Function at 0x447846
Capabilities:
Enumerate pe sections
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5d0
movzx eax, byte [ebp + 0x38]
test eax, eax
je 0x449445
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3cc], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 0x310], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3d8], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x310]
movzx eax, byte [eax]
test eax, eax
je 0x4478b5
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x3d4], eax
push dword [ebp - 0x3d4]
push 1
call fcn.00449bf9
pop ecx
pop ecx
jmp 0x449440
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x358]
movzx eax, byte [eax]
test eax, eax
je 0x447921
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x2c0]
movzx eax, byte [eax]
test eax, eax
je 0x44791c
push 0x15a3
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x449440
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x418], 1
mov dword [ebp - 0x414], 1
mov dword [ebp - 0x410], 1
mov dword [ebp - 0x40c], 1
mov dword [ebp - 0x2d8], 0xfffffff8
mov dword [ebp - 0x50], 0xfffffff7
mov dword [ebp - 0x128], 1
mov dword [ebp - 0x2c8], 7
mov dword [ebp - 0x270], 0xdbc37078
mov dword [ebp - 0x24], 0
jmp 0x447991
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x4479a7
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x44c], 0xedfa831e
jmp 0x44798a
mov dword [ebp - 0x24], 0
jmp 0x4479b7
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x4479cd
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x3b0], 0xc14c
jmp 0x4479b0
push 1
push 0x5056
push 0
push 1
lea eax, [ebp - 0x270]
push eax
push 0x44a1
push 0x394f
push 0x31aa
push 1
push 1
push 1
call fcn.00442ed4
add esp, 0x2c
mov dword [ebp - 0x50], 0
jmp 0x447a0c
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xfffffffd
je 0x447be1
mov dword [ebp - 0x234], 0x7c8b166c
mov dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x2c8], 0
jne 0x447a63
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x44c], 0
jne 0x447a63
and dword [ebp - 0x1d4], 0
jmp 0x447a6d
mov dword [ebp - 0x1d4], 1
cmp dword [ebp - 0x1d4], 0xfffffff6
jne 0x447a82
mov dword [ebp - 0x290], 1
jmp 0x447a89
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x290], eax
jne 0x447aa3
mov dword [ebp - 0x110], 1
jmp 0x447aaa
and dword [ebp - 0x110], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44c]
cmp dword [ebp - 0x110], eax
jg 0x447acb
mov dword [ebp - 0x1d0], 1
jmp 0x447ad2
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x1d0]
add eax, 8
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0x418]
imul eax, dword [ebp - 0x128]
test eax, eax
jne 0x447b04
mov eax, 0x4defc72f
test eax, eax
jne 0x447b04
and dword [ebp - 0x118], 0
jmp 0x447b0e
mov dword [ebp - 0x118], 1
cmp dword [ebp - 0x118], 0x8213af72
ja 0x447b2f
cmp dword [ebp - 0x234], 0
je 0x447b2f
mov dword [ebp - 0x120], 1
jmp 0x447b36
and dword [ebp - 0x120], 0
cmp dword [ebp - 0x120], 0xcbfc
jge 0x447b62
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x447b62
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3b0], 0
jne 0x447b62
and dword [ebp - 0x1dc], 0
jmp 0x447b6c
mov dword [ebp - 0x1dc], 1
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x1dc], eax
jge 0x447b86
mov dword [ebp - 0x2d0], 1
jmp 0x447b8d
and dword [ebp - 0x2d0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x44c]
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0xb8], eax
jle 0x447bb6
mov dword [ebp - 0x368], 1
jmp 0x447bbd
and dword [ebp - 0x368], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x418]
mov dword [ebp - 0x4c4], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x2d8], eax
jmp 0x447a05
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x60]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x4cc], 0xd546
mov dword [ebp - 0x504], 0xffffffff
mov dword [ebp - 0x50c], 0xfffffffe
mov dword [ebp - 0x514], 0xb1c2a2c7
mov dword [ebp - 0x538], 0xfffffffa
mov dword [ebp - 0x540], 7
mov dword [ebp - 0x548], 0xfffffffc
mov dword [ebp - 0x550], 0x9d786592
mov dword [ebp - 0x558], 0xf5f9
mov dword [ebp - 0x560], 0xc424
mov dword [ebp - 0x3c8], 0x3ca955a6
mov dword [ebp - 0x18], 0
jmp 0x447c74
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x447c8a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x520], 1
jmp 0x447c6d
mov dword [ebp - 0x18], 0
jmp 0x447c9a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x447cb0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5c0], 0xfffffff7
jmp 0x447c93
push 0
lea eax, [ebp - 0x3c8]
push eax
push 1
push 1
call fcn.0043bf4b
add esp, 0x10
and dword [ebp - 0xc0], 0
jmp 0x447ce4
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc]
add eax, 0x28
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0xc0], eax
jge 0x449440
mov dword [ebp - 0xac], 0
jmp 0x447d12
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x447d2e
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x29c], 0x25b9b55b
jmp 0x447d05
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x29c], 0xffffffe3
jmp 0x447d5c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x29c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x29c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x29c], 9
jle 0x447e73
mov dword [ebp - 0x100], 0xffffffff
mov dword [ebp - 0x2e0], 0x2b53
cmp dword [ebp - 0x100], 0xfffb
ja 0x447d9c
mov dword [ebp - 0x138], 1
jmp 0x447da3
and dword [ebp - 0x138], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x100]
cmp dword [ebp + eax - 0x29c], ecx
jge 0x447dc4
mov dword [ebp - 0x264], 1
jmp 0x447dcb
and dword [ebp - 0x264], 0
cmp dword [ebp - 0x264], 0x2d0da0bd
je 0x447de3
mov dword [ebp - 0x130], 1
jmp 0x447dea
and dword [ebp - 0x130], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x29c]
cmp dword [ebp - 0x130], eax
jle 0x447e10
cmp dword [ebp - 0x2e0], 0
jne 0x447e10
and dword [ebp - 0x1e4], 0
jmp 0x447e1a
mov dword [ebp - 0x1e4], 1
mov eax, dword [ebp - 0x100]
cmp eax, dword [ebp - 0x1e4]
jne 0x447e34
mov dword [ebp - 0x23c], 1
jmp 0x447e3b
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x23c]
jle 0x447e5d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x29c], 0
je 0x447e5b
jmp 0x447e73
jmp 0x447e6e
push 0
push 0x56da
push 1
call fcn.00445e81
add esp, 0xc
jmp 0x447d41
mov dword [ebp - 0xe4], 0x9bf3
mov dword [ebp - 0xcc], 0xa290
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x2f0], 0xffffffff
mov dword [ebp - 0x478], 0xfffb
mov dword [ebp - 0x54c], 0xb256
mov dword [ebp - 0x480], 0xfffffffa
mov dword [ebp - 0x20], 0
jmp 0x447ec9
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x447edf
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x3b8], 6
jmp 0x447ec2
mov dword [ebp - 0x20], 0
jmp 0x447eef
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x447f05
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x4d8], 0x7d239f94
jmp 0x447ee8
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x4438bea1
jl 0x447f29
mov dword [ebp - 0x370], 1
jmp 0x447f30
and dword [ebp - 0x370], 0
cmp dword [ebp - 0xe4], 0
je 0x447f4b
mov eax, 0x8530de9b
test eax, eax
je 0x447f4b
and dword [ebp - 0x140], 0
jmp 0x447f55
mov dword [ebp - 0x140], 1
imul eax, dword [ebp - 0x140], 0xf361
cmp eax, 0xfffffff6
jne 0x447f70
mov dword [ebp - 0x2e8], 1
jmp 0x447f77
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0xcc], eax
jge 0x447f91
mov dword [ebp - 0x1ec], 1
jmp 0x447f98
and dword [ebp - 0x1ec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1ec]
mov dword [ebp + eax - 0x3b8], ecx
xor eax, eax
inc eax
sub eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x148], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x148]
mov dword [ebp + eax - 0x4d8], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
and eax, 0x20000000
je 0x447fe6
mov dword [ebp - 0x27c], 1
jmp 0x447fed
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x380], eax
mov dword [ebp - 4], 0xd837bc75
mov dword [ebp - 0x28], 0
jmp 0x448010
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x448026
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x408], 0x42b9
jmp 0x448009
mov dword [ebp - 0x28], 0
jmp 0x448036
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x44804c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x56c], 1
jmp 0x44802f
push 0
push 0x1f2e
push 0x11e6
push 0
push 1
call fcn.004400a8
add esp, 0x14
cmp dword [ebp - 4], 0
je 0x448175
mov eax, dword [ebp - 4]
neg eax
cmp eax, dword [ebp - 4]
jge 0x448087
cmp dword [ebp - 4], 0
jne 0x448087
and dword [ebp - 0x150], 0
jmp 0x448091
mov dword [ebp - 0x150], 1
imul eax, dword [ebp - 4], 0x6f18
cmp eax, dword [ebp - 0x150]
jle 0x4480ac
mov dword [ebp - 0x1f4], 1
jmp 0x4480b3
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x1f4], eax
jg 0x4480ca
mov dword [ebp - 0x158], 1
jmp 0x4480d1
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x158], eax
jl 0x4480e8
mov dword [ebp - 0x378], 1
jmp 0x4480ef
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x500], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x244], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x244]
mov dword [ebp + eax - 0x408], ecx
cmp dword [ebp - 0x244], 1
jbe 0x448129
mov dword [ebp - 0x160], 1
jmp 0x448130
and dword [ebp - 0x160], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x160], eax
jg 0x448147
mov dword [ebp - 0x1fc], 1
jmp 0x44814e
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x1fc], eax
jl 0x448169
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x56c], 0
je 0x448175
mov dword [ebp - 0x168], 1
jmp 0x44817c
and dword [ebp - 0x168], 0
cmp dword [ebp - 0x168], 0x9dffbe58
je 0x4481cd
mov dword [ebp - 4], 0
jmp 0x448198
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jg 0x4481cb
push 1
push 0
push 0x2cf4
push 0
push 0x36df
push 0x16b9
call fcn.0044a306
add esp, 0x18
push 1
push 0
push 1
call fcn.00433211
add esp, 0xc
jmp 0x448191
jmp 0x44820e
push 0
push 1
push 1
push 1
push 0x4da4
push 1
call fcn.00432317
add esp, 0x18
mov dword [ebp - 4], 0
jmp 0x4481f4
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x18
je 0x44820e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x408], 0
je 0x44820c
jmp 0x44820e
jmp 0x4481ed
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
and eax, 0x40000000
je 0x448227
mov dword [ebp - 0x26c], 1
jmp 0x44822e
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x308], eax
mov dword [ebp - 0xec], 0xffffffff
mov dword [ebp - 0x10], 0
jmp 0x448254
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x44826a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa0], 0xffffffff
jmp 0x44824d
mov dword [ebp - 0x10], 0
jmp 0x44827a
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x448290
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb4], 0x74e8
jmp 0x448273
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xa0], 0xffffffe2
jmp 0x4482bb
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa0]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xa0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xa0], 0xfffffff1
jl 0x4482e4
push 0x272b
push 0x6b91
push 1
push 1
push 0
call fcn.00434f19
add esp, 0x14
jmp 0x4482a2
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa0]
mov dword [ebp - 0x488], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa0]
mov dword [ebp - 0x53c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb4], 0
jne 0x448325
mov dword [ebp - 0x170], 1
jmp 0x44832c
and dword [ebp - 0x170], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x170]
sub ecx, dword [ebp + eax - 0xb4]
cmp ecx, 1
jge 0x448350
mov dword [ebp - 0x204], 1
jmp 0x448357
and dword [ebp - 0x204], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa0]
sub eax, dword [ebp - 0x204]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xa0]
jl 0x448384
mov dword [ebp - 0x178], 1
jmp 0x44838b
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0xec]
add eax, dword [ebp - 0x178]
jne 0x4483a0
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x4483b5
cmp dword [ebp - 0xec], 0
je 0x4483b5
mov dword [ebp - 0x24c], 1
jmp 0x4483bc
and dword [ebp - 0x24c], 0
cmp dword [ebp - 0x24c], 0x3d1f
jne 0x4483e4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa0], 0
je 0x4483e4
mov dword [ebp - 0x180], 1
jmp 0x4483eb
and dword [ebp - 0x180], 0
cmp dword [ebp - 0x180], 0
jl 0x448400
mov dword [ebp - 0x20c], 1
jmp 0x448407
and dword [ebp - 0x20c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa0]
add eax, dword [ebp - 0x20c]
cmp eax, 0x4e5878ed
jg 0x44842d
mov dword [ebp - 0xf4], 1
jmp 0x448434
and dword [ebp - 0xf4], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xf4]
mov dword [ebp + eax - 0xa0], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb4]
cmp dword [ebp - 0xf4], eax
jne 0x448467
mov dword [ebp - 0x188], 1
jmp 0x44846e
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x188]
neg eax
je 0x4485f6
mov dword [ebp - 0x254], 0xffffffff
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x6c], 0
jmp 0x4484a0
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x4484b6
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xd4], 0xad21dd8e
jmp 0x448499
mov byte [ebp - 0x36], 0
push 0
lea eax, [ebp - 0x36]
push eax
push 0
call fcn.0043b997
add esp, 0xc
xor eax, eax
inc eax
je 0x448578
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd4], 1
je 0x4484ef
mov dword [ebp - 0x28c], 1
jmp 0x4484f6
and dword [ebp - 0x28c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
cmp dword [ebp - 0x28c], eax
jle 0x448517
mov dword [ebp - 0x190], 1
jmp 0x44851e
and dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x214], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa0]
cmp eax, dword [ebp - 0x214]
jl 0x44854a
mov dword [ebp - 0x198], 1
jmp 0x448551
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x254]
sub eax, dword [ebp - 0x198]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xa0]
jl 0x448578
mov dword [ebp - 0x2f8], 1
jmp 0x44857f
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x490], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
mov dword [ebp - 0x508], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb4]
cmp dword [ebp - 0xec], eax
jg 0x4485bf
mov dword [ebp - 0x1a0], 1
jmp 0x4485c6
and dword [ebp - 0x1a0], 0
cmp dword [ebp - 0x1a0], 0
ja 0x4485db
mov dword [ebp - 0x21c], 1
jmp 0x4485e2
and dword [ebp - 0x21c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x21c]
mov dword [ebp + eax - 0xa0], ecx
jmp 0x448606
push 1
push 1
push 0
push 1
call fcn.004454d9
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
and eax, 0x80000000
je 0x44861f
mov dword [ebp - 0x1a8], 1
jmp 0x448626
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x300], eax
mov dword [ebp - 0xbc], 0
jmp 0x44864b
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x448667
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x5b4], 0xfffffffd
jmp 0x44863e
mov byte [ebp - 0x35], 0
lea eax, [ebp - 0x35]
push eax
push 0x5a93
push 0x21a3
push 0
push 0
call fcn.0043ff87
add esp, 0x14
mov byte [ebp - 0x3d], 0
lea eax, [ebp - 0x3d]
push eax
push 0x4a48
push 0
push 1
call fcn.004356f7
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
and eax, 0x2000000
je 0x4489cc
push 0x4000
mov eax, dword [ebp - 0xc]
push dword [eax + 0x10]
mov eax, dword [ebp - 0xc]
push dword [eax + 8]
push 0x29da
push 0x2cf2
call fcn.0041ce49
pop ecx
pop ecx
call eax
mov dword [ebp - 0xdc], 0xfffffffb
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x3e8], 0x8b421dd2
mov dword [ebp - 0x3e4], 0x8b421dd2
mov dword [ebp - 0x3e0], 0x8b421dd2
mov dword [ebp - 0x3dc], 0x8b421dd2
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x48], 0xfffffff6
mov dword [ebp - 0x3d0], 0xfffffffa
mov dword [ebp - 0x498], 0xf4ed832c
mov dword [ebp - 0x1c], 0
jmp 0x44873e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x448754
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x440], 0xfffffffc
jmp 0x448737
mov dword [ebp - 0x1c], 0
jmp 0x448764
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x44877a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x420], 0x625aa9c4
jmp 0x44875d
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x58], eax
jge 0x44878e
mov dword [ebp - 0x274], 1
jmp 0x448795
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0xdc], eax
jl 0x4487c2
mov dword [ebp - 0x1c0], 1
jmp 0x4487c9
and dword [ebp - 0x1c0], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x440], 0x4677
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x44]
cmp dword [ebp + eax - 0x440], ecx
jle 0x4487f7
mov dword [ebp - 0x1b0], 1
jmp 0x4487fe
and dword [ebp - 0x1b0], 0
cmp dword [ebp - 0x1b0], 0xe63a5bed
jne 0x448816
mov dword [ebp - 0x224], 1
jmp 0x44881d
and dword [ebp - 0x224], 0
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x3e8], 0xffff
cmp dword [ebp - 0x224], 0xffff
jl 0x448847
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x440], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3e8]
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4a0], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3e8]
add eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x44]
jl 0x44888a
mov eax, 0xd4bca925
test eax, eax
jne 0x44888a
and dword [ebp - 0x1b8], 0
jmp 0x448894
mov dword [ebp - 0x1b8], 1
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x544], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x440]
add eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x48]
jle 0x4488d9
mov dword [ebp - 0x25c], 1
jmp 0x4488e0
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x25c]
sub eax, 0x8e296e9
jne 0x448905
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x440], 0
jne 0x448905
and dword [ebp - 0x22c], 0
jmp 0x44890f
mov dword [ebp - 0x22c], 1
mov eax, dword [ebp - 0x1c0]
cmp eax, dword [ebp - 0x22c]
jne 0x448929
mov dword [ebp - 0x1c8], 1
jmp 0x448930
and dword [ebp - 0x1c8], 0
cmp dword [ebp - 0x1c8], 0x402e31d8
jl 0x448948
mov dword [ebp - 0x284], 1
jmp 0x44894f
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x48], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x420]
cmp dword [ebp - 0x48], eax
jge 0x448976
mov dword [ebp - 0xfc], 1
jmp 0x44897d
and dword [ebp - 0xfc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xfc]
mov dword [ebp + eax - 0x420], ecx
cmp dword [ebp - 0xfc], 0
jne 0x44899f
cmp dword [ebp - 0x58], 0
je 0x4489b4
mov eax, 0xcf6a
test eax, eax
je 0x4489b4
mov dword [ebp - 0x108], 1
jmp 0x4489bb
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x3d0], eax
jmp 0x447cce
push 0
push 0
push 0x6d90
push 0x3c63
push 0x31c3
call fcn.0044779e
add esp, 0x14
lea eax, [ebp - 0xc]
push eax
push 0x2e76
lea eax, [ebp - 0x300]
push eax
push 0
push 0x3d81
lea eax, [ebp - 0x380]
push eax
lea eax, [ebp - 0x3bc]
push eax
push 0x5021
push 1
lea eax, [ebp - 0x308]
push eax
push 0
call fcn.004459d8
add esp, 0x2c
mov dword [ebp - 0x3c0], 1
mov dword [ebp - 0x2a0], 6
mov dword [ebp - 0x78], 0
jmp 0x448a48
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x448a5e
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x4b0], 0xd837bc75
jmp 0x448a41
push 0x2728
push 0x5411
push 1
push 0x3c42
push 0x309a
push 0x304a
push 0x2de2
push 1
push 0
push 0x440b
push 0x2d9
push 1
push 0
push 0x5f83
push 0x5583
call fcn.00440529
add esp, 0x3c
push 0x5ade
push 0
push 0x33fe
push 0x5ba
lea eax, [ebp - 0x3c0]
push eax
lea eax, [ebp - 0x2a0]
push eax
push 0x782d
push 0x37c6
push 0x198d
push 0x1af1
push 1
push 1
push 1
push 0x3134
push 1
push 1
call fcn.0043c004
add esp, 0x40
push 0x196d
lea eax, [ebp - 0x210]
push eax
push 0x5cd3
push 0
lea eax, [ebp - 0xc]
push eax
push 0x30d2
push 0
lea eax, [ebp - 0x60]
push eax
push 1
push 0x399c
call fcn.004430f5
add esp, 0x28
mov dword [ebp - 0x430], 0xf9b3198a
mov dword [ebp - 0x42c], 0xf9b3198a
mov dword [ebp - 0x428], 0xf9b3198a
mov dword [ebp - 0x424], 0xf9b3198a
mov dword [ebp - 0x54], 3
mov dword [ebp - 0x90], 0x6e348cc3
mov dword [ebp - 0x88], 0xd45b0e82
mov dword [ebp - 0x518], 0xa6ca
mov dword [ebp - 0xa8], 0xfffffff8
mov dword [ebp - 0x80], 0
jmp 0x448b84
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x448b9a
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x1bc], 0x648bd921
jmp 0x448b7d
mov dword [ebp - 0x54], 0
jmp 0x448baa
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jg 0x44910d
mov dword [ebp - 0x318], 0x5b15
mov dword [ebp - 0x328], 5
mov dword [ebp - 0x4b8], 0xea7eb8e1
mov dword [ebp - 0x320], 0x9220c436
mov dword [ebp - 0x15c], 0xfffffffd
mov dword [ebp - 0x51c], 2
mov dword [ebp - 0x3ac], 1
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x4c0], 1
mov dword [ebp - 0x4e0], 0xfffffff6
mov dword [ebp - 0x3a8], 0x629bad2c
mov dword [ebp - 0x330], 0xffffffff
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x460], 0
mov dword [ebp - 0x398], 0xfffffff8
mov dword [ebp - 0xb0], 0
jmp 0x448c77
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x448c93
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x578], 1
jmp 0x448c6a
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x430]
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x4e4], eax
or eax, 0xffffffff
jge 0x448cc0
mov dword [ebp - 0x10c], 1
jmp 0x448cc7
and dword [ebp - 0x10c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bc]
cmp dword [ebp - 0x10c], eax
jg 0x448ce8
mov dword [ebp - 0x114], 1
jmp 0x448cef
and dword [ebp - 0x114], 0
cmp dword [ebp - 0x114], 0xffffffff
jne 0x448d04
mov dword [ebp - 0x388], 1
jmp 0x448d0b
and dword [ebp - 0x388], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x578]
mov dword [ebp - 0x4d0], eax
cmp dword [ebp - 0x318], 6
jne 0x448d38
cmp dword [ebp - 0x88], 0
jne 0x448d38
and dword [ebp - 0x11c], 0
jmp 0x448d42
mov dword [ebp - 0x11c], 1
mov eax, dword [ebp - 0x3a8]
cmp dword [ebp - 0x11c], eax
jle 0x448d5c
mov dword [ebp - 0x124], 1
jmp 0x448d63
and dword [ebp - 0x124], 0
cmp dword [ebp - 0x124], 0xfffffffb
jae 0x448d81
cmp dword [ebp - 0x88], 0
je 0x448d81
mov dword [ebp - 0x12c], 1
jmp 0x448d88
and dword [ebp - 0x12c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x430]
cmp dword [ebp - 0x12c], eax
jle 0x448da9
mov dword [ebp - 0x134], 1
jmp 0x448db0
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x320]
add eax, dword [ebp - 0x134]
je 0x448ef8
mov dword [ebp - 0x13c], 1
mov dword [ebp - 0x14], 0
jmp 0x448ddc
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x448df2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc4], 1
jmp 0x448dd5
mov dword [ebp - 0x14], 0
jmp 0x448e02
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x448e18
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x590], 0xe19ccd29
jmp 0x448dfb
mov byte [ebp - 0x3e], 0
movzx eax, byte [ebp - 0x3e]
test eax, eax
je 0x448e37
push 1
push 1
push 0x341d
push 0
call fcn.00442196
add esp, 0x10
cmp dword [ebp - 0x88], 0
je 0x448e55
mov eax, 0x6568c077
test eax, eax
je 0x448e55
mov dword [ebp - 0x390], 1
jmp 0x448e5c
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x4ec], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc4]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
sub eax, dword [ebp - 0x13c]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0xc4]
cmp eax, dword [ebp - 0x13c]
jl 0x448ea8
mov dword [ebp - 0x144], 1
jmp 0x448eaf
and dword [ebp - 0x144], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc4]
cmp dword [ebp - 0x144], eax
jne 0x448ed0
mov dword [ebp - 0x14c], 1
jmp 0x448ed7
and dword [ebp - 0x14c], 0
imul eax, dword [ebp - 0x14c], 0x389e
sub eax, 0xffff
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x590], eax
jmp 0x449108
mov dword [ebp - 0x5c], 0xa420
mov dword [ebp - 0xc8], 1
mov dword [ebp - 0x19c], 0xffffffff
mov dword [ebp - 0x3b4], 0xb4770dda
cmp dword [ebp - 0x3ac], 0
jne 0x448f32
mov dword [ebp - 0x154], 1
jmp 0x448f39
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x449007
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x4dc], eax
mov dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0xc8]
add eax, dword [ebp - 0x15c]
cmp eax, dword [ebp - 0x5c]
jg 0x448f97
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x46c], 0
jne 0x448f97
and dword [ebp - 0x164], 0
jmp 0x448fa1
mov dword [ebp - 0x164], 1
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x164], eax
jl 0x448fb8
mov dword [ebp - 0x16c], 1
jmp 0x448fbf
and dword [ebp - 0x16c], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x16c], eax
jge 0x448fd6
mov dword [ebp - 0x174], 1
jmp 0x448fdd
and dword [ebp - 0x174], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x174], eax
jl 0x448ff7
mov dword [ebp - 0x17c], 1
jmp 0x448ffe
and dword [ebp - 0x17c], 0
cmp dword [ebp - 0x17c], 0xffffffff
je 0x449019
cmp dword [ebp - 0xc8], 0
jne 0x449019
and dword [ebp - 0x184], 0
jmp 0x449023
mov dword [ebp - 0x184], 1
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x184]
jg 0x44903d
mov dword [ebp - 0x18c], 1
jmp 0x449044
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x398]
cmp dword [ebp - 0x18c], eax
jne 0x44905e
mov dword [ebp - 0x194], 1
jmp 0x449065
and dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x19c], eax
jg 0x44908b
mov dword [ebp - 0x338], 1
jmp 0x449092
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x3b4]
cmp dword [ebp - 0x340], eax
jg 0x4490ac
mov dword [ebp - 0x1a4], 1
jmp 0x4490b3
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x1a4], eax
jne 0x4490cd
mov dword [ebp - 0x1ac], 1
jmp 0x4490d4
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x1ac], eax
je 0x4490ee
mov dword [ebp - 0x1b4], 1
jmp 0x4490f5
and dword [ebp - 0x1b4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b4]
mov dword [ebp + eax - 0x1bc], ecx
jmp 0x448ba3
cmp dword [ebp - 0x210], 0
jbe 0x44943b
mov dword [ebp - 8], 4
mov dword [ebp - 0x34], 0x82b4746a
mov dword [ebp - 0x4f4], 0
mov dword [ebp - 0x4fc], 0xb4404179
mov dword [ebp - 0x348], 0xe8e1
mov dword [ebp - 8], 0
jmp 0x449156
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1d
je 0x449375
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0xd0], 0x53fde750
mov dword [ebp - 0x2c], 0
jmp 0x449181
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffff5
jne 0x449348
mov dword [ebp - 0x3c], 0x1738ab65
mov dword [ebp - 0x3a0], 5
mov dword [ebp - 0x3c], 0
jmp 0x4491ac
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xf
jl 0x449343
mov dword [ebp - 0x70], 0
jmp 0x4491c6
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x4491dc
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x45c], 0xd66a0756
jmp 0x4491bf
cmp dword [ebp - 8], 1
je 0x4491ee
mov dword [ebp - 0x1c4], 1
jmp 0x4491f5
and dword [ebp - 0x1c4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x45c]
cmp eax, dword [ebp - 0x1c4]
jle 0x449216
mov dword [ebp - 0x1cc], 1
jmp 0x44921d
and dword [ebp - 0x1cc], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x45c]
imul eax, dword [ebp - 0x1cc]
cmp eax, dword [ebp - 0x3c]
je 0x449242
mov dword [ebp - 0x1d8], 1
jmp 0x449249
and dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x1d8], eax
jg 0x449260
mov dword [ebp - 0x1e0], 1
jmp 0x449267
and dword [ebp - 0x1e0], 0
cmp dword [ebp - 0x1e0], 1
je 0x44927c
mov dword [ebp - 0x1e8], 1
jmp 0x449283
and dword [ebp - 0x1e8], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x1e8]
sub ecx, dword [ebp + eax - 0x45c]
jne 0x4492a7
cmp dword [ebp - 8], 0
jne 0x4492a7
and dword [ebp - 0x1f0], 0
jmp 0x4492b1
mov dword [ebp - 0x1f0], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x45c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x1f0]
sub eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x34], eax
jg 0x4492ee
mov dword [ebp - 0x1f8], 1
jmp 0x4492f5
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x1f8]
cmp eax, dword [ebp - 0x3c]
jne 0x44930f
mov dword [ebp - 0x200], 1
jmp 0x449316
and dword [ebp - 0x200], 0
cmp dword [ebp - 0x200], 1
jle 0x44932b
mov dword [ebp - 0x208], 1
jmp 0x449332
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x3a0], eax
jmp 0x4491a5
jmp 0x44917a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xd0]
push eax
push 0
push 1
push 1
lea eax, [ebp - 0x34]
push eax
push 0x1870
lea eax, [ebp - 0x2c]
push eax
push 1
call fcn.00442227
add esp, 0x24
jmp 0x44914f
mov dword [ebp - 0x34], 0
jmp 0x449385
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xa
jge 0x44940f
mov dword [ebp - 0x74], 0
jmp 0x44939f
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x4493b5
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x59c], 0xffffffff
jmp 0x449398
push 1
push 1
push 1
push 1
push 0x4077
push 1
call fcn.00432317
add esp, 0x18
mov dword [ebp - 8], 0
jmp 0x4493dc
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jg 0x44940a
lea eax, [ebp - 0x348]
push eax
push 1
push 1
push 0
push 1
push 0x60f4
push 0x4a72
push 0x2327
call fcn.00432a81
add esp, 0x20
jmp 0x4493d5
jmp 0x44937e
lea eax, [ebp - 0x4e8]
push eax
push dword [ebp - 0x3bc]
push dword [ebp - 0x210]
mov eax, dword [ebp - 0xc]
push dword [eax + 8]
push 0x29da
push 0x300a
call fcn.0041ce49
pop ecx
pop ecx
call eax
jmp 0x447cce
jmp 0x449bf5
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2cc], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x350], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c4], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x350]
movzx eax, byte [eax]
test eax, eax
je 0x449bc5
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x2d4]
movzx eax, byte [eax]
test eax, eax
je 0x449536
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp - 0x2ec]
movzx eax, byte [eax]
test eax, eax
je 0x449531
push 0x1ae5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
jmp 0x449bc3
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x84], 1
mov dword [ebp - 0x554], 0xfffffff7
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x4f0], 0xffffffff
mov dword [ebp - 0x534], 2
mov dword [ebp - 0x31c], 0xfffffff8
mov dword [ebp - 0x230], 3
mov dword [ebp - 0xd8], 0xfffffff7
mov dword [ebp - 0x7c], 0
jmp 0x4495c6
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 4
jge 0x4495dc
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x5d0], 0x4ac0198a
jmp 0x4495bf
mov dword [ebp - 0x84], 0x18
jmp 0x4495f5
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xc
jl 0x449804
mov dword [ebp - 0x240], 0xfffd
mov dword [ebp - 0x4f8], 0x7dcd66a0
mov dword [ebp - 0x35c], 0x7207182b
mov dword [ebp - 0x474], 1
mov dword [ebp - 0x47c], 0x82aa9dad
mov dword [ebp - 0x34c], 0xc9fa8bc0
mov dword [ebp - 0x484], 1
mov dword [ebp - 0x33c], 0x1720d700
mov dword [ebp - 0x48c], 0xbae8b012
mov dword [ebp - 0x32c], 0xffffffff
mov dword [ebp - 0x314], 0xfffffff8
mov dword [ebp - 0x494], 0xabac89d7
mov dword [ebp - 0x238], 1
mov dword [ebp - 0x344], 0xfffffffc
mov dword [ebp - 0x8c], 0
jmp 0x4496a7
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x4496c3
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x580], 0x377d6446
jmp 0x44969a
mov eax, dword [ebp - 0x314]
inc eax
jne 0x4496de
cmp dword [ebp - 0x228], 0
jne 0x4496de
and dword [ebp - 0x218], 0
jmp 0x4496e8
mov dword [ebp - 0x218], 1
mov eax, dword [ebp - 0x230]
add eax, dword [ebp - 0x218]
cmp eax, dword [ebp - 0x31c]
jg 0x449708
mov dword [ebp - 0x220], 1
jmp 0x44970f
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x220]
jle 0x449736
mov dword [ebp - 0x324], 1
jmp 0x44973d
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x32c], 0
jne 0x44976e
push 0xfffffffffffffffc
pop eax
test eax, eax
jne 0x44976e
and dword [ebp - 0x334], 0
jmp 0x449778
mov dword [ebp - 0x334], 1
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x230]
sub eax, dword [ebp - 0x238]
cmp dword [ebp - 0x240], eax
jl 0x4497a4
mov dword [ebp - 0x248], 1
jmp 0x4497ab
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x33c]
cmp dword [ebp - 0x248], eax
jge 0x4497c3
push 0
call fcn.00445bb0
pop ecx
jmp 0x4497ff
mov dword [ebp - 0x354], 1
push 0
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x34c]
push eax
push 0x3b1c
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x35c]
push eax
push 0x54e4
push 0
call fcn.00432d9d
add esp, 0x20
jmp 0x4495e8
mov eax, dword [ebp - 0x364]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x30], 0x3fcb50bf
mov dword [ebp - 0x250], 2
mov dword [ebp - 0x64], 0x6e6c8cac
mov dword [ebp - 0x384], 0xffff
mov dword [ebp - 0x4b4], 0xffffffff
mov dword [ebp - 0x94], 0
jmp 0x449858
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 4
jge 0x449874
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x3f8], 0xa8eac8b
jmp 0x44984b
mov dword [ebp - 0x30], 0
jmp 0x449884
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jg 0x449ab2
mov dword [ebp - 0x4c], 0xf6b8f3d4
mov dword [ebp - 0x530], 0x9729cf30
mov dword [ebp - 0x52c], 0x9729cf30
mov dword [ebp - 0x528], 0x9729cf30
mov dword [ebp - 0x524], 0x9729cf30
mov dword [ebp - 0x36c], 0xfffffff8
mov dword [ebp - 0xa4], 0
jmp 0x4498e0
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x4498fc
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x400], 0xe5b14f4e
jmp 0x4498d3
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x400]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x400], eax
mov dword [ebp - 0x4c], 3
jmp 0x449927
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x449aad
mov dword [ebp - 0xe8], 0xfffffffa
mov dword [ebp - 0xe0], 0x878e
mov dword [ebp - 0x38c], 0xbf5e
mov dword [ebp - 0x250], 1
cmp dword [ebp - 0x250], 0
je 0x4499d7
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x3f8]
mov ecx, dword [ebp - 0x30]
imul eax, dword [ebp + ecx*4 - 0x3f8]
cmp eax, dword [ebp - 0x36c]
jl 0x44998b
mov dword [ebp - 0x258], 1
jmp 0x449992
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x258]
jg 0x4499b5
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3f8], 0
jne 0x4499b5
and dword [ebp - 0x260], 0
jmp 0x4499bf
mov dword [ebp - 0x260], 1
cmp dword [ebp - 0x260], 0xffff
ja 0x4499d7
mov dword [ebp - 0x268], 1
jmp 0x4499de
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0xe0]
imul eax, dword [ebp - 0x268]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x374]
cmp eax, dword [ebp - 0x37c]
je 0x449a27
mov dword [ebp - 0x104], 1
jmp 0x449a2e
and dword [ebp - 0x104], 0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x384]
cmp dword [ebp - 0xe8], eax
jge 0x449a54
mov dword [ebp - 0x278], 1
jmp 0x449a5b
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x278]
dec ecx
cmp dword [ebp + eax*4 - 0x3f8], ecx
jl 0x449a7a
mov dword [ebp - 0x280], 1
jmp 0x449a81
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x38c], eax
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x3f8], 0x6a9cbde6
cmp dword [ebp - 0x4c], 0
je 0x449aa8
jmp 0x449920
jmp 0x449920
jmp 0x44987d
mov dword [ebp - 0x64], 0
jmp 0x449ac2
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xffffffee
jg 0x449aed
push 0x1f96
push 0x7f9f
push 0x18e1
push 0x59ad
push 0x55fc
push 0
call fcn.0044b8b5
add esp, 0x18
jmp 0x449abb
cmp dword [ebp - 0xf0], 0
jle 0x449bc3
push 0x4ac0
push 0
call fcn.00439448
pop ecx
pop ecx
push 4
push 0x1000
push dword [ebp - 0xf0]
mov eax, dword [ebp - 0x288]
mov ecx, dword [ebp - 0x394]
add ecx, dword [eax + 0xc]
push ecx
push 0x29da
push 0x2536
call fcn.0041ce49
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0xf8]
mov dword [ecx], eax
mov dword [ebp - 0x68], 0
jmp 0x449b50
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x449b66
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x5a8], 0xfffffffd
jmp 0x449b49
push 0
push 0
call fcn.004454c2
pop ecx
pop ecx
mov byte [ebp - 0x37], 0
push 0x5ccb
push 0
lea eax, [ebp - 0x37]
push eax
call fcn.00432b71
add esp, 0xc
lea eax, [ebp - 0xf8]
push eax
push 1
push 0
push 0
push 0
push 0x3502
lea eax, [ebp - 0x288]
push eax
call fcn.00438f7a
add esp, 0x1c
push dword [ebp - 0xf0]
push 0
mov eax, dword [ebp - 0xf8]
push dword [eax]
call fcn.0042dcff
add esp, 0xc
jmp 0x449bf5
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x3a4], eax
push 0
push dword [ebp - 0x3a4]
push 0x4127
push 0x6b90
push 0x149
push 0x17c2
call fcn.0043a4e0
add esp, 0x18
mov esp, ebp
pop ebp
ret