Function at 0x100474b1
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100833c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xddc
push esi
and dword [ebp - 0x18], 0
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004d325
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x110], 0x1b7e280b
mov dword [ebp - 0xdc], 0xffffffff
mov dword [ebp - 0x188], 0
jmp 0x1004751a
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 4
jge 0x10047536
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0xd40], 0xffffffff
jmp 0x1004750d
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x10047550
push 0
call fcn.10046a1b
pop ecx
mov dword [ebp - 0x3c], 0xfffffff9
jmp 0x10047560
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x17
je 0x1004799c
mov dword [ebp - 0x98], 7
mov dword [ebp - 0x1d0], 0
jmp 0x1004758d
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 2
jge 0x100475a9
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0x7f0], 0xea1bca3
jmp 0x10047580
cmp dword [ebp - 0x3c], 0xecf0
jg 0x100475be
mov dword [ebp - 0x6d8], 1
jmp 0x100475c5
and dword [ebp - 0x6d8], 0
imul eax, dword [ebp - 0x3c], 0x74b6
cmp eax, dword [ebp - 0x3c]
jle 0x100475dd
mov dword [ebp - 0x468], 1
jmp 0x100475e4
and dword [ebp - 0x468], 0
imul eax, dword [ebp - 0x468], 0xffff
test eax, eax
jne 0x10047607
mov eax, 0xdb74a71a
test eax, eax
je 0x10047607
mov dword [ebp - 0x6d0], 1
jmp 0x1004760e
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x6d0]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 9
ja 0x10047633
mov dword [ebp - 0x714], 1
jmp 0x1004763a
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x6d8]
cmp eax, dword [ebp - 0x714]
jg 0x10047654
mov dword [ebp - 0x71c], 1
jmp 0x1004765b
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
je 0x10047682
cmp dword [ebp - 0x3c], 0
je 0x10047682
mov dword [ebp - 0x724], 1
jmp 0x10047689
and dword [ebp - 0x724], 0
cmp dword [ebp - 0x724], 0x6eab
jle 0x100476a1
mov dword [ebp - 0x72c], 1
jmp 0x100476a8
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x72c]
neg eax
cmp eax, dword [ebp - 0x98]
jle 0x100476c4
mov dword [ebp - 0x744], 1
jmp 0x100476cb
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x744]
cmp eax, 0x97312b94
jb 0x100476e8
mov dword [ebp - 0x708], 1
jmp 0x100476ef
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x708], eax
jle 0x10047709
mov dword [ebp - 0x728], 1
jmp 0x10047710
and dword [ebp - 0x728], 0
cmp dword [ebp - 0x728], 0x3ae5
jle 0x10047728
mov dword [ebp - 0x374], 1
jmp 0x1004772f
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x374], eax
jge 0x10047746
mov dword [ebp - 0x6c8], 1
jmp 0x1004774d
and dword [ebp - 0x6c8], 0
cmp dword [ebp - 0x6c8], 0x2b50
jl 0x10047765
mov dword [ebp - 0x56c], 1
jmp 0x1004776c
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x56c], eax
jne 0x10047786
mov dword [ebp - 0x37c], 1
jmp 0x1004778d
and dword [ebp - 0x37c], 0
cmp dword [ebp - 0x37c], 0x2c9cc141
jge 0x100477a5
mov dword [ebp - 0x6fc], 1
jmp 0x100477ac
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x98]
imul eax, dword [ebp - 0x6fc]
test eax, eax
je 0x100477d2
cmp dword [ebp - 0x98], 0
je 0x100477d2
mov dword [ebp - 0x384], 1
jmp 0x100477d9
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
sub eax, dword [ebp - 0x98]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x7f0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x110]
cmp dword [ebp + eax - 0x7f0], ecx
jge 0x10047813
mov dword [ebp - 0x574], 1
jmp 0x1004781a
and dword [ebp - 0x574], 0
cmp dword [ebp - 0x574], 9
jbe 0x1004782f
mov dword [ebp - 0x38c], 1
jmp 0x10047836
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x38c], eax
jne 0x10047859
cmp dword [ebp - 0x98], 0
je 0x10047859
mov dword [ebp - 0x66c], 1
jmp 0x10047860
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x66c]
jne 0x10047877
mov dword [ebp - 0x394], 1
jmp 0x1004787e
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x394]
je 0x10047898
mov dword [ebp - 0x57c], 1
jmp 0x1004789f
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x57c]
je 0x100478b6
mov dword [ebp - 0x39c], 1
jmp 0x100478bd
and dword [ebp - 0x39c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7f0]
cmp dword [ebp - 0x39c], eax
jl 0x100478de
mov dword [ebp - 0x33c], 1
jmp 0x100478e5
and dword [ebp - 0x33c], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x33c]
mov dword [ebp + eax - 0xd40], ecx
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x33c]
jg 0x10047912
mov dword [ebp - 0x6e8], 1
jmp 0x10047919
and dword [ebp - 0x6e8], 0
imul eax, dword [ebp - 0x6e8], 0x2547
sub eax, dword [ebp - 0xdc]
jne 0x10047939
xor eax, eax
inc eax
jne 0x10047939
and dword [ebp - 0x3a4], 0
jmp 0x10047943
mov dword [ebp - 0x3a4], 1
mov eax, dword [ebp - 0x3a4]
add eax, 8
je 0x10047963
mov eax, 0xe40e
test eax, eax
je 0x10047963
mov dword [ebp - 0x584], 1
jmp 0x1004796a
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x584], eax
jge 0x10047984
mov dword [ebp - 0x3ac], 1
jmp 0x1004798b
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0xdc], eax
jmp 0x10047559
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3ec], eax
mov dword [ebp - 0x138], 0x9c28ade1
mov dword [ebp - 0x190], 0
jmp 0x100479c8
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 1
jge 0x100479e4
mov eax, dword [ebp - 0x190]
mov dword [ebp + eax*4 - 0x874], 4
jmp 0x100479bb
mov byte [ebp - 0xca], 0
push 0
lea eax, [ebp - 0xca]
push eax
push 0x4784
call fcn.10046c2f
add esp, 0xc
mov dword [ebp - 0x138], 0
jmp 0x10047a1a
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 1
jge 0x10047a36
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x874], 0
jmp 0x10047a0d
mov eax, dword [ebp - 0x3ec]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10047a4b
jmp 0x1004d337
mov dword [ebp - 0x2a4], 0xb2c21353
push 3
lea ecx, [ebp - 0x938]
call fcn.10015f8b
and dword [ebp - 4], 0
mov dword [ebp - 0x58c], 0xe8ef
mov dword [ebp - 0x7d4], 0xfffffffe
push 1
lea eax, [ebp - 0xc94]
push eax
lea eax, [ebp - 0x938]
push eax
call fcn.1004541d
add esp, 0xc
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0xc5c], eax
cmp dword [ebp - 0x2a4], 0
je 0x10047ea1
mov dword [ebp - 0x7cc], 0
mov dword [ebp - 0x118], 0x7a73d2d6
mov dword [ebp - 0x3dc], 0xe81a7ecc
mov dword [ebp - 0x674], 0xffdeabfd
mov dword [ebp - 0x328], 0xffffffff
mov dword [ebp - 0x1f4], 0
jmp 0x10047af6
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 2
jge 0x10047b12
mov eax, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0xb6c], 0
jmp 0x10047ae9
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x938]
push eax
lea eax, [ebp - 0x58c]
push eax
lea eax, [ebp - 0x2a4]
push eax
push 0
lea eax, [ebp - 0x3dc]
push eax
lea eax, [ebp - 0x674]
push eax
call fcn.10045c47
add esp, 0x20
mov dword [ebp - 0x118], 0x13
jmp 0x10047b66
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xfffffff6
jg 0x10047e9f
mov dword [ebp - 0x88], 0xc870af03
mov dword [ebp - 0x198], 0x9da97883
mov dword [ebp - 0x864], 0xb758c9e4
mov dword [ebp - 0x3d4], 0xc2329b61
mov dword [ebp - 0x7e4], 0xffffffff
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x88], 0xffffffee
jmp 0x10047bcb
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x19
jle 0x10047e9a
mov dword [ebp - 0x7dc], 0xa9177c83
mov dword [ebp - 0x2fc], 0x33618264
push 1
lea ecx, [ebp - 0x8bc]
call fcn.10015f8b
mov byte [ebp - 4], 1
lea eax, [ebp - 0xb50]
push eax
lea eax, [ebp - 0x8bc]
push eax
push 0x6c77
push 1
call fcn.10045495
add esp, 0x10
cmp dword [ebp - 0x674], 0
jne 0x10047c3e
push 0
lea ecx, [ebp - 0x8bc]
call fcn.10015ff8
cmp dword [eax], 0
jne 0x10047c3e
and dword [ebp - 0x3b4], 0
jmp 0x10047c48
mov dword [ebp - 0x3b4], 1
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x328]
cmp eax, dword [ebp - 0x3b4]
jge 0x10047c6f
mov dword [ebp - 0x3bc], 1
jmp 0x10047c76
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x58c]
cmp dword [ebp - 0x3bc], eax
jg 0x10047c90
mov dword [ebp - 0x718], 1
jmp 0x10047c97
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x718]
add eax, 0xa093
cmp eax, dword [ebp - 0x7d4]
jge 0x10047cb6
mov dword [ebp - 0x3c4], 1
jmp 0x10047cbd
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x7dc]
cmp eax, dword [ebp - 0x3c4]
jne 0x10047cd7
mov dword [ebp - 0x594], 1
jmp 0x10047cde
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x594]
sub eax, dword [ebp - 0x7e4]
cmp eax, dword [ebp - 0x3d4]
jle 0x10047cfe
mov dword [ebp - 0x3cc], 1
jmp 0x10047d05
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x3cc], eax
je 0x10047d24
xor eax, eax
inc eax
je 0x10047d24
mov dword [ebp - 0x67c], 1
jmp 0x10047d2b
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x67c]
sub eax, dword [ebp - 0x198]
je 0x10047d4e
cmp dword [ebp - 0x3d4], 0
je 0x10047d4e
mov dword [ebp - 0x59c], 1
jmp 0x10047d55
and dword [ebp - 0x59c], 0
push 0
lea ecx, [ebp - 0x8bc]
call fcn.10015ff8
mov ecx, dword [ebp - 0x59c]
cmp ecx, dword [eax]
jl 0x10047d78
mov dword [ebp - 0x2b4], 1
jmp 0x10047d7f
and dword [ebp - 0x2b4], 0
push 0
lea ecx, [ebp - 0x8bc]
call fcn.10015ff8
mov ecx, dword [ebp - 0x2b4]
mov dword [eax], ecx
cmp dword [ebp - 0x2b4], 0
jne 0x10047daf
cmp dword [ebp - 0x198], 0
jne 0x10047daf
and dword [ebp - 0x85c], 0
jmp 0x10047db9
mov dword [ebp - 0x85c], 1
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xc2c], eax
push 1
lea ecx, [ebp - 0x938]
call fcn.10015ff8
cmp dword [eax], 0
jne 0x10047df0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb6c], 0
jne 0x10047df0
and dword [ebp - 0x6f0], 0
jmp 0x10047dfa
mov dword [ebp - 0x6f0], 1
mov eax, dword [ebp - 0x3dc]
cmp dword [ebp - 0x6f0], eax
jge 0x10047e14
mov dword [ebp - 0x3e4], 1
jmp 0x10047e1b
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
sub eax, dword [ebp - 0x2fc]
add eax, dword [ebp - 0x864]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x198], eax
jne 0x10047e4d
mov dword [ebp - 0x5a4], 1
jmp 0x10047e54
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x2fc], eax
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x10047e86
push 1
push 0x7114
push 0x72dd
call fcn.10045512
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8bc]
call fcn.10015ff3
jmp 0x10047bbe
jmp 0x10047b59
jmp 0x10047eaf
push 0
push 0x31de
call fcn.10046b83
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x938]
call fcn.10015ff3
mov eax, dword [ebp - 0x3ec]
mov ecx, dword [ebp - 0x2c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xd4], 0xffffffff
mov dword [ebp - 0x3fc], 0x90197f0a
push 3
lea ecx, [ebp - 0x73c]
call fcn.10015f8b
mov dword [ebp - 4], 2
mov dword [ebp - 0x34], 0
jmp 0x10047f08
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x10047f24
push dword [ebp - 0x34]
lea ecx, [ebp - 0x73c]
call fcn.10015ff8
mov dword [eax], 0xde9bf9f
jmp 0x10047f01
mov dword [ebp - 0x34], 0
jmp 0x10047f34
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x10047f4a
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xba0], 0x952f3411
jmp 0x10047f2d
mov dword [ebp - 0x34], 0
jmp 0x10047f5a
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x10047f70
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x9a0], 0x1b17d72
jmp 0x10047f53
push 0
lea ecx, [ebp - 0x73c]
call fcn.10015ff8
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xba0], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x9a0], 0
push 1
lea ecx, [ebp - 0x73c]
call fcn.10015ff8
cmp dword [eax], 0
jne 0x10047fbd
mov dword [ebp - 0x684], 1
jmp 0x10047fc4
and dword [ebp - 0x684], 0
push 1
lea ecx, [ebp - 0x73c]
call fcn.10015ff8
mov eax, dword [eax]
cmp eax, dword [ebp - 0x684]
jge 0x10047fe7
mov dword [ebp - 0x3f4], 1
jmp 0x10047fee
and dword [ebp - 0x3f4], 0
push 1
lea ecx, [ebp - 0x73c]
call fcn.10015ff8
mov ecx, dword [ebp - 0x3f4]
cmp ecx, dword [eax]
jg 0x10048011
mov dword [ebp - 0x5ac], 1
jmp 0x10048018
and dword [ebp - 0x5ac], 0
cmp dword [ebp - 0x5ac], 0xbf88
je 0x10048030
mov dword [ebp - 0x86c], 1
jmp 0x10048037
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x3fc], eax
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xb58], eax
push 1
lea ecx, [ebp - 0x73c]
call fcn.10015ff8
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x9a0]
push 1
lea ecx, [ebp - 0x73c]
call fcn.10015ff8
mov dword [eax], esi
mov dword [ebp - 0xd4], 0
jmp 0x1004809d
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 9
jne 0x100480d2
mov dword [ebp - 0x7b0], 0xae7b
push 0x7c6a
lea eax, [ebp - 0x7b0]
push eax
push 0x5afd
push 1
push 0x4dfc
call fcn.1004557d
add esp, 0x14
jmp 0x10048090
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x73c]
call fcn.10015ff3
mov eax, dword [ebp - 0xb0]
cmp dword [eax], 0x4550
je 0x100480f4
jmp 0x1004d337
mov dword [ebp - 0xe4], 0xa53d06ce
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0xf4], 0x37f1bd53
mov dword [ebp - 0xab4], 7
mov dword [ebp - 0xab0], 7
mov dword [ebp - 0xaac], 7
mov dword [ebp - 0xaa8], 7
mov dword [ebp - 0x330], 0x764fe605
mov dword [ebp - 0x68c], 1
mov dword [ebp - 0x1d4], 0xb76a
mov dword [ebp - 0x9c0], 0x8d4885c3
mov dword [ebp - 0x9bc], 0x8d4885c3
mov dword [ebp - 0x9b8], 0x8d4885c3
mov dword [ebp - 0x9b4], 0x8d4885c3
mov dword [ebp - 0x894], 0x546d79c1
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
je 0x100481da
mov dword [ebp - 0x87c], 0xffff
push 0x1e98
push 0x3b96
push 0x5650
push 0
call fcn.100473a6
add esp, 0x10
push 0
push 0x7fa2
lea eax, [ebp - 0x87c]
push eax
call fcn.10045aff
add esp, 0xc
jmp 0x1004820d
mov dword [ebp - 0x884], 0xfffffff7
push 0x6d02
push 0x1ee4
lea eax, [ebp - 0xe4]
push eax
push 0
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x884]
push eax
call fcn.10045765
add esp, 0x18
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xb8c], eax
imul eax, dword [ebp - 0xe4], 0xb964
test eax, eax
jne 0x10048239
mov eax, 0xffff
test eax, eax
jne 0x10048239
and dword [ebp - 0x740], 0
jmp 0x10048243
mov dword [ebp - 0x740], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x740]
mov dword [ebp + eax - 0xab4], ecx
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xb60], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x330], eax
jge 0x1004828e
mov eax, 0xddd0c6a3
test eax, eax
jne 0x1004828e
and dword [ebp - 0x404], 0
jmp 0x10048298
mov dword [ebp - 0x404], 1
cmp dword [ebp - 0x404], 0x8c6a
jge 0x100482b0
mov dword [ebp - 0x5b4], 1
jmp 0x100482b7
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x5b4]
je 0x100482db
or eax, 0xffffffff
je 0x100482db
or eax, 0xffffffff
je 0x100482db
mov dword [ebp - 0x40c], 1
jmp 0x100482e2
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x68c], eax
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x68c], eax
jg 0x10048308
mov dword [ebp - 0x414], 1
jmp 0x1004830f
and dword [ebp - 0x414], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c0]
cmp dword [ebp - 0x414], eax
jg 0x10048330
mov dword [ebp - 0x2bc], 1
jmp 0x10048337
and dword [ebp - 0x2bc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2bc]
mov dword [ebp + eax - 0x9c0], ecx
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x2bc], eax
jge 0x10048364
mov dword [ebp - 0x5bc], 1
jmp 0x1004836b
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x5bc]
dec ecx
sub eax, ecx
cmp eax, dword [ebp - 0xe4]
jge 0x1004838e
mov dword [ebp - 0x41c], 1
jmp 0x10048395
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x41c], eax
jl 0x100483af
mov dword [ebp - 0x6f8], 1
jmp 0x100483b6
and dword [ebp - 0x6f8], 0
cmp dword [ebp - 0x6f8], 1
jge 0x100483cb
mov dword [ebp - 0x424], 1
jmp 0x100483d2
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x424]
jge 0x100483f8
mov dword [ebp - 0x88c], 1
jmp 0x100483ff
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xb94], eax
cmp dword [ebp - 0x330], 0
jne 0x10048426
cmp dword [ebp - 0x1d4], 0
jne 0x10048426
and dword [ebp - 0x5c4], 0
jmp 0x10048430
mov dword [ebp - 0x5c4], 1
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0x894], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb0]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xc90], 0xec3d
mov dword [ebp - 0xb98], 0x4d8e5ccc
mov dword [ebp - 0xc34], 0xffffffff
mov dword [ebp - 0xc6c], 0xe31d8329
mov dword [ebp - 0xc68], 0xe31d8329
mov dword [ebp - 0xc64], 0xe31d8329
mov dword [ebp - 0xc60], 0xe31d8329
mov dword [ebp - 0xba4], 0
mov dword [ebp - 0xc70], 0xffffffff
mov dword [ebp - 0xbb0], 0xf1d6
mov dword [ebp - 0xc3c], 0x421d
mov dword [ebp - 0x1a0], 0
jmp 0x100484d6
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 2
jge 0x100484f2
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0x9c8], 1
jmp 0x100484c9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x9c8], eax
mov eax, dword [ebp - 0x4c]
cmp dword [eax + 4], 0
jne 0x1004851b
jmp 0x1004d337
and dword [ebp - 0x38], 0
mov eax, dword [ebp - 0xb0]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xb0]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x60], 0xe23a
mov dword [ebp - 0x9c], 0x758fc567
push 3
lea ecx, [ebp - 0x368]
call fcn.10015f8b
mov dword [ebp - 4], 3
mov dword [ebp - 0x1a8], 0xbf520f09
mov dword [ebp - 0x58], 0
jmp 0x10048578
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x1004858e
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0xbbc], 1
jmp 0x10048571
mov dword [ebp - 0x58], 0
jmp 0x1004859e
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x100485b4
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x79c], 1
jmp 0x10048597
lea eax, [ebp - 0x58]
push eax
push 1
lea eax, [ebp - 0x368]
push eax
call fcn.100456ee
add esp, 0xc
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x79c], 0xffff8295
mov eax, 0xffff8295
test eax, eax
je 0x100485fd
or eax, 0xffffffff
je 0x100485fd
mov eax, 0x32d3
test eax, eax
je 0x100485fd
mov dword [ebp - 0x42c], 1
jmp 0x10048604
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x9c], eax
jne 0x10048634
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x79c], 0
jne 0x10048634
and dword [ebp - 0x434], 0
jmp 0x1004863e
mov dword [ebp - 0x434], 1
imul eax, dword [ebp - 0x60], 0x531d
mov dword [ebp - 0x694], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x694]
mov dword [ebp + eax - 0xbbc], ecx
mov eax, dword [ebp - 0x694]
cmp eax, dword [ebp - 0x434]
jle 0x10048678
mov dword [ebp - 0x89c], 1
jmp 0x1004867f
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xbc0], eax
cmp dword [ebp - 0x9c], 0
jne 0x100486a1
push 7
pop eax
test eax, eax
jne 0x100486a1
and dword [ebp - 0x5cc], 0
jmp 0x100486ab
mov dword [ebp - 0x5cc], 1
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0x5cc]
cmp eax, 0xe352
je 0x100486c7
mov dword [ebp - 0x43c], 1
jmp 0x100486ce
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x43c], 0x8d535dd2
jne 0x100486e6
mov dword [ebp - 0x720], 1
jmp 0x100486ed
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x720]
add eax, 0x9751
cmp eax, 0xf620a341
jb 0x1004870b
mov dword [ebp - 0x444], 1
jmp 0x10048712
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x444], eax
jl 0x10048729
mov dword [ebp - 0x8a4], 1
jmp 0x10048730
and dword [ebp - 0x8a4], 0
cmp dword [ebp - 0x9c], 0xfffffffe
jl 0x10048746
xor eax, eax
jne 0x10048746
and dword [ebp - 0x5d4], 0
jmp 0x10048750
mov dword [ebp - 0x5d4], 1
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x5d4], eax
je 0x10048767
mov dword [ebp - 0x44c], 1
jmp 0x1004876e
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
add eax, 0x4eff862a
cmp eax, dword [ebp - 0x60]
jl 0x1004878a
mov dword [ebp - 0x69c], 1
jmp 0x10048791
and dword [ebp - 0x69c], 0
push 2
lea ecx, [ebp - 0x368]
call fcn.10015ff8
mov ecx, dword [ebp - 0x69c]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x79c], 0
je 0x10048966
push 0
lea ecx, [ebp - 0x368]
call fcn.10015ff8
cmp dword [eax], 0
jne 0x100488f3
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x79c]
cmp dword [ebp + eax - 0x79c], ecx
jg 0x100487f8
mov dword [ebp - 0x454], 1
jmp 0x100487ff
and dword [ebp - 0x454], 0
push 2
lea ecx, [ebp - 0x368]
call fcn.10015ff8
mov eax, dword [eax]
cmp eax, dword [ebp - 0x454]
jl 0x10048822
mov dword [ebp - 0x1ec], 1
jmp 0x10048829
and dword [ebp - 0x1ec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1ec]
mov dword [ebp + eax - 0xbbc], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1ec]
mov dword [ebp + eax - 0x79c], ecx
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x1ec], eax
jg 0x10048866
mov dword [ebp - 0x5dc], 1
jmp 0x1004886d
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0x5dc]
cmp eax, 0x3e63
jne 0x10048889
mov dword [ebp - 0x45c], 1
jmp 0x10048890
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x45c], eax
je 0x100488aa
mov dword [ebp - 0x700], 1
jmp 0x100488b1
and dword [ebp - 0x700], 0
push 2
lea ecx, [ebp - 0x368]
call fcn.10015ff8
mov ecx, dword [ebp - 0x700]
sub ecx, dword [eax]
mov dword [ebp - 0x464], ecx
push 2
lea ecx, [ebp - 0x368]
call fcn.10015ff8
mov ecx, dword [ebp - 0x464]
mov dword [eax], ecx
cmp dword [ebp - 0x464], 0
jne 0x100488f3
and dword [ebp - 0x5e4], 0
jmp 0x100488fd
mov dword [ebp - 0x5e4], 1
cmp dword [ebp - 0x5e4], 0xfffffffb
jbe 0x10048912
mov dword [ebp - 0x46c], 1
jmp 0x10048919
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x1a8]
imul eax, dword [ebp - 0x46c]
test eax, eax
je 0x10048937
push 2
lea ecx, [ebp - 0x368]
call fcn.10015ff8
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x9c], eax
mov esi, dword [ebp - 0x9c]
push 1
lea ecx, [ebp - 0x368]
call fcn.10015ff8
cmp esi, dword [eax]
je 0x10048966
mov dword [ebp - 0x6a4], 1
jmp 0x1004896d
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0x6a4]
jne 0x10048984
mov dword [ebp - 0x474], 1
jmp 0x1004898b
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x474], eax
jl 0x100489a5
mov dword [ebp - 0x5ec], 1
jmp 0x100489ac
and dword [ebp - 0x5ec], 0
cmp dword [ebp - 0x5ec], 0xda7d8e2d
jne 0x100489c4
mov dword [ebp - 0x47c], 1
jmp 0x100489cb
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0x1a8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x368]
call fcn.10015ff3
and dword [ebp - 0x2c4], 0
jmp 0x10048a0b
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0xf8]
add eax, 0x28
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xb0]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x2c4], eax
jge 0x10048a96
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x704], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x704]
jb 0x10048a91
mov eax, dword [ebp - 0xb0]
push dword [eax + 0x38]
mov eax, dword [ebp - 0xf8]
push dword [eax + 8]
call fcn.100453ee
pop ecx
pop ecx
add eax, dword [ebp - 0x704]
mov dword [ebp - 0x8ac], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x8ac]
jae 0x10048a91
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xf8]
push eax
push 0xd5a
push 1
push 0x5c1f
push 0x63ec
call fcn.10045765
add esp, 0x18
jmp 0x10048a96
jmp 0x100489ef
and dword [ebp - 0x9dc], 0
and dword [ebp - 0x9d8], 0
and dword [ebp - 0x9d4], 0
and dword [ebp - 0x9d0], 0
lea ecx, [ebp - 0x2fd]
call fcn.10008b33
push eax
lea eax, [ebp - 0x9cc]
push eax
lea eax, [ebp - 0x9dc]
push eax
lea ecx, [ebp - 0xd48]
call fcn.10016007
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xca8]
call fcn.10015fcd
mov dword [ebp - 4], 4
mov dword [ebp - 0x1dc], 0x5c8094a1
mov dword [ebp - 0x1dc], 0
jmp 0x10048b11
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 3
jg 0x10048b36
mov byte [ebp - 0xcc], 0
movzx eax, byte [ebp - 0xcc]
test eax, eax
je 0x10048b34
push 1
call fcn.100458ee
pop ecx
jmp 0x10048b04
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca8]
call fcn.10015ff3
cmp dword [ebp - 0x38], 0
jne 0x10048b50
jmp 0x1004d337
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x38]
add ecx, dword [eax]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x9f0], 0x713b9102
mov dword [ebp - 0x9ec], 0x713b9102
mov dword [ebp - 0x9e8], 0x713b9102
mov dword [ebp - 0x9e4], 0x713b9102
lea ecx, [ebp - 0x33d]
call fcn.10008b33
push eax
lea eax, [ebp - 0x9e0]
push eax
lea eax, [ebp - 0x9f0]
push eax
lea ecx, [ebp - 0xcc8]
call fcn.10016007
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2a0]
call fcn.10015fcd
mov dword [ebp - 4], 5
mov dword [ebp - 0x1b0], 3
mov dword [ebp - 0x2cc], 1
mov dword [ebp - 0x338], 0xd5b4
mov dword [ebp - 0x918], 0x7b6a
push 2
lea ecx, [ebp - 0x950]
call fcn.10015f8b
mov byte [ebp - 4], 6
mov dword [ebp - 0x904], 0xffffffff
mov dword [ebp - 0x4bc], 4
mov dword [ebp - 0x4c4], 0x9cc02768
mov dword [ebp - 0x90c], 0xff905219
push 0
lea eax, [ebp - 0xc88]
push eax
lea eax, [ebp - 0x950]
push eax
push 0x4933
call fcn.10046469
add esp, 0x10
push 1
lea ecx, [ebp - 0x2a0]
call fcn.10015ff8
and dword [eax], 0
jmp 0x10048c76
push 1
lea ecx, [ebp - 0x2a0]
call fcn.10015ff8
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x484]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x484]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x2a0]
call fcn.10015ff8
cmp dword [eax], 0xffffffea
jge 0x10048caa
mov byte [ebp - 0xcb], 0
movzx eax, byte [ebp - 0xcb]
test eax, eax
je 0x10048ca8
push 0x6eeb
push 1
call fcn.1004592a
pop ecx
pop ecx
jmp 0x10048c52
cmp dword [ebp - 0x1b0], 0
je 0x10048faf
push 2
lea ecx, [ebp - 0x2a0]
call fcn.10015ff8
cmp dword [ebp - 0x1b0], 0xffff
je 0x10048cdc
mov dword [ebp - 0x5f4], 1
jmp 0x10048ce3
and dword [ebp - 0x5f4], 0
cmp dword [ebp - 0x5f4], 0x4cd
jle 0x10048cfb
mov dword [ebp - 0x910], 1
jmp 0x10048d02
and dword [ebp - 0x910], 0
cmp dword [ebp - 0x1b0], 0x3afd
jl 0x10048d29
push 2
lea ecx, [ebp - 0x2a0]
call fcn.10015ff8
cmp dword [eax], 0
jne 0x10048d29
and dword [ebp - 0x48c], 0
jmp 0x10048d33
mov dword [ebp - 0x48c], 1
push 1
lea ecx, [ebp - 0x2a0]
call fcn.10015ff8
mov ecx, dword [ebp - 0x48c]
cmp ecx, dword [eax]
jge 0x10048d56
mov dword [ebp - 0x6ac], 1
jmp 0x10048d5d
and dword [ebp - 0x6ac], 0
push 1
lea ecx, [ebp - 0x2a0]
call fcn.10015ff8
mov ecx, dword [ebp - 0x6ac]
cmp ecx, dword [eax]
jge 0x10048d7d
cmp dword [ebp - 0x1b0], 0
jne 0x10048d9c
push 1
lea ecx, [ebp - 0x2a0]
call fcn.10015ff8
cmp dword [eax], 0
jne 0x10048d9c
xor eax, eax
jne 0x10048d9c
and dword [ebp - 0x494], 0
jmp 0x10048da6
mov dword [ebp - 0x494], 1
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x494], eax
jl 0x10048dc0
mov dword [ebp - 0x5fc], 1
jmp 0x10048dc7
and dword [ebp - 0x5fc], 0
push 1
lea ecx, [ebp - 0x2a0]
call fcn.10015ff8
mov ecx, dword [ebp - 0x5fc]
cmp ecx, dword [eax]
jl 0x10048dea
mov dword [ebp - 0x49c], 1
jmp 0x10048df1
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0x49c], eax
jl 0x10048e0b
mov dword [ebp - 0x70c], 1
jmp 0x10048e12
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x918]
cmp dword [ebp - 0x70c], eax
jle 0x10048e2c
mov dword [ebp - 0x4a4], 1
jmp 0x10048e33
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0x4a4], eax
je 0x10048e4d
mov dword [ebp - 0x604], 1
jmp 0x10048e54
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x604], eax
jge 0x10048e80
push 1
lea ecx, [ebp - 0x950]
call fcn.10015ff8
cmp dword [eax], 0
je 0x10048e80
mov dword [ebp - 0x4ac], 1
jmp 0x10048e87
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x904]
cmp dword [ebp - 0x4ac], eax
jge 0x10048ea1
mov dword [ebp - 0x304], 1
jmp 0x10048ea8
and dword [ebp - 0x304], 0
push 1
lea ecx, [ebp - 0x2a0]
call fcn.10015ff8
mov ecx, dword [ebp - 0x304]
mov dword [eax], ecx
cmp dword [ebp - 0x304], 0
je 0x10048ed9
push 3
pop eax
test eax, eax
je 0x10048ed9
mov dword [ebp - 0x6b4], 1
jmp 0x10048ee0
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x6b4]
add eax, 0x4c38b6b0
cmp eax, dword [ebp - 0x2cc]
je 0x10048eff
mov dword [ebp - 0x4b4], 1
jmp 0x10048f06
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0x4b4], eax
jl 0x10048f20
mov dword [ebp - 0x60c], 1
jmp 0x10048f27
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 0
jne 0x10048f57
push 0
lea ecx, [ebp - 0x2a0]
call fcn.10015ff8
cmp dword [eax], 0
jne 0x10048f57
and dword [ebp - 0x730], 0
jmp 0x10048f61
mov dword [ebp - 0x730], 1
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 0xffff
jne 0x10048f85
mov dword [ebp - 0x614], 1
jmp 0x10048f8c
and dword [ebp - 0x614], 0
push 1
lea ecx, [ebp - 0x950]
call fcn.10015ff8
mov ecx, dword [ebp - 0x614]
cmp ecx, dword [eax]
je 0x10048faf
mov dword [ebp - 0x4cc], 1
jmp 0x10048fb6
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x90c], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x950]
call fcn.10015ff3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a0]
call fcn.10015ff3
xor ecx, ecx
call fcn.1002f9cd
push eax
call fcn.1006ad28
pop ecx
mov dword [ebp - 0x7c0], 0xffffffff
mov dword [ebp - 0xbd0], 0x29729cf3
mov dword [ebp - 0xc44], 0x16b471df
push 3
lea ecx, [ebp - 0x8cc]
call fcn.10015f8b
mov dword [ebp - 4], 7
mov dword [ebp - 0xbe0], 0xffffffff
mov dword [ebp - 0x624], 0xb14f4e79
push 2
lea ecx, [ebp - 0x968]
call fcn.10015f8b
mov byte [ebp - 4], 8
mov dword [ebp - 0x310], 0xbc43
mov dword [ebp - 0xc78], 0x23e4
mov dword [ebp - 0x81c], 0xffffffff
mov dword [ebp - 0xbf0], 1
push 1
lea ecx, [ebp - 0xa8c]
call fcn.10015f8b
mov byte [ebp - 4], 9
mov dword [ebp - 0x2d4], 0x360e5697
mov dword [ebp - 0x7c4], 0xa4aa3e85
mov dword [ebp - 0x7c8], 0xbec3a435
mov dword [ebp - 0xaec], 0xa21f9f6d
push 3
lea ecx, [ebp - 0xa74]
call fcn.10015f8b
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x1c], 0
jmp 0x100490c7
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x100490e3
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x8cc]
call fcn.10015ff8
mov dword [eax], 0xfffffff9
jmp 0x100490c0
push 0
push 0x6e01
push 0x7bca
push 0x196b
push 0x45e4
push 0x7cf0
push 0xcb7
push 0x4091
push 0x55ee
lea eax, [ebp - 0x968]
push eax
push 0x2586
lea eax, [ebp - 0x1c]
push eax
push 0x55ac
call fcn.10045e03
add esp, 0x34
mov dword [ebp - 0x1c], 0
jmp 0x1004913a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x10049156
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa8c]
call fcn.10015ff8
mov dword [eax], 0xee87
jmp 0x10049133
mov dword [ebp - 0x1c], 0
jmp 0x10049166
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1004917f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa74]
call fcn.10015ff8
and dword [eax], 0
jmp 0x1004915f
push 0
lea ecx, [ebp - 0x968]
call fcn.10015ff8
cmp dword [eax], 0
jne 0x1004927f
push 2
lea ecx, [ebp - 0x8cc]
call fcn.10015ff8
mov ecx, dword [ebp - 0x624]
cmp dword [eax], ecx
jne 0x100491b8
mov dword [ebp - 0x4d4], 1
jmp 0x100491bf
and dword [ebp - 0x4d4], 0
push 2
lea ecx, [ebp - 0x8cc]
call fcn.10015ff8
cmp dword [eax], 0
jne 0x100491e1
push 0xfffffffffffffffc
pop eax
test eax, eax
jne 0x100491e1
and dword [ebp - 0x6bc], 0
jmp 0x100491eb
mov dword [ebp - 0x6bc], 1
push 0
lea ecx, [ebp - 0xa8c]
call fcn.10015ff8
mov ecx, dword [ebp - 0x6bc]
cmp ecx, dword [eax]
jle 0x1004920e
mov dword [ebp - 0x61c], 1
jmp 0x10049215
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0x61c]
je 0x1004922f
mov dword [ebp - 0x4dc], 1
jmp 0x10049236
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
mov esi, dword [ebp - 0x2d4]
push 0
lea ecx, [ebp - 0x8cc]
call fcn.10015ff8
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4dc]
lea eax, [ecx + eax + 0x5bcc]
imul eax, eax, 0
cmp esi, eax
jle 0x10049278
mov dword [ebp - 0x7b8], 1
jmp 0x1004927f
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x310]
dec eax
mov dword [ebp - 0x310], eax
mov esi, dword [ebp - 0x310]
push 0
lea ecx, [ebp - 0x968]
call fcn.10015ff8
imul esi, dword [eax]
dec esi
cmp esi, dword [ebp - 0x7c4]
jne 0x100492b7
mov dword [ebp - 0x814], 1
jmp 0x100492be
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x7c0]
mov dword [ebp - 0xaf4], eax
mov eax, dword [ebp - 0x81c]
sub eax, dword [ebp - 0x7c8]
cmp eax, 0xffad
jg 0x100492e9
mov dword [ebp - 0x710], 1
jmp 0x100492f0
and dword [ebp - 0x710], 0
cmp dword [ebp - 0x710], 1
ja 0x10049305
mov dword [ebp - 0x4e4], 1
jmp 0x1004930c
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x624], eax
push 1
lea eax, [ebp - 0xa74]
push eax
push 0x6c1f
push 0x17f0
call fcn.1004596f
add esp, 0x10
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa74]
call fcn.10015ff3
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa8c]
call fcn.10015ff3
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x968]
call fcn.10015ff3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8cc]
call fcn.10015ff3
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x120], 0xde450bb
mov dword [ebp - 0x334], 0xfffffff9
mov dword [ebp - 0xec], 0
mov dword [ebp - 0x82c], 0x27067d5b
mov dword [ebp - 0x644], 1
mov dword [ebp - 0x834], 1
mov dword [ebp - 0x28], 0
jmp 0x100493c2
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x100493d8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x140], 0xfda6c2e3
jmp 0x100493bb
mov dword [ebp - 0x28], 0
jmp 0x100493e8
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x100493fe
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x764], 0
jmp 0x100493e1
mov dword [ebp - 0x28], 0
jmp 0x1004940e
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x10049424
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x7d8], 0x3a50eb6b
jmp 0x10049407
cmp dword [ebp - 0x7c], 0
je 0x100496ae
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x10049534
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x1004947b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x140], 0
jne 0x1004947b
and dword [ebp - 0x4ec], 0
jmp 0x10049485
mov dword [ebp - 0x4ec], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x140]
cmp dword [ebp - 0x4ec], eax
jg 0x100494a6
mov dword [ebp - 0x6c4], 1
jmp 0x100494ad
and dword [ebp - 0x6c4], 0
cmp dword [ebp - 0x6c4], 1
jbe 0x100494c2
mov dword [ebp - 0x4f4], 1
jmp 0x100494c9
and dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x4f4], 0xffff
jbe 0x100494db
cmp dword [ebp - 0x7c], 0
jne 0x100494f4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x140], 0
jne 0x100494f4
and dword [ebp - 0x62c], 0
jmp 0x100494fe
mov dword [ebp - 0x62c], 1
cmp dword [ebp - 0x62c], 0xf9f3
je 0x10049516
mov dword [ebp - 0x4fc], 1
jmp 0x1004951d
and dword [ebp - 0x4fc], 0
imul eax, dword [ebp - 0x4fc], 0x6d9e
test eax, eax
jne 0x10049534
and dword [ebp - 0x2dc], 0
jmp 0x1004953e
mov dword [ebp - 0x2dc], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2dc]
mov dword [ebp + eax - 0x140], ecx
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x2dc], eax
jne 0x10049568
mov dword [ebp - 0x6e0], 1
jmp 0x1004956f
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x6e0]
sub eax, dword [ebp - 0x7c]
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0xec], eax
jne 0x10049598
mov dword [ebp - 0x504], 1
jmp 0x1004959f
and dword [ebp - 0x504], 0
cmp dword [ebp - 0x504], 1
jl 0x100495b4
mov dword [ebp - 0x634], 1
jmp 0x100495bb
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x634], eax
jge 0x100495d2
mov dword [ebp - 0x824], 1
jmp 0x100495d9
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0xb04], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x140]
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xb14], eax
mov eax, 0x9a5c1b09
cmp eax, 0xf997ec53
jae 0x1004961c
mov dword [ebp - 0x50c], 1
jmp 0x10049623
and dword [ebp - 0x50c], 0
cmp dword [ebp - 0x50c], 0x1b78cd90
jl 0x1004963b
mov dword [ebp - 0x6cc], 1
jmp 0x10049642
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x6cc], eax
jge 0x1004965c
mov dword [ebp - 0x514], 1
jmp 0x10049663
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x514], eax
jge 0x1004967d
mov dword [ebp - 0x7d0], 1
jmp 0x10049684
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xb1c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x764]
cmp dword [ebp - 0x334], eax
jg 0x100496ae
mov dword [ebp - 0x63c], 1
jmp 0x100496b5
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x7c]
add eax, dword [ebp - 0x63c]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x764]
test eax, eax
jne 0x100496e5
cmp dword [ebp - 0x82c], 0
jne 0x100496e5
mov dword [ebp - 0x51c], 1
jmp 0x100496ec
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x51c], eax
je 0x10049706
mov dword [ebp - 0x6e4], 1
jmp 0x1004970d
and dword [ebp - 0x6e4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6e4]
add ecx, dword [ebp + eax - 0x764]
mov dword [ebp - 0x524], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x524]
mov dword [ebp + eax - 0x764], ecx
mov eax, dword [ebp - 0x524]
dec eax
mov dword [ebp - 0x644], eax
mov eax, 0x41e55969
sub eax, dword [ebp - 0x644]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x7d8], eax
lea eax, [ebp - 0x834]
push eax
push 0x15d8
push 0x49ff
push 1
call fcn.100459f2
add esp, 0x10
mov byte [ebp - 0x238], 8
mov byte [ebp - 0x237], 0x20
mov byte [ebp - 0x236], 6
mov byte [ebp - 0x235], 1
mov byte [ebp - 0x234], 2
mov byte [ebp - 0x233], 6
mov byte [ebp - 0x232], 3
mov byte [ebp - 0x231], 0
mov byte [ebp - 0x230], 4
mov byte [ebp - 0x22f], 0xf
mov byte [ebp - 0x22e], 9
mov byte [ebp - 0x22d], 8
mov byte [ebp - 0x22c], 5
mov byte [ebp - 0x22b], 1
mov byte [ebp - 0x22a], 0
mov byte [ebp - 0x229], 0
mov byte [ebp - 0x228], 7
mov byte [ebp - 0x227], 7
mov byte [ebp - 0x226], 0x22
mov byte [ebp - 0x225], 0x4d
mov byte [ebp - 0x224], 0xdd
mov byte [ebp - 0x223], 0x9e
mov byte [ebp - 0x222], 0x61
mov byte [ebp - 0x221], 0xc5
mov byte [ebp - 0x220], 0xa3
mov byte [ebp - 0x21f], pe_nt_image_headers32
mov byte [ebp - 0x21e], 0xb1
mov byte [ebp - 0x21d], 0x99
mov byte [ebp - 0x21c], 0xb7
mov byte [ebp - 0x21b], 0x63
mov byte [ebp - 0x21a], 0xef
mov byte [ebp - 0x219], 0x83
mov byte [ebp - 0x218], 0x23
mov byte [ebp - 0x217], 0xe6
mov byte [ebp - 0x216], 0x58
mov byte [ebp - 0x215], 0x19
mov byte [ebp - 0x214], 0x85
mov byte [ebp - 0x213], 0xb8
mov byte [ebp - 0x212], 0x55
mov byte [ebp - 0x211], 0x34
mov byte [ebp - 0x210], 0x37
mov byte [ebp - 0x20f], 0xda
mov byte [ebp - 0x20e], 0xf3
mov byte [ebp - 0x20d], 0xb2
mov byte [ebp - 0x20c], 0x58
mov byte [ebp - 0x20b], 0x8e
mov byte [ebp - 0x20a], 0x61
mov byte [ebp - 0x209], 0xa
mov byte [ebp - 0x208], 0x5d
mov byte [ebp - 0x207], 0xa6
mov byte [ebp - 0x206], 0xb7
mov byte [ebp - 0x205], 0xe2
mov byte [ebp - 0x204], 0x99
mov byte [ebp - 0x203], 1
mov byte [ebp - 0x202], 3
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x238]
or eax, 0x10
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x238]
and ecx, 0x10
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x238]
mov byte [ebp + ecx - 0x75c], al
mov dword [ebp - 0x44], 2
and dword [ebp - 0x1fc], 0
jmp 0x1004994b
mov eax, dword [ebp - 0x44]
inc eax
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x37
jae 0x10049a01
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x238]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x44], eax
jne 0x10049995
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x238]
inc eax
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x238]
mov ecx, dword [ebp - 0x44]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x44], eax
jmp 0x10049943
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x237]
mov ecx, dword [ebp - 0x44]
sub ecx, dword [ebp - 0x1fc]
movzx ecx, byte [ebp + ecx - 0x23a]
movsx ecx, byte [ebp + ecx - 0x75c]
or eax, ecx
mov ecx, dword [ebp - 0x44]
movzx ecx, byte [ebp + ecx - 0x237]
mov edx, dword [ebp - 0x44]
sub edx, dword [ebp - 0x1fc]
movzx edx, byte [ebp + edx - 0x23a]
movsx edx, byte [ebp + edx - 0x75c]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x44]
movzx ecx, byte [ebp + ecx - 0x238]
mov byte [ebp + ecx - 0x75c], al
and dword [ebp - 0x1fc], 0
jmp 0x10049943
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x75c], 0
lea eax, [ebp - 0x75c]
push eax
lea ecx, [ebp - 0xd70]
call fcn.10024533
mov dword [ebp - 0x7e0], eax
mov eax, dword [ebp - 0x7e0]
mov dword [ebp - 0x83c], eax
mov dword [ebp - 4], 0xb
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x83c]
call fcn.1002f98d
pop ecx
mov dword [ebp - 0x840], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd70]
call fcn.10015eed
mov dword [ebp - 0x54], 0xa3367f5e
mov dword [ebp - 0x50], 0xffff
mov dword [ebp - 0x2e4], 0x86335c0
mov dword [ebp - 0xb24], 0
mov dword [ebp - 0xb2c], 0xffffffff
mov dword [ebp - 0xb34], 0xfffffffe
mov dword [ebp - 0xb3c], 0xfffffff9
push 1
lea ecx, [ebp - 0xbcc]
call fcn.10015f8b
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xb44], 0
mov dword [ebp - 0x84c], 6
lea eax, [ebp - 0xb4c]
push eax
lea eax, [ebp - 0xbcc]
push eax
push 1
call fcn.10045a68
add esp, 0xc
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xb54], eax
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xb5c], eax
cmp dword [ebp - 0x54], 0
je 0x10049b8f
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x54], eax
jg 0x10049b16
mov dword [ebp - 0x52c], 1
jmp 0x10049b1d
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x52c], eax
jge 0x10049b34
mov dword [ebp - 0x6d4], 1
jmp 0x10049b3b
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x6d4], eax
jl 0x10049b52
mov dword [ebp - 0x534], 1
jmp 0x10049b59
and dword [ebp - 0x534], 0
cmp dword [ebp - 0x534], 0xc99c
jle 0x10049b71
mov dword [ebp - 0x64c], 1
jmp 0x10049b78
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x64c], eax
jl 0x10049b8f
mov dword [ebp - 0x53c], 1
jmp 0x10049b96
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x53c]
neg eax
sub eax, dword [ebp - 0x50]
cmp eax, 0xc3d6
je 0x10049bb4
mov dword [ebp - 0x6ec], 1
jmp 0x10049bbb
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x6ec]
sub eax, dword [ebp - 0x50]
je 0x10049bd8
cmp dword [ebp - 0x50], 0
je 0x10049bd8
mov dword [ebp - 0x544], 1
jmp 0x10049bdf
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x2e4], eax
jle 0x10049c02
mov dword [ebp - 0x654], 1
jmp 0x10049c09
and dword [ebp - 0x654], 0
cmp dword [ebp - 0x654], 0x1eb64d0
jl 0x10049c21
mov dword [ebp - 0x54c], 1
jmp 0x10049c28
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x54c]
test eax, eax
je 0x10049d52
mov dword [ebp - 0x7f4], 0xa9c79ebe
mov dword [ebp - 0x7e8], 0xdedbec15
mov dword [ebp - 0x844], 0x416da84b
mov dword [ebp - 0x50], 0
jmp 0x10049c68
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x1c
jl 0x10049d2a
push 2
lea ecx, [ebp - 0xaa4]
call fcn.10015f8b
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x1b8], 0
jmp 0x10049c9c
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 2
jge 0x10049cbb
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0xaa4]
call fcn.10015ff8
and dword [eax], 0
jmp 0x10049c8f
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x7e8]
push eax
push 0
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0xaa4]
push eax
lea eax, [ebp - 0x7f4]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.10046820
add esp, 0x20
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x10049d16
push 0x54ea
push 0x40d5
push 0
call fcn.100463a2
add esp, 0xc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xaa4]
call fcn.10015ff3
jmp 0x10049c61
mov byte [ebp - 0xce], 0
movzx eax, byte [ebp - 0xce]
test eax, eax
je 0x10049d50
push 0x376f
push 0x716a
push 0
call fcn.1004623f
add esp, 0xc
jmp 0x10049d5a
push 1
call fcn.10045ad1
pop ecx
push 1
lea eax, [ebp - 0x84c]
push eax
push 0x44cd
call fcn.10045aff
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbcc]
call fcn.10015ff3
and dword [ebp - 0x1e4], 0
jmp 0x10049d95
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0xb
jae 0x10049dae
mov eax, dword [ebp - 0x1e4]
mov byte [ebp + eax - 0x75c], 0
jmp 0x10049d88
mov dword [ebp - 0xfc], 0xcf5
mov dword [ebp - 0x564], 0xfffffff7
mov dword [ebp - 0xb64], 0xc23afc37
mov dword [ebp - 0x148], 0xfffffffc
mov dword [ebp - 0x1c0], 0
jmp 0x10049def
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 2
jge 0x10049e0b
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x76c], 0x5a80e358
jmp 0x10049de2
cmp dword [ebp - 0xfc], 0
je 0x1004a0f9
mov dword [ebp - 0x854], 9
mov dword [ebp - 0xb70], 0xffffffff
mov dword [ebp - 0x808], 0
mov dword [ebp - 0xb7c], 0xf5af8b51
mov dword [ebp - 0x1c8], 0x223fa3a9
mov dword [ebp - 0x180], 1
push 3
lea ecx, [ebp - 0xa38]
call fcn.10015f8b
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x128], 0
jmp 0x10049e81
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 2
jge 0x10049e9d
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0xb78], 0xa715cc48
jmp 0x10049e74
lea eax, [ebp - 0x128]
push eax
push 0x12a0
push 1
lea eax, [ebp - 0xa38]
push eax
call fcn.10045b41
add esp, 0x10
push 1
lea eax, [ebp - 0xa38]
push eax
push 0x7741
push 0x4c87
call fcn.10045bc4
add esp, 0x10
mov dword [ebp - 0x1c8], 6
jmp 0x10049eee
mov eax, dword [ebp - 0x1c8]
dec eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0xfffffff2
jl 0x1004a0e8
mov dword [ebp - 0x184], 0xfffffff8
mov dword [ebp - 0x180], 0
jmp 0x10049f1e
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xffffffef
jne 0x10049f5e
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x10049f5c
push 0x4f5f
push 0x4d9c
push 0x1a2
push 0x8f0
push 0
push 0x923
call fcn.10046696
add esp, 0x18
jmp 0x10049f11
cmp dword [ebp - 0x854], 0
je 0x1004a02c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x76c]
mov dword [ebp - 0xb88], eax
cmp dword [ebp - 0x184], 0
jge 0x10049f93
mov dword [ebp - 0x800], 1
jmp 0x10049f9a
and dword [ebp - 0x800], 0
xor eax, eax
cmp eax, 0x3bc9fc22
je 0x10049faf
mov dword [ebp - 0x6dc], 1
jmp 0x10049fb6
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x6dc]
sub eax, dword [ebp - 0x184]
add eax, 3
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0xb78]
jge 0x10049fe0
mov dword [ebp - 0x554], 1
jmp 0x10049fe7
and dword [ebp - 0x554], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x76c]
cmp dword [ebp - 0x554], eax
jg 0x1004a008
mov dword [ebp - 0x65c], 1
jmp 0x1004a00f
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x148]
imul eax, dword [ebp - 0x65c]
neg eax
je 0x1004a02c
mov dword [ebp - 0x55c], 1
jmp 0x1004a033
and dword [ebp - 0x55c], 0
cmp dword [ebp - 0x55c], 0xd8d7cd14
jb 0x1004a04b
mov dword [ebp - 0x6f4], 1
jmp 0x1004a052
and dword [ebp - 0x6f4], 0
cmp dword [ebp - 0x6f4], 0x5e7e8ee7
jge 0x1004a06a
mov dword [ebp - 0x898], 1
jmp 0x1004a071
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0xc18], eax
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0xc20], eax
mov eax, dword [ebp - 0x564]
cmp dword [ebp - 0x808], eax
jg 0x1004a0a3
mov dword [ebp - 0x664], 1
jmp 0x1004a0aa
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x664]
sub eax, 0x2cbf
cmp eax, dword [ebp - 0x184]
jle 0x1004a0c9
mov dword [ebp - 0x370], 1
jmp 0x1004a0d0
and dword [ebp - 0x370], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x370]
mov dword [ebp + eax - 0x76c], ecx
jmp 0x10049ee1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa38]
call fcn.10015ff3
jmp 0x1004a10f
mov dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x378], eax
mov dword [ebp - 0x148], 0
jmp 0x1004a128
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0x28
jge 0x1004a1c4
mov dword [ebp - 0x8fc], 0xffffffff
mov dword [ebp - 0xfc], 0
jmp 0x1004a158
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jg 0x1004a1b4
mov byte [ebp - 0xd7], 0
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x1004a1a0
push 0x5ce1
push 0x2840
push 0x3b4f
push 0xd4e
push 0x5755
push 1
push 0x240c
push 0x612b
call fcn.10045c47
add esp, 0x20
mov eax, dword [ebp - 0xfc]
cmp dword [ebp + eax*4 - 0x76c], 0
je 0x1004a1b2
jmp 0x1004a1b4
jmp 0x1004a14b
cmp dword [ebp - 0x8fc], 0
je 0x1004a1bf
jmp 0x1004a1c4
jmp 0x1004a11b
mov dword [ebp - 0x810], 1
mov dword [ebp - 0x18c], 0
jmp 0x1004a1e7
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 2
jge 0x1004a203
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0xbac], 7
jmp 0x1004a1da
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbac]
mov dword [ebp - 0x810], eax
push 0
push 0x6c1b
push 0x120
call fcn.10046199
add esp, 0xc
mov byte [ebp - 0x170], 3
mov byte [ebp - 0x16f], 0xf3
mov byte [ebp - 0x16e], 7
mov byte [ebp - 0x16d], 4
mov byte [ebp - 0x16c], 8
mov byte [ebp - 0x16b], 6
mov byte [ebp - 0x16a], 5
mov byte [ebp - 0x169], 1
mov byte [ebp - 0x168], 6
mov byte [ebp - 0x167], 0xa5
mov byte [ebp - 0x166], 0x35
mov byte [ebp - 0x165], 2
mov byte [ebp - 0x164], 0xe9
mov byte [ebp - 0x163], 0xbf
mov byte [ebp - 0x162], 0x63
mov byte [ebp - 0x161], 6
mov byte [ebp - 0x160], 8
mov byte [ebp - 0x15f], 4
mov byte [ebp - 0x15e], 0xd
mov byte [ebp - 0x15d], 0
mov byte [ebp - 0x15c], 5
mov byte [ebp - 0x15b], 2
mov byte [ebp - 0x15a], 6
mov byte [ebp - 0x159], 9
mov byte [ebp - 0x158], 7
mov byte [ebp - 0x157], 1
mov byte [ebp - 0x156], 6
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x170]
or eax, 0xc1
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x170]
and ecx, 0xc1
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x170]
mov byte [ebp + ecx - 0x750], al
mov dword [ebp - 0x24], 2
and dword [ebp - 0x130], 0
jmp 0x1004a33d
mov eax, dword [ebp - 0x24]
inc eax
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1b
jae 0x1004a42a
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x170]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x24], eax
jne 0x1004a387
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x170]
inc eax
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x170]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x24], eax
jmp 0x1004a335
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x16f]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x130]
movzx ecx, byte [ebp + ecx - 0x172]
movsx ecx, byte [ebp + ecx - 0x750]
add eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x16f]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x130]
movzx edx, byte [ebp + edx - 0x172]
movsx edx, byte [ebp + edx - 0x750]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x16f]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x130]
movzx edx, byte [ebp + edx - 0x172]
movsx edx, byte [ebp + edx - 0x750]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x170]
mov byte [ebp + ecx - 0x750], al
push 0x36a0
push 0
lea eax, [ebp - 0x130]
push eax
call fcn.100461ef
add esp, 0xc
jmp 0x1004a335
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x750], 0
lea eax, [ebp - 0x750]
push eax
lea ecx, [ebp - 0xd88]
call fcn.10024533
mov dword [ebp - 0x8a0], eax
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0x818], eax
mov dword [ebp - 4], 0xf
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x818]
call fcn.1002f98d
pop ecx
mov dword [ebp - 0x8e8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd88]
call fcn.10015eed
mov dword [ebp - 0xc28], 0xa3cc92ea
mov dword [ebp - 0x91c], 0xe1c2e937
mov dword [ebp - 0x830], 0x43af7806
push 2
lea ecx, [ebp - 0xa68]
call fcn.10015f8b
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x108], 0
jmp 0x1004a4d3
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 3
jge 0x1004a4ef
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x980], 0x69fdf99f
jmp 0x1004a4c6
lea eax, [ebp - 0x108]
push eax
push 0
lea eax, [ebp - 0xa68]
push eax
call fcn.100463fd
add esp, 0xc
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x980], 0
jmp 0x1004a535
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x980]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x980], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x980], 0xfffffffb
jg 0x1004a63f
mov dword [ebp - 0x828], 0x96a485bf
mov dword [ebp - 0x820], 0xc32b96ce
mov dword [ebp - 0x8b0], 0xc863cc1d
push 3
lea ecx, [ebp - 0xa80]
call fcn.10015f8b
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x838], 0x312e
mov dword [ebp - 0x8a8], 0x1bd4
mov dword [ebp - 0x8e4], 0x4d7d9c74
mov dword [ebp - 0x194], 0
jmp 0x1004a5af
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 3
jge 0x1004a5d1
push dword [ebp - 0x194]
lea ecx, [ebp - 0xa80]
call fcn.10015ff8
mov dword [eax], 0xe0d1b713
jmp 0x1004a5a2
push 1
lea eax, [ebp - 0xa80]
push eax
lea eax, [ebp - 0x91c]
push eax
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0x8a8]
push eax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x8e4]
push eax
lea eax, [ebp - 0x830]
push eax
push 0xbd1
lea eax, [ebp - 0x8b0]
push eax
push 0x2917
lea eax, [ebp - 0x838]
push eax
call fcn.10045e03
add esp, 0x34
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xa80]
call fcn.10015ff3
jmp 0x1004a51a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa68]
call fcn.10015ff3
and dword [ebp - 0x19c], 0
jmp 0x1004a664
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0xb
jae 0x1004a67d
mov eax, dword [ebp - 0x19c]
mov byte [ebp + eax - 0x750], 0
jmp 0x1004a657
mov dword [ebp - 0xa0], 0xba394643
mov dword [ebp - 0x380], 0
mov dword [ebp - 0x1a4], 0
jmp 0x1004a6aa
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 4
jge 0x1004a6c6
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0x92c], 3
jmp 0x1004a69d
mov dword [ebp - 0xa0], 0
jmp 0x1004a6df
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jg 0x1004a749
mov dword [ebp - 0x10c], 0xc07e17f7
mov dword [ebp - 0x10c], 0
jmp 0x1004a70b
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 4
jge 0x1004a727
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x92c], 1
jmp 0x1004a6fe
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x1004a747
push 0x38cb
push 1
call fcn.10046082
pop ecx
pop ecx
jmp 0x1004a6d2
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x92c]
mov dword [ebp - 0x380], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x92c]
cmp eax, dword [ebp - 0x380]
jg 0x1004a77d
mov dword [ebp - 0x388], 1
jmp 0x1004a784
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x388]
jg 0x1004a79e
mov dword [ebp - 0x390], 1
jmp 0x1004a7a5
and dword [ebp - 0x390], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x92c]
cmp eax, dword [ebp - 0x390]
jl 0x1004a7c6
mov dword [ebp - 0x398], 1
jmp 0x1004a7cd
and dword [ebp - 0x398], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x92c]
mov dword [ebp - 0xc30], eax
cmp dword [ebp - 0x398], 0x7525d2d9
jne 0x1004a7f8
mov dword [ebp - 0x3a0], 1
jmp 0x1004a7ff
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x3a0], eax
je 0x1004a825
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x92c], 0
jne 0x1004a825
and dword [ebp - 0x3a8], 0
jmp 0x1004a82f
mov dword [ebp - 0x3a8], 1
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0xa0], eax
push dword [ebp - 0x8e8]
push dword [ebp - 0x840]
call fcn.10042710
pop ecx
pop ecx
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x84], 0x53b26bdd
mov dword [ebp - 0xa04], 0x2a74db50
mov dword [ebp - 0xa00], 0x2a74db50
mov dword [ebp - 0x9fc], 0x2a74db50
mov dword [ebp - 0x9f8], 0x2a74db50
lea ecx, [ebp - 0x311]
call fcn.10008b33
push eax
lea eax, [ebp - 0x9f4]
push eax
lea eax, [ebp - 0xa04]
push eax
lea ecx, [ebp - 0xd28]
call fcn.10016007
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x790]
call fcn.10015fcd
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x408], 0x3c44
push 3
lea ecx, [ebp - 0x974]
call fcn.10015f8b
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x74], 0
jmp 0x1004a8ed
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x1004a903
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x8c], 0x585b7f37
jmp 0x1004a8e6
mov dword [ebp - 0x74], 0
jmp 0x1004a913
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1004a92f
push dword [ebp - 0x74]
lea ecx, [ebp - 0x974]
call fcn.10015ff8
mov dword [eax], 0xfba24273
jmp 0x1004a90c
mov dword [ebp - 0x84], 0
jmp 0x1004a948
cmp dword [ebp - 0x84], 0xfffffffa
jl 0x1004af85
mov dword [ebp - 0xe0], 0xffffffff
mov dword [ebp - 0x104], 0xffffffff
push 4
lea ecx, [ebp - 0x998]
call fcn.10015f8b
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x30], 0
jmp 0x1004a98a
cmp dword [ebp - 0x30], 2
jge 0x1004a9a0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x974]
call fcn.10015ff3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x790]
call fcn.10015ff3
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0x36c]
mov dword [eax + 8], ecx
mov dword [ebp - 0x114], 0x6db5
mov dword [ebp - 0x460], 0x65e3edfa
mov dword [ebp - 0x850], 0xffffffff
mov dword [ebp - 0x1ac], 0
jmp 0x1004afe9
cmp dword [ebp - 0x1ac], 3
jge 0x1004b005
push 0
push 0x842
push 0x231
call dword [sym.imp.GDI32.dll_CreatePen]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret