Function at 0x10048249
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008f39c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x610
push esi
and dword [ebp - 0x1fc], 0
mov dword [ebp - 0x68], 4
mov dword [ebp - 0x138], 0
jmp 0x1004828f
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jge 0x100482ab
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x390], 0xfffffffe
jmp 0x10048282
push 0
call fcn.1004af8f
pop ecx
mov dword [ebp - 0x68], 1
jmp 0x100482c3
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x100484e1
mov dword [ebp - 0x30c], 0x3ae5d5ec
mov dword [ebp - 0x3f8], 0xb55e9731
mov dword [ebp - 0x114], 0
jmp 0x100482fa
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 3
jge 0x10048316
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x3b0], 0xdc7555b7
jmp 0x100482ed
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3b0], 1
jmp 0x10048344
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3b0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3b0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3b0], 0
jl 0x100484c7
mov eax, dword [ebp - 0x68]
cmp dword [ebp + eax*4 - 0x390], 0
jne 0x10048467
mov eax, dword [ebp - 0x68]
cmp dword [ebp + eax*4 - 0x390], 8
jge 0x10048384
xor eax, eax
inc eax
jne 0x10048384
and dword [ebp - 0x370], 0
jmp 0x1004838e
mov dword [ebp - 0x370], 1
cmp dword [ebp - 0x370], 1
jge 0x100483a3
mov dword [ebp - 0x37c], 1
jmp 0x100483aa
and dword [ebp - 0x37c], 0
cmp dword [ebp - 0x37c], 0xefbde283
ja 0x100483d1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3b0], 0
je 0x100483d1
mov dword [ebp - 0x384], 1
jmp 0x100483d8
and dword [ebp - 0x384], 0
cmp dword [ebp - 0x384], 1
jne 0x100483fd
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3b0], 0
je 0x100483fd
mov dword [ebp - 0x3a0], 1
jmp 0x10048404
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x3a0]
add eax, 8
cmp eax, 0xf591
je 0x10048420
mov dword [ebp - 0x208], 1
jmp 0x10048427
and dword [ebp - 0x208], 0
cmp dword [ebp - 0x208], 0xfffffffd
je 0x10048445
mov eax, 0x66ef
test eax, eax
je 0x10048445
mov dword [ebp - 0x304], 1
jmp 0x1004844c
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x304]
sub ecx, dword [ebp + eax*4 - 0x390]
jne 0x10048467
and dword [ebp - 0x3c8], 0
jmp 0x10048471
mov dword [ebp - 0x3c8], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x390]
mov dword [ebp - 0x4f4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x390], 0x7bb1a88a
jle 0x100484a3
mov dword [ebp - 0x1a0], 1
jmp 0x100484aa
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x3f8], eax
jmp 0x10048329
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3b0], 0
je 0x100484dc
jmp 0x100482bc
jmp 0x100482bc
mov byte [ebp - 0x180], 5
mov byte [ebp - 0x17f], 0x97
mov byte [ebp - 0x17e], 9
mov byte [ebp - 0x17d], 0xc
mov byte [ebp - 0x17c], 0x11
mov byte [ebp - 0x17b], 0x18
mov byte [ebp - 0x17a], 0xd
mov byte [ebp - 0x179], 0x1c
mov byte [ebp - 0x178], 0x15
mov byte [ebp - 0x177], 0x18
mov byte [ebp - 0x176], 0x10
mov byte [ebp - 0x175], 7
mov byte [ebp - 0x174], 4
mov byte [ebp - 0x173], 0x78
mov byte [ebp - 0x172], 0x54
mov byte [ebp - 0x171], 0x1b
mov byte [ebp - 0x170], 0x75
mov byte [ebp - 0x16f], 0x19
mov byte [ebp - 0x16e], 0xb
mov byte [ebp - 0x16d], 0x18
mov byte [ebp - 0x16c], 3
mov byte [ebp - 0x16b], 0x13
mov byte [ebp - 0x16a], 0xd
mov byte [ebp - 0x169], 3
mov byte [ebp - 0x168], 0x10
mov byte [ebp - 0x167], 8
mov byte [ebp - 0x166], 0xd
mov byte [ebp - 0x165], 2
mov byte [ebp - 0x164], 0xa
mov byte [ebp - 0x163], 0xb
mov byte [ebp - 0x162], 0xf
mov byte [ebp - 0x161], 0
mov byte [ebp - 0x160], 0xd
mov byte [ebp - 0x15f], 0x16
mov byte [ebp - 0x15e], 0x16
mov byte [ebp - 0x15d], 0xe
mov byte [ebp - 0x15c], 0x18
mov byte [ebp - 0x15b], 0x14
mov byte [ebp - 0x15a], 0x1a
mov byte [ebp - 0x159], 7
mov byte [ebp - 0x158], 0x1d
mov byte [ebp - 0x157], 1
mov byte [ebp - 0x156], 0xa
mov byte [ebp - 0x155], 4
mov byte [ebp - 0x154], 7
mov byte [ebp - 0x153], 0x17
mov byte [ebp - 0x152], 0x1d
mov byte [ebp - 0x151], 0xa
mov byte [ebp - 0x150], 0x13
mov byte [ebp - 0x14f], 0xc
mov byte [ebp - 0x14e], 6
mov byte [ebp - 0x14d], 0x12
mov byte [ebp - 0x14c], 0x1e
mov byte [ebp - 0x14b], 0xf
mov byte [ebp - 0x14a], 3
mov byte [ebp - 0x149], 6
mov byte [ebp - 0x148], 0x17
mov dword [ebp - 0x32c], 0x9d3388a0
mov dword [ebp - 0x408], 6
mov dword [ebp - 0x520], 0
mov dword [ebp - 0x48], 0
jmp 0x1004869e
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x100486b4
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x144], 0xffffffff
jmp 0x10048697
mov dword [ebp - 0x48], 0
jmp 0x100486c4
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x100486da
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x3b8], 0x9989d221
jmp 0x100486bd
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x144]
mov dword [ebp + ecx - 0x3b8], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x3b8]
cmp dword [ebp + eax - 0x144], ecx
jne 0x1004871c
mov dword [ebp - 0x1a8], 1
jmp 0x10048723
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x1a8]
neg eax
mov ecx, 0x441a62a9
sub ecx, eax
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x144]
jge 0x1004874d
mov dword [ebp - 0x314], 1
jmp 0x10048754
and dword [ebp - 0x314], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x144]
imul eax, dword [ebp - 0x314]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x144]
jl 0x10048783
mov dword [ebp - 0x1b0], 1
jmp 0x1004878a
and dword [ebp - 0x1b0], 0
cmp dword [ebp - 0x1b0], 0xbeab1d6a
ja 0x100487a2
mov dword [ebp - 0x31c], 1
jmp 0x100487a9
and dword [ebp - 0x31c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x144]
cmp dword [ebp - 0x31c], eax
jle 0x100487ca
mov dword [ebp - 0x1b8], 1
jmp 0x100487d1
and dword [ebp - 0x1b8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x144]
cmp dword [ebp - 0x1b8], eax
jge 0x100487f2
mov dword [ebp - 0x324], 1
jmp 0x100487f9
and dword [ebp - 0x324], 0
cmp dword [ebp - 0x324], 0x8e2
jl 0x10048811
mov dword [ebp - 0x1c0], 1
jmp 0x10048818
and dword [ebp - 0x1c0], 0
cmp dword [ebp - 0x1c0], 0
jge 0x1004882d
mov dword [ebp - 0x400], 1
jmp 0x10048834
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x56c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x144]
cmp dword [ebp - 0x32c], eax
jg 0x10048861
mov dword [ebp - 0x1c8], 1
jmp 0x10048868
and dword [ebp - 0x1c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x144]
cmp eax, dword [ebp - 0x1c8]
je 0x1004888b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3b8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3b8]
mov dword [ebp - 0x408], eax
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x180]
or eax, 0xf1
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x180]
and ecx, 0xf1
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x180]
mov byte [ebp + ecx - 0x4bc], al
mov dword [ebp - 0x1c], 0x469ad59e
mov dword [ebp - 0x1f8], 0x7d239f94
mov dword [ebp - 0xc8], 4
mov dword [ebp - 0x454], 0xadcfec76
mov dword [ebp - 0xe4], 0
jmp 0x1004891a
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 3
jge 0x10048936
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0x124], 0
jmp 0x1004890d
mov dword [ebp - 0x1c], 0
jmp 0x10048946
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x100489e0
mov dword [ebp - 0xc0], 0xf390197f
mov dword [ebp - 0xc0], 2
jmp 0x10048973
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jl 0x100489db
mov dword [ebp - 0x13c], 0x576c3a0b
mov dword [ebp - 0x13c], 0
jmp 0x1004899f
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 2
jg 0x100489d9
mov byte [ebp - 0x89], 0
push 0xcfb
push 0
lea eax, [ebp - 0x89]
push eax
call fcn.1004b125
add esp, 0xc
mov eax, dword [ebp - 0xc0]
cmp dword [ebp + eax*4 - 0x124], 0
je 0x100489d7
jmp 0x100489d9
jmp 0x10048992
jmp 0x10048966
jmp 0x1004893f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x124]
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x1c], 0
jne 0x10048c1f
cmp dword [ebp - 0x1c], 0
jne 0x10048a15
mov eax, 0xe7bf5cbf
test eax, eax
jne 0x10048a15
and dword [ebp - 0x334], 0
jmp 0x10048a1f
mov dword [ebp - 0x334], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x124]
imul eax, dword [ebp - 0x334]
cmp eax, dword [ebp - 0x1c]
je 0x10048a43
mov dword [ebp - 0x1d0], 1
jmp 0x10048a4a
and dword [ebp - 0x1d0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1d0]
sub ecx, dword [ebp + eax - 0x124]
push 4
pop eax
shl eax, 1
imul ecx, dword [ebp + eax - 0x124]
cmp ecx, 0xbca0becc
jbe 0x10048a7e
mov dword [ebp - 0x33c], 1
jmp 0x10048a85
and dword [ebp - 0x33c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x124]
cmp dword [ebp - 0x33c], eax
jl 0x10048aa6
mov dword [ebp - 0x1d8], 1
jmp 0x10048aad
and dword [ebp - 0x1d8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1d8]
sub ecx, dword [ebp + eax - 0x124]
cmp ecx, 0x8c6dcff2
je 0x10048ad3
mov dword [ebp - 0x410], 1
jmp 0x10048ada
and dword [ebp - 0x410], 0
mov eax, 0xfb389fa1
sub eax, dword [ebp - 0x1c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x124]
jne 0x10048afd
mov dword [ebp - 0x344], 1
jmp 0x10048b04
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x344], eax
jl 0x10048b21
cmp dword [ebp - 0x1c], 0
je 0x10048b21
mov dword [ebp - 0x1e0], 1
jmp 0x10048b28
and dword [ebp - 0x1e0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e0]
sub ecx, dword [ebp + eax - 0x124]
je 0x10048b59
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x124], 0
je 0x10048b59
mov dword [ebp - 0x34c], 1
jmp 0x10048b60
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x34c], eax
jle 0x10048b77
mov dword [ebp - 0x1e8], 1
jmp 0x10048b7e
and dword [ebp - 0x1e8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x124]
cmp dword [ebp - 0x1e8], eax
jne 0x10048b9f
mov dword [ebp - 0x354], 1
jmp 0x10048ba6
and dword [ebp - 0x354], 0
cmp dword [ebp - 0x354], 0xbdeb
jl 0x10048bbe
mov dword [ebp - 0x1f0], 1
jmp 0x10048bc5
and dword [ebp - 0x1f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x124]
cmp dword [ebp - 0x1f0], eax
jle 0x10048be6
mov dword [ebp - 0x35c], 1
jmp 0x10048bed
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1f8]
neg eax
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x124]
jge 0x10048c1f
and dword [ebp - 0x364], 0
jmp 0x10048c29
mov dword [ebp - 0x364], 1
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x364], eax
je 0x10048c43
mov dword [ebp - 0x438], 1
jmp 0x10048c4a
and dword [ebp - 0x438], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x124]
mov dword [ebp - 0x588], eax
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0xc8], eax
je 0x10048c77
mov dword [ebp - 0x440], 1
jmp 0x10048c7e
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x20], 2
and dword [ebp - 0x10c], 0
jmp 0x10048cae
mov eax, dword [ebp - 0x20]
inc eax
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x39
jae 0x1004a0b5
mov dword [ebp - 0x70], 0xf444
mov dword [ebp - 0xbc], 1
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x18], 0
jmp 0x10048ce0
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x10048cf6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa4], 0x6e5c7a00
jmp 0x10048cd9
mov dword [ebp - 0x18], 0
jmp 0x10048d06
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x10048d1c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3f0], 0x2e63372
jmp 0x10048cff
mov dword [ebp - 0x18], 0
jmp 0x10048d2c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10048d42
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5ec], 1
jmp 0x10048d25
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa4]
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x70], 0xffff
cmp dword [ebp - 0x70], 0
je 0x10048d7e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa4], 0
je 0x10048d7e
mov dword [ebp - 0x200], 1
jmp 0x10048d85
and dword [ebp - 0x200], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa4]
cmp dword [ebp - 0x200], eax
jl 0x10048da6
mov dword [ebp - 0x36c], 1
jmp 0x10048dad
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0xbc]
imul eax, dword [ebp - 0x36c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xa4]
jg 0x10048dd5
mov dword [ebp - 0x430], 1
jmp 0x10048ddc
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa4]
add eax, dword [ebp - 0x24]
cmp eax, 0x6cce
jge 0x10048e08
mov dword [ebp - 0x374], 1
jmp 0x10048e0f
and dword [ebp - 0x374], 0
cmp dword [ebp - 0x374], 0x9e88
jl 0x10048e27
mov dword [ebp - 0x378], 1
jmp 0x10048e2e
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x378], eax
jge 0x10048e48
mov dword [ebp - 0x210], 1
jmp 0x10048e4f
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x210]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x70], 0xfffffff4
jmp 0x10048e6b
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x18
je 0x100490f4
mov dword [ebp - 0x3d4], 0xfffffffe
mov dword [ebp - 0x230], 1
mov dword [ebp - 0xec], 0
jmp 0x10048ea2
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 2
jge 0x10048ebe
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x4cc], 0xa95534fd
jmp 0x10048e95
mov dword [ebp - 0xbc], 0x13
jmp 0x10048ed7
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xb
jl 0x100490ef
mov dword [ebp - 0x484], 0xa88f
mov dword [ebp - 0x480], 0xa88f
mov dword [ebp - 0x47c], 0xa88f
mov dword [ebp - 0x478], 0xa88f
mov dword [ebp - 0x24], 0
jmp 0x10048f1c
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jg 0x10048f5b
mov byte [ebp - 0x71], 0
push 0x4b9e
lea eax, [ebp - 0x71]
push eax
push 0
call fcn.10048147
add esp, 0xc
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x10048f59
push 0
push 0xd86
push 0x5850
call fcn.1004b770
add esp, 0xc
jmp 0x10048f15
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x3f0]
cmp dword [ebp + eax - 0xa4], ecx
jge 0x10048f83
mov dword [ebp - 0x2e8], 1
jmp 0x10048f8a
and dword [ebp - 0x2e8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x484]
mov dword [ebp - 0x514], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x3d4]
sub ecx, 3
cmp dword [ebp + eax - 0x484], ecx
jg 0x10048fc3
mov dword [ebp - 0x2e0], 1
jmp 0x10048fca
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2e0], eax
je 0x10048fe1
mov dword [ebp - 0x218], 1
jmp 0x10048fe8
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1004900c
cmp dword [ebp - 0x230], 0
je 0x1004900c
mov dword [ebp - 0x348], 1
jmp 0x10049013
and dword [ebp - 0x348], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x484]
cmp dword [ebp - 0x348], eax
jle 0x10049034
mov dword [ebp - 0x220], 1
jmp 0x1004903b
and dword [ebp - 0x220], 0
cmp dword [ebp - 0x220], 0xfff9
je 0x10049053
mov dword [ebp - 0x228], 1
jmp 0x1004905a
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x2e8]
cmp eax, dword [ebp - 0x228]
jl 0x1004907a
mov eax, 0xfff7
test eax, eax
jne 0x1004907a
and dword [ebp - 0x398], 0
jmp 0x10049084
mov dword [ebp - 0x398], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x398]
mov dword [ebp + eax - 0x4cc], ecx
cmp dword [ebp - 0x70], 0
je 0x100490b2
cmp dword [ebp - 0x230], 0
je 0x100490b2
mov dword [ebp - 0x2f0], 1
jmp 0x100490b9
and dword [ebp - 0x2f0], 0
cmp dword [ebp - 0x2f0], 0x6f2c
jl 0x100490d1
mov dword [ebp - 0x238], 1
jmp 0x100490d8
and dword [ebp - 0x238], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x238]
mov dword [ebp + eax - 0x5ec], ecx
jmp 0x10048eca
jmp 0x10048e64
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x180]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x20], eax
jne 0x10049aa9
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x100], 0x3411
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x308], 0xfffffff8
cmp dword [ebp - 0x78], 0
je 0x10049181
mov dword [ebp - 0xfc], 0
jmp 0x10049150
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 2
jge 0x1004916c
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x4d8], 0
jmp 0x10049143
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x78]
mov dword [ebp + eax - 0x4d8], ecx
jmp 0x10049307
mov dword [ebp - 0x450], 0xfcb1
mov dword [ebp - 0x44c], 0xfcb1
mov dword [ebp - 0x448], 0xfcb1
mov dword [ebp - 0x444], 0xfcb1
mov dword [ebp - 0x350], 0
mov dword [ebp - 0xf4], 0
jmp 0x100491cc
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 4
jge 0x100491e8
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x5dc], 0xffffffff
jmp 0x100491bf
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x450]
cmp dword [ebp - 0x100], eax
jge 0x10049209
mov dword [ebp - 0x240], 1
jmp 0x10049210
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x350]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x450]
imul ecx, dword [ebp - 0x240]
imul eax, ecx
cmp eax, dword [ebp - 0x100]
jge 0x10049249
mov dword [ebp - 0x2f8], 1
jmp 0x10049250
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x100]
imul eax, dword [ebp - 0x2f8]
cmp eax, 0xb0a6
jle 0x10049270
mov dword [ebp - 0x420], 1
jmp 0x10049277
and dword [ebp - 0x420], 0
push 4
pop eax
shl eax, 0
imul eax, dword [ebp + eax - 0x450], 0
cmp eax, dword [ebp - 0x80]
jle 0x10049296
mov dword [ebp - 0x248], 1
jmp 0x1004929d
and dword [ebp - 0x248], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x450]
cmp eax, dword [ebp - 0x248]
je 0x100492be
mov dword [ebp - 0x3dc], 1
jmp 0x100492c5
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x51c], eax
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x308], eax
je 0x100492e8
mov dword [ebp - 0x380], 1
jmp 0x100492ef
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x380]
sub eax, 0x6a5b5cf0
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x5dc], eax
mov dword [ebp - 0x80], 0
jmp 0x10049317
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0xfffffff0
jg 0x10049628
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x258], 0xfffffffc
mov dword [ebp - 0x43c], 0xbe926f5d
mov dword [ebp - 0x78], 0
jmp 0x1004934c
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x15
jg 0x10049615
mov dword [ebp - 0x190], 1
mov dword [ebp - 0x388], 0x268dd2ac
mov dword [ebp - 0x280], 0xcff2
mov dword [ebp - 0xd8], 0
jmp 0x1004938d
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x100493a9
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x3c4], 0xecc33bab
jmp 0x10049380
lea eax, [ebp - 0x280]
push eax
push 0
call fcn.1004b2b8
pop ecx
pop ecx
mov dword [ebp - 0x30], 0
jmp 0x100493c9
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x10049610
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x3c4], 0
je 0x1004957a
mov eax, 0x3fe2
test eax, eax
je 0x100493f4
cmp dword [ebp - 0x258], 0
mov eax, 0xe95
test eax, eax
jb 0x10049409
mov dword [ebp - 0x250], 1
jmp 0x10049410
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x3c4]
cmp dword [ebp - 0x250], eax
je 0x1004942e
mov dword [ebp - 0x300], 1
jmp 0x10049435
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x190]
cmp eax, dword [ebp - 0x300]
jg 0x1004944f
mov dword [ebp - 0x358], 1
jmp 0x10049456
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x358]
je 0x10049470
mov dword [ebp - 0x260], 1
jmp 0x10049477
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x3c4]
cmp dword [ebp - 0x260], eax
je 0x10049495
mov dword [ebp - 0x268], 1
jmp 0x1004949c
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x308]
cmp dword [ebp - 0x268], eax
jne 0x100494b6
mov dword [ebp - 0x3a4], 1
jmp 0x100494bd
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x190]
add eax, dword [ebp - 0x3a4]
cmp eax, 0xaf32
jge 0x100494dc
mov dword [ebp - 0x270], 1
jmp 0x100494e3
and dword [ebp - 0x270], 0
cmp dword [ebp - 0x270], 9
jae 0x10049505
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x3c4], 0
je 0x10049505
mov dword [ebp - 0x310], 1
jmp 0x1004950c
and dword [ebp - 0x310], 0
cmp dword [ebp - 0x310], 0x584d75f0
jl 0x10049524
mov dword [ebp - 0x278], 1
jmp 0x1004952b
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x3c4]
cmp dword [ebp - 0x278], eax
jg 0x10049549
mov dword [ebp - 0x18c], 1
jmp 0x10049550
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x3c4], ecx
mov eax, dword [ebp - 0x190]
add eax, dword [ebp - 0x18c]
je 0x1004957a
mov dword [ebp - 0x360], 1
jmp 0x10049581
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x360], eax
jle 0x10049598
mov dword [ebp - 0x424], 1
jmp 0x1004959f
and dword [ebp - 0x424], 0
cmp dword [ebp - 0x30], 0
je 0x100495b1
mov dword [ebp - 0x3e4], 1
jmp 0x100495b8
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x388], 0xc39b9878
jne 0x100495dc
mov dword [ebp - 0x318], 1
jmp 0x100495e3
and dword [ebp - 0x318], 0
cmp dword [ebp - 0x318], 7
je 0x100495f8
mov dword [ebp - 0x288], 1
jmp 0x100495ff
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x388], eax
jmp 0x100493c2
jmp 0x10049345
cmp dword [ebp - 0x43c], 0
je 0x10049623
jmp 0x10049310
jmp 0x10049310
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x180]
inc eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x88], 0xf444
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x14], 0
jmp 0x10049665
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1004967b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb8], 0x6e5c7a00
jmp 0x1004965e
mov dword [ebp - 0x14], 0
jmp 0x1004968b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x100496a1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x42c], 0x2e63372
jmp 0x10049684
mov dword [ebp - 0x14], 0
jmp 0x100496b1
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x100496c7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x60c], 1
jmp 0x100496aa
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
mov dword [ebp - 0x52c], eax
mov dword [ebp - 0x88], 0xffff
cmp dword [ebp - 0x88], 0
je 0x10049709
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb8], 0
je 0x10049709
mov dword [ebp - 0x290], 1
jmp 0x10049710
and dword [ebp - 0x290], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
cmp dword [ebp - 0x290], eax
jl 0x10049731
mov dword [ebp - 0x320], 1
jmp 0x10049738
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0xb0]
imul eax, dword [ebp - 0x320]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xb8]
jg 0x10049760
mov dword [ebp - 0x3ec], 1
jmp 0x10049767
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x574], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
add eax, dword [ebp - 0x28]
cmp eax, 0x6cce
jge 0x10049793
mov dword [ebp - 0x298], 1
jmp 0x1004979a
and dword [ebp - 0x298], 0
cmp dword [ebp - 0x298], 0x9e88
jl 0x100497b2
mov dword [ebp - 0x368], 1
jmp 0x100497b9
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x368], eax
jge 0x100497d3
mov dword [ebp - 0x2a0], 1
jmp 0x100497da
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x88], 0xfffffff4
jmp 0x100497ff
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x18
je 0x10049a8f
mov dword [ebp - 0x3f4], 0xfffffffe
mov dword [ebp - 0x2c0], 1
mov dword [ebp - 0x108], 0
jmp 0x10049839
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 2
jge 0x10049855
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x4e4], 0xa95534fd
jmp 0x1004982c
mov dword [ebp - 0xb0], 0x13
jmp 0x1004986e
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xb
jl 0x10049a8a
mov dword [ebp - 0x474], 0xa88f
mov dword [ebp - 0x470], 0xa88f
mov dword [ebp - 0x46c], 0xa88f
mov dword [ebp - 0x468], 0xa88f
mov dword [ebp - 0x28], 0
jmp 0x100498b3
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jg 0x100498f3
mov byte [ebp - 0x61], 0
movzx eax, byte [ebp - 0x61]
test eax, eax
je 0x100498e3
push 0x2d99
push 0x42cf
push 0
push 0x6418
push 0x2433
call fcn.1004b357
add esp, 0x14
push 0
push 0x6d25
call fcn.1004b18a
pop ecx
pop ecx
jmp 0x100498ac
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x42c]
cmp dword [ebp + eax - 0xb8], ecx
jge 0x1004991b
mov dword [ebp - 0x330], 1
jmp 0x10049922
and dword [ebp - 0x330], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x474]
mov dword [ebp - 0x57c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x3f4]
sub ecx, 3
cmp dword [ebp + eax - 0x474], ecx
jg 0x1004995b
mov dword [ebp - 0x328], 1
jmp 0x10049962
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x328], eax
je 0x10049979
mov dword [ebp - 0x2a8], 1
jmp 0x10049980
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x100499a4
cmp dword [ebp - 0x2c0], 0
je 0x100499a4
mov dword [ebp - 0x39c], 1
jmp 0x100499ab
and dword [ebp - 0x39c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x474]
cmp dword [ebp - 0x39c], eax
jle 0x100499cc
mov dword [ebp - 0x2b0], 1
jmp 0x100499d3
and dword [ebp - 0x2b0], 0
cmp dword [ebp - 0x2b0], 0xfff9
je 0x100499eb
mov dword [ebp - 0x2b8], 1
jmp 0x100499f2
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x330]
cmp eax, dword [ebp - 0x2b8]
jl 0x10049a12
mov eax, 0xfff7
test eax, eax
jne 0x10049a12
and dword [ebp - 0x194], 0
jmp 0x10049a1c
mov dword [ebp - 0x194], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x194]
mov dword [ebp + eax - 0x4e4], ecx
cmp dword [ebp - 0x88], 0
je 0x10049a4d
cmp dword [ebp - 0x2c0], 0
je 0x10049a4d
mov dword [ebp - 0x338], 1
jmp 0x10049a54
and dword [ebp - 0x338], 0
cmp dword [ebp - 0x338], 0x6f2c
jl 0x10049a6c
mov dword [ebp - 0x2c8], 1
jmp 0x10049a73
and dword [ebp - 0x2c8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2c8]
mov dword [ebp + eax - 0x60c], ecx
jmp 0x10049861
jmp 0x100497f2
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x180]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x20], eax
jmp 0x10048ca6
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x5c], 0x4caa8e55
mov dword [ebp - 0x21c], 0xbae055a2
mov dword [ebp - 0x44], 0
jmp 0x10049ad1
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x10049ae7
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x54c], 0x958900fd
jmp 0x10049aca
mov dword [ebp - 0x44], 0
jmp 0x10049af7
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x10049b0d
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x53c], 0
jmp 0x10049af0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x584], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x54c], 0
je 0x10049b41
cmp dword [ebp - 0x4c], 0
je 0x10049b41
mov eax, 0xf9150fae
test eax, eax
je 0x10049b41
mov dword [ebp - 0x394], 1
jmp 0x10049b48
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x4c]
jl 0x10049b68
mov dword [ebp - 0x2d0], 1
jmp 0x10049b6f
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x2d0]
jge 0x10049b86
mov dword [ebp - 0x340], 1
jmp 0x10049b8d
and dword [ebp - 0x340], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x340]
mov dword [ebp + eax - 0x53c], ecx
mov dword [ebp - 0x4c], 0
jmp 0x10049bb0
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffe6
jne 0x10049f30
mov dword [ebp - 0xac], 0xfffffffe
mov byte [ebp - 0x91], 0
push 0
lea eax, [ebp - 0x91]
push eax
push 0x679
push 0x316b
call fcn.1004b079
add esp, 0x10
mov dword [ebp - 0x5c], 0
jmp 0x10049bf6
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xfffffff4
jne 0x10049f2b
mov dword [ebp - 0x90], 0xfffffffc
mov dword [ebp - 0x224], 0xb017
mov dword [ebp - 0xd0], 0xfffffff6
mov dword [ebp - 0x254], 0xffff
mov dword [ebp - 0x404], 0xe236
mov dword [ebp - 0x90], 2
jmp 0x10049c4b
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x10049d44
mov dword [ebp - 0x458], 0xb171c250
mov dword [ebp - 0x104], 0
jmp 0x10049c7b
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 4
jge 0x10049c97
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x5fc], 0x8a1b
jmp 0x10049c6e
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x568], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x53c]
cmp dword [ebp - 0x224], eax
jl 0x10049cc4
mov dword [ebp - 0x2d8], 1
jmp 0x10049ccb
and dword [ebp - 0x2d8], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x5fc]
cmp dword [ebp - 0x2d8], eax
jle 0x10049cec
mov dword [ebp - 0x204], 1
jmp 0x10049cf3
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x204]
add eax, 0x2840cc74
cmp eax, 0xfffffffa
jl 0x10049d18
cmp dword [ebp - 0xac], 0
je 0x10049d18
mov dword [ebp - 0x20c], 1
jmp 0x10049d1f
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x21c]
add ecx, dword [ebp - 0x20c]
sub ecx, dword [ebp - 0xd0]
add eax, ecx
mov dword [ebp - 0x458], eax
jmp 0x10049c3e
cmp dword [ebp - 0xd0], 0x885c3b36
jbe 0x10049d5c
mov dword [ebp - 0x214], 1
jmp 0x10049d63
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0x90], eax
jg 0x10049d89
mov dword [ebp - 0x3fc], 1
jmp 0x10049d90
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x4f0], eax
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x570], eax
cmp dword [ebp - 0xd0], 0x3bc5
jl 0x10049dc0
mov dword [ebp - 0x22c], 1
jmp 0x10049dc7
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x224]
cmp dword [ebp - 0x22c], eax
jl 0x10049de1
mov dword [ebp - 0x234], 1
jmp 0x10049de8
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x234], eax
jg 0x10049e02
mov dword [ebp - 0x23c], 1
jmp 0x10049e09
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x23c], eax
jle 0x10049e23
mov dword [ebp - 0x244], 1
jmp 0x10049e2a
and dword [ebp - 0x244], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x54c]
cmp dword [ebp - 0x244], eax
jne 0x10049e4b
mov dword [ebp - 0x24c], 1
jmp 0x10049e52
and dword [ebp - 0x24c], 0
cmp dword [ebp - 0x24c], 0x9c1f6213
jae 0x10049e6a
mov dword [ebp - 0x434], 1
jmp 0x10049e71
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0x5c], eax
jge 0x10049e94
mov dword [ebp - 0x25c], 1
jmp 0x10049e9b
and dword [ebp - 0x25c], 0
cmp dword [ebp - 0x25c], 0xb1310f07
jb 0x10049eb3
mov dword [ebp - 0x264], 1
jmp 0x10049eba
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x264], eax
jne 0x10049ed1
mov dword [ebp - 0x26c], 1
jmp 0x10049ed8
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x26c], eax
jg 0x10049ef2
mov dword [ebp - 0x274], 1
jmp 0x10049ef9
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x274]
jl 0x10049f13
mov dword [ebp - 0x27c], 1
jmp 0x10049f1a
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x404], eax
jmp 0x10049bef
jmp 0x10049ba9
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x17f]
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x10c]
movzx ecx, byte [ebp + ecx - 0x182]
movsx ecx, byte [ebp + ecx - 0x4bc]
or eax, ecx
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0x17f]
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x10c]
movzx edx, byte [ebp + edx - 0x182]
movsx edx, byte [ebp + edx - 0x4bc]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0x180]
mov byte [ebp + ecx - 0x4bc], al
mov dword [ebp - 0x98], 0x20e8
mov dword [ebp - 0x4ec], 0
mov dword [ebp - 0x134], 0
jmp 0x10049fbd
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 3
jge 0x10049fd9
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x55c], 0xf37831e4
jmp 0x10049fb0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x4dc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x98]
mov dword [ebp + eax - 0x55c], ecx
mov dword [ebp - 0x98], 0x19
jmp 0x1004a011
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x33
jl 0x1004a0a9
mov dword [ebp - 0x284], 0xffffffff
mov dword [ebp - 0x41c], 0x5af8b513
mov dword [ebp - 0x40c], 8
or eax, 0xffffffff
je 0x1004a069
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x55c]
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0
je 0x1004a069
mov dword [ebp - 0x28c], 1
jmp 0x1004a070
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x98], 0
jl 0x1004a091
mov dword [ebp - 0x294], 1
jmp 0x1004a098
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x40c], eax
jmp 0x1004a004
and dword [ebp - 0x10c], 0
jmp 0x10048ca6
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x12c], 0
jmp 0x1004a0d5
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 3
jge 0x1004a0f1
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0x4a0], 1
jmp 0x1004a0c8
mov dword [ebp - 0x40], 0
jmp 0x1004a101
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jg 0x1004a1c4
mov dword [ebp - 0x2a4], 0xc7af5af8
mov dword [ebp - 0x418], 0xfffffff8
mov dword [ebp - 0x414], 0xfffffffd
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x4a0], 0xfc371865
je 0x1004a188
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x4a0]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x29c]
mov dword [ebp + eax*4 - 0x4a0], ecx
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
jne 0x1004a188
mov eax, 0xb79f6a71
sub eax, dword [ebp - 0x40]
imul eax, eax, 0xd42c
dec eax
jne 0x1004a188
and dword [ebp - 0x2ac], 0
jmp 0x1004a192
mov dword [ebp - 0x2ac], 1
mov eax, dword [ebp - 0x418]
cmp dword [ebp - 0x2ac], eax
jle 0x1004a1ac
mov dword [ebp - 0x2b4], 1
jmp 0x1004a1b3
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x414], eax
jmp 0x1004a0fa
push 0x4759
push 0x4e3f
lea eax, [ebp - 0x40]
push eax
push 0x7b9
push 0
call fcn.100481a6
add esp, 0x14
xor eax, eax
inc eax
imul eax, eax, 0x1a
mov byte [ebp + eax - 0x4bc], 0
mov dword [ebp - 0x4c0], 0xffffffff
mov dword [ebp - 0xb4], 7
mov dword [ebp - 0x4e8], 0x631e19e9
mov dword [ebp - 0x10], 0
jmp 0x1004a21d
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1004a233
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5ac], 0xad6f2ee
jmp 0x1004a216
mov dword [ebp - 0x10], 0
jmp 0x1004a243
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1004a259
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5cc], 0xffffffff
jmp 0x1004a23c
mov dword [ebp - 0x10], 0
jmp 0x1004a269
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1004a27f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x61c], 0x58fb770a
jmp 0x1004a262
mov dword [ebp - 0x10], 0
jmp 0x1004a28f
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1004a2a5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4fc], 9
jmp 0x1004a288
push 1
lea eax, [ebp - 0xb4]
push eax
call fcn.100480fd
pop ecx
pop ecx
mov dword [ebp - 0xb4], 0
jmp 0x1004a2ce
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x1004a2ea
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x5ac], 0x4a9bacde
jmp 0x1004a2c1
lea eax, [ebp - 0x4bc]
push eax
lea ecx, [ebp - 0x5c4]
call fcn.1002d193
and dword [ebp - 4], 0
mov dword [ebp - 0xe0], 0x69fdf99f
mov dword [ebp - 0xc4], 0xf094
mov dword [ebp - 0xdc], 0
jmp 0x1004a32d
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jge 0x1004a349
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0x504], 0xcd795364
jmp 0x1004a320
mov dword [ebp - 0xe0], 0
jmp 0x1004a362
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0x18
jge 0x1004a3f9
mov dword [ebp - 0x54], 0xbf25cbd9
mov dword [ebp - 0x54], 0
jmp 0x1004a386
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jg 0x1004a3a4
lea eax, [ebp - 0xc4]
push eax
push 0xbd8
push 1
call fcn.10048147
add esp, 0xc
jmp 0x1004a37f
mov dword [ebp - 0xc4], 0xffffffe9
jmp 0x1004a3bd
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x2b
jne 0x1004a3f4
mov dword [ebp - 0x54], 0x16
jmp 0x1004a3d6
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x16
je 0x1004a3f2
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x1004a3f0
push 0
call fcn.1004b012
pop ecx
jmp 0x1004a3cf
jmp 0x1004a3b0
jmp 0x1004a355
and dword [ebp - 0xe8], 0
jmp 0x1004a40f
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x1b
jae 0x1004a428
mov eax, dword [ebp - 0xe8]
mov byte [ebp + eax - 0x4bc], 0
jmp 0x1004a402
mov dword [ebp - 0x540], 0xffffffff
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x1004a464
push 0
push 0x21b3
push 0x253a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
mov byte [ebp - 0x62], 0
movzx eax, byte [ebp - 0x62]
test eax, eax
je 0x1004a478
push 0
call fcn.1004b615
pop ecx
push 0x1000d48a
lea ecx, [ebp - 0x5a0]
call fcn.1002d193
mov byte [ebp - 4], 1
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x58], 0xe5c7a00f
mov dword [ebp - 0x50], 0
mov dword [ebp - 0xa0], 0x6c74aa0d
mov dword [ebp - 0x60], 0
mov dword [ebp - 0xf0], 0
jmp 0x1004a4cb
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 3
jge 0x1004a4e7
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x464], 0x166941fc
jmp 0x1004a4be
cmp dword [ebp - 0x34], 0xf5cd
jl 0x1004a4fc
mov dword [ebp - 0x2bc], 1
jmp 0x1004a503
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x50], eax
jle 0x1004a526
mov dword [ebp - 0x2c4], 1
jmp 0x1004a52d
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x60], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x60]
mov dword [ebp + eax - 0x464], ecx
mov dword [ebp - 0xa0], 0xffffffe8
jmp 0x1004a56a
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xffffffe7
je 0x1004a974
mov dword [ebp - 0xa8], 0x5acee617
mov dword [ebp - 0x428], 0x17c7128a
mov dword [ebp - 0x2fc], 7
mov dword [ebp - 0x4f8], 0xcbf698ba
mov dword [ebp - 0x38], 0
jmp 0x1004a5af
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1004a5c5
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x580], 0x4adb5d23
jmp 0x1004a5a8
mov dword [ebp - 0x38], 0
jmp 0x1004a5d5
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1004a5eb
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x48c], 1
jmp 0x1004a5ce
mov dword [ebp - 0x34], 0xfffffffa
jmp 0x1004a5fb
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xfffffff4
jle 0x1004a793
mov dword [ebp - 0xf8], 0x320f
mov dword [ebp - 0x110], 0x5ec35211
mov eax, 0x5542
test eax, eax
je 0x1004a629
cmp dword [ebp - 0xa8], 0
cmp dword [ebp - 0xa8], 0
jne 0x1004a67e
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xa8], eax
imul eax, dword [ebp - 0x428], 0
cmp dword [ebp - 0xa8], eax
je 0x1004a659
mov dword [ebp - 0x2cc], 1
jmp 0x1004a660
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x1004a67e
and dword [ebp - 0x2d4], 0
jmp 0x1004a688
mov dword [ebp - 0x2d4], 1
mov eax, dword [ebp - 0xf8]
imul eax, dword [ebp - 0x2d4]
cmp eax, dword [ebp - 0xa0]
je 0x1004a6a9
mov dword [ebp - 0x2dc], 1
jmp 0x1004a6b0
and dword [ebp - 0x2dc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2dc]
mov dword [ebp + eax - 0x464], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x464]
mov dword [ebp - 0x500], eax
xor eax, eax
inc eax
je 0x1004a6e0
cmp dword [ebp - 0x2fc], 0
cmp dword [ebp - 0xf8], 0xb927eed0
ja 0x1004a6f8
mov dword [ebp - 0x2e4], 1
jmp 0x1004a6ff
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x2e4], eax
jge 0x1004a719
mov dword [ebp - 0x2ec], 1
jmp 0x1004a720
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x2ec], eax
jl 0x1004a73a
mov dword [ebp - 0x2f4], 1
jmp 0x1004a741
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x2f4]
sub eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0xa8]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x2fc]
imul eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jne 0x1004a778
cmp dword [ebp - 0xa8], 0
jne 0x1004a778
and dword [ebp - 0x198], 0
jmp 0x1004a782
mov dword [ebp - 0x198], 1
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x110], eax
jmp 0x1004a5f4
mov dword [ebp - 0x34], 0
jmp 0x1004a7a3
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xd
je 0x1004a96f
mov dword [ebp - 0x1c4], 0x1956a74a
mov dword [ebp - 0x118], 0
jmp 0x1004a7d0
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 1
jge 0x1004a7ec
mov eax, dword [ebp - 0x118]
mov dword [ebp + eax*4 - 0xcc], 0x81501494
jmp 0x1004a7c3
mov dword [ebp - 0x58], 2
jmp 0x1004a7fc
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x1004a88d
mov dword [ebp - 0x550], 0xffffffff
mov dword [ebp - 0x508], 8
mov dword [ebp - 0x578], 0x1dd6b9ec
mov dword [ebp - 0x510], 0xae54fd57
mov dword [ebp - 0x50], 0
jmp 0x1004a83e
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jg 0x1004a86d
mov dword [ebp - 0x60], 0
jmp 0x1004a854
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jg 0x1004a86b
mov eax, dword [ebp - 0x50]
cmp dword [ebp + eax*4 - 0x464], 0
je 0x1004a869
jmp 0x1004a86b
jmp 0x1004a84d
jmp 0x1004a837
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x48c], eax
jmp 0x1004a7f5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xcc], 0x5834d56b
jne 0x1004a8ac
mov dword [ebp - 0x19c], 1
jmp 0x1004a8b3
and dword [ebp - 0x19c], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xcc], 0
jne 0x1004a8d3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xcc], 0
je 0x1004a8ef
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xcc], 0
je 0x1004a8ef
mov dword [ebp - 0x1a4], 1
jmp 0x1004a8f6
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x19c]
sub eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x1ac], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1ac]
mov dword [ebp + eax - 0xcc], ecx
cmp dword [ebp - 0x1ac], 0xc852
jg 0x1004a933
mov dword [ebp - 0x1b4], 1
jmp 0x1004a93a
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x1b4]
add eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x1bc], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1bc]
mov dword [ebp + eax - 0x464], ecx
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c4], eax
jmp 0x1004a79c
jmp 0x1004a55d
mov dword [ebp - 0xd4], 0xfffffff9
mov dword [ebp - 0x3cc], 0xbf25cbd9
mov dword [ebp - 0x128], 0
jmp 0x1004a9a1
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 2
jge 0x1004a9bd
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x494], 7
jmp 0x1004a994
mov dword [ebp - 0xd4], 1
jmp 0x1004a9d6
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jl 0x1004aa13
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x494]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0x1cc]
mov dword [ebp + eax*4 - 0x494], ecx
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x3cc], eax
jmp 0x1004a9c9
lea ecx, [ebp - 0x5a0]
call fcn.1001ee5f
cmp eax, dword [ebp + 0xc]
je 0x1004aa69
call fcn.100746c7
mov esi, eax
lea ecx, [ebp - 0x5c4]
call fcn.1001ee5f
mov ecx, eax
mov eax, esi
xor edx, edx
div ecx
mov dword [ebp - 0x3d0], edx
lea eax, [ebp - 0x5c4]
push eax
lea eax, [ebp - 0x5a0]
push eax
push 0x32cf
lea eax, [ebp - 0x3d0]
push eax
push 1
call fcn.100481a6
add esp, 0x14
jmp 0x1004aa13
mov dword [ebp - 0x3e8], 4
mov dword [ebp - 0x3c], 0
jmp 0x1004aa83
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1004aa99
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x188], 7
jmp 0x1004aa7c
mov dword [ebp - 0x3c], 0
jmp 0x1004aaa9
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1004aabf
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x130], 1
jmp 0x1004aaa2
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x188], 0
jmp 0x1004aaed
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x188]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x188], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x188], 5
jle 0x1004ac9c
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x3d8], 0x20b5
mov dword [ebp - 0x2c], 0
jmp 0x1004ab22
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x1004ac97
mov eax, dword [ebp - 0x2c]
mov ecx, 0x1c3a
sub ecx, dword [ebp + eax*4 - 0x130]
jne 0x1004ac53
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x130], 0
jne 0x1004aba6
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x560], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x188]
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0x3d8]
cmp dword [ebp - 0x2c], eax
jne 0x1004ab81
mov dword [ebp - 0x1d4], 1
jmp 0x1004ab88
and dword [ebp - 0x1d4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x188]
add eax, dword [ebp - 0x1d4]
jne 0x1004aba6
and dword [ebp - 0x1dc], 0
jmp 0x1004abb0
mov dword [ebp - 0x1dc], 1
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x130]
cmp dword [ebp - 0x1dc], eax
jge 0x1004abd2
xor eax, eax
je 0x1004abd2
mov dword [ebp - 0x1e4], 1
jmp 0x1004abd9
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x130]
cmp dword [ebp - 0x1e4], eax
jge 0x1004abf7
mov dword [ebp - 0x1ec], 1
jmp 0x1004abfe
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x1ec]
add eax, 0x162c5d17
jns 0x1004ac14
mov eax, 0xffff
test eax, eax
je 0x1004ac18
xor eax, eax
jne 0x1004ac31
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x188], 0
jne 0x1004ac31
and dword [ebp - 0x3e0], 0
jmp 0x1004ac3b
mov dword [ebp - 0x3e0], 1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x2c], 0
jne 0x1004ac53
and dword [ebp - 0x1f4], 0
jmp 0x1004ac5d
mov dword [ebp - 0x1f4], 1
mov eax, dword [ebp - 0x1f4]
add eax, 0x18d118d4
mov dword [ebp - 0x3e8], eax
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x1004ac92
push 0x352
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
jmp 0x1004ab1b
jmp 0x1004aad2
lea eax, [ebp - 0x5a0]
push eax
mov ecx, dword [ebp + 8]
call fcn.1001e91f
mov eax, dword [ebp - 0x1fc]
or eax, 1
mov dword [ebp - 0x1fc], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5a0]
call fcn.1001e978
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c4]
call fcn.1001e978
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret