Function at 0x40af36
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3dc
push esi
movzx eax, byte [ebp + 0x30]
test eax, eax
je 0x40af88
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x26c], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x2e4], eax
push dword [ebp - 0x26c]
push 0x3b36
mov eax, dword [ebp - 0x2e4]
movzx eax, byte [eax]
push eax
push 0x2a49
push 0xb88
push 0
call fcn.0040f8dd
add esp, 0x18
jmp 0x40c933
lea eax, [ebp + 0x34]
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x280], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x328], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2ec]
movzx eax, byte [eax]
test eax, eax
je 0x40b019
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x320], eax
push dword [ebp - 0x318]
push 0
push dword [ebp - 0x320]
call fcn.0040a101
add esp, 0xc
jmp 0x40c933
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x288]
movzx eax, byte [eax]
test eax, eax
je 0x40b0d6
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
jmp 0x40b0b1
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x48]
mov dword [ecx], eax
mov eax, dword [ebp - 0x48]
cmp dword [eax], 1
jge 0x40b0d1
mov eax, dword [ebp - 0x48]
push dword [eax]
mov ecx, dword [ebp - 0x324]
call fcn.00430937
mov dword [eax], 0x64a6
jmp 0x40b0a6
jmp 0x40c933
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x84], 0x4bedcc59
mov dword [ebp - 0x88], 0x98e64e6d
mov dword [ebp - 0x90], 9
mov dword [ebp - 0x204], 5
mov dword [ebp - 0x34], 0x11e7bff4
push 3
lea ecx, [ebp - 0x354]
call fcn.00430849
mov dword [ebp - 0x2b0], 0x8cf1d65f
mov dword [ebp - 0x20c], 0xffffffff
mov dword [ebp - 0x98], 0xe864ea5f
mov dword [ebp - 0x2f0], 2
mov dword [ebp - 0x2c8], 0xddc7
lea eax, [ebp - 4]
push eax
push 0x72c8
lea eax, [ebp - 0x354]
push eax
push 0
call fcn.00421708
add esp, 0x10
mov dword [ebp - 4], 0
jmp 0x40b196
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x40b1ac
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x254], 3
jmp 0x40b18f
mov dword [ebp - 4], 0
jmp 0x40b1bc
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x40b1cf
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x60], 0x3196e86f
jmp 0x40b1b5
mov dword [ebp - 4], 0
jmp 0x40b1df
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x40b1f5
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x3a4], 0x14e76493
jmp 0x40b1d8
mov dword [ebp - 4], 0
jmp 0x40b205
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jge 0x40b21b
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x118], 0xb3f497ee
jmp 0x40b1fe
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
cmp dword [ebp - 0x204], eax
jle 0x40b239
mov dword [ebp - 0x234], 1
jmp 0x40b240
and dword [ebp - 0x234], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3a4]
inc eax
mov dword [ebp - 0x12c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x12c]
mov dword [ebp + eax - 0x3a4], ecx
mov eax, dword [ebp - 0x12c]
cmp eax, dword [ebp - 0x234]
jg 0x40b281
mov dword [ebp - 0xac], 1
jmp 0x40b288
and dword [ebp - 0xac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x2c]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x60]
cmp eax, dword [ebp - 0x88]
je 0x40b2b9
mov dword [ebp - 0x304], 1
jmp 0x40b2c0
and dword [ebp - 0x304], 0
mov eax, 0xffff
cmp eax, 9
jae 0x40b2d6
mov dword [ebp - 0x23c], 1
jmp 0x40b2dd
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jae 0x40b2fe
mov dword [ebp - 0x1b0], 1
jmp 0x40b305
and dword [ebp - 0x1b0], 0
cmp dword [ebp - 0x1b0], 0xffffffff
jle 0x40b31a
mov dword [ebp - 0x1f4], 1
jmp 0x40b321
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x1f4], eax
jge 0x40b33a
or eax, 0xffffffff
jne 0x40b33a
and dword [ebp - 0xd4], 0
jmp 0x40b344
mov dword [ebp - 0xd4], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x60]
cmp dword [ebp - 0xd4], eax
jg 0x40b362
mov dword [ebp - 0x1fc], 1
jmp 0x40b369
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x1fc], eax
jne 0x40b380
mov dword [ebp - 0xdc], 1
jmp 0x40b387
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x1ca0702d
jg 0x40b3ad
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x254], 0
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x88], eax
je 0x40b3d3
mov dword [ebp - 0x2e8], 1
jmp 0x40b3da
and dword [ebp - 0x2e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
mov dword [ebp - 0x398], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x90], 0xfffffffb
je 0x40b40f
mov dword [ebp - 0xe4], 1
jmp 0x40b416
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x20c], eax
jl 0x40b43c
mov dword [ebp - 0xec], 1
jmp 0x40b443
and dword [ebp - 0xec], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0xec], eax
jne 0x40b45a
mov dword [ebp - 0x214], 1
jmp 0x40b461
and dword [ebp - 0x214], 0
cmp dword [ebp - 0x214], 7
jge 0x40b476
mov dword [ebp - 0xf4], 1
jmp 0x40b47d
and dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0xf4]
sub eax, dword [ebp - 0x34]
add eax, 4
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x60]
cmp eax, dword [ebp - 0x2c]
jle 0x40b4ad
mov dword [ebp - 0x21c], 1
jmp 0x40b4b4
and dword [ebp - 0x21c], 0
cmp dword [ebp - 0x21c], 0
jl 0x40b4c9
mov dword [ebp - 0x2b8], 1
jmp 0x40b4d0
and dword [ebp - 0x2b8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x254]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x384], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60], 0xfffffff6
je 0x40b507
mov dword [ebp - 0xfc], 1
jmp 0x40b50e
and dword [ebp - 0xfc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x254]
cmp dword [ebp - 0xfc], eax
jne 0x40b52f
mov dword [ebp - 0x224], 1
jmp 0x40b536
and dword [ebp - 0x224], 0
cmp dword [ebp - 0x224], 0x40a493bb
jge 0x40b54e
mov dword [ebp - 0x22c], 1
jmp 0x40b555
and dword [ebp - 0x22c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x22c]
sub ecx, dword [ebp + eax - 0x254]
mov dword [ebp - 0x31c], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x31c]
mov dword [ebp + eax - 0x118], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x254]
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x98], 0x2cbed49f
jne 0x40b5b9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x254], 0
jne 0x40b5b9
and dword [ebp - 0x2c0], 0
jmp 0x40b5c3
mov dword [ebp - 0x2c0], 1
mov eax, dword [ebp - 0x84]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x254]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x60]
je 0x40b5ee
mov dword [ebp - 0x108], 1
jmp 0x40b5f5
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x108]
sub eax, 0xe598
cmp eax, dword [ebp - 0x2f0]
jg 0x40b614
mov dword [ebp - 0x1a8], 1
jmp 0x40b61b
and dword [ebp - 0x1a8], 0
push 2
lea ecx, [ebp - 0x354]
call fcn.00430937
mov ecx, dword [ebp - 0xac]
mov dword [eax], ecx
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x1a8]
jne 0x40b64a
mov dword [ebp - 0x110], 1
jmp 0x40b651
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x110], eax
jge 0x40b66b
mov dword [ebp - 0x1b4], 1
jmp 0x40b672
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x2c], eax
jl 0x40b68f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x118], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c8], eax
lea ecx, [ebp - 0x354]
call fcn.0043091b
mov eax, dword [ebp - 0x78]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1d4], eax
push 0
call fcn.00426d8b
pop ecx
push 4
lea ecx, [ebp - 0x3b4]
call fcn.00430849
push 1
lea ecx, [ebp - 0x314]
call fcn.00430849
push 0x7791
push 0x1009
push 0
push 0x7176
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x3b4]
push eax
push 0x4e
push 0x64b8
push 0
call fcn.0040ad1b
add esp, 0x24
mov dword [ebp - 0x10], 0
jmp 0x40b70e
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x40b72a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x314]
call fcn.00430937
mov dword [eax], 0x1febaeef
jmp 0x40b707
mov dword [ebp - 0x10], 0
jmp 0x40b73a
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x40b750
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x390], 0xfffc
jmp 0x40b733
push 0
lea ecx, [ebp - 0x314]
call fcn.00430937
and dword [eax], 0
jmp 0x40b786
push 0
lea ecx, [ebp - 0x314]
call fcn.00430937
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1f8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1f8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x314]
call fcn.00430937
cmp dword [eax], 3
jg 0x40b802
push 1
lea ecx, [ebp - 0x348]
call fcn.00430849
push 1
push 0x14cd
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x368]
push eax
push 0x5b9f
push 1
push 0x1ba5
push 1
push 0x6433
call fcn.00407ed9
add esp, 0x24
lea eax, [ebp - 0x348]
push eax
push 0x6304
push 0x7fec
push 0
push 0
call fcn.0040a573
add esp, 0x14
lea ecx, [ebp - 0x348]
call fcn.0043091b
jmp 0x40b762
lea ecx, [ebp - 0x314]
call fcn.0043091b
lea ecx, [ebp - 0x3b4]
call fcn.0043091b
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x33c], 0xc2e0
mov dword [ebp - 0x338], 0xc2e0
mov dword [ebp - 0x334], 0xc2e0
mov dword [ebp - 0x330], 0xc2e0
lea ecx, [ebp - 0xa1]
call fcn.00430946
push eax
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x33c]
push eax
lea ecx, [ebp - 0x3dc]
call fcn.00430949
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3c8]
call fcn.004308f5
mov dword [ebp - 0x50], 0xfffffff6
push 1
push 1
push 0
push 0x2939
push 0x715c
push 0x62e4
push 0x3247
push 0x2360
push 0x3dbd
push 0x65b6
push 0
call fcn.004135ec
add esp, 0x2c
mov dword [ebp - 0x50], 3
jmp 0x40b8d4
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x40b94c
mov dword [ebp - 0x80], 0
jmp 0x40b8ea
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x40b8fd
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x68], 1
jmp 0x40b8e3
push 0
call fcn.004147f5
pop ecx
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x68], 3
jmp 0x40b92a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x68]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x68], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x68], 0
jl 0x40b94a
mov byte [ebp - 0x2d], 0
push 0
lea eax, [ebp - 0x2d]
push eax
call fcn.0040aa14
pop ecx
pop ecx
jmp 0x40b915
jmp 0x40b8cd
lea ecx, [ebp - 0x3c8]
call fcn.0043091b
and dword [ebp - 0xa8], 0
jmp 0x40b976
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x14]
add eax, 0x28
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0xa8], eax
jge 0x40c933
push 0
call fcn.00411da2
pop ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x10], 0
jne 0x40bd47
mov dword [ebp - 0x370], 0x13eca4f8
push 0x3d8a
push 0x4afa
push 0
call fcn.004219f6
add esp, 0xc
push 0
call fcn.0042540e
pop ecx
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x9c]
push eax
push 0x2cd7
push 0x5c1e
lea eax, [ebp - 0x1d4]
push eax
push 0x32b9
push 1
call fcn.0040ad1b
add esp, 0x24
mov dword [ebp - 0x40], 0x78dc2a82
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x274], 0xffffffff
mov dword [ebp - 0x70], 0
jmp 0x40ba29
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x40ba3f
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xc4], 0xfffffff8
jmp 0x40ba22
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc4]
mov dword [ebp - 0x378], eax
mov dword [ebp - 0x40], 0
cmp dword [ebp - 0x40], 0
je 0x40bab3
mov dword [ebp - 0x40], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc4]
cmp dword [ebp - 0x40], eax
jg 0x40ba84
mov dword [ebp - 0x120], 1
jmp 0x40ba8b
and dword [ebp - 0x120], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc4]
mov ecx, dword [ebp - 0x120]
lea eax, [ecx + eax - 0x1a93826a]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xc4]
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0xc4], 0xfff9
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x40bad9
mov dword [ebp - 0x1b8], 1
jmp 0x40bae0
and dword [ebp - 0x1b8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc4]
cmp eax, dword [ebp - 0x1b8]
je 0x40bb01
mov dword [ebp - 0x128], 1
jmp 0x40bb08
and dword [ebp - 0x128], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc4]
cmp dword [ebp - 0x128], eax
je 0x40bb29
mov dword [ebp - 0x238], 1
jmp 0x40bb30
and dword [ebp - 0x238], 0
cmp dword [ebp - 0x238], 0x11aa
jne 0x40bb48
mov dword [ebp - 0x130], 1
jmp 0x40bb4f
and dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40bcdc
mov dword [ebp - 0x64], 0x7503
mov dword [ebp - 0x18], 2
jmp 0x40bb79
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x40bcda
mov dword [ebp - 0x58], 0
jmp 0x40bb93
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x40bba9
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x3d4], 0xfffffff9
jmp 0x40bb8c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xc4]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0xc4], ecx
cmp dword [ebp - 0x1c0], 0
jne 0x40bc01
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x64], eax
jg 0x40bbe6
mov dword [ebp - 0x138], 1
jmp 0x40bbed
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x138], eax
jl 0x40bc01
and dword [ebp - 0x27c], 0
jmp 0x40bc0b
mov dword [ebp - 0x27c], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x380], eax
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x3d4], 1
mov eax, 0xe4944c1a
inc eax
cmp eax, dword [ebp - 0x40]
jle 0x40bc3b
mov dword [ebp - 0x200], 1
jmp 0x40bc42
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x200], eax
jl 0x40bc59
mov dword [ebp - 0x140], 1
jmp 0x40bc60
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x64]
imul eax, dword [ebp - 0x140]
imul eax, eax, 0x1aa2
cmp eax, 0x7e9f
jle 0x40bc83
mov dword [ebp - 0x1c8], 1
jmp 0x40bc8a
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x1c8]
dec eax
cmp eax, 0xacdff905
jae 0x40bca4
mov dword [ebp - 0x148], 1
jmp 0x40bcab
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x274]
cmp dword [ebp - 0x148], eax
je 0x40bcc5
mov dword [ebp - 0x220], 1
jmp 0x40bccc
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x38], eax
jmp 0x40bb72
jmp 0x40bd42
mov dword [ebp - 0x28c], 0x9945c66b
push 0x2e62
push 0
push 0x2658
call fcn.0040d869
add esp, 0xc
cmp dword [ebp - 0x38], 0
jne 0x40bd0d
xor eax, eax
jne 0x40bd0d
and dword [ebp - 0x150], 0
jmp 0x40bd17
mov dword [ebp - 0x150], 1
cmp dword [ebp - 0x150], 0x20c5abfe
jge 0x40bd2f
mov dword [ebp - 0x1d0], 1
jmp 0x40bd36
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x28c], eax
jmp 0x40b960
mov dword [ebp - 8], 7
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x94], 0x67a21e2c
mov dword [ebp - 0x194], 0xfffffff7
mov dword [ebp - 0x2bc], 0xd6341d3
mov dword [ebp - 0x38c], 0xf68c368f
mov dword [ebp - 0x1c], 0
jmp 0x40bd8d
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x40bda3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb8], 7
jmp 0x40bd86
mov dword [ebp - 0x1c], 0
jmp 0x40bdb3
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x40bdc9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2f8], 1
jmp 0x40bdac
mov dword [ebp - 8], 2
jmp 0x40bdd9
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x40c5e7
mov dword [ebp - 0x20], 0x654fddd3
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x2ac], 0x6ff5532c
mov dword [ebp - 0x2b4], 0xfffb
mov dword [ebp - 0x2c4], 0xd19747a0
mov dword [ebp - 0x6c], 0
jmp 0x40be1f
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x40be35
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x25c], 0xe623b26d
jmp 0x40be18
mov dword [ebp - 0x20], 2
jmp 0x40be45
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x40c5d0
mov dword [ebp - 0x8c], 0xfffffff9
mov dword [ebp - 0x17c], 0x82c65315
mov dword [ebp - 0x7c], 0xfffffffe
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0xb8]
cmp dword [ebp + eax*4 - 0xb8], ecx
jl 0x40be8c
mov dword [ebp - 0x294], 1
jmp 0x40be93
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x394], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb8], 0
je 0x40bec0
cmp dword [ebp - 0x8c], 0
je 0x40bec0
mov dword [ebp - 0x158], 1
jmp 0x40bec7
and dword [ebp - 0x158], 0
cmp dword [ebp - 0x158], 0xfffffff9
jl 0x40bedc
mov dword [ebp - 0x208], 1
jmp 0x40bee3
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x24], eax
jge 0x40bf00
mov dword [ebp - 0x160], 1
jmp 0x40bf07
and dword [ebp - 0x160], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
cmp dword [ebp - 0x160], eax
jle 0x40bf28
mov dword [ebp - 0x1d8], 1
jmp 0x40bf2f
and dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1d8], eax
jg 0x40bf46
mov dword [ebp - 0x168], 1
jmp 0x40bf4d
and dword [ebp - 0x168], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0xb8]
sub eax, dword [ebp - 0x168]
imul eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 8]
cmp eax, dword [ebp + ecx*4 - 0xb8]
jg 0x40bf7c
mov dword [ebp - 0x230], 1
jmp 0x40bf83
and dword [ebp - 0x230], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb8]
cmp dword [ebp - 0x230], eax
jl 0x40bfa4
mov dword [ebp - 0x170], 1
jmp 0x40bfab
and dword [ebp - 0x170], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x25c]
cmp dword [ebp - 0x170], eax
jne 0x40bfcc
mov dword [ebp - 0x1e0], 1
jmp 0x40bfd3
and dword [ebp - 0x1e0], 0
cmp dword [ebp - 0x1e0], 9
jg 0x40bfe8
mov dword [ebp - 0x178], 1
jmp 0x40bfef
and dword [ebp - 0x178], 0
imul eax, dword [ebp - 0x178], 0x1fb9
imul eax, eax, 0x1c0a
test eax, eax
jne 0x40c015
mov eax, 0x4b4b26d8
test eax, eax
jne 0x40c015
and dword [ebp - 0x210], 0
jmp 0x40c01f
mov dword [ebp - 0x210], 1
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x20]
je 0x40c244
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x29c], 0xfdf115cd
mov byte [ebp - 0x2e], 0
lea eax, [ebp - 0x2e]
push eax
push 0
push 0
push 0xc4d
call fcn.00414a74
add esp, 0x10
cmp dword [ebp - 0x44], 0x8fe2d584
jae 0x40c073
mov dword [ebp - 0x180], 1
jmp 0x40c07a
and dword [ebp - 0x180], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x180], eax
jl 0x40c091
mov dword [ebp - 0x1e8], 1
jmp 0x40c098
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1e8], eax
jle 0x40c0af
mov dword [ebp - 0xa0], 1
jmp 0x40c0b6
and dword [ebp - 0xa0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa0]
mov dword [ebp + eax - 0x2f8], ecx
cmp dword [ebp - 0xa0], 3
je 0x40c0e4
cmp dword [ebp - 0x3c], 0
je 0x40c0e4
mov dword [ebp - 0x188], 1
jmp 0x40c0eb
and dword [ebp - 0x188], 0
cmp dword [ebp - 0x188], 0x83781cdf
jbe 0x40c103
mov dword [ebp - 0x228], 1
jmp 0x40c10a
and dword [ebp - 0x228], 0
cmp dword [ebp - 0x228], 0x604c
jg 0x40c122
mov dword [ebp - 0x190], 1
jmp 0x40c129
and dword [ebp - 0x190], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x25c]
cmp dword [ebp - 0x190], eax
jge 0x40c14a
mov dword [ebp - 0x1f0], 1
jmp 0x40c151
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x1f0], eax
jge 0x40c168
mov dword [ebp - 0x198], 1
jmp 0x40c16f
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x198]
cmp eax, dword [ebp - 8]
jge 0x40c18a
mov dword [ebp - 0x218], 1
jmp 0x40c191
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x218]
je 0x40c1a8
mov dword [ebp - 0x1a0], 1
jmp 0x40c1af
and dword [ebp - 0x1a0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x25c]
cmp dword [ebp - 0x1a0], eax
jg 0x40c1d0
mov dword [ebp - 0x1ac], 1
jmp 0x40c1d7
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1ac], eax
jle 0x40c1ee
mov dword [ebp - 0x100], 1
jmp 0x40c1f5
and dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x100]
cmp eax, 0xfffffff6
jl 0x40c210
mov dword [ebp - 0x104], 1
jmp 0x40c217
and dword [ebp - 0x104], 0
cmp dword [ebp - 0x104], 1
jbe 0x40c22c
mov dword [ebp - 0x10c], 1
jmp 0x40c233
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x29c], eax
jmp 0x40c4f7
push 3
lea ecx, [ebp - 0x268]
call fcn.00430849
mov dword [ebp - 0x16c], 0x5db0950c
mov dword [ebp - 0x74], 0
jmp 0x40c26b
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x40c287
push dword [ebp - 0x74]
lea ecx, [ebp - 0x268]
call fcn.00430937
mov dword [eax], 0xb1bd
jmp 0x40c264
mov esi, dword [ebp - 0x8c]
push 0
lea ecx, [ebp - 0x268]
call fcn.00430937
cmp esi, dword [eax]
jle 0x40c2aa
mov dword [ebp - 0x2a4], 1
jmp 0x40c2b1
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x17c], 0x727faab1
je 0x40c2d2
mov dword [ebp - 0x114], 1
jmp 0x40c2d9
and dword [ebp - 0x114], 0
mov esi, dword [ebp - 0x44]
imul esi, dword [ebp - 0x114]
push 1
lea ecx, [ebp - 0x268]
call fcn.00430937
cmp esi, dword [eax]
je 0x40c300
mov dword [ebp - 0x11c], 1
jmp 0x40c307
and dword [ebp - 0x11c], 0
cmp dword [ebp - 0x11c], 2
jge 0x40c31c
mov dword [ebp - 0x124], 1
jmp 0x40c323
and dword [ebp - 0x124], 0
imul eax, dword [ebp - 0x124], 0x72f8
mov ecx, dword [ebp - 8]
cmp eax, dword [ebp + ecx*4 - 0xb8]
jle 0x40c345
mov dword [ebp - 0xc8], 1
jmp 0x40c34c
and dword [ebp - 0xc8], 0
push 0
lea ecx, [ebp - 0x268]
call fcn.00430937
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc8]
jge 0x40c36f
mov dword [ebp - 0x134], 1
jmp 0x40c376
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x134], eax
jg 0x40c38d
mov dword [ebp - 0x13c], 1
jmp 0x40c394
and dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x13c], eax
jge 0x40c3ab
mov dword [ebp - 0x144], 1
jmp 0x40c3b2
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x144]
jg 0x40c3c9
mov dword [ebp - 0x14c], 1
jmp 0x40c3d0
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 8]
sub eax, dword [ebp + ecx*4 - 0xb8]
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x24], 0xcae2
jge 0x40c3ff
mov dword [ebp - 0x154], 1
jmp 0x40c406
and dword [ebp - 0x154], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x25c]
cmp dword [ebp - 0x154], eax
jle 0x40c427
mov dword [ebp - 0x15c], 1
jmp 0x40c42e
and dword [ebp - 0x15c], 0
push 0
lea ecx, [ebp - 0x268]
call fcn.00430937
mov ecx, dword [ebp - 0x15c]
cmp ecx, dword [eax]
je 0x40c451
mov dword [ebp - 0x164], 1
jmp 0x40c458
and dword [ebp - 0x164], 0
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
je 0x40c482
mov eax, 0x1a9d
test eax, eax
je 0x40c482
mov dword [ebp - 0x174], 1
jmp 0x40c489
and dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x174]
neg eax
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x94], eax
jle 0x40c4b1
mov dword [ebp - 0x184], 1
jmp 0x40c4b8
and dword [ebp - 0x184], 0
cmp dword [ebp - 0x184], 0xfffd
jb 0x40c4d0
mov dword [ebp - 0x18c], 1
jmp 0x40c4d7
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x7c], eax
lea ecx, [ebp - 0x268]
call fcn.0043091b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2f8]
mov dword [ebp - 0x36c], eax
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x40c523
cmp dword [ebp - 0x94], 0
jne 0x40c523
and dword [ebp - 0x19c], 0
jmp 0x40c52d
mov dword [ebp - 0x19c], 1
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x19c]
jge 0x40c544
mov dword [ebp - 0x1a4], 1
jmp 0x40c54b
and dword [ebp - 0x1a4], 0
cmp dword [ebp - 0x1a4], 0x1bd6
jl 0x40c563
mov dword [ebp - 0x1bc], 1
jmp 0x40c56a
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x1bc], eax
je 0x40c584
mov dword [ebp - 0x1c4], 1
jmp 0x40c58b
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x2bc]
cmp dword [ebp - 0x1c4], eax
jle 0x40c5a5
mov dword [ebp - 0x1cc], 1
jmp 0x40c5ac
and dword [ebp - 0x1cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2f8]
add eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x2c4], eax
jmp 0x40be3e
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0xb8], 0
je 0x40c5e2
jmp 0x40bdd2
jmp 0x40bdd2
push 4
push 0x1000
mov eax, dword [ebp - 0x14]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1d4]
add ecx, dword [eax + 0xc]
push ecx
push 0x3cd5
push 0x36e9
call fcn.00406974
pop ecx
pop ecx
call eax
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x14]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2cc]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x9c]
call fcn.00407461
add esp, 0xc
mov dword [ebp - 0x54], 0x4a8c6a53
mov dword [ebp - 0xd0], 0
push 4
lea ecx, [ebp - 0x360]
call fcn.00430849
mov dword [ebp - 0x4c], 0
jmp 0x40c669
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x40c67f
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xe8], 8
jmp 0x40c662
push 0
push 0x7fb1
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00416d1f
add esp, 0x10
push 0x7e6
push 0
push 0x5172
push 0x6025
push 0x6350
push 0
call fcn.0040d50d
add esp, 0x18
mov dword [ebp - 0x54], 0xfffffff2
jmp 0x40c6c9
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xfffffff4
jne 0x40c8f9
push 2
lea ecx, [ebp - 0x248]
call fcn.00430849
push 0
push 0
lea eax, [ebp - 0x3bc]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0040d451
add esp, 0x10
push 1
push 0x5603
push 0x3e39
push 0x1ffb
push 0x6253
push 1
push 0x5d3c
push 0
push 0x5dea
call fcn.00407ed9
add esp, 0x24
push 0
lea ecx, [ebp - 0x248]
call fcn.00430937
and dword [eax], 0
jmp 0x40c75c
push 0
lea ecx, [ebp - 0x248]
call fcn.00430937
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x1dc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1dc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x248]
call fcn.00430937
cmp dword [eax], 0
jg 0x40c8e9
mov dword [ebp - 0xc], 0x1dfe4b28
mov dword [ebp - 0x1ec], 0x7f8b4dfe
mov dword [ebp - 0xe0], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x40c79d
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x40c8e4
mov dword [ebp - 0x270], 0xfa1a8f1e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x374], eax
mov esi, dword [ebp - 0xc]
push 0
lea ecx, [ebp - 0x248]
call fcn.00430937
cmp esi, dword [eax]
jge 0x40c7da
mov dword [ebp - 0x1e4], 1
jmp 0x40c7e1
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x1e4]
neg eax
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 0xd0]
sub esi, dword [ebp - 0x1ec]
sub esi, dword [ebp + eax*4 - 0xe8]
push 0
lea ecx, [ebp - 0x248]
call fcn.00430937
sub esi, dword [eax]
mov eax, dword [ebp - 0xc]
sub eax, esi
mov dword [ebp - 0xcc], eax
push 3
lea ecx, [ebp - 0x360]
call fcn.00430937
mov ecx, dword [ebp - 0xcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0xd0]
je 0x40c851
mov dword [ebp - 0xd8], 1
jmp 0x40c858
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xe0], eax
jg 0x40c87b
mov dword [ebp - 0xf0], 1
jmp 0x40c882
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0xe8]
cmp eax, dword [ebp - 0xf0]
jl 0x40c8a0
mov dword [ebp - 0xf8], 1
jmp 0x40c8a7
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x270], eax
mov byte [ebp - 0x25], 0
push 0x127a
push 1
lea eax, [ebp - 0x25]
push eax
push 0x43e6
push 0x189d
push 0
push 1
push 0
push 0x7b08
call fcn.00409ab9
add esp, 0x24
jmp 0x40c796
jmp 0x40c738
lea ecx, [ebp - 0x248]
call fcn.0043091b
jmp 0x40c6c2
lea ecx, [ebp - 0x360]
call fcn.0043091b
lea eax, [ebp - 0x14]
push eax
push 1
push 0x1d3c
push 0x20db
push 0x745f
push 0
push 0
push 0
lea eax, [ebp - 0x9c]
push eax
call fcn.00409ab9
add esp, 0x24
jmp 0x40b960
pop esi
mov esp, ebp
pop ebp
ret