Function at 0x10047cc7
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008edfd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb04
and dword [ebp - 0x18], 0
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004cbd9
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x6ac], 0xfffffff7
mov dword [ebp - 0x6a8], 0xfffffff7
mov dword [ebp - 0x6a4], 0xfffffff7
mov dword [ebp - 0x6a0], 0xfffffff7
mov dword [ebp - 0x218], 0x9adb8213
mov dword [ebp - 0x310], 7
mov dword [ebp - 0x794], 0xffffffff
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x6ac]
cmp dword [ebp + eax - 0x6ac], ecx
jge 0x10047d69
mov dword [ebp - 0x724], 1
jmp 0x10047d70
and dword [ebp - 0x724], 0
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x6ac]
cmp dword [ebp + eax - 0x6ac], ecx
jne 0x10047d98
mov dword [ebp - 0x654], 1
jmp 0x10047d9f
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x218]
add eax, dword [ebp - 0x654]
jne 0x10047dbf
cmp dword [ebp - 0x218], 0
jne 0x10047dbf
and dword [ebp - 0x634], 0
jmp 0x10047dc9
mov dword [ebp - 0x634], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x6ac]
cmp eax, dword [ebp - 0x634]
jg 0x10047df3
cmp dword [ebp - 0x218], 0
je 0x10047df3
mov dword [ebp - 0x63c], 1
jmp 0x10047dfa
and dword [ebp - 0x63c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x6ac]
cmp dword [ebp - 0x63c], eax
jl 0x10047e1b
mov dword [ebp - 0x670], 1
jmp 0x10047e22
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x8f4], eax
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x93c], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x6ac]
imul eax, dword [ebp - 0x310]
imul eax, eax, 0
cmp eax, 0x5052061f
jl 0x10047e70
mov dword [ebp - 0x678], 1
jmp 0x10047e77
and dword [ebp - 0x678], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x6ac]
cmp dword [ebp - 0x678], eax
jne 0x10047e98
mov dword [ebp - 0x69c], 1
jmp 0x10047e9f
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x69c]
mov dword [ebp - 0x794], eax
push 0x2bbe
push 0
call fcn.100475d2
pop ecx
pop ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x538], 0xfffffff9
mov dword [ebp - 0x220], 0
jmp 0x10047ee5
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 1
jge 0x10047f01
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0x14c], 0xd313dd33
jmp 0x10047ed8
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x14c], 0xffffffe7
jmp 0x10047f2f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x14c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14c], 5
jne 0x10048060
mov dword [ebp - 0x90], 0x94b2
mov dword [ebp - 0x5dc], 0xfffffff7
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x90], eax
jge 0x10047f71
mov dword [ebp - 0x79c], 1
jmp 0x10047f78
and dword [ebp - 0x79c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14c]
cmp dword [ebp - 0x90], eax
jge 0x10047f99
mov dword [ebp - 0x664], 1
jmp 0x10047fa0
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x90]
imul eax, dword [ebp - 0x664]
cmp eax, dword [ebp - 0x90]
jge 0x10047fc1
mov dword [ebp - 0x7a4], 1
jmp 0x10047fc8
and dword [ebp - 0x7a4], 0
cmp dword [ebp - 0x90], 0x6e700d62
jge 0x10047fe0
mov dword [ebp - 0x7ac], 1
jmp 0x10047fe7
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x978], eax
mov eax, 0x76fda024
test eax, eax
je 0x10048045
mov dword [ebp - 0x7b4], 9
cmp dword [ebp - 0x90], 0
jne 0x10048021
cmp dword [ebp - 0x7b4], 0
jne 0x10048021
and dword [ebp - 0x694], 0
jmp 0x1004802b
mov dword [ebp - 0x694], 1
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x538], eax
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x5dc], eax
jmp 0x1004805b
push 1
lea eax, [ebp - 0x5dc]
push eax
push 0x33ab
call fcn.10047417
add esp, 0xc
jmp 0x10047f14
mov eax, dword [ebp - 0x36c]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10048075
jmp 0x1004cc06
mov dword [ebp - 0x228], 0
jmp 0x1004808e
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 1
jge 0x100480aa
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0x944], 0xffff
jmp 0x10048081
mov byte [ebp - 0xe3], 0
movzx eax, byte [ebp - 0xe3]
test eax, eax
je 0x100480c4
push 1
call fcn.10047457
pop ecx
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x100480de
push 1
call fcn.1004748a
pop ecx
mov eax, dword [ebp - 0x36c]
mov ecx, dword [ebp - 0x34]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc8], ecx
mov dword [ebp - 0x154], 0x22a19820
mov dword [ebp - 0xec], 4
mov dword [ebp - 0x230], 0
jmp 0x1004811d
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 1
jge 0x10048136
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x48], 0x94a1
jmp 0x10048110
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x48], 1
jl 0x1004814f
mov dword [ebp - 0x5e4], 1
jmp 0x10048156
and dword [ebp - 0x5e4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5e4]
sub ecx, 0x62231068
cmp dword [ebp + eax - 0x48], ecx
jge 0x1004817a
mov dword [ebp - 0x374], 1
jmp 0x10048181
and dword [ebp - 0x374], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x374], eax
jle 0x1004819f
mov dword [ebp - 0x5ec], 1
jmp 0x100481a6
and dword [ebp - 0x5ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x5ec], eax
jle 0x100481c4
mov dword [ebp - 0x37c], 1
jmp 0x100481cb
and dword [ebp - 0x37c], 0
cmp dword [ebp - 0x37c], 0x37aced45
jl 0x100481e3
mov dword [ebp - 0x5f4], 1
jmp 0x100481ea
and dword [ebp - 0x5f4], 0
cmp dword [ebp - 0x5f4], 0
jge 0x100481ff
mov dword [ebp - 0x384], 1
jmp 0x10048206
and dword [ebp - 0x384], 0
cmp dword [ebp - 0x384], 0x28de637c
jne 0x1004821e
mov dword [ebp - 0x5fc], 1
jmp 0x10048225
and dword [ebp - 0x5fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp eax, dword [ebp - 0x5fc]
jl 0x10048612
mov dword [ebp - 0x58], 8
mov dword [ebp - 0x85c], 0xe11cd4ee
mov dword [ebp - 0x858], 0xe11cd4ee
mov dword [ebp - 0x854], 0xe11cd4ee
mov dword [ebp - 0x850], 0xe11cd4ee
mov dword [ebp - 0x7bc], 0x9b704dcf
mov dword [ebp - 0x58], 0xffffffe9
jmp 0x10048284
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0x17
je 0x10048514
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x20], 0
jmp 0x100482a5
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jg 0x10048316
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp + ecx*4 - 0x48]
cmp dword [ebp + eax*4 - 0x48], ecx
je 0x100482c7
mov dword [ebp - 0x38c], 1
jmp 0x100482ce
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x48]
cmp dword [ebp - 0x38c], eax
jne 0x100482fe
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x48], 0
jne 0x100482eb
cmp dword [ebp - 0x58], 0
xor eax, eax
inc eax
cmp eax, 0xffff
jae 0x100482fe
and dword [ebp - 0x604], 0
jmp 0x10048308
mov dword [ebp - 0x604], 1
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x154], eax
jmp 0x1004829e
mov dword [ebp - 0x20], 0
jmp 0x10048326
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jg 0x1004850f
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x154]
cmp dword [ebp + eax*4 - 0x48], ecx
jg 0x1004834b
mov dword [ebp - 0x3b8], 1
jmp 0x10048352
and dword [ebp - 0x3b8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x154]
cmp dword [ebp + eax - 0x48], ecx
jne 0x10048373
cmp dword [ebp - 0x58], 0
jne 0x10048373
and dword [ebp - 0x394], 0
jmp 0x1004837d
mov dword [ebp - 0x394], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x394], eax
je 0x10048394
mov dword [ebp - 0x60c], 1
jmp 0x1004839b
and dword [ebp - 0x60c], 0
cmp dword [ebp - 0x60c], 0xfffffff6
jne 0x100483b0
mov dword [ebp - 0x39c], 1
jmp 0x100483b7
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x39c]
sub eax, dword [ebp - 0x154]
imul eax, dword [ebp - 0xec]
imul eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x58]
je 0x100483df
mov dword [ebp - 0x614], 1
jmp 0x100483e6
and dword [ebp - 0x614], 0
cmp dword [ebp - 0x614], 1
jae 0x100483fb
mov dword [ebp - 0x3a4], 1
jmp 0x10048402
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x3a4]
lea eax, [ecx + eax - 0xa34]
neg eax
cmp eax, dword [ebp - 0x58]
jle 0x10048425
mov dword [ebp - 0x61c], 1
jmp 0x1004842c
and dword [ebp - 0x61c], 0
cmp dword [ebp - 0x61c], 0xfffffffa
jle 0x10048441
mov dword [ebp - 0x3ac], 1
jmp 0x10048448
and dword [ebp - 0x3ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x3ac], eax
jle 0x10048466
mov dword [ebp - 0x624], 1
jmp 0x1004846d
and dword [ebp - 0x624], 0
cmp dword [ebp - 0x624], 1
jne 0x10048482
mov dword [ebp - 0x62c], 1
jmp 0x10048489
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x48]
cmp eax, dword [ebp - 0x62c]
jne 0x100484a4
mov dword [ebp - 0x324], 1
jmp 0x100484ab
and dword [ebp - 0x324], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x324]
mov dword [ebp + eax - 0x85c], ecx
mov eax, dword [ebp - 0x3b8]
cmp eax, dword [ebp - 0x324]
jle 0x100484d8
mov dword [ebp - 0x65c], 1
jmp 0x100484df
and dword [ebp - 0x65c], 0
cmp dword [ebp - 0x65c], 0xb69e0d94
jae 0x100484f7
mov dword [ebp - 0x3c0], 1
jmp 0x100484fe
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x7bc], eax
jmp 0x1004831f
jmp 0x1004827d
mov dword [ebp - 0xec], 3
jmp 0x1004852d
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x10048610
mov dword [ebp - 0x32c], 0xd3eafca1
mov dword [ebp - 0x7c4], 1
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x32c]
cmp dword [ebp - 0x32c], eax
jge 0x1004856b
mov dword [ebp - 0x540], 1
jmp 0x10048572
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x154]
neg eax
jne 0x100485a3
mov eax, dword [ebp - 0x32c]
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x85c]
lea eax, [eax + ecx + 0xdda6]
test eax, eax
jne 0x100485a3
and dword [ebp - 0x3c8], 0
jmp 0x100485ad
mov dword [ebp - 0x3c8], 1
mov eax, dword [ebp - 0x540]
cmp eax, dword [ebp - 0x3c8]
jge 0x100485c7
mov dword [ebp - 0x334], 1
jmp 0x100485ce
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x334]
mov dword [ebp + eax*4 - 0x85c], ecx
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x334], eax
jl 0x100485f8
mov dword [ebp - 0x600], 1
jmp 0x100485ff
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0x7c4], eax
jmp 0x10048520
jmp 0x10048629
mov byte [ebp - 0xe2], 0
lea eax, [ebp - 0xe2]
push eax
push 1
call fcn.100474ae
pop ecx
pop ecx
mov eax, dword [ebp - 0xc8]
cmp dword [eax], 0x4550
je 0x1004863c
jmp 0x1004cc06
mov dword [ebp - 0x3e8], 0x99fb023e
mov dword [ebp - 0x608], 0x5dae5a60
mov dword [ebp - 0x15c], 0xa2215256
mov dword [ebp - 0x2c], 0
jmp 0x1004866a
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x10048680
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x86c], 1
jmp 0x10048663
mov dword [ebp - 0x2c], 0
jmp 0x10048690
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x100486a6
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x9b8], 1
jmp 0x10048689
mov dword [ebp - 0x2c], 0
jmp 0x100486b6
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x100486cc
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x9dc], 0xa48a2b8e
jmp 0x100486af
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x9b8], 0xffffffff
or eax, 0xffffffff
jne 0x100487c2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x86c], 0x24307a32
jne 0x10048704
mov dword [ebp - 0x3d0], 1
jmp 0x1004870b
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x15c]
cmp eax, dword [ebp - 0x3d0]
jge 0x10048725
mov dword [ebp - 0x548], 1
jmp 0x1004872c
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x548], eax
jne 0x10048746
mov dword [ebp - 0x3d8], 1
jmp 0x1004874d
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x15c]
imul eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffff
jg 0x10048775
mov dword [ebp - 0x660], 1
jmp 0x1004877c
and dword [ebp - 0x660], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x86c]
cmp dword [ebp - 0x660], eax
jle 0x1004879d
mov dword [ebp - 0x3e0], 1
jmp 0x100487a4
and dword [ebp - 0x3e0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x86c]
cmp dword [ebp - 0x3e0], eax
jge 0x100487c2
and dword [ebp - 0x550], 0
jmp 0x100487cc
mov dword [ebp - 0x550], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x86c]
cmp dword [ebp - 0x550], eax
jle 0x100487ec
mov dword [ebp - 0x3f0], 1
jmp 0x100487f3
and dword [ebp - 0x3f0], 0
mov dword [ebp - 0x3e8], 0xfb6318d5
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x608], eax
mov eax, dword [ebp - 0x608]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x86c]
cmp eax, dword [ebp - 0x3f0]
jle 0x10048830
mov dword [ebp - 0x33c], 1
jmp 0x10048837
and dword [ebp - 0x33c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x33c]
mov dword [ebp + eax - 0x86c], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x33c]
mov dword [ebp + eax - 0x9dc], ecx
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc8]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x28], 0xe8cff0ea
mov dword [ebp - 0x60], 0xfffffff7
mov dword [ebp - 0x810], 0x3f2a
mov dword [ebp - 0x214], 0
jmp 0x100488a1
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 3
jge 0x100488bd
mov eax, dword [ebp - 0x214]
mov dword [ebp + eax*4 - 0x6c8], 0x5f07c70a
jmp 0x10048894
mov dword [ebp - 0x28], 0
jmp 0x100488cd
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffeb
jne 0x100489df
mov dword [ebp - 0x7cc], 0x54db
mov dword [ebp - 0x7d4], 0x714ffd81
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x9a0], eax
cmp dword [ebp - 0x7cc], 0
jne 0x1004890f
mov eax, 0x890c
test eax, eax
jne 0x1004890f
and dword [ebp - 0x558], 0
jmp 0x10048919
mov dword [ebp - 0x558], 1
mov eax, dword [ebp - 0x558]
sub eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x28]
jg 0x10048933
mov dword [ebp - 0x344], 1
jmp 0x1004893a
and dword [ebp - 0x344], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x344]
mov dword [ebp + eax - 0x6c8], ecx
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x344], eax
jl 0x10048964
mov dword [ebp - 0x3f8], 1
jmp 0x1004896b
and dword [ebp - 0x3f8], 0
cmp dword [ebp - 0x3f8], 0xa4c9
jl 0x10048983
mov dword [ebp - 0x668], 1
jmp 0x1004898a
and dword [ebp - 0x668], 0
mov dword [ebp - 0x60], 1
mov eax, dword [ebp - 0x60]
sub eax, dword [ebp - 0x668]
cmp dword [ebp - 0x28], eax
jg 0x100489ab
mov dword [ebp - 0x400], 1
jmp 0x100489b2
and dword [ebp - 0x400], 0
cmp dword [ebp - 0x400], 0xfffffff7
je 0x100489c7
mov dword [ebp - 0x560], 1
jmp 0x100489ce
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0x7d4], eax
jmp 0x100488c6
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x408], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x408]
mov dword [ebp + eax - 0x6c8], ecx
cmp dword [ebp - 0x408], 0
je 0x10048a57
mov dword [ebp - 0x60], 2
jmp 0x10048a14
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x10048a52
mov dword [ebp - 0x7dc], 0xbbd4856c
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0x6c8]
mov dword [ebp - 0x610], eax
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x610]
mov dword [ebp + eax*4 - 0x6c8], ecx
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x7dc], eax
jmp 0x10048a0d
jmp 0x10048b98
mov dword [ebp - 0x7c], 0
jmp 0x10048a67
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x10048a7d
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x800], 5
jmp 0x10048a60
mov dword [ebp - 0x7c], 0
jmp 0x10048a8d
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x10048aa3
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x808], 0x752e4a6b
jmp 0x10048a86
mov dword [ebp - 0x28], 2
jmp 0x10048ab3
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x10048b88
mov dword [ebp - 0x7f8], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6c8]
mov dword [ebp - 0x8f8], eax
mov eax, dword [ebp - 0x7f8]
mov dword [ebp - 0x410], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x410]
mov dword [ebp + eax - 0x800], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x808]
cmp dword [ebp - 0x410], eax
jge 0x10048b1a
mov dword [ebp - 0x568], 1
jmp 0x10048b21
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x568]
jne 0x10048b38
mov dword [ebp - 0x418], 1
jmp 0x10048b3f
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x60]
dec eax
cmp dword [ebp - 0x418], eax
jg 0x10048b57
mov dword [ebp - 0x68c], 1
jmp 0x10048b5e
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x68c]
mov dword [ebp + eax*4 - 0x6c8], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6c8], 0
je 0x10048b83
jmp 0x10048aac
jmp 0x10048aac
push 1
lea eax, [ebp - 0x810]
push eax
call fcn.10047535
pop ecx
pop ecx
mov eax, dword [ebp - 0x54]
cmp dword [eax + 4], 0
jne 0x10048ba6
jmp 0x1004cc06
and dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0xc8]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xc8]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x438], 0x99fb023e
mov dword [ebp - 0x66c], 0x5dae5a60
mov dword [ebp - 0x144], 0xa2215256
mov dword [ebp - 0x38], 0
jmp 0x10048bf2
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x10048c08
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x87c], 1
jmp 0x10048beb
mov dword [ebp - 0x38], 0
jmp 0x10048c18
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x10048c2e
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x9c4], 1
jmp 0x10048c11
mov dword [ebp - 0x38], 0
jmp 0x10048c3e
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x10048c54
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x9d0], 0xa48a2b8e
jmp 0x10048c37
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x9c4], 0xffffffff
or eax, 0xffffffff
jne 0x10048d4a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x87c], 0x24307a32
jne 0x10048c8c
mov dword [ebp - 0x420], 1
jmp 0x10048c93
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x144]
cmp eax, dword [ebp - 0x420]
jge 0x10048cad
mov dword [ebp - 0x570], 1
jmp 0x10048cb4
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x570], eax
jne 0x10048cce
mov dword [ebp - 0x428], 1
jmp 0x10048cd5
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x144]
imul eax, dword [ebp - 0x428]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffff
jg 0x10048cfd
mov dword [ebp - 0x618], 1
jmp 0x10048d04
and dword [ebp - 0x618], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x87c]
cmp dword [ebp - 0x618], eax
jle 0x10048d25
mov dword [ebp - 0x430], 1
jmp 0x10048d2c
and dword [ebp - 0x430], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x87c]
cmp dword [ebp - 0x430], eax
jge 0x10048d4a
and dword [ebp - 0x578], 0
jmp 0x10048d54
mov dword [ebp - 0x578], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x87c]
cmp dword [ebp - 0x578], eax
jle 0x10048d74
mov dword [ebp - 0x440], 1
jmp 0x10048d7b
and dword [ebp - 0x440], 0
mov dword [ebp - 0x438], 0xfb6318d5
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 0x66c]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x87c]
cmp eax, dword [ebp - 0x440]
jle 0x10048db8
mov dword [ebp - 0x34c], 1
jmp 0x10048dbf
and dword [ebp - 0x34c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x34c]
mov dword [ebp + eax - 0x87c], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x34c]
mov dword [ebp + eax - 0x9d0], ecx
and dword [ebp - 0x354], 0
jmp 0x10048e0a
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0xd0]
add eax, 0x28
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xc8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x354], eax
jge 0x10048e86
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x580], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x580]
jb 0x10048e81
mov eax, dword [ebp - 0xc8]
push dword [eax + 0x38]
mov eax, dword [ebp - 0xd0]
push dword [eax + 8]
call fcn.100473e8
pop ecx
pop ecx
add eax, dword [ebp - 0x580]
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x818]
jae 0x10048e81
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0xd0]
mov eax, dword [eax + 0x14]
sub eax, dword [ecx + 0xc]
mov dword [ebp - 0x3c], eax
jmp 0x10048e86
jmp 0x10048dee
cmp dword [ebp - 0x3c], 0
jne 0x10048e91
jmp 0x1004cc06
mov dword [ebp - 0x78], 0x949d
mov dword [ebp - 0x35c], 0xcc25fa5f
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x70], 1
mov dword [ebp - 0x30c], 0x5ee6d54e
mov dword [ebp - 0x308], 0x5ee6d54e
mov dword [ebp - 0x304], 0x5ee6d54e
mov dword [ebp - 0x300], 0x5ee6d54e
mov dword [ebp - 0x1e0], 0
jmp 0x10048ef1
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 1
jge 0x10048f0d
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0xdc], 0xa63a
jmp 0x10048ee4
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x900], eax
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x78], eax
je 0x10048f2a
mov dword [ebp - 0x448], 1
jmp 0x10048f31
and dword [ebp - 0x448], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdc]
cmp dword [ebp - 0x448], eax
je 0x10048f52
mov dword [ebp - 0x620], 1
jmp 0x10048f59
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x78]
sub eax, dword [ebp - 0x620]
add eax, dword [ebp - 0x78]
mov dword [ebp - 0x44], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdc]
cmp dword [ebp - 0x44], eax
jl 0x10048f86
mov dword [ebp - 0x450], 1
jmp 0x10048f8d
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x450]
jg 0x10048fa4
mov dword [ebp - 0x820], 1
jmp 0x10048fab
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x8bc], eax
imul eax, dword [ebp - 0x44], 0x1e60
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xdc]
jge 0x10048fd6
mov dword [ebp - 0x840], 1
jmp 0x10048fdd
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x8c4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdc]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0xdc]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xdc]
jg 0x1004902c
or eax, 0xffffffff
je 0x1004902c
mov dword [ebp - 0x588], 1
jmp 0x10049033
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xfffffffc
jle 0x1004904e
mov dword [ebp - 0x458], 1
jmp 0x10049055
and dword [ebp - 0x458], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x458]
mov dword [ebp + eax - 0x30c], ecx
mov dword [ebp - 0x44], 3
jmp 0x10049078
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x1004935a
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x30c]
mov dword [ebp + ecx*4 - 0x30c], eax
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x100490b0
push 1
call fcn.1004756a
pop ecx
mov dword [ebp - 0x70], 3
jmp 0x100490c0
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x10049355
mov dword [ebp - 0xf4], 0x29bfaead
mov dword [ebp - 0x11c], 0xf7977f45
mov eax, dword [ebp - 0xf4]
inc eax
jne 0x10049185
cmp dword [ebp - 0xf4], 0
je 0x10049115
mov dword [ebp - 0x11c], 0xffffcc2d
imul eax, dword [ebp - 0x11c], 0xfffffff7
test eax, eax
je 0x10049115
mov dword [ebp - 0x690], 1
jmp 0x1004911c
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x690]
sub eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0xf4]
je 0x10049139
mov dword [ebp - 0x460], 1
jmp 0x10049140
and dword [ebp - 0x460], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x30c]
imul eax, dword [ebp - 0x460]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x30c]
jge 0x1004916f
mov dword [ebp - 0x81c], 1
jmp 0x10049176
and dword [ebp - 0x81c], 0
cmp dword [ebp - 0x70], 0
jne 0x10049185
and dword [ebp - 0x590], 0
jmp 0x1004918f
mov dword [ebp - 0x590], 1
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0x590]
jg 0x100491a9
mov dword [ebp - 0x468], 1
jmp 0x100491b0
and dword [ebp - 0x468], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x468]
sub ecx, dword [ebp + eax - 0x30c]
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x30c], ecx
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x8cc], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x30c]
cmp dword [ebp - 0x11c], eax
jne 0x100491f7
mov dword [ebp - 0x628], 1
jmp 0x100491fe
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x628]
inc eax
inc eax
je 0x1004921d
cmp dword [ebp - 0xf4], 0
je 0x1004921d
mov dword [ebp - 0x470], 1
jmp 0x10049224
and dword [ebp - 0x470], 0
cmp dword [ebp - 0x470], 0xd6799626
jne 0x10049246
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x30c], 0
jne 0x10049246
and dword [ebp - 0x598], 0
jmp 0x10049250
mov dword [ebp - 0x598], 1
mov eax, dword [ebp - 0x35c]
cmp eax, dword [ebp - 0x598]
jl 0x1004926a
mov dword [ebp - 0x478], 1
jmp 0x10049271
and dword [ebp - 0x478], 0
cmp dword [ebp - 0x478], 0
jb 0x1004928c
mov eax, 0xaa9b
test eax, eax
jne 0x1004928c
and dword [ebp - 0x674], 0
jmp 0x10049296
mov dword [ebp - 0x674], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdc]
cmp dword [ebp - 0x674], eax
jge 0x100492b7
mov dword [ebp - 0x480], 1
jmp 0x100492be
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp + eax*4 - 0x30c]
cmp dword [ebp - 0x480], eax
jl 0x100492dc
mov dword [ebp - 0x5a0], 1
jmp 0x100492e3
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x30c]
cmp dword [ebp - 0x5a0], eax
jg 0x10049301
mov dword [ebp - 0x488], 1
jmp 0x10049308
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp + ecx*4 - 0x30c]
imul ecx, dword [ebp - 0x488]
cmp dword [ebp + eax*4 - 0x30c], ecx
jle 0x1004933a
cmp dword [ebp - 0x11c], 0
je 0x1004933a
mov dword [ebp - 0x630], 1
jmp 0x10049341
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x630]
add eax, 0xa
mov dword [ebp - 0x11c], eax
jmp 0x100490b9
jmp 0x10049071
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x3c]
add ecx, dword [eax]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x9c], 0xe5ccc90a
mov dword [ebp - 0x194], 0
jmp 0x1004938b
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 4
jge 0x100493a7
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x88c], 0xf75dcec3
jmp 0x1004937e
mov dword [ebp - 0x9c], 0
jmp 0x100493c0
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jg 0x1004953a
mov dword [ebp - 0x318], 0x498e64e6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x88c], 0
je 0x10049483
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88c]
mov dword [ebp - 0x8d4], eax
cmp dword [ebp - 0x318], 0xe3f1
jle 0x10049416
mov dword [ebp - 0x490], 1
jmp 0x1004941d
and dword [ebp - 0x490], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x88c]
cmp dword [ebp - 0x490], eax
je 0x10049444
cmp dword [ebp - 0x9c], 0
jne 0x10049444
and dword [ebp - 0x844], 0
jmp 0x1004944e
mov dword [ebp - 0x844], 1
mov eax, 0xa10dd664
cmp eax, 0x7a912e75
jbe 0x10049466
mov dword [ebp - 0x5a8], 1
jmp 0x1004946d
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x5a8]
neg eax
je 0x10049483
mov dword [ebp - 0x498], 1
jmp 0x1004948a
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0x498]
je 0x100494a4
mov dword [ebp - 0x644], 1
jmp 0x100494ab
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x318]
cmp eax, dword [ebp - 0x644]
je 0x100494de
mov eax, 0xffff
test eax, eax
je 0x100494de
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x88c], 0
je 0x100494de
mov dword [ebp - 0x4a0], 1
jmp 0x100494e5
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0x4a0], eax
jl 0x100494ff
mov dword [ebp - 0x5b0], 1
jmp 0x10049506
and dword [ebp - 0x5b0], 0
cmp dword [ebp - 0x5b0], 0xffffffff
jge 0x1004951b
mov dword [ebp - 0x4a8], 1
jmp 0x10049522
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x4a8]
mov dword [ebp + eax*4 - 0x88c], ecx
jmp 0x100493b3
xor ecx, ecx
call fcn.100311ea
push eax
call fcn.100743f8
pop ecx
mov dword [ebp - 0x100], 4
mov dword [ebp - 0xa8], 1
mov dword [ebp - 0x150], 0xffffffff
mov dword [ebp - 0x100], 0
jmp 0x1004957f
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0xffffffe7
jle 0x100497ac
mov dword [ebp - 0xa0], 0x1f665683
mov dword [ebp - 0xa0], 0xfffffff2
jmp 0x100495af
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 9
jle 0x100497a7
mov dword [ebp - 0x4b0], 0xfffffffb
mov dword [ebp - 0x730], 0xf58cdc14
mov dword [ebp - 0x1e8], 0
jmp 0x100495e9
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jge 0x10049605
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0x78c], 0xcbfc
jmp 0x100495dc
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x8dc], eax
mov eax, dword [ebp - 0xa8]
sub eax, 7
imul eax, eax, 0x3cb5
add eax, 3
sub eax, dword [ebp - 0xa0]
jne 0x10049640
cmp dword [ebp - 0xa0], 0
je 0x10049655
mov eax, 0x3ca3
test eax, eax
je 0x10049655
mov dword [ebp - 0x638], 1
jmp 0x1004965c
and dword [ebp - 0x638], 0
cmp dword [ebp - 0x638], 0x6f49
jg 0x1004966f
cmp dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x8e4], eax
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x940], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x948], eax
mov eax, 0xee67
test eax, eax
je 0x100496b1
cmp dword [ebp - 0x150], 0
je 0x100496b1
mov dword [ebp - 0x5b8], 1
jmp 0x100496b8
and dword [ebp - 0x5b8], 0
cmp dword [ebp - 0x5b8], 0xd955a619
jb 0x100496d0
mov dword [ebp - 0x4b8], 1
jmp 0x100496d7
and dword [ebp - 0x4b8], 0
cmp dword [ebp - 0x4b8], 0x6e7f737a
jg 0x100496ef
mov dword [ebp - 0x648], 1
jmp 0x100496f6
and dword [ebp - 0x648], 0
cmp dword [ebp - 0x648], 0xfffffffe
je 0x1004972d
mov byte [ebp - 0xe7], 0
movzx eax, byte [ebp - 0xe7]
test eax, eax
je 0x1004972b
push 0x1d97
push 0x2048
push 0xe39
push 0x1e14
call dword [sym.imp.GDI32.dll_CreateRectRgn]
jmp 0x100497a2
mov dword [ebp - 0x150], 0
jmp 0x10049746
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0x21
jl 0x100497a2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78c]
mov dword [ebp - 0x730], eax
mov dword [ebp - 0xa8], 0
jmp 0x1004977b
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x11
jl 0x100497a0
mov byte [ebp - 0xe4], 0
movzx eax, byte [ebp - 0xe4]
test eax, eax
je 0x1004979e
push 1
call fcn.10047596
pop ecx
jmp 0x1004976e
jmp 0x10049739
jmp 0x100495a2
jmp 0x10049572
mov byte [ebp - 0x288], 2
mov byte [ebp - 0x287], 0x89
mov byte [ebp - 0x286], 7
mov byte [ebp - 0x285], 1
mov byte [ebp - 0x284], 1
mov byte [ebp - 0x283], 3
mov byte [ebp - 0x282], 0x40
mov byte [ebp - 0x281], 0xc0
mov byte [ebp - 0x280], 0x85
mov byte [ebp - 0x27f], 0x2b
mov byte [ebp - 0x27e], 0x24
mov byte [ebp - 0x27d], 0x5f
mov byte [ebp - 0x27c], 0x46
mov byte [ebp - 0x27b], pe_nt_image_headers32
mov byte [ebp - 0x27a], 0x93
mov byte [ebp - 0x279], 0xbb
mov byte [ebp - 0x278], 0xed
mov byte [ebp - 0x277], 0x8a
mov byte [ebp - 0x276], 0x48
mov byte [ebp - 0x275], 0x88
mov byte [ebp - 0x274], 0x79
mov byte [ebp - 0x273], 0x79
mov byte [ebp - 0x272], 0xd
mov byte [ebp - 0x271], 0xbc
mov byte [ebp - 0x270], 0x3d
mov byte [ebp - 0x26f], 0xd7
mov byte [ebp - 0x26e], 0x86
mov byte [ebp - 0x26d], 0xc3
mov byte [ebp - 0x26c], 0x9e
mov byte [ebp - 0x26b], 0x40
mov byte [ebp - 0x26a], 0xd7
mov byte [ebp - 0x269], 0x2d
mov byte [ebp - 0x268], 0x59
mov byte [ebp - 0x267], 0x7c
mov byte [ebp - 0x266], 0x59
mov byte [ebp - 0x265], 0x85
mov byte [ebp - 0x264], 0xc4
mov byte [ebp - 0x263], 0x5a
mov byte [ebp - 0x262], 0xf5
mov byte [ebp - 0x261], 0x52
mov byte [ebp - 0x260], 0x29
mov byte [ebp - 0x25f], 0x2c
mov byte [ebp - 0x25e], 0xee
mov byte [ebp - 0x25d], 0x68
mov byte [ebp - 0x25c], 0x96
mov byte [ebp - 0x25b], 0x5b
mov byte [ebp - 0x25a], 0x79
mov byte [ebp - 0x259], 0x86
mov byte [ebp - 0x258], 0xda
mov byte [ebp - 0x257], 0x11
mov byte [ebp - 0x256], 0x98
mov byte [ebp - 0x255], 0xf3
mov byte [ebp - 0x254], 3
mov byte [ebp - 0x253], 0x51
mov byte [ebp - 0x252], 0x18
mov byte [ebp - 0x251], 0x8c
mov byte [ebp - 0x250], 0xf9
mov byte [ebp - 0x24f], 0x16
mov byte [ebp - 0x24e], 0x82
mov byte [ebp - 0x24d], 0xf5
mov byte [ebp - 0x24c], 0x40
mov byte [ebp - 0x24b], 0xcd
mov byte [ebp - 0x24a], 0x8b
mov byte [ebp - 0x249], 0x6d
mov byte [ebp - 0x248], 0xcf
mov byte [ebp - 0x247], 0xb3
mov byte [ebp - 0x246], 0xb7
mov byte [ebp - 0x245], 0x65
mov byte [ebp - 0x244], 0x93
mov byte [ebp - 0x243], 0
mov byte [ebp - 0x242], 0xc1
mov byte [ebp - 0x241], 8
mov byte [ebp - 0x240], 5
mov byte [ebp - 0x23f], 3
mov byte [ebp - 0x23e], 7
mov byte [ebp - 0x23d], 5
mov byte [ebp - 0x23c], 6
mov byte [ebp - 0x23b], 0
mov byte [ebp - 0x23a], 0
mov byte [ebp - 0x239], 6
mov byte [ebp - 0x238], 0
mov byte [ebp - 0x237], 4
mov byte [ebp - 0x236], 9
mov byte [ebp - 0x235], 9
mov byte [ebp - 0x234], 8
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x288]
or eax, 0xbe
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x288]
and ecx, 0xbe
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x288]
mov byte [ebp + ecx - 0x6d4], al
mov dword [ebp - 0x4c], 2
and dword [ebp - 0x19c], 0
jmp 0x10049a55
mov eax, dword [ebp - 0x4c]
inc eax
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x55
jae 0x10049b14
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x288]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x4c], eax
jne 0x10049a9f
mov eax, dword [ebp - 0x4c]
movzx eax, byte [ebp + eax - 0x288]
inc eax
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [ebp + eax - 0x288]
mov ecx, dword [ebp - 0x4c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x4c], eax
jmp 0x10049a4d
mov eax, dword [ebp - 0x4c]
movzx eax, byte [ebp + eax - 0x287]
mov ecx, dword [ebp - 0x4c]
sub ecx, dword [ebp - 0x19c]
movzx ecx, byte [ebp + ecx - 0x28a]
movsx ecx, byte [ebp + ecx - 0x6d4]
or eax, ecx
mov ecx, dword [ebp - 0x4c]
movzx ecx, byte [ebp + ecx - 0x287]
mov edx, dword [ebp - 0x4c]
sub edx, dword [ebp - 0x19c]
movzx edx, byte [ebp + edx - 0x28a]
movsx edx, byte [ebp + edx - 0x6d4]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x4c]
movzx ecx, byte [ebp + ecx - 0x288]
mov byte [ebp + ecx - 0x6d4], al
lea eax, [ebp - 0x19c]
push eax
push 1
call fcn.100475d2
pop ecx
pop ecx
jmp 0x10049a4d
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x6d4], 0
mov dword [ebp - 0x74], 0xb13638ec
mov dword [ebp - 0x1f0], 0
jmp 0x10049b42
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 3
jge 0x10049b5e
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0x898], 0xfffffffe
jmp 0x10049b35
mov dword [ebp - 0x74], 2
jmp 0x10049b6e
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jl 0x10049c6c
mov dword [ebp - 0xfc], 0xfbbd0a70
mov dword [ebp - 0x738], 0
cmp dword [ebp - 0xfc], 0
jne 0x10049bd3
xor eax, eax
jne 0x10049bab
cmp dword [ebp - 0xfc], 0
jne 0x10049bab
and dword [ebp - 0x4c0], 0
jmp 0x10049bb5
mov dword [ebp - 0x4c0], 1
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x4c0], eax
jle 0x10049bcc
mov dword [ebp - 0x5c0], 1
jmp 0x10049bd3
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x954], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x95c], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp + eax*4 - 0x898]
mov dword [ebp - 0x7c8], eax
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x7c8]
mov dword [ebp + eax*4 - 0x898], ecx
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x964], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x96c], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x974], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x97c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x898], 0x62c4
jge 0x10049c54
mov dword [ebp - 0x4c8], 1
jmp 0x10049c5b
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x738], eax
jmp 0x10049b67
lea eax, [ebp - 0x6d4]
push eax
lea ecx, [ebp - 0xa90]
call fcn.10026d91
mov dword [ebp - 0x814], eax
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0x740], eax
and dword [ebp - 4], 0
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x740]
call fcn.100311aa
pop ecx
mov dword [ebp - 0x7f0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa90]
call fcn.10017fc6
mov dword [ebp - 0x1a4], 0x13dd33a4
mov dword [ebp - 0x6bc], 0xfffffffe
mov dword [ebp - 0x6b8], 0xfffffffe
mov dword [ebp - 0x6b4], 0xfffffffe
mov dword [ebp - 0x6b0], 0xfffffffe
mov dword [ebp - 0x4f0], 0x4433ac25
mov dword [ebp - 0x1a4], 0
jmp 0x10049d0e
mov eax, dword [ebp - 0x1a4]
dec eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0xffffffe3
jl 0x10049f8d
mov dword [ebp - 0x720], 0xda585283
mov dword [ebp - 0x71c], 0xda585283
mov dword [ebp - 0x718], 0xda585283
mov dword [ebp - 0x714], 0xda585283
mov dword [ebp - 0x640], 4
mov dword [ebp - 0x4d0], 8
mov dword [ebp - 0x650], 0x7c4e7ccc
mov dword [ebp - 0x4f8], 0xb739032
mov dword [ebp - 0x748], 4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x720], 0
jne 0x10049f02
cmp dword [ebp - 0x640], 0
jne 0x10049f02
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x6bc], 0xffff
mov dword [ebp - 0x640], eax
mov dword [ebp - 0x4d0], 0xfffffffd
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x4f0], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x6bc], 0x612d
je 0x10049de2
mov dword [ebp - 0x5c8], 1
jmp 0x10049de9
and dword [ebp - 0x5c8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x720]
cmp dword [ebp - 0x5c8], eax
je 0x10049e0a
mov dword [ebp - 0x4d8], 1
jmp 0x10049e11
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x650], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6bc]
cmp dword [ebp - 0x650], eax
je 0x10049e3e
mov dword [ebp - 0x4e0], 1
jmp 0x10049e45
and dword [ebp - 0x4e0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4e0]
sub ecx, dword [ebp + eax - 0x720]
mov dword [ebp - 0x5d0], 1
jmp 0x10049e6b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x720]
imul eax, dword [ebp - 0x5d0]
cmp eax, 0xfffe
ja 0x10049e92
mov dword [ebp - 0x4e8], 1
jmp 0x10049e99
and dword [ebp - 0x4e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x720]
cmp dword [ebp - 0x4e8], eax
jge 0x10049eba
mov dword [ebp - 0x658], 1
jmp 0x10049ec1
and dword [ebp - 0x658], 0
cmp dword [ebp - 0x658], 7
jge 0x10049ed6
mov dword [ebp - 0x7d0], 1
jmp 0x10049edd
and dword [ebp - 0x7d0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x6bc]
mov dword [ebp - 0x984], eax
cmp dword [ebp - 0x4f0], 0
jne 0x10049f02
and dword [ebp - 0x5d8], 0
jmp 0x10049f0c
mov dword [ebp - 0x5d8], 1
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x4f8], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x6bc]
cmp dword [ebp - 0x4f8], eax
jg 0x10049f39
mov dword [ebp - 0x64c], 1
jmp 0x10049f40
and dword [ebp - 0x64c], 0
cmp dword [ebp - 0x64c], 0xb721
jge 0x10049f58
mov dword [ebp - 0x500], 1
jmp 0x10049f5f
and dword [ebp - 0x500], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x6bc]
push 4
pop ecx
shl ecx, 0
mov edx, dword [ebp - 0x500]
sub edx, dword [ebp + ecx - 0x6bc]
sub eax, edx
dec eax
mov dword [ebp - 0x748], eax
jmp 0x10049d01
and dword [ebp - 0x1f8], 0
jmp 0x10049fa3
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0xb
jae 0x10049fbc
mov eax, dword [ebp - 0x1f8]
mov byte [ebp + eax - 0x6d4], 0
jmp 0x10049f96
mov byte [ebp - 0x2f0], 6
mov byte [ebp - 0x2ef], 0xc2
mov byte [ebp - 0x2ee], 5
mov byte [ebp - 0x2ed], 8
mov byte [ebp - 0x2ec], 3
mov byte [ebp - 0x2eb], 3
mov byte [ebp - 0x2ea], 2
mov byte [ebp - 0x2e9], 5
mov byte [ebp - 0x2e8], 0
mov byte [ebp - 0x2e7], 6
mov byte [ebp - 0x2e6], 1
mov byte [ebp - 0x2e5], 7
mov byte [ebp - 0x2e4], 9
mov byte [ebp - 0x2e3], 6
mov byte [ebp - 0x2e2], 0x50
mov byte [ebp - 0x2e1], 0xed
mov byte [ebp - 0x2e0], 0x42
mov byte [ebp - 0x2df], 0x57
mov byte [ebp - 0x2de], 0x6b
mov byte [ebp - 0x2dd], 0xd1
mov byte [ebp - 0x2dc], 0x97
mov byte [ebp - 0x2db], 0x73
mov byte [ebp - 0x2da], 0xd4
mov byte [ebp - 0x2d9], 0x2e
mov byte [ebp - 0x2d8], 0xca
mov byte [ebp - 0x2d7], 0xc6
mov byte [ebp - 0x2d6], 0xb0
mov byte [ebp - 0x2d5], 0x28
mov byte [ebp - 0x2d4], 0x7b
mov byte [ebp - 0x2d3], 0x87
mov byte [ebp - 0x2d2], 0xed
mov byte [ebp - 0x2d1], 6
mov byte [ebp - 0x2d0], 0x56
mov byte [ebp - 0x2cf], 0xeb
mov byte [ebp - 0x2ce], 0xf3
mov byte [ebp - 0x2cd], 0x42
mov byte [ebp - 0x2cc], 0xaf
mov byte [ebp - 0x2cb], 0x70
mov byte [ebp - 0x2ca], 0x16
mov byte [ebp - 0x2c9], 0x2a
mov byte [ebp - 0x2c8], 0xef
mov byte [ebp - 0x2c7], 0x24
mov byte [ebp - 0x2c6], 0x94
mov byte [ebp - 0x2c5], 0x83
mov byte [ebp - 0x2c4], 0x79
mov byte [ebp - 0x2c3], 0
mov byte [ebp - 0x2c2], 0x56
mov byte [ebp - 0x2c1], 0x63
mov byte [ebp - 0x2c0], 0xf1
mov byte [ebp - 0x2bf], 0xac
mov byte [ebp - 0x2be], 0xeb
mov byte [ebp - 0x2bd], 0x35
mov byte [ebp - 0x2bc], 0x7f
mov byte [ebp - 0x2bb], 0xc2
mov byte [ebp - 0x2ba], 0x22
mov byte [ebp - 0x2b9], 0x98
mov byte [ebp - 0x2b8], 0x77
mov byte [ebp - 0x2b7], 0x5b
mov byte [ebp - 0x2b6], 0x1c
mov byte [ebp - 0x2b5], 0x98
mov byte [ebp - 0x2b4], 0x94
mov byte [ebp - 0x2b3], 1
mov byte [ebp - 0x2b2], 0xca
mov byte [ebp - 0x2b1], 0xe1
mov byte [ebp - 0x2b0], 0x92
mov byte [ebp - 0x2af], 0x64
mov byte [ebp - 0x2ae], 0x31
mov byte [ebp - 0x2ad], 0x7d
mov byte [ebp - 0x2ac], 0x66
mov byte [ebp - 0x2ab], 0xcd
mov byte [ebp - 0x2aa], 0xc9
mov byte [ebp - 0x2a9], 0x2e
mov byte [ebp - 0x2a8], 0x5e
mov byte [ebp - 0x2a7], 0x3b
mov byte [ebp - 0x2a6], 0x8e
mov byte [ebp - 0x2a5], 0x78
mov byte [ebp - 0x2a4], 0x6b
mov byte [ebp - 0x2a3], 0x2d
mov byte [ebp - 0x2a2], 0xd9
mov byte [ebp - 0x2a1], 0xfc
mov byte [ebp - 0x2a0], 0x57
mov byte [ebp - 0x29f], 0xfa
mov byte [ebp - 0x29e], 0x36
mov byte [ebp - 0x29d], 0x1f
mov byte [ebp - 0x29c], 0x2a
mov byte [ebp - 0x29b], 0x47
mov byte [ebp - 0x29a], 0xdb
mov byte [ebp - 0x299], 0x25
mov byte [ebp - 0x298], 9
mov byte [ebp - 0x297], 0xde
mov byte [ebp - 0x296], 0xd3
mov byte [ebp - 0x295], 0xd2
mov byte [ebp - 0x294], 0x4a
mov byte [ebp - 0x293], 0xa5
mov byte [ebp - 0x292], 0x15
mov byte [ebp - 0x291], 4
mov byte [ebp - 0x290], 4
mov byte [ebp - 0x28f], 8
mov byte [ebp - 0x28e], 4
mov byte [ebp - 0x28d], 7
mov byte [ebp - 0x28c], 6
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x2f0]
or eax, 0xfb
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x2f0]
and ecx, 0xfb
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x2f0]
mov byte [ebp + ecx - 0x6e0], al
mov dword [ebp - 0x50], 2
and dword [ebp - 0x1ac], 0
jmp 0x1004a2d5
mov eax, dword [ebp - 0x50]
inc eax
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x65
jae 0x1004a39f
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x2f0]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x50], eax
jne 0x1004a31f
mov eax, dword [ebp - 0x50]
movzx eax, byte [ebp + eax - 0x2f0]
inc eax
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [ebp + eax - 0x2f0]
mov ecx, dword [ebp - 0x50]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x50], eax
jmp 0x1004a2cd
mov eax, dword [ebp - 0x50]
movzx eax, byte [ebp + eax - 0x2ef]
mov ecx, dword [ebp - 0x50]
sub ecx, dword [ebp - 0x1ac]
movzx ecx, byte [ebp + ecx - 0x2f2]
movsx ecx, byte [ebp + ecx - 0x6e0]
or eax, ecx
mov ecx, dword [ebp - 0x50]
movzx ecx, byte [ebp + ecx - 0x2ef]
mov edx, dword [ebp - 0x50]
sub edx, dword [ebp - 0x1ac]
movzx edx, byte [ebp + edx - 0x2f2]
movsx edx, byte [ebp + edx - 0x6e0]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x50]
movzx ecx, byte [ebp + ecx - 0x2f0]
mov byte [ebp + ecx - 0x6e0], al
push 0x3c34
lea eax, [ebp - 0x1ac]
push eax
push 1
push 0x3416
call fcn.10047655
add esp, 0x10
jmp 0x1004a2cd
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x6e0], 0
mov dword [ebp - 0xf0], 0xac204e2d
mov dword [ebp - 0x208], 0x8bea
mov dword [ebp - 0x520], 0x3bab7215
mov dword [ebp - 0xc0], 0xfb389fa1
mov dword [ebp - 0xb0], 0x70d97802
mov dword [ebp - 0x530], 0x970c0f3a
mov dword [ebp - 0x6c], 0
jmp 0x1004a3f9
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1004a40f
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x148], 0xfffffffd
jmp 0x1004a3f2
mov dword [ebp - 0x6c], 0
jmp 0x1004a41f
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1004a435
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x758], 0xd6db
jmp 0x1004a418
mov dword [ebp - 0xf0], 0x17
jmp 0x1004a44e
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xe
jge 0x1004a8be
mov dword [ebp - 0x200], 0x6173948b
mov dword [ebp - 0xb8], 0xd66de6b9
mov dword [ebp - 0x130], 0xb5a2
mov dword [ebp - 0x84], 0
jmp 0x1004a492
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x1004a4ae
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x9e8], 0xdebf889e
jmp 0x1004a485
mov dword [ebp - 0x84], 0
jmp 0x1004a4c7
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x1004a4e3
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x6e8], 0x3b0a6d08
jmp 0x1004a4ba
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x98c], eax
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x6e8], 0xb6a36042
jae 0x1004a51b
mov dword [ebp - 0x5e0], 1
jmp 0x1004a522
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x5e0], eax
je 0x1004a545
mov eax, 0x79a4
test eax, eax
je 0x1004a545
mov dword [ebp - 0x84c], 1
jmp 0x1004a54c
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x994], eax
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x520], eax
jge 0x1004a572
mov dword [ebp - 0x508], 1
jmp 0x1004a579
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0xb8]
imul eax, dword [ebp - 0x508]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x148]
jle 0x1004a5a1
mov dword [ebp - 0x67c], 1
jmp 0x1004a5a8
and dword [ebp - 0x67c], 0
cmp dword [ebp - 0x67c], 9
ja 0x1004a5c6
cmp dword [ebp - 0x130], 0
je 0x1004a5c6
mov dword [ebp - 0x358], 1
jmp 0x1004a5cd
and dword [ebp - 0x358], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x358]
mov dword [ebp + eax - 0x6e8], ecx
cmp dword [ebp - 0x358], 0
jne 0x1004a602
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6e8], 0
jne 0x1004a602
and dword [ebp - 0x5e8], 0
jmp 0x1004a60c
mov dword [ebp - 0x5e8], 1
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x510], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x510]
mov dword [ebp + eax - 0x9e8], ecx
mov eax, dword [ebp - 0x510]
cmp eax, dword [ebp - 0x5e8]
jle 0x1004a645
mov dword [ebp - 0x518], 1
jmp 0x1004a64c
and dword [ebp - 0x518], 0
imul eax, dword [ebp - 0x518], 0x88fe
cmp eax, dword [ebp - 0xf0]
jne 0x1004a66a
mov dword [ebp - 0x360], 1
jmp 0x1004a671
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x360], eax
jge 0x1004a686
cmp dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x208]
cmp dword [ebp - 0xb8], eax
je 0x1004a6ac
mov dword [ebp - 0x5f0], 1
jmp 0x1004a6b3
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x200]
add eax, dword [ebp - 0x5f0]
je 0x1004a6dd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x148], 0
je 0x1004a6dd
mov dword [ebp - 0x750], 1
jmp 0x1004a6e4
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x99c], eax
cmp dword [ebp - 0xc0], 0
jne 0x1004a705
mov dword [ebp - 0x528], 1
jmp 0x1004a70c
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x208]
cmp dword [ebp - 0x528], eax
je 0x1004a726
mov dword [ebp - 0x698], 1
jmp 0x1004a72d
and dword [ebp - 0x698], 0
imul eax, dword [ebp - 0x698], 9
cmp eax, dword [ebp - 0x530]
jle 0x1004a748
mov dword [ebp - 0x5f8], 1
jmp 0x1004a74f
and dword [ebp - 0x5f8], 0
cmp dword [ebp - 0x5f8], 0x84d75f05
jbe 0x1004a767
mov dword [ebp - 0x3b0], 1
jmp 0x1004a76e
and dword [ebp - 0x3b0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3b0]
mov dword [ebp + eax - 0x148], ecx
mov dword [ebp - 0x130], 0
jmp 0x1004a79a
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xfffffff2
jle 0x1004a8b9
mov dword [ebp - 0x1b4], 0
jmp 0x1004a7c0
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jge 0x1004a7dc
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x950], 0xfffffffc
jmp 0x1004a7b3
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x6e8]
cmp dword [ebp + eax - 0x950], ecx
jg 0x1004a804
mov dword [ebp - 0x3b4], 1
jmp 0x1004a80b
and dword [ebp - 0x3b4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3b4]
mov dword [ebp + eax - 0x148], ecx
mov dword [ebp - 0xb0], 0
jmp 0x1004a837
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x2a
je 0x1004a8b4
mov dword [ebp - 0xb8], 0xf
jmp 0x1004a859
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0x10
jne 0x1004a8af
mov dword [ebp - 0x7d8], 0x6add7081
mov dword [ebp - 0xc0], 0
jmp 0x1004a885
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jg 0x1004a8a2
mov eax, dword [ebp - 0xc0]
cmp dword [ebp + eax*4 - 0x148], 0
je 0x1004a8a0
jmp 0x1004a8a2
jmp 0x1004a878
cmp dword [ebp - 0x7d8], 0
je 0x1004a8ad
jmp 0x1004a8af
jmp 0x1004a84c
jmp 0x1004a82a
jmp 0x1004a78d
jmp 0x1004a441
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x208]
mov dword [ebp + eax - 0x758], ecx
lea eax, [ebp - 0x6e0]
push eax
lea ecx, [ebp - 0xa60]
call fcn.10026d91
mov dword [ebp - 0x7e4], eax
mov eax, dword [ebp - 0x7e4]
mov dword [ebp - 0x760], eax
mov dword [ebp - 4], 1
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x760]
call fcn.100311aa
pop ecx
mov dword [ebp - 0x770], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa60]
call fcn.10017fc6
mov dword [ebp - 0x3bc], 0xffffffff
mov dword [ebp - 0x768], 0x184dcc8
mov dword [ebp - 0x210], 0
jmp 0x1004a94e
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 1
jge 0x1004a96a
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x8c], 1
jmp 0x1004a941
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x1004a99a
push 0x2153
push 0x4591
push 0
push 0x164
push 0x64d7
call fcn.10047c63
add esp, 0x14
mov dword [ebp - 0x3bc], 0xffffffff
cmp dword [ebp - 0x3bc], 0x51c3
jl 0x1004a9bc
mov dword [ebp - 0x3c4], 1
jmp 0x1004a9c3
and dword [ebp - 0x3c4], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x8c]
cmp dword [ebp + eax - 0x8c], ecx
jne 0x1004a9eb
mov dword [ebp - 0x3cc], 1
jmp 0x1004a9f2
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3c4]
cmp eax, dword [ebp - 0x3cc]
je 0x1004aa0c
mov dword [ebp - 0x3d4], 1
jmp 0x1004aa13
and dword [ebp - 0x3d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c]
cmp dword [ebp - 0x3d4], eax
je 0x1004aa34
mov dword [ebp - 0x3dc], 1
jmp 0x1004aa3b
and dword [ebp - 0x3dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c]
cmp eax, dword [ebp - 0x3dc]
jl 0x1004aa69
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8c], 0
jne 0x1004aa69
and dword [ebp - 0x3e4], 0
jmp 0x1004aa73
mov dword [ebp - 0x3e4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c]
cmp dword [ebp - 0x3e4], eax
jne 0x1004aa94
mov dword [ebp - 0x7e0], 1
jmp 0x1004aa9b
and dword [ebp - 0x7e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c]
mov dword [ebp - 0x9a4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c]
mov dword [ebp - 0x768], eax
and dword [ebp - 0x1c0], 0
jmp 0x1004aad7
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0xb
jae 0x1004aaf0
mov eax, dword [ebp - 0x1c0]
mov byte [ebp + eax - 0x6e0], 0
jmp 0x1004aaca
mov dword [ebp - 0x7e8], 0xffff
mov dword [ebp - 0x1c4], 0
jmp 0x1004ab13
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 3
jge 0x1004ab2f
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0x688], 0xe3245f1d
jmp 0x1004ab06
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x1004ab49
push 1
call fcn.1004769d
pop ecx
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x688]
cmp dword [ebp + eax - 0x688], ecx
jl 0x1004ab70
mov dword [ebp - 0x3ec], 1
jmp 0x1004ab77
and dword [ebp - 0x3ec], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x688]
cmp dword [ebp + eax - 0x688], ecx
jg 0x1004ab9d
mov dword [ebp - 0x3f4], 1
jmp 0x1004aba4
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3ec]
cmp eax, dword [ebp - 0x3f4]
jge 0x1004abbe
mov dword [ebp - 0x3fc], 1
jmp 0x1004abc5
and dword [ebp - 0x3fc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x688]
cmp dword [ebp - 0x3fc], eax
jge 0x1004abe5
mov dword [ebp - 0x404], 1
jmp 0x1004abec
and dword [ebp - 0x404], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov edx, dword [ebp - 0x404]
sub edx, dword [ebp + ecx - 0x688]
push 4
pop ecx
shl ecx, 1
add edx, dword [ebp + ecx - 0x688]
cmp dword [ebp + eax - 0x688], edx
jl 0x1004ac24
mov dword [ebp - 0x40c], 1
jmp 0x1004ac2b
and dword [ebp - 0x40c], 0
cmp dword [ebp - 0x40c], 7
jne 0x1004ac40
mov dword [ebp - 0x414], 1
jmp 0x1004ac47
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x7e8], eax
push dword [ebp - 0x770]
push dword [ebp - 0x7f0]
call fcn.10043967
pop ecx
pop ecx
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x1c], 0xe17c
mov dword [ebp - 0x1fc], 0
jmp 0x1004ac8c
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 3
jge 0x1004aca8
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x2fc], 0x97f0a290
jmp 0x1004ac7f
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jg 0x1004acc0
mov dword [ebp - 0x41c], 1
jmp 0x1004acc7
and dword [ebp - 0x41c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x41c]
mov dword [ebp + eax - 0x2fc], ecx
mov dword [ebp - 0x1c], 0
jmp 0x1004ace9
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1004ae85
mov dword [ebp - 0x1cc], 0x3e95aad8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2fc], 0x8ee41b66
mov dword [ebp - 0x1cc], 0
jmp 0x1004ad24
cmp dword [ebp - 0x1cc], 2
jg 0x1004ae80
mov dword [ebp - 0x7ec], 0xcf687292
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x1004ad67
push 0x1695
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2fc]
mov dword [ebp - 0x9ac], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2fc]
mov dword [ebp - 0x8b8], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp + ecx*4 - 0x2fc]
cmp dword [ebp + eax*4 - 0x2fc], ecx
je 0x1004ada9
mov dword [ebp - 0x424], 1
jmp 0x1004adb0
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2fc]
imul eax, dword [ebp - 0x424]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x2fc]
je 0x1004addb
mov dword [ebp - 0x42c], 1
jmp 0x1004ade2
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
add eax, 8
cmp eax, 8
jge 0x1004adfc
mov dword [ebp - 0x434], 1
jmp 0x1004ae03
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2fc]
add eax, dword [ebp - 0x434]
jne 0x1004ae2b
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x2fc], 0
jne 0x1004ae2b
mov dword [ebp - 0x778], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp + eax - 0x2fc]
mov dword [ebp + ecx*4 - 0x2fc], eax
mov eax, 0xfff6
cmp eax, 0x6a6c
jb 0x1004ae64
jmp 0x1004ace2
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x47c]
mov dword [eax + 8], ecx
mov dword [ebp - 0x138], 3
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x788], 0xf7bd
mov dword [ebp - 0x7f4], 3
cmp dword [ebp - 0x138], 0
je 0x1004af12
mov dword [ebp - 0x224], 0
jmp 0x1004aede
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 1
jge 0x1004aefa
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0x780], 0xfffffff9
jmp 0x1004aed1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x780]
mov dword [ebp - 0x1d4], eax
jmp 0x1004b0a1
mov dword [ebp - 0x340], 0xffffffff
mov dword [ebp - 0x320], 3
mov dword [ebp - 0x328], 0xde574131
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1004af4a
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
xor eax, eax
jne 0x1004af55
cmp dword [ebp - 0x1d4], 0
cmp dword [ebp - 0x320], 0
je 0x1004af6f
xor eax, eax
inc eax
je 0x1004af6f
mov dword [ebp - 0x444], 1
jmp 0x1004af76
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
sub eax, dword [ebp - 0x328]
mov ecx, dword [ebp - 0x340]
neg ecx
cmp ecx, eax
jge 0x1004afb2
mov dword [ebp - 0x44c], 1
jmp 0x1004afb9
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x328]
cmp dword [ebp - 0x44c], eax
jle 0x1004afd3
mov dword [ebp - 0x848], 1
jmp 0x1004afda
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x8c0], eax
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x340], eax
je 0x1004b000
mov dword [ebp - 0x454], 1
jmp 0x1004b007
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x454]
sub eax, dword [ebp - 0x328]
je 0x1004b02a
push 0xf
push 5
call fcn.10043967
pop ecx
pop ecx
add eax, dword [ebp - 0x47c]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], eax
and dword [ebp - 0x118], 0
mov dword [ebp - 0x204], 0xe91a049f
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x1004b0e3
push 1
call fcn.100476c8
pop ecx
mov dword [ebp - 0x204], 0x11
jmp 0x1004b0fc
cmp dword [ebp - 0x204], 2
jg 0x1004b132
mov byte [ebp - 0xe6], 0
movzx eax, byte [ebp - 0xe6]
test eax, eax
je 0x1004b130
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x18], 0
jbe 0x1004b155
mov eax, dword [ebp + 8]
mov dword [ebp - 0x77c], eax
mov eax, dword [ebp - 0x77c]
mov dword [ebp - 0x784], eax
mov eax, dword [ebp - 0x784]
movzx eax, byte [eax]
test eax, eax
je 0x1004cc06
push 0x2015
call dword [sym.imp.USER32.dll_GetKeyboardType]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret