Function at 0x1004588f
Capabilities:
Check for peb ntglobalflag flag
Get number of processors
Reference the vmware io port
Reference wmi statements
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070cd8
push 0x1004f108
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xda4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
lea eax, [ebp - 0x5f8]
push eax
lea ecx, [ebp - 0x440]
call fcn.10001b1d
lea eax, [ebp - 0x5fc]
push eax
lea ecx, [ebp - 0x220]
call fcn.10001b1d
lea eax, [ebp - 0x600]
push eax
lea ecx, [ebp - 0x4a4]
call fcn.10001b1d
lea eax, [ebp - 0x604]
push eax
lea ecx, [ebp - 0x1f8]
call fcn.10001b1d
lea eax, [ebp - 0x608]
push eax
lea ecx, [ebp - 0xac]
call fcn.10001b1d
lea eax, [ebp - 0x60c]
push eax
lea ecx, [ebp - 0x430]
call fcn.10001b1d
lea eax, [ebp - 0x610]
push eax
lea ecx, [ebp - 0x420]
call fcn.10001b1d
lea eax, [ebp - 0x614]
push eax
lea ecx, [ebp - 0x26c]
call fcn.10001b1d
lea eax, [ebp - 0x618]
push eax
lea ecx, [ebp - 0x410]
call fcn.10001b1d
lea eax, [ebp - 0x61c]
push eax
lea ecx, [ebp - 0x40]
call fcn.10001b1d
lea eax, [ebp - 0x620]
push eax
lea ecx, [ebp - 0x3dc]
call fcn.10001b1d
lea eax, [ebp - 0x624]
push eax
lea ecx, [ebp - 0x9c]
call fcn.10001b1d
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x1e8]
call fcn.10001b1d
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x134]
call fcn.10001b1d
lea eax, [ebp - 0x630]
push eax
lea ecx, [ebp - 0xc4]
call fcn.10001b1d
lea eax, [ebp - 0x634]
push eax
mov esi, 0x1007db14
push esi
lea ecx, [ebp - 0x2b4]
call fcn.10001b5f
lea eax, [ebp - 0x638]
push eax
push esi
lea ecx, [ebp - 0x400]
call fcn.10001b5f
lea eax, [ebp - 0x63c]
push eax
push esi
lea ecx, [ebp - 0x19c]
call fcn.10001b5f
lea eax, [ebp - 0x640]
push eax
push esi
lea ecx, [ebp - 0x18c]
call fcn.10001b5f
lea eax, [ebp - 0x644]
push eax
push esi
lea ecx, [ebp - 0x124]
call fcn.10001b5f
lea eax, [ebp - 0x648]
push eax
push esi
lea ecx, [ebp - 0x17c]
call fcn.10001b5f
lea eax, [ebp - 0x64c]
push eax
push esi
lea ecx, [ebp - 0x210]
call fcn.10001b5f
lea eax, [ebp - 0x650]
push eax
push esi
lea ecx, [ebp - 0x2a4]
call fcn.10001b5f
lea eax, [ebp - 0x654]
push eax
push esi
lea ecx, [ebp - 0x1c4]
call fcn.10001b5f
lea eax, [ebp - 0x658]
push eax
lea ecx, [ebp - 0x1b4]
call fcn.10001bd7
lea eax, [ebp - 0x65c]
push eax
lea ecx, [ebp - 0x110]
call fcn.10001bd7
xor ebx, ebx
mov dword [ebp - 0x494], ebx
mov dword [ebp - 0x490], ebx
mov dword [ebp - 0x1a4], ebx
lea eax, [ebp - 0x660]
push eax
lea ecx, [ebp - 0x100]
call fcn.10001bd7
mov byte [ebp - 0x8c], bl
call fcn.1001b481
call fcn.10018f1e
mov dword [ebp - 0x200], eax
lea eax, [ebp - 0x670]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10025331
mov ecx, eax
call fcn.10001ba2
push eax
push 1
push ebx
call fcn.10019737
add esp, 0xc
lea ecx, [ebp - 0x670]
call fcn.10001b82
call fcn.1001977c
cmp eax, 0xb7
jne 0x10045b22
push ebx
push dword [ebp - 0x200]
call fcn.10018fb4
pop ecx
pop ecx
jmp 0x10047d2a
lea eax, [ebp - 0x680]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10027f00
push eax
lea ecx, [ebp - 0x2b4]
call fcn.10001b8a
lea ecx, [ebp - 0x680]
call fcn.10001b82
lea eax, [ebp - 0x690]
push eax
lea ecx, [ebp - 0xc8]
call fcn.100265b4
push eax
lea ecx, [ebp - 0x400]
call fcn.10001b8a
lea ecx, [ebp - 0x690]
call fcn.10001b82
lea eax, [ebp - 0x6a0]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1002764c
push eax
lea ecx, [ebp - 0x19c]
call fcn.10001b8a
lea ecx, [ebp - 0x6a0]
call fcn.10001b82
lea eax, [ebp - 0x6b0]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10027ffa
push eax
lea ecx, [ebp - 0x18c]
call fcn.10001b8a
lea ecx, [ebp - 0x6b0]
call fcn.10001b82
lea eax, [ebp - 0x6c0]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10029cf7
push eax
lea ecx, [ebp - 0x124]
call fcn.10001b8a
lea ecx, [ebp - 0x6c0]
call fcn.10001b82
lea eax, [ebp - 0x6d0]
push eax
lea ecx, [ebp - 0xc8]
call fcn.100282c3
push eax
lea ecx, [ebp - 0x17c]
call fcn.10001b8a
lea ecx, [ebp - 0x6d0]
call fcn.10001b82
lea eax, [ebp - 0x6e0]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10029a16
push eax
lea ecx, [ebp - 0x2a4]
call fcn.10001b8a
lea ecx, [ebp - 0x6e0]
call fcn.10001b82
lea eax, [ebp - 0x6f0]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10029cb6
push eax
lea ecx, [ebp - 0x1c4]
call fcn.10001b8a
lea ecx, [ebp - 0x6f0]
call fcn.10001b82
call fcn.10045813
test eax, eax
jne 0x10047ecf
call fcn.1004582f
test eax, eax
jne 0x10047ecf
call fcn.1004584b
test eax, eax
jne 0x10047ecf
mov dword [ebp - 0xf0], ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x68]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x70
jne 0x10045cb8
push ebx
call fcn.1004effb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x10045d4b
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.ZwQueryInformationProcess
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push 0x18
lea ecx, [ebp - 0x48c]
push ecx
push ebx
push esi
call eax
cmp eax, ebx
jl 0x10045d44
mov dword [ebp - 0x4b8], ebx
mov dword [ebp - 0x4b4], ebx
lea eax, [ebp - 0x4b8]
push eax
push 2
lea eax, [ebp - 0x4b4]
push eax
mov eax, dword [ebp - 0x488]
add eax, 0x68
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x10045d44
cmp dword [ebp - 0x4b8], 2
jne 0x10045d44
cmp word [ebp - 0x4b4], 0x70
jne 0x10045d44
push ebx
call fcn.1004effb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pushfd
pushal
mov eax, 1
cpuid
test ecx, 0x80000000
jne 0x10045d68
mov dword [ebp - 0x494], 0
jmp 0x10045d72
mov dword [ebp - 0x494], 1
popal
popfd
and dword [ebp - 4], 0
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
mov dword [ebp - 0x490], 1
or dword [ebp - 4], 0xffffffff
xor ebx, ebx
jmp 0x10045db8
push ebx
push ebx
call fcn.10019ce6
push ebx
push ebx
push ebx
push 3
pop esi
push esi
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call fcn.1001a4b6
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x30]
push eax
push 0x100735c0
push 1
push ebx
push 0x10073690
call fcn.10019479
add esp, 0x40
mov dword [ebp - 0x45c], ebx
mov eax, dword [ebp - 0x30]
mov edi, dword [eax]
lea eax, [ebp - 0x45c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x18c]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x6f4]
call 0x10047ed5
mov ecx, eax
call fcn.10047f0e
push eax
push dword [ebp - 0x30]
call dword [edi + 0xc]
lea ecx, [ebp - 0x6f4]
call fcn.10047f09
push ebx
push ebx
push esi
push esi
push ebx
push ebx
push 0xa
push dword [ebp - 0x45c]
call fcn.1001ab6c
add esp, 0x20
mov dword [ebp - 0xb4], ebx
mov eax, dword [ebp - 0x45c]
mov edi, dword [eax]
lea eax, [ebp - 0xb4]
push eax
push ebx
push 0x30
lea ecx, [ebp - 0x400]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x6f8]
call 0x10047ed5
mov ecx, eax
call fcn.10047f0e
push eax
lea ecx, [ebp - 0x2b4]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x6fc]
call 0x10047ed5
mov ecx, eax
call fcn.10047f0e
push eax
push dword [ebp - 0x45c]
call dword [edi + 0x50]
lea ecx, [ebp - 0x6fc]
call fcn.10047f09
lea ecx, [ebp - 0x6f8]
call fcn.10047f09
mov dword [ebp - 0x2c8], ebx
mov dword [ebp - 0x458], ebx
cmp dword [ebp - 0xb4], ebx
je 0x10045f13
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x2c8]
push ecx
push 1
push 0xffffffffffffffff
push dword [ebp - 0xb4]
call dword [eax + 0x10]
cmp dword [ebp - 0x458], ebx
je 0x10045f13
inc dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10045ecc
cmp dword [ebp - 0x1a4], ebx
jne 0x10046105
mov dword [ebp - 0x45c], ebx
mov eax, dword [ebp - 0x30]
mov edi, dword [eax]
lea eax, [ebp - 0x45c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x124]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x700]
call 0x10047ed5
mov ecx, eax
call fcn.10047f0e
push eax
push dword [ebp - 0x30]
call dword [edi + 0xc]
lea ecx, [ebp - 0x700]
call fcn.10047f09
push ebx
push ebx
push esi
push esi
push ebx
push ebx
push 0xa
push dword [ebp - 0x45c]
call fcn.1001ab6c
add esp, 0x20
mov dword [ebp - 0xb4], ebx
mov eax, dword [ebp - 0x45c]
mov esi, dword [eax]
lea eax, [ebp - 0xb4]
push eax
push ebx
push 0x30
lea ecx, [ebp - 0x19c]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x704]
call 0x10047ed5
mov ecx, eax
call fcn.10047f0e
push eax
lea ecx, [ebp - 0x2b4]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x708]
call 0x10047ed5
mov ecx, eax
call fcn.10047f0e
push eax
push dword [ebp - 0x45c]
call dword [esi + 0x50]
lea ecx, [ebp - 0x708]
call fcn.10047f09
lea ecx, [ebp - 0x704]
call fcn.10047f09
mov dword [ebp - 0x2c8], ebx
mov dword [ebp - 0x458], ebx
cmp dword [ebp - 0xb4], ebx
je 0x10046045
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x2c8]
push ecx
push 1
push 0xffffffffffffffff
push dword [ebp - 0xb4]
call dword [eax + 0x10]
cmp dword [ebp - 0x458], ebx
je 0x10046045
inc dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10045ffe
cmp dword [ebp - 0x1a4], ebx
jne 0x10046105
mov eax, dword [ebp - 0x45c]
mov esi, dword [eax]
lea eax, [ebp - 0xb4]
push eax
push ebx
push 0x30
push str.SELECT__FROM_Win32_VoltageProbe
lea ecx, [ebp - 0x70c]
call 0x10047ed5
mov ecx, eax
call fcn.10047f0e
push eax
push 0x100793e8
lea ecx, [ebp - 0x710]
call 0x10047ed5
mov ecx, eax
call fcn.10047f0e
push eax
push dword [ebp - 0x45c]
call dword [esi + 0x50]
lea ecx, [ebp - 0x710]
call fcn.10047f09
lea ecx, [ebp - 0x70c]
call fcn.10047f09
mov dword [ebp - 0x2c8], ebx
mov dword [ebp - 0x458], ebx
cmp dword [ebp - 0xb4], ebx
je 0x10046105
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x2c8]
push ecx
push 1
push 0xffffffffffffffff
push dword [ebp - 0xb4]
call dword [eax + 0x10]
cmp dword [ebp - 0x458], ebx
je 0x10046105
inc dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x100460be
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x45c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.100194cf
lea eax, [ebp - 0x474]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001c0cb
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001c12a
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001c189
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001c095
lea eax, [ebp - 0x720]
push eax
call fcn.100048c8
pop ecx
push eax
lea ecx, [ebp - 0x210]
call fcn.10001b8a
lea ecx, [ebp - 0x720]
call fcn.10001b82
lea ecx, [ebp - 0xc8]
call fcn.100251c8
lea eax, [ebp - 0x3f0]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001ce58
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0xc8]
call fcn.100251e5
sub esp, 0x10
push esp
lea ecx, [ebp - 0xc8]
call fcn.1001cac5
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0x3f0]
push eax
call fcn.10001b35
lea eax, [ebp - 0x454]
push eax
call fcn.100056eb
add esp, 0x24
lea eax, [ebp - 0x72c]
push eax
lea ecx, [ebp - 0xec]
call fcn.10001b1d
lea eax, [ebp - 0x73c]
push eax
call fcn.10004a01
pop ecx
push eax
lea ecx, [ebp - 0xec]
call fcn.10001b8a
lea ecx, [ebp - 0x73c]
call fcn.10001b82
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0x744]
push eax
mov esi, 0x1007db14
push esi
call fcn.10001b5f
sub esp, 0x10
push esp
lea ecx, [ebp - 0xc8]
call fcn.1001e2d5
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0xec]
push eax
call fcn.10001b35
lea eax, [ebp - 0x75c]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10021ca8
push eax
lea ecx, [ebp - 0xec]
call fcn.10001b8a
lea ecx, [ebp - 0x75c]
call fcn.10001b82
lea ecx, [ebp - 0xec]
call fcn.10002bd1
dec eax
push eax
lea ecx, [ebp - 0xec]
call fcn.10004af6
cmp byte [eax], 0x5c
jne 0x10046319
lea eax, [ebp - 0x76c]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001e2d5
push eax
lea ecx, [ebp - 0xec]
call fcn.10002bd1
dec eax
push eax
push ebx
lea eax, [ebp - 0x77c]
push eax
lea ecx, [ebp - 0xec]
call fcn.10001baf
push eax
lea eax, [ebp - 0x78c]
push eax
call fcn.10003622
add esp, 0xc
push eax
lea ecx, [ebp - 0xec]
call fcn.10001b8a
lea ecx, [ebp - 0x78c]
call fcn.10001b82
lea ecx, [ebp - 0x77c]
call fcn.10001b82
lea ecx, [ebp - 0x76c]
jmp 0x1004633d
lea eax, [ebp - 0x79c]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001e2d5
push eax
lea ecx, [ebp - 0xec]
call fcn.10001b96
lea ecx, [ebp - 0x79c]
call fcn.10001b82
lea eax, [ebp - 0x7a0]
push eax
lea ecx, [ebp - 0x168]
call fcn.10001b1d
lea eax, [ebp - 0x7a4]
push eax
lea ecx, [ebp - 0x28]
call fcn.10001b1d
lea eax, [ebp - 0x7a8]
push eax
lea ecx, [ebp - 0x28c]
call fcn.10001b1d
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x168]
push eax
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0xec]
push eax
call fcn.10001b35
lea ecx, [ebp - 0xc8]
call fcn.10023124
mov byte [ebp - 0x158], bl
lea eax, [ebp - 0x7b0]
push eax
lea ecx, [ebp - 0x1d4]
call fcn.10001b1d
lea eax, [ebp - 0x7c0]
push eax
lea ecx, [ebp - 0xc8]
call fcn.100232e3
push eax
lea ecx, [ebp - 0x1d4]
call fcn.10001b8a
lea ecx, [ebp - 0x7c0]
call fcn.10001b82
lea eax, [ebp - 0x7c4]
push eax
lea ecx, [ebp - 0x154]
call fcn.10001b1d
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0x454]
push eax
call fcn.10001bef
lea eax, [ebp - 0x7d8]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001c009
push eax
lea ecx, [ebp - 0x154]
call fcn.10001b8a
lea ecx, [ebp - 0x7d8]
call fcn.10001b82
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x7e8]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10020722
push eax
lea ecx, [ebp - 0x154]
call fcn.10001b8a
lea ecx, [ebp - 0x7e8]
call fcn.10001b82
push esi
lea eax, [ebp - 0x154]
push eax
call fcn.100052df
pop ecx
pop ecx
test al, al
je 0x10046486
push ebx
push dword [ebp - 0x200]
call fcn.10018fb4
pop ecx
pop ecx
jmp 0x10047ca1
lea eax, [ebp - 0x7f8]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10025581
push eax
lea ecx, [ebp - 0x9c]
call fcn.10001b8a
lea ecx, [ebp - 0x7f8]
call fcn.10001b82
sub esp, 0x10
push esp
lea ecx, [ebp - 0xc8]
call fcn.1001cac5
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0x9c]
push eax
call fcn.10001b35
lea eax, [ebp - 0xdc]
push eax
call fcn.100056eb
add esp, 0x14
mov ecx, esp
lea eax, [ebp - 0xdc]
push eax
call fcn.10001bef
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001c009
push eax
lea ecx, [ebp - 0x1e8]
call fcn.10001b8a
lea ecx, [ebp - 0x814]
call fcn.10001b82
lea eax, [ebp - 0x1e8]
push eax
lea eax, [ebp - 0x824]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10020722
push eax
lea ecx, [ebp - 0x1e8]
call fcn.10001b8a
lea ecx, [ebp - 0x824]
call fcn.10001b82
lea ecx, [ebp - 0x1c4]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x828]
call fcn.100679df
lea ecx, [ebp - 0x1e8]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x82c]
call fcn.100679df
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x83c]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10021baf
push eax
lea ecx, [ebp - 0x1b4]
call fcn.10004bfe
lea ecx, [ebp - 0x83c]
call fcn.10001cbd
lea ecx, [ebp - 0x82c]
call fcn.10067971
lea ecx, [ebp - 0x828]
call fcn.10067971
lea eax, [ebp - 0x84c]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1002897e
push eax
lea ecx, [ebp - 0x134]
call fcn.10001b8a
lea ecx, [ebp - 0x84c]
call fcn.10001b82
sub esp, 0x10
push esp
lea ecx, [ebp - 0xc8]
call fcn.1001cac5
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0x134]
push eax
call fcn.10001b35
lea eax, [ebp - 0x74]
push eax
call fcn.100056eb
add esp, 0x14
mov ecx, esp
lea eax, [ebp - 0x74]
push eax
call fcn.10001bef
lea eax, [ebp - 0x868]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001c009
push eax
lea ecx, [ebp - 0xc4]
call fcn.10001b8a
lea ecx, [ebp - 0x868]
call fcn.10001b82
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x878]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10020722
push eax
lea ecx, [ebp - 0xc4]
call fcn.10001b8a
lea ecx, [ebp - 0x878]
call fcn.10001b82
lea ecx, [ebp - 0x1c4]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x87c]
call fcn.100679df
lea ecx, [ebp - 0xc4]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x880]
call fcn.100679df
lea eax, [ebp - 0x87c]
push eax
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0x890]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10021baf
push eax
lea ecx, [ebp - 0x110]
call fcn.10004bfe
lea ecx, [ebp - 0x890]
call fcn.10001cbd
lea ecx, [ebp - 0x880]
call fcn.10067971
lea ecx, [ebp - 0x87c]
call fcn.10067971
push 4
lea ecx, [ebp - 0x1b4]
call fcn.10003be2
mov ecx, eax
call fcn.10001ba2
push eax
call fcn.1004efc3
pop ecx
cmp dword [ebp - 0x494], eax
jge 0x1004675d
push 5
lea ecx, [ebp - 0x1b4]
call fcn.10003be2
mov ecx, eax
call fcn.10001ba2
push eax
call fcn.1004efc3
pop ecx
cmp dword [ebp - 0x490], eax
jge 0x1004675d
push 6
lea ecx, [ebp - 0x1b4]
call fcn.10003be2
mov ecx, eax
call fcn.10001ba2
push eax
call fcn.1004efc3
pop ecx
cmp dword [ebp - 0x1a4], eax
jg 0x10046766
call fcn.10045868
test al, al
jne 0x100467bf
lea ecx, [ebp - 0x154]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x894]
call fcn.100679df
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x894]
push eax
lea eax, [ebp - 0x8a4]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10021baf
push eax
lea ecx, [ebp - 0x100]
call fcn.10004bfe
lea ecx, [ebp - 0x8a4]
call fcn.10001cbd
lea ecx, [ebp - 0x894]
call fcn.10067971
lea ecx, [ebp - 0x110]
call fcn.10002bd5
mov edi, eax
xor esi, esi
cmp edi, ebx
jle 0x10046869
lea eax, [ebp - 0x2a4]
push eax
push esi
lea ecx, [ebp - 0x110]
call fcn.10003be2
push eax
call fcn.10003668
pop ecx
pop ecx
test al, al
jne 0x10046862
lea eax, [ebp - 0x8b8]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001dc84
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x8c8]
push eax
call fcn.10003622
add esp, 0xc
push eax
push esi
lea ecx, [ebp - 0x110]
call fcn.10003be2
push eax
call fcn.10003668
pop ecx
pop ecx
mov byte [ebp - 0x8a8], al
lea ecx, [ebp - 0x8c8]
call fcn.10001b82
lea ecx, [ebp - 0x8b8]
call fcn.10001b82
cmp byte [ebp - 0x8a8], bl
jne 0x10046862
inc esi
cmp esi, edi
jl 0x100467d6
jmp 0x10046869
mov byte [ebp - 0x8c], 1
cmp byte [ebp - 0x8c], bl
jne 0x1004687c
lea ecx, [ebp - 0x100]
call fcn.10003bf3
lea eax, [ebp - 0x8cc]
push eax
lea ecx, [ebp - 0x144]
call fcn.10001b1d
lea eax, [ebp - 0x8d0]
push eax
lea ecx, [ebp - 0x60]
call fcn.10001b1d
lea eax, [ebp - 0x8d4]
push eax
lea ecx, [ebp - 0x27c]
call fcn.10001b1d
lea eax, [ebp - 0x8d8]
push eax
lea ecx, [ebp - 0x50]
call fcn.10001b1d
lea eax, [ebp - 0x8dc]
push eax
lea eax, [ebp - 0x8f0]
push eax
lea ecx, [ebp - 0x8ec]
call fcn.10001b1d
push eax
push 0x64
lea ecx, [ebp - 0x46c]
call fcn.100480ef
lea ecx, [ebp - 0x8ec]
call fcn.10001b82
lea eax, [ebp - 0x8f4]
push eax
lea ecx, [ebp - 0x248]
call fcn.10001bd7
lea eax, [ebp - 0x8f8]
push eax
lea ecx, [ebp - 0x238]
call fcn.10001bd7
lea eax, [ebp - 0x8fc]
push eax
lea ecx, [ebp - 0x2c4]
call fcn.10001bd7
xor esi, esi
lea ecx, [ebp - 0x46c]
call fcn.10002bd5
test eax, eax
jbe 0x1004695f
push 0x1007db14
push esi
lea ecx, [ebp - 0x46c]
call fcn.10003be2
mov ecx, eax
call fcn.10003bd6
inc esi
lea ecx, [ebp - 0x46c]
call fcn.10002bd5
cmp esi, eax
jb 0x10046937
mov dword [ebp - 0xb0], ebx
lea ecx, [ebp - 0x100]
call fcn.10002bd5
test eax, eax
jbe 0x100479c9
lea eax, [ebp - 0x900]
push eax
lea ecx, [ebp - 0x4f8]
call fcn.10001bd7
lea eax, [ebp - 0x904]
push eax
lea ecx, [ebp - 0x4e8]
call fcn.10001bd7
lea eax, [ebp - 0x908]
push eax
lea ecx, [ebp - 0x4d8]
call fcn.10001bd7
lea eax, [ebp - 0x90c]
push eax
lea ecx, [ebp - 0x508]
call fcn.10001bd7
lea eax, [ebp - 0x910]
push eax
lea ecx, [ebp - 0x4c8]
call fcn.10001bd7
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x100]
call fcn.10003be2
mov ecx, eax
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x914]
call fcn.100679df
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0x924]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10021baf
push eax
lea ecx, [ebp - 0x4f8]
call fcn.10004bfe
lea ecx, [ebp - 0x924]
call fcn.10001cbd
lea ecx, [ebp - 0x914]
call fcn.10067971
lea eax, [ebp - 0x938]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10023778
mov ecx, eax
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x928]
call fcn.100679df
push 1
lea ecx, [ebp - 0x4f8]
call fcn.10003be2
mov ecx, eax
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x93c]
call fcn.100679df
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x93c]
push eax
lea eax, [ebp - 0x94c]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10021baf
push eax
lea ecx, [ebp - 0x4e8]
call fcn.10004bfe
lea ecx, [ebp - 0x94c]
call fcn.10001cbd
lea ecx, [ebp - 0x93c]
call fcn.10067971
lea ecx, [ebp - 0x928]
call fcn.10067971
lea ecx, [ebp - 0x938]
call fcn.10001b82
mov byte [ebp - 0x64], bl
lea eax, [ebp - 0x84]
push eax
push 2
lea ecx, [ebp - 0x4f8]
call fcn.10003be2
push eax
call fcn.10003668
pop ecx
pop ecx
test al, al
je 0x10046af9
mov byte [ebp - 0x64], 1
lea eax, [ebp - 0x960]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10023778
mov ecx, eax
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x950]
call fcn.100679df
push 3
lea ecx, [ebp - 0x4f8]
call fcn.10003be2
mov ecx, eax
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x964]
call fcn.100679df
lea eax, [ebp - 0x950]
push eax
lea eax, [ebp - 0x964]
push eax
lea eax, [ebp - 0x974]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10021baf
push eax
lea ecx, [ebp - 0x4d8]
call fcn.10004bfe
lea ecx, [ebp - 0x974]
call fcn.10001cbd
lea ecx, [ebp - 0x964]
call fcn.10067971
lea ecx, [ebp - 0x950]
call fcn.10067971
lea ecx, [ebp - 0x960]
call fcn.10001b82
lea eax, [ebp - 0x988]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10023778
mov ecx, eax
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x978]
call fcn.100679df
push 4
lea ecx, [ebp - 0x4f8]
call fcn.10003be2
mov ecx, eax
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x98c]
call fcn.100679df
lea eax, [ebp - 0x978]
push eax
lea eax, [ebp - 0x98c]
push eax
lea eax, [ebp - 0x99c]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10021baf
push eax
lea ecx, [ebp - 0x508]
call fcn.10004bfe
lea ecx, [ebp - 0x99c]
call fcn.10001cbd
lea ecx, [ebp - 0x98c]
call fcn.10067971
lea ecx, [ebp - 0x978]
call fcn.10067971
lea ecx, [ebp - 0x988]
call fcn.10001b82
lea eax, [ebp - 0x9b0]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10023778
mov ecx, eax
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x9a0]
call fcn.100679df
push 5
lea ecx, [ebp - 0x4f8]
call fcn.10003be2
mov ecx, eax
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x9b4]
call fcn.100679df
lea eax, [ebp - 0x9a0]
push eax
lea eax, [ebp - 0x9b4]
push eax
lea eax, [ebp - 0x9c4]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10021baf
push eax
lea ecx, [ebp - 0x4c8]
call fcn.10004bfe
lea ecx, [ebp - 0x9c4]
call fcn.10001cbd
lea ecx, [ebp - 0x9b4]
call fcn.10067971
lea ecx, [ebp - 0x9a0]
call fcn.10067971
lea ecx, [ebp - 0x9b0]
call fcn.10001b82
lea eax, [ebp - 0x9d4]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001dc84
push eax
push 6
lea eax, [ebp - 0x9e4]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001e8e4
push eax
push 6
lea ecx, [ebp - 0x4f8]
call fcn.10003be2
push eax
lea eax, [ebp - 0x9f4]
push eax
call fcn.10003622
add esp, 0xc
push eax
lea eax, [ebp - 0xa04]
push eax
call fcn.10003622
add esp, 0xc
push eax
lea ecx, [ebp - 0x144]
call fcn.10001b8a
lea ecx, [ebp - 0xa04]
call fcn.10001b82
lea ecx, [ebp - 0x9f4]
call fcn.10001b82
lea ecx, [ebp - 0x9e4]
call fcn.10001b82
lea ecx, [ebp - 0x9d4]
call fcn.10001b82
mov byte [ebp - 0x3e0], bl
cmp byte [ebp - 0x64], bl
jne 0x10046de5
xor esi, esi
lea ecx, [ebp - 0x4d8]
call fcn.10002bd5
test eax, eax
jbe 0x10046dec
lea eax, [ebp - 0x168]
push eax
push esi
lea ecx, [ebp - 0x4d8]
call fcn.10003be2
push eax
call fcn.10003668
pop ecx
pop ecx
test al, al
jne 0x10046de5
lea eax, [ebp - 0x28]
push eax
push esi
lea ecx, [ebp - 0x4d8]
call fcn.10003be2
push eax
call fcn.10003668
pop ecx
pop ecx
test al, al
jne 0x10046de5
lea eax, [ebp - 0x28c]
push eax
push esi
lea ecx, [ebp - 0x4d8]
call fcn.10003be2
push eax
call fcn.10003668
pop ecx
pop ecx
test al, al
jne 0x10046de5
inc esi
lea ecx, [ebp - 0x4d8]
call fcn.10002bd5
cmp esi, eax
jb 0x10046d79
jmp 0x10046dec
mov byte [ebp - 0x3e0], 1
cmp byte [ebp - 0x3e0], 1
jne 0x1004793e
mov dword [ebp - 0x510], ebx
lea ecx, [ebp - 0x508]
call fcn.10002bd5
test eax, eax
jbe 0x1004793e
push 6
lea eax, [ebp - 0xa14]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001e8e4
push eax
lea ecx, [ebp - 0x60]
call fcn.10001b8a
lea ecx, [ebp - 0xa14]
call fcn.10001b82
push dword [ebp - 0x510]
lea ecx, [ebp - 0x508]
call fcn.10003be2
push eax
lea ecx, [ebp - 0x60]
call fcn.10001b8a
push dword [ebp - 0x510]
lea ecx, [ebp - 0x508]
call fcn.10003be2
sub esp, 0x10
mov ecx, esp
push eax
call fcn.10001b35
sub esp, 0x10
mov eax, esp
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x1d4]
push ecx
push eax
call fcn.10003622
add esp, 0xc
push dword [ebp - 0x510]
lea ecx, [ebp - 0x4e8]
call fcn.10003be2
sub esp, 0x10
mov ecx, esp
push eax
call fcn.10001b35
call fcn.1000571c
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp - 0xa34]
push eax
call fcn.10003622
push eax
call fcn.10004ac8
add esp, 0x40
neg al
sbb al, al
inc al
mov byte [ebp - 0xa24], al
lea ecx, [ebp - 0xa34]
call fcn.10001b82
cmp byte [ebp - 0xa24], bl
jne 0x10047e5f
mov byte [ebp - 0xcc], bl
cmp byte [ebp - 0x158], bl
jne 0x10047125
lea eax, [ebp - 0xa44]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10023a83
push eax
lea ecx, [ebp - 0x27c]
call fcn.10001b8a
lea ecx, [ebp - 0xa44]
call fcn.10001b82
sub esp, 0x10
push esp
lea ecx, [ebp - 0xc8]
call fcn.10023d4c
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0x27c]
push eax
call fcn.10001b35
sub esp, 0x10
mov eax, esp
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x1d4]
push ecx
push eax
call fcn.10003622
add esp, 0xc
lea eax, [ebp - 0xa60]
push eax
call fcn.100019af
add esp, 0x34
push eax
lea ecx, [ebp - 0x50]
call fcn.10001b8a
lea ecx, [ebp - 0xa60]
call fcn.10001b82
push 0x1007db14
lea eax, [ebp - 0x50]
push eax
call fcn.10005354
pop ecx
pop ecx
test al, al
je 0x10047125
sub esp, 0x10
push esp
lea ecx, [ebp - 0xc8]
call fcn.10023d4c
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0x50]
push eax
call fcn.10001b35
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0x27c]
push eax
call fcn.10001b35
sub esp, 0x10
mov eax, esp
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x1d4]
push ecx
push eax
call fcn.10003622
add esp, 0xc
lea eax, [ebp - 0x5e4]
push eax
call fcn.10001826
mov byte [ebp - 0x158], 1
mov byte [ebp - 0xcc], 1
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp - 0xa80]
push eax
call fcn.10003622
add esp, 0x50
push eax
lea ecx, [ebp - 0x440]
call fcn.10001b8a
lea ecx, [ebp - 0xa80]
call fcn.10001b82
lea eax, [ebp - 0xa84]
push eax
lea ecx, [ebp - 0x5d4]
call fcn.10001bd7
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0x5e4]
push eax
call fcn.10001bef
lea eax, [ebp - 0xa98]
push eax
call fcn.10004352
add esp, 0x14
push eax
lea ecx, [ebp - 0x5d4]
call fcn.10047fd1
lea ecx, [ebp - 0xa98]
call fcn.10001c34
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0x5d4]
push eax
call fcn.10001bef
lea ecx, [ebp - 0xc8]
call fcn.1001e9f3
mov esi, eax
lea ecx, [ebp - 0x5d4]
call fcn.10002b4c
push eax
push esi
call fcn.10005d53
pop ecx
pop ecx
mov dword [ebp - 0x290], eax
cmp eax, ebx
je 0x10047ea9
lea ecx, [ebp - 0x5e4]
call fcn.100480d5
lea ecx, [ebp - 0x5d4]
call fcn.100480d5
lea eax, [ebp - 0xaac]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10024013
mov ecx, eax
call fcn.10001ba2
push eax
push dword [ebp - 0x290]
call fcn.100064ce
pop ecx
pop ecx
mov esi, eax
lea ecx, [ebp - 0xaac]
call fcn.10001b82
mov dword [ebp - 0x444], esi
cmp esi, ebx
je 0x10047ea9
lea ecx, [ebp - 0x5d4]
call fcn.10001c34
lea ecx, [ebp - 0x5e4]
call fcn.10001c34
cmp byte [ebp - 0x158], 1
jne 0x10047149
cmp byte [ebp - 0xcc], 1
jne 0x10047149
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x1f8]
call fcn.10001b8a
lea ecx, [ebp - 0x144]
call fcn.10001ba2
push eax
call fcn.100045f0
pop ecx
lea eax, [ebp - 0xac0]
push eax
lea ecx, [ebp - 0x524]
call fcn.10001bd7
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0x144]
push eax
call fcn.10001b35
sub esp, 0x10
push esp
lea ecx, [ebp - 0xc8]
call fcn.10023d4c
lea eax, [ebp - 0xadc]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001eb81
sub esp, 0x10
mov esi, esp
push eax
push dword [ebp - 0x510]
lea ecx, [ebp - 0x4c8]
call fcn.10003be2
push eax
push esi
call fcn.10003622
push ecx
mov eax, esp
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x1d4]
push ecx
push eax
call fcn.10003622
add esp, 0xc
lea eax, [ebp - 0xaf0]
push eax
call fcn.1000138b
add esp, 0x44
push eax
lea ecx, [ebp - 0x524]
call fcn.10004bfe
lea ecx, [ebp - 0xaf0]
call fcn.10001cbd
lea ecx, [ebp - 0xadc]
call fcn.10001b82
xor edi, edi
lea ecx, [ebp - 0x524]
call fcn.10002bd5
test eax, eax
jbe 0x100472b1
push edi
lea ecx, [ebp - 0x524]
call fcn.10003be2
sub esp, 0x10
mov ecx, esp
push eax
call fcn.10001b35
call fcn.10004135
add esp, 0x10
test al, al
jne 0x1004729d
xor esi, esi
lea ecx, [ebp - 0x46c]
call fcn.10002bd5
test eax, eax
jbe 0x1004729d
push 0x1007db14
push esi
lea ecx, [ebp - 0x46c]
call fcn.10003be2
push eax
call fcn.100052df
pop ecx
pop ecx
test al, al
jne 0x1004727d
inc esi
lea ecx, [ebp - 0x46c]
call fcn.10002bd5
cmp esi, eax
jb 0x1004724e
jmp 0x1004729d
push edi
lea ecx, [ebp - 0x524]
call fcn.10003be2
push eax
push esi
lea ecx, [ebp - 0x46c]
call fcn.10003be2
mov ecx, eax
call fcn.10001b8a
inc edi
lea ecx, [ebp - 0x524]
call fcn.10002bd5
cmp edi, eax
jb 0x1004721a
push 1
push 0x12
lea eax, [ebp - 0xb04]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10029b10
push eax
lea eax, [ebp - 0xb14]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001dc84
push eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0xb24]
push eax
call fcn.10003622
add esp, 0xc
push eax
lea eax, [ebp - 0xb34]
push eax
call fcn.10003622
add esp, 0xc
mov ecx, eax
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x5c0]
call fcn.10001d04
lea ecx, [ebp - 0xb34]
call fcn.10001b82
lea ecx, [ebp - 0xb24]
call fcn.10001b82
lea ecx, [ebp - 0xb14]
call fcn.10001b82
lea ecx, [ebp - 0xb04]
call fcn.10001b82
lea ecx, [ebp - 0x5c0]
call fcn.10004d0b
test al, al
je 0x10047499
lea eax, [ebp - 0xb44]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001e2d5
push eax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0xb54]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001dc84
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0xb64]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10029cb6
push eax
push 6
lea eax, [ebp - 0xb74]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001e8e4
push eax
lea eax, [ebp - 0xb84]
push eax
call fcn.10003622
add esp, 0xc
push eax
lea eax, [ebp - 0xb94]
push eax
call fcn.10003622
add esp, 0xc
push eax
lea eax, [ebp - 0xba4]
push eax
call fcn.10003622
add esp, 0xc
push eax
lea eax, [ebp - 0xbb4]
push eax
call fcn.10003622
add esp, 0xc
push eax
lea eax, [ebp - 0xbc4]
push eax
call fcn.10003622
add esp, 0xc
push eax
lea eax, [ebp - 0xbd4]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001f2b7
push eax
lea eax, [ebp - 0x5c0]
push eax
call fcn.100052c5
pop ecx
pop ecx
lea ecx, [ebp - 0xbd4]
call fcn.10001b82
lea ecx, [ebp - 0xbc4]
call fcn.10001b82
lea ecx, [ebp - 0xbb4]
call fcn.10001b82
lea ecx, [ebp - 0xba4]
call fcn.10001b82
lea ecx, [ebp - 0xb94]
call fcn.10001b82
lea ecx, [ebp - 0xb84]
call fcn.10001b82
lea ecx, [ebp - 0xb74]
call fcn.10001b82
lea ecx, [ebp - 0xb64]
call fcn.10001b82
lea ecx, [ebp - 0xb54]
call fcn.10001b82
lea ecx, [ebp - 0xb44]
call fcn.10001b82
lea ecx, [ebp - 0x5c0]
call fcn.10001dc8
cmp byte [ebp - 0x158], 1
jne 0x1004766f
cmp byte [ebp - 0xcc], 1
jne 0x1004766f
sub esp, 0x10
push esp
lea ecx, [ebp - 0xc8]
call fcn.1002437f
sub esp, 0x10
push esp
lea ecx, [ebp - 0xc8]
call fcn.10023d4c
sub esp, 0x10
push esp
lea ecx, [ebp - 0xc8]
call fcn.1002411b
sub esp, 0x10
mov eax, esp
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x1d4]
push ecx
push eax
call fcn.10003622
add esp, 0xc
lea eax, [ebp - 0xbf4]
push eax
call fcn.1000138b
add esp, 0x44
push eax
lea ecx, [ebp - 0x248]
call fcn.10004bfe
lea ecx, [ebp - 0xbf4]
call fcn.10001cbd
lea eax, [ebp - 0xc04]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001dc84
push eax
push 5
lea eax, [ebp - 0xc14]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001e8e4
push eax
lea eax, [ebp - 0xc24]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001dc84
push eax
lea eax, [ebp - 0xc34]
push eax
call fcn.10003cd3
pop ecx
push eax
lea eax, [ebp - 0xc44]
push eax
call fcn.10003622
add esp, 0xc
push eax
lea eax, [ebp - 0xc54]
push eax
call fcn.10003622
add esp, 0xc
push eax
lea eax, [ebp - 0xc64]
push eax
call fcn.10003622
add esp, 0xc
push eax
lea ecx, [ebp - 0x3dc]
call fcn.10001b8a
lea ecx, [ebp - 0xc64]
call fcn.10001b82
lea ecx, [ebp - 0xc54]
call fcn.10001b82
lea ecx, [ebp - 0xc44]
call fcn.10001b82
lea ecx, [ebp - 0xc34]
call fcn.10001b82
lea ecx, [ebp - 0xc24]
call fcn.10001b82
lea ecx, [ebp - 0xc14]
call fcn.10001b82
lea ecx, [ebp - 0xc04]
call fcn.10001b82
lea ecx, [ebp - 0x3dc]
call fcn.10001ba2
push eax
call fcn.100045f0
sub esp, 0xc
mov ecx, esp
lea eax, [ebp - 0x3dc]
push eax
call fcn.10001b35
sub esp, 0x10
push esp
lea ecx, [ebp - 0xc8]
call fcn.10023d4c
sub esp, 0x10
push esp
lea ecx, [ebp - 0xc8]
call fcn.100247c7
sub esp, 0x10
mov eax, esp
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x1d4]
push ecx
push eax
call fcn.10003622
add esp, 0xc
lea eax, [ebp - 0xc84]
push eax
call fcn.1000138b
add esp, 0x44
push eax
lea ecx, [ebp - 0x238]
call fcn.10004bfe
lea ecx, [ebp - 0xc84]
call fcn.10001cbd
lea eax, [ebp - 0xc88]
push eax
lea ecx, [ebp - 0x534]
call fcn.10001b1d
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0x168]
push eax
call fcn.10001b35
lea eax, [ebp - 0x524]
push eax
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0x144]
push eax
call fcn.10001b35
lea eax, [ebp - 0xca0]
push eax
call fcn.10003d6a
add esp, 0x28
push eax
lea ecx, [ebp - 0x534]
call fcn.10001b8a
lea ecx, [ebp - 0xca0]
call fcn.10001b82
cmp byte [ebp - 0x158], 1
jne 0x100478ba
cmp byte [ebp - 0xcc], 1
jne 0x100478ba
lea eax, [ebp - 0x534]
push eax
lea ecx, [ebp - 0x430]
call fcn.10001b8a
lea eax, [ebp - 0xcb0]
push eax
lea ecx, [ebp - 0xc8]
call fcn.10024b5a
push eax
lea ecx, [ebp - 0x4a4]
call fcn.10001b8a
lea ecx, [ebp - 0xcb0]
call fcn.10001b82
lea eax, [ebp - 0xcc0]
push eax
lea ecx, [ebp - 0xc8]
call fcn.100237b1
push eax
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x3dc]
push eax
lea eax, [ebp - 0xcd0]
push eax
call fcn.10003622
add esp, 0xc
push eax
lea eax, [ebp - 0xce0]
push eax
call fcn.10003622
add esp, 0xc
push eax
lea ecx, [ebp - 0xac]
call fcn.10001b8a
lea ecx, [ebp - 0xce0]
call fcn.10001b82
lea ecx, [ebp - 0xcd0]
call fcn.10001b82
lea ecx, [ebp - 0xcc0]
call fcn.10001b82
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0xce8]
push eax
push 0x1007db14
call fcn.10001b5f
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0x430]
push eax
call fcn.10001b35
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0xac]
push eax
call fcn.10001b35
call fcn.100044e0
add esp, 0x30
lea eax, [ebp - 0xd00]
push eax
lea ecx, [ebp - 0xc8]
call fcn.100238b9
push eax
push 3
lea eax, [ebp - 0xd10]
push eax
lea ecx, [ebp - 0xc8]
call fcn.1001e8e4
push eax
lea eax, [ebp - 0x3dc]
push eax
lea eax, [ebp - 0xd20]
push eax
call fcn.10003622
add esp, 0xc
push eax
lea eax, [ebp - 0xd30]
push eax
call fcn.10003622
add esp, 0xc
push eax
lea ecx, [ebp - 0x420]
call fcn.10001b8a
lea ecx, [ebp - 0xd30]
call fcn.10001b82
lea ecx, [ebp - 0xd20]
call fcn.10001b82
lea ecx, [ebp - 0xd10]
call fcn.10001b82
lea ecx, [ebp - 0xd00]
call fcn.10001b82
push 0x12c
call fcn.10019508
sub esp, 0xc
mov ecx, esp
lea eax, [ebp - 0xac]
push eax
call fcn.10001b35
lea eax, [ebp - 0xd48]
push eax
lea ecx, [ebp - 0xc8]
call fcn.100237b1
sub esp, 0x10
mov ecx, esp
push eax
lea eax, [ebp - 0x4a4]
push eax
push ecx
call fcn.10003622
push ecx
mov ecx, esp
lea eax, [ebp - 0x420]
push eax
call fcn.10001b35
call fcn.10001054
add esp, 0x30
lea ecx, [ebp - 0xd48]
call fcn.10001b82
cmp byte [ebp - 0xcc], bl
jne 0x100478f5
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp - 0xd5c]
push eax
call fcn.10003622
add esp, 0xc
mov ecx, eax
call fcn.10001ba2
push eax
call fcn.100192ba
pop ecx
lea ecx, [ebp - 0xd5c]
call fcn.10001b82
lea ecx, [ebp - 0x524]
call fcn.10003bf3
lea ecx, [ebp - 0x534]
call fcn.10001b82
lea ecx, [ebp - 0x5c0]
call fcn.10001812
lea ecx, [ebp - 0x524]
call fcn.10001cbd
inc dword [ebp - 0x510]
lea ecx, [ebp - 0x508]
call fcn.10002bd5
cmp dword [ebp - 0x510], eax
jb 0x10046e12
lea ecx, [ebp - 0x4f8]
call fcn.10003bf3
lea ecx, [ebp - 0x4e8]
call fcn.10003bf3
lea ecx, [ebp - 0x4d8]
call fcn.10003bf3
lea ecx, [ebp - 0x508]
call fcn.10003bf3
lea ecx, [ebp - 0x4c8]
call fcn.10003bf3
lea ecx, [ebp - 0x4c8]
call fcn.10001cbd
lea ecx, [ebp - 0x508]
call fcn.10001cbd
lea ecx, [ebp - 0x4d8]
call fcn.10001cbd
lea ecx, [ebp - 0x4e8]
call fcn.10001cbd
lea ecx, [ebp - 0x4f8]
call fcn.10001cbd
inc dword [ebp - 0xb0]
lea ecx, [ebp - 0x100]
call fcn.10002bd5
cmp dword [ebp - 0xb0], eax
jb 0x10046978
cmp byte [ebp - 0x158], 1
jne 0x10047c02
xor esi, esi
lea ecx, [ebp - 0x46c]
call fcn.10002bd5
test eax, eax
jbe 0x10047a10
push 0x1007db14
push esi
lea ecx, [ebp - 0x46c]
call fcn.10003be2
push eax
call fcn.10005354
pop ecx
pop ecx
inc esi
lea ecx, [ebp - 0x46c]
call fcn.10002bd5
cmp esi, eax
jb 0x100479e7
xor esi, esi
lea ecx, [ebp - 0x46c]
call fcn.10002bd5
test eax, eax
jbe 0x10047a66
push 0x1007db14
push esi
lea ecx, [ebp - 0x46c]
call fcn.10003be2
push eax
call fcn.10005354
pop ecx
pop ecx
test al, al
je 0x10047a56
push esi
lea ecx, [ebp - 0x46c]
call fcn.10003be2
push eax
lea ecx, [ebp - 0x2c4]
call fcn.10001cec
inc esi
lea ecx, [ebp - 0x46c]
call fcn.10002bd5
cmp esi, eax
jb 0x10047a21
lea eax, [ebp - 0xd6c]
push eax
call fcn.10003cd3
pop ecx
push eax
lea ecx, [ebp - 0x220]
call fcn.10001b8a
lea ecx, [ebp - 0xd6c]
call fcn.10001b82
sub esp, 0x10
push esp
lea ecx, [ebp - 0xc8]
call fcn.10025089
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0x2c4]
push eax
call fcn.10001c78
lea eax, [ebp - 0xd84]
push eax
lea ecx, [ebp - 0xc8]
call fcn.100239c1
push eax
lea ecx, [ebp - 0x26c]
call fcn.10001b8a
lea ecx, [ebp - 0xd84]
call fcn.10001b82
sub esp, 0x10
push esp
lea ecx, [ebp - 0xc8]
call fcn.10025089
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0x248]
push eax
call fcn.10001c78
lea eax, [ebp - 0xd9c]
push eax
lea ecx, [ebp - 0xc8]
call fcn.100239c1
push eax
lea ecx, [ebp - 0x410]
call fcn.10001b8a
lea ecx, [ebp - 0xd9c]
call fcn.10001b82
sub esp, 0x10
push esp
lea ecx, [ebp - 0xc8]
call fcn.10025089
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0x238]
push eax
call fcn.10001c78
lea eax, [ebp - 0xdb4]
push eax
lea ecx, [ebp - 0xc8]
call fcn.100239c1
push eax
lea ecx, [ebp - 0x40]
call fcn.10001b8a
lea ecx, [ebp - 0xdb4]
call fcn.10001b82
lea ecx, [ebp - 0x40]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x410]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x26c]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x420]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x430]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0xac]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x3dc]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x1f8]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x4a4]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x220]
call fcn.10001ba2
push eax
lea ecx, [ebp - 0x440]
call fcn.10001ba2
push eax
call dword [ebp - 0x444]
push dword [ebp - 0x290]
call fcn.100065da
add esp, 0x30
lea ecx, [ebp - 0x2c4]
call fcn.10003bf3
lea ecx, [ebp - 0x100]
call fcn.10003bf3
lea ecx, [ebp - 0x46c]
call fcn.10003bf3
lea ecx, [ebp - 0x248]
call fcn.10003bf3
lea ecx, [ebp - 0x238]
call fcn.10003bf3
push ebx
push dword [ebp - 0x200]
call fcn.10018fb4
pop ecx
pop ecx
lea ecx, [ebp - 0x2c4]
call fcn.10001cbd
lea ecx, [ebp - 0x238]
call fcn.10001cbd
lea ecx, [ebp - 0x248]
call fcn.10001cbd
lea ecx, [ebp - 0x46c]
call fcn.10001cbd
lea ecx, [ebp - 0x50]
call fcn.10001b82
lea ecx, [ebp - 0x27c]
call fcn.10001b82
lea ecx, [ebp - 0x60]
call fcn.10001b82
lea ecx, [ebp - 0x144]
call fcn.10001b82
lea ecx, [ebp - 0x74]
call fcn.10001c34
lea ecx, [ebp - 0xdc]
call fcn.10001c34
lea ecx, [ebp - 0x154]
call fcn.10001b82
lea ecx, [ebp - 0x1d4]
call fcn.10001b82
lea ecx, [ebp - 0x28c]
call fcn.10001b82
lea ecx, [ebp - 0x28]
call fcn.10001b82
lea ecx, [ebp - 0x168]
call fcn.10001b82
lea ecx, [ebp - 0xec]
call fcn.10001b82
lea ecx, [ebp - 0x454]
call fcn.10001c34
lea ecx, [ebp - 0x258]
call fcn.10001b82
lea ecx, [ebp - 0x3f0]
call fcn.10001b82
lea ecx, [ebp - 0x84]
call fcn.10001b82
lea ecx, [ebp - 0x88]
call fcn.10067971
lea ecx, [ebp - 0x2c]
call fcn.10067971
lea ecx, [ebp - 0x474]
call fcn.10067971
lea ecx, [ebp - 0x100]
call fcn.10001cbd
lea ecx, [ebp - 0x110]
call fcn.10001cbd
lea ecx, [ebp - 0x1b4]
call fcn.10001cbd
lea ecx, [ebp - 0x1c4]
call fcn.10001b82
lea ecx, [ebp - 0x2a4]
call fcn.10001b82
lea ecx, [ebp - 0x210]
call fcn.10001b82
lea ecx, [ebp - 0x17c]
call fcn.10001b82
lea ecx, [ebp - 0x124]
call fcn.10001b82
lea ecx, [ebp - 0x18c]
call fcn.10001b82
lea ecx, [ebp - 0x19c]
call fcn.10001b82
lea ecx, [ebp - 0x400]
call fcn.10001b82
lea ecx, [ebp - 0x2b4]
call fcn.10001b82
lea ecx, [ebp - 0xc4]
call fcn.10001b82
lea ecx, [ebp - 0x134]
call fcn.10001b82
lea ecx, [ebp - 0x1e8]
call fcn.10001b82
lea ecx, [ebp - 0x9c]
call fcn.10001b82
lea ecx, [ebp - 0x3dc]
call fcn.10001b82
lea ecx, [ebp - 0x40]
call fcn.10001b82
lea ecx, [ebp - 0x410]
call fcn.10001b82
lea ecx, [ebp - 0x26c]
call fcn.10001b82
lea ecx, [ebp - 0x420]
call fcn.10001b82
lea ecx, [ebp - 0x430]
call fcn.10001b82
lea ecx, [ebp - 0xac]
call fcn.10001b82
lea ecx, [ebp - 0x1f8]
call fcn.10001b82
lea ecx, [ebp - 0x4a4]
call fcn.10001b82
lea ecx, [ebp - 0x220]
call fcn.10001b82
lea ecx, [ebp - 0x440]
call fcn.10001b82
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
push ebx
push dword [ebp - 0x200]
call fcn.10018fb4
pop ecx
pop ecx
lea ecx, [ebp - 0x4c8]
call fcn.10001cbd
lea ecx, [ebp - 0x508]
call fcn.10001cbd
lea ecx, [ebp - 0x4d8]
call fcn.10001cbd
lea ecx, [ebp - 0x4e8]
call fcn.10001cbd
lea ecx, [ebp - 0x4f8]
call fcn.10001cbd
jmp 0x10047c3c
push ebx
push dword [ebp - 0x200]
call fcn.10018fb4
pop ecx
pop ecx
lea ecx, [ebp - 0x5d4]
call fcn.10001c34
lea ecx, [ebp - 0x5e4]
call fcn.10001c34
jmp 0x10047e6d
push ebx
call fcn.1004effb
push esi
mov esi, ecx
push 0xc
call fcn.10067c2a
test eax, eax
pop ecx
je 0x10047ef1
push dword [esp + 8]
mov ecx, eax
call fcn.10047f30
jmp 0x10047ef3
xor eax, eax
test eax, eax
mov dword [esi], eax
jne 0x10047f03
push 0x8007000e
call fcn.100667f5
mov eax, esi
pop esi
ret 4