Function at 0x1004e20a
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008bcba
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd44
push esi
push edi
and dword [ebp - 0x24], 0
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1005421e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x60], 0xfffffff6
mov dword [ebp - 0x224], 0xebf90350
mov dword [ebp - 0xa0], 7
mov dword [ebp - 0xb4c], 0xfffffffd
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xb38], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xb64], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x60], eax
jg 0x1004e28b
mov dword [ebp - 0x478], 1
jmp 0x1004e292
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
sub eax, dword [ebp - 0x60]
cmp dword [ebp - 0x60], eax
jl 0x1004e2ac
mov dword [ebp - 0x750], 1
jmp 0x1004e2b3
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0x750]
cmp eax, dword [ebp - 0x60]
jle 0x1004e2cd
mov dword [ebp - 0x758], 1
jmp 0x1004e2d4
and dword [ebp - 0x758], 0
cmp dword [ebp - 0x758], 3
jne 0x1004e2e9
mov dword [ebp - 0x784], 1
jmp 0x1004e2f0
and dword [ebp - 0x784], 0
cmp dword [ebp - 0x784], 0x13e19f23
jne 0x1004e308
mov dword [ebp - 0x78c], 1
jmp 0x1004e30f
and dword [ebp - 0x78c], 0
cmp dword [ebp - 0x78c], 0x1b35d569
jg 0x1004e327
mov dword [ebp - 0x794], 1
jmp 0x1004e32e
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xb40], eax
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xb6c], eax
cmp dword [ebp - 0x60], 0x22124f84
jge 0x1004e370
mov dword [ebp - 0x79c], 1
jmp 0x1004e377
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x79c]
inc eax
jne 0x1004e389
cmp dword [ebp - 0x224], 0
je 0x1004e3f9
mov dword [ebp - 0x7a4], 0xfffffff6
mov dword [ebp - 0xb48], 0xe215169f
mov dword [ebp - 0x838], 1
mov dword [ebp - 0x8a0], 0x7d2ae857
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x8a0]
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x7a4]
push eax
push 0x207c
push 0
push 0x535b
lea eax, [ebp - 0x224]
push eax
call fcn.1004d940
add esp, 0x20
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0xa0], eax
jmp 0x1004e531
mov dword [ebp - 0xbfc], 0xfffffff6
mov dword [ebp - 0xbf8], 0xfffffff6
mov dword [ebp - 0xbf4], 0xfffffff6
mov dword [ebp - 0xbf0], 0xfffffff6
mov dword [ebp - 0x1f0], 0
jmp 0x1004e43a
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 2
jge 0x1004e456
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0xc30], 3
jmp 0x1004e42d
mov dword [ebp - 0xa0], 0
jmp 0x1004e46f
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 7
jge 0x1004e531
mov dword [ebp - 0x7d0], 0xffffffff
mov dword [ebp - 0xb74], 0xe10ef7d5
push 2
lea ecx, [ebp - 0xb8c]
call fcn.10018b61
and dword [ebp - 4], 0
mov dword [ebp - 0xa0c], 0xedf2
mov dword [ebp - 0xa08], 0xedf2
mov dword [ebp - 0xa04], 0xedf2
mov dword [ebp - 0xa00], 0xedf2
push 0x75dd
push 0x296e
push 0x4774
push 1
lea eax, [ebp - 0xb58]
push eax
lea eax, [ebp - 0xb8c]
push eax
push 0x1cdf
call fcn.1004c846
add esp, 0x1c
mov eax, dword [ebp - 0x7d0]
inc eax
mov dword [ebp - 0x7d0], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa0c]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xa0c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb8c]
call fcn.10018be3
jmp 0x1004e462
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x7d4], eax
mov eax, dword [ebp - 0x7d4]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1004e54f
jmp 0x10054251
mov dword [ebp - 0x8b8], 0x10e1
mov dword [ebp - 0x8a8], 0x16b471df
mov dword [ebp - 0x7c4], 0
mov dword [ebp - 0x8b0], 9
mov dword [ebp - 0x368], 1
push 1
lea ecx, [ebp - 0xacc]
call fcn.10018b61
mov dword [ebp - 4], 1
mov dword [ebp - 0x16c], 0
jmp 0x1004e5ae
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 1
jge 0x1004e5d0
push dword [ebp - 0x16c]
lea ecx, [ebp - 0xacc]
call fcn.10018bff
mov dword [eax], 1
jmp 0x1004e5a1
mov eax, dword [ebp - 0x368]
dec eax
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0xb60], eax
mov eax, dword [ebp - 0x8a8]
mov dword [ebp - 0xbec], eax
mov eax, dword [ebp - 0x8b0]
cmp dword [ebp - 0x8b8], eax
jg 0x1004e61b
mov dword [ebp - 0x7d8], 1
jmp 0x1004e622
and dword [ebp - 0x7d8], 0
cmp dword [ebp - 0x7d8], 0x6cc9ca31
jle 0x1004e643
cmp dword [ebp - 0x7c4], 0
je 0x1004e643
mov dword [ebp - 0x778], 1
jmp 0x1004e64a
and dword [ebp - 0x778], 0
cmp dword [ebp - 0x778], 0xe60f
jle 0x1004e662
mov dword [ebp - 0x8d8], 1
jmp 0x1004e669
and dword [ebp - 0x8d8], 0
push 0
lea ecx, [ebp - 0xacc]
call fcn.10018bff
mov dword [eax], 0x2aff635
mov byte [ebp - 0xe6], 0
movzx eax, byte [ebp - 0xe6]
test eax, eax
je 0x1004e696
push 0
call fcn.1004d4cf
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xacc]
call fcn.10018be3
mov eax, dword [ebp - 0x7d4]
mov ecx, dword [ebp - 0x2c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0x7c], 0xfffffff9
mov dword [ebp - 0x8e0], 0xffffffff
mov dword [ebp - 0x710], 6
mov dword [ebp - 0x1d4], 0
jmp 0x1004e6eb
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 1
jge 0x1004e707
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0x1dc], 1
jmp 0x1004e6de
mov dword [ebp - 0x7c], 0
jmp 0x1004e717
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jl 0x1004e8bd
mov dword [ebp - 0x394], 0x82bdb979
mov dword [ebp - 0x174], 0
jmp 0x1004e744
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 3
jge 0x1004e760
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0xa54], 0xfffffffd
jmp 0x1004e737
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ebp + ecx*4 - 0x1dc]
cmp dword [ebp + eax*4 - 0x1dc], ecx
jne 0x1004e782
mov dword [ebp - 0x41c], 1
jmp 0x1004e789
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp + eax*4 - 0x1dc]
cmp dword [ebp - 0x41c], eax
jge 0x1004e8a5
cmp dword [ebp - 0x394], 0x3b37
jge 0x1004e7bb
xor eax, eax
je 0x1004e7bb
mov dword [ebp - 0x3dc], 1
jmp 0x1004e7c2
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x8e0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa54], 8
jae 0x1004e7f0
mov eax, 0xa79cc099
test eax, eax
jne 0x1004e7f0
and dword [ebp - 0x708], 0
jmp 0x1004e7fa
mov dword [ebp - 0x708], 1
mov eax, dword [ebp - 0x394]
cmp dword [ebp - 0x708], eax
jg 0x1004e821
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa54], 0
jne 0x1004e821
and dword [ebp - 0x3e4], 0
jmp 0x1004e82b
mov dword [ebp - 0x3e4], 1
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x710], eax
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x710], eax
jl 0x1004e84e
mov dword [ebp - 0x3ec], 1
jmp 0x1004e855
and dword [ebp - 0x3ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa54]
cmp dword [ebp - 0x3ec], eax
jne 0x1004e876
mov dword [ebp - 0x718], 1
jmp 0x1004e87d
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x1dc], 0xdb6d
imul eax, dword [ebp - 0x718], 0xdb6d
test eax, eax
je 0x1004e8a5
mov dword [ebp - 0x3f4], 1
jmp 0x1004e8ac
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x394], eax
jmp 0x1004e710
mov byte [ebp - 0xc1], 0
push 0x6c6c
lea eax, [ebp - 0xc1]
push eax
push 1
call fcn.1004c910
add esp, 0xc
mov eax, dword [ebp - 0xc0]
cmp dword [eax], 0x4550
je 0x1004e8ed
jmp 0x10054251
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc0]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x54], eax
or dword [ebp - 0xa20], 0xffffffff
or dword [ebp - 0xa1c], 0xffffffff
or dword [ebp - 0xa18], 0xffffffff
or dword [ebp - 0xa14], 0xffffffff
lea ecx, [ebp - 0x379]
call fcn.10008ea3
push eax
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0xa20]
push eax
lea ecx, [ebp - 0xc78]
call fcn.10018c0e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb9c]
call fcn.10018bbd
mov dword [ebp - 4], 2
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x17c], 3
jmp 0x1004e97b
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jl 0x1004e9f9
mov dword [ebp - 0x138], 4
mov dword [ebp - 0x138], 0
jmp 0x1004e9a7
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 3
jg 0x1004e9ef
mov dword [ebp - 0x8e8], 0xfffffffc
push 0
lea eax, [ebp - 0x8e8]
push eax
push 0x2bf3
push 0xaa2
call fcn.1004ce56
add esp, 0x10
push dword [ebp - 0x138]
lea ecx, [ebp - 0xb9c]
call fcn.10018bff
cmp dword [eax], 0
je 0x1004e9ed
jmp 0x1004e9ef
jmp 0x1004e99a
call fcn.1004c99a
jmp 0x1004e96e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb9c]
call fcn.10018be3
mov eax, dword [ebp - 0x54]
cmp dword [eax + 4], 0
jne 0x1004ea16
jmp 0x10054251
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 0xc0]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xc0]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x3c], 0xe0a8eac8
mov dword [ebp - 0x78], 0xb302aff6
mov dword [ebp - 0xe4], 0xfffffffe
mov dword [ebp - 0x1e4], 0
jmp 0x1004ea65
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jge 0x1004ea81
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0x820], 0x47d2038e
jmp 0x1004ea58
mov dword [ebp - 0x3c], 0xffffffe7
jmp 0x1004ea91
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffed
jle 0x1004ebdf
mov dword [ebp - 0x1ec], 0x164caf14
mov dword [ebp - 0x184], 0
jmp 0x1004eabe
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 4
jge 0x1004eada
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0xc98], 0x9fe5
jmp 0x1004eab1
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0xb68], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xbcc], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xb70], eax
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x720], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x720]
mov dword [ebp + eax - 0x820], ecx
cmp dword [ebp - 0x720], 0
jne 0x1004eb32
cmp dword [ebp - 0x1ec], 0
jne 0x1004eb32
and dword [ebp - 0x3fc], 0
jmp 0x1004eb3c
mov dword [ebp - 0x3fc], 1
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x3fc], eax
je 0x1004eb56
mov dword [ebp - 0x728], 1
jmp 0x1004eb5d
and dword [ebp - 0x728], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc98]
cmp dword [ebp - 0x728], eax
jne 0x1004eb8b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x820], 0
jne 0x1004eb8b
and dword [ebp - 0x404], 0
jmp 0x1004eb95
mov dword [ebp - 0x404], 1
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x404], eax
jl 0x1004ebac
mov dword [ebp - 0x730], 1
jmp 0x1004ebb3
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x730], eax
jle 0x1004ebca
mov dword [ebp - 0x40c], 1
jmp 0x1004ebd1
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x78], eax
jmp 0x1004ea8a
cmp dword [ebp - 0x3c], 0
jne 0x1004ec05
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x820], 9
cmp dword [ebp - 0x78], 9
je 0x1004ec05
and dword [ebp - 0x738], 0
jmp 0x1004ec0f
mov dword [ebp - 0x738], 1
cmp dword [ebp - 0x738], 0
je 0x1004ec24
mov dword [ebp - 0x414], 1
jmp 0x1004ec2b
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x414], eax
jge 0x1004ec45
cmp dword [ebp - 0x3c], 0
jne 0x1004ec45
and dword [ebp - 0x740], 0
jmp 0x1004ec4f
mov dword [ebp - 0x740], 1
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x3c], eax
jne 0x1004ec75
mov dword [ebp - 0x748], 1
jmp 0x1004ec7c
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0xdd79
jle 0x1004eca0
mov dword [ebp - 0x6fc], 1
jmp 0x1004eca7
and dword [ebp - 0x6fc], 0
cmp dword [ebp - 0x6fc], 0
jb 0x1004ecfc
mov dword [ebp - 0xe4], 1
jmp 0x1004ecc9
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jl 0x1004ecfa
mov dword [ebp - 0x78], 0
jmp 0x1004ece2
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x1004ecf8
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x820], 0x63b88216
jmp 0x1004ecdb
jmp 0x1004ecbc
jmp 0x1004ed21
mov dword [ebp - 0x8f0], 2
push 0x54f
push 1
push 0x528f
lea eax, [ebp - 0x8f0]
push eax
call fcn.1004c9bd
add esp, 0x10
and dword [ebp - 0x36c], 0
jmp 0x1004ed46
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x8c]
add eax, 0x28
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0xc0]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x36c], eax
jge 0x1004edc2
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x424]
jb 0x1004edbd
mov eax, dword [ebp - 0xc0]
push dword [eax + 0x38]
mov eax, dword [ebp - 0x8c]
push dword [eax + 8]
call fcn.1004c62e
pop ecx
pop ecx
add eax, dword [ebp - 0x424]
mov dword [ebp - 0x8f8], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x8f8]
jae 0x1004edbd
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x8c]
mov eax, dword [eax + 0x14]
sub eax, dword [ecx + 0xc]
mov dword [ebp - 0x30], eax
jmp 0x1004edc2
jmp 0x1004ed2a
mov dword [ebp - 0x18c], 0
jmp 0x1004eddb
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 1
jge 0x1004edf7
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x1f4], 0xffffffff
jmp 0x1004edce
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1f4], 0
jmp 0x1004ee25
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1f4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1f4], 4
je 0x1004ee5d
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1004ee5b
push 1
push 0x76fe
push 0x7466
call fcn.1004ca33
add esp, 0xc
jmp 0x1004ee0a
cmp dword [ebp - 0x30], 0
jne 0x1004ee68
jmp 0x10054251
mov dword [ebp - 0x130], 0x5f88
mov dword [ebp - 0x194], 1
mov dword [ebp - 0x134], 0xb611fb8e
mov dword [ebp - 0x45c], 0x8a13c444
mov dword [ebp - 0x910], 0xfffa
push 4
lea ecx, [ebp - 0xab4]
call fcn.10018b61
mov dword [ebp - 4], 3
mov dword [ebp - 0x88], 0
jmp 0x1004eec7
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x1004eee0
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x48], 0xfffffff9
jmp 0x1004eeba
mov dword [ebp - 0x88], 0
jmp 0x1004eef9
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 4
jge 0x1004ef1b
push dword [ebp - 0x88]
lea ecx, [ebp - 0xab4]
call fcn.10018bff
mov dword [eax], 0xcd5c
jmp 0x1004eeec
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
add eax, 0x49f4ffcf
jne 0x1004ef42
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x48], 0
jne 0x1004ef42
and dword [ebp - 0x60c], 0
jmp 0x1004ef4c
mov dword [ebp - 0x60c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x60c], eax
jl 0x1004ef6a
mov dword [ebp - 0x42c], 1
jmp 0x1004ef71
and dword [ebp - 0x42c], 0
cmp dword [ebp - 0x42c], 0xee28
jg 0x1004ef89
mov dword [ebp - 0x77c], 1
jmp 0x1004ef90
and dword [ebp - 0x77c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
add eax, dword [ebp - 0x77c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x48]
jle 0x1004efb8
mov dword [ebp - 0x434], 1
jmp 0x1004efbf
and dword [ebp - 0x434], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
imul eax, dword [ebp - 0x434]
cmp eax, dword [ebp - 0x130]
jle 0x1004efe4
mov dword [ebp - 0x614], 1
jmp 0x1004efeb
and dword [ebp - 0x614], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x614], eax
jg 0x1004f009
mov dword [ebp - 0x43c], 1
jmp 0x1004f010
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x43c], 1
jge 0x1004f025
mov dword [ebp - 0x900], 1
jmp 0x1004f02c
and dword [ebp - 0x900], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
jne 0x1004f052
xor eax, eax
jne 0x1004f052
and dword [ebp - 0x704], 0
jmp 0x1004f05c
mov dword [ebp - 0x704], 1
cmp dword [ebp - 0x704], 0xffffffff
jle 0x1004f077
cmp dword [ebp - 0x130], 0
jne 0x1004f077
and dword [ebp - 0x444], 0
jmp 0x1004f081
mov dword [ebp - 0x444], 1
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x134], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
neg eax
cmp eax, 0xffffffff
jb 0x1004f0aa
mov dword [ebp - 0x61c], 1
jmp 0x1004f0b1
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0x61c]
jg 0x1004f134
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x130], eax
je 0x1004f0d9
mov dword [ebp - 0x908], 1
jmp 0x1004f0e0
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xc18], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x48], 0xffffffff
je 0x1004f105
mov dword [ebp - 0x44c], 1
jmp 0x1004f10c
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x134]
imul eax, dword [ebp - 0x44c]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x1004f134
mov dword [ebp - 0x7cc], 1
jmp 0x1004f13b
and dword [ebp - 0x7cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x7cc], eax
jge 0x1004f159
mov dword [ebp - 0x454], 1
jmp 0x1004f160
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x194], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x194], eax
jl 0x1004f18a
mov dword [ebp - 0x624], 1
jmp 0x1004f191
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x624]
sub eax, 5
mov dword [ebp - 0x45c], eax
jne 0x1004f1b4
cmp dword [ebp - 0x910], 0
jne 0x1004f1b4
and dword [ebp - 0x70c], 0
jmp 0x1004f1be
mov dword [ebp - 0x70c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x70c], eax
jle 0x1004f1dc
mov dword [ebp - 0x464], 1
jmp 0x1004f1e3
and dword [ebp - 0x464], 0
push 3
lea ecx, [ebp - 0xab4]
call fcn.10018bff
mov ecx, dword [ebp - 0x464]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xab4]
call fcn.10018be3
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x30]
add ecx, dword [eax]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xa48], 3
mov dword [ebp - 0xa44], 3
mov dword [ebp - 0xa40], 3
mov dword [ebp - 0xa3c], 3
lea ecx, [ebp - 0x38d]
call fcn.10008ea3
push eax
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0xa48]
push eax
lea ecx, [ebp - 0xc80]
call fcn.10018c0e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xbac]
call fcn.10018bbd
mov dword [ebp - 4], 4
mov dword [ebp - 0xec], 0
mov dword [ebp - 0x9c0], 2
mov dword [ebp - 0x9b0], 0x4c9d8d92
mov dword [ebp - 0x918], 0xfaead221
mov dword [ebp - 0xec], 3
jmp 0x1004f2ba
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x1004f338
mov dword [ebp - 0x9b8], 2
mov dword [ebp - 0x920], 1
mov dword [ebp - 0x928], 0xc8a81d5f
lea eax, [ebp - 0x918]
push eax
lea eax, [ebp - 0x920]
push eax
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0xec]
push eax
push 0x6f65
lea eax, [ebp - 0x9b0]
push eax
push 1
lea eax, [ebp - 0x9b8]
push eax
lea eax, [ebp - 0xbac]
push eax
lea eax, [ebp - 0x9c0]
push eax
call fcn.1004caa3
add esp, 0x28
cmp dword [ebp - 0xec], 0
je 0x1004f333
jmp 0x1004f338
jmp 0x1004f2ad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbac]
call fcn.10018be3
xor ecx, ecx
call fcn.1003595b
push eax
call fcn.100719f8
pop ecx
mov dword [ebp - 0x1fc], 0
jmp 0x1004f36e
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 2
jge 0x1004f38a
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x828], 0xfffffff8
jmp 0x1004f361
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x828], 9
jmp 0x1004f3b8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x828]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x828], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x828], 0xfffffff0
jg 0x1004f40d
mov dword [ebp - 0x19c], 1
mov dword [ebp - 0x19c], 0xfffffff4
jmp 0x1004f3eb
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 6
jg 0x1004f40b
mov dword [ebp - 0x9c8], 0xfffe
cmp dword [ebp - 0x9c8], 0
je 0x1004f409
jmp 0x1004f40b
jmp 0x1004f3de
jmp 0x1004f39d
mov byte [ebp - 0x338], 4
mov byte [ebp - 0x337], 5
mov byte [ebp - 0x336], 9
mov byte [ebp - 0x335], 8
mov byte [ebp - 0x334], 5
mov byte [ebp - 0x333], 1
mov byte [ebp - 0x332], 1
mov byte [ebp - 0x331], 4
mov byte [ebp - 0x330], 6
mov byte [ebp - 0x32f], 4
mov byte [ebp - 0x32e], 0x50
mov byte [ebp - 0x32d], 0x37
mov byte [ebp - 0x32c], 0xf
mov byte [ebp - 0x32b], 0xac
mov byte [ebp - 0x32a], 0x45
mov byte [ebp - 0x329], 0x3a
mov byte [ebp - 0x328], 0x18
mov byte [ebp - 0x327], 0x25
mov byte [ebp - 0x326], 0x48
mov byte [ebp - 0x325], 0xf
mov byte [ebp - 0x324], 0xb0
mov byte [ebp - 0x323], 0x17
mov byte [ebp - 0x322], 0xc2
mov byte [ebp - 0x321], 0x20
mov byte [ebp - 0x320], 0xa8
mov byte [ebp - 0x31f], 0x1c
mov byte [ebp - 0x31e], 0x13
mov byte [ebp - 0x31d], 0x13
mov byte [ebp - 0x31c], 0x9a
mov byte [ebp - 0x31b], 0xc
mov byte [ebp - 0x31a], 0xfe
mov byte [ebp - 0x319], 0x79
mov byte [ebp - 0x318], 0x5e
mov byte [ebp - 0x317], 0xfa
mov byte [ebp - 0x316], 0x38
mov byte [ebp - 0x315], 0xa1
mov byte [ebp - 0x314], 0xaa
mov byte [ebp - 0x313], 0x1a
mov byte [ebp - 0x312], 0xe5
mov byte [ebp - 0x311], 0x3b
mov byte [ebp - 0x310], 0xb2
mov byte [ebp - 0x30f], 0xb8
mov byte [ebp - 0x30e], 0x93
mov byte [ebp - 0x30d], 0x65
mov byte [ebp - 0x30c], 0x1f
mov byte [ebp - 0x30b], 0xb0
mov byte [ebp - 0x30a], 0x94
mov byte [ebp - 0x309], 0xcf
mov byte [ebp - 0x308], 0x17
mov byte [ebp - 0x307], 0x83
mov byte [ebp - 0x306], 0xab
mov byte [ebp - 0x305], 0x19
mov byte [ebp - 0x304], 0xe0
mov byte [ebp - 0x303], 0x60
mov byte [ebp - 0x302], 0x12
mov byte [ebp - 0x301], 0x7e
mov byte [ebp - 0x300], 0x33
mov byte [ebp - 0x2ff], 0xec
mov byte [ebp - 0x2fe], 0xad
mov byte [ebp - 0x2fd], 0x15
mov byte [ebp - 0x2fc], 0x46
mov byte [ebp - 0x2fb], 0xf1
mov byte [ebp - 0x2fa], 0x8b
mov byte [ebp - 0x2f9], 0x23
mov byte [ebp - 0x2f8], 0xbe
mov byte [ebp - 0x2f7], 0x64
mov byte [ebp - 0x2f6], 0x75
mov byte [ebp - 0x2f5], 0x35
mov byte [ebp - 0x2f4], 0xf9
mov byte [ebp - 0x2f3], 0x4a
mov byte [ebp - 0x2f2], 0x2b
mov byte [ebp - 0x2f1], 0xb6
mov byte [ebp - 0x2f0], 0x68
mov byte [ebp - 0x2ef], 0xa
mov byte [ebp - 0x2ee], 0xa9
mov byte [ebp - 0x2ed], 0xfe
mov byte [ebp - 0x2ec], 0x66
mov byte [ebp - 0x2eb], 0x9f
mov byte [ebp - 0x2ea], 0x78
mov byte [ebp - 0x2e9], 0xa8
mov byte [ebp - 0x2e8], 0xcd
mov byte [ebp - 0x2e7], 0x42
mov byte [ebp - 0x2e6], 0xe7
mov byte [ebp - 0x2e5], 0x2e
mov byte [ebp - 0x2e4], 0xb2
mov byte [ebp - 0x2e3], 0x7b
mov byte [ebp - 0x2e2], 0xc9
mov byte [ebp - 0x2e1], 0x8a
mov byte [ebp - 0x2e0], 0x7c
mov byte [ebp - 0x2df], 0x2b
mov byte [ebp - 0x2de], 0xfa
mov byte [ebp - 0x2dd], 0
mov byte [ebp - 0x2dc], 0
mov byte [ebp - 0x2db], 3
mov byte [ebp - 0x2da], 6
mov byte [ebp - 0x2d9], 7
mov byte [ebp - 0x2d8], 1
mov byte [ebp - 0x2d7], 8
mov byte [ebp - 0x2d6], 6
mov byte [ebp - 0x2d5], 2
mov byte [ebp - 0x2d4], 7
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x338]
or eax, 0x3d
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x338]
and ecx, 0x3d
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x338]
mov byte [ebp + ecx - 0x80c], al
mov dword [ebp - 0x44], 2
and dword [ebp - 0x204], 0
jmp 0x1004f721
mov eax, dword [ebp - 0x44]
inc eax
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x65
jae 0x1004f7e6
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x338]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x44], eax
jne 0x1004f76b
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x338]
inc eax
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x338]
mov ecx, dword [ebp - 0x44]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x44], eax
jmp 0x1004f719
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x337]
mov ecx, dword [ebp - 0x44]
sub ecx, dword [ebp - 0x204]
movzx ecx, byte [ebp + ecx - 0x33a]
movsx ecx, byte [ebp + ecx - 0x80c]
or eax, ecx
mov ecx, dword [ebp - 0x44]
movzx ecx, byte [ebp + ecx - 0x337]
mov edx, dword [ebp - 0x44]
sub edx, dword [ebp - 0x204]
movzx edx, byte [ebp + edx - 0x33a]
movsx edx, byte [ebp + edx - 0x80c]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x44]
movzx ecx, byte [ebp + ecx - 0x338]
mov byte [ebp + ecx - 0x80c], al
lea eax, [ebp - 0x204]
push eax
push 0x6008
push 0
call fcn.1004d867
add esp, 0xc
jmp 0x1004f719
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x80c], 0
push 3
lea ecx, [ebp - 0x7f4]
call fcn.10018b61
mov dword [ebp - 4], 5
mov dword [ebp - 0x20c], 1
mov dword [ebp - 0x788], 0x16747b1d
mov dword [ebp - 0x80], 0
jmp 0x1004f82c
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1004f842
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x26c], 0
jmp 0x1004f825
mov dword [ebp - 0x80], 0
jmp 0x1004f852
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x1004f86b
push dword [ebp - 0x80]
lea ecx, [ebp - 0x7f4]
call fcn.10018bff
or dword [eax], 0xffffffff
jmp 0x1004f84b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x26c], 0
jmp 0x1004f899
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x26c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x26c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x26c], 3
jl 0x1004fe62
mov dword [ebp - 0x10c], 0xfffffff6
mov dword [ebp - 0x70], 0x3eee2fde
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0x10c], 0
jmp 0x1004f8e1
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jne 0x1004fcba
mov dword [ebp - 0x9c], 0xfffffff6
mov dword [ebp - 0xb78], 0xde57
mov dword [ebp - 0xac], 0x7216709e
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x9c], 0
jmp 0x1004f932
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x22
je 0x1004fcb5
mov dword [ebp - 0x1a4], 0xebbd485
mov dword [ebp - 0x4c], 1
cmp dword [ebp - 0xb0], 0
jne 0x1004f979
mov eax, dword [ebp - 0x1a4]
mov ecx, dword [ebp - 0x1a4]
dec ecx
mov dword [ebp - 0x1a4], ecx
test eax, eax
jne 0x1004f979
and dword [ebp - 0x62c], 0
jmp 0x1004f983
mov dword [ebp - 0x62c], 1
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0x62c], eax
jl 0x1004f99d
mov dword [ebp - 0x46c], 1
jmp 0x1004f9a4
and dword [ebp - 0x46c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x26c]
cmp eax, dword [ebp - 0x46c]
jge 0x1004f9c5
mov dword [ebp - 0x780], 1
jmp 0x1004f9cc
and dword [ebp - 0x780], 0
cmp dword [ebp - 0x70], 0xfffffff9
jge 0x1004f9de
mov dword [ebp - 0x9d0], 1
jmp 0x1004f9e5
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x9c]
sub ecx, 0xfffc
imul eax, ecx
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
je 0x1004fa1b
cmp dword [ebp - 0xb0], 0
je 0x1004fa1b
mov dword [ebp - 0x474], 1
jmp 0x1004fa22
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x780]
cmp eax, dword [ebp - 0x474]
jg 0x1004fa3c
mov dword [ebp - 0x964], 1
jmp 0x1004fa43
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xbd4], eax
push 2
lea ecx, [ebp - 0x7f4]
call fcn.10018bff
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
jne 0x1004fa6d
mov dword [ebp - 0x634], 1
jmp 0x1004fa74
and dword [ebp - 0x634], 0
cmp dword [ebp - 0x634], 0xa6f63eed
jne 0x1004fa8c
mov dword [ebp - 0x47c], 1
jmp 0x1004fa93
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x47c], eax
jl 0x1004faad
mov dword [ebp - 0x714], 1
jmp 0x1004fab4
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x714]
sub eax, dword [ebp - 0x4c]
jne 0x1004fad1
cmp dword [ebp - 0xb0], 0
jne 0x1004fad1
and dword [ebp - 0x484], 0
jmp 0x1004fadb
mov dword [ebp - 0x484], 1
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x4c], 0
jmp 0x1004fafa
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jg 0x1004fcb0
mov dword [ebp - 0x980], 0x62b1
mov dword [ebp - 0xac], 2
jmp 0x1004fb27
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x1004fcab
push 3
lea ecx, [ebp - 0x9f0]
call fcn.10018b61
mov byte [ebp - 4], 6
push 0
lea eax, [ebp - 0xb80]
push eax
push 0x6d94
push 0x51c
lea eax, [ebp - 0x9f0]
push eax
push 0x612d
call fcn.1004d8a6
add esp, 0x18
mov dword [ebp - 0x70], 2
jmp 0x1004fb7c
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x1004fc97
cmp dword [ebp - 0x980], 8
je 0x1004fb9b
mov dword [ebp - 0x63c], 1
jmp 0x1004fba2
and dword [ebp - 0x63c], 0
push 2
lea ecx, [ebp - 0x9f0]
call fcn.10018bff
mov eax, dword [eax]
cmp eax, dword [ebp - 0x63c]
jge 0x1004fbc5
mov dword [ebp - 0x48c], 1
jmp 0x1004fbcc
and dword [ebp - 0x48c], 0
push dword [ebp - 0x70]
lea ecx, [ebp - 0x7f4]
call fcn.10018bff
mov esi, dword [eax]
add esi, dword [ebp - 0x48c]
push 2
lea ecx, [ebp - 0x9f0]
call fcn.10018bff
cmp esi, dword [eax]
je 0x1004fbff
mov dword [ebp - 0x898], 1
jmp 0x1004fc06
and dword [ebp - 0x898], 0
cmp dword [ebp - 0x1a4], 0xc9e5
jle 0x1004fc1e
mov dword [ebp - 0x7b8], 1
jmp 0x1004fc25
and dword [ebp - 0x7b8], 0
cmp dword [ebp - 0x7b8], 0xa600
jne 0x1004fc3d
mov dword [ebp - 0x494], 1
jmp 0x1004fc44
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x494], eax
jne 0x1004fc5b
mov dword [ebp - 0x644], 1
jmp 0x1004fc62
and dword [ebp - 0x644], 0
push dword [ebp - 0xac]
lea ecx, [ebp - 0x7f4]
call fcn.10018bff
mov ecx, dword [ebp - 0x644]
mov dword [eax], ecx
mov byte [ebp - 0xd1], 0
lea eax, [ebp - 0xd1]
push eax
push 0
call fcn.1004d423
pop ecx
pop ecx
jmp 0x1004fb75
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9f0]
call fcn.10018be3
jmp 0x1004fb1a
jmp 0x1004faf3
jmp 0x1004f925
jmp 0x1004f8d4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x26c]
cmp dword [ebp - 0x20c], eax
jl 0x1004fcdb
mov dword [ebp - 0x49c], 1
jmp 0x1004fce2
and dword [ebp - 0x49c], 0
cmp dword [ebp - 0x49c], 0
jle 0x1004fcf7
mov dword [ebp - 0x844], 1
jmp 0x1004fcfe
and dword [ebp - 0x844], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x26c]
mov dword [ebp - 0xc00], eax
cmp dword [ebp - 0x20c], 0
jne 0x1004fd2c
cmp dword [ebp - 0x20c], 0
jne 0x1004fd2c
and dword [ebp - 0x71c], 0
jmp 0x1004fd36
mov dword [ebp - 0x71c], 1
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0x70], eax
mov esi, dword [ebp - 0x70]
push 2
lea ecx, [ebp - 0x7f4]
call fcn.10018bff
cmp esi, dword [eax]
jg 0x1004fd5f
mov dword [ebp - 0x4a4], 1
jmp 0x1004fd66
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0x4a4]
jle 0x1004fd80
mov dword [ebp - 0x64c], 1
jmp 0x1004fd87
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x64c], eax
jne 0x1004fda1
mov dword [ebp - 0x4ac], 1
jmp 0x1004fda8
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x4ac], eax
jl 0x1004fdc2
mov dword [ebp - 0x4b4], 1
jmp 0x1004fdc9
and dword [ebp - 0x4b4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x26c]
mov dword [ebp - 0x788], eax
mov eax, dword [ebp - 0x788]
cmp eax, dword [ebp - 0x4b4]
jl 0x1004fdfc
cmp dword [ebp - 0xb0], 0
jne 0x1004fdfc
and dword [ebp - 0x654], 0
jmp 0x1004fe06
mov dword [ebp - 0x654], 1
push 1
lea ecx, [ebp - 0x7f4]
call fcn.10018bff
mov eax, dword [eax]
cmp eax, dword [ebp - 0x654]
jge 0x1004fe29
mov dword [ebp - 0x4bc], 1
jmp 0x1004fe30
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x4bc], eax
jl 0x1004fe4a
mov dword [ebp - 0x724], 1
jmp 0x1004fe51
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x10c], eax
jmp 0x1004f87e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7f4]
call fcn.10018be3
lea eax, [ebp - 0x80c]
push eax
lea ecx, [ebp - 0xcf0]
call fcn.100283f2
mov dword [ebp - 0x92c], eax
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0x84c], eax
mov dword [ebp - 4], 7
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x84c]
call fcn.1003591b
pop ecx
mov dword [ebp - 0x96c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcf0]
call fcn.10018ac3
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0x1ac], 0
jmp 0x1004fee4
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 1
jge 0x1004ff00
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0x4c4], 0xffffffff
jmp 0x1004fed7
mov byte [ebp - 0xe5], 0
push 1
push 0x6063
lea eax, [ebp - 0xe5]
push eax
call fcn.1004cc81
add esp, 0xc
mov dword [ebp - 0xf8], 0
jmp 0x1004ff36
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jl 0x1004ff7d
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0xf8]
mov eax, dword [ebp + eax*4 - 0x4c4]
mov dword [ebp + ecx*4 - 0x4c4], eax
mov byte [ebp - 0xc9], 0
lea eax, [ebp - 0xc9]
push eax
push 1
push 0x6340
push 0xb8
call fcn.1004ccd1
add esp, 0x10
jmp 0x1004ff29
and dword [ebp - 0x214], 0
jmp 0x1004ff93
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xb
jae 0x1004ffac
mov eax, dword [ebp - 0x214]
mov byte [ebp + eax - 0x80c], 0
jmp 0x1004ff86
mov dword [ebp - 0xb8], 0xdb3ae355
mov dword [ebp - 0x21c], 0x2a67
mov dword [ebp - 0x854], 0x6cedda56
mov dword [ebp - 0xb8], 0x16
jmp 0x1004ffe3
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 5
jle 0x100501f7
mov dword [ebp - 0x74], 0x8c443eb6
mov dword [ebp - 0x988], 0xde7504ed
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x10050022
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
cmp dword [ebp - 0x74], 0
jne 0x10050143
cmp dword [ebp - 0x74], 0
je 0x10050047
mov eax, 0x7182b474
test eax, eax
je 0x10050047
mov dword [ebp - 0x4dc], 1
jmp 0x1005004e
and dword [ebp - 0x4dc], 0
cmp dword [ebp - 0x74], 9
jl 0x10050060
mov dword [ebp - 0x65c], 1
jmp 0x10050067
and dword [ebp - 0x65c], 0
imul eax, dword [ebp - 0x65c], 0x8b01
cmp eax, dword [ebp - 0x74]
jl 0x10050082
mov dword [ebp - 0x4cc], 1
jmp 0x10050089
and dword [ebp - 0x4cc], 0
imul eax, dword [ebp - 0x4cc], 0x2a30
imul eax, eax, 0x7306
cmp dword [ebp - 0x74], eax
jge 0x100500aa
mov dword [ebp - 0x7bc], 1
jmp 0x100500b1
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0xb8]
add eax, dword [ebp - 0x7bc]
cmp eax, dword [ebp - 0x74]
jne 0x100500ce
mov dword [ebp - 0x4d4], 1
jmp 0x100500d5
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x4d4], eax
jge 0x100500ef
mov dword [ebp - 0x664], 1
jmp 0x100500f6
and dword [ebp - 0x664], 0
imul eax, dword [ebp - 0x664], 0
cmp dword [ebp - 0x4dc], eax
jne 0x10050111
mov dword [ebp - 0x72c], 1
jmp 0x10050118
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x72c], eax
jg 0x1005012f
mov dword [ebp - 0x4e4], 1
jmp 0x10050136
and dword [ebp - 0x4e4], 0
imul eax, dword [ebp - 0x4e4], 0
cmp eax, dword [ebp - 0xb8]
imul eax, dword [ebp - 0x21c], 0
cmp eax, dword [ebp - 0x21c]
jg 0x1005015e
mov dword [ebp - 0x66c], 1
jmp 0x10050165
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x74]
imul eax, dword [ebp - 0x66c]
mov dword [ebp - 0x988], eax
cmp dword [ebp - 0x21c], 0
je 0x100501a6
push 0x5eb1
lea eax, [ebp - 0x854]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x3fb0
push 0
lea eax, [ebp - 0x74]
push eax
call fcn.1004d25b
add esp, 0x18
jmp 0x100501f2
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x100501cc
push 0xe4f
push 1
push 0x727a
call fcn.1004cd6d
add esp, 0xc
mov byte [ebp - 0xdf], 0
movzx eax, byte [ebp - 0xdf]
test eax, eax
je 0x100501f2
push 1
push 0x464f
push 0x11de
call fcn.1004cde8
add esp, 0xc
jmp 0x1004ffd6
mov byte [ebp - 0x264], 6
mov byte [ebp - 0x263], 0x90
mov byte [ebp - 0x262], 8
mov byte [ebp - 0x261], 9
mov byte [ebp - 0x260], 5
mov byte [ebp - 0x25f], 1
mov byte [ebp - 0x25e], 1
mov byte [ebp - 0x25d], 7
mov byte [ebp - 0x25c], 2
mov byte [ebp - 0x25b], 1
mov byte [ebp - 0x25a], 3
mov byte [ebp - 0x259], 5
mov byte [ebp - 0x258], 9
mov byte [ebp - 0x257], 2
mov byte [ebp - 0x256], 0x2a
mov byte [ebp - 0x255], 0x79
mov byte [ebp - 0x254], 0x41
mov byte [ebp - 0x253], 0x89
mov byte [ebp - 0x252], 0xaf
mov byte [ebp - 0x251], 0x64
mov byte [ebp - 0x250], 0x1a
mov byte [ebp - 0x24f], 0xe0
mov byte [ebp - 0x24e], 0x7f
mov byte [ebp - 0x24d], 0x1c
mov byte [ebp - 0x24c], 0xa7
mov byte [ebp - 0x24b], 0xbb
mov byte [ebp - 0x24a], 0xf5
mov byte [ebp - 0x249], 0x59
mov byte [ebp - 0x248], 0x73
mov byte [ebp - 0x247], 0xa7
mov byte [ebp - 0x246], 0xbd
mov byte [ebp - 0x245], 0x5f
mov byte [ebp - 0x244], 0x29
mov byte [ebp - 0x243], 0xf5
mov byte [ebp - 0x242], 0x2c
mov byte [ebp - 0x241], 0xae
mov byte [ebp - 0x240], 0x1b
mov byte [ebp - 0x23f], 0x84
mov byte [ebp - 0x23e], 0x5a
mov byte [ebp - 0x23d], 0xfb
mov byte [ebp - 0x23c], 0xdb
mov byte [ebp - 0x23b], 0x41
mov byte [ebp - 0x23a], 0x56
mov byte [ebp - 0x239], 0xfa
mov byte [ebp - 0x238], 0x72
mov byte [ebp - 0x237], 0xdb
mov byte [ebp - 0x236], 0x70
mov byte [ebp - 0x235], 0xc2
mov byte [ebp - 0x234], 0xd0
mov byte [ebp - 0x233], 0xbe
mov byte [ebp - 0x232], 6
mov byte [ebp - 0x231], 0x3a
mov byte [ebp - 0x230], 0x7f
mov byte [ebp - 0x22f], 0x43
mov byte [ebp - 0x22e], 0x56
mov byte [ebp - 0x22d], 0x6c
mov byte [ebp - 0x22c], 0xc1
mov byte [ebp - 0x22b], 4
mov byte [ebp - 0x22a], 4
mov byte [ebp - 0x229], 7
mov byte [ebp - 0x228], 2
mov byte [ebp - 0x227], 0
mov byte [ebp - 0x226], 7
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x264]
or eax, 0xa9
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x264]
and ecx, 0xa9
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x264]
mov byte [ebp + ecx - 0x818], al
mov dword [ebp - 0x34], 2
and dword [ebp - 0x1c4], 0
jmp 0x10050406
mov eax, dword [ebp - 0x34]
inc eax
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x3f
jae 0x100504bc
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x264]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x34], eax
jne 0x10050450
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0x264]
inc eax
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0x264]
mov ecx, dword [ebp - 0x34]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x34], eax
jmp 0x100503fe
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0x263]
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x1c4]
movzx ecx, byte [ebp + ecx - 0x266]
movsx ecx, byte [ebp + ecx - 0x818]
or eax, ecx
mov ecx, dword [ebp - 0x34]
movzx ecx, byte [ebp + ecx - 0x263]
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x1c4]
movzx edx, byte [ebp + edx - 0x266]
movsx edx, byte [ebp + edx - 0x818]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x34]
movzx ecx, byte [ebp + ecx - 0x264]
mov byte [ebp + ecx - 0x818], al
and dword [ebp - 0x1c4], 0
jmp 0x100503fe
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x818], 0
push 2
lea ecx, [ebp - 0x160]
call fcn.10018b61
mov dword [ebp - 4], 8
mov dword [ebp - 0x3bc], 1
mov dword [ebp - 0x3b8], 1
mov dword [ebp - 0x3b4], 1
mov dword [ebp - 0x3b0], 1
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x98], 0x8fb0b44
mov dword [ebp - 0xae0], 1
mov dword [ebp - 0x1bc], 0
jmp 0x1005053d
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 2
jge 0x1005055f
push dword [ebp - 0x1bc]
lea ecx, [ebp - 0x160]
call fcn.10018bff
mov dword [eax], 0xfffffff6
jmp 0x10050530
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3bc], 0
jmp 0x1005058d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3bc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3bc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3bc], 1
jg 0x100509e2
mov dword [ebp - 0x5c], 0x525d2d91
mov dword [ebp - 0x384], 0xffffffff
mov dword [ebp - 0x1c0], 0
jmp 0x100505cb
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
jge 0x100505e7
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x1f8], 0xe92eda8e
jmp 0x100505be
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x3bc]
lea ecx, [ebp - 0x160]
call fcn.10018bff
mov dword [ebp - 0x4ec], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x3bc]
lea ecx, [ebp - 0x160]
call fcn.10018bff
mov ecx, dword [ebp - 0x4ec]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x4ec]
cmp dword [ecx], eax
jne 0x100507ea
mov dword [ebp - 0x218], 0xa8628405
mov dword [ebp - 0x1c8], 0x95dbc2a
mov dword [ebp - 0x85c], 0x846c8c5c
mov dword [ebp - 0x990], 1
cmp dword [ebp - 0x5c], 0
je 0x1005077f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f8]
mov dword [ebp - 0xae4], eax
push 1
lea ecx, [ebp - 0x160]
call fcn.10018bff
or ecx, 0xffffffff
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x1c8]
jg 0x100506a6
mov dword [ebp - 0x790], 1
jmp 0x100506ad
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x790]
shl eax, 1
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0xaec], eax
mov esi, dword [ebp - 0x98]
push 1
lea ecx, [ebp - 0x160]
call fcn.10018bff
sub esi, dword [eax]
mov dword [ebp - 0x93c], esi
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x3bc]
lea ecx, [ebp - 0x160]
call fcn.10018bff
mov ecx, dword [ebp - 0x93c]
mov dword [eax], ecx
cmp dword [ebp - 0x1c8], 0
jne 0x10050724
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1f8], 0
jne 0x10050724
and dword [ebp - 0x4f4], 0
jmp 0x1005072e
mov dword [ebp - 0x4f4], 1
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
cmp eax, dword [ebp - 0x4f4]
jge 0x10050755
mov dword [ebp - 0x674], 1
jmp 0x1005075c
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x384]
cmp dword [ebp - 0x674], eax
jg 0x1005077f
cmp dword [ebp - 0x218], 0
je 0x1005077f
mov dword [ebp - 0x4fc], 1
jmp 0x10050786
and dword [ebp - 0x4fc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4fc]
mov dword [ebp + eax - 0x1f8], ecx
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xaf4], eax
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0xafc], eax
cmp dword [ebp - 0x85c], 0x5ab
jge 0x100507c9
mov dword [ebp - 0x734], 1
jmp 0x100507d0
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x384]
add eax, dword [ebp - 0x734]
sub eax, dword [ebp - 0x5c]
mov dword [ebp - 0x990], eax
jmp 0x100509cf
mov dword [ebp - 0x998], 0
mov dword [ebp - 0x5c], 0
jmp 0x10050804
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jg 0x100509cf
mov dword [ebp - 0x94c], 5
mov dword [ebp - 0xa4], 0
jmp 0x10050831
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jg 0x1005088f
mov dword [ebp - 0x98], 0
jmp 0x10050853
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jl 0x1005088d
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x3bc]
lea ecx, [ebp - 0x160]
call fcn.10018bff
mov esi, eax
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x160]
call fcn.10018bff
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x10050846
jmp 0x10050824
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x160]
call fcn.10018bff
cmp dword [eax], 0x9f48
jge 0x100508b1
mov dword [ebp - 0x67c], 1
jmp 0x100508b8
and dword [ebp - 0x67c], 0
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x160]
call fcn.10018bff
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x3bc]
lea ecx, [ebp - 0x160]
call fcn.10018bff
mov esi, eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x160]
call fcn.10018bff
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x10050900
mov dword [ebp - 0x864], 1
jmp 0x10050907
and dword [ebp - 0x864], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x3bc]
lea ecx, [ebp - 0x160]
call fcn.10018bff
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xb04], eax
cmp dword [ebp - 0x5c], 0x3ee1
je 0x10050940
mov dword [ebp - 0x504], 1
jmp 0x10050947
and dword [ebp - 0x504], 0
imul eax, dword [ebp - 0x504], 0xe417
imul eax, dword [ebp - 0x94c]
imul eax, eax, 0x2184
imul eax, dword [ebp - 0x67c]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jne 0x1005099a
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x3bc]
lea ecx, [ebp - 0x160]
call fcn.10018bff
cmp dword [eax], 0
jne 0x1005099a
and dword [ebp - 0x86c], 0
jmp 0x100509a4
mov dword [ebp - 0x86c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f8]
mov dword [ebp - 0xb0c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3bc]
mov dword [ebp - 0x998], eax
jmp 0x100507fd
cmp dword [ebp - 0x384], 0
je 0x100509dd
jmp 0x10050572
jmp 0x10050572
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.10018be3
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0xcd8]
call fcn.100283f2
mov dword [ebp - 0x874], eax
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0x95c], eax
mov dword [ebp - 4], 9
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x95c]
call fcn.1003591b
pop ecx
mov dword [ebp - 0x894], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcd8]
call fcn.10018ac3
mov dword [ebp - 0x354], 0xd6c0
mov dword [ebp - 0x350], 0xd6c0
mov dword [ebp - 0x34c], 0xd6c0
mov dword [ebp - 0x348], 0xd6c0
mov dword [ebp - 0x694], 0x494dfd99
mov dword [ebp - 0x6c], 0
jmp 0x10050a83
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x10050a99
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x124], 0x3d8da8e9
jmp 0x10050a7c
mov dword [ebp - 0x6c], 0
jmp 0x10050aa9
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10050abf
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x8c4], 0
jmp 0x10050aa2
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x124], 3
jmp 0x10050aea
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x124]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x124], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x124], 0
jl 0x10050d9a
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x124]
mov eax, dword [ebp + eax*4 - 0x354]
mov dword [ebp - 0xb14], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x124]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x124]
imul eax, dword [ebp + ecx*4 - 0x354]
test eax, eax
je 0x10050b55
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x124], 0
je 0x10050b55
mov dword [ebp - 0x50c], 1
jmp 0x10050b5c
and dword [ebp - 0x50c], 0
cmp dword [ebp - 0x50c], 0x21046671
jne 0x10050b74
mov dword [ebp - 0x7c8], 1
jmp 0x10050b7b
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x7c8]
neg eax
cmp eax, 0xc5a3
jle 0x10050b96
mov dword [ebp - 0x514], 1
jmp 0x10050b9d
and dword [ebp - 0x514], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x124]
mov eax, dword [ebp + eax*4 - 0x354]
cmp dword [ebp - 0x514], eax
je 0x10050bdd
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x124], 0
jne 0x10050bdd
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x124]
cmp dword [ebp + eax*4 - 0x354], 0
je 0x10050c08
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x124]
cmp dword [ebp + eax*4 - 0x354], 0
je 0x10050c08
mov eax, 0x966e
test eax, eax
je 0x10050c08
mov dword [ebp - 0x684], 1
jmp 0x10050c0f
and dword [ebp - 0x684], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x124]
mov eax, dword [ebp + eax*4 - 0x354]
cmp dword [ebp - 0x684], eax
jg 0x10050c36
mov dword [ebp - 0x51c], 1
jmp 0x10050c3d
and dword [ebp - 0x51c], 0
cmp dword [ebp - 0x51c], 1
jg 0x10050c52
mov dword [ebp - 0x73c], 1
jmp 0x10050c59
and dword [ebp - 0x73c], 0
mov eax, 0x943c6fe2
sub eax, dword [ebp - 0x73c]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x124]
cmp eax, dword [ebp + ecx*4 - 0x354]
jg 0x10050c85
mov dword [ebp - 0x524], 1
jmp 0x10050c8c
and dword [ebp - 0x524], 0
mov eax, 0xcf415d72
sub eax, dword [ebp - 0x524]
cmp eax, 0xffffffff
jbe 0x10050ca8
mov dword [ebp - 0x68c], 1
jmp 0x10050caf
and dword [ebp - 0x68c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x124]
mov eax, dword [ebp + eax*4 - 0x354]
cmp dword [ebp - 0x68c], eax
jle 0x10050cec
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x124]
cmp dword [ebp + eax*4 - 0x354], 0
je 0x10050cec
mov dword [ebp - 0x52c], 1
jmp 0x10050cf3
and dword [ebp - 0x52c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x124]
cmp dword [ebp - 0x52c], eax
jne 0x10050d13
mov dword [ebp - 0x798], 1
jmp 0x10050d1a
and dword [ebp - 0x798], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x124]
mov eax, dword [ebp + eax*4 - 0x354]
cmp dword [ebp - 0x798], eax
jle 0x10050d41
mov dword [ebp - 0x534], 1
jmp 0x10050d48
and dword [ebp - 0x534], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x124]
mov eax, dword [ebp + eax*4 - 0x354]
cmp dword [ebp - 0x534], eax
jge 0x10050d6f
mov dword [ebp - 0x38c], 1
jmp 0x10050d76
and dword [ebp - 0x38c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x38c]
mov dword [ebp + eax - 0x8c4], ecx
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x694], eax
jmp 0x10050ad1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x354], 0
jne 0x10050e18
mov eax, 0x3020
test eax, eax
je 0x10050dcf
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x354], 4
je 0x10050dcf
mov dword [ebp - 0x53c], 1
jmp 0x10050dd6
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x694]
add eax, dword [ebp - 0x53c]
cmp eax, 4
jg 0x10050df3
mov dword [ebp - 0x744], 1
jmp 0x10050dfa
and dword [ebp - 0x744], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c4]
cmp dword [ebp - 0x744], eax
jne 0x10050e18
and dword [ebp - 0x544], 0
jmp 0x10050e22
mov dword [ebp - 0x544], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x544]
mov dword [ebp + eax - 0x8c4], ecx
and dword [ebp - 0x1d0], 0
jmp 0x10050e4b
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0xb
jae 0x10050e64
mov eax, dword [ebp - 0x1d0]
mov byte [ebp + eax - 0x818], 0
jmp 0x10050e3e
mov dword [ebp - 0x1c], 0x17ca0029
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x6a4], 0xfffffffd
push 3
lea ecx, [ebp - 0x800]
call fcn.10018b61
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x200], 0xffffffff
mov dword [ebp - 0xb1c], 6
mov dword [ebp - 0xb24], 1
push 1
push 0x2db4
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0xb2c]
push eax
call fcn.1004ce56
add esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xb34], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x210], eax
jge 0x10050ef4
mov eax, 0xa520
test eax, eax
jne 0x10050f03
cmp dword [ebp - 0x1c], 0
jne 0x10050f03
and dword [ebp - 0x69c], 0
jmp 0x10050f0d
mov dword [ebp - 0x69c], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x69c], eax
jne 0x10050f24
mov dword [ebp - 0x54c], 1
jmp 0x10050f2b
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x54c], eax
jge 0x10050f42
mov dword [ebp - 0x7c0], 1
jmp 0x10050f49
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x7c0]
neg eax
cmp dword [ebp - 0x1c], eax
jge 0x10050f65
mov dword [ebp - 0x554], 1
jmp 0x10050f6c
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x554]
jne 0x10050f83
mov dword [ebp - 0x87c], 1
jmp 0x10050f8a
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xb3c], eax
mov eax, dword [ebp - 0x210]
add eax, dword [ebp - 0x6a4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 2
jmp 0x10050fb2
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x10051256
mov dword [ebp - 0x9a0], 0xf0adc109
mov dword [ebp - 0x564], 0xd978029
mov dword [ebp - 0x884], 0xe360abed
mov dword [ebp - 0xb44], 0xce5f1497
push 3
lea ecx, [ebp - 0xac0]
call fcn.10018b61
mov byte [ebp - 4], 0xb
mov dword [ebp - 0xadc], 1
push 0
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0xac0]
push eax
push 0x760c
call fcn.1004e09f
add esp, 0x10
mov dword [ebp - 0x148], 0
jmp 0x10051035
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jge 0x10051051
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x88c], 0x9f7e48ff
jmp 0x10051028
push 0
lea eax, [ebp - 0x9a0]
push eax
lea eax, [ebp - 0x800]
push eax
push 0xcf
lea eax, [ebp - 0x1c]
push eax
push 0x46cb
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x6a4]
push eax
push 0xf6a
push 0x5986
push 0x45e9
lea eax, [ebp - 0x200]
push eax
call fcn.1004d4fb
add esp, 0x30
push 1
lea ecx, [ebp - 0x800]
call fcn.10018bff
cmp dword [eax], 0
jne 0x100510c9
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x800]
call fcn.10018bff
cmp dword [eax], 0
jne 0x100510c9
and dword [ebp - 0x55c], 0
jmp 0x100510d3
mov dword [ebp - 0x55c], 1
mov eax, dword [ebp - 0x564]
cmp eax, dword [ebp - 0x55c]
jl 0x100510ed
mov dword [ebp - 0x74c], 1
jmp 0x100510f4
and dword [ebp - 0x74c], 0
cmp dword [ebp - 0x74c], 0xbab
jl 0x10051112
cmp dword [ebp - 0x884], 0
jne 0x10051112
and dword [ebp - 0x9a8], 0
jmp 0x1005111c
mov dword [ebp - 0x9a8], 1
push 2
lea ecx, [ebp - 0x800]
call fcn.10018bff
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x800]
call fcn.10018bff
mov eax, dword [eax]
add eax, 0x722d53d0
mov ecx, dword [ebp - 0x564]
add ecx, 0x1ec8e12b
cmp eax, ecx
jl 0x1005115a
mov dword [ebp - 0x6ac], 1
jmp 0x10051161
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x6ac], eax
jl 0x10051195
lea eax, [ebp - 0x1c]
push eax
push 0x291
push 0
push 0x2b88
push 0x364b
lea eax, [ebp - 0x200]
push eax
call fcn.1004d7c1
add esp, 0x18
jmp 0x10051242
mov dword [ebp - 0x9bc], 0xffffffff
push 2
lea ecx, [ebp - 0xa9c]
call fcn.10018b61
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x1d8], 0
jmp 0x100511c9
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 2
jge 0x100511eb
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0xa9c]
call fcn.10018bff
mov dword [eax], 0xdd7081dc
jmp 0x100511bc
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x88c], 1
mov dword [ebp - 0x200], 1
mov esi, dword [ebp - 0x200]
push 1
lea ecx, [ebp - 0xa9c]
call fcn.10018bff
mov dword [eax], esi
lea eax, [ebp - 0x9bc]
push eax
lea eax, [ebp - 0xac0]
push eax
push 1
call fcn.1004ceca
add esp, 0xc
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xa9c]
call fcn.10018be3
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xac0]
call fcn.10018be3
jmp 0x10050fab
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x800]
call fcn.10018be3
push dword [ebp - 0x894]
push dword [ebp - 0x96c]
call fcn.10049708
pop ecx
pop ecx
mov dword [ebp - 0x56c], eax
push 0x7e15
push 0
lea eax, [ebp - 0xc0]
push eax
push 0x5695
lea eax, [ebp - 0x56c]
push eax
call fcn.1004cf20
add esp, 0x14
lea eax, [ebp - 0x56c]
push eax
push 1
push 0x5f8f
lea eax, [ebp - 0x18]
push eax
push 0x2aff
call fcn.1004cf20
add esp, 0x14
mov dword [ebp - 0x100], 0xc03342eb
mov dword [ebp - 0x89c], 0xffff
mov dword [ebp - 0x1e0], 0
jmp 0x100512ec
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 1
jge 0x10051308
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x9a4], 5
jmp 0x100512df
mov dword [ebp - 0x100], 0
jmp 0x10051321
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0xffffffea
jl 0x10051410
mov dword [ebp - 0x108], 0xcf54c3c6
mov dword [ebp - 0x108], 0
jmp 0x10051351
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0x1c
jg 0x10051400
mov dword [ebp - 0x220], 0x72226312
mov dword [ebp - 0x220], 0
jmp 0x10051381
mov eax, dword [ebp - 0x220]
dec eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0xfffffff1
jl 0x100513fb
push 2
lea ecx, [ebp - 0xad8]
call fcn.10018b61
mov dword [ebp - 4], 0xd
push 0x11ea
push 1
push 0x57b1
lea eax, [ebp - 0xb7c]
push eax
lea eax, [ebp - 0xad8]
push eax
call fcn.1004cf89
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0xad8]
push eax
push 0x73a4
push 0x3cb4
push 1
push 0x5de2
call fcn.1004d007
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xad8]
call fcn.10018be3
jmp 0x10051374
jmp 0x10051344
cmp dword [ebp - 0x108], 0
je 0x1005140b
jmp 0x10051410
jmp 0x10051314
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x89c]
cmp dword [ebp + eax - 0x9a4], ecx
jge 0x10051431
mov dword [ebp - 0x7a0], 1
jmp 0x10051438
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x7a0], eax
jle 0x10051452
mov dword [ebp - 0x574], 1
jmp 0x10051459
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x100], eax
and dword [ebp - 0x144], 0
mov dword [ebp - 0x84], 0xffffffff
mov dword [ebp - 0x57c], 0x135e1f6f
push 2
lea ecx, [ebp - 0xa84]
call fcn.10018b61
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x8a4], 0xf4f88039
push 0x2c0
push 0
lea eax, [ebp - 0xa84]
push eax
lea eax, [ebp - 0xbc0]
push eax
push 0x1301
call fcn.1004da9a
add esp, 0x14
mov dword [ebp - 0x84], 0
jmp 0x100514d9
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x1a
jne 0x100515f7
mov dword [ebp - 0x6b4], 0xfffffffc
mov dword [ebp - 0x6bc], 0xffffffff
cmp dword [ebp - 0x6b4], 0xfffffffb
jne 0x1005150f
mov dword [ebp - 0x584], 1
jmp 0x10051516
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xbc8], eax
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x84], eax
jl 0x1005153c
mov dword [ebp - 0x754], 1
jmp 0x10051543
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x57c], eax
mov eax, dword [ebp - 0x57c]
add eax, dword [ebp - 0x754]
cmp eax, dword [ebp - 0x84]
jg 0x1005156f
mov dword [ebp - 0x3a0], 1
jmp 0x10051576
and dword [ebp - 0x3a0], 0
push 1
lea ecx, [ebp - 0xa84]
call fcn.10018bff
mov ecx, dword [ebp - 0x3a0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
add eax, dword [ebp - 0x3a0]
mov ecx, dword [ebp - 0x584]
lea eax, [ecx + eax - 6]
mov dword [ebp - 0x6bc], eax
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x8a4], eax
mov byte [ebp - 0xe7], 0
movzx eax, byte [ebp - 0xe7]
test eax, eax
je 0x100515f2
push 0x7c0
push 0x4c34
push 0x236
push 0x61f8
push 0x7b81
push 0x72cc
push 1
push 0x50d1
call fcn.1004d155
add esp, 0x20
jmp 0x100514cc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa84]
call fcn.10018be3
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x18], 0
jbe 0x10051624
mov eax, dword [ebp - 0x18]
push dword [eax + 0x18]
push 0
call fcn.10049708
pop ecx
pop ecx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0x7e4], 0
mov dword [ebp - 0x7e0], 0
mov dword [ebp - 0x7dc], 0
push 4
lea ecx, [ebp - 0x3d0]
call fcn.10018b61
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x58c], 0x19d81479
mov dword [ebp - 0x974], 0xffffffff
mov dword [ebp - 0x76c], 0xffffffff
mov dword [ebp - 0x1e8], 0
jmp 0x10051697
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 4
jge 0x100516b9
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x3d0]
call fcn.10018bff
mov dword [eax], 1
jmp 0x1005168a
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x7e8], 0x7fd1
jge 0x100516d7
mov dword [ebp - 0x5a4], 1
jmp 0x100516de
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x58c]
inc eax
mov dword [ebp - 0x58c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x7e8], 0x6ec7
jg 0x10051709
mov dword [ebp - 0x760], 1
jmp 0x10051710
and dword [ebp - 0x760], 0
mov esi, dword [ebp - 0x760]
sub esi, 0x2f20
push 2
lea ecx, [ebp - 0x3d0]
call fcn.10018bff
imul esi, dword [eax]
push 2
lea ecx, [ebp - 0x3d0]
call fcn.10018bff
cmp esi, dword [eax]
je 0x10051749
mov dword [ebp - 0x594], 1
jmp 0x10051750
and dword [ebp - 0x594], 0
cmp dword [ebp - 0x594], 0xfffb
ja 0x10051768
mov dword [ebp - 0x6c4], 1
jmp 0x1005176f
and dword [ebp - 0x6c4], 0
push 2
lea ecx, [ebp - 0x3d0]
call fcn.10018bff
mov ecx, dword [ebp - 0x6c4]
cmp ecx, dword [eax]
jle 0x10051792
mov dword [ebp - 0x59c], 1
jmp 0x10051799
and dword [ebp - 0x59c], 0
imul eax, dword [ebp - 0x59c], 0x2e41
cmp eax, 0xfffffffa
je 0x100517c3
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x7e8], 0
je 0x100517c3
mov dword [ebp - 0x75c], 1
jmp 0x100517ca
and dword [ebp - 0x75c], 0
push 4
pop eax
imul eax, eax, 3
mov esi, dword [ebp + eax - 0x7e8]
add esi, dword [ebp - 0x75c]
add esi, dword [ebp - 0x5a4]
push 0
lea ecx, [ebp - 0x3d0]
call fcn.10018bff
cmp esi, dword [eax]
jge 0x10051800
mov dword [ebp - 0x6cc], 1
jmp 0x10051807
and dword [ebp - 0x6cc], 0
push 2
lea ecx, [ebp - 0x3d0]
call fcn.10018bff
mov ecx, dword [ebp - 0x6cc]
mov dword [eax], ecx
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x1005184b
push 2
lea ecx, [ebp - 0x3d0]
call fcn.10018bff
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x7e8], 0
je 0x1005184b
mov dword [ebp - 0x5ac], 1
jmp 0x10051852
and dword [ebp - 0x5ac], 0
cmp dword [ebp - 0x5ac], 0x6982
jge 0x1005186a
mov dword [ebp - 0x5b4], 1
jmp 0x10051871
and dword [ebp - 0x5b4], 0
mov esi, dword [ebp - 0x974]
push 0
lea ecx, [ebp - 0x3d0]
call fcn.10018bff
cmp esi, dword [eax]
jle 0x10051894
mov dword [ebp - 0x764], 1
jmp 0x1005189b
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x764]
sub eax, 8
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x7e8]
jl 0x100518be
mov dword [ebp - 0x6d4], 1
jmp 0x100518c5
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x5b4]
cmp eax, dword [ebp - 0x6d4]
jl 0x100518df
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x888], eax
mov eax, dword [ebp - 0x888]
mov dword [ebp - 0x890], eax
mov eax, dword [ebp - 0x890]
movzx eax, byte [eax]
test eax, eax
je 0x10054251
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret