Function at 0x1004a829
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10086f1f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe94
push esi
and dword [ebp - 0x18], 0
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10051139
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x798], eax
mov eax, dword [ebp - 0x798]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1004acf1
push 3
lea ecx, [ebp - 0x334]
call fcn.1001740b
and dword [ebp - 4], 0
mov dword [ebp - 0xbc], 0xfffffffd
mov dword [ebp - 0x134], 9
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x8fc], 7
mov dword [ebp - 0x1ec], 0
jmp 0x1004a8cd
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 3
jge 0x1004a8ef
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0x334]
call fcn.100174a9
mov dword [eax], 0xff606579
jmp 0x1004a8c0
mov dword [ebp - 0xbc], 0
jmp 0x1004a908
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jg 0x1004acdd
push 2
lea ecx, [ebp - 0x2bc]
call fcn.1001740b
mov byte [ebp - 4], 1
push 0
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0xd54]
push eax
call fcn.10048fc4
add esp, 0xc
mov byte [ebp - 0xdf], 0
movzx eax, byte [ebp - 0xdf]
test eax, eax
je 0x1004a970
push 0
push 0x1dfb
push 0
push 0x23d0
push 0x12ee
push 0
push 0x230c
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0
lea ecx, [ebp - 0x2bc]
call fcn.100174a9
and dword [eax], 0
jmp 0x1004a9a6
push 0
lea ecx, [ebp - 0x2bc]
call fcn.100174a9
mov dword [ebp - 0x4cc], eax
mov eax, dword [ebp - 0x4cc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4cc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x2bc]
call fcn.100174a9
cmp dword [eax], 2
jg 0x1004acc9
mov dword [ebp - 0xec], 1
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x334]
call fcn.100174a9
mov eax, dword [eax]
neg eax
je 0x1004aab6
push 0
lea ecx, [ebp - 0x2bc]
call fcn.100174a9
push dword [eax]
lea ecx, [ebp - 0x334]
call fcn.100174a9
cmp dword [eax], 0
jne 0x1004aa12
cmp dword [ebp - 0xbc], 0
jne 0x1004aa12
and dword [ebp - 0xa60], 0
jmp 0x1004aa1c
mov dword [ebp - 0xa60], 1
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x334]
call fcn.100174a9
cmp dword [eax], 0
je 0x1004aa47
mov eax, 0x4e1c2e93
test eax, eax
je 0x1004aa47
mov dword [ebp - 0x744], 1
jmp 0x1004aa4e
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x744]
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x3cc1dab9
push 0
lea ecx, [ebp - 0x2bc]
call fcn.100174a9
mov esi, eax
push 0
lea ecx, [ebp - 0x2bc]
call fcn.100174a9
push dword [eax]
lea ecx, [ebp - 0x334]
call fcn.100174a9
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x1004aa9f
mov dword [ebp - 0x8e4], 1
jmp 0x1004aaa6
and dword [ebp - 0x8e4], 0
xor eax, eax
je 0x1004aab6
mov dword [ebp - 0x74c], 1
jmp 0x1004aabd
and dword [ebp - 0x74c], 0
push 2
lea ecx, [ebp - 0x334]
call fcn.100174a9
mov ecx, dword [ebp - 0x74c]
sub ecx, dword [eax]
je 0x1004aae0
mov dword [ebp - 0x754], 1
jmp 0x1004aae7
and dword [ebp - 0x754], 0
push 0
lea ecx, [ebp - 0x2bc]
call fcn.100174a9
push dword [eax]
lea ecx, [ebp - 0x334]
call fcn.100174a9
mov ecx, dword [ebp - 0x754]
cmp ecx, dword [eax]
jne 0x1004ac0d
mov dword [ebp - 0xf4], 0xffff
mov dword [ebp - 0x75c], 0xf314d41b
lea eax, [ebp - 0x75c]
push eax
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x134]
push eax
push 0x66f8
lea eax, [ebp - 0x334]
push eax
push 0x37ec
push 1
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x2c0]
push eax
call fcn.1004883b
add esp, 0x24
mov dword [ebp - 0xec], 0
jmp 0x1004ab7a
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xffffffff
jne 0x1004ac0b
mov dword [ebp - 0x8f4], 0x403e1fe0
mov dword [ebp - 0xf4], 0
jmp 0x1004abaa
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jg 0x1004ac06
mov dword [ebp - 0x8ec], 0xffffffff
lea eax, [ebp - 0x75c]
push eax
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0xf4]
push eax
push 0x1384
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x8f4]
push eax
push 1
lea eax, [ebp - 0x8fc]
push eax
call fcn.100489c3
add esp, 0x28
jmp 0x1004ab9d
jmp 0x1004ab6d
jmp 0x1004ac77
mov dword [ebp - 0x134], 0
jmp 0x1004ac26
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 2
jg 0x1004ac77
mov byte [ebp - 0xb3], 0
movzx eax, byte [ebp - 0xb3]
test eax, eax
je 0x1004ac55
push 0
push 0x2d45
push 0x65a4
call fcn.1004a6d5
add esp, 0xc
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1004ac75
push 0x95c
push 0
call fcn.1004a6a5
pop ecx
pop ecx
jmp 0x1004ac19
push 0
lea ecx, [ebp - 0x2bc]
call fcn.100174a9
cmp dword [eax], 0xfffffff9
jle 0x1004ac95
mov dword [ebp - 0x790], 1
jmp 0x1004ac9c
and dword [ebp - 0x790], 0
push 0
lea ecx, [ebp - 0x2bc]
call fcn.100174a9
push dword [eax]
lea ecx, [ebp - 0x334]
call fcn.100174a9
mov eax, dword [eax]
add eax, dword [ebp - 0x790]
mov dword [ebp - 0x2c0], eax
jmp 0x1004a982
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2bc]
call fcn.1001748d
jmp 0x1004a8fb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x334]
call fcn.1001748d
jmp 0x100511d3
mov dword [ebp - 0xc64], 0xe3556834
mov byte [ebp - 0xb7], 0
movzx eax, byte [ebp - 0xb7]
test eax, eax
je 0x1004ad1b
push 0
push 0x1ad3
call fcn.10048daf
pop ecx
pop ecx
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1004ad78
push 0x3a39
push 0x382
push 0x3329
push 0xdee
push 0x441
push 0x755c
push 0
push 0x3ec4
push 0x5991
push 0x757
push 0x731a
push 0x7d92
push 0x2aa1
push 0xab1
call fcn.1004976f
add esp, 0x38
mov eax, dword [ebp - 0x798]
mov ecx, dword [ebp - 0x28]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0x34], 0x32b1cecb
mov dword [ebp - 0x7d8], 0
mov dword [ebp - 0x958], 0xb72b
push 4
lea ecx, [ebp - 0xafc]
call fcn.1001740b
mov dword [ebp - 4], 2
mov dword [ebp - 0x960], 0xffff
mov dword [ebp - 0x130], 0
jmp 0x1004addc
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 4
jge 0x1004adf8
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x388], 0
jmp 0x1004adcf
push 0
push 0x1798
lea eax, [ebp - 0xafc]
push eax
push 0x5981
push 0x2ed9
push 0x12c5
push 0x13e
push 0x3414
push 0x49c3
lea eax, [ebp - 0x130]
push eax
call fcn.10049f8e
add esp, 0x28
mov dword [ebp - 0x34], 0
jmp 0x1004ae43
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jg 0x1004b0b5
mov dword [ebp - 0x970], 0
mov dword [ebp - 0x238], 0
jmp 0x1004ae70
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 3
jge 0x1004ae8c
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0x9c8], 0xffffffff
jmp 0x1004ae63
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x388]
mov dword [ebp - 0xd78], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x388]
mov dword [ebp - 0xc6c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x388]
mov dword [ebp - 0xd14], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9c8]
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp + ecx*4 - 0x388]
cmp dword [ebp + eax*4 - 0x388], ecx
jl 0x1004aef6
mov dword [ebp - 0x7a0], 1
jmp 0x1004aefd
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x34]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x388]
imul ecx, dword [ebp - 0x7a0]
cmp dword [ebp + eax*4 - 0x388], ecx
jge 0x1004af28
mov dword [ebp - 0x7a8], 1
jmp 0x1004af2f
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x7a8], eax
jge 0x1004af66
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9c8], 0
je 0x1004af66
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x388], 0
je 0x1004af66
mov dword [ebp - 0x904], 1
jmp 0x1004af6d
and dword [ebp - 0x904], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x388]
mov dword [ebp - 0xb8c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9c8]
mov dword [ebp - 0xb94], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9c8], 0x7f03
jg 0x1004afb8
cmp dword [ebp - 0x34], 0
je 0x1004afb8
mov dword [ebp - 0x7b0], 1
jmp 0x1004afbf
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x7b0]
lea eax, [eax*4 + 1]
mov dword [ebp - 0x7d8], eax
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0xbb0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9c8]
mov dword [ebp - 0xbb8], eax
push 0xfffffffffffffffd
pop eax
sub eax, dword [ebp - 0x958]
jne 0x1004b017
push 0
lea ecx, [ebp - 0xafc]
call fcn.100174a9
cmp dword [eax], 0
jne 0x1004b017
and dword [ebp - 0x7e0], 0
jmp 0x1004b021
mov dword [ebp - 0x7e0], 1
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x388]
cmp eax, dword [ebp - 0x7e0]
jl 0x1004b03f
mov dword [ebp - 0x7c4], 1
jmp 0x1004b046
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x7c4]
sub eax, dword [ebp - 0x960]
je 0x1004b06d
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x388], 0
je 0x1004b06d
mov dword [ebp - 0x968], 1
jmp 0x1004b074
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x388]
mov dword [ebp - 0xbc0], eax
mov dword [ebp - 0x970], 0xad479ea4
mov byte [ebp - 0xa8], 0
lea eax, [ebp - 0xa8]
push eax
push 0xf2a
push 0
push 0x77f9
call fcn.10048d30
add esp, 0x10
jmp 0x1004ae3c
mov byte [ebp - 0xe6], 0
push 0
push 0x132e
lea eax, [ebp - 0xe6]
push eax
push 0x1292
push 0x3369
call fcn.1004a2f0
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xafc]
call fcn.1001748d
mov eax, dword [ebp - 0xcc]
cmp dword [eax], 0x4550
je 0x1004b3c2
mov dword [ebp - 0xc4], 0xe8cff0ea
mov dword [ebp - 0x980], 0x4acd6ba8
mov dword [ebp - 0x988], 6
mov dword [ebp - 0xc4], 0
jmp 0x1004b134
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x13
jne 0x1004b39e
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x154], 0x80ebbd48
mov dword [ebp - 0x1a8], 0
jmp 0x1004b16b
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
jge 0x1004b187
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0xd90], 0xffffffff
jmp 0x1004b15e
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xbc8], eax
cmp dword [ebp - 0x38], 0x7c70ab2
jge 0x1004b1a5
mov dword [ebp - 0x768], 1
jmp 0x1004b1ac
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x768], eax
jg 0x1004b1c3
mov dword [ebp - 0x5c0], 1
jmp 0x1004b1ca
and dword [ebp - 0x5c0], 0
cmp dword [ebp - 0x5c0], 0x3ee7
jge 0x1004b1e2
mov dword [ebp - 0x73c], 1
jmp 0x1004b1e9
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0xc4]
imul eax, dword [ebp - 0x73c]
cmp eax, dword [ebp - 0x38]
jg 0x1004b207
mov dword [ebp - 0x398], 1
jmp 0x1004b20e
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x398], eax
je 0x1004b225
mov dword [ebp - 0x6d8], 1
jmp 0x1004b22c
and dword [ebp - 0x6d8], 0
cmp dword [ebp - 0x6d8], 1
je 0x1004b241
mov dword [ebp - 0x3a0], 1
jmp 0x1004b248
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x3a0]
cmp eax, dword [ebp - 0x38]
jge 0x1004b262
mov dword [ebp - 0x5c8], 1
jmp 0x1004b269
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x5c8], eax
jg 0x1004b283
mov dword [ebp - 0x978], 1
jmp 0x1004b28a
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x38], eax
jge 0x1004b2a1
mov dword [ebp - 0x3a8], 1
jmp 0x1004b2a8
and dword [ebp - 0x3a8], 0
cmp dword [ebp - 0x3a8], 0x98963ec5
je 0x1004b2c0
mov dword [ebp - 0x76c], 1
jmp 0x1004b2c7
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x76c], eax
jne 0x1004b33b
mov dword [ebp - 0x38], 2
jmp 0x1004b2e2
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1004b328
mov dword [ebp - 0x154], 0
jmp 0x1004b301
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 2
jg 0x1004b326
mov byte [ebp - 0xaa], 0
movzx eax, byte [ebp - 0xaa]
test eax, eax
je 0x1004b324
push 0
call fcn.10022d2c
pop ecx
jmp 0x1004b2f4
jmp 0x1004b2db
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xd90], 0
je 0x1004b339
jmp 0x1004b39e
jmp 0x1004b399
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1004b37f
push 0x2ba5
push 0x47a0
push 0x7884
push 0x60bc
push 0x6df6
push 0x2b8f
push 0x27a3
push 1
push 0x37e1
call fcn.10048aec
add esp, 0x24
mov byte [ebp - 0xac], 0
movzx eax, byte [ebp - 0xac]
test eax, eax
je 0x1004b399
push 0
call fcn.10049032
pop ecx
jmp 0x1004b127
lea eax, [ebp - 0x980]
push eax
lea eax, [ebp - 0xc4]
push eax
push 0
lea eax, [ebp - 0x988]
push eax
call fcn.1004a561
add esp, 0x10
jmp 0x100511d3
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xcc]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x1a4], 0
jmp 0x1004b3ee
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 2
jge 0x1004b40a
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0xa98], 8
jmp 0x1004b3e1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa98]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa98], eax
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x1004b446
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
mov eax, dword [ebp - 0x4c]
cmp dword [eax + 4], 0
jne 0x1004b454
jmp 0x100511d3
mov dword [ebp - 0x13c], 0x3fa75c1
mov dword [ebp - 0x90], 0
jmp 0x1004b477
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x1004b493
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x11c], 0xc58a
jmp 0x1004b46a
mov dword [ebp - 0x90], 0
jmp 0x1004b4ac
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x1004b4c8
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x998], 0x3cef3392
jmp 0x1004b49f
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x1004b67b
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0xbd8], eax
cmp dword [ebp - 0x13c], 0
jne 0x1004b50d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x11c], 0
jne 0x1004b50d
and dword [ebp - 0x3b0], 0
jmp 0x1004b517
mov dword [ebp - 0x3b0], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11c]
cmp dword [ebp - 0x3b0], eax
je 0x1004b548
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x11c], 0
je 0x1004b548
mov dword [ebp - 0x5d0], 1
jmp 0x1004b54f
and dword [ebp - 0x5d0], 0
cmp dword [ebp - 0x5d0], 0x5a65
jge 0x1004b67b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x11c], 0
je 0x1004b61c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x11c], 0
je 0x1004b61c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11c]
mov dword [ebp - 0xbe0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x11c]
mov dword [ebp - 0xbe8], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x11c]
cmp dword [ebp + eax - 0x11c], ecx
je 0x1004b5d9
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x11c], 0
je 0x1004b5ec
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x1004b5ec
mov dword [ebp - 0x3b8], 1
jmp 0x1004b5f3
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x3b8]
add eax, 0x3fc2
je 0x1004b61c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x11c], 0
je 0x1004b61c
mov dword [ebp - 0x990], 1
jmp 0x1004b623
and dword [ebp - 0x990], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11c]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0xbf0], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x998], 0x6a08376f
mov byte [ebp - 0xae], 0
movzx eax, byte [ebp - 0xae]
test eax, eax
je 0x1004b679
push 0x2d97
push 1
push 0x6220
call fcn.10048c62
add esp, 0xc
jmp 0x1004b6b0
mov dword [ebp - 0xbf8], 0xfffffff8
mov dword [ebp - 0xc00], 0
mov dword [ebp - 0xc08], 0xb4b26d8f
mov dword [ebp - 0x6e0], 0xea3d8810
mov eax, dword [ebp - 0x6e0]
inc eax
mov dword [ebp - 0x6e0], eax
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 0xcc]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xcc]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x108], eax
and dword [ebp - 0x31c], 0
jmp 0x1004b6f3
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x108]
add eax, 0x28
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0xcc]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x31c], eax
jge 0x1004b871
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x5d8], eax
mov dword [ebp - 0x1ac], 0x5c8094a1
mov dword [ebp - 0xc10], 7
mov dword [ebp - 0xc18], 0xffffffff
mov dword [ebp - 0xc20], 0xfffffff8
mov dword [ebp - 0xc28], 9
mov dword [ebp - 0x214], 0
jmp 0x1004b763
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 1
jge 0x1004b77f
mov eax, dword [ebp - 0x214]
mov dword [ebp + eax*4 - 0xc30], 0x9b31
jmp 0x1004b756
mov dword [ebp - 0x1ac], 0
jmp 0x1004b798
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
jg 0x1004b816
mov dword [ebp - 0x1f4], 0xafd94fe5
mov dword [ebp - 0x1f4], 0
jmp 0x1004b7c4
mov eax, dword [ebp - 0x1f4]
dec eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0
jl 0x1004b811
mov dword [ebp - 0xc38], 0x923607a9
mov dword [ebp - 0xc40], 8
mov dword [ebp - 0x3c0], 0x37bb0086
mov byte [ebp - 0xe8], 0
push 1
lea eax, [ebp - 0xe8]
push eax
call fcn.10048cd7
pop ecx
pop ecx
mov eax, dword [ebp - 0x3c0]
dec eax
mov dword [ebp - 0x3c0], eax
jmp 0x1004b7b7
jmp 0x1004b78b
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5d8]
jb 0x1004b86c
mov eax, dword [ebp - 0xcc]
push dword [eax + 0x38]
mov eax, dword [ebp - 0x108]
push dword [eax + 8]
call fcn.1004880c
pop ecx
pop ecx
add eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x9a0], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x9a0]
jae 0x1004b86c
push 0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.1004a1ff
add esp, 0xc
jmp 0x1004b871
jmp 0x1004b6d7
mov dword [ebp - 0xab4], 0xf9b3198a
mov dword [ebp - 0xab0], 0xf9b3198a
mov dword [ebp - 0xaac], 0xf9b3198a
mov dword [ebp - 0xaa8], 0xf9b3198a
lea ecx, [ebp - 0x2e9]
call fcn.10008b33
push eax
lea eax, [ebp - 0xaa4]
push eax
lea eax, [ebp - 0xab4]
push eax
lea ecx, [ebp - 0xe10]
call fcn.100174b8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9e8]
call fcn.10017467
mov dword [ebp - 4], 3
mov dword [ebp - 0x9c], 0x15cbcef0
mov dword [ebp - 0x7a4], 1
mov dword [ebp - 0x35c], 0x3fc4b03e
mov dword [ebp - 0x438], 3
push 3
lea ecx, [ebp - 0x9d8]
call fcn.1001740b
mov byte [ebp - 4], 4
mov dword [ebp - 0x2c8], 0xfffffff8
mov dword [ebp - 0x164], 0
jmp 0x1004b931
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jge 0x1004b94d
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x830], 0xc6f1bf50
jmp 0x1004b924
push 0
lea eax, [ebp - 0x164]
push eax
push 0x1582
lea eax, [ebp - 0x9d8]
push eax
push 0x4975
call fcn.10049295
add esp, 0x14
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x830], 3
jmp 0x1004b99a
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x830]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x830], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x830], 0
jl 0x1004c006
mov dword [ebp - 0x9a8], 3
mov dword [ebp - 0x9b8], 1
mov dword [ebp - 0x3e0], 0
mov dword [ebp - 0x1b4], 0xd8c5
mov dword [ebp - 0x3c8], 0
mov dword [ebp - 0xa58], 0xf746b325
mov dword [ebp - 0x80], 0
jmp 0x1004b9f9
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x1004ba0f
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xb50], 2
jmp 0x1004b9f2
mov dword [ebp - 0x80], 0
jmp 0x1004ba1f
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1004ba35
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x428], 1
jmp 0x1004ba18
mov eax, dword [ebp - 0x3c8]
dec eax
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x9c], 0
jmp 0x1004ba5b
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jg 0x1004c001
push 2
lea ecx, [ebp - 0x7c0]
call fcn.1001740b
mov byte [ebp - 4], 5
push 0x405c
lea eax, [ebp - 0x7c0]
push eax
push 1
lea eax, [ebp - 0xc48]
push eax
call fcn.10048d30
add esp, 0x10
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x830], 0
jne 0x1004bb63
mov eax, 0xf9eb
test eax, eax
je 0x1004bb5a
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x9e8]
call fcn.100174a9
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0xc50], eax
mov eax, 0x69d
test eax, eax
je 0x1004baf1
cmp dword [ebp - 0x35c], 0
je 0x1004baf1
mov dword [ebp - 0x774], 1
jmp 0x1004baf8
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x774]
sub eax, 3
jne 0x1004bb15
cmp dword [ebp - 0x9a8], 0
jne 0x1004bb15
and dword [ebp - 0x3d0], 0
jmp 0x1004bb1f
mov dword [ebp - 0x3d0], 1
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x9e8]
call fcn.100174a9
mov esi, dword [ebp - 0x3d0]
imul esi, dword [eax]
push 2
lea ecx, [ebp - 0x9d8]
call fcn.100174a9
mov eax, dword [eax]
lea eax, [esi + eax - 5]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x830]
jne 0x1004bb63
and dword [ebp - 0x9b0], 0
jmp 0x1004bb6d
mov dword [ebp - 0x9b0], 1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb50], 0xe6c1cc49
je 0x1004bb8b
mov dword [ebp - 0x324], 1
jmp 0x1004bb92
and dword [ebp - 0x324], 0
push 2
lea ecx, [ebp - 0x9d8]
call fcn.100174a9
mov ecx, dword [ebp - 0x324]
mov dword [eax], ecx
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x9e8]
call fcn.100174a9
mov eax, dword [eax]
add eax, dword [ebp - 0x324]
cmp eax, 0xd1c
je 0x1004bbd3
mov dword [ebp - 0x5e0], 1
jmp 0x1004bbda
and dword [ebp - 0x5e0], 0
push 1
lea ecx, [ebp - 0x7c0]
call fcn.100174a9
mov ecx, dword [ebp - 0x5e0]
mov dword [eax], ecx
mov dword [ebp - 0x1b4], 3
jmp 0x1004bc08
mov eax, dword [ebp - 0x1b4]
dec eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0
jl 0x1004bfed
mov dword [ebp - 0x234], 0x420a61b3
mov dword [ebp - 0x408], 0x56b7
mov eax, dword [ebp - 0x9b8]
mov dword [ebp - 0xc58], eax
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0
jne 0x1004bc5c
cmp dword [ebp - 0x234], 0
jne 0x1004bc5c
and dword [ebp - 0x3d8], 0
jmp 0x1004bc66
mov dword [ebp - 0x3d8], 1
cmp dword [ebp - 0x3d8], 0x33df
jl 0x1004bc7e
mov dword [ebp - 0x6e8], 1
jmp 0x1004bc85
and dword [ebp - 0x6e8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6e8]
mov dword [ebp + eax - 0xb50], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb50]
mov dword [ebp - 0xc60], eax
cmp dword [ebp - 0x408], 0
jne 0x1004bcc5
cmp dword [ebp - 0x3e0], 0
jne 0x1004bcc5
and dword [ebp - 0x5e8], 0
jmp 0x1004bccf
mov dword [ebp - 0x5e8], 1
mov eax, dword [ebp - 0x5e8]
sub eax, dword [ebp - 0x2c8]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x428]
cmp eax, 0x1489
jge 0x1004bcfc
mov dword [ebp - 0x3e8], 1
jmp 0x1004bd03
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x7a4], eax
mov esi, dword [ebp - 0x7a4]
push 1
lea ecx, [ebp - 0x7c0]
call fcn.100174a9
cmp esi, dword [eax]
jge 0x1004bd32
mov dword [ebp - 0x3f0], 1
jmp 0x1004bd39
and dword [ebp - 0x3f0], 0
push 0
lea ecx, [ebp - 0x7c0]
call fcn.100174a9
mov ecx, dword [ebp - 0x3f0]
cmp ecx, dword [eax]
jg 0x1004bd5c
mov dword [ebp - 0x5f0], 1
jmp 0x1004bd63
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x438]
cmp dword [ebp - 0x5f0], eax
jle 0x1004bd7d
mov dword [ebp - 0x3f8], 1
jmp 0x1004bd84
and dword [ebp - 0x3f8], 0
cmp dword [ebp - 0x3f8], 0xd055
jge 0x1004bd9c
mov dword [ebp - 0x6f0], 1
jmp 0x1004bda3
and dword [ebp - 0x6f0], 0
cmp dword [ebp - 0x6f0], 4
jg 0x1004bdb8
mov dword [ebp - 0x400], 1
jmp 0x1004bdbf
and dword [ebp - 0x400], 0
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x9e8]
call fcn.100174a9
mov eax, dword [eax]
cmp eax, dword [ebp - 0x400]
jne 0x1004bde6
mov dword [ebp - 0x310], 1
jmp 0x1004bded
and dword [ebp - 0x310], 0
push 2
lea ecx, [ebp - 0x9d8]
call fcn.100174a9
mov ecx, dword [ebp - 0x310]
mov dword [eax], ecx
imul eax, dword [ebp - 0x310], 0x1299
cmp eax, 0xfffffffa
jae 0x1004be2c
mov eax, 0x6fa8
test eax, eax
jne 0x1004be2c
mov eax, 0x53aaa0c
test eax, eax
jne 0x1004be2c
and dword [ebp - 0x5f8], 0
jmp 0x1004be36
mov dword [ebp - 0x5f8], 1
mov eax, dword [ebp - 0x5f8]
sub eax, dword [ebp - 0x2c8]
cmp eax, dword [ebp - 0x408]
jne 0x1004be56
mov dword [ebp - 0x770], 1
jmp 0x1004be5d
and dword [ebp - 0x770], 0
imul eax, dword [ebp - 0x770], 0
cmp dword [ebp - 0xa58], eax
jg 0x1004be78
mov dword [ebp - 0x410], 1
jmp 0x1004be7f
and dword [ebp - 0x410], 0
cmp dword [ebp - 0x410], 5
jb 0x1004be94
mov dword [ebp - 0x600], 1
jmp 0x1004be9b
and dword [ebp - 0x600], 0
mov esi, dword [ebp - 0x234]
add esi, dword [ebp - 0x600]
push 1
lea ecx, [ebp - 0x7c0]
call fcn.100174a9
cmp esi, dword [eax]
jle 0x1004bec4
mov dword [ebp - 0x418], 1
jmp 0x1004becb
and dword [ebp - 0x418], 0
cmp dword [ebp - 0x418], 0x19de87a9
jl 0x1004bee3
mov dword [ebp - 0x6f8], 1
jmp 0x1004beea
and dword [ebp - 0x6f8], 0
cmp dword [ebp - 0x6f8], 0xea62
jle 0x1004bf02
mov dword [ebp - 0x420], 1
jmp 0x1004bf09
and dword [ebp - 0x420], 0
cmp dword [ebp - 0x420], 0xfffffff9
jae 0x1004bf1e
mov dword [ebp - 0x608], 1
jmp 0x1004bf25
and dword [ebp - 0x608], 0
push 1
lea ecx, [ebp - 0x7c0]
call fcn.100174a9
mov ecx, dword [ebp - 0x608]
cmp ecx, dword [eax]
jge 0x1004bf48
mov dword [ebp - 0x77c], 1
jmp 0x1004bf4f
and dword [ebp - 0x77c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x428]
cmp dword [ebp - 0x77c], eax
jne 0x1004bf70
mov dword [ebp - 0x430], 1
jmp 0x1004bf77
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
add eax, 0x1a4633be
cmp eax, 0x548e
jg 0x1004bf95
mov dword [ebp - 0x610], 1
jmp 0x1004bf9c
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
je 0x1004bfd3
mov eax, 0x122bf4b
test eax, eax
je 0x1004bfd3
mov byte [ebp - 0xb0], 0
push 1
lea eax, [ebp - 0xb0]
push eax
call fcn.10048daf
pop ecx
pop ecx
jmp 0x1004bfe8
push 1
lea ecx, [ebp - 0x7c0]
call fcn.100174a9
mov eax, dword [eax]
mov dword [ebp - 0x438], eax
jmp 0x1004bbfb
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x7c0]
call fcn.1001748d
jmp 0x1004ba4e
jmp 0x1004b981
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x9d8]
call fcn.1001748d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e8]
call fcn.1001748d
cmp dword [ebp - 0x30], 0
jne 0x1004c02f
jmp 0x100511d3
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x30]
add ecx, dword [eax]
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x14], ecx
xor ecx, ecx
call fcn.10032140
push eax
call fcn.1006e798
pop ecx
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x1fc], 9
mov dword [ebp - 0x628], 0x83d87e3b
mov dword [ebp - 0x460], 0xfcc1031c
mov dword [ebp - 0xa44], 0xfffffff6
mov dword [ebp - 0x1bc], 0
jmp 0x1004c093
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 1
jge 0x1004c0af
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0x834], 5
jmp 0x1004c086
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x50]
je 0x1004c0bb
cmp dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xc68], eax
cmp dword [ebp - 0x50], 0x76f
je 0x1004c0d9
mov dword [ebp - 0x700], 1
jmp 0x1004c0e0
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x700], eax
jl 0x1004c0f7
mov dword [ebp - 0x440], 1
jmp 0x1004c0fe
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x440], eax
jle 0x1004c115
mov dword [ebp - 0x618], 1
jmp 0x1004c11c
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0
jne 0x1004c14c
cmp dword [ebp - 0x1fc], 0
jne 0x1004c14c
cmp dword [ebp - 0x1fc], 0
jne 0x1004c14c
and dword [ebp - 0x448], 0
jmp 0x1004c156
mov dword [ebp - 0x448], 1
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x448], eax
jge 0x1004c16d
mov dword [ebp - 0x778], 1
jmp 0x1004c174
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x628]
cmp dword [ebp - 0x778], eax
jle 0x1004c18e
mov dword [ebp - 0x450], 1
jmp 0x1004c195
and dword [ebp - 0x450], 0
cmp dword [ebp - 0x450], 0xe5077045
jb 0x1004c1ad
mov dword [ebp - 0x620], 1
jmp 0x1004c1b4
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x620]
add eax, 0x15b2a601
cmp eax, 0xfffffff8
jne 0x1004c1d0
mov dword [ebp - 0x458], 1
jmp 0x1004c1d7
and dword [ebp - 0x458], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x834]
add eax, dword [ebp - 0x458]
je 0x1004c201
mov eax, 0x1d77f172
test eax, eax
je 0x1004c201
mov dword [ebp - 0x708], 1
jmp 0x1004c208
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x708]
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0xc70], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xc78], eax
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x628]
cmp eax, 1
jl 0x1004c244
mov dword [ebp - 0x468], 1
jmp 0x1004c24b
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0xa44], eax
mov dword [ebp - 0x88], 0xb457102d
mov dword [ebp - 0x74], 0
jmp 0x1004c271
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1004c287
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xa6c], 0x1b3c692b
jmp 0x1004c26a
mov dword [ebp - 0x74], 0
jmp 0x1004c297
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1004c2ad
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xba0], 0xfffffffa
jmp 0x1004c290
mov byte [ebp - 0xe7], 0
movzx eax, byte [ebp - 0xe7]
test eax, eax
je 0x1004c2e2
push 0
push 0x61b2
push 0x4591
push 0x283e
push 0x3891
push 0x5454
call fcn.1004a784
add esp, 0x18
mov dword [ebp - 0x88], 2
jmp 0x1004c2fb
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jl 0x1004c3e1
push 0
call fcn.10049a53
pop ecx
mov eax, dword [ebp - 0x88]
cmp dword [ebp + eax*4 - 0xa6c], 0
je 0x1004c367
mov eax, dword [ebp - 0x88]
cmp dword [ebp + eax*4 - 0xa6c], 2
jae 0x1004c33c
mov dword [ebp - 0xa4c], 1
jmp 0x1004c343
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xc80], eax
mov eax, 0x6880
imul eax, eax, 0xf2f
mov ecx, dword [ebp - 0x88]
add eax, dword [ebp + ecx*4 - 0xa6c]
mov eax, dword [ebp - 0x88]
cmp dword [ebp + eax*4 - 0xa6c], 0xfffffffa
jbe 0x1004c383
mov dword [ebp - 0x780], 1
jmp 0x1004c38a
and dword [ebp - 0x780], 0
cmp dword [ebp - 0x780], 0
jle 0x1004c39f
mov dword [ebp - 0x470], 1
jmp 0x1004c3a6
and dword [ebp - 0x470], 0
cmp dword [ebp - 0x470], 1
jle 0x1004c3bf
push 0xfffffffffffffffe
pop eax
test eax, eax
jne 0x1004c3bf
and dword [ebp - 0x630], 0
jmp 0x1004c3c9
mov dword [ebp - 0x630], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x630]
mov dword [ebp + eax - 0xba0], ecx
jmp 0x1004c2ee
mov byte [ebp - 0x2a4], 9
mov byte [ebp - 0x2a3], 0xd8
mov byte [ebp - 0x2a2], 8
mov byte [ebp - 0x2a1], 0
mov byte [ebp - 0x2a0], 3
mov byte [ebp - 0x29f], 7
mov byte [ebp - 0x29e], 0
mov byte [ebp - 0x29d], 6
mov byte [ebp - 0x29c], 1
mov byte [ebp - 0x29b], 4
mov byte [ebp - 0x29a], 2
mov byte [ebp - 0x299], 2
mov byte [ebp - 0x298], 7
mov byte [ebp - 0x297], 1
mov byte [ebp - 0x296], 5
mov byte [ebp - 0x295], 7
mov byte [ebp - 0x294], 4
mov byte [ebp - 0x293], 9
mov byte [ebp - 0x292], 6
mov byte [ebp - 0x291], 9
mov byte [ebp - 0x290], 0x27
mov byte [ebp - 0x28f], 0xdc
mov byte [ebp - 0x28e], 0xd
mov byte [ebp - 0x28d], 0x90
mov byte [ebp - 0x28c], 0xeb
mov byte [ebp - 0x28b], 0xd
mov byte [ebp - 0x28a], 0xa5
mov byte [ebp - 0x289], 0x74
mov byte [ebp - 0x288], 0x48
mov byte [ebp - 0x287], 0xa5
mov byte [ebp - 0x286], 0xfa
mov byte [ebp - 0x285], 0x11
mov byte [ebp - 0x284], 0x38
mov byte [ebp - 0x283], 0x3f
mov byte [ebp - 0x282], 0xc1
mov byte [ebp - 0x281], 0x8b
mov byte [ebp - 0x280], 0x38
mov byte [ebp - 0x27f], 0xe5
mov byte [ebp - 0x27e], 0x92
mov byte [ebp - 0x27d], 0xac
mov byte [ebp - 0x27c], 0x79
mov byte [ebp - 0x27b], 0x96
mov byte [ebp - 0x27a], 0x7d
mov byte [ebp - 0x279], 0xec
mov byte [ebp - 0x278], 0x57
mov byte [ebp - 0x277], 0x35
mov byte [ebp - 0x276], 0x37
mov byte [ebp - 0x275], 0x42
mov byte [ebp - 0x274], 0xfb
mov byte [ebp - 0x273], 0x65
mov byte [ebp - 0x272], 0xab
mov byte [ebp - 0x271], 0x30
mov byte [ebp - 0x270], 0x39
mov byte [ebp - 0x26f], 0xd9
mov byte [ebp - 0x26e], 0x12
mov byte [ebp - 0x26d], 0x69
mov byte [ebp - 0x26c], 0xb6
mov byte [ebp - 0x26b], 0x8f
mov byte [ebp - 0x26a], 0x47
mov byte [ebp - 0x269], 0x81
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x2a4]
or eax, 0xe8
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x2a4]
and ecx, 0xe8
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x2a4]
mov byte [ebp + ecx - 0x7ec], al
mov dword [ebp - 0x1c], 2
and dword [ebp - 0x128], 0
jmp 0x1004c5db
mov eax, dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3c
jae 0x1004c6b9
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x2a4]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x1c], eax
jne 0x1004c625
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x2a4]
inc eax
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x2a4]
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x1c], eax
jmp 0x1004c5d3
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x2a3]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x128]
movzx ecx, byte [ebp + ecx - 0x2a6]
movsx ecx, byte [ebp + ecx - 0x7ec]
add eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x2a3]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x128]
movzx edx, byte [ebp + edx - 0x2a6]
movsx edx, byte [ebp + edx - 0x7ec]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x2a3]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x128]
movzx edx, byte [ebp + edx - 0x2a6]
movsx edx, byte [ebp + edx - 0x7ec]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x2a4]
mov byte [ebp + ecx - 0x7ec], al
and dword [ebp - 0x128], 0
jmp 0x1004c5d3
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x7ec], 0
mov dword [ebp - 0x144], 0x3fa75c1
mov dword [ebp - 0x98], 0
jmp 0x1004c6ea
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x1004c706
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x114], 0xc58a
jmp 0x1004c6dd
mov dword [ebp - 0x98], 0
jmp 0x1004c71f
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x1004c73b
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x8dc], 0x3cef3392
jmp 0x1004c712
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x1004c8e2
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0xc88], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0xc90], eax
cmp dword [ebp - 0x144], 0
jne 0x1004c780
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x114], 0
jne 0x1004c780
and dword [ebp - 0x478], 0
jmp 0x1004c78a
mov dword [ebp - 0x478], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x114]
cmp dword [ebp - 0x478], eax
je 0x1004c7bb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x114], 0
je 0x1004c7bb
mov dword [ebp - 0x710], 1
jmp 0x1004c7c2
and dword [ebp - 0x710], 0
cmp dword [ebp - 0x710], 0x5a65
jge 0x1004c8e2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x114], 0
je 0x1004c88f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x114], 0
je 0x1004c88f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x114]
mov dword [ebp - 0xc98], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x114]
mov dword [ebp - 0xca0], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x114]
cmp dword [ebp + eax - 0x114], ecx
je 0x1004c84c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x114], 0
je 0x1004c85f
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x1004c85f
mov dword [ebp - 0x480], 1
jmp 0x1004c866
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
add eax, 0x3fc2
je 0x1004c88f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x114], 0
je 0x1004c88f
mov dword [ebp - 0x9cc], 1
jmp 0x1004c896
and dword [ebp - 0x9cc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x114]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0xca8], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x8dc], 0x6a08376f
mov byte [ebp - 0xb4], 0
movzx eax, byte [ebp - 0xb4]
test eax, eax
je 0x1004c8e0
push 1
call fcn.10048e03
pop ecx
jmp 0x1004c925
mov dword [ebp - 0xcb0], 0xfffffff8
mov dword [ebp - 0xd3c], 0
mov dword [ebp - 0xd44], 0xb4b26d8f
mov dword [ebp - 0x840], 0xea3d8810
push 0x48a8
push 0
push 0xcb3
lea eax, [ebp - 0x840]
push eax
call fcn.1004a632
add esp, 0x10
lea eax, [ebp - 0x7ec]
push eax
lea ecx, [ebp - 0xe70]
call fcn.10026067
mov dword [ebp - 0x95c], eax
mov eax, dword [ebp - 0x95c]
mov dword [ebp - 0x848], eax
mov dword [ebp - 4], 6
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x848]
call fcn.10032105
pop ecx
mov dword [ebp - 0x96c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe70]
call fcn.1001736d
and dword [ebp - 0x1c4], 0
jmp 0x1004c98b
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0xb
jae 0x1004c9a4
mov eax, dword [ebp - 0x1c4]
mov byte [ebp + eax - 0x7ec], 0
jmp 0x1004c97e
mov dword [ebp - 0x2d0], 1
mov dword [ebp - 0x314], 1
mov dword [ebp - 0x21c], 0
jmp 0x1004c9d1
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 1
jge 0x1004c9ea
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0x54], 2
jmp 0x1004c9c4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x54], 0xfffffff0
jmp 0x1004ca0f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x54], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x54], 0xffffffe4
je 0x1004ccfb
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x10c], 0xfffffff8
mov dword [ebp - 0x850], 0x4bab
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x54], 0x51ebf0dd
jne 0x1004ca57
mov dword [ebp - 0x638], 1
jmp 0x1004ca5e
and dword [ebp - 0x638], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54]
cmp dword [ebp - 0x638], eax
jg 0x1004ca7c
mov dword [ebp - 0x488], 1
jmp 0x1004ca83
and dword [ebp - 0x488], 0
cmp dword [ebp - 0x488], 0x93e7
jle 0x1004ca9b
mov dword [ebp - 0x788], 1
jmp 0x1004caa2
and dword [ebp - 0x788], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54]
cmp dword [ebp - 0x788], eax
je 0x1004cac0
mov dword [ebp - 0x490], 1
jmp 0x1004cac7
and dword [ebp - 0x490], 0
cmp dword [ebp - 0x490], 5
je 0x1004cadc
mov dword [ebp - 0x640], 1
jmp 0x1004cae3
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x58]
neg eax
cmp eax, dword [ebp - 0x640]
jl 0x1004cafc
mov dword [ebp - 0x498], 1
jmp 0x1004cb03
and dword [ebp - 0x498], 0
cmp dword [ebp - 0x498], 0x45ac
jle 0x1004cb1b
mov dword [ebp - 0x718], 1
jmp 0x1004cb22
and dword [ebp - 0x718], 0
cmp dword [ebp - 0x718], 7
jne 0x1004cb37
mov dword [ebp - 0x4a0], 1
jmp 0x1004cb3e
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x4a0], eax
jl 0x1004cb58
cmp dword [ebp - 0x58], 0
jne 0x1004cb58
and dword [ebp - 0x648], 0
jmp 0x1004cb62
mov dword [ebp - 0x648], 1
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x2d0]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x54]
cmp dword [ebp - 0x58], eax
jne 0x1004cb90
mov dword [ebp - 0x4a8], 1
jmp 0x1004cb97
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xd4c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54]
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0
jne 0x1004cbfa
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x54], 1
jg 0x1004cbe1
mov dword [ebp - 0x784], 1
jmp 0x1004cbe8
and dword [ebp - 0x784], 0
cmp dword [ebp - 0x10c], 0xfffffff7
jb 0x1004cbfa
and dword [ebp - 0x4b0], 0
jmp 0x1004cc04
mov dword [ebp - 0x4b0], 1
cmp dword [ebp - 0x4b0], 0
je 0x1004cc19
mov dword [ebp - 0x650], 1
jmp 0x1004cc20
and dword [ebp - 0x650], 0
cmp dword [ebp - 0x650], 0x7c74
jle 0x1004cc38
mov dword [ebp - 0xa3c], 1
jmp 0x1004cc3f
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0x10c]
imul eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x58]
cmp eax, 0x217c7128
jl 0x1004cc68
mov dword [ebp - 0x4b8], 1
jmp 0x1004cc6f
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x1004cc96
cmp dword [ebp - 0x314], 0
jne 0x1004cc96
and dword [ebp - 0x720], 0
jmp 0x1004cca0
mov dword [ebp - 0x720], 1
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x720], eax
jne 0x1004ccb7
mov dword [ebp - 0x4c0], 1
jmp 0x1004ccbe
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x58], 0x27815014
je 0x1004cce3
mov dword [ebp - 0x658], 1
jmp 0x1004ccea
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0x850], eax
jmp 0x1004c9fa
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1004cd21
push 1
push 0x1356
push 0x3d7
call fcn.10048e33
add esp, 0xc
mov dword [ebp - 0x78], 0xad313dd3
mov dword [ebp - 0x660], 0xc56e700d
mov dword [ebp - 0x78], 0
jmp 0x1004cd42
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xc
jle 0x1004ced2
mov dword [ebp - 0x4d8], 0xa5ef
mov dword [ebp - 0x4e8], 2
mov dword [ebp - 0x964], 1
mov dword [ebp - 0x1cc], 0
jmp 0x1004cd83
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 3
jge 0x1004cd9f
mov eax, dword [ebp - 0x1cc]
mov dword [ebp + eax*4 - 0xda8], 0x57f451d5
jmp 0x1004cd76
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x1004cdbf
push 0x230
push 0
call fcn.10049053
pop ecx
pop ecx
cmp dword [ebp - 0x78], 0
jne 0x1004cdd1
mov dword [ebp - 0x4c8], 1
jmp 0x1004cdd8
and dword [ebp - 0x4c8], 0
cmp dword [ebp - 0x4d8], 0
jne 0x1004cded
mov dword [ebp - 0x338], 1
jmp 0x1004cdf4
and dword [ebp - 0x338], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x338]
mov dword [ebp + eax - 0xda8], ecx
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x338], eax
jne 0x1004ce1e
mov dword [ebp - 0x7ac], 1
jmp 0x1004ce25
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0x7ac]
je 0x1004ce3f
mov dword [ebp - 0x4d0], 1
jmp 0x1004ce46
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x660], eax
mov eax, dword [ebp - 0x660]
cmp dword [ebp - 0x78], eax
jne 0x1004ce69
mov dword [ebp - 0x728], 1
jmp 0x1004ce70
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x4d8]
cmp eax, dword [ebp - 0x728]
je 0x1004ce8d
cmp dword [ebp - 0x78], 0
jne 0x1004ce8d
and dword [ebp - 0x4e0], 0
jmp 0x1004ce97
mov dword [ebp - 0x4e0], 1
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x4e0]
jne 0x1004ceae
mov dword [ebp - 0x668], 1
jmp 0x1004ceb5
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x964], eax
jmp 0x1004cd3b
mov byte [ebp - 0x268], 6
mov byte [ebp - 0x267], 0x59
mov byte [ebp - 0x266], 7
mov byte [ebp - 0x265], 0xf
mov byte [ebp - 0x264], 9
mov byte [ebp - 0x263], 6
mov byte [ebp - 0x262], 0
mov byte [ebp - 0x261], 1
mov byte [ebp - 0x260], 4
mov byte [ebp - 0x25f], 5
mov byte [ebp - 0x25e], 8
mov byte [ebp - 0x25d], 4
mov byte [ebp - 0x25c], 3
mov byte [ebp - 0x25b], 2
mov byte [ebp - 0x25a], 0x18
mov byte [ebp - 0x259], 0xdf
mov byte [ebp - 0x258], 0xcc
mov byte [ebp - 0x257], 0x44
mov byte [ebp - 0x256], 0x6d
mov byte [ebp - 0x255], 0xaf
mov byte [ebp - 0x254], 0xaa
mov byte [ebp - 0x253], 0xb9
mov byte [ebp - 0x252], 0x7d
mov byte [ebp - 0x251], 0xc5
mov byte [ebp - 0x250], 0x38
mov byte [ebp - 0x24f], 0xb7
mov byte [ebp - 0x24e], 0xc2
mov byte [ebp - 0x24d], 0x20
mov byte [ebp - 0x24c], 0x83
mov byte [ebp - 0x24b], 0xca
mov byte [ebp - 0x24a], 0x34
mov byte [ebp - 0x249], 0x33
mov byte [ebp - 0x248], 0xde
mov byte [ebp - 0x247], 0x1b
mov byte [ebp - 0x246], 0x33
mov byte [ebp - 0x245], 5
mov byte [ebp - 0x244], 0xec
mov byte [ebp - 0x243], 0xe0
mov byte [ebp - 0x242], 0x84
mov byte [ebp - 0x241], 5
mov byte [ebp - 0x240], 3
mov byte [ebp - 0x23f], 1
mov byte [ebp - 0x23e], 7
mov byte [ebp - 0x23d], 2
mov byte [ebp - 0x23c], 1
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x268]
or eax, 0x60
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x268]
and ecx, 0x60
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x268]
mov byte [ebp + ecx - 0x804], al
mov dword [ebp - 0x3c], 2
and dword [ebp - 0x204], 0
jmp 0x1004d05e
mov eax, dword [ebp - 0x3c]
inc eax
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x2d
jae 0x1004d128
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x268]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x3c], eax
jne 0x1004d0a8
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0x268]
inc eax
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0x268]
mov ecx, dword [ebp - 0x3c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x3c], eax
jmp 0x1004d056
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0x267]
mov ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x204]
movzx ecx, byte [ebp + ecx - 0x26a]
movsx ecx, byte [ebp + ecx - 0x804]
or eax, ecx
mov ecx, dword [ebp - 0x3c]
movzx ecx, byte [ebp + ecx - 0x267]
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x204]
movzx edx, byte [ebp + edx - 0x26a]
movsx edx, byte [ebp + edx - 0x804]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x3c]
movzx ecx, byte [ebp + ecx - 0x268]
mov byte [ebp + ecx - 0x804], al
lea eax, [ebp - 0x204]
push eax
push 0x6230
push 0x17a
push 1
call fcn.10048ea0
add esp, 0x10
jmp 0x1004d056
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x804], 0
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0xe40]
call fcn.10026067
mov dword [ebp - 0x858], eax
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0x9dc], eax
mov dword [ebp - 4], 7
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x9dc]
call fcn.10032105
pop ecx
mov dword [ebp - 0x860], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe40]
call fcn.1001736d
and dword [ebp - 0x1d4], 0
jmp 0x1004d19c
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0xb
jae 0x1004d1b5
mov eax, dword [ebp - 0x1d4]
mov byte [ebp + eax - 0x804], 0
jmp 0x1004d18f
push dword [ebp - 0x860]
push dword [ebp - 0x96c]
call fcn.1004625f
pop ecx
pop ecx
mov dword [ebp - 0x6a0], eax
push 3
lea ecx, [ebp - 0x9f8]
call fcn.1001740b
mov dword [ebp - 4], 8
mov dword [ebp - 0x22c], 0
jmp 0x1004d1fb
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jge 0x1004d21d
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x9f8]
call fcn.100174a9
mov dword [eax], 0x540d7f82
jmp 0x1004d1ee
push 1
lea ecx, [ebp - 0x9f8]
call fcn.100174a9
mov dword [eax], 0x1d
jmp 0x1004d256
push 1
lea ecx, [ebp - 0x9f8]
call fcn.100174a9
mov dword [ebp - 0x78c], eax
mov eax, dword [ebp - 0x78c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x78c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x9f8]
call fcn.100174a9
cmp dword [eax], 0x1c
jl 0x1004d284
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x1004d282
push 1
call fcn.10048ef0
pop ecx
jmp 0x1004d232
mov byte [ebp - 0xb6], 0
movzx eax, byte [ebp - 0xb6]
test eax, eax
je 0x1004d29e
push 1
call fcn.10048f2f
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9f8]
call fcn.1001748d
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0x6a0]
mov dword [eax + 8], ecx
push 2
lea ecx, [ebp - 0x344]
call fcn.1001740b
mov dword [ebp - 4], 9
mov dword [ebp - 0x370], 0xfffffffd
mov dword [ebp - 0x36c], 0xfffffffd
mov dword [ebp - 0x368], 0xfffffffd
mov dword [ebp - 0x364], 0xfffffffd
mov dword [ebp - 0x7b4], 0xdb255963
lea eax, [ebp - 0xd5c]
push eax
push 1
lea eax, [ebp - 0x344]
push eax
call fcn.10048f4e
add esp, 0xc
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x370], 0
jmp 0x1004d348
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x370]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x370], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x370], 1
jg 0x1004d98f
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x40], 0xf748dc16
push 1
lea ecx, [ebp - 0x824]
call fcn.1001740b
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x1dc], 0
jmp 0x1004d394
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 1
jge 0x1004d3b6
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0x824]
call fcn.100174a9
mov dword [eax], 9
jmp 0x1004d387
mov dword [ebp - 0x2c], 0
jmp 0x1004d3c6
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jg 0x1004d7d5
mov dword [ebp - 0x44], 0xe0c863cc
mov dword [ebp - 0x518], 0x4c77a5c6
mov dword [ebp - 0x870], 0xda53d1e
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x344]
call fcn.100174a9
imul ecx, dword [ebp - 0x2c], 0xa21e
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x2c]
jge 0x1004d413
mov dword [ebp - 0x868], 1
jmp 0x1004d41a
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xd64], eax
mov eax, dword [ebp - 0x2c]
push 4
pop ecx
imul ecx, ecx, 3
imul eax, dword [ebp + ecx - 0x370]
cmp eax, 0xffffffff
jg 0x1004d445
mov dword [ebp - 0x4f0], 1
jmp 0x1004d44c
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x4f0], eax
jne 0x1004d463
mov dword [ebp - 0x670], 1
jmp 0x1004d46a
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0x16
jmp 0x1004d483
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xfffffff5
jne 0x1004d7d0
mov dword [ebp - 0x20c], 0x314d41bd
mov dword [ebp - 0x318], 0x3ede5c48
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x370], 0xe9e5a939
ja 0x1004d4c0
mov dword [ebp - 0x730], 1
jmp 0x1004d4c7
and dword [ebp - 0x730], 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x344]
call fcn.100174a9
cmp dword [eax], 0x63f6d1d8
jge 0x1004d4e9
mov dword [ebp - 0x4f8], 1
jmp 0x1004d4f0
and dword [ebp - 0x4f8], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x370]
cmp eax, dword [ebp - 0x4f8]
jl 0x1004d51a
cmp dword [ebp - 0x20c], 0
je 0x1004d51a
mov dword [ebp - 0x2d8], 1
jmp 0x1004d521
and dword [ebp - 0x2d8], 0
push 0
lea ecx, [ebp - 0x824]
call fcn.100174a9
mov ecx, dword [ebp - 0x2d8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x730]
cmp eax, dword [ebp - 0x2d8]
jge 0x1004d550
mov dword [ebp - 0x500], 1
jmp 0x1004d557
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x500], eax
jg 0x1004d56e
mov dword [ebp - 0x678], 1
jmp 0x1004d575
and dword [ebp - 0x678], 0
imul eax, dword [ebp - 0x678], 0xfffffffb
cmp eax, dword [ebp - 0x20c]
jle 0x1004d590
mov dword [ebp - 0x508], 1
jmp 0x1004d597
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0x318], eax
jle 0x1004d5bd
mov dword [ebp - 0x7dc], 1
jmp 0x1004d5c4
and dword [ebp - 0x7dc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x370]
mov ecx, dword [ebp - 0x7dc]
sub ecx, dword [ebp - 0x40]
imul eax, ecx
test eax, eax
je 0x1004d61f
mov byte [ebp - 0xe3], 0
movzx eax, byte [ebp - 0xe3]
test eax, eax
je 0x1004d606
push 1
push 0x623e
push 0x7d24
call fcn.10048fc4
add esp, 0xc
push 1
lea ecx, [ebp - 0x344]
call fcn.100174a9
cmp dword [eax], 0
je 0x1004d61d
jmp 0x1004d7d0
jmp 0x1004d62d
cmp dword [ebp - 0x318], 0
je 0x1004d62d
jmp 0x1004d7d0
mov dword [ebp - 0x44], 0
jmp 0x1004d63d
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jg 0x1004d7cb
push dword [ebp - 0x44]
lea ecx, [ebp - 0x344]
call fcn.100174a9
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x370], 0x16d6
jg 0x1004d673
mov dword [ebp - 0x510], 1
jmp 0x1004d67a
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x510]
sub eax, 0x2a44f381
cmp eax, dword [ebp - 0x44]
jne 0x1004d696
mov dword [ebp - 0x680], 1
jmp 0x1004d69d
and dword [ebp - 0x680], 0
cmp dword [ebp - 0x680], 3
jl 0x1004d6b2
mov dword [ebp - 0xa48], 1
jmp 0x1004d6b9
and dword [ebp - 0xa48], 0
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0xd6c], eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x344]
call fcn.100174a9
mov esi, eax
push dword [ebp - 0x44]
lea ecx, [ebp - 0x344]
call fcn.100174a9
mov ecx, dword [esi]
add ecx, dword [eax]
mov dword [ebp - 0x518], ecx
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x518], eax
jle 0x1004d704
mov dword [ebp - 0x738], 1
jmp 0x1004d70b
and dword [ebp - 0x738], 0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x344]
call fcn.100174a9
mov ecx, dword [ebp - 0x738]
cmp ecx, dword [eax]
jl 0x1004d72f
mov dword [ebp - 0x520], 1
jmp 0x1004d736
and dword [ebp - 0x520], 0
cmp dword [ebp - 0x520], 0xdfeb077c
jb 0x1004d74e
mov dword [ebp - 0x688], 1
jmp 0x1004d755
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x688], eax
jl 0x1004d76c
mov dword [ebp - 0x528], 1
jmp 0x1004d773
and dword [ebp - 0x528], 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x344]
call fcn.100174a9
mov eax, dword [eax]
cmp eax, dword [ebp - 0x528]
je 0x1004d797
mov dword [ebp - 0x794], 1
jmp 0x1004d79e
and dword [ebp - 0x794], 0
cmp dword [ebp - 0x794], 0xffffffff
jge 0x1004d7b3
mov dword [ebp - 0x530], 1
jmp 0x1004d7ba
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x870], eax
jmp 0x1004d636
jmp 0x1004d47c
jmp 0x1004d3bf
mov dword [ebp - 0x40], 0xffffffe6
jmp 0x1004d7e5
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffed
jl 0x1004d97b
mov dword [ebp - 0x1e4], 0xf46a
mov dword [ebp - 0x698], 0xb70f7348
mov dword [ebp - 0x974], 0xfffffffb
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x370]
mov dword [ebp - 0xd74], eax
cmp dword [ebp - 0x2c], 0
jne 0x1004d85d
push 0
lea ecx, [ebp - 0x824]
call fcn.100174a9
cmp dword [eax], 0
jne 0x1004d85d
push 0
lea ecx, [ebp - 0x824]
call fcn.100174a9
mov dword [eax], 0xfa6f
mov eax, 0xfa6f
test eax, eax
jne 0x1004d85d
and dword [ebp - 0x690], 0
jmp 0x1004d867
mov dword [ebp - 0x690], 1
cmp dword [ebp - 0x690], 1
jge 0x1004d87c
mov dword [ebp - 0x538], 1
jmp 0x1004d883
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x538], eax
jg 0x1004d89e
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x370], 0
je 0x1004d8a7
cmp dword [ebp - 0x1e4], 0
jne 0x1004d8b9
mov eax, 0x6179
test eax, eax
jne 0x1004d8b9
and dword [ebp - 0x740], 0
jmp 0x1004d8c3
mov dword [ebp - 0x740], 1
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x740]
add eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1e4], eax
jne 0x1004d8ea
mov eax, 0x224c
test eax, eax
jne 0x1004d8ea
and dword [ebp - 0x540], 0
jmp 0x1004d8f4
mov dword [ebp - 0x540], 1
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0x698], eax
cmp dword [ebp - 0x698], 0xfffa
jbe 0x1004d918
mov dword [ebp - 0x548], 1
jmp 0x1004d91f
and dword [ebp - 0x548], 0
push 0
lea ecx, [ebp - 0x344]
call fcn.100174a9
mov ecx, dword [ebp - 0x548]
sub ecx, dword [eax]
mov dword [ebp - 0x7b4], ecx
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x7b4], eax
jl 0x1004d954
mov dword [ebp - 0x550], 1
jmp 0x1004d95b
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x1e4]
push 0
lea ecx, [ebp - 0x824]
call fcn.100174a9
mov eax, dword [eax]
mov dword [ebp - 0x974], eax
jmp 0x1004d7de
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x824]
call fcn.1001748d
jmp 0x1004d32d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x344]
call fcn.1001748d
push 0xf
push 5
call fcn.1004625f
pop ecx
pop ecx
add eax, dword [ebp - 0x6a0]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], eax
and dword [ebp - 0x138], 0
mov dword [ebp - 0x15c], 0xffffffff
push 2
lea ecx, [ebp - 0xb14]
call fcn.1001740b
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x878], 9
mov dword [ebp - 0x224], 0
jmp 0x1004d9fd
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 2
jge 0x1004da1f
push dword [ebp - 0x224]
lea ecx, [ebp - 0xb14]
call fcn.100174a9
mov dword [eax], 7
jmp 0x1004d9f0
mov byte [ebp - 0xb8], 0
movzx eax, byte [ebp - 0xb8]
test eax, eax
je 0x1004da39
push 1
call fcn.10049032
pop ecx
cmp dword [ebp - 0x15c], 0
je 0x1004daad
mov dword [ebp - 0x15c], 1
jmp 0x1004da5b
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
jl 0x1004daab
mov dword [ebp - 0x19c], 0x891f782a
mov dword [ebp - 0x19c], 1
jmp 0x1004da87
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jl 0x1004daa9
mov byte [ebp - 0xde], 0
lea eax, [ebp - 0xde]
push eax
push 1
call fcn.10049053
pop ecx
pop ecx
jmp 0x1004da7a
jmp 0x1004da4e
jmp 0x1004daca
push 0x5677
push 0
lea eax, [ebp - 0xb14]
push eax
lea eax, [ebp - 0x878]
push eax
call fcn.100494f3
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb14]
call fcn.1001748d
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x138]
push eax
push 1
call fcn.100490a8
add esp, 0xc
mov dword [ebp - 0x48], 0xfffffff6
mov dword [ebp - 0xfc], 0xfffffff9
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0xb60], 0xffffffff
mov dword [ebp - 0xb5c], 0xffffffff
mov dword [ebp - 0xb58], 0xffffffff
mov dword [ebp - 0xb54], 0xffffffff
mov dword [ebp - 0x598], 0xffffffff
push 4
lea ecx, [ebp - 0xb44]
call fcn.1001740b
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x880], 0xb06f8616
push 1
lea eax, [ebp - 0xd7c]
push eax
push 0x3a06
push 0x1165
lea eax, [ebp - 0xb44]
push eax
call fcn.10049119
add esp, 0x14
push 9
pop eax
test eax, eax
je 0x1004dc03
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0xfc], eax
jge 0x1004dba3
mov dword [ebp - 0x558], 1
jmp 0x1004dbaa
and dword [ebp - 0x558], 0
cmp dword [ebp - 0x558], 0xa907865e
jae 0x1004dbc2
mov dword [ebp - 0x748], 1
jmp 0x1004dbc9
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x748]
sub eax, 0x1255325e
cmp eax, dword [ebp - 0x48]
jg 0x1004dbe5
mov dword [ebp - 0x560], 1
jmp 0x1004dbec
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x560], eax
jle 0x1004dc03
mov dword [ebp - 0x6a8], 1
jmp 0x1004dc0a
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x6a8]
sub eax, 5
cmp dword [ebp - 0x48], eax
jl 0x1004dc24
mov dword [ebp - 0x568], 1
jmp 0x1004dc2b
and dword [ebp - 0x568], 0
cmp dword [ebp - 0x568], 0x95b
je 0x1004dc43
mov dword [ebp - 0x79c], 1
jmp 0x1004dc4a
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x79c], eax
je 0x1004dc61
mov dword [ebp - 0x570], 1
jmp 0x1004dc68
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x570]
dec eax
sub eax, dword [ebp - 0x48]
cmp eax, 8
jbe 0x1004dc7e
cmp dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xd84], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xd58], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xba8], eax
cmp dword [ebp - 0x7c], 0x2975a144
je 0x1004dcbd
mov dword [ebp - 0x6b0], 1
jmp 0x1004dcc4
and dword [ebp - 0x6b0], 0
cmp dword [ebp - 0x6b0], 4
ja 0x1004dcd9
mov dword [ebp - 0x578], 1
jmp 0x1004dce0
and dword [ebp - 0x578], 0
cmp dword [ebp - 0x578], 0x5771
jle 0x1004dcf8
mov dword [ebp - 0x750], 1
jmp 0x1004dcff
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x750], eax
je 0x1004dd16
mov dword [ebp - 0x9ec], 1
jmp 0x1004dd1d
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xb90], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x1004dd4d
cmp dword [ebp - 0xfc], 0
je 0x1004dd4d
cmp dword [ebp - 0x7c], 0
je 0x1004dd4d
mov dword [ebp - 0x580], 1
jmp 0x1004dd54
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x580]
sub eax, 0x7dd34c5d
mov ecx, 0xbcef
sub ecx, eax
jne 0x1004dd74
mov dword [ebp - 0x6b8], 1
jmp 0x1004dd7b
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x7c]
add eax, dword [ebp - 0x6b8]
jne 0x1004dd92
mov dword [ebp - 0x588], 1
jmp 0x1004dd99
and dword [ebp - 0x588], 0
cmp dword [ebp - 0x588], 1
jne 0x1004ddae
mov dword [ebp - 0x7d4], 1
jmp 0x1004ddb5
and dword [ebp - 0x7d4], 0
cmp dword [ebp - 0x7d4], 0xffffffff
jl 0x1004ddca
mov dword [ebp - 0x2e0], 1
jmp 0x1004ddd1
and dword [ebp - 0x2e0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2e0]
mov dword [ebp + eax - 0xb60], ecx
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x2e0], eax
jle 0x1004ddfb
mov dword [ebp - 0x590], 1
jmp 0x1004de02
and dword [ebp - 0x590], 0
cmp dword [ebp - 0x590], 0x19d6b80f
jg 0x1004de1a
mov dword [ebp - 0x6c0], 1
jmp 0x1004de21
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x6c0]
mov dword [ebp - 0x598], eax
mov esi, dword [ebp - 0x598]
add esi, dword [ebp - 0x7c]
add esi, dword [ebp - 0x7c]
push 2
lea ecx, [ebp - 0xb44]
call fcn.100174a9
sub esi, dword [eax]
mov dword [ebp - 0x880], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb44]
call fcn.1001748d
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1a0], 0x4fd3df75
mov dword [ebp - 0xd28], 0x57478144
mov dword [ebp - 0x1a0], 0
jmp 0x1004de93
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xa
jne 0x1004dee1
mov dword [ebp - 0x198], 1
mov dword [ebp - 0x198], 0
jmp 0x1004debf
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0xffffffec
je 0x1004dedf
mov dword [ebp - 0x97c], 0xffffffff
cmp dword [ebp - 0x97c], 0
je 0x1004dedd
jmp 0x1004dedf
jmp 0x1004deb2
jmp 0x1004de86
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
sub eax, dword [ebp - 0x138]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x1b0], 0xfffffff9
mov dword [ebp - 0x320], 0xae5a60d0
mov dword [ebp - 0xb98], 0x7f37c04c
mov dword [ebp - 0xa50], 4
mov dword [ebp - 0xc7c], 8
mov dword [ebp - 0x358], 0xffffffff
push 4
lea ecx, [ebp - 0xa84]
call fcn.1001740b
mov dword [ebp - 4], 0xd
mov dword [ebp - 0xba4], 1
mov dword [ebp - 0x5a8], 0
mov dword [ebp - 0x888], 0x5fb26c4f
mov dword [ebp - 0x2e8], 0xbff5ecce
mov dword [ebp - 0x84], 0
jmp 0x1004df84
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x1004dfa6
push dword [ebp - 0x84]
lea ecx, [ebp - 0xa84]
call fcn.100174a9
mov dword [eax], 0xb4e94f93
jmp 0x1004df77
mov dword [ebp - 0x84], 0
jmp 0x1004dfbf
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x1004dfdb
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x80c], 0x992db756
jmp 0x1004dfb2
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x1b0]
dec ecx
mov dword [ebp - 0x1b0], ecx
test eax, eax
je 0x1004e0ed
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x358]
mov dword [ebp + eax - 0x80c], ecx
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x80c], 0
je 0x1004e067
mov eax, dword [ebp - 0x1b0]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x80c]
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x5a8]
cmp dword [ebp - 0x358], eax
jle 0x1004e052
push 1
lea ecx, [ebp - 0xa84]
call fcn.100174a9
cmp dword [eax], 0
je 0x1004e067
cmp dword [ebp - 0x320], 0
je 0x1004e067
mov dword [ebp - 0x758], 1
jmp 0x1004e06e
and dword [ebp - 0x758], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x80c]
cmp eax, dword [ebp - 0x758]
jl 0x1004e08f
mov dword [ebp - 0x5a0], 1
jmp 0x1004e096
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x2e8]
dec eax
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2e8]
mov ecx, dword [ebp - 0x888]
add ecx, dword [ebp - 0x5a0]
add eax, ecx
cmp eax, 0x22f8
jge 0x1004e0ca
mov dword [ebp - 0x6c8], 1
jmp 0x1004e0d1
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0xa50], eax
xor eax, eax
je 0x1004e0ed
mov dword [ebp - 0x890], 1
jmp 0x1004e0f4
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0xd24], eax
mov eax, dword [ebp - 0x5a8]
mov dword [ebp - 0xbac], eax
mov esi, dword [ebp - 0x320]
push 0
lea ecx, [ebp - 0xa84]
call fcn.100174a9
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa84]
call fcn.1001748d
and dword [ebp - 0x14c], 0
jmp 0x1004e146
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0xf8]
jge 0x1004e1db
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
sub eax, dword [ecx + 0x18]
cmp dword [ebp - 0x14c], eax
jae 0x1004e189
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x30]
add ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14c]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x764], eax
jmp 0x1004e1a1
lea eax, [ebp - 0x108]
push eax
push 1
lea eax, [ebp - 0x764]
push eax
call fcn.100491bd
add esp, 0xc
push 0
push 0x7da3
lea eax, [ebp - 0x30]
push eax
push 0x639b
lea eax, [ebp - 0x764]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4ce2
call fcn.1004a450
add esp, 0x20
mov eax, dword [ebp - 0x10]
add eax, 4
mov dword [ebp - 0x10], eax
jmp 0x1004e139
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0xc84], 0xfffffff8
mov dword [ebp - 0xbb4], 0x97a888ad
mov dword [ebp - 0xd2c], 0xffffffff
mov dword [ebp - 0x1b8], 0xf
jmp 0x1004e21c
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 5
jg 0x1004e265
mov dword [ebp - 0x5b0], 0xb5a5efa2
mov eax, dword [ebp - 0x5b0]
dec eax
mov dword [ebp - 0x5b0], eax
mov byte [ebp - 0xbd], 0
lea eax, [ebp - 0xbd]
push eax
push 0x461f
push 0x4012
push 0x7735
push 0
call fcn.100496f4
add esp, 0x14
jmp 0x1004e20f
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x138]
push eax
push 0x7615
call fcn.100499a6
add esp, 0x10
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
sub eax, dword [ebp - 0x138]
mov dword [ebp - 0xf8], eax
and dword [ebp - 0x2f0], 0
jmp 0x1004e2a7
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x2f0]
cmp eax, dword [ebp - 0xf8]
jge 0x1004e2f9
push 0x4f23
push 0x6946
push 0x67b7
push 0
push 0x23b9
lea eax, [ebp - 0x30]
push eax
push 0x46cf
lea eax, [ebp - 0x28]
push eax
push 0x56b8
lea eax, [ebp - 0x10]
push eax
push 0x55a5
call fcn.10049ada
add esp, 0x2c
mov eax, dword [ebp - 0x10]
add eax, 4
mov dword [ebp - 0x10], eax
jmp 0x1004e29a
or dword [ebp - 0xac8], 0xffffffff
or dword [ebp - 0xac4], 0xffffffff
or dword [ebp - 0xac0], 0xffffffff
or dword [ebp - 0xabc], 0xffffffff
lea ecx, [ebp - 0x2f1]
call fcn.10008b33
push eax
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0xac8]
push eax
lea ecx, [ebp - 0xe08]
call fcn.100174b8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7f8]
call fcn.10017467
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x984], 0xfffffffb
mov dword [ebp - 0x98c], 0x7f95e19f
push 0
lea ecx, [ebp - 0x7f8]
call fcn.100174a9
and dword [eax], 0
jmp 0x1004e39b
push 0
lea ecx, [ebp - 0x7f8]
call fcn.100174a9
mov dword [ebp - 0x6d0], eax
mov eax, dword [ebp - 0x6d0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x6d0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x7f8]
call fcn.100174a9
cmp dword [eax], 0xffffffeb
jg 0x1004e655
mov dword [ebp - 0x104], 0xbd7b1c2a
mov dword [ebp - 0x390], 0xffffffff
mov dword [ebp - 0x39c], 0xfffffffa
mov dword [ebp - 0xb70], 0xffffffff
mov dword [ebp - 0xb6c], 0xffffffff
mov dword [ebp - 0xb68], 0xffffffff
mov dword [ebp - 0xb64], 0xffffffff
mov dword [ebp - 0x104], 0xfffffff6
jmp 0x1004e410
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x19
jle 0x1004e62e
mov dword [ebp - 0x348], 0
mov dword [ebp - 0xd4], 0xfffffff6
mov dword [ebp - 0x8a8], 0
cmp dword [ebp - 0x104], 0
je 0x1004e449
jmp 0x1004e62e
push 0
lea ecx, [ebp - 0x7f8]
call fcn.100174a9
cmp dword [eax], 0
jne 0x1004e476
push 3
lea ecx, [ebp - 0x7f8]
call fcn.100174a9
cmp dword [eax], 0
jne 0x1004e476
and dword [ebp - 0x3ac], 0
jmp 0x1004e480
mov dword [ebp - 0x3ac], 1
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x984], eax
je 0x1004e49a
mov dword [ebp - 0x5b8], 1
jmp 0x1004e4a1
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5b8]
add eax, 0xd8d9
jne 0x1004e4c0
cmp dword [ebp - 0xd4], 0
jne 0x1004e4c0
and dword [ebp - 0x760], 0
jmp 0x1004e4ca
mov dword [ebp - 0x760], 1
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x390], eax
imul eax, dword [ebp - 0x348], 0x9481
mov dword [ebp - 0x898], eax
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x9fc], eax
mov eax, dword [ebp - 0x348]
dec eax
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x898]
cmp eax, dword [ebp - 0x9fc]
jle 0x1004e519
mov dword [ebp - 0x8a0], 1
jmp 0x1004e520
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0xbbc], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xc8c], eax
or eax, 0xffffffff
add eax, 0x6b5a7dd9
imul eax, eax, 0x21ad
cmp eax, 0x966896e6
jae 0x1004e559
mov dword [ebp - 0x394], 1
jmp 0x1004e560
and dword [ebp - 0x394], 0
push 0
lea ecx, [ebp - 0x7f8]
call fcn.100174a9
mov ecx, dword [ebp - 0x394]
imul ecx, dword [eax]
add ecx, dword [ebp - 0x39c]
je 0x1004e593
cmp dword [ebp - 0xd4], 0
je 0x1004e593
mov dword [ebp - 0x3a4], 1
jmp 0x1004e59a
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x98c]
imul eax, dword [ebp - 0x3a4]
add eax, dword [ebp - 0x104]
cmp dword [ebp - 0x3ac], eax
jge 0x1004e5c1
mov dword [ebp - 0x3b4], 1
jmp 0x1004e5c8
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x3b4], eax
jle 0x1004e5e2
mov dword [ebp - 0x3bc], 1
jmp 0x1004e5e9
and dword [ebp - 0x3bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb70]
cmp dword [ebp - 0x3bc], eax
je 0x1004e60a
mov dword [ebp - 0x3c4], 1
jmp 0x1004e611
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x8a8], eax
jmp 0x1004e403
mov byte [ebp - 0xe0], 0
push 0
push 0x1163
lea eax, [ebp - 0xe0]
push eax
push 0x4fc2
call fcn.1004a256
add esp, 0x10
jmp 0x1004e377
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7f8]
call fcn.1001748d
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xf8]
push eax
push 1
call fcn.1004922b
add esp, 0x10
mov dword [ebp - 0x8c], 0xa439beb0
mov dword [ebp - 0x2f8], 0xa124
push 2
lea ecx, [ebp - 0xa78]
call fcn.1001740b
mov dword [ebp - 4], 0xf
mov dword [ebp - 0xbc4], 5
mov dword [ebp - 0xa54], 0x634d71b3
mov dword [ebp - 0x16c], 0
jmp 0x1004e6d2
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 2
jge 0x1004e6ee
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0xaa0], 0x8bbca631
jmp 0x1004e6c5
push 1
push 0x567
lea eax, [ebp - 0xa78]
push eax
push 0x3eb
lea eax, [ebp - 0x16c]
push eax
call fcn.10049295
add esp, 0x14
mov dword [ebp - 0x8c], 1
jmp 0x1004e729
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jl 0x1004e81c
mov dword [ebp - 0x12c], 0x4cdb8faa
mov dword [ebp - 0xd34], 0xffffffff
mov dword [ebp - 0xbcc], 0xa18e418a
push 1
lea ecx, [ebp - 0xb38]
call fcn.1001740b
mov byte [ebp - 4], 0x10
push 0x6bd
lea eax, [ebp - 0xb38]
push eax
push 1
lea eax, [ebp - 0xc94]
push eax
call fcn.1004933c
add esp, 0x10
mov dword [ebp - 0x12c], 1
jmp 0x1004e79b
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jl 0x1004e7cb
mov dword [ebp - 0xbd4], 0x9edbda7f
push 0
push 0x7d33
lea eax, [ebp - 0x2f8]
push eax
push 0x1d5a
call fcn.1004961d
add esp, 0x10
jmp 0x1004e78e
mov esi, dword [ebp - 0x12c]
push 0
lea ecx, [ebp - 0xb38]
call fcn.100174a9
cmp esi, dword [eax]
jg 0x1004e7ee
mov dword [ebp - 0x3cc], 1
jmp 0x1004e7f5
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x3cc]
mov dword [ebp + eax*4 - 0xaa0], ecx
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xb38]
call fcn.1001748d
jmp 0x1004e71c
cmp dword [ebp - 0x2f8], 0
jne 0x1004e837
cmp dword [ebp - 0x8c], 1
ja 0x1004e837
and dword [ebp - 0x3e4], 0
jmp 0x1004e841
mov dword [ebp - 0x3e4], 1
mov eax, dword [ebp - 0x2f8]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xaa0]
lea esi, [eax + ecx + 9]
push 0
lea ecx, [ebp - 0xa78]
call fcn.100174a9
cmp esi, dword [eax]
jne 0x1004e875
mov dword [ebp - 0x3d4], 1
jmp 0x1004e87c
and dword [ebp - 0x3d4], 0
cmp dword [ebp - 0x3d4], 0x799040c3
jl 0x1004e894
mov dword [ebp - 0x3dc], 1
jmp 0x1004e89b
and dword [ebp - 0x3dc], 0
push 0
lea ecx, [ebp - 0xa78]
call fcn.100174a9
mov ecx, dword [ebp - 0x3dc]
cmp ecx, dword [eax]
jg 0x1004e8be
mov dword [ebp - 0x3ec], 1
jmp 0x1004e8c5
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x8c]
imul eax, dword [ebp - 0x3e4]
cmp eax, dword [ebp - 0x3ec]
jne 0x1004e8e6
mov dword [ebp - 0x3f4], 1
jmp 0x1004e8ed
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
je 0x1004e941
mov dword [ebp - 0x3fc], 0xebf3b8cf
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x1004e932
push 1
push 0x18b3
push 0x6928
call fcn.100493ca
add esp, 0xc
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
jmp 0x1004e9b9
mov dword [ebp - 0xd30], 0xe80a7c6d
push 4
lea ecx, [ebp - 0xcc0]
call fcn.1001740b
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x1c0], 0
jmp 0x1004e975
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 4
jge 0x1004e994
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0xcc0]
call fcn.100174a9
and dword [eax], 0
jmp 0x1004e968
lea eax, [ebp - 0xa54]
push eax
push 0x1265
push 1
call fcn.10049433
add esp, 0xc
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xcc0]
call fcn.1001748d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa78]
call fcn.1001748d
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
sub eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x18], eax
mov dword [ebp - 0x24], 0x3d06
push 3
lea ecx, [ebp - 0xb2c]
call fcn.1001740b
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x8b8], 0x5156be82
mov dword [ebp - 0x4a4], 0
push 0
push 0x5cbf
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xb2c]
push eax
call fcn.1004a3dd
add esp, 0x10
mov dword [ebp - 0x64], 0
jmp 0x1004ea33
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x1004ea49
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x378], 0xfffb
jmp 0x1004ea2c
mov dword [ebp - 0x64], 0
jmp 0x1004ea59
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1004ea6f
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xd9c], 0
jmp 0x1004ea52
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
je 0x1004edd6
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0xb80], 0x8d72a67f
mov dword [ebp - 0xb7c], 0x8d72a67f
mov dword [ebp - 0xb78], 0x8d72a67f
mov dword [ebp - 0xb74], 0x8d72a67f
mov dword [ebp - 0x8c0], 0xfffffff7
mov dword [ebp - 0x1c8], 0
jmp 0x1004ead1
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jge 0x1004eaed
mov eax, dword [ebp - 0x1c8]
mov dword [ebp + eax*4 - 0xa90], 5
jmp 0x1004eac4
mov dword [ebp - 0x24], 0
jmp 0x1004eafd
cmp dword [ebp - 0x24], 2
jg 0x1004edaf
mov dword [ebp - 0xa0c], 0x900fdb69
mov dword [ebp - 0x328], 0x56370016
mov dword [ebp - 0x43c], 0x4caa8e55
push 2
lea ecx, [ebp - 0xcd0]
call fcn.1001740b
mov byte [ebp - 4], 0x13
push 1
lea eax, [ebp - 0xbdc]
push eax
lea eax, [ebp - 0xcd0]
push eax
call fcn.10049482
add esp, 0xc
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xa90]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x378]
mov dword [ebp - 0x8b0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x378]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x378], eax
cmp dword [ebp - 0x8b0], 0
jne 0x1004eb9b
mov byte [ebp - 0xe2], 0
lea eax, [ebp - 0xe2]
push eax
push 1
push 0x90a
push 0x3002
call fcn.100494f3
add esp, 0x10
jmp 0x1004efad
mov dword [ebp - 0xf0], 0xa10b913a
mov dword [ebp - 0x90c], 0xd528
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xbec], eax
mov eax, dword [ebp - 0xf0]
add eax, 0xf07
jne 0x1004ee10
push 3
pop eax
test eax, eax
jne 0x1004ee10
and dword [ebp - 0x474], 0
jmp 0x1004ee1a
mov dword [ebp - 0x474], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x378]
cmp dword [ebp - 0x474], eax
jne 0x1004ee3b
mov dword [ebp - 0x99c], 1
jmp 0x1004ee42
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xca4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x378]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x378]
cmp eax, dword [ebp - 0x24]
jne 0x1004ee7a
mov dword [ebp - 0x47c], 1
jmp 0x1004ee81
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0xf0]
add eax, dword [ebp - 0x47c]
imul eax, eax, 0x2ef7
cmp eax, dword [ebp - 0x4a4]
je 0x1004eea7
mov dword [ebp - 0x484], 1
jmp 0x1004eeae
and dword [ebp - 0x484], 0
push 1
lea ecx, [ebp - 0xb2c]
call fcn.100174a9
mov ecx, dword [ebp - 0x484]
cmp ecx, dword [eax]
je 0x1004eed1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x88c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x894], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x89c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x8ac], eax
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0x8cc], eax
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0x8bc], eax
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0x8b4], eax
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x8c4], eax
mov eax, dword [ebp - 0x8ac]
mov dword [ebp - 0x8d4], eax
mov eax, dword [ebp - 0x8b4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x8bc]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x8c4]
mov eax, dword [eax]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x8cc]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x8d4]
mov edx, dword [edx]
mov dword [ecx + eax], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret