Function at 0x10048dbd
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008a3d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc50
push esi
and dword [ebp - 0x1c], 0
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004de87
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xd0], 0xd149febb
mov dword [ebp - 0x528], 0xfffffff7
mov dword [ebp - 0x588], 0x30f888c5
mov dword [ebp - 0x198], 0
jmp 0x10048e29
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 1
jge 0x10048e45
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x9c], 0x2beaa32b
jmp 0x10048e1c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xd0], 0x12
jmp 0x10048e71
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xa
jl 0x10049099
push 2
lea ecx, [ebp - 0x6a4]
call fcn.10017107
and dword [ebp - 4], 0
mov dword [ebp - 0x81c], 0x21fbb9
mov dword [ebp - 0x818], 0x21fbb9
mov dword [ebp - 0x814], 0x21fbb9
mov dword [ebp - 0x810], 0x21fbb9
lea ecx, [ebp - 0x2d9]
call fcn.10009433
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x81c]
push eax
lea ecx, [ebp - 0xb44]
call fcn.100171b4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x8c0]
call fcn.10017163
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c4], 0
jmp 0x10048f09
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 2
jge 0x10048f2b
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x6a4]
call fcn.100171a5
mov dword [eax], 0xfffffffa
jmp 0x10048efc
push 1
lea ecx, [ebp - 0x6a4]
call fcn.100171a5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c]
mov dword [ebp - 0xa14], eax
push 0
lea ecx, [ebp - 0x6a4]
call fcn.100171a5
cmp dword [eax], 0xff60
jge 0x10048f6c
mov dword [ebp - 0x710], 1
jmp 0x10048f73
and dword [ebp - 0x710], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c]
mov dword [ebp - 0x9f0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c]
mov dword [ebp - 0x8f4], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x9c]
cmp dword [ebp + eax - 0x9c], ecx
jne 0x10048fc1
mov dword [ebp - 0x2a8], 1
jmp 0x10048fc8
and dword [ebp - 0x2a8], 0
push 2
lea ecx, [ebp - 0x8c0]
call fcn.100171a5
mov ecx, dword [ebp - 0x2a8]
mov dword [eax], ecx
cmp dword [ebp - 0x2a8], 0xfffffffb
jbe 0x10048ff2
mov dword [ebp - 0x490], 1
jmp 0x10048ff9
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x528], eax
mov eax, dword [ebp - 0x490]
sub eax, 0xffff
imul eax, eax, 7
mov esi, dword [ebp - 0x528]
imul esi, eax
push 1
lea ecx, [ebp - 0x6a4]
call fcn.100171a5
cmp dword [eax], esi
jge 0x10049039
mov dword [ebp - 0x550], 1
jmp 0x10049040
and dword [ebp - 0x550], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c]
sub eax, 0x105bd4b8
imul eax, dword [ebp - 0x550]
mov dword [ebp - 0x588], eax
push 2
lea ecx, [ebp - 0x8c0]
call fcn.100171a5
mov dword [ebp - 0x588], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8c0]
call fcn.10017189
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6a4]
call fcn.10017189
jmp 0x10048e64
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x1e4], 0x25b9b55b
push 2
lea ecx, [ebp - 0x788]
call fcn.10017107
mov dword [ebp - 4], 2
mov dword [ebp - 0x1a4], 0
jmp 0x100490d9
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 2
jge 0x100490f8
push dword [ebp - 0x1a4]
lea ecx, [ebp - 0x788]
call fcn.100171a5
or dword [eax], 0xffffffff
jmp 0x100490cc
mov dword [ebp - 0x1e4], 0x10
jmp 0x10049111
mov eax, dword [ebp - 0x1e4]
dec eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0xfffffff2
jle 0x10049218
mov dword [ebp - 0x54], 0xfffffff7
mov dword [ebp - 0x54], 0
jmp 0x10049135
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jg 0x100491e1
mov dword [ebp - 0x188], 0xffffffff
mov dword [ebp - 0x188], 1
jmp 0x10049162
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jl 0x10049189
mov byte [ebp - 0x83], 0
movzx eax, byte [ebp - 0x83]
test eax, eax
je 0x10049187
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
jmp 0x10049155
push dword [ebp - 0x54]
lea ecx, [ebp - 0x788]
call fcn.100171a5
mov ecx, 0x1a17e59
sub ecx, dword [eax]
je 0x100491b6
push 0
lea ecx, [ebp - 0x788]
call fcn.100171a5
cmp dword [eax], 0
je 0x100491b4
jmp 0x100491e1
jmp 0x100491dc
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x100491dc
push 0
push 0x6041
push 0x5c33
call fcn.100471d0
add esp, 0xc
jmp 0x1004912e
mov dword [ebp - 0x54], 0
jmp 0x100491f1
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jg 0x10049213
mov byte [ebp - 0x90], 0
movzx eax, byte [ebp - 0x90]
test eax, eax
je 0x10049211
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
jmp 0x100491ea
jmp 0x10049104
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x788]
call fcn.10017189
mov eax, dword [ebp - 0x444]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1004923c
jmp 0x1004dead
mov dword [ebp - 0x8f8], 0
mov dword [ebp - 0x900], 0x4ffb871c
mov dword [ebp - 0x908], 0x6ca2cb51
mov dword [ebp - 0x910], 1
mov dword [ebp - 0x918], 0xffffffff
mov dword [ebp - 0x920], 0xc4ab274b
mov dword [ebp - 0x928], 0xad2086bd
mov dword [ebp - 0x930], 0x53e58bfc
mov dword [ebp - 0x938], 0xffffffff
mov dword [ebp - 0x940], 0
mov dword [ebp - 0x948], 0xfffffff9
mov dword [ebp - 0x950], 0x41637c1d
mov dword [ebp - 0x958], 0x85bd52a2
mov dword [ebp - 0x534], 0x1d9
mov dword [ebp - 0x960], 0x7440e708
mov dword [ebp - 0x1ac], 0
jmp 0x100492eb
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 1
jge 0x10049307
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0x968], 0xfffffffa
jmp 0x100492de
mov byte [ebp - 0x92], 0
movzx eax, byte [ebp - 0x92]
test eax, eax
je 0x10049327
push 0x6028
push 0
call fcn.10047045
pop ecx
pop ecx
mov eax, dword [ebp - 0x534]
dec eax
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0x444]
mov ecx, dword [ebp - 0x30]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xec], 0xfb871c7b
mov dword [ebp - 0xdc], 0x5c82f744
mov dword [ebp - 0x66c], 0xfffffff8
mov dword [ebp - 0x970], 0xfffffffb
mov dword [ebp - 0x978], 0xffffffff
mov dword [ebp - 0x980], 5
mov dword [ebp - 0x988], 0x364f2ca1
mov dword [ebp - 0x990], 0xfffffff8
mov dword [ebp - 0x998], 0xe85dc32c
mov dword [ebp - 0x9a0], 0xffffffff
push 2
lea ecx, [ebp - 0x9e8]
call fcn.10017107
mov dword [ebp - 4], 3
mov dword [ebp - 0x4c], 0
jmp 0x100493ce
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x100493e4
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x83c], 0x64a6847d
jmp 0x100493c7
mov dword [ebp - 0x4c], 0
jmp 0x100493f4
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x10049410
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x9e8]
call fcn.100171a5
mov dword [eax], 0x49f7fae0
jmp 0x100493ed
mov byte [ebp - 0x94], 0
movzx eax, byte [ebp - 0x94]
test eax, eax
je 0x1004942a
push 1
call fcn.1004697e
pop ecx
mov dword [ebp - 0xec], 2
jmp 0x10049443
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x10049758
mov dword [ebp - 0x68], 0x443250e6
mov dword [ebp - 0x7a4], 0x924f
mov dword [ebp - 0x7a0], 0x924f
mov dword [ebp - 0x79c], 0x924f
mov dword [ebp - 0x798], 0x924f
push 4
lea ecx, [ebp - 0x9d8]
call fcn.10017107
mov byte [ebp - 4], 4
mov dword [ebp - 0x9a8], 9
mov dword [ebp - 0x1cc], 0
jmp 0x100494b3
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 4
jge 0x100494d5
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0x9d8]
call fcn.100171a5
mov dword [eax], 7
jmp 0x100494a6
mov dword [ebp - 0x68], 0
jmp 0x100494e5
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jg 0x1004966e
mov dword [ebp - 0xa4], 0x39ecf4a
mov dword [ebp - 0x664], 0xed55c59c
cmp dword [ebp - 0xa4], 0
je 0x10049517
push 5
pop eax
test eax, eax
jne 0x100495c3
mov eax, dword [ebp - 0xec]
add eax, dword [ebp - 0xec]
cmp eax, 0xe224
je 0x10049536
mov dword [ebp - 0x520], 1
jmp 0x1004953d
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x520]
jl 0x10049554
mov dword [ebp - 0x654], 1
jmp 0x1004955b
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x9b0], eax
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0xa4]
cmp eax, 0xf8609561
jb 0x1004958c
cmp dword [ebp - 0xa4], 0
jne 0x1004958c
and dword [ebp - 0x304], 0
jmp 0x10049596
mov dword [ebp - 0x304], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7a4]
cmp dword [ebp - 0x304], eax
jl 0x100495ba
cmp dword [ebp - 0x68], 0
jne 0x100495ba
cmp dword [ebp - 0xa4], 0
jne 0x100495c3
and dword [ebp - 0x554], 0
jmp 0x100495cd
mov dword [ebp - 0x554], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7a4]
cmp dword [ebp - 0x554], eax
jg 0x100495ee
mov dword [ebp - 0x65c], 1
jmp 0x100495f5
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp + eax*4 - 0x83c]
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x30c]
mov dword [ebp + eax*4 - 0x83c], ecx
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x30c], eax
jg 0x1004962f
mov dword [ebp - 0x44c], 1
jmp 0x10049636
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
sub eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x664]
jge 0x10049656
mov dword [ebp - 0x314], 1
jmp 0x1004965d
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x66c], eax
jmp 0x100494de
mov dword [ebp - 0xdc], 2
jmp 0x10049687
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jl 0x10049744
push 1
lea ecx, [ebp - 0x8cc]
call fcn.10017107
mov byte [ebp - 4], 5
mov dword [ebp - 0x9b8], 0
mov dword [ebp - 0x674], 0
mov dword [ebp - 0x1b4], 0
jmp 0x100496d2
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 1
jge 0x100496f4
push dword [ebp - 0x1b4]
lea ecx, [ebp - 0x8cc]
call fcn.100171a5
mov dword [eax], 0xb9cbadbe
jmp 0x100496c5
mov eax, dword [ebp - 0xdc]
cmp dword [ebp + eax*4 - 0x83c], 0
je 0x10049715
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8cc]
call fcn.10017189
jmp 0x10049744
lea eax, [ebp - 0x674]
push eax
push 0x645f
push 0x12b8
push 0
call fcn.10046f08
add esp, 0x10
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8cc]
call fcn.10017189
jmp 0x1004967a
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x9d8]
call fcn.10017189
jmp 0x10049436
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e8]
call fcn.10017189
mov eax, dword [ebp - 0xbc]
cmp dword [eax], 0x4550
je 0x1004977a
jmp 0x1004dead
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbc]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0xfc], 0x61f9c28a
mov dword [ebp - 0x2e8], 0x1d925b0e
mov dword [ebp - 0x150], 0x1aa1
push 2
lea ecx, [ebp - 0x8a8]
call fcn.10017107
mov dword [ebp - 4], 6
mov dword [ebp - 0x684], 0
push 0x3d00
lea eax, [ebp - 0x8a8]
push eax
push 1
push 0x7c23
lea eax, [ebp - 0x9c0]
push eax
push 0x64c1
call fcn.100469ad
add esp, 0x18
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x10049810
push 0x64d4
push 1
call fcn.10046a86
pop ecx
pop ecx
cmp dword [ebp - 0xfc], 0
je 0x10049a33
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x2b0], 9
mov dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0xfc], 0
jmp 0x10049858
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0xffffffed
jle 0x10049a31
mov dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x9c8], eax
cmp dword [ebp - 0x2e8], 0
je 0x100498a8
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x2e8], eax
je 0x100498a8
mov dword [ebp - 0x4ec], 1
jmp 0x100498af
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
neg eax
je 0x100498ce
cmp dword [ebp - 0x32c], 0
je 0x100498ce
mov dword [ebp - 0x31c], 1
jmp 0x100498d5
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x31c], eax
jl 0x100498ef
mov dword [ebp - 0x67c], 1
jmp 0x100498f6
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xa98], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x454]
add eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x150]
jl 0x1004992e
mov dword [ebp - 0x324], 1
jmp 0x10049935
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x324], eax
jle 0x1004994f
mov dword [ebp - 0x53c], 1
jmp 0x10049956
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x2b0]
dec eax
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x2b0]
push 3
pop ecx
sub ecx, dword [ebp - 0x53c]
lea eax, [eax + ecx + 7]
cmp eax, dword [ebp - 0x74]
je 0x10049987
mov dword [ebp - 0x45c], 1
jmp 0x1004998e
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x32c]
cmp dword [ebp - 0x45c], eax
jle 0x100499a8
mov dword [ebp - 0x334], 1
jmp 0x100499af
and dword [ebp - 0x334], 0
cmp dword [ebp - 0x334], 0xa5b7
jle 0x100499c7
mov dword [ebp - 0x4f4], 1
jmp 0x100499ce
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x4f4], eax
jg 0x100499e8
mov dword [ebp - 0x2d8], 1
jmp 0x100499ef
and dword [ebp - 0x2d8], 0
push 0
lea ecx, [ebp - 0x8a8]
call fcn.100171a5
mov ecx, dword [ebp - 0x2d8]
mov dword [eax], ecx
cmp dword [ebp - 0x2d8], 8
jne 0x10049a19
mov dword [ebp - 0x33c], 1
jmp 0x10049a20
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x684], eax
jmp 0x1004984b
jmp 0x10049a59
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x10049a59
push 0x25d1
push 0x48bc
push 0
call fcn.100477ef
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8a8]
call fcn.10017189
mov eax, dword [ebp - 0x48]
cmp dword [eax + 4], 0
jne 0x10049a76
jmp 0x1004dead
mov dword [ebp - 0xaa8], 0xfffffffe
mov dword [ebp - 0xab0], 0xac04ee7d
mov dword [ebp - 0xab8], 0xfffffff7
mov dword [ebp - 0xad4], 0xddbc3707
mov dword [ebp - 0xadc], 0xe7f737a9
mov dword [ebp - 0x68c], 0xfffffff9
mov dword [ebp - 0xae4], 0
mov dword [ebp - 0xaec], 0xcc2fdcba
mov dword [ebp - 0xaf4], 0xc9d5fac1
mov dword [ebp - 0x2b8], 7
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
imul eax, dword [ebp - 0x2b8], 0x520
test eax, eax
jne 0x10049b07
mov eax, 0x1eb2
test eax, eax
jne 0x10049b07
and dword [ebp - 0x464], 0
jmp 0x10049b11
mov dword [ebp - 0x464], 1
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x68c], eax
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x10049b43
push 0x74fd
push 1
push 0x1bb4
call fcn.10046aca
add esp, 0xc
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0xbc]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xbc]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0xe0], eax
and dword [ebp - 0x2f0], 0
jmp 0x10049b86
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0xe0]
add eax, 0x28
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xbc]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x2f0], eax
jge 0x10049c02
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x344]
jb 0x10049bfd
mov eax, dword [ebp - 0xbc]
push dword [eax + 0x38]
mov eax, dword [ebp - 0xe0]
push dword [eax + 8]
call fcn.1004694f
pop ecx
pop ecx
add eax, dword [ebp - 0x344]
mov dword [ebp - 0x694], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x694]
jae 0x10049bfd
lea eax, [ebp - 0x2c]
push eax
push 1
lea eax, [ebp - 0xe0]
push eax
call fcn.10046b33
add esp, 0xc
jmp 0x10049c02
jmp 0x10049b6a
push 1
lea ecx, [ebp - 0x8b4]
call fcn.10017107
mov dword [ebp - 4], 7
mov dword [ebp - 0xe4], 0xcddd1d8f
mov dword [ebp - 0x10c], 0x52f76ec7
mov dword [ebp - 0x7b8], 0x906c902d
mov dword [ebp - 0x7b4], 0x906c902d
mov dword [ebp - 0x7b0], 0x906c902d
mov dword [ebp - 0x7ac], 0x906c902d
lea ecx, [ebp - 0x2cd]
call fcn.10009433
push eax
lea eax, [ebp - 0x7a8]
push eax
lea eax, [ebp - 0x7b8]
push eax
lea ecx, [ebp - 0xb84]
call fcn.100171b4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x860]
call fcn.10017163
mov byte [ebp - 4], 8
mov dword [ebp - 0x758], 0xffffffff
lea eax, [ebp - 0xafc]
push eax
lea eax, [ebp - 0x8b4]
push eax
push 1
call fcn.10046b8b
add esp, 0xc
lea eax, [ebp - 0x860]
push eax
push 1
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x758]
push eax
lea eax, [ebp - 0x8b4]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.10046bfd
add esp, 0x18
mov dword [ebp - 0x10c], 0
jmp 0x10049cf3
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffe6
jl 0x10049d44
mov dword [ebp - 0xe4], 0
jmp 0x10049d15
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 4
jge 0x10049d42
push 0x4697
push 1
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x860]
push eax
push 0x792a
call fcn.10046d21
add esp, 0x14
jmp 0x10049d08
jmp 0x10049ce6
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x860]
call fcn.10017189
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8b4]
call fcn.10017189
cmp dword [ebp - 0x2c], 0
jne 0x10049d6d
jmp 0x1004dead
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x2c]
add ecx, dword [eax]
add ecx, dword [ebp - 0x30]
mov dword [ebp - 0x10], ecx
xor ecx, ecx
call fcn.1002ffa0
push eax
call fcn.100715c8
pop ecx
mov dword [ebp - 0x20], 0xdb3ae355
mov dword [ebp - 0xac], 5
mov dword [ebp - 0x2e0], 0xb0e31355
mov dword [ebp - 0xb4], 5
mov dword [ebp - 0x20], 0
jmp 0x10049dbe
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x16
je 0x1004a1c8
mov dword [ebp - 0x60], 0xffffffff
push 1
lea ecx, [ebp - 0x6b4]
call fcn.10017107
mov dword [ebp - 4], 9
mov dword [ebp - 0x47c], 8
mov dword [ebp - 0x118], 5
mov dword [ebp - 0x1dc], 0
jmp 0x10049e10
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 1
jge 0x10049e32
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0x6b4]
call fcn.100171a5
mov dword [eax], 0xfffffff7
jmp 0x10049e03
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x20], eax
je 0x10049e4f
mov dword [ebp - 0x760], 1
jmp 0x10049e56
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x20], eax
jl 0x10049e88
mov dword [ebp - 0x574], 1
jmp 0x10049e8f
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x574], eax
jl 0x10049eac
cmp dword [ebp - 0x60], 0
je 0x10049eac
mov dword [ebp - 0x34c], 1
jmp 0x10049eb3
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x34c], eax
jle 0x10049eca
mov dword [ebp - 0x46c], 1
jmp 0x10049ed1
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x46c]
je 0x10049f12
mov dword [ebp - 0x768], 0x2076
lea eax, [ebp - 0x768]
push eax
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x6b4]
push eax
push 1
call fcn.10046dab
add esp, 0x18
jmp 0x1004a13a
mov dword [ebp - 0x374], 0
mov dword [ebp - 0x1bc], 0
jmp 0x10049f35
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 3
jge 0x10049f51
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0x794], 0xffffffff
jmp 0x10049f28
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xb00], eax
cmp dword [ebp - 0xac], 0
jne 0x10049fb9
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x794], 0
jne 0x10049f99
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x794], 0
jne 0x10049f99
cmp dword [ebp - 0x20], 0
jne 0x10049f99
mov eax, 0x565e139a
test eax, eax
jne 0x10049f99
and dword [ebp - 0x354], 0
jmp 0x10049fa3
mov dword [ebp - 0x354], 1
mov eax, dword [ebp - 0x354]
sub eax, 0x55b7f83f
jne 0x10049fb9
and dword [ebp - 0x4fc], 0
jmp 0x10049fc3
mov dword [ebp - 0x4fc], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x794]
cmp dword [ebp - 0x4fc], eax
jl 0x10049fe3
mov dword [ebp - 0x35c], 1
jmp 0x10049fea
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x35c], eax
jne 0x1004a001
mov dword [ebp - 0x474], 1
jmp 0x1004a008
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x474], eax
jg 0x1004a022
mov dword [ebp - 0x364], 1
jmp 0x1004a029
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xfffffffd
jge 0x1004a04a
mov dword [ebp - 0x2c0], 1
jmp 0x1004a051
and dword [ebp - 0x2c0], 0
push 0
lea ecx, [ebp - 0x6b4]
call fcn.100171a5
mov ecx, dword [ebp - 0x2c0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x374]
cmp dword [ebp - 0x2e0], eax
jg 0x1004a08c
mov dword [ebp - 0x544], 1
jmp 0x1004a093
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x544], eax
jge 0x1004a0aa
mov dword [ebp - 0x36c], 1
jmp 0x1004a0b1
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 0
je 0x1004a0db
cmp dword [ebp - 0x374], 0
je 0x1004a0db
mov dword [ebp - 0x504], 1
jmp 0x1004a0e2
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x504], eax
je 0x1004a0ff
cmp dword [ebp - 0x2e0], 0
jne 0x1004a0ff
and dword [ebp - 0x76c], 0
jmp 0x1004a109
mov dword [ebp - 0x76c], 1
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x9f4], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x8fc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x794]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0xb4], 0
jmp 0x1004a153
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jl 0x1004a1b4
mov dword [ebp - 0x118], 0
jmp 0x1004a175
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jg 0x1004a1b2
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x6b4]
call fcn.100171a5
cmp dword [eax], 0
je 0x1004a196
jmp 0x1004a1b2
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x1004a1b0
push 0
call fcn.10046eb7
pop ecx
jmp 0x1004a168
jmp 0x1004a146
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6b4]
call fcn.10017189
jmp 0x10049db7
mov dword [ebp - 0x5cc], 0xa5d6c05b
mov dword [ebp - 0x5c8], 0xa5d6c05b
mov dword [ebp - 0x5c4], 0xa5d6c05b
mov dword [ebp - 0x5c0], 0xa5d6c05b
mov dword [ebp - 0x34], 0x7eede0b4
mov dword [ebp - 0x8dc], 0x7d04549c
mov dword [ebp - 0x8d8], 0x7d04549c
mov dword [ebp - 0x8d4], 0x7d04549c
mov dword [ebp - 0x8d0], 0x7d04549c
mov dword [ebp - 0x34], 3
jmp 0x1004a22f
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1004a4be
mov dword [ebp - 0x6c], 4
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x5cc]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x37c]
mov dword [ebp + eax*4 - 0x5cc], ecx
push 5
pop eax
sub eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x37c]
sub ecx, eax
cmp ecx, 0x1f90ef30
jle 0x1004a282
mov dword [ebp - 0x484], 1
jmp 0x1004a289
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x484]
sub eax, dword [ebp - 0x6c]
imul eax, eax, 0
test eax, eax
je 0x1004a2d3
mov dword [ebp - 0x6c], 0
jmp 0x1004a2a9
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jg 0x1004a2ce
mov byte [ebp - 0x87], 0
lea eax, [ebp - 0x87]
push eax
push 0x3736
push 0
call fcn.10047168
add esp, 0xc
jmp 0x1004a2a2
jmp 0x1004a4b9
push 3
lea ecx, [ebp - 0x560]
call fcn.10017107
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x1d4], 0
jmp 0x1004a300
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 3
jge 0x1004a322
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x560]
call fcn.100171a5
mov dword [eax], 0x98aaf0a9
jmp 0x1004a2f3
push 1
lea ecx, [ebp - 0x560]
call fcn.100171a5
cmp dword [eax], 0
jne 0x1004a3f2
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xaa4], eax
push 1
lea ecx, [ebp - 0x560]
call fcn.100171a5
cmp dword [eax], 0
jne 0x1004a365
cmp dword [ebp - 0x34], 0
jne 0x1004a365
mov dword [ebp - 0x384], 1
jmp 0x1004a36c
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
add eax, 0xffff
neg eax
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x5cc]
cmp eax, 0xfffffffb
jne 0x1004a398
mov dword [ebp - 0x564], 1
jmp 0x1004a39f
and dword [ebp - 0x564], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5cc]
cmp dword [ebp - 0x564], eax
jle 0x1004a3c0
mov dword [ebp - 0x38c], 1
jmp 0x1004a3c7
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x38c], eax
je 0x1004a3de
mov dword [ebp - 0x48c], 1
jmp 0x1004a3e5
and dword [ebp - 0x48c], 0
push 1
lea ecx, [ebp - 0x560]
call fcn.100171a5
push 1
lea ecx, [ebp - 0x560]
call fcn.100171a5
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x34], eax
jl 0x1004a413
mov dword [ebp - 0x394], 1
jmp 0x1004a41a
and dword [ebp - 0x394], 0
cmp dword [ebp - 0x394], 0x9643
jne 0x1004a432
mov dword [ebp - 0x50c], 1
jmp 0x1004a439
and dword [ebp - 0x50c], 0
push 1
lea ecx, [ebp - 0x560]
call fcn.100171a5
mov eax, dword [eax]
cmp eax, dword [ebp - 0x50c]
jne 0x1004a45c
mov dword [ebp - 0x39c], 1
jmp 0x1004a463
and dword [ebp - 0x39c], 0
push 4
pop eax
imul eax, eax, 3
mov esi, dword [ebp + eax - 0x8dc]
add esi, dword [ebp - 0x39c]
push 1
lea ecx, [ebp - 0x560]
call fcn.100171a5
cmp esi, dword [eax]
jg 0x1004a493
mov dword [ebp - 0x494], 1
jmp 0x1004a49a
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x494]
mov dword [ebp + eax*4 - 0x5cc], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x560]
call fcn.10017189
jmp 0x1004a228
mov dword [ebp - 0x34], 3
jmp 0x1004a4ce
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1004a4ed
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x5cc], 0
je 0x1004a4e3
jmp 0x1004a4ed
push 1
call fcn.10046eb7
pop ecx
jmp 0x1004a4c7
mov byte [ebp - 0x22c], 8
mov byte [ebp - 0x22b], 0x21
mov byte [ebp - 0x22a], 9
mov byte [ebp - 0x229], 0
mov byte [ebp - 0x228], 6
mov byte [ebp - 0x227], 1
mov byte [ebp - 0x226], 0
mov byte [ebp - 0x225], 0
mov byte [ebp - 0x224], 7
mov byte [ebp - 0x223], 7
mov byte [ebp - 0x222], 1
mov byte [ebp - 0x221], 3
mov byte [ebp - 0x220], 5
mov byte [ebp - 0x21f], 4
mov byte [ebp - 0x21e], 3
mov byte [ebp - 0x21d], 6
mov byte [ebp - 0x21c], 4
mov byte [ebp - 0x21b], 0xf
mov byte [ebp - 0x21a], 0x2f
mov byte [ebp - 0x219], 0x7b
mov byte [ebp - 0x218], 0x53
mov byte [ebp - 0x217], 0xfd
mov byte [ebp - 0x216], 0x4e
mov byte [ebp - 0x215], 6
mov byte [ebp - 0x214], 0xd3
mov byte [ebp - 0x213], 0xf5
mov byte [ebp - 0x212], 0x67
mov byte [ebp - 0x211], 0x55
mov byte [ebp - 0x210], 0x2c
mov byte [ebp - 0x20f], 0xcf
mov byte [ebp - 0x20e], 0xf1
mov byte [ebp - 0x20d], 0x11
mov byte [ebp - 0x20c], 0x70
mov byte [ebp - 0x20b], 7
mov byte [ebp - 0x20a], 0x29
mov byte [ebp - 0x209], 0xc8
mov byte [ebp - 0x208], 0xf0
mov byte [ebp - 0x207], 0xce
mov byte [ebp - 0x206], 0x20
mov byte [ebp - 0x205], 0x63
mov byte [ebp - 0x204], 0x56
mov byte [ebp - 0x203], 0x70
mov byte [ebp - 0x202], 0xe
mov byte [ebp - 0x201], 0xd4
mov byte [ebp - 0x200], 0xb4
mov byte [ebp - 0x1ff], 3
mov byte [ebp - 0x1fe], 0xe3
mov byte [ebp - 0x1fd], 0xe7
mov byte [ebp - 0x1fc], 0x1c
mov byte [ebp - 0x1fb], 0xdf
mov byte [ebp - 0x1fa], 0xbe
mov byte [ebp - 0x1f9], 0xf3
mov byte [ebp - 0x1f8], 0xab
mov byte [ebp - 0x1f7], 0x6a
mov byte [ebp - 0x1f6], 0xf6
mov byte [ebp - 0x1f5], 0x4c
mov byte [ebp - 0x1f4], 0x27
mov byte [ebp - 0x1f3], 0x67
mov byte [ebp - 0x1f2], 0x46
mov byte [ebp - 0x1f1], 0x4a
mov byte [ebp - 0x1f0], 0x9a
mov byte [ebp - 0x1ef], 0x9b
mov byte [ebp - 0x1ee], 0x5c
mov byte [ebp - 0x1ed], 0x33
mov byte [ebp - 0x1ec], 0x87
mov byte [ebp - 0x1eb], 0xe5
mov byte [ebp - 0x1ea], 2
mov byte [ebp - 0x1e9], 0xf
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x22c]
or eax, 0x11
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x22c]
and ecx, 0x11
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x22c]
mov byte [ebp + ecx - 0x5ac], al
mov dword [ebp - 0x40], 2
and dword [ebp - 0x194], 0
jmp 0x1004a71a
mov eax, dword [ebp - 0x40]
inc eax
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x44
jae 0x1004a7d0
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x22c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x40], eax
jne 0x1004a764
mov eax, dword [ebp - 0x40]
movzx eax, byte [ebp + eax - 0x22c]
inc eax
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [ebp + eax - 0x22c]
mov ecx, dword [ebp - 0x40]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x40], eax
jmp 0x1004a712
mov eax, dword [ebp - 0x40]
movzx eax, byte [ebp + eax - 0x22b]
mov ecx, dword [ebp - 0x40]
sub ecx, dword [ebp - 0x194]
movzx ecx, byte [ebp + ecx - 0x22e]
movsx ecx, byte [ebp + ecx - 0x5ac]
or eax, ecx
mov ecx, dword [ebp - 0x40]
movzx ecx, byte [ebp + ecx - 0x22b]
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x194]
movzx edx, byte [ebp + edx - 0x22e]
movsx edx, byte [ebp + edx - 0x5ac]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x40]
movzx ecx, byte [ebp + ecx - 0x22c]
mov byte [ebp + ecx - 0x5ac], al
and dword [ebp - 0x194], 0
jmp 0x1004a712
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x5ac], 0
push 1
lea ecx, [ebp - 0x890]
call fcn.10017107
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xf4], 0xcddd1d8f
mov dword [ebp - 0x138], 0x52f76ec7
mov dword [ebp - 0x7cc], 0x906c902d
mov dword [ebp - 0x7c8], 0x906c902d
mov dword [ebp - 0x7c4], 0x906c902d
mov dword [ebp - 0x7c0], 0x906c902d
lea ecx, [ebp - 0x2f1]
call fcn.10009433
push eax
lea eax, [ebp - 0x7bc]
push eax
lea eax, [ebp - 0x7cc]
push eax
lea ecx, [ebp - 0xbc4]
call fcn.100171b4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x878]
call fcn.10017163
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x750], 0xffffffff
push 0x333a
lea eax, [ebp - 0x890]
push eax
lea eax, [ebp - 0x904]
push eax
push 1
call fcn.10046f08
add esp, 0x10
lea eax, [ebp - 0x750]
push eax
lea eax, [ebp - 0x878]
push eax
push 0
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x890]
push eax
push 0x3b69
push 0x6b21
call fcn.100481c5
add esp, 0x20
mov dword [ebp - 0x138], 0
jmp 0x1004a8de
mov eax, dword [ebp - 0x138]
dec eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xffffffe6
jl 0x1004a92a
mov dword [ebp - 0xf4], 0
jmp 0x1004a900
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 4
jge 0x1004a928
push 1
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x878]
push eax
push 0x256
call fcn.10046f7e
add esp, 0x10
jmp 0x1004a8f3
jmp 0x1004a8d1
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x878]
call fcn.10017189
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x890]
call fcn.10017189
lea eax, [ebp - 0x5ac]
push eax
lea ecx, [ebp - 0xbe4]
call fcn.10024da3
mov dword [ebp - 0x64c], eax
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x5e8], eax
mov dword [ebp - 4], 0xd
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x5e8]
call fcn.1002ff60
pop ecx
mov dword [ebp - 0x70c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbe4]
call fcn.10017069
mov dword [ebp - 0xa04], 0
mov dword [ebp - 0x90c], 0xffffffff
mov dword [ebp - 0xae0], 0xfffffff6
mov dword [ebp - 0x914], 0xade2167f
push 3
lea ecx, [ebp - 0xa10]
call fcn.10017107
mov dword [ebp - 4], 0xe
push 2
lea ecx, [ebp - 0xa00]
call fcn.10017107
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x8f0], 0xffffffff
mov dword [ebp - 0x91c], 0x335c
mov dword [ebp - 0x7e0], 0x5c0c
mov dword [ebp - 0x7dc], 0x5c0c
mov dword [ebp - 0x7d8], 0x5c0c
mov dword [ebp - 0x7d4], 0x5c0c
lea ecx, [ebp - 0x2ea]
call fcn.10009433
push eax
lea eax, [ebp - 0x7d0]
push eax
lea eax, [ebp - 0x7e0]
push eax
lea ecx, [ebp - 0xbb4]
call fcn.100171b4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb18]
call fcn.10017163
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x5f0], 0x5f402be2
push 1
lea eax, [ebp - 0x6f4]
push eax
lea eax, [ebp - 0xa10]
push eax
call fcn.10046fd4
add esp, 0xc
push 0
lea eax, [ebp - 0x6f4]
push eax
lea eax, [ebp - 0xa00]
push eax
call fcn.10047d78
add esp, 0xc
lea eax, [ebp - 0x5f0]
push eax
push 1
call fcn.10047045
pop ecx
pop ecx
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xb18]
call fcn.10017189
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xa00]
call fcn.10017189
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa10]
call fcn.10017189
and dword [ebp - 0x1a0], 0
jmp 0x1004aae7
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xb
jae 0x1004ab00
mov eax, dword [ebp - 0x1a0]
mov byte [ebp + eax - 0x5ac], 0
jmp 0x1004aada
mov dword [ebp - 0x5f8], 1
mov dword [ebp - 0x600], 0x58382bdb
mov dword [ebp - 0x6fc], 0xe9829cbc
mov dword [ebp - 0x734], 0x61ac7eb2
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1004ab53
push 0x269b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
lea eax, [ebp - 0x734]
push eax
lea eax, [ebp - 0x5f8]
push eax
lea eax, [ebp - 0x6fc]
push eax
lea eax, [ebp - 0x600]
push eax
push 0
call fcn.10047a44
add esp, 0x14
mov byte [ebp - 0x184], 3
mov byte [ebp - 0x183], 0x96
mov byte [ebp - 0x182], 1
mov byte [ebp - 0x181], 4
mov byte [ebp - 0x180], 5
mov byte [ebp - 0x17f], 7
mov byte [ebp - 0x17e], 7
mov byte [ebp - 0x17d], 7
mov byte [ebp - 0x17c], 0x1c
mov byte [ebp - 0x17b], 0x15
mov byte [ebp - 0x17a], 0x38
mov byte [ebp - 0x179], 0xfb
mov byte [ebp - 0x178], 0x3d
mov byte [ebp - 0x177], 0xce
mov byte [ebp - 0x176], 0x73
mov byte [ebp - 0x175], 0xb5
mov byte [ebp - 0x174], 0x60
mov byte [ebp - 0x173], 0xcc
mov byte [ebp - 0x172], 0x35
mov byte [ebp - 0x171], 0x58
mov byte [ebp - 0x170], 0x6b
mov byte [ebp - 0x16f], 0xba
mov byte [ebp - 0x16e], 0xf8
mov byte [ebp - 0x16d], 0xaf
mov byte [ebp - 0x16c], 0x13
mov byte [ebp - 0x16b], 0x7f
mov byte [ebp - 0x16a], 0x34
mov byte [ebp - 0x169], 0xa7
mov byte [ebp - 0x168], 0x6e
mov byte [ebp - 0x167], 0x7a
mov byte [ebp - 0x166], 0xa3
mov byte [ebp - 0x165], 0x2f
mov byte [ebp - 0x164], 0xec
mov byte [ebp - 0x163], 0xe4
mov byte [ebp - 0x162], 0xb9
mov byte [ebp - 0x161], 0xd1
mov byte [ebp - 0x160], 0x99
mov byte [ebp - 0x15f], 0
mov byte [ebp - 0x15e], 7
mov byte [ebp - 0x15d], 6
mov byte [ebp - 0x15c], 8
mov byte [ebp - 0x15b], 4
mov byte [ebp - 0x15a], 0xd
mov byte [ebp - 0x159], 9
mov byte [ebp - 0x158], 4
mov byte [ebp - 0x157], 2
mov byte [ebp - 0x156], 7
mov byte [ebp - 0x155], 8
mov byte [ebp - 0x154], 7
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x184]
or eax, 0xa4
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x184]
and ecx, 0xa4
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x184]
mov byte [ebp + ecx - 0x594], al
mov dword [ebp - 0x24], 2
and dword [ebp - 0x120], 0
jmp 0x1004ad26
mov eax, dword [ebp - 0x24]
inc eax
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x31
jae 0x1004ae04
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x184]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x24], eax
jne 0x1004ad70
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x184]
inc eax
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x184]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x24], eax
jmp 0x1004ad1e
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x183]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x120]
movzx ecx, byte [ebp + ecx - 0x186]
movsx ecx, byte [ebp + ecx - 0x594]
add eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x183]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x120]
movzx edx, byte [ebp + edx - 0x186]
movsx edx, byte [ebp + edx - 0x594]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x183]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x120]
movzx edx, byte [ebp + edx - 0x186]
movsx edx, byte [ebp + edx - 0x594]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x184]
mov byte [ebp + ecx - 0x594], al
and dword [ebp - 0x120], 0
jmp 0x1004ad1e
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x594], 0
mov dword [ebp - 0xc8], 8
mov dword [ebp - 0xaac], 0
mov dword [ebp - 0x924], 0x4f6cbcb1
mov dword [ebp - 0xa24], 0x82e77e81
mov dword [ebp - 0x92c], 0xebda1846
mov dword [ebp - 0x3b4], 1
mov dword [ebp - 0x1a8], 0
jmp 0x1004ae67
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
jge 0x1004ae83
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0x848], 0x3e31551d
jmp 0x1004ae5a
cmp dword [ebp - 0xc8], 0
je 0x1004aea1
cmp dword [ebp - 0xc8], 0
je 0x1004aea1
mov dword [ebp - 0x3a4], 1
jmp 0x1004aea8
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x3a4]
je 0x1004af78
mov dword [ebp - 0x754], 0xa23
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0xaf8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x848], 0xffffffff
ja 0x1004aeeb
mov dword [ebp - 0x54c], 1
jmp 0x1004aef2
and dword [ebp - 0x54c], 0
cmp dword [ebp - 0x54c], 0xfffffff6
jbe 0x1004af07
mov dword [ebp - 0x3ac], 1
jmp 0x1004af0e
and dword [ebp - 0x3ac], 0
cmp dword [ebp - 0x3ac], 0x40ed3c15
jle 0x1004af26
mov dword [ebp - 0x49c], 1
jmp 0x1004af2d
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x49c]
neg eax
cmp eax, dword [ebp - 0xc8]
jg 0x1004af49
mov dword [ebp - 0x608], 1
jmp 0x1004af50
and dword [ebp - 0x608], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x848]
mov dword [ebp - 0x934], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x848]
mov dword [ebp - 0xc8], eax
jmp 0x1004afc0
mov dword [ebp - 0x1b0], 0
jmp 0x1004af91
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 1
jge 0x1004afad
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x704], 0xe92eda8e
jmp 0x1004af84
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x704]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
lea eax, [ebp - 0x594]
push eax
lea ecx, [ebp - 0xbfc]
call fcn.10024da3
mov dword [ebp - 0x610], eax
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x73c], eax
mov dword [ebp - 4], 0x11
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x73c]
call fcn.1002ff60
pop ecx
mov dword [ebp - 0x618], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbfc]
call fcn.10017069
and dword [ebp - 0x1b8], 0
jmp 0x1004b033
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xb
jae 0x1004b04c
mov eax, dword [ebp - 0x1b8]
mov byte [ebp + eax - 0x594], 0
jmp 0x1004b026
push dword [ebp - 0x618]
push dword [ebp - 0x70c]
call fcn.1004406c
pop ecx
pop ecx
mov dword [ebp - 0x4d4], eax
mov dword [ebp - 0x44], 0xb110c93b
mov dword [ebp - 0x2c8], 0x12d2c87
mov dword [ebp - 0x1c0], 0
jmp 0x1004b08f
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
jge 0x1004b0ab
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x620], 7
jmp 0x1004b082
mov dword [ebp - 0x44], 0x1c
jmp 0x1004b0bb
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x13
jle 0x1004b2cd
mov dword [ebp - 0x148], 0x79e672ca
mov dword [ebp - 0x764], 5
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x148]
test eax, eax
jne 0x1004b0f6
cmp dword [ebp - 0x44], 0
jne 0x1004b0f6
and dword [ebp - 0x3dc], 0
jmp 0x1004b100
mov dword [ebp - 0x3dc], 1
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x44], eax
jle 0x1004b117
mov dword [ebp - 0x514], 1
jmp 0x1004b11e
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x514], eax
je 0x1004b138
mov dword [ebp - 0x3bc], 1
jmp 0x1004b13f
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x3bc], eax
jne 0x1004b156
mov dword [ebp - 0x4a4], 1
jmp 0x1004b15d
and dword [ebp - 0x4a4], 0
cmp dword [ebp - 0x4a4], 0x6284
jle 0x1004b175
mov dword [ebp - 0x3c4], 1
jmp 0x1004b17c
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x3c4], eax
jge 0x1004b193
mov dword [ebp - 0x584], 1
jmp 0x1004b19a
and dword [ebp - 0x584], 0
cmp dword [ebp - 0x584], 0x1658a600
jg 0x1004b1b2
mov dword [ebp - 0x3cc], 1
jmp 0x1004b1b9
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x3cc]
cmp eax, dword [ebp - 0x148]
jle 0x1004b1dd
cmp dword [ebp - 0x148], 0
jne 0x1004b1dd
and dword [ebp - 0x4ac], 0
jmp 0x1004b1e7
mov dword [ebp - 0x4ac], 1
cmp dword [ebp - 0x4ac], 0x4886
je 0x1004b1ff
mov dword [ebp - 0x3d4], 1
jmp 0x1004b206
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x2c8]
cmp eax, dword [ebp - 0x3d4]
jl 0x1004b22d
mov dword [ebp - 0x51c], 1
jmp 0x1004b234
and dword [ebp - 0x51c], 0
cmp dword [ebp - 0x51c], 0x5d580090
jg 0x1004b24f
cmp dword [ebp - 0x44], 0
jne 0x1004b24f
and dword [ebp - 0x4b4], 0
jmp 0x1004b259
mov dword [ebp - 0x4b4], 1
mov eax, dword [ebp - 0x3dc]
cmp eax, dword [ebp - 0x4b4]
jne 0x1004b273
mov dword [ebp - 0x3e4], 1
jmp 0x1004b27a
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
imul eax, dword [ebp - 0x44]
mov dword [ebp - 0x530], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x530]
mov dword [ebp + eax - 0x620], ecx
cmp dword [ebp - 0x530], 0x8700
je 0x1004b2b5
mov dword [ebp - 0x3ec], 1
jmp 0x1004b2bc
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x764], eax
jmp 0x1004b0b4
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x4d4]
mov dword [eax + 8], ecx
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 0xcc], 0xfffffffe
mov dword [ebp - 0x29c], 0xffffffff
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x638], 0x8ed3351f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xa34], eax
xor eax, eax
inc eax
je 0x1004b32b
cmp dword [ebp - 0x18], 0
je 0x1004b32b
mov dword [ebp - 0x628], 1
jmp 0x1004b332
and dword [ebp - 0x628], 0
cmp dword [ebp - 0x18], 0
jne 0x1004b388
mov eax, dword [ebp - 0x18]
neg eax
cmp eax, dword [ebp - 0x18]
jge 0x1004b34e
mov dword [ebp - 0x4bc], 1
jmp 0x1004b355
and dword [ebp - 0x4bc], 0
cmp dword [ebp - 0x4bc], 0xffffffff
jl 0x1004b36a
mov dword [ebp - 0x3f4], 1
jmp 0x1004b371
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x3f4], eax
jl 0x1004b388
and dword [ebp - 0x524], 0
jmp 0x1004b392
mov dword [ebp - 0x524], 1
cmp dword [ebp - 0x524], 0xffff
jbe 0x1004b3aa
mov dword [ebp - 0x3fc], 1
jmp 0x1004b3b1
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
je 0x1004b3db
cmp dword [ebp - 0xcc], 0
je 0x1004b3db
mov dword [ebp - 0x4c4], 1
jmp 0x1004b3e2
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x4c4], eax
jne 0x1004b3f9
mov dword [ebp - 0x714], 1
jmp 0x1004b400
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jg 0x1004b414
mov dword [ebp - 0x630], 1
jmp 0x1004b41b
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x93c], eax
cmp dword [ebp - 0x18], 0xfa9e
jge 0x1004b43f
cmp dword [ebp - 0x18], 0
je 0x1004b43f
mov dword [ebp - 0x744], 1
jmp 0x1004b446
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xcc], eax
jge 0x1004b466
mov dword [ebp - 0x404], 1
jmp 0x1004b46d
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x404], eax
jle 0x1004b484
mov dword [ebp - 0x538], 1
jmp 0x1004b48b
and dword [ebp - 0x538], 0
cmp dword [ebp - 0x538], 0xd9e96bb6
je 0x1004b4a6
cmp dword [ebp - 0x18], 0
jne 0x1004b4a6
and dword [ebp - 0x40c], 0
jmp 0x1004b4b0
mov dword [ebp - 0x40c], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x40c], eax
jg 0x1004b4ce
push 0xfffffffffffffffd
pop eax
test eax, eax
je 0x1004b4ce
mov dword [ebp - 0x4cc], 1
jmp 0x1004b4d5
and dword [ebp - 0x4cc], 0
cmp dword [ebp - 0x4cc], 0x5ff74f57
jg 0x1004b4f6
mov eax, 0x298c245e
test eax, eax
je 0x1004b4f6
mov dword [ebp - 0x414], 1
jmp 0x1004b4fd
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x414], eax
jg 0x1004b517
cmp dword [ebp - 0x18], 0
jne 0x1004b517
and dword [ebp - 0x52c], 0
jmp 0x1004b521
mov dword [ebp - 0x52c], 1
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x18], 0xfffffffb
jmp 0x1004b549
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xc
je 0x1004b5b1
mov dword [ebp - 0x71c], 7
lea eax, [ebp - 0xcc]
push eax
push 0x2e58
push 0
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x71c]
push eax
call fcn.10048327
add esp, 0x20
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x1004b5af
push 0x1fde
push 1
call fcn.1004707d
pop ecx
pop ecx
jmp 0x1004b542
push 0xf
push 5
call fcn.1004406c
pop ecx
pop ecx
add eax, dword [ebp - 0x4d4]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
push 3
lea ecx, [ebp - 0x6c4]
call fcn.10017107
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x944], 6
mov dword [ebp - 0x58], 0
jmp 0x1004b5f6
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x1004b612
push dword [ebp - 0x58]
lea ecx, [ebp - 0x6c4]
call fcn.100171a5
mov dword [eax], 1
jmp 0x1004b5ef
mov dword [ebp - 0x58], 0
jmp 0x1004b622
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x1004b638
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0xba4], 0
jmp 0x1004b61b
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x1004b652
push 1
call fcn.100470b4
pop ecx
push 0
lea ecx, [ebp - 0x6c4]
call fcn.100171a5
mov dword [eax], 0xfffffff4
jmp 0x1004b68b
push 0
lea ecx, [ebp - 0x6c4]
call fcn.100171a5
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x424]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x424]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x6c4]
call fcn.100171a5
cmp dword [eax], 0xffffffe2
jge 0x1004b6f6
mov dword [ebp - 0xd8], 0xfffffff6
lea eax, [ebp - 0xd8]
push eax
push 0x5bb8
push 0
push 0x49df
call fcn.100476d2
add esp, 0x10
mov dword [ebp - 0xd8], 1
jmp 0x1004b6db
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jl 0x1004b6f1
cmp dword [ebp - 0xd8], 0
je 0x1004b6ef
jmp 0x1004b6f1
jmp 0x1004b6ce
jmp 0x1004b667
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c4]
call fcn.10017189
and dword [ebp - 0x130], 0
mov dword [ebp - 0xa44], 1
push 0x3d28
push 0x7d35
push 1
call fcn.100470e6
add esp, 0xc
mov byte [ebp - 0x8b], 0
push 0x329f
lea eax, [ebp - 0x8b]
push eax
push 1
call fcn.10047168
add esp, 0xc
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x18], 0
jbe 0x1004b765
push 1
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.100471d0
add esp, 0xc
push 2
lea ecx, [ebp - 0x6d4]
call fcn.10017107
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x640], 0x26ff23b1
mov dword [ebp - 0x94c], 7
mov dword [ebp - 0x42c], 0x9f4981ff
mov dword [ebp - 0x3c], 0
jmp 0x1004b7a7
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1004b7bd
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xae8], 0xfffffff9
jmp 0x1004b7a0
mov dword [ebp - 0x3c], 0
jmp 0x1004b7cd
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1004b7e6
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x6d4]
call fcn.100171a5
or dword [eax], 0xffffffff
jmp 0x1004b7c6
mov dword [ebp - 0x3c], 0
jmp 0x1004b7f6
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1004b80c
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xbbc], 0xfffffff6
jmp 0x1004b7ef
push 1
lea ecx, [ebp - 0x6d4]
call fcn.100171a5
and dword [eax], 0
jmp 0x1004b842
push 1
lea ecx, [ebp - 0x6d4]
call fcn.100171a5
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0x540]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x540]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x6d4]
call fcn.100171a5
cmp dword [eax], 0
jl 0x1004b8b2
push 2
lea ecx, [ebp - 0xa20]
call fcn.10017107
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x954], 1
lea eax, [ebp - 0xa54]
push eax
lea eax, [ebp - 0xa20]
push eax
push 0x475c
push 0x9eb
push 1
call fcn.10047218
add esp, 0x14
mov eax, dword [ebp - 0x42c]
dec eax
mov dword [ebp - 0x42c], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xa20]
call fcn.10017189
jmp 0x1004b81e
lea eax, [ebp - 0x640]
push eax
push 0x355
push 0
call fcn.10047672
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6d4]
call fcn.10017189
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x5bc], 0xa5d6c05b
mov dword [ebp - 0x5b8], 0xa5d6c05b
mov dword [ebp - 0x5b4], 0xa5d6c05b
mov dword [ebp - 0x5b0], 0xa5d6c05b
mov dword [ebp - 0x28], 0x7eede0b4
mov dword [ebp - 0x8ec], 0x7d04549c
mov dword [ebp - 0x8e8], 0x7d04549c
mov dword [ebp - 0x8e4], 0x7d04549c
mov dword [ebp - 0x8e0], 0x7d04549c
mov dword [ebp - 0x28], 3
jmp 0x1004b947
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1004bbe9
mov dword [ebp - 0x70], 4
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x5bc]
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp + eax*4 - 0x5bc], ecx
push 5
pop eax
sub eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x4dc]
sub ecx, eax
cmp ecx, 0x1f90ef30
jle 0x1004b99a
mov dword [ebp - 0x434], 1
jmp 0x1004b9a1
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
sub eax, dword [ebp - 0x70]
imul eax, eax, 0
test eax, eax
je 0x1004b9fe
mov dword [ebp - 0x70], 0
jmp 0x1004b9c1
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jg 0x1004b9f9
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x1004b9f7
push 0x7971
push 1
push 0x20be
push 0x2882
push 0x293c
call fcn.100472c2
add esp, 0x14
jmp 0x1004b9ba
jmp 0x1004bbe4
push 3
lea ecx, [ebp - 0x570]
call fcn.10017107
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x1c8], 0
jmp 0x1004ba2b
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jge 0x1004ba4d
push dword [ebp - 0x1c8]
lea ecx, [ebp - 0x570]
call fcn.100171a5
mov dword [eax], 0x98aaf0a9
jmp 0x1004ba1e
push 1
lea ecx, [ebp - 0x570]
call fcn.100171a5
cmp dword [eax], 0
jne 0x1004bb1d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x95c], eax
push 1
lea ecx, [ebp - 0x570]
call fcn.100171a5
cmp dword [eax], 0
jne 0x1004ba90
cmp dword [ebp - 0x28], 0
jne 0x1004ba90
mov dword [ebp - 0x548], 1
jmp 0x1004ba97
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x548]
add eax, 0xffff
neg eax
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x5bc]
cmp eax, 0xfffffffb
jne 0x1004bac3
mov dword [ebp - 0x43c], 1
jmp 0x1004baca
and dword [ebp - 0x43c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5bc]
cmp dword [ebp - 0x43c], eax
jle 0x1004baeb
mov dword [ebp - 0x4e4], 1
jmp 0x1004baf2
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x4e4], eax
je 0x1004bb09
mov dword [ebp - 0x2fc], 1
jmp 0x1004bb10
and dword [ebp - 0x2fc], 0
push 1
lea ecx, [ebp - 0x570]
call fcn.100171a5
push 1
lea ecx, [ebp - 0x570]
call fcn.100171a5
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x28], eax
jl 0x1004bb3e
mov dword [ebp - 0x300], 1
jmp 0x1004bb45
and dword [ebp - 0x300], 0
cmp dword [ebp - 0x300], 0x9643
jne 0x1004bb5d
mov dword [ebp - 0x308], 1
jmp 0x1004bb64
and dword [ebp - 0x308], 0
push 1
lea ecx, [ebp - 0x570]
call fcn.100171a5
mov eax, dword [eax]
cmp eax, dword [ebp - 0x308]
jne 0x1004bb87
mov dword [ebp - 0x310], 1
jmp 0x1004bb8e
and dword [ebp - 0x310], 0
push 4
pop eax
imul eax, eax, 3
mov esi, dword [ebp + eax - 0x8ec]
add esi, dword [ebp - 0x310]
push 1
lea ecx, [ebp - 0x570]
call fcn.100171a5
cmp esi, dword [eax]
jg 0x1004bbbe
mov dword [ebp - 0x318], 1
jmp 0x1004bbc5
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x318]
mov dword [ebp + eax*4 - 0x5bc], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x570]
call fcn.10017189
jmp 0x1004b940
mov dword [ebp - 0x28], 3
jmp 0x1004bbf9
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1004bc30
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x5bc], 0
je 0x1004bc0e
jmp 0x1004bc30
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x1004bc2e
push 0
push 0x773f
call fcn.1004789c
pop ecx
pop ecx
jmp 0x1004bbf2
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
sub eax, dword [ebp - 0x130]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x320], 0x4e703026
mov dword [ebp - 0x5c], 0
jmp 0x1004bc63
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xffffffe5
jl 0x1004bd66
mov dword [ebp - 0x75c], 0x83d78398
mov dword [ebp - 0x724], 0x93cc
push 1
push 0x23a9
push 0xa3f
call fcn.10047588
add esp, 0xc
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0
jne 0x1004bcc2
mov eax, 0xd714
test eax, eax
jne 0x1004bcc2
and dword [ebp - 0x328], 0
jmp 0x1004bccc
mov dword [ebp - 0x328], 1
mov eax, dword [ebp - 0x75c]
cmp eax, dword [ebp - 0x328]
jne 0x1004bce6
mov dword [ebp - 0x330], 1
jmp 0x1004bced
and dword [ebp - 0x330], 0
cmp dword [ebp - 0x330], 0xafa32fd2
jne 0x1004bd05
mov dword [ebp - 0x338], 1
jmp 0x1004bd0c
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x338]
jl 0x1004bd23
mov dword [ebp - 0x648], 1
jmp 0x1004bd2a
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x964], eax
mov eax, 0xfffe
cmp eax, 0x6aeb
jbe 0x1004bd4b
mov dword [ebp - 0x340], 1
jmp 0x1004bd52
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x340]
mov dword [ebp - 0x724], eax
jmp 0x1004bc5c
and dword [ebp - 0x128], 0
jmp 0x1004bd7c
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0xe8]
jge 0x1004be1e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
sub eax, dword [ecx + 0x18]
cmp dword [ebp - 0x128], eax
jae 0x1004bddc
lea eax, [ebp - 0x348]
push eax
push 0x72a6
push 0x534d
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x128]
push eax
push 0xe8d
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x4960
call fcn.10048b85
add esp, 0x28
jmp 0x1004bdfe
push 0x34a5
push 0x6362
push 0
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.10047ddf
add esp, 0x14
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x348]
mov dword [ecx + eax], edx
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
jmp 0x1004bd6f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
sub eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x14], eax
push 1
lea ecx, [ebp - 0x854]
call fcn.10017107
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x650], 0x692beaa3
mov dword [ebp - 0xa64], 0
lea eax, [ebp - 0x854]
push eax
lea eax, [ebp - 0x96c]
push eax
push 1
call fcn.100475fd
add esp, 0xc
push 0
lea eax, [ebp - 0x854]
push eax
lea eax, [ebp - 0x650]
push eax
call fcn.100485af
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x854]
call fcn.10017189
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
sub eax, dword [ebp - 0x130]
mov dword [ebp - 0xe8], eax
and dword [ebp - 0x2a0], 0
jmp 0x1004bebf
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2a0]
cmp eax, dword [ebp - 0xe8]
jge 0x1004beef
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x30]
and dword [ecx + eax], 0
push 0
push 0x4cee
lea eax, [ebp - 0x14]
push eax
call fcn.10048b41
add esp, 0xc
jmp 0x1004beb2
mov dword [ebp - 0xc4], 0xffffffff
mov dword [ebp - 0x2a4], 0xb4bc662a
mov dword [ebp - 0x360], 9
mov dword [ebp - 0x72c], 0xffffffff
cmp dword [ebp - 0xc4], 0
je 0x1004bf2c
mov dword [ebp - 0x350], 1
jmp 0x1004bf33
and dword [ebp - 0x350], 0
cmp dword [ebp - 0x350], 0x21e1
jle 0x1004bf4b
mov dword [ebp - 0x358], 1
jmp 0x1004bf52
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0xc4]
neg eax
cmp eax, dword [ebp - 0x358]
je 0x1004bf6e
mov dword [ebp - 0x74c], 1
jmp 0x1004bf75
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xa78], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x360], eax
imul eax, dword [ebp - 0x360], 0x917a
test eax, eax
je 0x1004bfb0
mov eax, 0x816f93bd
test eax, eax
je 0x1004bfb0
mov dword [ebp - 0x368], 1
jmp 0x1004bfb7
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x2a4]
imul eax, dword [ebp - 0x368]
test eax, eax
jne 0x1004bfe6
cmp dword [ebp - 0x2a4], 0
jne 0x1004bfe6
and dword [ebp - 0x658], 0
jmp 0x1004bff0
mov dword [ebp - 0x658], 1
mov eax, dword [ebp - 0xc4]
sub eax, dword [ebp - 0xc4]
mov dword [ebp - 0x72c], eax
mov byte [ebp - 0x9d], 0
push 0x6157
lea eax, [ebp - 0x9d]
push eax
push 1
call fcn.10047672
add esp, 0xc
push 0
push 0x1c5f
push 0x14e7
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10048927
add esp, 0x18
mov dword [ebp - 0x974], 0
mov dword [ebp - 0xa74], 0xffffffff
mov dword [ebp - 0x97c], 0xfffffff6
mov dword [ebp - 0xa80], 0xade2167f
push 3
lea ecx, [ebp - 0xa40]
call fcn.10017107
mov dword [ebp - 4], 0x17
push 2
lea ecx, [ebp - 0xa30]
call fcn.10017107
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x984], 0xffffffff
mov dword [ebp - 0xa88], 0x335c
mov dword [ebp - 0x808], 0x5c0c
mov dword [ebp - 0x804], 0x5c0c
mov dword [ebp - 0x800], 0x5c0c
mov dword [ebp - 0x7fc], 0x5c0c
lea ecx, [ebp - 0x2e9]
call fcn.10009433
push eax
lea eax, [ebp - 0x7f8]
push eax
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0xbcc]
call fcn.100171b4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb3c]
call fcn.10017163
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x660], 0x5f402be2
mov dword [ebp - 0x140], 0
jmp 0x1004c127
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 3
jge 0x1004c149
push dword [ebp - 0x140]
lea ecx, [ebp - 0xa40]
call fcn.100171a5
mov dword [eax], 0x8974b66
jmp 0x1004c11a
push 0x71c5
lea eax, [ebp - 0x140]
push eax
push 1
lea eax, [ebp - 0xa30]
push eax
call fcn.100476d2
add esp, 0x10
push 0x7d59
push 0x2d87
push 0x2835
push 0x429c
push 0x3453
lea eax, [ebp - 0x660]
push eax
push 0x76db
push 0
push 0x1a66
call fcn.10048619
add esp, 0x24
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xb3c]
call fcn.10017189
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xa30]
call fcn.10017189
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa40]
call fcn.10017189
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
sub eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x18], eax
or dword [ebp - 0x830], 0xffffffff
or dword [ebp - 0x82c], 0xffffffff
or dword [ebp - 0x828], 0xffffffff
or dword [ebp - 0x824], 0xffffffff
lea ecx, [ebp - 0x2e1]
call fcn.10009433
push eax
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x830]
push eax
lea ecx, [ebp - 0xb64]
call fcn.100171b4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa50]
call fcn.10017163
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x668], 0x90c4d8e5
mov dword [ebp - 0x6f0], 0x4e26c12a
mov dword [ebp - 0x6ec], 0xf1571c09
mov dword [ebp - 0x98c], 0x87a912e
push 0x2bfc
push 0x2cf0
lea eax, [ebp - 0x6ec]
push eax
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0xa50]
push eax
push 0
lea eax, [ebp - 0x6f0]
push eax
call fcn.10048054
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa50]
call fcn.10017189
and dword [ebp - 0x1d0], 0
jmp 0x1004c2ae
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x1d0]
cmp eax, dword [ebp - 0xe8]
jge 0x1004c2fc
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x1d0]
lea eax, [ecx + eax*2]
mov ecx, dword [ebp - 0x2c]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x30]
mov ax, word [esi + eax]
mov word [edx + ecx], ax
lea eax, [ebp - 0x14]
push eax
push 0x2a7
push 0x7b3
push 1
call fcn.10047778
add esp, 0x10
jmp 0x1004c2a1
push 3
lea ecx, [ebp - 0xa60]
call fcn.10017107
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x670], 1
lea eax, [ebp - 0xb08]
push eax
lea eax, [ebp - 0xa60]
push eax
push 1
call fcn.100477ef
add esp, 0xc
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x1004c352
push 1
push 0x3e76
call fcn.10047858
pop ecx
pop ecx
push 1
lea eax, [ebp - 0x670]
push eax
call fcn.1004789c
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa60]
call fcn.10017189
mov eax, dword [ebp - 0xe8]
shl eax, 1
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x24], ecx
mov dword [ebp - 0x1d8], 0xffffffff
mov dword [ebp - 0x2ac], 2
mov dword [ebp - 0xf0], 0xbe3d0e72
mov dword [ebp - 0x64], 0
jmp 0x1004c3b2
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1004c3c8
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xb30], 0x1c3a23fe
jmp 0x1004c3ab
mov dword [ebp - 0x64], 0
jmp 0x1004c3d8
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x1004c3ee
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xacc], 0xe45d764c
jmp 0x1004c3d1
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x1004c439
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x994], eax
mov eax, 0x8d96753f
test eax, eax
jne 0x1004c41a
mov eax, 0x73df2ef5
test eax, eax
jne 0x1004c41a
cmp dword [ebp - 0x1d8], 0
mov dword [ebp - 0x1d8], 0xfffffffd
cmp dword [ebp - 0x1d8], 0
je 0x1004c439
mov dword [ebp - 0x370], 1
jmp 0x1004c440
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x2ac], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xacc]
cmp dword [ebp - 0x2ac], eax
je 0x1004c46c
mov dword [ebp - 0x378], 1
jmp 0x1004c473
and dword [ebp - 0x378], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xacc]
cmp dword [ebp - 0x378], eax
jne 0x1004c499
cmp dword [ebp - 0x2ac], 0
jne 0x1004c499
and dword [ebp - 0x2b4], 0
jmp 0x1004c4a3
mov dword [ebp - 0x2b4], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2b4]
mov dword [ebp + eax - 0xacc], ecx
mov eax, dword [ebp - 0x2b4]
sub eax, dword [ebp - 0xf0]
cmp eax, 0x34ccbb24
jg 0x1004c4d4
mov dword [ebp - 0x380], 1
jmp 0x1004c4db
and dword [ebp - 0x380], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb30], 0
cmp dword [ebp - 0x380], 0
je 0x1004c501
mov dword [ebp - 0x6f8], 1
jmp 0x1004c508
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xa84], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x99c], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xad0], eax
mov eax, 0x7689351f
test eax, eax
jae 0x1004c541
mov dword [ebp - 0x388], 1
jmp 0x1004c548
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x388], eax
jle 0x1004c562
mov dword [ebp - 0x390], 1
jmp 0x1004c569
and dword [ebp - 0x390], 0
cmp dword [ebp - 0x390], 0
jbe 0x1004c57e
mov dword [ebp - 0x398], 1
jmp 0x1004c585
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
add ecx, dword [eax + 0xc]
add ecx, dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0xb9c]
call fcn.10024da3
mov dword [ebp - 4], 0x1c
lea ecx, [ebp - 0xb9c]
call fcn.10017530
mov dword [ebp - 0x3a0], eax
push dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x3a0]
shr eax, 1
push eax
call fcn.1004406c
pop ecx
pop ecx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x110], 0xad313dd3
mov dword [ebp - 0x1e0], 0
jmp 0x1004c600
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 1
jge 0x1004c61c
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x678], 0xffffffff
jmp 0x1004c5f3
mov dword [ebp - 0x110], 0
jmp 0x1004c635
cmp dword [ebp - 0x110], 0xfffffff4
jle 0x1004c760
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x114], 0
jmp 0x1004c665
cmp dword [ebp - 0x114], 0x14
jle 0x1004c730
mov dword [ebp - 0x78], 0x3690f1d8
mov dword [ebp - 0x78], 0xffffffe6
jmp 0x1004c689
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x3a8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3a8]
mov dword [ebp + eax - 0x678], ecx
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x114], eax
jmp 0x1004c628
push 1
lea ecx, [ebp - 0x86c]
call fcn.10017107
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x11c], 0x692beaa3
mov dword [ebp - 0x9a4], 0
mov dword [ebp - 0x18c], 0
jmp 0x1004c79e
cmp dword [ebp - 0x18c], 1
jge 0x1004c7c0
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x86c]
call fcn.100171a5
mov dword [eax], 0xfff7
jmp 0x1004c791
mov dword [ebp - 0x11c], 0
jmp 0x1004c7d9
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x644], eax
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0x518]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x518]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret