ebp - 0x288]
mov byte [ebp + eax - 0x8cc], 0
jmp 0x1004e542
mov dword [ebp - 0x21c], 0x24a8c6a5
mov dword [ebp - 0x21c], 0xffffffeb
jmp 0x1004e58b
mov eax, dword [ebp - 0x21c]
dec eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xffffffe6
jle 0x1004e5da
mov dword [ebp - 0xa04], 0
push 0x6fb9
push 0x556a
push 0
push 0xbd9
lea eax, [ebp - 0xa04]
push eax
call fcn.1004bab8
add esp, 0x14
mov byte [ebp - 0x120], 0
movzx eax, byte [ebp - 0x120]
test eax, eax
je 0x1004e5d8
push 1
call fcn.1004b21b
pop ecx
jmp 0x1004e57e
mov byte [ebp - 0x11a], 0
movzx eax, byte [ebp - 0x11a]
test eax, eax
je 0x1004e600
push 0x3de6
push 0
push 0x1863
call fcn.1004b77d
add esp, 0xc
mov byte [ebp - 0x1dc], 7
mov byte [ebp - 0x1db], 0xb7
mov byte [ebp - 0x1da], 2
mov byte [ebp - 0x1d9], 1
mov byte [ebp - 0x1d8], 4
mov byte [ebp - 0x1d7], 3
mov byte [ebp - 0x1d6], 0
mov byte [ebp - 0x1d5], 5
mov byte [ebp - 0x1d4], 3
mov byte [ebp - 0x1d3], 3
mov byte [ebp - 0x1d2], 1
mov byte [ebp - 0x1d1], 4
mov byte [ebp - 0x1d0], 5
mov byte [ebp - 0x1cf], 7
mov byte [ebp - 0x1ce], 6
mov byte [ebp - 0x1cd], 8
mov byte [ebp - 0x1cc], 0xf
mov byte [ebp - 0x1cb], 0xce
mov byte [ebp - 0x1ca], 0xd3
mov byte [ebp - 0x1c9], 0x57
mov byte [ebp - 0x1c8], 0x4d
mov byte [ebp - 0x1c7], 9
mov byte [ebp - 0x1c6], 0x52
mov byte [ebp - 0x1c5], 0xb9
mov byte [ebp - 0x1c4], 0xd2
mov byte [ebp - 0x1c3], 0x92
mov byte [ebp - 0x1c2], 0x86
mov byte [ebp - 0x1c1], 0xd1
mov byte [ebp - 0x1c0], 0x65
mov byte [ebp - 0x1bf], 0xcc
mov byte [ebp - 0x1be], 0xf4
mov byte [ebp - 0x1bd], 0xe8
mov byte [ebp - 0x1bc], 9
mov byte [ebp - 0x1bb], 9
mov byte [ebp - 0x1ba], 8
mov byte [ebp - 0x1b9], 0
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1dc]
or eax, 0x81
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1dc]
and ecx, 0x81
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x1dc]
mov byte [ebp + ecx - 0x8a0], al
mov dword [ebp - 0x30], 2
and dword [ebp - 0x1a8], 0
jmp 0x1004e752
mov eax, dword [ebp - 0x30]
inc eax
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x24
jae 0x1004e83f
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1dc]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x30], eax
jne 0x1004e79c
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x1dc]
inc eax
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x1dc]
mov ecx, dword [ebp - 0x30]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x30], eax
jmp 0x1004e74a
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x1db]
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x1a8]
movzx ecx, byte [ebp + ecx - 0x1de]
movsx ecx, byte [ebp + ecx - 0x8a0]
add eax, ecx
mov ecx, dword [ebp - 0x30]
movzx ecx, byte [ebp + ecx - 0x1db]
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x1a8]
movzx edx, byte [ebp + edx - 0x1de]
movsx edx, byte [ebp + edx - 0x8a0]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x30]
movzx ecx, byte [ebp + ecx - 0x1db]
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x1a8]
movzx edx, byte [ebp + edx - 0x1de]
movsx edx, byte [ebp + edx - 0x8a0]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x30]
movzx ecx, byte [ebp + ecx - 0x1dc]
mov byte [ebp + ecx - 0x8a0], al
lea eax, [ebp - 0x1a8]
push eax
push 0x3af4
push 1
call fcn.1004b25d
add esp, 0xc
jmp 0x1004e74a
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x8a0], 0
mov dword [ebp - 0x110], 0x2ba39464
mov dword [ebp - 0x708], 0xa23
mov dword [ebp - 0x224], 5
mov dword [ebp - 0x598], 0x82e77e81
mov dword [ebp - 0x3b8], 0x71658a6
mov dword [ebp - 0x370], 0xffff
mov dword [ebp - 0xa54], 0xfa4a603d
mov dword [ebp - 0x14], 0
jmp 0x1004e8a3
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1004e8b9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xde4], 0xfffffff7
jmp 0x1004e89c
mov dword [ebp - 0x14], 0
jmp 0x1004e8c9
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1004e8df
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9e0], 0xffffffff
jmp 0x1004e8c2
mov dword [ebp - 0x14], 0
jmp 0x1004e8ef
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1004e905
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xad0], 0x187
jmp 0x1004e8e8
mov dword [ebp - 0x14], 0
jmp 0x1004e915
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1004e92b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe98], 0
jmp 0x1004e90e
mov dword [ebp - 0x14], 0
jmp 0x1004e93b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1004e951
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe74], 2
jmp 0x1004e934
mov dword [ebp - 0x110], 3
jmp 0x1004e96a
mov eax, dword [ebp - 0x110]
dec eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jl 0x1004ec56
mov dword [ebp - 0x720], 0x2b56095d
mov dword [ebp - 0x580], 6
mov dword [ebp - 0xa0c], 0xfffffff6
mov dword [ebp - 0x268], 0
jmp 0x1004e9ae
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 3
jge 0x1004e9ca
mov eax, dword [ebp - 0x268]
mov dword [ebp + eax*4 - 0xfa4], 9
jmp 0x1004e9a1
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp + eax*4 - 0xde4]
mov dword [ebp - 0xb98], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xde4]
mov ecx, dword [ebp - 0x110]
lea eax, [eax + ecx - 1]
cmp dword [ebp - 0x110], eax
je 0x1004ea08
mov dword [ebp - 0x570], 1
jmp 0x1004ea0f
and dword [ebp - 0x570], 0
mov dword [ebp - 0x708], 0xe672
mov eax, dword [ebp - 0x708]
cmp eax, dword [ebp - 0x570]
je 0x1004ea33
mov dword [ebp - 0x934], 1
jmp 0x1004ea3a
and dword [ebp - 0x934], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xde4]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x9e0]
mov dword [ebp - 0x224], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xad0]
mov dword [ebp - 0xcf0], eax
mov eax, dword [ebp - 0x580]
mov dword [ebp - 0xba0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9e0]
cmp dword [ebp - 0x720], eax
jne 0x1004ea9a
mov dword [ebp - 0x7d8], 1
jmp 0x1004eaa1
and dword [ebp - 0x7d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xad0]
cmp dword [ebp - 0x7d8], eax
jl 0x1004eac2
mov dword [ebp - 0x578], 1
jmp 0x1004eac9
and dword [ebp - 0x578], 0
cmp dword [ebp - 0x578], 0xfffd
je 0x1004eae1
mov dword [ebp - 0x710], 1
jmp 0x1004eae8
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x224]
sub eax, dword [ebp - 0x710]
cmp eax, dword [ebp - 0xa54]
jg 0x1004eb08
mov dword [ebp - 0x840], 1
jmp 0x1004eb0f
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x580]
cmp eax, dword [ebp - 0x840]
jg 0x1004eb29
mov dword [ebp - 0x588], 1
jmp 0x1004eb30
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
mov eax, dword [ebp - 0x370]
cmp eax, dword [ebp - 0x588]
jg 0x1004eb57
mov dword [ebp - 0x718], 1
jmp 0x1004eb5e
and dword [ebp - 0x718], 0
cmp dword [ebp - 0x718], 0xffffffff
jne 0x1004eb73
mov dword [ebp - 0x590], 1
jmp 0x1004eb7a
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x590]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0xf9a
jne 0x1004eb9e
mov dword [ebp - 0x93c], 1
jmp 0x1004eba5
and dword [ebp - 0x93c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xe74]
mov dword [ebp - 0xdc4], eax
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x944], eax
mov eax, dword [ebp - 0xa0c]
mov dword [ebp - 0xa58], eax
mov eax, dword [ebp - 0x3b8]
dec eax
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x944]
cmp eax, dword [ebp - 0xa58]
jle 0x1004ebf6
mov dword [ebp - 0x7e0], 1
jmp 0x1004ebfd
and dword [ebp - 0x7e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9e0]
cmp dword [ebp - 0x7e0], eax
jg 0x1004ec1e
mov dword [ebp - 0x378], 1
jmp 0x1004ec25
and dword [ebp - 0x378], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x378]
mov dword [ebp + eax - 0xe98], ecx
mov eax, dword [ebp - 0x378]
dec eax
mov dword [ebp - 0x598], eax
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x720], eax
jmp 0x1004e95d
lea eax, [ebp - 0x8a0]
push eax
lea ecx, [ebp - 0xf8c]
call fcn.1002a0b2
mov dword [ebp - 0x94c], eax
mov eax, dword [ebp - 0x94c]
mov dword [ebp - 0xa14], eax
mov dword [ebp - 4], 1
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0xa14]
call fcn.10034ca5
pop ecx
mov dword [ebp - 0xa7c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf8c]
call fcn.100197a6
mov dword [ebp - 0x3c0], 0x1897
mov dword [ebp - 0x118], 0xfffffffd
mov dword [ebp - 0x5b8], 1
cmp dword [ebp - 0x3c0], 0
je 0x1004ecd9
mov dword [ebp - 0x5a0], 1
jmp 0x1004ece0
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x1004eee1
mov dword [ebp - 0x380], 0xc710
mov dword [ebp - 0x2a0], 0
jmp 0x1004ed1c
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 1
jge 0x1004ed38
mov eax, dword [ebp - 0x2a0]
mov dword [ebp + eax*4 - 0xa60], 0x32c5b641
jmp 0x1004ed0f
mov byte [ebp - 0x129], 0
push 0x882
push 1
lea eax, [ebp - 0x129]
push eax
call fcn.1004b2a1
add esp, 0xc
mov dword [ebp - 0x118], 0xffffffe6
jmp 0x1004ed6e
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xfffffffb
jge 0x1004eedf
mov dword [ebp - 0x954], 0xe5ab
mov dword [ebp - 0x22c], 0
jmp 0x1004ed9e
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 4
jge 0x1004edba
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0xb18], 0xfa4a
jmp 0x1004ed91
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x380]
cmp dword [ebp + eax - 0xb18], ecx
jge 0x1004eddb
mov dword [ebp - 0x5a8], 1
jmp 0x1004ede2
and dword [ebp - 0x5a8], 0
cmp dword [ebp - 0x380], 0xecf04b06
jbe 0x1004edfa
mov dword [ebp - 0x84c], 1
jmp 0x1004ee01
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x954]
cmp dword [ebp - 0x84c], eax
jl 0x1004ee1b
mov dword [ebp - 0x400], 1
jmp 0x1004ee22
and dword [ebp - 0x400], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x400]
mov dword [ebp + eax - 0xa60], ecx
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x5a8]
imul ecx, dword [ebp - 0x400]
add ecx, dword [ebp + eax - 0xb18]
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xb18], ecx
je 0x1004ee69
mov dword [ebp - 0x728], 1
jmp 0x1004ee70
and dword [ebp - 0x728], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x380]
imul ecx, dword [ebp - 0x728]
cmp dword [ebp + eax - 0xb18], ecx
jge 0x1004ee98
mov dword [ebp - 0x5b0], 1
jmp 0x1004ee9f
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x5b0], eax
je 0x1004eeb9
mov dword [ebp - 0x7e8], 1
jmp 0x1004eec0
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x7e8]
mov dword [ebp - 0x5b8], eax
cmp dword [ebp - 0x3c0], 0
je 0x1004eeda
jmp 0x1004ed61
jmp 0x1004ed61
jmp 0x1004ef36
mov dword [ebp - 0x95c], 0xfffffff6
mov byte [ebp - 0x11d], 0
push 0x7061
push 0
lea eax, [ebp - 0x11d]
push eax
push 0x57a6
call fcn.1004b609
add esp, 0x10
lea eax, [ebp - 0x5b8]
push eax
lea eax, [ebp - 0x3c0]
push eax
push 0xce8
push 0x25df
lea eax, [ebp - 0x95c]
push eax
push 1
call fcn.1004b300
add esp, 0x18
and dword [ebp - 0x270], 0
jmp 0x1004ef4c
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0xb
jae 0x1004ef65
mov eax, dword [ebp - 0x270]
mov byte [ebp + eax - 0x8a0], 0
jmp 0x1004ef3f
mov dword [ebp - 0x60], 0xfe223643
mov dword [ebp - 0x848], 1
mov dword [ebp - 0xa1c], 0xffff
mov dword [ebp - 0x234], 0
jmp 0x1004ef99
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 3
jge 0x1004efb5
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0x8e8], 0xb55b
jmp 0x1004ef8c
mov dword [ebp - 0x60], 2
jmp 0x1004efc5
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x1004f1f0
mov dword [ebp - 0x5d0], 0
mov dword [ebp - 0x9c], 0
jmp 0x1004eff2
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x1004f00e
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xe2c], 7
jmp 0x1004efe5
mov dword [ebp - 0x9c], 0
jmp 0x1004f027
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x1004f043
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x964], 0
jmp 0x1004f01a
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0x8e8]
mov dword [ebp - 0xba8], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0x8e8]
mov dword [ebp - 0x730], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x730]
mov dword [ebp + eax - 0xe2c], ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0x8e8]
cmp eax, dword [ebp - 0x730]
jg 0x1004f098
push 3
pop eax
test eax, eax
jne 0x1004f098
and dword [ebp - 0x5c0], 0
jmp 0x1004f0a2
mov dword [ebp - 0x5c0], 1
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0xd00], eax
mov eax, dword [ebp - 0x5d0]
cmp dword [ebp - 0x60], eax
jne 0x1004f0d1
mov dword [ebp - 0x5c8], 1
jmp 0x1004f0d8
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0xa1c]
cmp dword [ebp - 0x5c8], eax
jle 0x1004f0f2
mov dword [ebp - 0x738], 1
jmp 0x1004f0f9
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x738]
jl 0x1004f110
mov dword [ebp - 0x7f0], 1
jmp 0x1004f117
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0x5d0]
add eax, dword [ebp - 0x7f0]
jne 0x1004f131
mov dword [ebp - 0x5d8], 1
jmp 0x1004f138
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x5d8]
je 0x1004f149
cmp dword [ebp - 0x60], 0
jne 0x1004f157
or eax, 0xffffffff
jne 0x1004f157
and dword [ebp - 0x740], 0
jmp 0x1004f161
mov dword [ebp - 0x740], 1
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0x8e8]
cmp eax, dword [ebp - 0x740]
jle 0x1004f17f
mov dword [ebp - 0x5e0], 1
jmp 0x1004f186
and dword [ebp - 0x5e0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5e0]
mov dword [ebp + eax - 0x964], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8e8]
mov ecx, dword [ebp - 0x60]
add eax, dword [ebp + ecx*4 - 0x8e8]
je 0x1004f1d1
mov byte [ebp - 0xe2], 0
push 1
lea eax, [ebp - 0xe2]
push eax
push 0x880
call fcn.1004b3e4
add esp, 0xc
jmp 0x1004f1eb
mov byte [ebp - 0xe3], 0
movzx eax, byte [ebp - 0xe3]
test eax, eax
je 0x1004f1eb
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1004efbe
push dword [ebp - 0xa7c]
push dword [ebp - 0x96c]
call fcn.100479ab
pop ecx
pop ecx
mov dword [ebp - 0x858], eax
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x858]
mov dword [eax + 8], ecx
mov dword [ebp - 0x18], 0xb1cecb45
mov dword [ebp - 0x16c], 0x87a9b65c
mov dword [ebp - 0xb58], 0x7cec7e9a
mov dword [ebp - 0xb54], 0x7cec7e9a
mov dword [ebp - 0xb50], 0x7cec7e9a
mov dword [ebp - 0xb4c], 0x7cec7e9a
mov dword [ebp - 0x770], 0
mov dword [ebp - 0xbb0], 0x85266add
mov dword [ebp - 0xd44], 0xffffffff
mov dword [ebp - 0x640], 2
mov dword [ebp - 0xa0], 0
jmp 0x1004f292
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x1004f2ae
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x3e4], 0x41b3
jmp 0x1004f285
mov dword [ebp - 0xa0], 0
jmp 0x1004f2c7
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x1004f2e3
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0xabc], 0xff609d70
jmp 0x1004f2ba
mov dword [ebp - 0x18], 0
jmp 0x1004f2f3
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x1004f759
mov dword [ebp - 0x84], 0xffffffff
mov dword [ebp - 0x3e8], 0x6982b357
mov dword [ebp - 0x388], 0xa4b38b4b
mov dword [ebp - 0x84], 1
cmp dword [ebp - 0x84], 0
je 0x1004f4e4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x854], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x854]
mov dword [ebp + eax - 0xabc], ecx
cmp dword [ebp - 0x854], 0xce96f8f9
jbe 0x1004f365
mov dword [ebp - 0x5e8], 1
jmp 0x1004f36c
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x5e8], eax
jge 0x1004f383
mov dword [ebp - 0xa24], 1
jmp 0x1004f38a
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xbb8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xabc], 0xfffffffb
je 0x1004f3b1
mov dword [ebp - 0x748], 1
jmp 0x1004f3b8
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x748], eax
je 0x1004f3cf
mov dword [ebp - 0x974], 1
jmp 0x1004f3d6
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xd10], eax
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x84], eax
jge 0x1004f3fc
mov dword [ebp - 0x5f0], 1
jmp 0x1004f403
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x5f0], eax
jl 0x1004f41a
mov dword [ebp - 0x7f8], 1
jmp 0x1004f421
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x7f8], eax
jne 0x1004f438
mov dword [ebp - 0x5f8], 1
jmp 0x1004f43f
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x5f8], eax
je 0x1004f459
mov dword [ebp - 0x750], 1
jmp 0x1004f460
and dword [ebp - 0x750], 0
cmp dword [ebp - 0x750], 0xf888c554
jne 0x1004f478
mov dword [ebp - 0x600], 1
jmp 0x1004f47f
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3e4]
mov dword [ebp - 0x85c], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x85c]
mov dword [ebp + eax*4 - 0x3e4], ecx
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x85c], eax
jle 0x1004f4c5
mov dword [ebp - 0x608], 1
jmp 0x1004f4cc
and dword [ebp - 0x608], 0
cmp dword [ebp - 0x608], 0xb674
je 0x1004f4e4
mov dword [ebp - 0x758], 1
jmp 0x1004f4eb
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xabc]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3e4]
cmp dword [ebp - 0x388], eax
jge 0x1004f53a
mov dword [ebp - 0x618], 1
jmp 0x1004f541
and dword [ebp - 0x618], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x3e4]
cmp dword [ebp + eax - 0xb58], ecx
jg 0x1004f576
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x3e4], 0
je 0x1004f576
mov dword [ebp - 0x610], 1
jmp 0x1004f57d
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x610]
lea eax, [ecx + eax - 0x2795fdd0]
cmp eax, dword [ebp - 0x16c]
jl 0x1004f5a4
mov dword [ebp - 0x800], 1
jmp 0x1004f5ab
and dword [ebp - 0x800], 0
cmp dword [ebp - 0x800], 5
jae 0x1004f5c0
mov dword [ebp - 0x760], 1
jmp 0x1004f5c7
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x618]
cmp eax, dword [ebp - 0x760]
jl 0x1004f5e1
mov dword [ebp - 0xa64], 1
jmp 0x1004f5e8
and dword [ebp - 0xa64], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x3e4]
cmp dword [ebp + eax*4 - 0x3e4], ecx
jne 0x1004f616
mov dword [ebp - 0x620], 1
jmp 0x1004f61d
and dword [ebp - 0x620], 0
cmp dword [ebp - 0x620], 0x7283a38c
jne 0x1004f635
mov dword [ebp - 0x97c], 1
jmp 0x1004f63c
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x888], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x888]
mov dword [ebp + eax - 0xabc], ecx
mov eax, dword [ebp - 0x770]
cmp dword [ebp - 0x888], eax
je 0x1004f675
mov dword [ebp - 0x628], 1
jmp 0x1004f67c
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3e4]
sub eax, dword [ebp - 0x628]
cmp eax, 0x274c
je 0x1004f69f
mov dword [ebp - 0x768], 1
jmp 0x1004f6a6
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3e4]
cmp dword [ebp - 0x768], eax
jge 0x1004f6c4
mov dword [ebp - 0x630], 1
jmp 0x1004f6cb
and dword [ebp - 0x630], 0
cmp dword [ebp - 0x630], 0
jne 0x1004f6e0
mov dword [ebp - 0x808], 1
jmp 0x1004f6e7
and dword [ebp - 0x808], 0
cmp dword [ebp - 0x808], 1
jg 0x1004f6fc
mov dword [ebp - 0x638], 1
jmp 0x1004f703
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3e4]
cmp dword [ebp - 0x638], eax
jg 0x1004f721
mov dword [ebp - 0xa2c], 1
jmp 0x1004f728
and dword [ebp - 0xa2c], 0
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0xd48], eax
cmp dword [ebp - 0x770], 0
je 0x1004f748
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x3e4], 0
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x16c], eax
jmp 0x1004f2ec
mov dword [ebp - 0x18], 0xb
jmp 0x1004f769
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1004f7fc
mov dword [ebp - 0xbc8], 0xfffffff7
mov dword [ebp - 0xdf8], 0xd7bff020
mov dword [ebp - 0xdf4], 0xd7bff020
mov dword [ebp - 0xdf0], 0xd7bff020
mov dword [ebp - 0xdec], 0xd7bff020
mov byte [ebp - 0x101], 0
lea eax, [ebp - 0x101]
push eax
push 0x5183
push 0x4f37
push 0x6b18
push 0x7c66
push 0x74e3
push 0x4b27
push 0x4d52
push 1
push 0x603c
push 0x40d9
call fcn.1004b432
add esp, 0x2c
mov eax, dword [ebp - 0x640]
dec eax
mov dword [ebp - 0x640], eax
jmp 0x1004f762
lea eax, [ebp - 0x858]
push eax
push 1
push 0x7004
lea eax, [ebp - 0x1c]
push eax
call fcn.1004b609
add esp, 0x10
mov dword [ebp - 0x398], 0x4182
mov dword [ebp - 0x188], 0xf0488f4f
mov dword [ebp - 0x390], 0x17ca4e8
mov dword [ebp - 0x778], 0x4795ed7
mov dword [ebp - 0x648], 0xffffffff
mov dword [ebp - 0x810], 0x219a6fdd
mov dword [ebp - 0xa9c], 0x8d92426f
mov dword [ebp - 0xa98], 0x8d92426f
mov dword [ebp - 0xa94], 0x8d92426f
mov dword [ebp - 0xa90], 0x8d92426f
mov dword [ebp - 0x290], 0x9ae65c34
mov eax, 0x25ef2c36
test eax, eax
je 0x1004f98a
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x778], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x648], eax
mov eax, dword [ebp - 0x648]
cmp dword [ebp - 0x778], eax
jne 0x1004f8cf
mov dword [ebp - 0x650], 1
jmp 0x1004f8d6
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x810], eax
cmp dword [ebp - 0x810], 0
je 0x1004f900
cmp dword [ebp - 0x390], 0
je 0x1004f900
mov dword [ebp - 0x658], 1
jmp 0x1004f907
and dword [ebp - 0x658], 0
cmp dword [ebp - 0x658], 0xe77
jle 0x1004f91f
mov dword [ebp - 0x780], 1
jmp 0x1004f926
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x780], eax
jne 0x1004f940
mov dword [ebp - 0x3c8], 1
jmp 0x1004f947
and dword [ebp - 0x3c8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp + eax - 0xa9c], ecx
cmp dword [ebp - 0x3c8], 0xeb2d3650
ja 0x1004f98a
cmp dword [ebp - 0x188], 0
je 0x1004f98a
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xa9c], 0
je 0x1004f98a
mov dword [ebp - 0x660], 1
jmp 0x1004f991
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x398]
cmp dword [ebp - 0x660], eax
jne 0x1004f9ab
mov dword [ebp - 0x878], 1
jmp 0x1004f9b2
and dword [ebp - 0x878], 0
cmp dword [ebp - 0x878], 1
jae 0x1004f9c7
mov dword [ebp - 0x424], 1
jmp 0x1004f9ce
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x398]
cmp eax, dword [ebp - 0x424]
jle 0x1004f9e8
mov dword [ebp - 0x42c], 1
jmp 0x1004f9ef
and dword [ebp - 0x42c], 0
cmp dword [ebp - 0x42c], 5
jne 0x1004fa04
mov dword [ebp - 0x434], 1
jmp 0x1004fa0b
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x398]
sub eax, dword [ebp - 0x434]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x290], eax
jle 0x1004fa46
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov eax, dword [ebp + eax - 0xa9c]
mov dword [ebp + ecx - 0xa9c], eax
jmp 0x1004fa98
mov dword [ebp - 0x23c], 0xfffffffa
cmp dword [ebp - 0x23c], 0xfffffff7
jbe 0x1004fa65
mov eax, dword [ebp - 0x23c]
cmp dword [ebp - 0x290], eax
push 6
pop eax
sub eax, dword [ebp - 0x290]
je 0x1004fa85
cmp dword [ebp - 0x23c], 0
je 0x1004fa85
mov dword [ebp - 0x43c], 1
jmp 0x1004fa8c
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x23c], eax
and dword [ebp - 0x198], 0
mov dword [ebp - 0x244], 3
mov dword [ebp - 0xd20], 0xfffb
mov dword [ebp - 0x240], 0
jmp 0x1004facc
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 3
jge 0x1004fae8
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0xf98], 0xfffffffd
jmp 0x1004fabf
mov dword [ebp - 0x244], 2
jmp 0x1004fb01
mov eax, dword [ebp - 0x244]
dec eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
jl 0x1004fb54
mov dword [ebp - 0x248], 0xfffffff7
mov dword [ebp - 0x984], 0xef7d6512
mov dword [ebp - 0x248], 2
jmp 0x1004fb37
mov eax, dword [ebp - 0x248]
dec eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jl 0x1004fb52
push 0
lea eax, [ebp - 0x984]
push eax
call fcn.1004bc44
pop ecx
pop ecx
jmp 0x1004fb2a
jmp 0x1004faf4
push 1
lea eax, [ebp - 0x198]
push eax
push 0x2f1f
lea eax, [ebp - 0x1c]
push eax
call fcn.1004b682
add esp, 0x10
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1e8], 0xfffffff6
mov dword [ebp - 0x1e4], 0
jmp 0x1004fb9a
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jge 0x1004fbb6
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0xeb8], 0
jmp 0x1004fb8d
mov dword [ebp - 0x1e8], 1
jmp 0x1004fbcf
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0
jl 0x1004fbe8
push 1
push 0x2a52
call fcn.1004b6e6
pop ecx
pop ecx
jmp 0x1004fbc2
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x14]
sub eax, dword [ebp - 0x198]
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x454], 1
mov dword [ebp - 0x40], 0
jmp 0x1004fc14
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1004fc2a
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xc38], 1
jmp 0x1004fc0d
mov dword [ebp - 0x40], 0
jmp 0x1004fc3a
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x1004fc50
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x130], 0x622ba394
jmp 0x1004fc33
mov dword [ebp - 0x40], 0
jmp 0x1004fc60
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1004fc76
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xed8], 0x7525d2d9
jmp 0x1004fc59
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x130], 0
jmp 0x1004fca4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x130]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x130], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x130], 1
jg 0x1004fda6
mov dword [ebp - 0x70], 0xfffffff6
mov dword [ebp - 0xbd0], 0x4225189d
mov dword [ebp - 0xd50], 8
mov dword [ebp - 0x70], 0
jmp 0x1004fce3
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jg 0x1004fcfa
mov eax, dword [ebp - 0x70]
cmp dword [ebp + eax*4 - 0xc38], 0
je 0x1004fcf8
jmp 0x1004fcfa
jmp 0x1004fcdc
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x130]
cmp dword [ebp + eax - 0x130], ecx
jl 0x1004fd22
mov dword [ebp - 0x444], 1
jmp 0x1004fd29
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x70]
add eax, dword [ebp - 0x444]
sub eax, dword [ebp - 0x70]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x130]
je 0x1004fd50
mov dword [ebp - 0x44c], 1
jmp 0x1004fd57
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x70], 0
jmp 0x1004fd7c
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jg 0x1004fda1
mov byte [ebp - 0xe1], 0
push 1
push 0x30fd
lea eax, [ebp - 0xe1]
push eax
call fcn.1004b72c
add esp, 0xc
jmp 0x1004fd75
jmp 0x1004fc89
and dword [ebp - 0x1a0], 0
jmp 0x1004fdbc
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
cmp eax, dword [ebp - 0x160]
jge 0x1004fe33
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [eax + 0x14]
sub eax, dword [ecx + 0x18]
cmp dword [ebp - 0x1a0], eax
jae 0x1004fdfb
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x34]
add ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1a0]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x45c], eax
jmp 0x1004fe13
lea eax, [ebp - 0x164]
push eax
push 1
lea eax, [ebp - 0x45c]
push eax
call fcn.1004b77d
add esp, 0xc
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x45c]
mov dword [ecx + eax], edx
mov eax, dword [ebp - 0x10]
add eax, 4
mov dword [ebp - 0x10], eax
jmp 0x1004fdaf
mov dword [ebp - 0x8f8], 0
mov dword [ebp - 0x8f4], 0
mov dword [ebp - 0x8f0], 0
mov dword [ebp - 0x8ec], 0
mov dword [ebp - 0x1f0], 0xc5a654fd
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x8f8], 0
jmp 0x1004fe93
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8f8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x8f8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8f8], 0xfffffff1
jle 0x1004feb7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8f8], 0
je 0x1004feb5
jmp 0x1004feb7
jmp 0x1004fe78
mov dword [ebp - 0x1f0], 0
jmp 0x1004fed0
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0x17
je 0x10050057
mov dword [ebp - 0x15c], 9
mov dword [ebp - 0xbd8], 0xd238e486
mov dword [ebp - 0xb5c], 1
mov dword [ebp - 0xbe0], 0
mov dword [ebp - 0xd58], 1
mov dword [ebp - 0xa8], 0
jmp 0x1004ff28
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 4
jge 0x1004ff44
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0xfb4], 0xe6768459
jmp 0x1004ff1b
mov dword [ebp - 0xa8], 0
jmp 0x1004ff5d
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x1004ff79
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0xd0c], 0
jmp 0x1004ff50
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x15c], 0xffffffef
jmp 0x1004ff9f
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0x24
jge 0x10050052
mov dword [ebp - 0x1f8], 0xfbb6bc3e
mov dword [ebp - 0xbe8], 5
mov dword [ebp - 0xd40], 0x38330377
mov dword [ebp - 0xbf0], 0xfffffff8
mov dword [ebp - 0xd60], 0x4e665969
mov dword [ebp - 0xbf8], 0x8c38ec32
mov dword [ebp - 0xd68], 0x8cd54673
mov dword [ebp - 0xc00], 0xedfc3e8c
mov dword [ebp - 0xc58], 0xc2f92e6c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xd0c], eax
mov dword [ebp - 0x1f8], 0
jmp 0x1005003a
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
jge 0x1005004d
push 1
call fcn.1004b7e0
pop ecx
jmp 0x1005002d
jmp 0x1004ff92
jmp 0x1004fec3
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x14]
sub eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], eax
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0xdc], 0x2a0c0e07
mov dword [ebp - 0x90], 0
jmp 0x10050093
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x100500af
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x404], 0
jmp 0x10050086
mov dword [ebp - 0x90], 0
jmp 0x100500c8
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x100500e4
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0xae8], 0xcc19583e
jmp 0x100500bb
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc08], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc5c], eax
mov eax, 0x79cd329b
test eax, eax
jne 0x10050117
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x2c]
test eax, eax
jne 0x10050117
and dword [ebp - 0xa8c], 0
jmp 0x10050121
mov dword [ebp - 0xa8c], 1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc10], eax
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x2c]
test eax, eax
jne 0x10050144
cmp dword [ebp - 0x2c], 0
jne 0x10050144
and dword [ebp - 0x464], 0
jmp 0x1005014e
mov dword [ebp - 0x464], 1
cmp dword [ebp - 0x464], 0x1405
jg 0x10050166
mov dword [ebp - 0x46c], 1
jmp 0x1005016d
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x46c]
test eax, eax
jne 0x10050187
mov dword [ebp - 0x474], 1
jmp 0x1005018e
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x474], eax
jne 0x100501a5
mov dword [ebp - 0x47c], 1
jmp 0x100501ac
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x47c], eax
jge 0x100501c3
mov dword [ebp - 0x484], 1
jmp 0x100501ca
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x484], eax
jle 0x100501e1
mov dword [ebp - 0x48c], 1
jmp 0x100501e8
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x48c], eax
jge 0x100501ff
mov dword [ebp - 0x494], 1
jmp 0x10050206
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x494], eax
jl 0x10050220
mov dword [ebp - 0x98c], 1
jmp 0x10050227
and dword [ebp - 0x98c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x404]
mov dword [ebp - 0xc64], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x404]
mov dword [ebp - 0xc18], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xc6c], eax
mov eax, dword [ebp - 0xdc]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x404]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xae8]
jg 0x10050287
mov dword [ebp - 0x49c], 1
jmp 0x1005028e
and dword [ebp - 0x49c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x49c]
mov dword [ebp + eax - 0xae8], ecx
mov dword [ebp - 0xdc], 0
jmp 0x100502ba
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x998], eax
mov eax, dword [ebp - 0x998]
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x80c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x80c]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret