Function at 0x440ea0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x49b7fa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x52c
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 4
push 0x4aed28
lea ecx, [esp + 0x4c]
mov dword [esp + 0x1c], esi
call fcn.0046ebc0
xor ebx, ebx
push 6
push 0x4aed20
lea ecx, [esp + 0x34]
mov dword [esp + 0x54c], ebx
call fcn.0046ebc0
push 5
push 0x4aed18
lea ecx, [esp + 0x54]
mov byte [esp + 0x54c], 1
call fcn.0046ebc0
push 5
push 0x4aed10
lea ecx, [esp + 0x40]
mov byte [esp + 0x54c], 2
call fcn.0046ebc0
push 5
push 0x4aed08
lea ecx, [esp + 0x44]
mov byte [esp + 0x54c], 3
call fcn.0046ebc0
push 5
push 0x4aed00
lea ecx, [esp + 0x3c]
mov byte [esp + 0x54c], 4
call fcn.0046ebc0
push 5
push 0x4aecf8
lea ecx, [esp + 0x48]
mov byte [esp + 0x54c], 5
call fcn.0046ebc0
push 5
push 0x4aecf0
lea ecx, [esp + 0x50]
mov byte [esp + 0x54c], 6
call fcn.0046ebc0
push 5
push 0x4aece8
lea ecx, [esp + 0x58]
mov byte [esp + 0x54c], 7
call fcn.0046ebc0
push 4
push 0x4aece0
lea ecx, [esp + 0x38]
mov byte [esp + 0x54c], 8
call fcn.0046ebc0
push ebx
push 1
push ecx
mov byte [esp + 0x550], 9
mov ecx, esp
mov dword [esp + 0x60], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0xa
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x4aecd0
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0xb
mov ecx, esp
mov dword [esp + 0x64], esp
push 6
push 0x4aecc0
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0x4b63c8
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
push 0x4b63c8
push ecx
lea edx, [esp + 0x4c]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
cmp ax, 1
jl 0x443d93
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 2
push 0x4aecbc
call fcn.0046ebc0
push ecx
mov byte [esp + 0x54c], 0xc
mov ecx, esp
mov dword [esp + 0x5c], esp
push 6
push 0x4aecb4
call fcn.0046ebc0
mov ecx, esi
mov byte [esp + 0x54c], 9
call fcn.00440960
cmp ax, bx
je 0x443d93
push 0x4b63c8
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
cmp ax, 1
jl 0x443d0d
mov ecx, dword [0x4b63cc]
call fcn.0046efe0
cmp ax, 4
jl 0x443d0d
mov esi, dword [0x4b63cc]
push 2
lea ecx, [esp + 0x30]
call fcn.0046ee40
mov dl, al
push 1
mov ecx, esi
mov byte [esp + 0x1f], dl
call fcn.0046ee40
mov cl, byte [esp + 0x1b]
cmp al, cl
jne 0x443d0d
mov esi, dword [0x4b63cc]
push 3
lea ecx, [esp + 0x30]
call fcn.0046ee40
mov dl, al
push 2
mov ecx, esi
mov byte [esp + 0x1f], dl
call fcn.0046ee40
mov dl, byte [esp + 0x1b]
cmp al, dl
jne 0x443d0d
mov esi, dword [0x4b63cc]
push 4
lea ecx, [esp + 0x30]
call fcn.0046ee40
mov dl, al
push 3
mov ecx, esi
mov byte [esp + 0x1f], dl
call fcn.0046ee40
mov cl, byte [esp + 0x1b]
cmp al, cl
jne 0x443d0d
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0xf
mov ecx, esp
mov dword [esp + 0x64], esp
push 6
push 0x4aecac
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x10
mov ecx, esp
mov dword [esp + 0x64], esp
push 6
push 0x4aeca4
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x11
mov ecx, esp
mov dword [esp + 0x64], esp
push 6
push 0x4aec9c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x12
mov ecx, esp
mov dword [esp + 0x64], esp
push 6
push 0x4aec94
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4b63c8
push ecx
mov ecx, esp
lea edx, [esp + 0x54]
mov dword [esp + 0x18], esp
push edx
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
push ebx
push 1
push ecx
cmp ax, 1
mov ecx, esp
jge 0x44121d
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x13
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aec84
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x14
mov ecx, esp
mov dword [esp + 0x24], esp
jmp 0x443d75
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x15
mov ecx, esp
mov dword [esp + 0x64], esp
push 6
push 0x4aec7c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x16
mov ecx, esp
mov dword [esp + 0x64], esp
push 6
push 0x4aec74
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
mov al, byte [esp + 0x1b]
mov dword [esp + 0x20], ebx
mov byte [esp + 0x1c], al
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov cl, byte [esp + 0x1b]
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x58], cl
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
push ecx
mov byte [esp + 0x548], 0x18
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x4aec6c
mov byte [esp + 0x27], 0
call fcn.0046ebc0
lea edx, [esp + 0x80]
push edx
call fcn.00470800
add esp, 8
mov ecx, dword [0x4a0148]
mov byte [esp + 0x544], 0x19
push ecx
push ebx
push eax
lea ecx, [esp + 0x28]
call fcn.0040a8e0
mov eax, dword [esp + 0x80]
mov byte [esp + 0x544], 0x18
cmp eax, ebx
je 0x44133f
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x441336
cmp al, 0xff
je 0x441336
dec al
mov byte [ecx], al
jmp 0x44133f
push ecx
call fcn.0048d500
add esp, 4
mov edi, 0x4aec68
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x84], ebx
mov ebp, ecx
lea ecx, [esp + 0x5c]
push ebp
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
call fcn.0040aba0
test al, al
je 0x44139a
mov edi, dword [esp + 0x5c]
mov ecx, ebp
mov edx, ecx
mov esi, 0x4aec68
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x60], ebp
mov byte [eax + ebp], 0
lea ecx, [esp + 0x58]
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x70]
push edx
push eax
call fcn.0044b320
add esp, 0xc
mov ecx, dword [0x4a0148]
mov byte [esp + 0x544], 0x1a
push ecx
push ebx
push eax
lea ecx, [esp + 0x28]
call fcn.0040a8e0
mov eax, dword [esp + 0x70]
mov byte [esp + 0x544], 0x18
cmp eax, ebx
je 0x4413f8
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x4413ef
cmp al, 0xff
je 0x4413ef
dec al
mov byte [ecx], al
jmp 0x4413f8
push ecx
call fcn.0048d500
add esp, 4
push 0x4b63c8
push ecx
lea edx, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
cmp ax, 1
jl 0x44256a
mov ecx, dword [0x4b63cc]
call fcn.0046efe0
cmp ax, 4
jge 0x44144a
xor edx, edx
jmp 0x4414b1
mov ecx, dword [0x4b63cc]
push 3
call fcn.0046ee40
cmp al, 0x10
jb 0x441525
mov ecx, dword [0x4b63cc]
push 3
call fcn.0046ee40
cmp al, 0x4a
ja 0x441525
mov ecx, dword [0x4b63cc]
push 3
call fcn.0046ee40
and eax, 0xff
sub eax, 0x10
mov ecx, eax
mov eax, 0x38e38e39
lea ecx, [ecx + ecx*4]
shl ecx, 1
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp dx, 0x19
jl 0x4414b1
cmp dx, 0x37
jg 0x4414b1
mov byte [esp + 0x1b], 1
movsx ecx, dx
push ecx
lea edx, [esp + 0xb0]
push 0x4aec64
push edx
call fcn.0048dfde
lea eax, [esp + 0xb8]
lea ecx, [esp + 0x28]
push eax
lea edx, [esp + 0x100]
push ecx
push edx
call fcn.0044b450
add esp, 0x18
mov ecx, dword [0x4a0148]
mov byte [esp + 0x544], 0x1d
push ecx
push ebx
push eax
lea ecx, [esp + 0x28]
call fcn.0040a8e0
mov eax, dword [esp + 0xf4]
mov byte [esp + 0x544], 0x18
cmp eax, ebx
je 0x44154a
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x441541
cmp al, 0xff
je 0x441541
dec al
mov byte [ecx], al
jmp 0x44154a
mov ecx, dword [0x4b63cc]
push 3
call fcn.0046ee40
cmp al, 0x10
sbb edx, edx
and edx, 0xffffffbf
add edx, 0x41
jmp 0x4414b1
push ecx
call fcn.0048d500
add esp, 4
push ecx
mov dword [esp + 0xf8], ebx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x4aec5c
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
call fcn.0046ebc0
lea edx, [esp + 0xe4]
push edx
call fcn.00470800
add esp, 8
mov edi, eax
mov ecx, dword [0x4a0148]
mov eax, dword [edi + 8]
mov esi, ecx
mov byte [esp + 0x544], 0x1e
cmp eax, esi
jae 0x44159d
mov esi, eax
sub ecx, dword [esp + 0x24]
cmp ecx, esi
ja 0x4415aa
call fcn.0048d50b
cmp esi, ebx
jbe 0x4415f9
mov eax, dword [esp + 0x24]
push ebx
lea ecx, [esp + 0x20]
lea ebp, [esi + eax]
push ebp
call fcn.0040aba0
test al, al
je 0x4415f9
mov eax, dword [edi + 4]
cmp eax, ebx
jne 0x4415d0
mov eax, 0x4a014c
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea edi, [edx + ecx]
mov ecx, esi
mov esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x24], ebp
mov byte [ecx + ebp], 0
mov eax, dword [esp + 0xe4]
mov byte [esp + 0x544], 0x18
cmp eax, ebx
je 0x441629
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x441620
cmp al, 0xff
je 0x441620
dec al
mov byte [ecx], al
jmp 0x441629
push ecx
call fcn.0048d500
add esp, 4
mov edi, 0x4aec58
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x4a0148]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xe4], ebx
mov esi, ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
mov dword [esp + 0xe8], ebx
cmp edx, esi
mov dword [esp + 0xec], ebx
ja 0x441664
call fcn.0048d50b
cmp esi, ebx
jbe 0x4416aa
mov eax, dword [esp + 0x24]
push ebx
lea ecx, [esp + 0x20]
lea ebp, [esi + eax]
push ebp
call fcn.0040aba0
test al, al
je 0x4416aa
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea edi, [edx + ecx]
mov ecx, esi
mov eax, ecx
mov esi, 0x4aec58
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x24], ebp
mov byte [ecx + ebp], 0
mov edi, str.__25__55
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x24]
repne scasb al, byte es:[edi]
mov eax, dword [0x4a0148]
not ecx
dec ecx
sub eax, edx
mov esi, ecx
cmp eax, esi
ja 0x4416cf
call fcn.0048d50b
cmp esi, ebx
jbe 0x441715
mov edx, dword [esp + 0x24]
push ebx
lea ecx, [esp + 0x20]
lea ebp, [esi + edx]
push ebp
call fcn.0040aba0
test al, al
je 0x441715
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
lea edi, [ecx + eax]
mov ecx, esi
mov edx, ecx
mov esi, str.__25__55
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], ebp
mov byte [eax + ebp], 0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x4aec5c
call fcn.0046ebc0
lea ecx, [esp + 0x124]
push ecx
call fcn.00470800
add esp, 8
mov esi, eax
mov ecx, dword [0x4a0148]
mov eax, dword [esi + 8]
mov ebp, ecx
mov byte [esp + 0x544], 0x1f
cmp eax, ebp
jae 0x441753
mov ebp, eax
sub ecx, dword [esp + 0x24]
cmp ecx, ebp
ja 0x441760
call fcn.0048d50b
cmp ebp, ebx
jbe 0x4417ae
mov edx, dword [esp + 0x24]
push 0
lea ecx, [esp + 0x20]
lea ebx, [edx + ebp]
push ebx
call fcn.0040aba0
test al, al
je 0x4417ae
mov esi, dword [esi + 4]
test esi, esi
jne 0x441787
mov esi, 0x4a014c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
lea edi, [ecx + eax]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], ebx
mov byte [ebx + eax], 0
mov eax, dword [esp + 0x124]
mov byte [esp + 0x544], 0x18
test eax, eax
je 0x4417de
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x4417d5
cmp al, 0xff
je 0x4417d5
dec al
mov byte [ecx], al
jmp 0x4417de
push ecx
call fcn.0048d500
add esp, 4
mov edi, 0x4aec48
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x124], ebx
not ecx
dec ecx
mov dword [esp + 0x128], ebx
mov esi, ecx
mov ecx, dword [0x4a0148]
sub ecx, edx
mov dword [esp + 0x12c], ebx
cmp ecx, esi
ja 0x44181b
call fcn.0048d50b
cmp esi, ebx
jbe 0x441861
mov edx, dword [esp + 0x24]
push ebx
lea ecx, [esp + 0x20]
lea ebp, [esi + edx]
push ebp
call fcn.0040aba0
test al, al
je 0x441861
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
lea edi, [ecx + eax]
mov ecx, esi
mov edx, ecx
mov esi, 0x4aec48
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], ebp
mov byte [eax + ebp], 0
mov edi, 0x4ae470
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x24]
repne scasb al, byte es:[edi]
mov eax, dword [0x4a0148]
not ecx
dec ecx
sub eax, edx
mov esi, ecx
cmp eax, esi
ja 0x441886
call fcn.0048d50b
cmp esi, ebx
jbe 0x4418cc
mov ecx, dword [esp + 0x24]
push ebx
lea ebp, [esi + ecx]
lea ecx, [esp + 0x20]
push ebp
call fcn.0040aba0
test al, al
je 0x4418cc
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, esi
mov esi, 0x4ae470
lea edi, [eax + edx]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], ebp
mov byte [eax + ebp], 0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x4aec40
call fcn.0046ebc0
lea ecx, [esp + 0x114]
push ecx
call fcn.00470800
add esp, 8
mov esi, eax
mov ecx, dword [0x4a0148]
mov eax, dword [esi + 8]
mov ebp, ecx
mov byte [esp + 0x544], 0x20
cmp eax, ebp
jae 0x44190a
mov ebp, eax
sub ecx, dword [esp + 0x24]
cmp ecx, ebp
ja 0x441917
call fcn.0048d50b
cmp ebp, ebx
jbe 0x441965
mov edx, dword [esp + 0x24]
push 0
lea ecx, [esp + 0x20]
lea ebx, [edx + ebp]
push ebx
call fcn.0040aba0
test al, al
je 0x441965
mov esi, dword [esi + 4]
test esi, esi
jne 0x44193e
mov esi, 0x4a014c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
lea edi, [ecx + eax]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], ebx
mov byte [ebx + eax], 0
mov eax, dword [esp + 0x114]
xor ebx, ebx
cmp eax, ebx
mov byte [esp + 0x544], 0x18
je 0x441997
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x44198e
cmp al, 0xff
je 0x44198e
dec al
mov byte [ecx], al
jmp 0x441997
push ecx
call fcn.0048d500
add esp, 4
push 0x4b63c8
push ecx
lea edx, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
mov dword [esp + 0x128], ebx
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
cmp ax, 1
jl 0x44264c
mov ecx, dword [0x4b63cc]
call fcn.0046efe0
cmp ax, 5
jge 0x441ae5
xor ebp, ebp
mov byte [esp + 0x1b], 0
mov edi, 0x4aec68
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
mov ecx, dword [0x4a0148]
sub ecx, edx
cmp ecx, esi
ja 0x441a19
call fcn.0048d50b
cmp esi, ebx
jbe 0x441a60
mov edx, dword [esp + 0x24]
push 0
lea ecx, [esp + 0x20]
lea ebx, [esi + edx]
push ebx
call fcn.0040aba0
test al, al
je 0x441a60
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
lea edi, [ecx + eax]
mov ecx, esi
mov edx, ecx
mov esi, 0x4aec68
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], ebx
mov byte [ebx + eax], 0
movsx ecx, bp
push ecx
lea edx, [esp + 0xb0]
push 0x4aec64
push edx
call fcn.0048dfde
lea eax, [esp + 0xb8]
lea ecx, [esp + 0x28]
push eax
lea edx, [esp + 0x110]
push ecx
push edx
call fcn.0044b450
add esp, 0x18
mov ecx, dword [0x4a0148]
xor esi, esi
push ecx
push esi
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x550], 0x23
call fcn.0040a8e0
mov eax, dword [esp + 0x104]
mov byte [esp + 0x544], 0x18
cmp eax, esi
je 0x441b84
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x441b7b
cmp al, 0xff
je 0x441b7b
dec al
mov byte [ecx], al
jmp 0x441b84
mov ecx, dword [0x4b63cc]
push 4
call fcn.0046ee40
cmp al, 0x10
jb 0x441b5f
mov ecx, dword [0x4b63cc]
push 4
call fcn.0046ee40
cmp al, 0x6e
ja 0x441b5f
mov ecx, dword [0x4b63cc]
push 4
call fcn.0046ee40
and eax, 0xff
sub eax, 0x10
mov ecx, eax
mov eax, 0x38e38e39
lea ecx, [ecx + ecx*4]
shl ecx, 1
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov ebp, edx
cmp bp, 0x37
jl 0x4419ee
cmp bp, 0x5f
jg 0x4419ee
mov al, byte [esp + 0x1b]
test al, al
je 0x4419f3
mov byte [esp + 0x1b], 1
jmp 0x4419f3
mov ecx, dword [0x4b63cc]
push 4
call fcn.0046ee40
cmp al, 0x10
sbb ebp, ebp
and ebp, 0xffffff97
add ebp, 0x69
jmp 0x4419ee
push ecx
call fcn.0048d500
add esp, 4
push ecx
mov dword [esp + 0x108], esi
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x4aec5c
mov dword [esp + 0x114], esi
mov dword [esp + 0x118], esi
call fcn.0046ebc0
lea edx, [esp + 0xc4]
push edx
call fcn.00470800
add esp, 8
mov edi, eax
mov ecx, dword [0x4a0148]
mov eax, dword [edi + 8]
mov esi, ecx
mov byte [esp + 0x544], 0x24
cmp eax, esi
jae 0x441bd7
mov esi, eax
sub ecx, dword [esp + 0x24]
cmp ecx, esi
ja 0x441be4
call fcn.0048d50b
test esi, esi
jbe 0x441c36
mov eax, dword [esp + 0x24]
push 0
lea ecx, [esp + 0x20]
lea ebp, [esi + eax]
push ebp
call fcn.0040aba0
test al, al
je 0x441c36
mov edi, dword [edi + 4]
mov eax, 0x4a014c
test edi, edi
je 0x441c0d
mov eax, edi
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea edi, [edx + ecx]
mov ecx, esi
mov esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x24], ebp
mov byte [ecx + ebp], 0
mov eax, dword [esp + 0xc4]
mov byte [esp + 0x544], 0x18
test eax, eax
je 0x441c66
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x441c5d
cmp al, 0xff
je 0x441c5d
dec al
mov byte [ecx], al
jmp 0x441c66
push ecx
call fcn.0048d500
add esp, 4
mov edi, 0x4aec58
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
mov edx, dword [0x4a0148]
mov dword [esp + 0xc4], ebx
not ecx
dec ecx
mov dword [esp + 0xc8], ebx
mov esi, ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
mov dword [esp + 0xcc], ebx
cmp edx, esi
ja 0x441ca3
call fcn.0048d50b
cmp esi, ebx
jbe 0x441ce9
mov eax, dword [esp + 0x24]
push ebx
lea ecx, [esp + 0x20]
lea ebp, [esi + eax]
push ebp
call fcn.0040aba0
test al, al
je 0x441ce9
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea edi, [edx + ecx]
mov ecx, esi
mov eax, ecx
mov esi, 0x4aec58
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x24], ebp
mov byte [ecx + ebp], 0
mov edi, str.__55__95
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x24]
repne scasb al, byte es:[edi]
mov eax, dword [0x4a0148]
not ecx
dec ecx
sub eax, edx
mov esi, ecx
cmp eax, esi
ja 0x441d0e
call fcn.0048d50b
cmp esi, ebx
jbe 0x441d54
mov edx, dword [esp + 0x24]
push ebx
lea ecx, [esp + 0x20]
lea ebp, [esi + edx]
push ebp
call fcn.0040aba0
test al, al
je 0x441d54
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
lea edi, [ecx + eax]
mov ecx, esi
mov edx, ecx
mov esi, str.__55__95
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], ebp
mov byte [eax + ebp], 0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x4aec5c
call fcn.0046ebc0
lea ecx, [esp + 0xd4]
push ecx
call fcn.00470800
add esp, 8
mov esi, eax
mov ecx, dword [0x4a0148]
mov eax, dword [esi + 8]
mov ebp, ecx
mov byte [esp + 0x544], 0x25
cmp eax, ebp
jae 0x441d92
mov ebp, eax
sub ecx, dword [esp + 0x24]
cmp ecx, ebp
ja 0x441d9f
call fcn.0048d50b
cmp ebp, ebx
jbe 0x441ded
mov edx, dword [esp + 0x24]
push 0
lea ecx, [esp + 0x20]
lea ebx, [edx + ebp]
push ebx
call fcn.0040aba0
test al, al
je 0x441ded
mov esi, dword [esi + 4]
test esi, esi
jne 0x441dc6
mov esi, 0x4a014c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
lea edi, [ecx + eax]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], ebx
mov byte [ebx + eax], 0
mov eax, dword [esp + 0xd4]
mov byte [esp + 0x544], 0x18
test eax, eax
je 0x441e1d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x441e14
cmp al, 0xff
je 0x441e14
dec al
mov byte [ecx], al
jmp 0x441e1d
push ecx
call fcn.0048d500
add esp, 4
mov edi, 0x4aec48
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x24]
mov dword [esp + 0xd4], ebx
not ecx
dec ecx
mov dword [esp + 0xd8], ebx
mov esi, ecx
mov ecx, dword [0x4a0148]
sub ecx, edx
mov dword [esp + 0xdc], ebx
cmp ecx, esi
ja 0x441e5a
call fcn.0048d50b
cmp esi, ebx
jbe 0x441ea0
mov edx, dword [esp + 0x24]
push ebx
lea ecx, [esp + 0x20]
lea ebp, [esi + edx]
push ebp
call fcn.0040aba0
test al, al
je 0x441ea0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
lea edi, [ecx + eax]
mov ecx, esi
mov edx, ecx
mov esi, 0x4aec48
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], ebp
mov byte [eax + ebp], 0
mov edi, 0x4ae470
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x24]
repne scasb al, byte es:[edi]
mov eax, dword [0x4a0148]
not ecx
dec ecx
sub eax, edx
mov esi, ecx
cmp eax, esi
ja 0x441ec5
call fcn.0048d50b
cmp esi, ebx
jbe 0x441f0b
mov ecx, dword [esp + 0x24]
push ebx
lea ebp, [esi + ecx]
lea ecx, [esp + 0x20]
push ebp
call fcn.0040aba0
test al, al
je 0x441f0b
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, esi
mov esi, 0x4ae470
lea edi, [eax + edx]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], ebp
mov byte [eax + ebp], 0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x4aec2c
call fcn.0046ebc0
lea ecx, [esp + 0x90]
push ecx
call fcn.00470800
add esp, 8
mov esi, eax
mov ecx, dword [0x4a0148]
mov eax, dword [esi + 8]
mov ebp, ecx
mov byte [esp + 0x544], 0x26
cmp eax, ebp
jae 0x441f49
mov ebp, eax
sub ecx, dword [esp + 0x24]
cmp ecx, ebp
ja 0x441f56
call fcn.0048d50b
cmp ebp, ebx
jbe 0x441fa5
mov edx, dword [esp + 0x24]
xor edi, edi
push edi
lea ecx, [esp + 0x20]
lea ebx, [edx + ebp]
push ebx
call fcn.0040aba0
test al, al
je 0x441fa7
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x441f7e
mov esi, 0x4a014c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
lea edi, [ecx + eax]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], ebx
mov byte [ebx + eax], 0
xor edi, edi
mov eax, dword [esp + 0x90]
mov byte [esp + 0x544], 0x18
cmp eax, edi
je 0x441fd7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x441fce
cmp al, 0xff
je 0x441fce
dec al
mov byte [ecx], al
jmp 0x441fd7
push ecx
call fcn.0048d500
add esp, 4
push 0x4b63c8
push ecx
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov dword [esp + 0x9c], edi
mov dword [esp + 0xa0], edi
mov dword [esp + 0xa4], edi
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
cmp ax, 1
jl 0x442739
mov ecx, dword [0x4b63cc]
call fcn.0046efe0
cmp ax, 4
jl 0x44211a
mov ecx, dword [0x4b63cc]
push 3
mov esi, ecx
call fcn.0046ee40
mov bl, al
push 4
and ebx, 0xff
mov ecx, esi
shl ebx, 8
call fcn.0046ee40
and eax, 0xff
add ebx, eax
cmp ebx, 0x7d8
jle 0x44211a
mov ecx, dword [0x4b63cc]
push 3
mov esi, ecx
call fcn.0046ee40
mov bl, al
push 4
and ebx, 0xff
mov ecx, esi
shl ebx, 8
call fcn.0046ee40
and eax, 0xff
add ebx, eax
cmp ebx, 0x7d8
jl 0x442113
mov ecx, dword [0x4b63cc]
push 3
mov esi, ecx
call fcn.0046ee40
mov bl, al
push 4
and ebx, 0xff
mov ecx, esi
shl ebx, 8
call fcn.0046ee40
and eax, 0xff
add ebx, eax
cmp ebx, 0x12c8
jge 0x442113
mov ecx, dword [0x4b63cc]
push 3
mov esi, ecx
call fcn.0046ee40
mov bl, al
push 4
and ebx, 0xff
mov ecx, esi
shl ebx, 8
call fcn.0046ee40
and eax, 0xff
lea eax, [ebx + eax - 8]
cdq
and edx, 3
add eax, edx
sar eax, 2
cmp ax, 0x2bc
jl 0x44211f
cmp ax, 0x3e8
jg 0x44211f
mov bl, byte [esp + 0x1b]
test bl, bl
je 0x442121
mov bl, 1
jmp 0x442121
mov eax, 0x4b0
jmp 0x44211f
mov eax, 0x1f4
xor bl, bl
movsx eax, ax
push eax
lea ecx, [esp + 0xb0]
push 0x4aec28
push ecx
call fcn.0048dfde
mov edi, 0x4aec68
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [0x4a0148]
not ecx
dec ecx
mov esi, ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
cmp edx, esi
ja 0x442160
call fcn.0048d50b
test esi, esi
jbe 0x4421a7
mov eax, dword [esp + 0x24]
push 0
lea ecx, [esp + 0x20]
lea ebp, [eax + esi]
push ebp
call fcn.0040aba0
test al, al
je 0x4421a7
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea edi, [edx + ecx]
mov ecx, esi
mov eax, ecx
mov esi, 0x4aec68
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x24], ebp
mov byte [ecx + ebp], 0
lea edi, [esp + 0xac]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x24]
repne scasb al, byte es:[edi]
mov eax, dword [0x4a0148]
not ecx
dec ecx
sub eax, edx
mov esi, ecx
cmp eax, esi
ja 0x4421ce
call fcn.0048d50b
test esi, esi
jbe 0x442217
mov edx, dword [esp + 0x24]
push 0
lea ecx, [esp + 0x20]
lea ebp, [edx + esi]
push ebp
call fcn.0040aba0
test al, al
je 0x442217
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
lea edi, [ecx + eax]
mov ecx, esi
mov edx, ecx
lea esi, [esp + 0xac]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], ebp
mov byte [eax + ebp], 0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x4aec20
call fcn.0046ebc0
lea ecx, [esp + 0x134]
push ecx
call fcn.00470800
add esp, 8
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x548], 0x29
call fcn.0044b020
lea ecx, [esp + 0x130]
mov byte [esp + 0x544], 0x18
call fcn.0040a7b0
push str._700__1000
lea ecx, [esp + 0x20]
call fcn.0044b0f0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x4aec20
call fcn.0046ebc0
lea edx, [esp + 0x148]
push edx
call fcn.00470800
add esp, 8
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x548], 0x2a
call fcn.0044b020
lea ecx, [esp + 0x144]
mov byte [esp + 0x544], 0x18
call fcn.0040a7b0
push 0x4aec48
lea ecx, [esp + 0x20]
call fcn.0044b0f0
push 0x4ae470
lea ecx, [esp + 0x20]
call fcn.0044b0f0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x4aec0c
call fcn.0046ebc0
lea eax, [esp + 0xa0]
push eax
call fcn.00470800
add esp, 8
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x548], 0x2b
call fcn.0044b020
lea ecx, [esp + 0x9c]
mov byte [esp + 0x544], 0x18
call fcn.0040a7b0
push 0x4b63c8
push ecx
lea edx, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
cmp ax, 1
push 0
jl 0x442826
mov ecx, 0x4b63c8
call fcn.00401ba0
mov ecx, eax
call fcn.0046efe0
cmp ax, 4
jge 0x442418
xor edx, edx
xor bl, bl
movsx ecx, dx
push ecx
lea edx, [esp + 0xb0]
push 0x4aec64
push edx
call fcn.0048dfde
add esp, 0xc
lea ecx, [esp + 0x1c]
push 0x4aec68
call fcn.0044b0f0
lea eax, [esp + 0xac]
lea ecx, [esp + 0x1c]
push eax
call fcn.0044b0f0
push str._18__33_
lea ecx, [esp + 0x20]
call fcn.0044b0f0
test bl, bl
push 0
push 3
jne 0x4424e8
sub esp, 0x10
mov esi, esp
mov dword [esp + 0x28], esp
push ecx
mov ecx, esp
mov dword [esp + 0x70], esp
push 6
push 0x4aebf8
call fcn.0046ebc0
push esi
call fcn.00470800
sub esp, 8
lea edx, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x7c], esp
push edx
mov byte [esp + 0x570], 0x2e
call fcn.0040a690
mov ecx, 0x4b6448
mov byte [esp + 0x56c], 0x18
call fcn.00472ce0
cmp ax, 2
je 0x4428ac
jmp 0x442541
push 3
push 0
mov ecx, 0x4b63c8
call fcn.00401ba0
mov ecx, eax
call fcn.0046ee40
mov dl, al
push 4
and edx, 0xff
push 0
shl edx, 8
mov ecx, 0x4b63c8
mov dword [esp + 0x5c], edx
call fcn.00401ba0
mov ecx, eax
call fcn.0046ee40
mov ecx, dword [esp + 0x54]
and eax, 0xff
add ecx, eax
cmp ecx, 0xfa0
jg 0x4424de
push 3
push 0
mov ecx, 0x4b63c8
call fcn.00401ba0
mov ecx, eax
call fcn.0046ee40
mov dl, al
push 4
and edx, 0xff
push 0
shl edx, 8
mov ecx, 0x4b63c8
mov dword [esp + 0x5c], edx
call fcn.00401ba0
mov ecx, eax
call fcn.0046ee40
mov edx, dword [esp + 0x54]
and eax, 0xff
add edx, eax
mov eax, 0x51eb851f
mov ecx, edx
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp dx, 0x12
jl 0x442366
cmp dx, 0x21
jg 0x442366
test bl, bl
je 0x442368
mov bl, 1
jmp 0x442368
mov edx, 0x28
jmp 0x442366
sub esp, 0x10
mov esi, esp
mov dword [esp + 0x28], esp
push ecx
mov ecx, esp
mov dword [esp + 0x70], esp
push 6
push 0x4aebf8
call fcn.0046ebc0
push esi
call fcn.00470800
sub esp, 8
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x7c], esp
push eax
mov byte [esp + 0x570], 0x2f
call fcn.0040a690
mov ecx, 0x4b6448
mov byte [esp + 0x56c], 0x18
call fcn.00472ce0
cmp ax, 1
je 0x4428d3
lea ecx, [esp + 0x58]
mov byte [esp + 0x544], 0x17
call fcn.0040a7b0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x544], 9
call fcn.0040a7b0
xor ebx, ebx
jmp 0x44129d
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x1b
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 0x18
call fcn.00472d90
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aec84
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aebf0
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 0x18
call fcn.00472d90
mov eax, dword [esp + 0x5c]
cmp eax, ebx
je 0x442615
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x44260c
cmp al, 0xff
je 0x44260c
dec al
mov byte [ecx], al
jmp 0x442615
push ecx
call fcn.0048d500
add esp, 4
mov eax, dword [esp + 0x20]
mov dword [esp + 0x5c], ebx
cmp eax, ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
je 0x442728
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x44271f
cmp al, 0xff
je 0x44271f
dec al
mov byte [ecx], al
jmp 0x442728
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x21
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 0x18
call fcn.00472d90
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aec84
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x22
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aebf0
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 0x18
call fcn.00472d90
mov eax, dword [esp + 0x5c]
cmp eax, ebx
je 0x4426f7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x4426ee
cmp al, 0xff
je 0x4426ee
dec al
mov byte [ecx], al
jmp 0x4426f7
push ecx
call fcn.0048d500
add esp, 4
mov eax, dword [esp + 0x20]
mov dword [esp + 0x5c], ebx
cmp eax, ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
je 0x442728
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x44271f
cmp al, 0xff
je 0x44271f
dec al
mov byte [ecx], al
jmp 0x442728
push ecx
call fcn.0048d500
add esp, 4
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
jmp 0x443d93
push edi
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x27
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 0x18
call fcn.00472d90
push edi
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aec84
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x28
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aebf0
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 0x18
call fcn.00472d90
mov eax, dword [esp + 0x5c]
cmp eax, edi
je 0x4427e4
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x4427db
cmp al, 0xff
je 0x4427db
dec al
mov byte [ecx], al
jmp 0x4427e4
push ecx
call fcn.0048d500
add esp, 4
mov eax, dword [esp + 0x20]
mov dword [esp + 0x5c], edi
cmp eax, edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
je 0x442815
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x44280c
cmp al, 0xff
je 0x44280c
dec al
mov byte [ecx], al
jmp 0x442815
push ecx
call fcn.0048d500
add esp, 4
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
jmp 0x443d93
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x2c
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 0x18
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aec84
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x2d
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aebf0
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 0x18
call fcn.00472d90
lea ecx, [esp + 0x58]
mov byte [esp + 0x544], 0x17
call fcn.0040a7b0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x544], 9
call fcn.0040a7b0
jmp 0x443d93
lea ecx, [esp + 0x58]
mov byte [esp + 0x544], 0x17
call fcn.0040a7b0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x544], 9
call fcn.0040a7b0
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x30
mov ecx, esp
mov dword [esp + 0x64], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x31
mov ecx, esp
mov dword [esp + 0x64], esp
push 6
push 0x4aebe8
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x32
mov ecx, esp
mov dword [esp + 0x64], esp
push 6
push 0x4aecc0
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0x4b63c8
push ecx
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
push 0x4b63c8
push ecx
lea eax, [esp + 0x4c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
cmp ax, 1
jl 0x443d93
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 2
push 0x4aecbc
call fcn.0046ebc0
push ecx
mov byte [esp + 0x54c], 0x33
mov ecx, esp
mov dword [esp + 0x5c], esp
push 6
push 0x4aecb4
call fcn.0046ebc0
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x54c], 9
call fcn.00440960
test ax, ax
je 0x443d93
push 0x4b63c8
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
cmp ax, 1
jl 0x443ca1
push 0
mov ecx, 0x4b63c8
call fcn.00401ba0
mov ecx, eax
call fcn.0046efe0
cmp ax, 4
jl 0x443ca1
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x36
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x37
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aebe0
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call esi
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x38
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aecc0
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x39
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aebd8
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x3a
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec74
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0x4b63c8
push ecx
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
cmp ax, 1
jge 0x442c94
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x3b
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aec84
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x3c
mov ecx, esp
mov dword [esp + 0x24], esp
jmp 0x443d75
push 0x4b63c8
push ecx
lea edx, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
cmp ax, 1
jge 0x442d2a
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x3d
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aec84
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x3e
mov ecx, esp
mov dword [esp + 0x24], esp
jmp 0x443d75
push 0x4b63c8
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
cmp ax, 1
jge 0x442dc0
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x3f
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aec84
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x40
mov ecx, esp
mov dword [esp + 0x24], esp
jmp 0x443d75
push 0x4b63c8
push ecx
lea edx, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
push 0
push 1
push ecx
cmp ax, 1
mov ecx, esp
jge 0x442e56
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x41
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aec84
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x42
mov ecx, esp
mov dword [esp + 0x24], esp
jmp 0x443d75
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x43
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aebd0
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0x4b63c8
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
push 0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x44
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aebe0
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0x9c4
call esi
push 0x4b63c8
push ecx
lea edx, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
cmp ax, 1
push 0
jge 0x442f95
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x45
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aec84
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x46
mov ecx, esp
mov dword [esp + 0x24], esp
jmp 0x443d75
mov ecx, 0x4b63c8
call fcn.00401ba0
mov ecx, eax
call fcn.0046efe0
cmp ax, 4
jl 0x442fc9
push 3
push 0
mov ecx, 0x4b63c8
call fcn.00401ba0
mov ecx, eax
call fcn.0046ee40
cmp al, 1
je 0x443083
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x47
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x48
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aebc8
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x49
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aebc0
jmp 0x443bd4
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x4a
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x4b
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aebb8
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x4c
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aecc0
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x4d
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec74
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0x4b63c8
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
lea eax, [esp + 0x40]
push eax
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
cmp ax, 1
jge 0x443229
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x4e
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aec84
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x4f
mov ecx, esp
mov dword [esp + 0x24], esp
jmp 0x443d75
push 0x4b63c8
push ecx
lea edx, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
cmp ax, 1
jge 0x4432bf
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x50
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aec84
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x51
mov ecx, esp
mov dword [esp + 0x24], esp
jmp 0x443d75
push 0x4b63c8
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
cmp ax, 1
jge 0x443355
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x52
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aec84
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x53
mov ecx, esp
mov dword [esp + 0x24], esp
jmp 0x443d75
push 0x4b63c8
push ecx
lea edx, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
push 0
push 1
push ecx
cmp ax, 1
mov ecx, esp
jge 0x4433eb
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x54
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aec84
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x55
mov ecx, esp
mov dword [esp + 0x24], esp
jmp 0x443d75
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x56
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aebb0
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0x4b63c8
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
push 0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x57
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aebe0
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0x9c4
call esi
push 0x4b63c8
push ecx
lea edx, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
cmp ax, 1
push 0
jge 0x44352a
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x58
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aec84
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x59
mov ecx, esp
mov dword [esp + 0x24], esp
jmp 0x443d75
mov ecx, 0x4b63c8
call fcn.00401ba0
mov ecx, eax
call fcn.0046efe0
cmp ax, 4
jl 0x44355e
push 3
push 0
mov ecx, 0x4b63c8
call fcn.00401ba0
mov ecx, eax
call fcn.0046ee40
cmp al, 2
je 0x443b1f
lea eax, [esp + 0x1b]
lea ecx, [esp + 0x7c]
push eax
call fcn.0047f130
lea ecx, [esp + 0x6a]
mov byte [esp + 0x544], 0x5a
push ecx
lea ecx, [esp + 0x70]
call fcn.0047f130
lea edx, [esp + 0x6b]
lea ecx, [esp + 0x8c]
push edx
mov byte [esp + 0x548], 0x5b
call fcn.0047f130
push 0
push 1
push ecx
mov bl, 0x5c
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
mov byte [esp + 0x558], bl
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x5d
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], bl
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x5e
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aebc8
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], bl
call fcn.00472d90
xor esi, esi
push 0x4b63c8
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
push 0x4b63c8
push ecx
lea edx, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0046eb30
mov ecx, dword [0x4b63dc]
call fcn.004104a0
cmp ax, 1
jl 0x443a5e
inc esi
cmp esi, 2
jne 0x44362c
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x4aeba8
call fcn.0046ebc0
lea eax, [esp + 0xa0]
push eax
call fcn.00470800
add esp, 8
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0x548], 0x61
call fcn.0044ae30
lea ecx, [esp + 0x9c]
mov byte [esp + 0x544], bl
call fcn.0040a7b0
push 0
lea ecx, [esp + 0x134]
push str._02d
push ecx
call fcn.0048dfde
add esp, 0xc
lea edx, [esp + 0x130]
lea ecx, [esp + 0x7c]
push edx
call fcn.0044b0f0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x4aeb98
call fcn.0046ebc0
lea eax, [esp + 0xa0]
push eax
call fcn.00470800
add esp, 8
push eax
lea ecx, [esp + 0x70]
mov byte [esp + 0x548], 0x62
call fcn.0044ae30
lea ecx, [esp + 0x9c]
mov byte [esp + 0x544], bl
call fcn.0040a7b0
push 0
lea ecx, [esp + 0x70]
call fcn.0044b1c0
lea ecx, [esp + 0x158]
push eax
push ecx
call fcn.0048dfde
add esp, 0xc
lea edx, [esp + 0x154]
lea ecx, [esp + 0x8c]
push edx
call fcn.0044af70
lea eax, [esp + 0x7c]
push 0x4ae470
lea ecx, [esp + 0x148]
push eax
push ecx
call fcn.0044b450
lea edx, [esp + 0x98]
mov byte [esp + 0x550], 0x63
push edx
push eax
lea eax, [esp + 0xb0]
push eax
call fcn.0044b320
add esp, 0x18
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0x548], 0x64
call fcn.0044ae30
lea ecx, [esp + 0x9c]
mov byte [esp + 0x544], 0x63
call fcn.0040a7b0
lea ecx, [esp + 0x144]
mov byte [esp + 0x544], bl
call fcn.0040a7b0
push 0
push 1
sub esp, 0x10
mov esi, esp
mov dword [esp + 0x28], esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push esi
call fcn.00470800
sub esp, 8
lea edx, [esp + 0xa4]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
mov byte [esp + 0x570], 0x65
call fcn.0040a690
mov ecx, 0x4b6448
mov byte [esp + 0x56c], bl
call fcn.00472ce0
push 0
push 1
sub esp, 0x10
mov esi, esp
mov dword [esp + 0x28], esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push esi
call fcn.00470800
sub esp, 8
mov byte [esp + 0x56c], 0x66
mov esi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push 6
push 0x4aeb90
call fcn.0046ebc0
push esi
call fcn.00470800
add esp, 8
mov ecx, 0x4b6448
mov byte [esp + 0x56c], bl
call fcn.00472ce0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x4aeb88
call fcn.0046ebc0
lea eax, [esp + 0xa0]
push eax
call fcn.00470800
add esp, 8
push eax
lea ecx, [esp + 0x70]
mov byte [esp + 0x548], 0x67
call fcn.0044ae30
lea ecx, [esp + 0x9c]
mov byte [esp + 0x544], bl
call fcn.0040a7b0
push 0
lea ecx, [esp + 0x134]
push str._02d
push ecx
call fcn.0048dfde
add esp, 0xc
lea edx, [esp + 0x130]
lea ecx, [esp + 0x6c]
push edx
call fcn.0044b0f0
push 0
push 1
sub esp, 0x10
mov esi, esp
mov dword [esp + 0x28], esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push esi
call fcn.00470800
sub esp, 8
lea eax, [esp + 0x94]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
mov byte [esp + 0x570], 0x68
call fcn.0040a690
mov ecx, 0x4b6448
mov byte [esp + 0x56c], bl
call fcn.00472ce0
push 0
push 1
sub esp, 0x10
mov esi, esp
mov dword [esp + 0x28], esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push esi
call fcn.00470800
sub esp, 8
mov byte [esp + 0x56c], 0x69
mov esi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push 6
push 0x4aeb80
call fcn.0046ebc0
push esi
call fcn.00470800
add esp, 8
mov ecx, 0x4b6448
mov byte [esp + 0x56c], bl
call fcn.00472ce0
push 0
push 1
sub esp, 0x10
mov esi, esp
mov dword [esp + 0x28], esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push esi
call fcn.00470800
sub esp, 8
mov byte [esp + 0x56c], 0x6a
mov esi, esp
mov dword [esp + 0x3c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push 6
push 0x4aebc0
call fcn.0046ebc0
push esi
call fcn.00470800
add esp, 8
mov ecx, 0x4b6448
mov byte [esp + 0x56c], bl
call fcn.00472ce0
lea ecx, [esp + 0x8c]
mov byte [esp + 0x544], 0x5b
call fcn.0040a7b0
lea ecx, [esp + 0x6c]
mov byte [esp + 0x544], 0x5a
call fcn.0040a7b0
lea ecx, [esp + 0x7c]
mov byte [esp + 0x544], 9
call fcn.0040a7b0
jmp 0x443beb
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x5f
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], bl
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aec84
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x60
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aebf0
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], bl
call fcn.00472d90
lea ecx, [esp + 0x8c]
mov byte [esp + 0x544], 0x5b
call fcn.0040a7b0
lea ecx, [esp + 0x6c]
mov byte [esp + 0x544], 0x5a
call fcn.0040a7b0
lea ecx, [esp + 0x7c]
mov byte [esp + 0x544], 9
call fcn.0040a7b0
jmp 0x443d93
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x6b
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x6c
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aebb8
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecd8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x6d
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aeb78
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
lea ecx, [esp + 0x30]
mov byte [esp + 0x544], 8
call fcn.0046ec60
lea ecx, [esp + 0x50]
mov byte [esp + 0x544], 7
call fcn.0046ec60
lea ecx, [esp + 0x48]
mov byte [esp + 0x544], 6
call fcn.0046ec60
lea ecx, [esp + 0x40]
mov byte [esp + 0x544], 5
call fcn.0046ec60
lea ecx, [esp + 0x34]
mov byte [esp + 0x544], 4
call fcn.0046ec60
lea ecx, [esp + 0x3c]
mov byte [esp + 0x544], 3
call fcn.0046ec60
lea ecx, [esp + 0x38]
mov byte [esp + 0x544], 2
call fcn.0046ec60
lea ecx, [esp + 0x4c]
mov byte [esp + 0x544], 1
call fcn.0046ec60
lea ecx, [esp + 0x2c]
mov byte [esp + 0x544], 0
call fcn.0046ec60
lea ecx, [esp + 0x44]
mov dword [esp + 0x544], 0xffffffff
call fcn.0046ec60
mov ax, 1
jmp 0x443e43
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x34
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aec84
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0x35
mov ecx, esp
mov dword [esp + 0x24], esp
jmp 0x443d75
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aecc8
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0xd
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aec8c
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x4aec84
call fcn.0046ebc0
push ecx
mov byte [esp + 0x554], 0xe
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x4aebf0
call fcn.0046ebc0
mov ecx, 0x4b6448
mov byte [esp + 0x554], 9
call fcn.00472d90
lea ecx, [esp + 0x30]
mov byte [esp + 0x544], 8
call fcn.0046ec60
lea ecx, [esp + 0x50]
mov byte [esp + 0x544], 7
call fcn.0046ec60
lea ecx, [esp + 0x48]
mov byte [esp + 0x544], 6
call fcn.0046ec60
lea ecx, [esp + 0x40]
mov byte [esp + 0x544], 5
call fcn.0046ec60
lea ecx, [esp + 0x34]
mov byte [esp + 0x544], 4
call fcn.0046ec60
lea ecx, [esp + 0x3c]
mov byte [esp + 0x544], 3
call fcn.0046ec60
lea ecx, [esp + 0x38]
mov byte [esp + 0x544], 2
call fcn.0046ec60
lea ecx, [esp + 0x4c]
mov byte [esp + 0x544], 1
call fcn.0046ec60
lea ecx, [esp + 0x2c]
mov byte [esp + 0x544], 0
call fcn.0046ec60
lea ecx, [esp + 0x44]
mov dword [esp + 0x544], 0xffffffff
call fcn.0046ec60
xor ax, ax
mov ecx, dword [esp + 0x53c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x538
ret