Function at 0x10046ee4
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006eb3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x918
push esi
and dword [ebp - 0x14], 0
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1004aeeb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x24c], 6
mov dword [ebp - 0x568], 1
mov dword [ebp - 0x570], 0
mov dword [ebp - 0x174], 0
jmp 0x10046f57
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 1
jge 0x10046f73
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x128], 0xc0ae9714
jmp 0x10046f4a
mov dword [ebp - 0x44], 0
jmp 0x10046f83
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jg 0x10046f9a
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x128], 0
je 0x10046f98
jmp 0x10046f9a
jmp 0x10046f7c
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x24c], eax
jg 0x10046fb1
mov dword [ebp - 0x494], 1
jmp 0x10046fb8
and dword [ebp - 0x494], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x128], 0xbf0ddd9c
jae 0x10046fdd
cmp dword [ebp - 0x24c], 0
jne 0x10046fdd
and dword [ebp - 0x33c], 0
jmp 0x10046fe7
mov dword [ebp - 0x33c], 1
mov eax, dword [ebp - 0x24c]
cmp dword [ebp - 0x33c], eax
jge 0x10047001
mov dword [ebp - 0x4b4], 1
jmp 0x10047008
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x494]
mov ecx, dword [ebp - 0x44]
add ecx, dword [ebp - 0x4b4]
cmp eax, ecx
jg 0x1004702a
mov dword [ebp - 0x4bc], 1
jmp 0x10047031
and dword [ebp - 0x4bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x128]
cmp dword [ebp - 0x4bc], eax
jne 0x10047052
mov dword [ebp - 0x4c4], 1
jmp 0x10047059
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x568]
cmp dword [ebp - 0x4c4], eax
jg 0x10047073
mov dword [ebp - 0x4cc], 1
jmp 0x1004707a
and dword [ebp - 0x4cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x128]
cmp eax, dword [ebp - 0x4cc]
jne 0x1004709b
mov dword [ebp - 0x4e4], 1
jmp 0x100470a2
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x570], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x7dc], 0xac8b13ec
mov dword [ebp - 0x7f0], 0xfcb50bf3
mov dword [ebp - 0x804], 1
mov dword [ebp - 0x578], 0x68876942
push 1
push 0x1859
lea eax, [ebp - 0x578]
push eax
call fcn.10044a8b
add esp, 0xc
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x10047121
push 0x4017
push 1
push 0x5463
call fcn.10044acd
add esp, 0xc
mov eax, dword [ebp - 0x2e0]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10047136
jmp 0x1004af84
mov dword [ebp - 0x2a0], 0xdd1e1e87
mov dword [ebp - 0x29c], 0xdd1e1e87
mov dword [ebp - 0x298], 0xdd1e1e87
mov dword [ebp - 0x294], 0xdd1e1e87
push 1
lea ecx, [ebp - 0x2cc]
call fcn.1001710b
and dword [ebp - 4], 0
mov dword [ebp - 0x4a0], 0xecdc0f1f
mov dword [ebp - 0x6a0], 1
mov dword [ebp - 0x69c], 1
mov dword [ebp - 0x698], 1
mov dword [ebp - 0x694], 1
lea ecx, [ebp - 0x265]
call fcn.100171b8
push eax
lea eax, [ebp - 0x690]
push eax
lea eax, [ebp - 0x6a0]
push eax
lea ecx, [ebp - 0x85c]
call fcn.100171bb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x778]
call fcn.10017167
mov byte [ebp - 4], 1
push 3
lea ecx, [ebp - 0x760]
call fcn.1001710b
mov byte [ebp - 4], 2
mov dword [ebp - 0x588], 0x4f6c5533
mov dword [ebp - 0x30], 0
jmp 0x10047205
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1004721b
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x2b4], 0xfffffffd
jmp 0x100471fe
mov dword [ebp - 0x30], 0
jmp 0x1004722b
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x10047247
push dword [ebp - 0x30]
lea ecx, [ebp - 0x2cc]
call fcn.100171a9
mov dword [eax], 0x6ec17e5c
jmp 0x10047224
mov dword [ebp - 0x30], 0
jmp 0x10047257
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x10047270
push dword [ebp - 0x30]
lea ecx, [ebp - 0x760]
call fcn.100171a9
or dword [eax], 0xffffffff
jmp 0x10047250
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x2a0], 0
jmp 0x1004729e
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2a0]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x2a0], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2a0], 2
jg 0x100473d8
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2a0]
mov eax, dword [ebp + eax*4 - 0x2b4]
mov dword [ebp - 0x7a4], eax
push 0
lea ecx, [ebp - 0x2cc]
call fcn.100171a9
cmp dword [eax], 0
jne 0x10047365
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2a0]
cmp dword [ebp + eax*4 - 0x2b4], 0
jne 0x1004730b
mov eax, 0x4b541145
test eax, eax
jne 0x1004730b
and dword [ebp - 0x4ec], 0
jmp 0x10047315
mov dword [ebp - 0x4ec], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2a0]
mov eax, dword [ebp + eax*4 - 0x2b4]
cmp dword [ebp - 0x4ec], eax
jne 0x10047341
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x10047341
and dword [ebp - 0x580], 0
jmp 0x1004734b
mov dword [ebp - 0x580], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2a0]
mov eax, dword [ebp + eax*4 - 0x2b4]
mov dword [ebp - 0x76c], eax
push 0
lea ecx, [ebp - 0x2cc]
call fcn.100171a9
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2a0]
mov dword [ebp - 0x7c0], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2a0]
mov eax, dword [ebp + eax*4 - 0x2b4]
mov dword [ebp - 0x77c], eax
push 0
lea ecx, [ebp - 0x2cc]
call fcn.100171a9
cmp dword [eax], 0
jne 0x100473bf
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2a0], 0
mov eax, 0xffff
imul eax, eax, 0xffffffff
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2b4], eax
jmp 0x10047283
push 0
lea ecx, [ebp - 0x2cc]
call fcn.100171a9
cmp dword [eax], 0
jne 0x10047405
push 0
lea ecx, [ebp - 0x2cc]
call fcn.100171a9
cmp dword [eax], 0
jne 0x10047405
and dword [ebp - 0x284], 0
jmp 0x1004740f
mov dword [ebp - 0x284], 1
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x284]
mov dword [ebp + eax - 0x2a0], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2b4]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x2b4]
cmp dword [ebp - 0x284], eax
jl 0x1004744f
mov dword [ebp - 0x254], 1
jmp 0x10047456
and dword [ebp - 0x254], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x254]
mov dword [ebp + eax - 0x2b4], ecx
push 0
lea ecx, [ebp - 0x2cc]
call fcn.100171a9
mov eax, dword [eax]
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4a0]
cmp dword [ebp - 0x254], eax
jne 0x10047497
mov dword [ebp - 0x2d8], 1
jmp 0x1004749e
and dword [ebp - 0x2d8], 0
cmp dword [ebp - 0x2d8], 0xf63e
jne 0x100474b6
mov dword [ebp - 0x48c], 1
jmp 0x100474bd
and dword [ebp - 0x48c], 0
push 0
lea ecx, [ebp - 0x2cc]
call fcn.100171a9
mov ecx, dword [ebp - 0x48c]
cmp ecx, dword [eax]
jg 0x100474e0
mov dword [ebp - 0x3e8], 1
jmp 0x100474e7
and dword [ebp - 0x3e8], 0
push 3
lea ecx, [ebp - 0x778]
call fcn.100171a9
mov ecx, dword [ebp - 0x3e8]
cmp ecx, dword [eax]
jl 0x1004750a
mov dword [ebp - 0x28c], 1
jmp 0x10047511
and dword [ebp - 0x28c], 0
push 1
lea ecx, [ebp - 0x760]
call fcn.100171a9
mov ecx, dword [ebp - 0x28c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x588], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x760]
call fcn.1001718d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x778]
call fcn.1001718d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2cc]
call fcn.1001718d
mov eax, dword [ebp - 0x2e0]
mov ecx, dword [ebp - 0x28]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x3c], 0x425a80e3
mov dword [ebp - 0x300], 0x29f5
mov dword [ebp - 0x158], 0
jmp 0x10047598
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 4
jge 0x100475b4
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x894], 0xfffffffb
jmp 0x1004758b
cmp dword [ebp - 0x3c], 0
jne 0x100475c9
cmp dword [ebp - 0x3c], 0
jne 0x100475c9
and dword [ebp - 0x3f0], 0
jmp 0x100475d3
mov dword [ebp - 0x3f0], 1
cmp dword [ebp - 0x3c], 0xa3a92bd4
jb 0x100475ee
cmp dword [ebp - 0x3c], 0
je 0x100475ee
mov dword [ebp - 0x470], 1
jmp 0x100475f5
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x470], eax
jl 0x1004760c
mov dword [ebp - 0x2e8], 1
jmp 0x10047613
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x2e8]
jg 0x1004762a
mov dword [ebp - 0x2f0], 1
jmp 0x10047631
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x3f0]
cmp eax, dword [ebp - 0x2f0]
je 0x1004764b
mov dword [ebp - 0x4e0], 1
jmp 0x10047652
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x4e0], eax
jne 0x10047669
mov dword [ebp - 0x2f8], 1
jmp 0x10047670
and dword [ebp - 0x2f8], 0
cmp dword [ebp - 0x2f8], 8
je 0x10047685
mov dword [ebp - 0x3f8], 1
jmp 0x1004768c
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3f8], eax
jne 0x100476ac
cmp dword [ebp - 0x300], 0
je 0x100476ac
mov dword [ebp - 0x478], 1
jmp 0x100476b3
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x300]
add eax, dword [ebp - 0x478]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x894], eax
mov dword [ebp - 0x3c], 9
jmp 0x100476dc
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x26
jg 0x100476fe
mov byte [ebp - 0x67], 0
movzx eax, byte [ebp - 0x67]
test eax, eax
je 0x100476fc
push 1
push 0x7ee8
call fcn.10044b19
pop ecx
pop ecx
jmp 0x100476d5
mov eax, dword [ebp - 0x74]
cmp dword [eax], 0x4550
je 0x1004770e
jmp 0x1004af84
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x74]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x400], 1
mov dword [ebp - 0x64], 3
mov dword [ebp - 0x264], 0x6b779c63
mov dword [ebp - 0xb4], 0x3ec58f55
mov dword [ebp - 0x130], 0
jmp 0x1004775c
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 1
jge 0x10047778
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x288], 0x80335900
jmp 0x1004774f
push 0x5ad1
push 0x55f2
lea eax, [ebp - 0x264]
push eax
push 0x6003
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x64]
push eax
push 0x289
push 0x65b5
lea eax, [ebp - 0x400]
push eax
push 0x7c99
push 1
call fcn.10044b4f
add esp, 0x2c
mov dword [ebp - 0x64], 0
jmp 0x100477c9
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jg 0x100479ea
mov dword [ebp - 0x25c], 0x2a6a
mov dword [ebp - 0x328], 0xa52b3395
push 1
lea ecx, [ebp - 0x73c]
call fcn.1001710b
mov dword [ebp - 4], 3
push 0
lea eax, [ebp - 0x7c8]
push eax
push 0x71df
lea eax, [ebp - 0x73c]
push eax
call fcn.10044ece
add esp, 0x10
mov dword [ebp - 0xb4], 0
jmp 0x10047831
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jg 0x100479bf
mov dword [ebp - 0x308], 7
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x288]
mov dword [ebp - 0x78c], eax
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x7d0], eax
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x79c], eax
cmp dword [ebp - 0x400], 1
je 0x1004789d
mov dword [ebp - 0x310], 1
jmp 0x100478a4
and dword [ebp - 0x310], 0
cmp dword [ebp - 0x310], 0xa93f
jge 0x100478bc
mov dword [ebp - 0x4b8], 1
jmp 0x100478c3
and dword [ebp - 0x4b8], 0
cmp dword [ebp - 0x4b8], 0xc0f1fa6f
je 0x100478db
mov dword [ebp - 0x318], 1
jmp 0x100478e2
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x288]
cmp eax, dword [ebp - 0x318]
jge 0x10047900
mov dword [ebp - 0x408], 1
jmp 0x10047907
and dword [ebp - 0x408], 0
cmp dword [ebp - 0x408], 0x7356536
jge 0x1004791f
mov dword [ebp - 0x320], 1
jmp 0x10047926
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x288]
cmp dword [ebp - 0x320], eax
jne 0x10047944
mov dword [ebp - 0x480], 1
jmp 0x1004794b
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x410], eax
push 0
lea ecx, [ebp - 0x73c]
call fcn.100171a9
mov ecx, dword [ebp - 0x410]
mov dword [eax], ecx
cmp dword [ebp - 0x410], 0
jne 0x1004798d
mov dword [ebp - 0x330], 1
jmp 0x10047994
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x264]
cmp dword [ebp - 0x330], eax
jge 0x100479ac
push 0
call fcn.100465c9
pop ecx
jmp 0x100479ba
push 0
push 0x409d
call fcn.1004501c
pop ecx
pop ecx
jmp 0x10047824
mov byte [ebp - 0x86], 0
lea eax, [ebp - 0x86]
push eax
push 1
call fcn.10044e46
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x73c]
call fcn.1001718d
jmp 0x100477c2
mov eax, dword [ebp - 0x48]
cmp dword [eax + 4], 0
jne 0x100479f8
jmp 0x1004af84
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x74]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x74]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x60], eax
and dword [ebp - 0x2a4], 0
jmp 0x10047a2c
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x60]
add eax, 0x28
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x74]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x2a4], eax
jge 0x10047a96
mov eax, dword [ebp - 0x60]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x4d0]
jb 0x10047a94
mov eax, dword [ebp - 0x74]
push dword [eax + 0x38]
mov eax, dword [ebp - 0x60]
push dword [eax + 8]
call fcn.10044a5c
pop ecx
pop ecx
add eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x590], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x590]
jae 0x10047a94
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
call fcn.100467fc
add esp, 0xc
jmp 0x10047a96
jmp 0x10047a16
mov dword [ebp - 0x40], 0xb26bdde0
mov dword [ebp - 0x138], 0x999fb023
mov dword [ebp - 0x90], 0xdead9bac
mov dword [ebp - 0x170], 0
jmp 0x10047aca
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jge 0x10047ae6
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x650], 0x2b8e
jmp 0x10047abd
mov dword [ebp - 0x40], 0xfffffff6
jmp 0x10047af6
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffe7
jne 0x10047c36
mov dword [ebp - 0x50], 0x4f93
mov dword [ebp - 0x338], 0xfffffffd
mov dword [ebp - 0x5a0], 0
lea eax, [ebp - 0x138]
push eax
push 0x7e88
push 0x6b10
push 0
call fcn.1004647e
add esp, 0x10
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
je 0x10047c17
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0x50], eax
jge 0x10047b66
mov dword [ebp - 0x348], 1
jmp 0x10047b6d
and dword [ebp - 0x348], 0
cmp dword [ebp - 0x90], 0
jne 0x10047bc9
cmp dword [ebp - 0x50], 0x126c7f05
je 0x10047b8b
mov dword [ebp - 0x418], 1
jmp 0x10047b92
and dword [ebp - 0x418], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x418]
mov dword [ebp + eax - 0x650], ecx
imul eax, dword [ebp - 0x138], 0xf32b
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x138], eax
jg 0x10047bc9
and dword [ebp - 0x340], 0
jmp 0x10047bd3
mov dword [ebp - 0x340], 1
mov eax, dword [ebp - 0x340]
sub eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x40]
je 0x10047bed
mov dword [ebp - 0x488], 1
jmp 0x10047bf4
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x90]
add eax, dword [ebp - 0x488]
imul eax, dword [ebp - 0x348]
test eax, eax
je 0x10047c17
mov dword [ebp - 0x598], 1
jmp 0x10047c1e
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x7d8], eax
mov dword [ebp - 0x5a0], 0x455f992d
jmp 0x10047aef
cmp dword [ebp - 0x90], 0
je 0x10047ca1
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
neg ecx
add eax, ecx
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x650]
add ecx, 0x2295
sub eax, ecx
mov dword [ebp - 0x40], eax
jne 0x10047c70
or eax, 0xffffffff
jne 0x10047c70
and dword [ebp - 0x420], 0
jmp 0x10047c7a
mov dword [ebp - 0x420], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x650]
add eax, dword [ebp - 0x420]
cmp eax, dword [ebp - 0x90]
jl 0x10047ca1
mov dword [ebp - 0x350], 1
jmp 0x10047ca8
and dword [ebp - 0x350], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x650]
cmp dword [ebp - 0x350], eax
jg 0x10047cc9
mov dword [ebp - 0x4c0], 1
jmp 0x10047cd0
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x4c0]
jle 0x10047cea
mov dword [ebp - 0x358], 1
jmp 0x10047cf1
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x34], 0
jne 0x10047d08
jmp 0x1004af84
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x34]
add ecx, dword [eax]
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x10], ecx
xor ecx, ecx
call fcn.1002d833
push eax
call fcn.100574e8
pop ecx
mov dword [ebp - 0x1c], 0x33a4
mov dword [ebp - 0x26c], 0xea4d59ff
mov dword [ebp - 0x448], 0x245c2f1f
mov dword [ebp - 0x3a0], 8
mov dword [ebp - 0x63c], 0xfffffffd
mov dword [ebp - 0x644], 0xa751f099
mov dword [ebp - 0xc0], 0xffffffff
mov dword [ebp - 0x634], 0x348e76e
mov dword [ebp - 0xd0], 0xffffffff
mov dword [ebp - 0x160], 0
jmp 0x10047d94
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jge 0x10047db0
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0x7e0], 0x966a49df
jmp 0x10047d87
cmp dword [ebp - 0x1c], 0
je 0x1004806f
mov dword [ebp - 0x498], 1
mov dword [ebp - 0x5a8], 0xffffffff
mov dword [ebp - 0x140], 0
jmp 0x10047de7
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 4
jge 0x10047e03
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x514], 0
jmp 0x10047dda
mov dword [ebp - 0x1c], 0
jmp 0x10047e13
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1004806a
mov dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp + ecx*4 - 0x514]
cmp dword [ebp + eax*4 - 0x514], ecx
jl 0x10047e49
mov dword [ebp - 0x368], 1
jmp 0x10047e50
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x514]
mov dword [ebp - 0x7d4], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x514]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0x700d
je 0x10047e8a
mov dword [ebp - 0x360], 1
jmp 0x10047e91
and dword [ebp - 0x360], 0
cmp dword [ebp - 0x360], 0xca7
je 0x10047ea9
mov dword [ebp - 0x490], 1
jmp 0x10047eb0
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x490]
cmp eax, dword [ebp - 0x1c]
jge 0x10047eca
mov dword [ebp - 0x430], 1
jmp 0x10047ed1
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x368]
cmp eax, dword [ebp - 0x430]
jne 0x10047eeb
mov dword [ebp - 0x370], 1
jmp 0x10047ef2
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x370]
cmp eax, dword [ebp - 0x1c]
jl 0x10047f0c
mov dword [ebp - 0x49c], 1
jmp 0x10047f13
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x514]
imul eax, dword [ebp - 0x49c]
cmp eax, 0xd87e
jne 0x10047f37
mov dword [ebp - 0x378], 1
jmp 0x10047f3e
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x378]
inc eax
neg eax
mov ecx, dword [ebp - 0x1c]
cmp eax, dword [ebp + ecx*4 - 0x514]
jge 0x10047f5f
mov dword [ebp - 0x438], 1
jmp 0x10047f66
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x1c], 0
je 0x10047f8d
mov eax, 0x413053bf
test eax, eax
je 0x10047f8d
mov dword [ebp - 0x380], 1
jmp 0x10047f94
and dword [ebp - 0x380], 0
cmp dword [ebp - 0x380], 0xc4433ac2
je 0x10047fac
mov dword [ebp - 0x388], 1
jmp 0x10047fb3
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x498]
cmp eax, dword [ebp - 0x388]
jne 0x10047fd9
mov dword [ebp - 0x390], 1
jmp 0x10047fe0
and dword [ebp - 0x390], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x514], 0xffffffff
jbe 0x10047ffc
mov dword [ebp - 0x440], 1
jmp 0x10048003
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x514]
cmp dword [ebp - 0x440], eax
jne 0x10048031
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x514], 0
je 0x10048031
mov dword [ebp - 0x4a4], 1
jmp 0x10048038
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x390]
cmp eax, dword [ebp - 0x4a4]
jge 0x10048052
mov dword [ebp - 0x398], 1
jmp 0x10048059
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x5a8], eax
jmp 0x10047e0c
jmp 0x1004819c
mov dword [ebp - 0x5b0], 1
mov dword [ebp - 0xe0], 0xfffffffc
mov dword [ebp - 0x610], 9
lea eax, [ebp - 0x5b0]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x26c]
push eax
push 0x7c4c
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0xe0]
push eax
push 0x7074
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x610]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.10045910
add esp, 0x3c
mov dword [ebp - 0xd0], 0
jmp 0x1004810b
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xffffffe8
jl 0x1004819c
mov dword [ebp - 0xc0], 0xffffffe2
jmp 0x10048131
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xffffffe6
jle 0x10048197
mov dword [ebp - 0xe0], 0xffffffe6
jmp 0x10048153
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0xfffffff5
jl 0x1004817b
push 0
lea eax, [ebp - 0x26c]
push eax
push 0x479c
lea eax, [ebp - 0x3a0]
push eax
call fcn.10046ee4
add esp, 0x10
jmp 0x10048146
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x10048195
push 1
call fcn.10044e8d
pop ecx
jmp 0x10048124
jmp 0x100480fe
mov dword [ebp - 0x6c], 0x4a025691
mov dword [ebp - 0x618], 0x7b5bf2d3
mov dword [ebp - 0x534], 5
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x6c], 0x17
jmp 0x100481cd
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xffffffe7
jge 0x10048218
mov dword [ebp - 0x52c], 0xffffffff
mov dword [ebp - 0x524], 0x69b7d6b5
lea eax, [ebp - 0x52c]
push eax
push 0
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x534]
push eax
push 0x7fd5
lea eax, [ebp - 0x6c]
push eax
call fcn.100460fb
add esp, 0x1c
jmp 0x100481c6
mov byte [ebp - 0x244], 8
mov byte [ebp - 0x243], 0x26
mov byte [ebp - 0x242], 5
mov byte [ebp - 0x241], 1
mov byte [ebp - 0x240], 1
mov byte [ebp - 0x23f], 4
mov byte [ebp - 0x23e], 3
mov byte [ebp - 0x23d], 2
mov byte [ebp - 0x23c], 7
mov byte [ebp - 0x23b], 1
mov byte [ebp - 0x23a], 9
mov byte [ebp - 0x239], 6
mov byte [ebp - 0x238], 6
mov byte [ebp - 0x237], 1
mov byte [ebp - 0x236], 0
mov byte [ebp - 0x235], 0
mov byte [ebp - 0x234], 4
mov byte [ebp - 0x233], 9
mov byte [ebp - 0x232], 0x5f
mov byte [ebp - 0x231], 0x8a
mov byte [ebp - 0x230], 0xaa
mov byte [ebp - 0x22f], 0xd0
mov byte [ebp - 0x22e], 0x88
mov byte [ebp - 0x22d], 0xf2
mov byte [ebp - 0x22c], 0x91
mov byte [ebp - 0x22b], 0x9c
mov byte [ebp - 0x22a], 0xee
mov byte [ebp - 0x229], 0x6a
mov byte [ebp - 0x228], 0x79
mov byte [ebp - 0x227], 0x8b
mov byte [ebp - 0x226], 0x95
mov byte [ebp - 0x225], 0x73
mov byte [ebp - 0x224], 0xf3
mov byte [ebp - 0x223], 0xc6
mov byte [ebp - 0x222], 0x1d
mov byte [ebp - 0x221], 0x87
mov byte [ebp - 0x220], 0x29
mov byte [ebp - 0x21f], 0x64
mov byte [ebp - 0x21e], 0x5b
mov byte [ebp - 0x21d], 0x29
mov byte [ebp - 0x21c], 0xe1
mov byte [ebp - 0x21b], 0x54
mov byte [ebp - 0x21a], 0x5c
mov byte [ebp - 0x219], 0x4c
mov byte [ebp - 0x218], 0xa8
mov byte [ebp - 0x217], 0x8d
mov byte [ebp - 0x216], 0xba
mov byte [ebp - 0x215], 0xf7
mov byte [ebp - 0x214], 0xa6
mov byte [ebp - 0x213], 0x89
mov byte [ebp - 0x212], 0x6a
mov byte [ebp - 0x211], 0x69
mov byte [ebp - 0x210], 0x1b
mov byte [ebp - 0x20f], 0xed
mov byte [ebp - 0x20e], 0x11
mov byte [ebp - 0x20d], 0x1a
mov byte [ebp - 0x20c], 0x92
mov byte [ebp - 0x20b], 0x74
mov byte [ebp - 0x20a], 0x2f
mov byte [ebp - 0x209], 0xe2
mov byte [ebp - 0x208], 0xc6
mov byte [ebp - 0x207], 0xd7
mov byte [ebp - 0x206], 0x8a
mov byte [ebp - 0x205], 0x36
mov byte [ebp - 0x204], 0x47
mov byte [ebp - 0x203], 0x73
mov byte [ebp - 0x202], 0xb8
mov byte [ebp - 0x201], 0x9e
mov byte [ebp - 0x200], 0x4d
mov byte [ebp - 0x1ff], 0xd0
mov byte [ebp - 0x1fe], 0x3c
mov byte [ebp - 0x1fd], 0x78
mov byte [ebp - 0x1fc], 0x62
mov byte [ebp - 0x1fb], 0xc6
mov byte [ebp - 0x1fa], 0x7c
mov byte [ebp - 0x1f9], 0x92
mov byte [ebp - 0x1f8], 0x3c
mov byte [ebp - 0x1f7], 0xf2
mov byte [ebp - 0x1f6], 0x1e
mov byte [ebp - 0x1f5], 0x41
mov byte [ebp - 0x1f4], 0x71
mov byte [ebp - 0x1f3], 0x30
mov byte [ebp - 0x1f2], 0x79
mov byte [ebp - 0x1f1], 0xf5
mov byte [ebp - 0x1f0], 0x69
mov byte [ebp - 0x1ef], 0xcf
mov byte [ebp - 0x1ee], 0xc4
mov byte [ebp - 0x1ed], 0xe8
mov byte [ebp - 0x1ec], 0x32
mov byte [ebp - 0x1eb], 0xaa
mov byte [ebp - 0x1ea], 0x98
mov byte [ebp - 0x1e9], 7
mov byte [ebp - 0x1e8], 0x9a
mov byte [ebp - 0x1e7], 0xf0
mov byte [ebp - 0x1e6], 0xf2
mov byte [ebp - 0x1e5], 0x87
mov byte [ebp - 0x1e4], 0xad
mov byte [ebp - 0x1e3], 0x29
mov byte [ebp - 0x1e2], 0xe6
mov byte [ebp - 0x1e1], 0xea
mov byte [ebp - 0x1e0], 9
mov byte [ebp - 0x1df], 0xde
mov byte [ebp - 0x1de], 0xfd
mov byte [ebp - 0x1dd], 0xd7
mov byte [ebp - 0x1dc], 0x17
mov byte [ebp - 0x1db], 0xe9
mov byte [ebp - 0x1da], 0x21
mov byte [ebp - 0x1d9], 0x85
mov byte [ebp - 0x1d8], 0xa8
mov byte [ebp - 0x1d7], 0xbe
mov byte [ebp - 0x1d6], 0xf7
mov byte [ebp - 0x1d5], 0x23
mov byte [ebp - 0x1d4], 0x81
mov byte [ebp - 0x1d3], 0xd6
mov byte [ebp - 0x1d2], 2
mov byte [ebp - 0x1d1], 0xf
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x244]
or eax, 0x16
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x244]
and ecx, 0x16
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x244]
mov byte [ebp + ecx - 0x504], al
mov dword [ebp - 0x38], 2
and dword [ebp - 0x178], 0
jmp 0x10048595
mov eax, dword [ebp - 0x38]
inc eax
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x74
jae 0x1004865f
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x244]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x38], eax
jne 0x100485df
mov eax, dword [ebp - 0x38]
movzx eax, byte [ebp + eax - 0x244]
inc eax
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [ebp + eax - 0x244]
mov ecx, dword [ebp - 0x38]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x38], eax
jmp 0x1004858d
mov eax, dword [ebp - 0x38]
movzx eax, byte [ebp + eax - 0x243]
mov ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x178]
movzx ecx, byte [ebp + ecx - 0x246]
movsx ecx, byte [ebp + ecx - 0x504]
or eax, ecx
mov ecx, dword [ebp - 0x38]
movzx ecx, byte [ebp + ecx - 0x243]
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x178]
movzx edx, byte [ebp + edx - 0x246]
movsx edx, byte [ebp + edx - 0x504]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x38]
movzx ecx, byte [ebp + ecx - 0x244]
mov byte [ebp + ecx - 0x504], al
push 1
push 0x2275
lea eax, [ebp - 0x178]
push eax
push 0x318c
call fcn.10044ece
add esp, 0x10
jmp 0x1004858d
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x504], 0
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc8], 0
jmp 0x10048690
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0xfffffffb
jge 0x100486ce
mov dword [ebp - 0x5f0], 0x1f665683
mov dword [ebp - 0x53c], 0xbc370782
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x5f0]
push eax
lea eax, [ebp - 0x53c]
push eax
push 1
call fcn.10044f3f
add esp, 0x10
jmp 0x10048683
lea eax, [ebp - 0x504]
push eax
lea ecx, [ebp - 0x8c4]
call fcn.10023fdd
mov dword [ebp - 0x630], eax
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x544], eax
mov dword [ebp - 4], 4
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x544]
call fcn.1002d7f3
pop ecx
mov dword [ebp - 0x628], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c4]
call fcn.1001706d
and dword [ebp - 0x148], 0
jmp 0x10048734
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xb
jae 0x1004874d
mov eax, dword [ebp - 0x148]
mov byte [ebp + eax - 0x504], 0
jmp 0x10048727
mov dword [ebp - 0x554], 0xcc2fdcb
mov dword [ebp - 0x54c], 0xcb4e76ab
mov dword [ebp - 0x620], 0x9523dd97
push 2
lea ecx, [ebp - 0x6f4]
call fcn.1001710b
mov dword [ebp - 4], 5
push 4
lea ecx, [ebp - 0x724]
call fcn.1001710b
mov byte [ebp - 4], 6
lea eax, [ebp - 0x6f4]
push eax
push 0
push 0x736d
lea eax, [ebp - 0x5f8]
push eax
call fcn.10045d8a
add esp, 0x10
lea eax, [ebp - 0x5f8]
push eax
push 1
lea eax, [ebp - 0x724]
push eax
call fcn.10044fae
add esp, 0xc
lea eax, [ebp - 0x54c]
push eax
lea eax, [ebp - 0x6f4]
push eax
push 0
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x554]
push eax
lea eax, [ebp - 0x724]
push eax
call fcn.1004664b
add esp, 0x18
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x724]
call fcn.1001718d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6f4]
call fcn.1001718d
mov byte [ebp - 0x1d0], 9
mov byte [ebp - 0x1cf], 0xa0
mov byte [ebp - 0x1ce], 3
mov byte [ebp - 0x1cd], 2
mov byte [ebp - 0x1cc], 6
mov byte [ebp - 0x1cb], 0xb
mov byte [ebp - 0x1ca], 4
mov byte [ebp - 0x1c9], 0xd
mov byte [ebp - 0x1c8], 1
mov byte [ebp - 0x1c7], 2
mov byte [ebp - 0x1c6], 0
mov byte [ebp - 0x1c5], 7
mov byte [ebp - 0x1c4], 8
mov byte [ebp - 0x1c3], 1
mov byte [ebp - 0x1c2], 7
mov byte [ebp - 0x1c1], 6
mov byte [ebp - 0x1c0], 5
mov byte [ebp - 0x1bf], 7
mov byte [ebp - 0x1be], 2
mov byte [ebp - 0x1bd], 6
mov byte [ebp - 0x1bc], 0x39
mov byte [ebp - 0x1bb], 0x8b
mov byte [ebp - 0x1ba], 0xcd
mov byte [ebp - 0x1b9], 0x5d
mov byte [ebp - 0x1b8], 0xe
mov byte [ebp - 0x1b7], 0xe5
mov byte [ebp - 0x1b6], 0xd6
mov byte [ebp - 0x1b5], 0xce
mov byte [ebp - 0x1b4], 0x22
mov byte [ebp - 0x1b3], 0xdb
mov byte [ebp - 0x1b2], 0xa8
mov byte [ebp - 0x1b1], 0xb9
mov byte [ebp - 0x1b0], 0x2c
mov byte [ebp - 0x1af], 0x92
mov byte [ebp - 0x1ae], 0xe1
mov byte [ebp - 0x1ad], 0x75
mov byte [ebp - 0x1ac], 0x5a
mov byte [ebp - 0x1ab], 0xb1
mov byte [ebp - 0x1aa], 0x21
mov byte [ebp - 0x1a9], 0x12
mov byte [ebp - 0x1a8], 0xe1
mov byte [ebp - 0x1a7], 0x9d
mov byte [ebp - 0x1a6], 0xf5
mov byte [ebp - 0x1a5], 0x6b
mov byte [ebp - 0x1a4], 0xeb
mov byte [ebp - 0x1a3], 0x70
mov byte [ebp - 0x1a2], 0x89
mov byte [ebp - 0x1a1], 0x63
mov byte [ebp - 0x1a0], 0x65
mov byte [ebp - 0x19f], 0x6c
mov byte [ebp - 0x19e], 0x4a
mov byte [ebp - 0x19d], 0xc8
mov byte [ebp - 0x19c], 0xe3
mov byte [ebp - 0x19b], 0x83
mov byte [ebp - 0x19a], 0x76
mov byte [ebp - 0x199], 0x72
mov byte [ebp - 0x198], 0xde
mov byte [ebp - 0x197], 0x9a
mov byte [ebp - 0x196], 0x4d
mov byte [ebp - 0x195], 0xc
mov byte [ebp - 0x194], 0xe0
mov byte [ebp - 0x193], 0x2b
mov byte [ebp - 0x192], 0x4d
mov byte [ebp - 0x191], 0x22
mov byte [ebp - 0x190], 0x6e
mov byte [ebp - 0x18f], 0xeb
mov byte [ebp - 0x18e], 0x3a
mov byte [ebp - 0x18d], 0x5d
mov byte [ebp - 0x18c], 0xdf
mov byte [ebp - 0x18b], 0x9b
mov byte [ebp - 0x18a], 0x62
mov byte [ebp - 0x189], 0x16
mov byte [ebp - 0x188], 0x3f
mov byte [ebp - 0x187], 0x9b
mov byte [ebp - 0x186], 0x43
mov byte [ebp - 0x185], 0x94
mov byte [ebp - 0x184], 0x97
mov byte [ebp - 0x183], 0x71
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1d0]
or eax, 0x90
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1d0]
and ecx, 0x90
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x1d0]
mov byte [ebp + ecx - 0x4f8], al
mov dword [ebp - 0x24], 2
and dword [ebp - 0xd8], 0
jmp 0x10048a88
mov eax, dword [ebp - 0x24]
inc eax
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x4e
jae 0x10048b6f
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1d0]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x24], eax
jne 0x10048ad2
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x1d0]
inc eax
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x1d0]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x24], eax
jmp 0x10048a80
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x1cf]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0xd8]
movzx ecx, byte [ebp + ecx - 0x1d2]
movsx ecx, byte [ebp + ecx - 0x4f8]
add eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x1cf]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0xd8]
movzx edx, byte [ebp + edx - 0x1d2]
movsx edx, byte [ebp + edx - 0x4f8]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x1cf]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0xd8]
movzx edx, byte [ebp + edx - 0x1d2]
movsx edx, byte [ebp + edx - 0x4f8]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x1d0]
mov byte [ebp + ecx - 0x4f8], al
push 1
lea eax, [ebp - 0xd8]
push eax
call fcn.1004501c
pop ecx
pop ecx
jmp 0x10048a80
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x4f8], 0
push 4
lea ecx, [ebp - 0x278]
call fcn.1001710b
mov dword [ebp - 4], 7
mov dword [ebp - 0x3a8], 0xfffffffe
mov dword [ebp - 0x4a8], 6
mov dword [ebp - 0x600], 0x9b37d022
mov dword [ebp - 0x168], 0
jmp 0x10048bc8
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 4
jge 0x10048bea
push dword [ebp - 0x168]
lea ecx, [ebp - 0x278]
call fcn.100171a9
mov dword [eax], 0x2daf
jmp 0x10048bbb
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x10048c10
push 0x1c23
push 1
push 0x2068
call fcn.1004506b
add esp, 0xc
push 1
lea ecx, [ebp - 0x278]
call fcn.100171a9
mov esi, eax
push 1
lea ecx, [ebp - 0x278]
call fcn.100171a9
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x10048c3e
mov dword [ebp - 0x4ac], 1
jmp 0x10048c45
and dword [ebp - 0x4ac], 0
push 2
lea ecx, [ebp - 0x278]
call fcn.100171a9
mov eax, dword [eax]
imul eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0
jb 0x10048c76
mov dword [ebp - 0x450], 1
jmp 0x10048c7d
and dword [ebp - 0x450], 0
push 1
lea ecx, [ebp - 0x278]
call fcn.100171a9
mov ecx, dword [ebp - 0x450]
cmp ecx, dword [eax]
jge 0x10048ca0
mov dword [ebp - 0x3b0], 1
jmp 0x10048ca7
and dword [ebp - 0x3b0], 0
cmp dword [ebp - 0x3b0], 1
je 0x10048cbc
mov dword [ebp - 0x4e8], 1
jmp 0x10048cc3
and dword [ebp - 0x4e8], 0
push 2
lea ecx, [ebp - 0x278]
call fcn.100171a9
mov ecx, dword [ebp - 0x4e8]
cmp ecx, dword [eax]
je 0x10048cea
xor eax, eax
je 0x10048cea
mov dword [ebp - 0x3b8], 1
jmp 0x10048cf1
and dword [ebp - 0x3b8], 0
push 2
lea ecx, [ebp - 0x278]
call fcn.100171a9
mov ecx, dword [ebp - 0x3b8]
cmp ecx, dword [eax]
jg 0x10048d14
mov dword [ebp - 0x458], 1
jmp 0x10048d1b
and dword [ebp - 0x458], 0
push 3
lea ecx, [ebp - 0x278]
call fcn.100171a9
mov ecx, dword [ebp - 0x458]
cmp ecx, dword [eax]
jle 0x10048d3e
mov dword [ebp - 0x3c0], 1
jmp 0x10048d45
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x4a8], eax
mov esi, dword [ebp - 0x4a8]
neg esi
push 2
lea ecx, [ebp - 0x278]
call fcn.100171a9
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x278]
call fcn.100171a9
mov eax, dword [eax]
lea eax, [esi + eax + 0x3bd00e74]
mov dword [ebp - 0x600], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x278]
call fcn.1001718d
lea eax, [ebp - 0x4f8]
push eax
lea ecx, [ebp - 0x8ac]
call fcn.10023fdd
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x640], eax
mov dword [ebp - 4], 8
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x640]
call fcn.1002d7f3
pop ecx
mov dword [ebp - 0x56c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8ac]
call fcn.1001706d
mov dword [ebp - 0x2c], 1
push 1
lea ecx, [ebp - 0x65c]
call fcn.1001710b
mov dword [ebp - 4], 9
mov dword [ebp - 0x150], 0
jmp 0x10048e17
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 1
jge 0x10048e39
push dword [ebp - 0x150]
lea ecx, [ebp - 0x65c]
call fcn.100171a9
mov dword [eax], 0xd52a2848
jmp 0x10048e0a
mov dword [ebp - 0x2c], 0
jmp 0x10048e49
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffffc
jle 0x100490a0
push 4
lea ecx, [ebp - 0x4dc]
call fcn.1001710b
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x3c8], 0xb0a3531f
mov dword [ebp - 0x6dc], 0x13b28858
mov dword [ebp - 0x6d8], 0x13b28858
mov dword [ebp - 0x6d4], 0x13b28858
mov dword [ebp - 0x6d0], 0x13b28858
lea ecx, [ebp - 0x28d]
call fcn.100171b8
push eax
lea eax, [ebp - 0x6cc]
push eax
lea eax, [ebp - 0x6dc]
push eax
lea ecx, [ebp - 0x864]
call fcn.100171bb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x700]
call fcn.10017167
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x280], 0xd8bc0d13
mov dword [ebp - 0x3d8], 0xd0d42ad0
mov dword [ebp - 0x608], 0xffffffff
push 0
lea eax, [ebp - 0x7ac]
push eax
push 0x2bd5
push 0x4bcc
push 0x7908
push 0x1969
push 0x2663
lea eax, [ebp - 0x4dc]
push eax
call fcn.1004622b
add esp, 0x20
push 2
lea ecx, [ebp - 0x4dc]
call fcn.100171a9
push 1
lea ecx, [ebp - 0x4dc]
call fcn.100171a9
mov eax, dword [eax]
mov dword [ebp - 0x3c8], eax
mov esi, dword [ebp - 0x3c8]
push 2
lea ecx, [ebp - 0x700]
call fcn.100171a9
mov dword [eax], esi
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x280]
imul eax, dword [ebp - 0x2c]
cmp eax, 0xb39e2240
je 0x10048f7b
mov dword [ebp - 0x460], 1
jmp 0x10048f82
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x460]
jl 0x10048f94
cmp dword [ebp - 0x280], 0
mov esi, dword [ebp - 0x2c]
push 0
lea ecx, [ebp - 0x65c]
call fcn.100171a9
mov dword [eax], esi
push 2
lea ecx, [ebp - 0x700]
call fcn.100171a9
cmp dword [eax], 3
jl 0x10048fc4
mov dword [ebp - 0x3d0], 1
jmp 0x10048fcb
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x2c]
push 2
lea ecx, [ebp - 0x4dc]
call fcn.100171a9
mov ecx, dword [ebp - 0x2c]
cmp dword [eax], ecx
jg 0x10048fee
mov dword [ebp - 0x564], 1
jmp 0x10048ff5
and dword [ebp - 0x564], 0
push 0
lea ecx, [ebp - 0x65c]
call fcn.100171a9
mov esi, eax
push 2
lea ecx, [ebp - 0x4dc]
call fcn.100171a9
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x10049023
mov dword [ebp - 0x4c8], 1
jmp 0x1004902a
and dword [ebp - 0x4c8], 0
push 2
lea ecx, [ebp - 0x4dc]
call fcn.100171a9
mov eax, dword [eax]
imul eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x3d8], eax
mov esi, dword [ebp - 0x3d8]
push 1
lea ecx, [ebp - 0x4dc]
call fcn.100171a9
cmp esi, dword [eax]
jle 0x10049069
mov dword [ebp - 0x468], 1
jmp 0x10049070
and dword [ebp - 0x468], 0
imul eax, dword [ebp - 0x468], 3
mov dword [ebp - 0x608], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x700]
call fcn.1001718d
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x4dc]
call fcn.1001718d
jmp 0x10048e42
mov dword [ebp - 0x2c], 0x1d
jmp 0x100490b0
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x18
jne 0x100490cf
mov byte [ebp - 0x75], 0
push 1
lea eax, [ebp - 0x75]
push eax
push 0x6ea
call fcn.100450e4
add esp, 0xc
jmp 0x100490a9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x65c]
call fcn.1001718d
and dword [ebp - 0x120], 0
jmp 0x100490f4
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xb
jae 0x1004910d
mov eax, dword [ebp - 0x120]
mov byte [ebp + eax - 0x4f8], 0
jmp 0x100490e7
mov dword [ebp - 0x12c], 0xcb457102
mov dword [ebp - 0x98], 0x43046b6e
mov dword [ebp - 0x124], 0
jmp 0x1004913a
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 3
jge 0x10049156
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x810], 0x41b3c692
jmp 0x1004912d
mov dword [ebp - 0x12c], 2
jmp 0x1004916f
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jl 0x100491c4
mov byte [ebp - 0x65], 0
movzx eax, byte [ebp - 0x65]
test eax, eax
je 0x100491b8
push 0
push 0x22fc
push 0x64d
push 0x15bb
push 0x90b
push 0x26fd
push 0x1315
push 0x223e
push 0x15ce
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x98], 1
jmp 0x10049162
mov dword [ebp - 0x98], 0
jmp 0x100491dd
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jg 0x100491fa
mov eax, dword [ebp - 0x98]
cmp dword [ebp + eax*4 - 0x810], 0
je 0x100491f8
jmp 0x100491fa
jmp 0x100491d0
push dword [ebp - 0x56c]
push dword [ebp - 0x628]
call fcn.1004123b
pop ecx
pop ecx
mov dword [ebp - 0x314], eax
push 1
lea ecx, [ebp - 0x520]
call fcn.1001710b
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x57c], 0
push 1
lea ecx, [ebp - 0x718]
call fcn.1001710b
mov byte [ebp - 4], 0xd
mov dword [ebp - 0xb0], 0
jmp 0x1004925b
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x1004927d
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x520]
call fcn.100171a9
mov dword [eax], 0xb26bdde0
jmp 0x1004924e
push 0x3e47
lea eax, [ebp - 0x718]
push eax
push 0
lea eax, [ebp - 0xb0]
push eax
call fcn.10046087
add esp, 0x10
push 0
lea ecx, [ebp - 0x520]
call fcn.100171a9
mov dword [eax], 0xfffffff2
jmp 0x100492d3
push 0
lea ecx, [ebp - 0x520]
call fcn.100171a9
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x3e0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3e0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x520]
call fcn.100171a9
cmp dword [eax], 0xfffffff7
jle 0x10049392
mov dword [ebp - 0x5d8], 1
mov dword [ebp - 0x574], 0
mov dword [ebp - 0x5dc], 0x707e294
lea eax, [ebp - 0x574]
push eax
push 1
lea eax, [ebp - 0x718]
push eax
lea eax, [ebp - 0x5d8]
push eax
lea eax, [ebp - 0x57c]
push eax
push 0x2392
lea eax, [ebp - 0x5dc]
push eax
lea eax, [ebp - 0x520]
push eax
call fcn.10045137
add esp, 0x20
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x1004938d
push 0x566e
push 0x74a3
push 0x1555
push 0x1fd5
push 0x6205
push 0xf78
push 0x1f01
push 0x1e19
push 0x1554
push 0x4789
push 1
push 0x4db0
call fcn.10045378
add esp, 0x30
jmp 0x100492af
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x718]
call fcn.1001718d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x520]
call fcn.1001718d
push 1
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.100456df
add esp, 0xc
mov dword [ebp - 0xbc], 0xfffffff6
push 1
lea ecx, [ebp - 0x674]
call fcn.1001710b
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x58], 0x6859
push 1
lea ecx, [ebp - 0x730]
call fcn.1001710b
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x5e4], 0x6a4abff1
push 1
lea eax, [ebp - 0x584]
push eax
lea eax, [ebp - 0x674]
push eax
call fcn.10045735
add esp, 0xc
push 0x74d0
push 1
lea eax, [ebp - 0x730]
push eax
push 0x52c9
lea eax, [ebp - 0x584]
push eax
push 0x14bf
call fcn.100457a8
add esp, 0x18
mov eax, 0xffff
test eax, eax
je 0x10049563
cmp dword [ebp - 0x58], 0xab1d
jg 0x10049466
mov dword [ebp - 0x4b0], 1
jmp 0x1004946d
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x4b0], eax
jge 0x10049484
mov dword [ebp - 0x2d4], 1
jmp 0x1004948b
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x2d4], eax
jle 0x100494a5
mov dword [ebp - 0x2dc], 1
jmp 0x100494ac
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0xbc]
imul eax, dword [ebp - 0x2dc]
cmp eax, dword [ebp - 0x58]
jl 0x100494ca
mov dword [ebp - 0x2e4], 1
jmp 0x100494d1
and dword [ebp - 0x2e4], 0
push 0
lea ecx, [ebp - 0x674]
call fcn.100171a9
mov dword [eax], 0xe4e9
cmp dword [ebp - 0x2e4], 0xe4e9
jg 0x100494fc
mov dword [ebp - 0x2ec], 1
jmp 0x10049503
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x2ec], eax
jl 0x1004951a
mov dword [ebp - 0x2f4], 1
jmp 0x10049521
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x2f4], eax
jg 0x10049530
cmp dword [ebp - 0x58], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x7b4], eax
push 0
lea ecx, [ebp - 0x674]
call fcn.100171a9
cmp dword [eax], 0
je 0x10049563
mov dword [ebp - 0x2fc], 1
jmp 0x1004956a
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x2fc]
lea eax, [ecx + eax + 0x55c170f8]
cmp eax, 0xffffffff
je 0x1004958b
mov dword [ebp - 0x304], 1
jmp 0x10049592
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x304]
cmp dword [ebp - 0xbc], eax
je 0x100495af
mov dword [ebp - 0x27c], 1
jmp 0x100495b6
and dword [ebp - 0x27c], 0
push 0
lea ecx, [ebp - 0x730]
call fcn.100171a9
mov ecx, dword [ebp - 0x27c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x27c], eax
jle 0x100495e5
mov dword [ebp - 0x30c], 1
jmp 0x100495ec
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x5e4], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x730]
call fcn.1001718d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x674]
call fcn.1001718d
lea eax, [ebp - 0x314]
push eax
push 1
push 0x2ad5
lea eax, [ebp - 0x10]
push eax
push 0x3e6
call fcn.10045881
add esp, 0x14
and dword [ebp - 0xd4], 0
mov dword [ebp - 0xa0], 0xc0ae9714
mov dword [ebp - 0x134], 0
jmp 0x1004965f
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 2
jge 0x1004967b
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x7fc], 0x2afa0177
jmp 0x10049652
mov dword [ebp - 0xa0], 6
jmp 0x10049694
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xfffffff0
je 0x100498e2
mov dword [ebp - 0x6c8], 8
mov dword [ebp - 0x6c4], 8
mov dword [ebp - 0x6c0], 8
mov dword [ebp - 0x6bc], 8
lea ecx, [ebp - 0x2a5]
call fcn.100171b8
push eax
lea eax, [ebp - 0x6b8]
push eax
lea eax, [ebp - 0x6c8]
push eax
lea ecx, [ebp - 0x854]
call fcn.100171bb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x5c0]
call fcn.10017167
mov dword [ebp - 4], 0x10
push 1
lea ecx, [ebp - 0x2c0]
call fcn.1001710b
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x118], 0
jmp 0x1004972f
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 1
jge 0x10049751
push dword [ebp - 0x118]
lea ecx, [ebp - 0x2c0]
call fcn.100171a9
mov dword [eax], 0xf47a6de
jmp 0x10049722
push 0
lea ecx, [ebp - 0x2c0]
call fcn.100171a9
and dword [eax], 0
jmp 0x10049787
push 0
lea ecx, [ebp - 0x2c0]
call fcn.100171a9
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x31c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x31c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x2c0]
call fcn.100171a9
cmp dword [eax], 3
jg 0x1004989d
push 0
lea ecx, [ebp - 0x2c0]
call fcn.100171a9
push dword [eax]
lea ecx, [ebp - 0x5c0]
call fcn.100171a9
push 0
lea ecx, [ebp - 0x2c0]
call fcn.100171a9
push dword [eax]
lea ecx, [ebp - 0x5c0]
call fcn.100171a9
cmp dword [eax], 0xfffffff8
jg 0x100497e2
mov dword [ebp - 0x324], 1
jmp 0x100497e9
and dword [ebp - 0x324], 0
imul esi, dword [ebp - 0x324], 0x61e
push 0
lea ecx, [ebp - 0x2c0]
call fcn.100171a9
push dword [eax]
lea ecx, [ebp - 0x5c0]
call fcn.100171a9
imul esi, dword [eax]
cmp esi, dword [ebp - 0xa0]
jl 0x10049824
mov dword [ebp - 0x32c], 1
jmp 0x1004982b
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x32c]
neg eax
cmp eax, dword [ebp - 0xa0]
jl 0x10049847
mov dword [ebp - 0x334], 1
jmp 0x1004984e
and dword [ebp - 0x334], 0
push 0
lea ecx, [ebp - 0x2c0]
call fcn.100171a9
push dword [eax]
lea ecx, [ebp - 0x5c0]
call fcn.100171a9
mov ecx, dword [ebp - 0x334]
cmp ecx, dword [eax]
jl 0x1004987e
mov dword [ebp - 0x2d0], 1
jmp 0x10049885
and dword [ebp - 0x2d0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2d0]
mov dword [ebp + eax - 0x7fc], ecx
jmp 0x10049763
mov byte [ebp - 0x88], 0
lea eax, [ebp - 0x88]
push eax
push 0
push 0x74a3
push 0x55ef
call fcn.10046b07
add esp, 0x10
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x2c0]
call fcn.1001718d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c0]
call fcn.1001718d
jmp 0x10049687
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x18], 0
jbe 0x1004993c
push 0x4539
push 0x842
push 1
push 0x2202
lea eax, [ebp - 0xd4]
push eax
push 0x3774
push 0x1a4d
push 0x576b
push 0x3037
push 0x44ef
lea eax, [ebp - 0x10]
push eax
push 0x66fa
push 0x1e86
push 0x7c29
push 0x47e3
call fcn.10045910
add esp, 0x3c
mov dword [ebp - 0x764], 0x92ea
mov dword [ebp - 0x54], 0
jmp 0x10049956
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x1004996c
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x668], 0x69fdf99f
jmp 0x1004994f
mov dword [ebp - 0x54], 0
jmp 0x1004997c
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x10049992
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x788], 1
jmp 0x10049975
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x668], 0
jmp 0x100499c0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x668]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x668], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x668], 0x13
je 0x10049b10
mov dword [ebp - 0x4c], 0xfffffffe
mov dword [ebp - 0x4c], 0
jmp 0x100499eb
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jg 0x10049b0b
mov dword [ebp - 0x6b4], 6
mov dword [ebp - 0x6b0], 6
mov dword [ebp - 0x6ac], 6
mov dword [ebp - 0x6a8], 6
lea ecx, [ebp - 0x25d]
call fcn.100171b8
push eax
lea eax, [ebp - 0x6a4]
push eax
lea eax, [ebp - 0x6b4]
push eax
lea ecx, [ebp - 0x86c]
call fcn.100171bb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x798]
call fcn.10017167
mov dword [ebp - 4], 0x12
cmp dword [ebp - 0x4c], 0
jne 0x10049a6b
mov dword [ebp - 0x344], 1
jmp 0x10049a72
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x788]
imul eax, dword [ebp - 0x344]
cmp dword [ebp - 0x4c], eax
jle 0x10049a94
mov dword [ebp - 0x34c], 1
jmp 0x10049a9b
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x34c], eax
je 0x10049ab2
mov dword [ebp - 0x354], 1
jmp 0x10049ab9
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x354], eax
jl 0x10049ad0
mov dword [ebp - 0x35c], 1
jmp 0x10049ad7
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x4c]
mov esi, dword [ebp + eax*4 - 0x788]
imul esi, dword [ebp - 0x35c]
push 1
lea ecx, [ebp - 0x798]
call fcn.100171a9
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x798]
call fcn.1001718d
jmp 0x100499e4
jmp 0x100499a5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x384], 0xfffffff7
mov dword [ebp - 0x364], 0xffffffff
mov dword [ebp - 0x374], 0x26d2e858
mov dword [ebp - 0x37c], 9
mov dword [ebp - 0x58c], 0xffffffff
mov dword [ebp - 0x13c], 0
jmp 0x10049b64
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 3
jge 0x10049b80
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x81c], 1
jmp 0x10049b57
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x374]
cmp dword [ebp - 0x364], eax
jl 0x10049ba6
mov dword [ebp - 0x36c], 1
jmp 0x10049bad
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x36c]
sub eax, dword [ebp - 0x374]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x38c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x38c]
mov dword [ebp + eax - 0x81c], ecx
mov eax, dword [ebp - 0x384]
cmp eax, dword [ebp - 0x38c]
jge 0x10049bf8
mov dword [ebp - 0x394], 1
jmp 0x10049bff
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x58c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
sub eax, dword [ebp - 0xd4]
mov dword [ebp - 0x9c], eax
push 4
lea ecx, [ebp - 0x748]
call fcn.1001710b
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x5f4], 0xfffffffe
mov dword [ebp - 0x5ec], 6
mov dword [ebp - 0x594], 0x9b37d022
lea eax, [ebp - 0x7bc]
push eax
push 1
push 0x6aa7
lea eax, [ebp - 0x748]
push eax
push 0x2d3a
call fcn.10045c27
add esp, 0x14
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x10049c8b
push 0x1d93
push 1
call fcn.10045cd1
pop ecx
pop ecx
lea eax, [ebp - 0x748]
push eax
push 0x3abf
push 0
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0x594]
push eax
push 0x61b6
lea eax, [ebp - 0x5f4]
push eax
push 0x76d6
call fcn.10045e87
add esp, 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x748]
call fcn.1001718d
and dword [ebp - 0xac], 0
jmp 0x10049ce5
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x9c]
jge 0x10049da9
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
sub eax, dword [ecx + 0x18]
cmp dword [ebp - 0xac], eax
jae 0x10049d4a
push 0x664c
push 0
lea eax, [ebp - 0x10]
push eax
push 0x44a5
lea eax, [ebp - 0x39c]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x4b53
push 0x12ce
lea eax, [ebp - 0xac]
push eax
push 0xefe
lea eax, [ebp - 0x28]
push eax
call fcn.100468c2
add esp, 0x2c
jmp 0x10049d6a
mov eax, dword [ebp - 0x60]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x60]
add eax, dword [ecx + 0x10]
push eax
mov eax, dword [ebp - 0x60]
push dword [eax + 0x14]
call fcn.1004123b
pop ecx
pop ecx
mov dword [ebp - 0x39c], eax
lea eax, [ebp - 0x39c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x4657
push 1
lea eax, [ebp - 0x18]
push eax
call fcn.10045d11
add esp, 0x18
push 0x87d
push 1
lea eax, [ebp - 0x18]
push eax
push 0x7c29
call fcn.10045d8a
add esp, 0x10
jmp 0x10049cd8
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
sub eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x14], eax
mov dword [ebp - 0x7c], 0x6652d0da
mov dword [ebp - 0x3dc], 0xbed1
push 1
lea ecx, [ebp - 0x6e8]
call fcn.1001710b
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x5c], 0
jmp 0x10049df0
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x10049e06
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x5d0], 1
jmp 0x10049de9
mov dword [ebp - 0x5c], 0
jmp 0x10049e16
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x10049e32
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x6e8]
call fcn.100171a9
mov dword [eax], 0xacd4a797
jmp 0x10049e0f
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x800], eax
cmp dword [ebp - 0x7c], 1
jne 0x10049e4d
mov dword [ebp - 0x3a4], 1
jmp 0x10049e54
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x3a4], eax
jge 0x10049e6b
mov dword [ebp - 0x3ac], 1
jmp 0x10049e72
and dword [ebp - 0x3ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5d0]
imul eax, dword [ebp - 0x3ac]
cmp eax, dword [ebp - 0x7c]
je 0x10049e97
mov dword [ebp - 0x3b4], 1
jmp 0x10049e9e
and dword [ebp - 0x3b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5d0]
cmp dword [ebp - 0x3b4], eax
jne 0x10049ebf
mov eax, dword [ebp + 8]
mov dword [ebp - 0x558], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x560], eax
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x180]
mov dword [eax], 0
jmp 0x1004af34
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x180]
mov dword [ecx], eax
mov eax, dword [ebp - 0x180]
cmp dword [eax], 0xb
jle 0x1004af84
mov dword [ebp - 0x484], 0xffffffff
mov eax, dword [ebp - 0x17c]
mov dword [eax], 0
jmp 0x1004af68
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x17c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x17c]
cmp dword [eax], 0
jg 0x1004af82
mov eax, dword [ebp - 0x484]
inc eax
mov dword [ebp - 0x484], eax
jmp 0x1004af57
jmp 0x1004af23
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret