Function at 0x406df0
Capabilities:
Create thread
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e53f
mov eax, dword fs:[0]
push eax
sub esp, 0x9c4
mov eax, dword [0x604e14]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8d4], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 8], 0xfffffffe
jne 0x406e5d
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [edx]
cmp ecx, dword [eax + 0x15a0]
jne 0x406e5d
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x8d4]
call fcn.0040e800
jmp 0x40afe2
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 8], 0xfffffffb
jne 0x406e91
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [edx]
cmp ecx, dword [eax + 0x15a0]
jne 0x406e91
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x8d4]
call fcn.0040e880
jmp 0x40afe2
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 8], 1
jne 0x406f08
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [edx]
cmp ecx, dword [eax + 0x1754]
jne 0x406f08
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x14], 0
je 0x406f08
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x1734
call fcn.00505fe0
test eax, eax
je 0x406eff
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x1734
call fcn.00505fe0
mov dword [ebp - 0x10], eax
jmp 0x406ecc
mov edx, dword [ebp - 0x10]
mov dword [0x608fec], edx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 8], 0
jne 0x406fa1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x8d4]
mov eax, dword [ecx]
cmp eax, dword [edx + 0x15a0]
jne 0x406fa1
mov ecx, dword [ebp - 0x8d4]
call fcn.0040e680
test eax, eax
je 0x406fa1
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0xc]
push ecx
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x1580
call fcn.004d5390
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
push 1
push 1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x41c]
push ecx
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x1734
call fcn.00506050
cmp dword [0x606aa8], 0
je 0x406f9c
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x62c]
push eax
mov ecx, dword [ebp - 0x8d4]
call fcn.0040e750
jmp 0x40afe2
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 8], 1
jne 0x40afe2
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [edx]
cmp ecx, dword [eax + 0x1754]
jne 0x40afe2
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x44c], edx
push 1
push str.Open
mov ecx, dword [ebp - 0x8d4]
add ecx, 0xa70
call fcn.004cd2d0
push 1
push str.Save
mov ecx, dword [ebp - 0x8d4]
add ecx, 0xe20
call fcn.004cd2d0
mov eax, dword [ebp - 0x8d4]
cmp dword [eax + 0xa6c], 0
je 0x40707e
push 0
mov ecx, dword [ebp - 0x8d4]
mov ecx, dword [ecx + 0xa6c]
call fcn.00531845
mov edx, dword [ebp - 0x8d4]
mov eax, dword [edx + 0xa6c]
mov dword [ebp - 0x6e0], eax
mov ecx, dword [ebp - 0x6e0]
mov dword [ebp - 0x6dc], ecx
cmp dword [ebp - 0x6dc], 0
je 0x407064
push 1
mov edx, dword [ebp - 0x6dc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x6dc]
mov edx, dword [eax + 4]
call edx
mov dword [ebp - 0x8d8], eax
jmp 0x40706e
mov dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x8d4]
mov dword [eax + 0xa6c], 0
mov ecx, dword [ebp - 0x44c]
cmp dword [ecx + 0x14], 0
je 0x407281
mov edx, dword [ebp - 0x44c]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x1734
call fcn.00505fe0
test eax, eax
je 0x4070cd
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x1734
call fcn.00505fe0
mov dword [ebp - 0x10], eax
jmp 0x40709a
push 0x606a38
call fcn.0045b4b0
add esp, 4
mov eax, 1
test eax, eax
je 0x40710d
push 0x606a38
call fcn.0045b530
add esp, 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x4070fb
jmp 0x40710d
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0x62c]
cmp edx, dword [ebp - 0x10]
jne 0x40710b
jmp 0x40710d
jmp 0x4070da
cmp dword [ebp - 0x28], 0
jne 0x407118
jmp 0x40afe2
xor eax, eax
mov ecx, dword [ebp - 0x28]
mov word [ecx + 0x420], ax
mov edx, dword [0x606ad4]
cmp edx, dword [ebp - 0x10]
je 0x40723b
mov eax, dword [ebp - 0x8d4]
add eax, 0x800
push eax
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x38c
push ecx
push 0
push 0
mov edx, dword [ebp - 0x28]
push edx
call fcn.00556bb2
add esp, 0x14
mov eax, dword [ebp - 0x8d4]
add eax, 0x800
push eax
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x38c
push ecx
call fcn.0055716c
add esp, 8
mov edx, dword [ebp - 0x8d4]
add edx, 0x38c
push edx
push str.CFF_Explorer_VIII
push 0x592f84
mov eax, dword [ebp - 0x8d4]
add eax, 0x800
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x800
push ecx
mov ecx, dword [ebp - 0x8d4]
call fcn.00533c0b
mov dword [ebp - 0x450], 0
jmp 0x4071dc
mov edx, dword [ebp - 0x450]
add edx, 1
mov dword [ebp - 0x450], edx
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x1580
call fcn.0040f0e0
cmp dword [ebp - 0x450], eax
jge 0x40723b
lea eax, [ebp - 0x454]
push eax
mov ecx, dword [ebp - 0x450]
push ecx
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x1580
call fcn.004d5390
mov edx, dword [ebp - 0x454]
cmp edx, dword [ebp - 0x28]
jne 0x407239
mov eax, dword [ebp - 0x450]
push eax
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x1580
call fcn.004d4ff0
jmp 0x40723b
jmp 0x4071cd
mov ecx, dword [ebp - 0x10]
mov dword [0x606ad4], ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x208]
mov dword [ebp - 0x444], eax
mov ecx, dword [ebp - 0x44c]
cmp dword [ecx + 0x14], 0
je 0x407271
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44c]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x41c], ecx
cmp dword [ebp - 0x444], 0
jne 0x40727f
jmp 0x40afe2
jmp 0x407286
jmp 0x40afe2
mov edx, dword [ebp - 0x8d4]
add edx, 0x800
push edx
mov eax, dword [ebp - 0x8d4]
add eax, 0x38c
push eax
push 0
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.00556bb2
add esp, 0x14
mov edx, dword [ebp - 0x8d4]
add edx, 0x800
push edx
mov eax, dword [ebp - 0x8d4]
add eax, 0x38c
push eax
call fcn.0055716c
add esp, 8
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x38c
push ecx
push 0x592f98
mov edx, dword [ebp - 0x8d4]
add edx, 0x800
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x44c]
mov edx, dword [eax + 0x62c]
cmp edx, dword [ecx + 0x14]
je 0x407341
mov eax, dword [ebp - 0x8d4]
add eax, 0x800
push eax
mov ecx, dword [ebp - 0x44c]
mov ecx, dword [ecx + 0x14]
add ecx, 4
call fcn.0040eb80
push eax
push str._s____s
lea edx, [ebp - 0x43c]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x407362
mov eax, dword [ebp - 0x8d4]
add eax, 0x800
push eax
push str.File_Info____s
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov edx, dword [ebp - 0x8d4]
cmp dword [edx + 0x1894], 1
jne 0x4074b5
push 0x608fac
call fcn.0045b4b0
add esp, 4
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x458], 0
mov ecx, dword [ebp - 0x45c]
movzx edx, word [ecx]
cmp edx, 0x2d
je 0x4073c6
mov eax, dword [ebp - 0x458]
add eax, 1
mov dword [ebp - 0x458], eax
mov ecx, dword [ebp - 0x45c]
add ecx, 2
mov dword [ebp - 0x45c], ecx
jmp 0x407398
mov edx, dword [ebp - 0x458]
sub edx, 1
mov dword [ebp - 0x458], edx
mov eax, dword [ebp - 0x458]
push eax
lea ecx, [ebp - 0x43c]
push ecx
push 0x104
mov edx, dword [ebp - 0x8d4]
add edx, 0x38c
push edx
call fcn.00556018
add esp, 0x10
mov eax, 1
test eax, eax
je 0x4074b5
push 0x608fac
call fcn.0045b530
add esp, 4
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0
jne 0x40742b
jmp 0x4074b5
mov ecx, dword [ebp - 0x460]
mov edx, dword [ecx + 4]
cmp edx, dword [ebp - 0x10]
jne 0x4074b0
push 0x104
mov eax, dword [ebp - 0x8d4]
add eax, 0x800
push eax
mov ecx, dword [ebp - 0x460]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebp - 0x458]
push eax
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x38c
push ecx
mov edx, dword [ebp - 0x8d4]
add edx, 0x800
push edx
call fcn.005571b9
add esp, 0xc
test eax, eax
jne 0x4074b0
push 9
mov eax, dword [ebp - 0x460]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 0x460]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, 1
jmp 0x40aff9
jmp 0x4073fd
mov ecx, dword [ebp - 0x44c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x44c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x2c]
mov dword [ebp - 0x440], eax
mov ecx, dword [ebp - 0x44c]
cmp dword [ecx + 0x14], 0
jne 0x4074ea
jmp 0x40af32
mov edx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [edx + 0x14]
cmp ecx, dword [eax + 0x62c]
jne 0x40787d
push 0xd3c
call fcn.0040ec40
mov dword [ebp - 0x6e8], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x6e8], 0
je 0x407537
push 0
mov ecx, dword [ebp - 0x6e8]
call fcn.00423c30
mov dword [ebp - 0x8dc], eax
jmp 0x407541
mov dword [ebp - 0x8dc], 0
mov edx, dword [ebp - 0x8dc]
mov dword [ebp - 0x6e4], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0x464], eax
mov ecx, dword [ebp - 0x464]
mov edx, dword [ebp - 0x444]
mov dword [ecx + 0x170], edx
mov eax, dword [ebp - 0x464]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0x628]
mov dword [eax + 0x174], edx
mov eax, dword [ebp - 0x464]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 0x178], ecx
mov edx, dword [ebp - 0x28]
add edx, 0x20c
mov eax, dword [ebp - 0x464]
mov dword [eax + 0x180], edx
mov ecx, dword [ebp - 0x444]
call fcn.0045bd20
test eax, eax
je 0x407630
mov ecx, dword [ebp - 0x444]
call fcn.004612d0
cmp eax, 1
jne 0x4075fd
mov ecx, dword [ebp - 0x444]
call fcn.004615d0
test eax, eax
jne 0x4075eb
mov ecx, dword [ebp - 0x464]
mov dword [ecx + 0x17c], 0x592fd4
jmp 0x4075fb
mov edx, dword [ebp - 0x464]
mov dword [edx + 0x17c], 0x593008
jmp 0x40762e
mov ecx, dword [ebp - 0x444]
call fcn.004615d0
test eax, eax
jne 0x40761e
mov eax, dword [ebp - 0x464]
mov dword [eax + 0x17c], 0x593054
jmp 0x40762e
mov ecx, dword [ebp - 0x464]
mov dword [ecx + 0x17c], 0x593088
jmp 0x407640
mov edx, dword [ebp - 0x464]
mov dword [edx + 0x17c], 0x5930d4
mov eax, dword [ebp - 0x8d4]
cmp dword [eax + 0x1894], 0
je 0x407844
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x6f0], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x6f0], 0
je 0x407689
mov ecx, dword [ebp - 0x6f0]
call fcn.004dff40
mov dword [ebp - 0x8e0], eax
jmp 0x407693
mov dword [ebp - 0x8e0], 0
mov ecx, dword [ebp - 0x8e0]
mov dword [ebp - 0x6ec], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x6ec]
mov dword [ebp - 0x468], edx
mov eax, dword [ebp - 0x468]
mov ecx, dword [ebp - 0x464]
mov dword [eax + 0x20c], ecx
mov edx, dword [ebp - 0x468]
mov dword [edx + 0x210], 0x85
mov eax, dword [ebp - 0x8d4]
add eax, 0x800
push eax
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x38c
push ecx
push 0
push 0
mov edx, dword [ebp - 0x28]
push edx
call fcn.00556bb2
add esp, 0x14
mov eax, dword [ebp - 0x8d4]
add eax, 0x800
push eax
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x38c
push ecx
call fcn.0055716c
add esp, 8
mov edx, dword [ebp - 0x8d4]
add edx, 0x38c
push edx
call fcn.005560eb
add esp, 4
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 5
jae 0x407755
mov eax, dword [ebp - 0x468]
mov ecx, dword [0x606810]
mov dword [eax], ecx
jmp 0x4077fa
mov edx, dword [ebp - 0x46c]
mov eax, dword [ebp - 0x8d4]
lea ecx, [eax + edx*2 + 0x384]
push ecx
mov edx, dword [ebp - 0x8d4]
add edx, 0x38c
push edx
call fcn.0055719a
add esp, 8
mov eax, dword [ebp - 0x8d4]
add eax, 0x38c
push eax
call fcn.005568e7
add esp, 4
push 0x5930f4
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x38c
push ecx
call fcn.00557135
add esp, 8
test eax, eax
jne 0x4077bf
mov edx, dword [ebp - 0x468]
mov eax, dword [0x606818]
mov dword [edx], eax
jmp 0x4077fa
push 0x593100
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x38c
push ecx
call fcn.00557135
add esp, 8
test eax, eax
jne 0x4077ec
mov edx, dword [ebp - 0x468]
mov eax, dword [0x606814]
mov dword [edx], eax
jmp 0x4077fa
mov ecx, dword [ebp - 0x468]
mov edx, dword [0x606810]
mov dword [ecx], edx
lea eax, [ebp - 0x43c]
push eax
push 0x104
mov ecx, dword [ebp - 0x468]
add ecx, 4
push ecx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov edx, dword [ebp - 0x468]
push edx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x8d4]
mov dword [eax + 0xa6c], 0
jmp 0x407878
mov ecx, dword [ebp - 0x8d4]
push ecx
push 0x85
mov edx, dword [ebp - 0x464]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x464]
mov edx, dword [eax + 0x13c]
call edx
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [ebp - 0x464]
mov dword [eax + 0xa6c], ecx
jmp 0x40af32
mov edx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [edx + 0x14]
cmp ecx, dword [eax + 0x630]
jne 0x407a2a
push 0x598
call fcn.0040ec40
mov dword [ebp - 0x6f8], eax
mov dword [ebp - 4], 2
cmp dword [ebp - 0x6f8], 0
je 0x4078ca
push 0
mov ecx, dword [ebp - 0x6f8]
call fcn.0041ba30
mov dword [ebp - 0x8e4], eax
jmp 0x4078d4
mov dword [ebp - 0x8e4], 0
mov edx, dword [ebp - 0x8e4]
mov dword [ebp - 0x6f4], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x470], eax
mov ecx, dword [ebp - 0x470]
mov edx, dword [ebp - 0x444]
mov dword [ecx + 0x170], edx
mov eax, dword [ebp - 0x8d4]
cmp dword [eax + 0x1894], 0
je 0x4079f1
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x700], eax
mov dword [ebp - 4], 3
cmp dword [ebp - 0x700], 0
je 0x40794e
mov ecx, dword [ebp - 0x700]
call fcn.004dff40
mov dword [ebp - 0x8e8], eax
jmp 0x407958
mov dword [ebp - 0x8e8], 0
mov ecx, dword [ebp - 0x8e8]
mov dword [ebp - 0x6fc], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x6fc]
mov dword [ebp - 0x474], edx
mov eax, dword [ebp - 0x474]
mov ecx, dword [ebp - 0x470]
mov dword [eax + 0x20c], ecx
mov edx, dword [ebp - 0x474]
mov dword [edx + 0x210], 0x84
mov eax, dword [ebp - 0x474]
mov ecx, dword [0x60682c]
mov dword [eax], ecx
lea edx, [ebp - 0x43c]
push edx
push 0x104
mov eax, dword [ebp - 0x474]
add eax, 4
push eax
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov ecx, dword [ebp - 0x474]
push ecx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x8d4]
mov dword [edx + 0xa6c], 0
jmp 0x407a25
mov eax, dword [ebp - 0x8d4]
push eax
push 0x84
mov ecx, dword [ebp - 0x470]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x470]
mov eax, dword [edx + 0x13c]
call eax
mov ecx, dword [ebp - 0x8d4]
mov edx, dword [ebp - 0x470]
mov dword [ecx + 0xa6c], edx
jmp 0x40af32
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
cmp edx, dword [ecx + 0x634]
jne 0x407bd7
push 0x598
call fcn.0040ec40
mov dword [ebp - 0x708], eax
mov dword [ebp - 4], 4
cmp dword [ebp - 0x708], 0
je 0x407a77
push 0
mov ecx, dword [ebp - 0x708]
call fcn.00442a20
mov dword [ebp - 0x8ec], eax
jmp 0x407a81
mov dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x8ec]
mov dword [ebp - 0x704], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x704]
mov dword [ebp - 0x478], ecx
mov edx, dword [ebp - 0x478]
mov eax, dword [ebp - 0x444]
mov dword [edx + 0x170], eax
mov ecx, dword [ebp - 0x8d4]
cmp dword [ecx + 0x1894], 0
je 0x407b9e
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x710], eax
mov dword [ebp - 4], 5
cmp dword [ebp - 0x710], 0
je 0x407afb
mov ecx, dword [ebp - 0x710]
call fcn.004dff40
mov dword [ebp - 0x8f0], eax
jmp 0x407b05
mov dword [ebp - 0x8f0], 0
mov edx, dword [ebp - 0x8f0]
mov dword [ebp - 0x70c], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x47c], eax
mov ecx, dword [ebp - 0x47c]
mov edx, dword [ebp - 0x478]
mov dword [ecx + 0x20c], edx
mov eax, dword [ebp - 0x47c]
mov dword [eax + 0x210], 0x84
mov ecx, dword [ebp - 0x47c]
mov edx, dword [0x60682c]
mov dword [ecx], edx
lea eax, [ebp - 0x43c]
push eax
push 0x104
mov ecx, dword [ebp - 0x47c]
add ecx, 4
push ecx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov edx, dword [ebp - 0x47c]
push edx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x8d4]
mov dword [eax + 0xa6c], 0
jmp 0x407bd2
mov ecx, dword [ebp - 0x8d4]
push ecx
push 0x84
mov edx, dword [ebp - 0x478]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x478]
mov edx, dword [eax + 0x13c]
call edx
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [ebp - 0x478]
mov dword [eax + 0xa6c], ecx
jmp 0x40af32
mov edx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [edx + 0x14]
cmp ecx, dword [eax + 0x638]
jne 0x407d84
push 0x620
call fcn.0040ec40
mov dword [ebp - 0x718], eax
mov dword [ebp - 4], 6
cmp dword [ebp - 0x718], 0
je 0x407c24
push 0
mov ecx, dword [ebp - 0x718]
call fcn.004224d0
mov dword [ebp - 0x8f4], eax
jmp 0x407c2e
mov dword [ebp - 0x8f4], 0
mov edx, dword [ebp - 0x8f4]
mov dword [ebp - 0x714], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x714]
mov dword [ebp - 0x480], eax
mov ecx, dword [ebp - 0x480]
mov edx, dword [ebp - 0x444]
mov dword [ecx + 0x170], edx
mov eax, dword [ebp - 0x8d4]
cmp dword [eax + 0x1894], 0
je 0x407d4b
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x720], eax
mov dword [ebp - 4], 7
cmp dword [ebp - 0x720], 0
je 0x407ca8
mov ecx, dword [ebp - 0x720]
call fcn.004dff40
mov dword [ebp - 0x8f8], eax
jmp 0x407cb2
mov dword [ebp - 0x8f8], 0
mov ecx, dword [ebp - 0x8f8]
mov dword [ebp - 0x71c], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x71c]
mov dword [ebp - 0x484], edx
mov eax, dword [ebp - 0x484]
mov ecx, dword [ebp - 0x480]
mov dword [eax + 0x20c], ecx
mov edx, dword [ebp - 0x484]
mov dword [edx + 0x210], 0x84
mov eax, dword [ebp - 0x484]
mov ecx, dword [0x60682c]
mov dword [eax], ecx
lea edx, [ebp - 0x43c]
push edx
push 0x104
mov eax, dword [ebp - 0x484]
add eax, 4
push eax
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov ecx, dword [ebp - 0x484]
push ecx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x8d4]
mov dword [edx + 0xa6c], 0
jmp 0x407d7f
mov eax, dword [ebp - 0x8d4]
push eax
push 0x84
mov ecx, dword [ebp - 0x480]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x480]
mov eax, dword [edx + 0x13c]
call eax
mov ecx, dword [ebp - 0x8d4]
mov edx, dword [ebp - 0x480]
mov dword [ecx + 0xa6c], edx
jmp 0x40af32
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
cmp edx, dword [ecx + 0x63c]
jne 0x407f31
push 0x620
call fcn.0040ec40
mov dword [ebp - 0x728], eax
mov dword [ebp - 4], 8
cmp dword [ebp - 0x728], 0
je 0x407dd1
push 0
mov ecx, dword [ebp - 0x728]
call fcn.00443480
mov dword [ebp - 0x8fc], eax
jmp 0x407ddb
mov dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x8fc]
mov dword [ebp - 0x724], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x724]
mov dword [ebp - 0x488], ecx
mov edx, dword [ebp - 0x488]
mov eax, dword [ebp - 0x444]
mov dword [edx + 0x170], eax
mov ecx, dword [ebp - 0x8d4]
cmp dword [ecx + 0x1894], 0
je 0x407ef8
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x730], eax
mov dword [ebp - 4], 9
cmp dword [ebp - 0x730], 0
je 0x407e55
mov ecx, dword [ebp - 0x730]
call fcn.004dff40
mov dword [ebp - 0x900], eax
jmp 0x407e5f
mov dword [ebp - 0x900], 0
mov edx, dword [ebp - 0x900]
mov dword [ebp - 0x72c], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x48c], eax
mov ecx, dword [ebp - 0x48c]
mov edx, dword [ebp - 0x488]
mov dword [ecx + 0x20c], edx
mov eax, dword [ebp - 0x48c]
mov dword [eax + 0x210], 0x84
mov ecx, dword [ebp - 0x48c]
mov edx, dword [0x60682c]
mov dword [ecx], edx
lea eax, [ebp - 0x43c]
push eax
push 0x104
mov ecx, dword [ebp - 0x48c]
add ecx, 4
push ecx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov edx, dword [ebp - 0x48c]
push edx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x8d4]
mov dword [eax + 0xa6c], 0
jmp 0x407f2c
mov ecx, dword [ebp - 0x8d4]
push ecx
push 0x84
mov edx, dword [ebp - 0x488]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x488]
mov edx, dword [eax + 0x13c]
call edx
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [ebp - 0x488]
mov dword [eax + 0xa6c], ecx
jmp 0x40af32
mov edx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [edx + 0x14]
cmp ecx, dword [eax + 0x640]
jne 0x4080de
push 0x620
call fcn.0040ec40
mov dword [ebp - 0x738], eax
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x738], 0
je 0x407f7e
push 0
mov ecx, dword [ebp - 0x738]
call fcn.00412e60
mov dword [ebp - 0x904], eax
jmp 0x407f88
mov dword [ebp - 0x904], 0
mov edx, dword [ebp - 0x904]
mov dword [ebp - 0x734], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0x490], eax
mov ecx, dword [ebp - 0x490]
mov edx, dword [ebp - 0x444]
mov dword [ecx + 0x170], edx
mov eax, dword [ebp - 0x8d4]
cmp dword [eax + 0x1894], 0
je 0x4080a5
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x740], eax
mov dword [ebp - 4], 0xb
cmp dword [ebp - 0x740], 0
je 0x408002
mov ecx, dword [ebp - 0x740]
call fcn.004dff40
mov dword [ebp - 0x908], eax
jmp 0x40800c
mov dword [ebp - 0x908], 0
mov ecx, dword [ebp - 0x908]
mov dword [ebp - 0x73c], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x73c]
mov dword [ebp - 0x494], edx
mov eax, dword [ebp - 0x494]
mov ecx, dword [ebp - 0x490]
mov dword [eax + 0x20c], ecx
mov edx, dword [ebp - 0x494]
mov dword [edx + 0x210], 0x84
mov eax, dword [ebp - 0x494]
mov ecx, dword [0x60682c]
mov dword [eax], ecx
lea edx, [ebp - 0x43c]
push edx
push 0x104
mov eax, dword [ebp - 0x494]
add eax, 4
push eax
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov ecx, dword [ebp - 0x494]
push ecx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x8d4]
mov dword [edx + 0xa6c], 0
jmp 0x4080d9
mov eax, dword [ebp - 0x8d4]
push eax
push 0x84
mov ecx, dword [ebp - 0x490]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x490]
mov eax, dword [edx + 0x13c]
call eax
mov ecx, dword [ebp - 0x8d4]
mov edx, dword [ebp - 0x490]
mov dword [ecx + 0xa6c], edx
jmp 0x40af32
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
cmp edx, dword [ecx + 0x644]
jne 0x40828b
push 0x26c4
call fcn.0040ec40
mov dword [ebp - 0x748], eax
mov dword [ebp - 4], 0xc
cmp dword [ebp - 0x748], 0
je 0x40812b
push 0
mov ecx, dword [ebp - 0x748]
call fcn.00457ba0
mov dword [ebp - 0x90c], eax
jmp 0x408135
mov dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x744], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x744]
mov dword [ebp - 0x498], ecx
mov edx, dword [ebp - 0x498]
mov eax, dword [ebp - 0x444]
mov dword [edx + 0x170], eax
mov ecx, dword [ebp - 0x8d4]
cmp dword [ecx + 0x1894], 0
je 0x408252
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x750], eax
mov dword [ebp - 4], 0xd
cmp dword [ebp - 0x750], 0
je 0x4081af
mov ecx, dword [ebp - 0x750]
call fcn.004dff40
mov dword [ebp - 0x910], eax
jmp 0x4081b9
mov dword [ebp - 0x910], 0
mov edx, dword [ebp - 0x910]
mov dword [ebp - 0x74c], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x49c], eax
mov ecx, dword [ebp - 0x49c]
mov edx, dword [ebp - 0x498]
mov dword [ecx + 0x20c], edx
mov eax, dword [ebp - 0x49c]
mov dword [eax + 0x210], 0x84
mov ecx, dword [ebp - 0x49c]
mov edx, dword [0x60682c]
mov dword [ecx], edx
lea eax, [ebp - 0x43c]
push eax
push 0x104
mov ecx, dword [ebp - 0x49c]
add ecx, 4
push ecx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov edx, dword [ebp - 0x49c]
push edx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x8d4]
mov dword [eax + 0xa6c], 0
jmp 0x408286
mov ecx, dword [ebp - 0x8d4]
push ecx
push 0x84
mov edx, dword [ebp - 0x498]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x498]
mov edx, dword [eax + 0x13c]
call edx
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [ebp - 0x498]
mov dword [eax + 0xa6c], ecx
jmp 0x40af32
mov edx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [edx + 0x14]
cmp ecx, dword [eax + 0x648]
jne 0x408438
push 0x2ec0
call fcn.0040ec40
mov dword [ebp - 0x758], eax
mov dword [ebp - 4], 0xe
cmp dword [ebp - 0x758], 0
je 0x4082d8
push 0
mov ecx, dword [ebp - 0x758]
call fcn.00421d10
mov dword [ebp - 0x914], eax
jmp 0x4082e2
mov dword [ebp - 0x914], 0
mov edx, dword [ebp - 0x914]
mov dword [ebp - 0x754], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x4a0], eax
mov ecx, dword [ebp - 0x4a0]
mov edx, dword [ebp - 0x444]
mov dword [ecx + 0x170], edx
mov eax, dword [ebp - 0x8d4]
cmp dword [eax + 0x1894], 0
je 0x4083ff
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x760], eax
mov dword [ebp - 4], 0xf
cmp dword [ebp - 0x760], 0
je 0x40835c
mov ecx, dword [ebp - 0x760]
call fcn.004dff40
mov dword [ebp - 0x918], eax
jmp 0x408366
mov dword [ebp - 0x918], 0
mov ecx, dword [ebp - 0x918]
mov dword [ebp - 0x75c], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x75c]
mov dword [ebp - 0x4a4], edx
mov eax, dword [ebp - 0x4a4]
mov ecx, dword [ebp - 0x4a0]
mov dword [eax + 0x20c], ecx
mov edx, dword [ebp - 0x4a4]
mov dword [edx + 0x210], 0xd4
mov eax, dword [ebp - 0x4a4]
mov ecx, dword [0x606828]
mov dword [eax], ecx
lea edx, [ebp - 0x43c]
push edx
push 0x104
mov eax, dword [ebp - 0x4a4]
add eax, 4
push eax
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov ecx, dword [ebp - 0x4a4]
push ecx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x8d4]
mov dword [edx + 0xa6c], 0
jmp 0x408433
mov eax, dword [ebp - 0x8d4]
push eax
push 0xd4
mov ecx, dword [ebp - 0x4a0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x4a0]
mov eax, dword [edx + 0x13c]
call eax
mov ecx, dword [ebp - 0x8d4]
mov edx, dword [ebp - 0x4a0]
mov dword [ecx + 0xa6c], edx
jmp 0x40af32
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
cmp edx, dword [ecx + 0x64c]
jne 0x4085e5
push 0x2f4c
call fcn.0040ec40
mov dword [ebp - 0x768], eax
mov dword [ebp - 4], 0x10
cmp dword [ebp - 0x768], 0
je 0x408485
push 0
mov ecx, dword [ebp - 0x768]
call fcn.00438f60
mov dword [ebp - 0x91c], eax
jmp 0x40848f
mov dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x764], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x764]
mov dword [ebp - 0x4a8], ecx
mov edx, dword [ebp - 0x4a8]
mov eax, dword [ebp - 0x444]
mov dword [edx + 0x170], eax
mov ecx, dword [ebp - 0x8d4]
cmp dword [ecx + 0x1894], 0
je 0x4085ac
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x770], eax
mov dword [ebp - 4], 0x11
cmp dword [ebp - 0x770], 0
je 0x408509
mov ecx, dword [ebp - 0x770]
call fcn.004dff40
mov dword [ebp - 0x920], eax
jmp 0x408513
mov dword [ebp - 0x920], 0
mov edx, dword [ebp - 0x920]
mov dword [ebp - 0x76c], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x76c]
mov dword [ebp - 0x4ac], eax
mov ecx, dword [ebp - 0x4ac]
mov edx, dword [ebp - 0x4a8]
mov dword [ecx + 0x20c], edx
mov eax, dword [ebp - 0x4ac]
mov dword [eax + 0x210], 0xd4
mov ecx, dword [ebp - 0x4ac]
mov edx, dword [0x606828]
mov dword [ecx], edx
lea eax, [ebp - 0x43c]
push eax
push 0x104
mov ecx, dword [ebp - 0x4ac]
add ecx, 4
push ecx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov edx, dword [ebp - 0x4ac]
push edx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x8d4]
mov dword [eax + 0xa6c], 0
jmp 0x4085e0
mov ecx, dword [ebp - 0x8d4]
push ecx
push 0xd4
mov edx, dword [ebp - 0x4a8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4a8]
mov edx, dword [eax + 0x13c]
call edx
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [ebp - 0x4a8]
mov dword [eax + 0xa6c], ecx
jmp 0x40af32
mov edx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [edx + 0x14]
cmp ecx, dword [eax + 0x650]
jne 0x408792
push 0xb64
call fcn.0040ec40
mov dword [ebp - 0x778], eax
mov dword [ebp - 4], 0x12
cmp dword [ebp - 0x778], 0
je 0x408632
push 0
mov ecx, dword [ebp - 0x778]
call fcn.0044bad0
mov dword [ebp - 0x924], eax
jmp 0x40863c
mov dword [ebp - 0x924], 0
mov edx, dword [ebp - 0x924]
mov dword [ebp - 0x774], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x4b0], eax
mov ecx, dword [ebp - 0x4b0]
mov edx, dword [ebp - 0x444]
mov dword [ecx + 0x170], edx
mov eax, dword [ebp - 0x8d4]
cmp dword [eax + 0x1894], 0
je 0x408759
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x780], eax
mov dword [ebp - 4], 0x13
cmp dword [ebp - 0x780], 0
je 0x4086b6
mov ecx, dword [ebp - 0x780]
call fcn.004dff40
mov dword [ebp - 0x928], eax
jmp 0x4086c0
mov dword [ebp - 0x928], 0
mov ecx, dword [ebp - 0x928]
mov dword [ebp - 0x77c], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x77c]
mov dword [ebp - 0x4b4], edx
mov eax, dword [ebp - 0x4b4]
mov ecx, dword [ebp - 0x4b0]
mov dword [eax + 0x20c], ecx
mov edx, dword [ebp - 0x4b4]
mov dword [edx + 0x210], 0x8d
mov eax, dword [ebp - 0x4b4]
mov ecx, dword [0x606828]
mov dword [eax], ecx
lea edx, [ebp - 0x43c]
push edx
push 0x104
mov eax, dword [ebp - 0x4b4]
add eax, 4
push eax
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov ecx, dword [ebp - 0x4b4]
push ecx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x8d4]
mov dword [edx + 0xa6c], 0
jmp 0x40878d
mov eax, dword [ebp - 0x8d4]
push eax
push 0x8d
mov ecx, dword [ebp - 0x4b0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x4b0]
mov eax, dword [edx + 0x13c]
call eax
mov ecx, dword [ebp - 0x8d4]
mov edx, dword [ebp - 0x4b0]
mov dword [ecx + 0xa6c], edx
jmp 0x40af32
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
cmp edx, dword [ecx + 0x654]
jne 0x40893f
push 0xc28
call fcn.0040ec40
mov dword [ebp - 0x788], eax
mov dword [ebp - 4], 0x14
cmp dword [ebp - 0x788], 0
je 0x4087df
push 0
mov ecx, dword [ebp - 0x788]
call fcn.0041c3a0
mov dword [ebp - 0x92c], eax
jmp 0x4087e9
mov dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0x784], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x4b8], ecx
mov edx, dword [ebp - 0x4b8]
mov eax, dword [ebp - 0x444]
mov dword [edx + 0x170], eax
mov ecx, dword [ebp - 0x8d4]
cmp dword [ecx + 0x1894], 0
je 0x408906
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x790], eax
mov dword [ebp - 4], 0x15
cmp dword [ebp - 0x790], 0
je 0x408863
mov ecx, dword [ebp - 0x790]
call fcn.004dff40
mov dword [ebp - 0x930], eax
jmp 0x40886d
mov dword [ebp - 0x930], 0
mov edx, dword [ebp - 0x930]
mov dword [ebp - 0x78c], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x78c]
mov dword [ebp - 0x4bc], eax
mov ecx, dword [ebp - 0x4bc]
mov edx, dword [ebp - 0x4b8]
mov dword [ecx + 0x20c], edx
mov eax, dword [ebp - 0x4bc]
mov dword [eax + 0x210], 0x85
mov ecx, dword [ebp - 0x4bc]
mov edx, dword [0x606828]
mov dword [ecx], edx
lea eax, [ebp - 0x43c]
push eax
push 0x104
mov ecx, dword [ebp - 0x4bc]
add ecx, 4
push ecx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov edx, dword [ebp - 0x4bc]
push edx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x8d4]
mov dword [eax + 0xa6c], 0
jmp 0x40893a
mov ecx, dword [ebp - 0x8d4]
push ecx
push 0x85
mov edx, dword [ebp - 0x4b8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4b8]
mov edx, dword [eax + 0x13c]
call edx
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [ebp - 0x4b8]
mov dword [eax + 0xa6c], ecx
jmp 0x40af32
mov edx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [edx + 0x14]
cmp ecx, dword [eax + 0x658]
jne 0x408aec
push 0xc28
call fcn.0040ec40
mov dword [ebp - 0x798], eax
mov dword [ebp - 4], 0x16
cmp dword [ebp - 0x798], 0
je 0x40898c
push 0
mov ecx, dword [ebp - 0x798]
call fcn.00449a00
mov dword [ebp - 0x934], eax
jmp 0x408996
mov dword [ebp - 0x934], 0
mov edx, dword [ebp - 0x934]
mov dword [ebp - 0x794], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x4c0], eax
mov ecx, dword [ebp - 0x4c0]
mov edx, dword [ebp - 0x444]
mov dword [ecx + 0x170], edx
mov eax, dword [ebp - 0x8d4]
cmp dword [eax + 0x1894], 0
je 0x408ab3
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x7a0], eax
mov dword [ebp - 4], 0x17
cmp dword [ebp - 0x7a0], 0
je 0x408a10
mov ecx, dword [ebp - 0x7a0]
call fcn.004dff40
mov dword [ebp - 0x938], eax
jmp 0x408a1a
mov dword [ebp - 0x938], 0
mov ecx, dword [ebp - 0x938]
mov dword [ebp - 0x79c], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x79c]
mov dword [ebp - 0x4c4], edx
mov eax, dword [ebp - 0x4c4]
mov ecx, dword [ebp - 0x4c0]
mov dword [eax + 0x20c], ecx
mov edx, dword [ebp - 0x4c4]
mov dword [edx + 0x210], 0x85
mov eax, dword [ebp - 0x4c4]
mov ecx, dword [0x606828]
mov dword [eax], ecx
lea edx, [ebp - 0x43c]
push edx
push 0x104
mov eax, dword [ebp - 0x4c4]
add eax, 4
push eax
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov ecx, dword [ebp - 0x4c4]
push ecx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x8d4]
mov dword [edx + 0xa6c], 0
jmp 0x408ae7
mov eax, dword [ebp - 0x8d4]
push eax
push 0x85
mov ecx, dword [ebp - 0x4c0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x4c0]
mov eax, dword [edx + 0x13c]
call eax
mov ecx, dword [ebp - 0x8d4]
mov edx, dword [ebp - 0x4c0]
mov dword [ecx + 0xa6c], edx
jmp 0x40af32
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
cmp edx, dword [ecx + 0x65c]
jne 0x408c99
push 0x620
call fcn.0040ec40
mov dword [ebp - 0x7a8], eax
mov dword [ebp - 4], 0x18
cmp dword [ebp - 0x7a8], 0
je 0x408b39
push 0
mov ecx, dword [ebp - 0x7a8]
call fcn.004148d0
mov dword [ebp - 0x93c], eax
jmp 0x408b43
mov dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x93c]
mov dword [ebp - 0x7a4], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x7a4]
mov dword [ebp - 0x4c8], ecx
mov edx, dword [ebp - 0x4c8]
mov eax, dword [ebp - 0x444]
mov dword [edx + 0x170], eax
mov ecx, dword [ebp - 0x8d4]
cmp dword [ecx + 0x1894], 0
je 0x408c60
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x7b0], eax
mov dword [ebp - 4], 0x19
cmp dword [ebp - 0x7b0], 0
je 0x408bbd
mov ecx, dword [ebp - 0x7b0]
call fcn.004dff40
mov dword [ebp - 0x940], eax
jmp 0x408bc7
mov dword [ebp - 0x940], 0
mov edx, dword [ebp - 0x940]
mov dword [ebp - 0x7ac], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x7ac]
mov dword [ebp - 0x4cc], eax
mov ecx, dword [ebp - 0x4cc]
mov edx, dword [ebp - 0x4c8]
mov dword [ecx + 0x20c], edx
mov eax, dword [ebp - 0x4cc]
mov dword [eax + 0x210], 0x84
mov ecx, dword [ebp - 0x4cc]
mov edx, dword [0x606828]
mov dword [ecx], edx
lea eax, [ebp - 0x43c]
push eax
push 0x104
mov ecx, dword [ebp - 0x4cc]
add ecx, 4
push ecx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov edx, dword [ebp - 0x4cc]
push edx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x8d4]
mov dword [eax + 0xa6c], 0
jmp 0x408c94
mov ecx, dword [ebp - 0x8d4]
push ecx
push 0x84
mov edx, dword [ebp - 0x4c8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4c8]
mov edx, dword [eax + 0x13c]
call edx
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [ebp - 0x4c8]
mov dword [eax + 0xa6c], ecx
jmp 0x40af32
mov edx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [edx + 0x14]
cmp ecx, dword [eax + 0x660]
jne 0x408e46
push 0x598
call fcn.0040ec40
mov dword [ebp - 0x7b8], eax
mov dword [ebp - 4], 0x1a
cmp dword [ebp - 0x7b8], 0
je 0x408ce6
push 0
mov ecx, dword [ebp - 0x7b8]
call fcn.0045a6d0
mov dword [ebp - 0x944], eax
jmp 0x408cf0
mov dword [ebp - 0x944], 0
mov edx, dword [ebp - 0x944]
mov dword [ebp - 0x7b4], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0x4d0], eax
mov ecx, dword [ebp - 0x4d0]
mov edx, dword [ebp - 0x444]
mov dword [ecx + 0x170], edx
mov eax, dword [ebp - 0x8d4]
cmp dword [eax + 0x1894], 0
je 0x408e0d
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x7c0], eax
mov dword [ebp - 4], 0x1b
cmp dword [ebp - 0x7c0], 0
je 0x408d6a
mov ecx, dword [ebp - 0x7c0]
call fcn.004dff40
mov dword [ebp - 0x948], eax
jmp 0x408d74
mov dword [ebp - 0x948], 0
mov ecx, dword [ebp - 0x948]
mov dword [ebp - 0x7bc], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x7bc]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
mov ecx, dword [ebp - 0x4d0]
mov dword [eax + 0x20c], ecx
mov edx, dword [ebp - 0x4d4]
mov dword [edx + 0x210], 0x84
mov eax, dword [ebp - 0x4d4]
mov ecx, dword [0x606828]
mov dword [eax], ecx
lea edx, [ebp - 0x43c]
push edx
push 0x104
mov eax, dword [ebp - 0x4d4]
add eax, 4
push eax
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov ecx, dword [ebp - 0x4d4]
push ecx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x8d4]
mov dword [edx + 0xa6c], 0
jmp 0x408e41
mov eax, dword [ebp - 0x8d4]
push eax
push 0x84
mov ecx, dword [ebp - 0x4d0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x4d0]
mov eax, dword [edx + 0x13c]
call eax
mov ecx, dword [ebp - 0x8d4]
mov edx, dword [ebp - 0x4d0]
mov dword [ecx + 0xa6c], edx
jmp 0x40af32
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
cmp edx, dword [ecx + 0x664]
jne 0x408ff3
push 0x620
call fcn.0040ec40
mov dword [ebp - 0x7c8], eax
mov dword [ebp - 4], 0x1c
cmp dword [ebp - 0x7c8], 0
je 0x408e93
push 0
mov ecx, dword [ebp - 0x7c8]
call fcn.00441cb0
mov dword [ebp - 0x94c], eax
jmp 0x408e9d
mov dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x94c]
mov dword [ebp - 0x7c4], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x7c4]
mov dword [ebp - 0x4d8], ecx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [ebp - 0x444]
mov dword [edx + 0x170], eax
mov ecx, dword [ebp - 0x8d4]
cmp dword [ecx + 0x1894], 0
je 0x408fba
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x7d0], eax
mov dword [ebp - 4], 0x1d
cmp dword [ebp - 0x7d0], 0
je 0x408f17
mov ecx, dword [ebp - 0x7d0]
call fcn.004dff40
mov dword [ebp - 0x950], eax
jmp 0x408f21
mov dword [ebp - 0x950], 0
mov edx, dword [ebp - 0x950]
mov dword [ebp - 0x7cc], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x7cc]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
mov edx, dword [ebp - 0x4d8]
mov dword [ecx + 0x20c], edx
mov eax, dword [ebp - 0x4dc]
mov dword [eax + 0x210], 0x84
mov ecx, dword [ebp - 0x4dc]
mov edx, dword [0x606828]
mov dword [ecx], edx
lea eax, [ebp - 0x43c]
push eax
push 0x104
mov ecx, dword [ebp - 0x4dc]
add ecx, 4
push ecx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov edx, dword [ebp - 0x4dc]
push edx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x8d4]
mov dword [eax + 0xa6c], 0
jmp 0x408fee
mov ecx, dword [ebp - 0x8d4]
push ecx
push 0x84
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [eax + 0x13c]
call edx
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [ebp - 0x4d8]
mov dword [eax + 0xa6c], ecx
jmp 0x40af32
mov edx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [edx + 0x14]
cmp ecx, dword [eax + 0x668]
jne 0x4091a0
push 0x598
call fcn.0040ec40
mov dword [ebp - 0x7d8], eax
mov dword [ebp - 4], 0x1e
cmp dword [ebp - 0x7d8], 0
je 0x409040
push 0
mov ecx, dword [ebp - 0x7d8]
call fcn.004399c0
mov dword [ebp - 0x954], eax
jmp 0x40904a
mov dword [ebp - 0x954], 0
mov edx, dword [ebp - 0x954]
mov dword [ebp - 0x7d4], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x7d4]
mov dword [ebp - 0x4e0], eax
mov ecx, dword [ebp - 0x4e0]
mov edx, dword [ebp - 0x444]
mov dword [ecx + 0x170], edx
mov eax, dword [ebp - 0x8d4]
cmp dword [eax + 0x1894], 0
je 0x409167
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x7e0], eax
mov dword [ebp - 4], 0x1f
cmp dword [ebp - 0x7e0], 0
je 0x4090c4
mov ecx, dword [ebp - 0x7e0]
call fcn.004dff40
mov dword [ebp - 0x958], eax
jmp 0x4090ce
mov dword [ebp - 0x958], 0
mov ecx, dword [ebp - 0x958]
mov dword [ebp - 0x7dc], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x7dc]
mov dword [ebp - 0x4e4], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [ebp - 0x4e0]
mov dword [eax + 0x20c], ecx
mov edx, dword [ebp - 0x4e4]
mov dword [edx + 0x210], 0x84
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [0x60682c]
mov dword [eax], ecx
lea edx, [ebp - 0x43c]
push edx
push 0x104
mov eax, dword [ebp - 0x4e4]
add eax, 4
push eax
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov ecx, dword [ebp - 0x4e4]
push ecx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x8d4]
mov dword [edx + 0xa6c], 0
jmp 0x40919b
mov eax, dword [ebp - 0x8d4]
push eax
push 0x84
mov ecx, dword [ebp - 0x4e0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x4e0]
mov eax, dword [edx + 0x13c]
call eax
mov ecx, dword [ebp - 0x8d4]
mov edx, dword [ebp - 0x4e0]
mov dword [ecx + 0xa6c], edx
jmp 0x40af32
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
cmp edx, dword [ecx + 0x66c]
jne 0x40934d
push 0x620
call fcn.0040ec40
mov dword [ebp - 0x7e8], eax
mov dword [ebp - 4], 0x20
cmp dword [ebp - 0x7e8], 0
je 0x4091ed
push 0
mov ecx, dword [ebp - 0x7e8]
call fcn.0043a5e0
mov dword [ebp - 0x95c], eax
jmp 0x4091f7
mov dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x95c]
mov dword [ebp - 0x7e4], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x7e4]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
mov eax, dword [ebp - 0x444]
mov dword [edx + 0x170], eax
mov ecx, dword [ebp - 0x8d4]
cmp dword [ecx + 0x1894], 0
je 0x409314
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x7f0], eax
mov dword [ebp - 4], 0x21
cmp dword [ebp - 0x7f0], 0
je 0x409271
mov ecx, dword [ebp - 0x7f0]
call fcn.004dff40
mov dword [ebp - 0x960], eax
jmp 0x40927b
mov dword [ebp - 0x960], 0
mov edx, dword [ebp - 0x960]
mov dword [ebp - 0x7ec], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x7ec]
mov dword [ebp - 0x4ec], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ebp - 0x4e8]
mov dword [ecx + 0x20c], edx
mov eax, dword [ebp - 0x4ec]
mov dword [eax + 0x210], 0x84
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [0x60682c]
mov dword [ecx], edx
lea eax, [ebp - 0x43c]
push eax
push 0x104
mov ecx, dword [ebp - 0x4ec]
add ecx, 4
push ecx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov edx, dword [ebp - 0x4ec]
push edx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x8d4]
mov dword [eax + 0xa6c], 0
jmp 0x409348
mov ecx, dword [ebp - 0x8d4]
push ecx
push 0x84
mov edx, dword [ebp - 0x4e8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [eax + 0x13c]
call edx
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [ebp - 0x4e8]
mov dword [eax + 0xa6c], ecx
jmp 0x40af32
mov edx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [edx + 0x14]
cmp ecx, dword [eax + 0x670]
jne 0x4094fa
push 0x598
call fcn.0040ec40
mov dword [ebp - 0x7f8], eax
mov dword [ebp - 4], 0x22
cmp dword [ebp - 0x7f8], 0
je 0x40939a
push 0
mov ecx, dword [ebp - 0x7f8]
call fcn.00440310
mov dword [ebp - 0x964], eax
jmp 0x4093a4
mov dword [ebp - 0x964], 0
mov edx, dword [ebp - 0x964]
mov dword [ebp - 0x7f4], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x7f4]
mov dword [ebp - 0x4f0], eax
mov ecx, dword [ebp - 0x4f0]
mov edx, dword [ebp - 0x444]
mov dword [ecx + 0x170], edx
mov eax, dword [ebp - 0x8d4]
cmp dword [eax + 0x1894], 0
je 0x4094c1
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x800], eax
mov dword [ebp - 4], 0x23
cmp dword [ebp - 0x800], 0
je 0x40941e
mov ecx, dword [ebp - 0x800]
call fcn.004dff40
mov dword [ebp - 0x968], eax
jmp 0x409428
mov dword [ebp - 0x968], 0
mov ecx, dword [ebp - 0x968]
mov dword [ebp - 0x7fc], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x7fc]
mov dword [ebp - 0x4f4], edx
mov eax, dword [ebp - 0x4f4]
mov ecx, dword [ebp - 0x4f0]
mov dword [eax + 0x20c], ecx
mov edx, dword [ebp - 0x4f4]
mov dword [edx + 0x210], 0x84
mov eax, dword [ebp - 0x4f4]
mov ecx, dword [0x60682c]
mov dword [eax], ecx
lea edx, [ebp - 0x43c]
push edx
push 0x104
mov eax, dword [ebp - 0x4f4]
add eax, 4
push eax
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov ecx, dword [ebp - 0x4f4]
push ecx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x8d4]
mov dword [edx + 0xa6c], 0
jmp 0x4094f5
mov eax, dword [ebp - 0x8d4]
push eax
push 0x84
mov ecx, dword [ebp - 0x4f0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x4f0]
mov eax, dword [edx + 0x13c]
call eax
mov ecx, dword [ebp - 0x8d4]
mov edx, dword [ebp - 0x4f0]
mov dword [ecx + 0xa6c], edx
jmp 0x40af32
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
cmp edx, dword [ecx + 0x674]
jne 0x4096a7
push 0x7dc
call fcn.0040ec40
mov dword [ebp - 0x808], eax
mov dword [ebp - 4], 0x24
cmp dword [ebp - 0x808], 0
je 0x409547
push 0
mov ecx, dword [ebp - 0x808]
call fcn.0043b680
mov dword [ebp - 0x96c], eax
jmp 0x409551
mov dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0x96c]
mov dword [ebp - 0x804], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x804]
mov dword [ebp - 0x4f8], ecx
mov edx, dword [ebp - 0x4f8]
mov eax, dword [ebp - 0x444]
mov dword [edx + 0x170], eax
mov ecx, dword [ebp - 0x8d4]
cmp dword [ecx + 0x1894], 0
je 0x40966e
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x810], eax
mov dword [ebp - 4], 0x25
cmp dword [ebp - 0x810], 0
je 0x4095cb
mov ecx, dword [ebp - 0x810]
call fcn.004dff40
mov dword [ebp - 0x970], eax
jmp 0x4095d5
mov dword [ebp - 0x970], 0
mov edx, dword [ebp - 0x970]
mov dword [ebp - 0x80c], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x4fc], eax
mov ecx, dword [ebp - 0x4fc]
mov edx, dword [ebp - 0x4f8]
mov dword [ecx + 0x20c], edx
mov eax, dword [ebp - 0x4fc]
mov dword [eax + 0x210], 0x8d
mov ecx, dword [ebp - 0x4fc]
mov edx, dword [0x60681c]
mov dword [ecx], edx
lea eax, [ebp - 0x43c]
push eax
push 0x104
mov ecx, dword [ebp - 0x4fc]
add ecx, 4
push ecx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov edx, dword [ebp - 0x4fc]
push edx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x8d4]
mov dword [eax + 0xa6c], 0
jmp 0x4096a2
mov ecx, dword [ebp - 0x8d4]
push ecx
push 0x8d
mov edx, dword [ebp - 0x4f8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4f8]
mov edx, dword [eax + 0x13c]
call edx
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [ebp - 0x4f8]
mov dword [eax + 0xa6c], ecx
jmp 0x40af32
mov edx, dword [ebp - 0x44c]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x1734
call fcn.00505fe0
mov ecx, dword [ebp - 0x28]
cmp eax, dword [ecx + 0x66c]
jne 0x40998a
mov edx, dword [ebp - 0x44c]
mov eax, dword [edx + 0x14]
push eax
lea ecx, [ebp - 0x618]
push ecx
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x1734
call fcn.00506170
mov dword [ebp - 4], 0x26
push 0x104
lea edx, [ebp - 0x614]
push edx
lea ecx, [ebp - 0x618]
call fcn.0040eb80
push eax
call fcn.0045fea0
add esp, 0xc
lea eax, [ebp - 0x614]
push eax
mov ecx, dword [ebp - 0x444]
call fcn.004682d0
mov dword [ebp - 0x508], eax
mov dword [ebp - 0x500], 0
mov dword [ebp - 0x504], 0
cmp dword [ebp - 0x508], 0
je 0x409956
push 0x59310c
push 0x594548
lea ecx, [ebp - 0x500]
push ecx
mov edx, dword [ebp - 0x508]
push edx
mov ecx, dword [ebp - 0x444]
call fcn.00462160
test eax, eax
je 0x409956
push 0x593114
push 0x594548
lea eax, [ebp - 0x504]
push eax
mov ecx, dword [ebp - 0x508]
push ecx
mov ecx, dword [ebp - 0x444]
call fcn.00462160
test eax, eax
je 0x409956
mov ecx, dword [ebp - 0x444]
call fcn.00468260
add eax, dword [ebp - 0x500]
mov dword [ebp - 0x508], eax
push 0x1c30
call fcn.0040ec40
mov dword [ebp - 0x818], eax
mov byte [ebp - 4], 0x27
cmp dword [ebp - 0x818], 0
je 0x4097f2
push 0
mov ecx, dword [ebp - 0x818]
call fcn.00428140
mov dword [ebp - 0x974], eax
jmp 0x4097fc
mov dword [ebp - 0x974], 0
mov edx, dword [ebp - 0x974]
mov dword [ebp - 0x814], edx
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0x61c], eax
mov ecx, dword [ebp - 0x504]
push ecx
push 0
mov edx, dword [ebp - 0x508]
push edx
mov eax, dword [ebp - 0x444]
push eax
mov ecx, dword [ebp - 0x61c]
call fcn.00428a80
mov ecx, dword [ebp - 0x8d4]
cmp dword [ecx + 0x1894], 0
je 0x409920
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x820], eax
mov byte [ebp - 4], 0x28
cmp dword [ebp - 0x820], 0
je 0x409880
mov ecx, dword [ebp - 0x820]
call fcn.004dff40
mov dword [ebp - 0x978], eax
jmp 0x40988a
mov dword [ebp - 0x978], 0
mov edx, dword [ebp - 0x978]
mov dword [ebp - 0x81c], edx
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x81c]
mov dword [ebp - 0x620], eax
mov ecx, dword [ebp - 0x620]
mov edx, dword [ebp - 0x61c]
mov dword [ecx + 0x20c], edx
mov eax, dword [ebp - 0x620]
mov dword [eax + 0x210], 0xbf
mov ecx, dword [ebp - 0x620]
mov edx, dword [0x60682c]
mov dword [ecx], edx
lea eax, [ebp - 0x43c]
push eax
push 0x104
mov ecx, dword [ebp - 0x620]
add ecx, 4
push ecx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov edx, dword [ebp - 0x620]
push edx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x8d4]
mov dword [eax + 0xa6c], 0
jmp 0x409954
mov ecx, dword [ebp - 0x8d4]
push ecx
push 0xbf
mov edx, dword [ebp - 0x61c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x61c]
mov edx, dword [eax + 0x13c]
call edx
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [ebp - 0x61c]
mov dword [eax + 0xa6c], ecx
jmp 0x409973
mov edx, dword [ebp - 0x8d4]
mov dword [edx + 0xa6c], 0
push 1
mov ecx, dword [ebp - 0x8d4]
call fcn.00404ba0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x618]
call fcn.00404cf0
jmp 0x40af32
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
cmp edx, dword [ecx + 0x678]
jne 0x409b37
push 0x620
call fcn.0040ec40
mov dword [ebp - 0x828], eax
mov dword [ebp - 4], 0x29
cmp dword [ebp - 0x828], 0
je 0x4099d7
push 0
mov ecx, dword [ebp - 0x828]
call fcn.00441310
mov dword [ebp - 0x97c], eax
jmp 0x4099e1
mov dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x97c]
mov dword [ebp - 0x824], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x824]
mov dword [ebp - 0x624], ecx
mov edx, dword [ebp - 0x624]
mov eax, dword [ebp - 0x444]
mov dword [edx + 0x170], eax
mov ecx, dword [ebp - 0x8d4]
cmp dword [ecx + 0x1894], 0
je 0x409afe
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x830], eax
mov dword [ebp - 4], 0x2a
cmp dword [ebp - 0x830], 0
je 0x409a5b
mov ecx, dword [ebp - 0x830]
call fcn.004dff40
mov dword [ebp - 0x980], eax
jmp 0x409a65
mov dword [ebp - 0x980], 0
mov edx, dword [ebp - 0x980]
mov dword [ebp - 0x82c], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x628], eax
mov ecx, dword [ebp - 0x628]
mov edx, dword [ebp - 0x624]
mov dword [ecx + 0x20c], edx
mov eax, dword [ebp - 0x628]
mov dword [eax + 0x210], 0x84
mov ecx, dword [ebp - 0x628]
mov edx, dword [0x606828]
mov dword [ecx], edx
lea eax, [ebp - 0x43c]
push eax
push 0x104
mov ecx, dword [ebp - 0x628]
add ecx, 4
push ecx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov edx, dword [ebp - 0x628]
push edx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x8d4]
mov dword [eax + 0xa6c], 0
jmp 0x409b32
mov ecx, dword [ebp - 0x8d4]
push ecx
push 0x84
mov edx, dword [ebp - 0x624]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x624]
mov edx, dword [eax + 0x13c]
call edx
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [ebp - 0x624]
mov dword [eax + 0xa6c], ecx
jmp 0x40af32
mov edx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [edx + 0x14]
cmp ecx, dword [eax + 0x67c]
jne 0x409cf7
push 0x2324
call fcn.0040ec40
mov dword [ebp - 0x838], eax
mov dword [ebp - 4], 0x2b
cmp dword [ebp - 0x838], 0
je 0x409b84
push 0
mov ecx, dword [ebp - 0x838]
call fcn.00403a80
mov dword [ebp - 0x984], eax
jmp 0x409b8e
mov dword [ebp - 0x984], 0
mov edx, dword [ebp - 0x984]
mov dword [ebp - 0x834], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x62c], eax
mov ecx, dword [ebp - 0x62c]
mov edx, dword [ebp - 0x444]
mov dword [ecx + 0x170], edx
mov eax, dword [ebp - 0x28]
add eax, 0x418
mov ecx, dword [ebp - 0x62c]
mov dword [ecx + 0x174], eax
mov edx, dword [ebp - 0x8d4]
cmp dword [edx + 0x1894], 0
je 0x409cbe
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x840], eax
mov dword [ebp - 4], 0x2c
cmp dword [ebp - 0x840], 0
je 0x409c1c
mov ecx, dword [ebp - 0x840]
call fcn.004dff40
mov dword [ebp - 0x988], eax
jmp 0x409c26
mov dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x988]
mov dword [ebp - 0x83c], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x83c]
mov dword [ebp - 0x630], ecx
mov edx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x62c]
mov dword [edx + 0x20c], eax
mov ecx, dword [ebp - 0x630]
mov dword [ecx + 0x210], 0x84
mov edx, dword [ebp - 0x630]
mov eax, dword [0x606824]
mov dword [edx], eax
lea ecx, [ebp - 0x43c]
push ecx
push 0x104
mov edx, dword [ebp - 0x630]
add edx, 4
push edx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov eax, dword [ebp - 0x630]
push eax
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x8d4]
mov dword [ecx + 0xa6c], 0
jmp 0x409cf2
mov edx, dword [ebp - 0x8d4]
push edx
push 0x84
mov eax, dword [ebp - 0x62c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x62c]
mov eax, dword [edx + 0x13c]
call eax
mov ecx, dword [ebp - 0x8d4]
mov edx, dword [ebp - 0x62c]
mov dword [ecx + 0xa6c], edx
jmp 0x40af32
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
cmp edx, dword [ecx + 0x68c]
jne 0x409ea4
push 0x568
call fcn.0040ec40
mov dword [ebp - 0x848], eax
mov dword [ebp - 4], 0x2d
cmp dword [ebp - 0x848], 0
je 0x409d44
push 0
mov ecx, dword [ebp - 0x848]
call fcn.004488d0
mov dword [ebp - 0x98c], eax
jmp 0x409d4e
mov dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x98c]
mov dword [ebp - 0x844], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x844]
mov dword [ebp - 0x634], ecx
mov edx, dword [ebp - 0x634]
mov eax, dword [ebp - 0x444]
mov dword [edx + 0x170], eax
mov ecx, dword [ebp - 0x8d4]
cmp dword [ecx + 0x1894], 0
je 0x409e6b
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x850], eax
mov dword [ebp - 4], 0x2e
cmp dword [ebp - 0x850], 0
je 0x409dc8
mov ecx, dword [ebp - 0x850]
call fcn.004dff40
mov dword [ebp - 0x990], eax
jmp 0x409dd2
mov dword [ebp - 0x990], 0
mov edx, dword [ebp - 0x990]
mov dword [ebp - 0x84c], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x84c]
mov dword [ebp - 0x638], eax
mov ecx, dword [ebp - 0x638]
mov edx, dword [ebp - 0x634]
mov dword [ecx + 0x20c], edx
mov eax, dword [ebp - 0x638]
mov dword [eax + 0x210], 0x86
mov ecx, dword [ebp - 0x638]
mov edx, dword [0x606824]
mov dword [ecx], edx
lea eax, [ebp - 0x43c]
push eax
push 0x104
mov ecx, dword [ebp - 0x638]
add ecx, 4
push ecx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov edx, dword [ebp - 0x638]
push edx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x8d4]
mov dword [eax + 0xa6c], 0
jmp 0x409e9f
mov ecx, dword [ebp - 0x8d4]
push ecx
push 0x86
mov edx, dword [ebp - 0x634]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x634]
mov edx, dword [eax + 0x13c]
call edx
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [ebp - 0x634]
mov dword [eax + 0xa6c], ecx
jmp 0x40af32
mov edx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [edx + 0x14]
cmp ecx, dword [eax + 0x690]
jne 0x40a04e
push 0x2ab8
call fcn.0040ec40
mov dword [ebp - 0x858], eax
mov dword [ebp - 4], 0x2f
cmp dword [ebp - 0x858], 0
je 0x409ef1
push 0
mov ecx, dword [ebp - 0x858]
call fcn.0044f8a0
mov dword [ebp - 0x994], eax
jmp 0x409efb
mov dword [ebp - 0x994], 0
mov edx, dword [ebp - 0x994]
mov dword [ebp - 0x854], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x854]
mov dword [ebp - 0x63c], eax
mov ecx, dword [ebp - 0x63c]
mov edx, dword [ebp - 0x444]
mov dword [ecx + 0x74], edx
mov eax, dword [ebp - 0x8d4]
cmp dword [eax + 0x1894], 0
je 0x40a015
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x860], eax
mov dword [ebp - 4], 0x30
cmp dword [ebp - 0x860], 0
je 0x409f72
mov ecx, dword [ebp - 0x860]
call fcn.004dff40
mov dword [ebp - 0x998], eax
jmp 0x409f7c
mov dword [ebp - 0x998], 0
mov ecx, dword [ebp - 0x998]
mov dword [ebp - 0x85c], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x85c]
mov dword [ebp - 0x640], edx
mov eax, dword [ebp - 0x640]
mov ecx, dword [ebp - 0x63c]
mov dword [eax + 0x20c], ecx
mov edx, dword [ebp - 0x640]
mov dword [edx + 0x210], 0x8e
mov eax, dword [ebp - 0x640]
mov ecx, dword [0x606824]
mov dword [eax], ecx
lea edx, [ebp - 0x43c]
push edx
push 0x104
mov eax, dword [ebp - 0x640]
add eax, 4
push eax
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov ecx, dword [ebp - 0x640]
push ecx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x8d4]
mov dword [edx + 0xa6c], 0
jmp 0x40a049
mov eax, dword [ebp - 0x8d4]
push eax
push 0x8e
mov ecx, dword [ebp - 0x63c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x63c]
mov eax, dword [edx + 0x13c]
call eax
mov ecx, dword [ebp - 0x8d4]
mov edx, dword [ebp - 0x63c]
mov dword [ecx + 0xa6c], edx
jmp 0x40af32
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
cmp edx, dword [ecx + 0x684]
jne 0x40a1fb
push 0x328
call fcn.0040ec40
mov dword [ebp - 0x868], eax
mov dword [ebp - 4], 0x31
cmp dword [ebp - 0x868], 0
je 0x40a09b
push 0
mov ecx, dword [ebp - 0x868]
call fcn.00430e00
mov dword [ebp - 0x99c], eax
jmp 0x40a0a5
mov dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x99c]
mov dword [ebp - 0x864], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x864]
mov dword [ebp - 0x644], ecx
mov edx, dword [ebp - 0x644]
mov eax, dword [ebp - 0x444]
mov dword [edx + 0x170], eax
mov ecx, dword [ebp - 0x8d4]
cmp dword [ecx + 0x1894], 0
je 0x40a1c2
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x870], eax
mov dword [ebp - 4], 0x32
cmp dword [ebp - 0x870], 0
je 0x40a11f
mov ecx, dword [ebp - 0x870]
call fcn.004dff40
mov dword [ebp - 0x9a0], eax
jmp 0x40a129
mov dword [ebp - 0x9a0], 0
mov edx, dword [ebp - 0x9a0]
mov dword [ebp - 0x86c], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0x648], eax
mov ecx, dword [ebp - 0x648]
mov edx, dword [ebp - 0x644]
mov dword [ecx + 0x20c], edx
mov eax, dword [ebp - 0x648]
mov dword [eax + 0x210], 0x90
mov ecx, dword [ebp - 0x648]
mov edx, dword [0x606824]
mov dword [ecx], edx
lea eax, [ebp - 0x43c]
push eax
push 0x104
mov ecx, dword [ebp - 0x648]
add ecx, 4
push ecx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov edx, dword [ebp - 0x648]
push edx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x8d4]
mov dword [eax + 0xa6c], 0
jmp 0x40a1f6
mov ecx, dword [ebp - 0x8d4]
push ecx
push 0x90
mov edx, dword [ebp - 0x644]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x644]
mov edx, dword [eax + 0x13c]
call edx
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [ebp - 0x644]
mov dword [eax + 0xa6c], ecx
jmp 0x40af32
mov edx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [edx + 0x14]
cmp ecx, dword [eax + 0x680]
jne 0x40a3da
push 0x1cf8
call fcn.0040ec40
mov dword [ebp - 0x878], eax
mov dword [ebp - 4], 0x33
cmp dword [ebp - 0x878], 0
je 0x40a248
push 0
mov ecx, dword [ebp - 0x878]
call fcn.00415cd0
mov dword [ebp - 0x9a4], eax
jmp 0x40a252
mov dword [ebp - 0x9a4], 0
mov edx, dword [ebp - 0x9a4]
mov dword [ebp - 0x874], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0x64c], eax
mov ecx, dword [ebp - 0x28]
push ecx
push 0x104
mov edx, dword [ebp - 0x64c]
add edx, 0x170
push edx
call fcn.0045eee0
add esp, 0xc
mov eax, dword [ebp - 0x64c]
mov ecx, dword [ebp - 0x444]
mov dword [eax + 0x378], ecx
mov edx, dword [ebp - 0x64c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0x628]
mov dword [edx + 0x37c], ecx
mov edx, dword [ebp - 0x8d4]
cmp dword [edx + 0x1894], 0
je 0x40a3a1
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x880], eax
mov dword [ebp - 4], 0x34
cmp dword [ebp - 0x880], 0
je 0x40a2ff
mov ecx, dword [ebp - 0x880]
call fcn.004dff40
mov dword [ebp - 0x9a8], eax
jmp 0x40a309
mov dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x87c]
mov dword [ebp - 0x650], ecx
mov edx, dword [ebp - 0x650]
mov eax, dword [ebp - 0x64c]
mov dword [edx + 0x20c], eax
mov ecx, dword [ebp - 0x650]
mov dword [ecx + 0x210], 0xd3
mov edx, dword [ebp - 0x650]
mov eax, dword [0x606824]
mov dword [edx], eax
lea ecx, [ebp - 0x43c]
push ecx
push 0x104
mov edx, dword [ebp - 0x650]
add edx, 4
push edx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov eax, dword [ebp - 0x650]
push eax
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x8d4]
mov dword [ecx + 0xa6c], 0
jmp 0x40a3d5
mov edx, dword [ebp - 0x8d4]
push edx
push 0xd3
mov eax, dword [ebp - 0x64c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x64c]
mov eax, dword [edx + 0x13c]
call eax
mov ecx, dword [ebp - 0x8d4]
mov edx, dword [ebp - 0x64c]
mov dword [ecx + 0xa6c], edx
jmp 0x40af32
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
cmp edx, dword [ecx + 0x688]
jne 0x40a5a9
push 0x1c30
call fcn.0040ec40
mov dword [ebp - 0x888], eax
mov dword [ebp - 4], 0x35
cmp dword [ebp - 0x888], 0
je 0x40a427
push 0
mov ecx, dword [ebp - 0x888]
call fcn.00428140
mov dword [ebp - 0x9ac], eax
jmp 0x40a431
mov dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0x9ac]
mov dword [ebp - 0x884], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x884]
mov dword [ebp - 0x654], ecx
mov edx, dword [ebp - 0x28]
add edx, 0x414
push edx
mov ecx, dword [ebp - 0x444]
call fcn.0045bce0
push eax
push 0
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x444]
push edx
mov ecx, dword [ebp - 0x654]
call fcn.00428980
mov eax, dword [ebp - 0x8d4]
cmp dword [eax + 0x1894], 0
je 0x40a570
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x890], eax
mov dword [ebp - 4], 0x36
cmp dword [ebp - 0x890], 0
je 0x40a4cd
mov ecx, dword [ebp - 0x890]
call fcn.004dff40
mov dword [ebp - 0x9b0], eax
jmp 0x40a4d7
mov dword [ebp - 0x9b0], 0
mov ecx, dword [ebp - 0x9b0]
mov dword [ebp - 0x88c], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x88c]
mov dword [ebp - 0x658], edx
mov eax, dword [ebp - 0x658]
mov ecx, dword [ebp - 0x654]
mov dword [eax + 0x20c], ecx
mov edx, dword [ebp - 0x658]
mov dword [edx + 0x210], 0xbf
mov eax, dword [ebp - 0x658]
mov ecx, dword [0x606824]
mov dword [eax], ecx
lea edx, [ebp - 0x43c]
push edx
push 0x104
mov eax, dword [ebp - 0x658]
add eax, 4
push eax
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov ecx, dword [ebp - 0x658]
push ecx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x8d4]
mov dword [edx + 0xa6c], 0
jmp 0x40a5a4
mov eax, dword [ebp - 0x8d4]
push eax
push 0xbf
mov ecx, dword [ebp - 0x654]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x654]
mov eax, dword [edx + 0x13c]
call eax
mov ecx, dword [ebp - 0x8d4]
mov edx, dword [ebp - 0x654]
mov dword [ecx + 0xa6c], edx
jmp 0x40af32
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
cmp edx, dword [ecx + 0x698]
jne 0x40a905
push 0x418
call fcn.0040ec40
mov dword [ebp - 0x898], eax
mov dword [ebp - 4], 0x37
cmp dword [ebp - 0x898], 0
je 0x40a5f6
push 0
mov ecx, dword [ebp - 0x898]
call fcn.0041a410
mov dword [ebp - 0x9b4], eax
jmp 0x40a600
mov dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x9b4]
mov dword [ebp - 0x894], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x894]
mov dword [ebp - 0x65c], ecx
mov ecx, dword [ebp - 0x444]
call fcn.0045bd20
test eax, eax
je 0x40a7b9
xor edx, edx
mov word [ebp - 0x664], dx
mov dword [ebp - 0x66c], 1
push 0x59311c
push 0x594438
lea eax, [ebp - 0x664]
push eax
mov ecx, dword [ebp - 0x444]
call fcn.00461380
push eax
mov ecx, dword [ebp - 0x444]
call fcn.00462160
movzx ecx, word [ebp - 0x664]
and ecx, 0x8664
cmp ecx, 0x8664
jne 0x40a68c
mov dword [ebp - 0x66c], 2
mov dword [ebp - 0x674], 0
mov dword [ebp - 0x670], 0
push 0x593124
mov ecx, dword [ebp - 0x444]
call fcn.00461620
push eax
lea edx, [ebp - 0x674]
push edx
mov ecx, dword [ebp - 0x444]
call fcn.004613c0
push eax
mov ecx, dword [ebp - 0x444]
call fcn.00462160
mov dword [ebp - 0x668], 0
push 0x593130
mov ecx, dword [ebp - 0x444]
call fcn.00461620
push eax
lea eax, [ebp - 0x668]
push eax
mov ecx, dword [ebp - 0x444]
call fcn.004613c0
push eax
mov ecx, dword [ebp - 0x444]
call fcn.00462160
mov ecx, dword [ebp - 0x668]
push ecx
mov ecx, dword [ebp - 0x444]
call fcn.00462a40
mov dword [ebp - 0x678], eax
mov dword [ebp - 0x660], 0x1000
mov edx, dword [ebp - 0x678]
sub edx, 0x7ffffff
neg edx
sbb edx, edx
and edx, dword [ebp - 0x678]
mov dword [ebp - 0x678], edx
mov ecx, dword [ebp - 0x444]
call fcn.0045bce0
sub eax, dword [ebp - 0x678]
cmp eax, dword [ebp - 0x660]
jae 0x40a776
mov ecx, dword [ebp - 0x444]
call fcn.0045bce0
sub eax, dword [ebp - 0x678]
mov dword [ebp - 0x660], eax
push 0
mov eax, dword [ebp - 0x668]
xor ecx, ecx
add eax, dword [ebp - 0x674]
mov edx, dword [ebp - 0x670]
adc edx, ecx
push edx
push eax
mov eax, dword [ebp - 0x660]
push eax
mov ecx, dword [ebp - 0x678]
push ecx
mov edx, dword [ebp - 0x66c]
push edx
mov eax, dword [ebp - 0x444]
push eax
mov ecx, dword [ebp - 0x65c]
call fcn.0041aa10
jmp 0x40a7e1
push 0
push 0
push 0
mov ecx, dword [ebp - 0x444]
call fcn.0045bce0
push eax
push 0
push 1
mov ecx, dword [ebp - 0x444]
push ecx
mov ecx, dword [ebp - 0x65c]
call fcn.0041aa10
mov edx, dword [ebp - 0x8d4]
cmp dword [edx + 0x1894], 0
je 0x40a8cc
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x8a0], eax
mov dword [ebp - 4], 0x38
cmp dword [ebp - 0x8a0], 0
je 0x40a82a
mov ecx, dword [ebp - 0x8a0]
call fcn.004dff40
mov dword [ebp - 0x9b8], eax
jmp 0x40a834
mov dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x9b8]
mov dword [ebp - 0x89c], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x89c]
mov dword [ebp - 0x67c], ecx
mov edx, dword [ebp - 0x67c]
mov eax, dword [ebp - 0x65c]
mov dword [edx + 0x20c], eax
mov ecx, dword [ebp - 0x67c]
mov dword [ecx + 0x210], 0xda
mov edx, dword [ebp - 0x67c]
mov eax, dword [0x606824]
mov dword [edx], eax
lea ecx, [ebp - 0x43c]
push ecx
push 0x104
mov edx, dword [ebp - 0x67c]
add edx, 4
push edx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov eax, dword [ebp - 0x67c]
push eax
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x8d4]
mov dword [ecx + 0xa6c], 0
jmp 0x40a900
mov edx, dword [ebp - 0x8d4]
push edx
push 0xda
mov eax, dword [ebp - 0x65c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x65c]
mov eax, dword [edx + 0x13c]
call eax
mov ecx, dword [ebp - 0x8d4]
mov edx, dword [ebp - 0x65c]
mov dword [ecx + 0xa6c], edx
jmp 0x40af32
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + 0x14]
cmp edx, dword [ecx + 0x69c]
jne 0x40aab2
push 0x1e0
call fcn.0040ec40
mov dword [ebp - 0x8a8], eax
mov dword [ebp - 4], 0x39
cmp dword [ebp - 0x8a8], 0
je 0x40a952
push 0
mov ecx, dword [ebp - 0x8a8]
call fcn.00430bf0
mov dword [ebp - 0x9bc], eax
jmp 0x40a95c
mov dword [ebp - 0x9bc], 0
mov eax, dword [ebp - 0x9bc]
mov dword [ebp - 0x8a4], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x8a4]
mov dword [ebp - 0x680], ecx
mov edx, dword [ebp - 0x680]
mov eax, dword [ebp - 0x444]
mov dword [edx + 0x170], eax
mov ecx, dword [ebp - 0x8d4]
cmp dword [ecx + 0x1894], 0
je 0x40aa79
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x8b0], eax
mov dword [ebp - 4], 0x3a
cmp dword [ebp - 0x8b0], 0
je 0x40a9d6
mov ecx, dword [ebp - 0x8b0]
call fcn.004dff40
mov dword [ebp - 0x9c0], eax
jmp 0x40a9e0
mov dword [ebp - 0x9c0], 0
mov edx, dword [ebp - 0x9c0]
mov dword [ebp - 0x8ac], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x8ac]
mov dword [ebp - 0x684], eax
mov ecx, dword [ebp - 0x684]
mov edx, dword [ebp - 0x680]
mov dword [ecx + 0x20c], edx
mov eax, dword [ebp - 0x684]
mov dword [eax + 0x210], 0xc8
mov ecx, dword [ebp - 0x684]
mov edx, dword [0x606824]
mov dword [ecx], edx
lea eax, [ebp - 0x43c]
push eax
push 0x104
mov ecx, dword [ebp - 0x684]
add ecx, 4
push ecx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov edx, dword [ebp - 0x684]
push edx
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x8d4]
mov dword [eax + 0xa6c], 0
jmp 0x40aaad
mov ecx, dword [ebp - 0x8d4]
push ecx
push 0xc8
mov edx, dword [ebp - 0x680]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x680]
mov edx, dword [eax + 0x13c]
call edx
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [ebp - 0x680]
mov dword [eax + 0xa6c], ecx
jmp 0x40af32
mov edx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [edx + 0x14]
cmp ecx, dword [eax + 0x694]
jne 0x40ac7b
push 0x398
call fcn.0040ec40
mov dword [ebp - 0x8b8], eax
mov dword [ebp - 4], 0x3b
cmp dword [ebp - 0x8b8], 0
je 0x40aaff
push 0
mov ecx, dword [ebp - 0x8b8]
call fcn.004450d0
mov dword [ebp - 0x9c4], eax
jmp 0x40ab09
mov dword [ebp - 0x9c4], 0
mov edx, dword [ebp - 0x9c4]
mov dword [ebp - 0x8b4], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x688], eax
mov ecx, dword [ebp - 0x688]
mov edx, dword [ebp - 0x444]
mov dword [ecx + 0x170], edx
push 0x104
mov eax, dword [ebp - 0x688]
add eax, 0x174
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.0045fea0
add esp, 0xc
mov edx, dword [ebp - 0x8d4]
cmp dword [edx + 0x1894], 0
je 0x40ac42
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x8c0], eax
mov dword [ebp - 4], 0x3c
cmp dword [ebp - 0x8c0], 0
je 0x40aba0
mov ecx, dword [ebp - 0x8c0]
call fcn.004dff40
mov dword [ebp - 0x9c8], eax
jmp 0x40abaa
mov dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x9c8]
mov dword [ebp - 0x8bc], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x8bc]
mov dword [ebp - 0x68c], ecx
mov edx, dword [ebp - 0x68c]
mov eax, dword [ebp - 0x688]
mov dword [edx + 0x20c], eax
mov ecx, dword [ebp - 0x68c]
mov dword [ecx + 0x210], 0xd6
mov edx, dword [ebp - 0x68c]
mov eax, dword [0x606824]
mov dword [edx], eax
lea ecx, [ebp - 0x43c]
push ecx
push 0x104
mov edx, dword [ebp - 0x68c]
add edx, 4
push edx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov eax, dword [ebp - 0x68c]
push eax
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x8d4]
mov dword [ecx + 0xa6c], 0
jmp 0x40ac76
mov edx, dword [ebp - 0x8d4]
push edx
push 0xd6
mov eax, dword [ebp - 0x688]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x688]
mov eax, dword [edx + 0x13c]
call eax
mov ecx, dword [ebp - 0x8d4]
mov edx, dword [ebp - 0x688]
mov dword [ecx + 0xa6c], edx
jmp 0x40af32
mov eax, dword [ebp - 0x448]
cmp eax, dword [ebp - 0x440]
jne 0x40af22
cmp dword [ebp - 0x448], 7
jne 0x40af22
mov dword [ebp - 0x690], 0
mov dword [ebp - 0x694], 0
jmp 0x40acbf
mov ecx, dword [ebp - 0x694]
add ecx, 1
mov dword [ebp - 0x694], ecx
cmp dword [ebp - 0x694], 0x3e8
jge 0x40acfa
mov edx, dword [ebp - 0x694]
imul edx, edx, 0x438
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x44c]
mov edx, dword [eax + edx + 0x6a4]
cmp edx, dword [ecx + 0x14]
jne 0x40acf8
mov dword [ebp - 0x690], 1
jmp 0x40acfa
jmp 0x40acb0
cmp dword [ebp - 0x690], 0
je 0x40af20
push 0x5b4
call fcn.0040ec40
mov dword [ebp - 0x8c8], eax
mov dword [ebp - 4], 0x3d
cmp dword [ebp - 0x8c8], 0
je 0x40ad3c
push 0
mov ecx, dword [ebp - 0x8c8]
call fcn.00422280
mov dword [ebp - 0x9cc], eax
jmp 0x40ad46
mov dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0x9cc]
mov dword [ebp - 0x8c4], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x8c4]
mov dword [ebp - 0x698], ecx
mov edx, dword [ebp - 0x694]
imul edx, edx, 0x438
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x698]
mov dword [eax + edx + 0xad4], ecx
mov edx, dword [ebp - 0x694]
imul edx, edx, 0x438
mov eax, dword [ebp - 0x28]
lea ecx, [eax + edx + 0x6a8]
push ecx
push 0x104
mov edx, dword [ebp - 0x28]
add edx, 0x420
push edx
call fcn.0045eee0
add esp, 0xc
push 0x42c
mov eax, dword [ebp - 0x694]
imul eax, eax, 0x438
mov ecx, dword [ebp - 0x28]
lea edx, [ecx + eax + 0x6a8]
push edx
mov eax, dword [ebp - 0x698]
add eax, 0x170
push eax
call fcn.00556dd0
add esp, 0xc
mov ecx, dword [ebp - 0x694]
imul ecx, ecx, 0x438
mov edx, dword [ebp - 0x28]
lea eax, [edx + ecx + 0xad8]
mov ecx, dword [ebp - 0x698]
mov dword [ecx + 0x59c], eax
mov edx, dword [ebp - 0x8d4]
cmp dword [edx + 0x1894], 0
je 0x40aeec
push 0x218
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x8d0], eax
mov dword [ebp - 4], 0x3e
cmp dword [ebp - 0x8d0], 0
je 0x40ae4a
mov ecx, dword [ebp - 0x8d0]
call fcn.004dff40
mov dword [ebp - 0x9d0], eax
jmp 0x40ae54
mov dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x9d0]
mov dword [ebp - 0x8cc], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x8cc]
mov dword [ebp - 0x69c], ecx
mov edx, dword [ebp - 0x69c]
mov eax, dword [ebp - 0x698]
mov dword [edx + 0x20c], eax
mov ecx, dword [ebp - 0x69c]
mov dword [ecx + 0x210], 0x92
mov edx, dword [ebp - 0x69c]
mov eax, dword [0x606820]
mov dword [edx], eax
lea ecx, [ebp - 0x43c]
push ecx
push 0x104
mov edx, dword [ebp - 0x69c]
add edx, 4
push edx
call fcn.0045eee0
add esp, 0xc
push 0
push 0
mov eax, dword [ebp - 0x69c]
push eax
push 0x40df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x8d4]
mov dword [ecx + 0xa6c], 0
jmp 0x40af20
mov edx, dword [ebp - 0x8d4]
push edx
push 0x92
mov eax, dword [ebp - 0x698]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x698]
mov eax, dword [edx + 0x13c]
call eax
mov ecx, dword [ebp - 0x8d4]
mov edx, dword [ebp - 0x698]
mov dword [ecx + 0xa6c], edx
jmp 0x40af32
mov eax, dword [ebp - 0x8d4]
mov dword [eax + 0xa6c], 0
mov ecx, dword [ebp - 0x8d4]
cmp dword [ecx + 0xa6c], 0
je 0x40afcc
lea ecx, [ebp - 0x6ac]
call fcn.0048a260
lea edx, [ebp - 0x6ac]
push edx
mov ecx, dword [ebp - 0x8d4]
call fcn.00404b80
lea eax, [ebp - 0x6d8]
push eax
mov ecx, dword [ebp - 0x8d4]
add ecx, 0x1734
call fcn.0052b3b7
mov ecx, dword [ebp - 0x6b4]
mov dword [ebp - 0x6ac], ecx
mov ecx, dword [ebp - 0x8d4]
call fcn.0040e680
test eax, eax
je 0x40af9f
mov dword [ebp - 0x6a8], 0x19
push 1
lea edx, [ebp - 0x6ac]
push edx
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [eax + 0xa6c]
call fcn.00404b40
push 5
mov ecx, dword [ebp - 0x8d4]
mov ecx, dword [ecx + 0xa6c]
call fcn.00533cad
mov edx, dword [ebp - 0x8d4]
cmp dword [edx + 0x1894], 1
jne 0x40afe2
mov eax, 1
jmp 0x40aff9
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x8d4]
call fcn.0052ecab
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.00555ac5
mov esp, ebp
pop ebp
ret 0xc