Function at 0x1004c517
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008ed73
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x12b0
call fcn.100896d0
push esi
and dword [ebp - 0x1c], 0
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10054272
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
push 4
lea ecx, [ebp - 0xe78]
call fcn.10016bef
and dword [ebp - 4], 0
mov dword [ebp - 0x144], 0x29000d4e
mov dword [ebp - 0xb54], 0xffffffff
push 0
push 0x77d4
push 0x57a9
lea eax, [ebp - 0xed8]
push eax
push 0x739b
lea eax, [ebp - 0xe78]
push eax
call fcn.1004abc8
add esp, 0x18
mov dword [ebp - 0x144], 0
jmp 0x1004c5b5
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 3
jg 0x1004c5e4
lea eax, [ebp - 0xe78]
push eax
push 1
lea eax, [ebp - 0xb54]
push eax
lea eax, [ebp - 0x144]
push eax
push 0x4b94
call fcn.100499ea
add esp, 0x14
jmp 0x1004c5a8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe78]
call fcn.10016c57
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x61c], eax
mov eax, dword [ebp - 0x61c]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1004c611
jmp 0x100542a8
mov eax, dword [ebp - 0x61c]
mov ecx, dword [ebp - 0x2c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xe0], ecx
mov eax, dword [ebp - 0xe0]
cmp dword [eax], 0x4550
je 0x1004c636
jmp 0x100542a8
mov dword [ebp - 0xb5c], 0x6ec7516a
push 4
lea ecx, [ebp - 0xcb4]
call fcn.10016bef
mov dword [ebp - 4], 1
mov dword [ebp - 0x97c], 1
mov dword [ebp - 0xb44], 0xfffffffa
mov dword [ebp - 0xb34], 0x31966c47
mov dword [ebp - 0xa78], 0xfff7
mov dword [ebp - 0xb3c], 0xffffffff
mov dword [ebp - 0xb4c], 1
mov dword [ebp - 0x1b8], 0
jmp 0x1004c6a9
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 4
jge 0x1004c6cb
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0xcb4]
call fcn.10016c5c
mov dword [eax], 1
jmp 0x1004c69c
push 0x2dfe
lea eax, [ebp - 0x97c]
push eax
push 0x3430
lea eax, [ebp - 0xb34]
push eax
push 1
lea eax, [ebp - 0xb3c]
push eax
lea eax, [ebp - 0xcb4]
push eax
lea eax, [ebp - 0xb44]
push eax
lea eax, [ebp - 0xb4c]
push eax
lea eax, [ebp - 0xa78]
push eax
lea eax, [ebp - 0xb5c]
push eax
call fcn.10049a61
add esp, 0x2c
mov esi, dword [ebp - 0x97c]
push 1
lea ecx, [ebp - 0xcb4]
call fcn.10016c5c
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcb4]
call fcn.10016c57
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe0]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xc18], 0xfffffffd
mov dword [ebp - 0x400], 0xfffffff7
mov dword [ebp - 0xfac], 0x7289
mov dword [ebp - 0x164], 0x9ba87a5
mov dword [ebp - 0xc20], 0xde8aff65
mov dword [ebp - 0x238], 0
jmp 0x1004c799
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
jge 0x1004c7b5
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0x2b4], 0xe0648261
jmp 0x1004c78c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2b4], 0
jmp 0x1004c7e3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2b4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2b4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2b4], 0xffffffef
jge 0x1004ca73
mov dword [ebp - 0x3b8], 1
mov dword [ebp - 0x278], 0x1cb6a7f4
mov dword [ebp - 0xc08], 0xa0a9
mov dword [ebp - 0x9f8], 1
mov dword [ebp - 0x1c0], 0
jmp 0x1004c838
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
jge 0x1004c854
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0xc10], 3
jmp 0x1004c82b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2b4]
sub eax, dword [ebp - 0x164]
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x278]
add eax, dword [ebp - 0x3b8]
cmp eax, dword [ebp - 0x164]
je 0x1004c88d
mov dword [ebp - 0xc00], 1
jmp 0x1004c894
and dword [ebp - 0xc00], 0
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x10a8], eax
mov dword [ebp - 0xc08], 0xfffffff8
mov eax, 0xf9034e10
test eax, eax
je 0x1004ca39
cmp dword [ebp - 0x164], 0
je 0x1004c90e
mov eax, 0x83f7
sub eax, dword [ebp - 0x400]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x2b4]
jl 0x1004c8e6
mov dword [ebp - 0x984], 1
jmp 0x1004c8ed
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x984]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0
je 0x1004c90e
mov dword [ebp - 0x9e0], 1
jmp 0x1004c915
and dword [ebp - 0x9e0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9e0]
sub ecx, dword [ebp + eax - 0x2b4]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x2b4]
jg 0x1004c943
mov dword [ebp - 0x3b0], 1
jmp 0x1004c94a
and dword [ebp - 0x3b0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3b0]
mov dword [ebp + eax - 0xc10], ecx
mov eax, dword [ebp - 0x400]
cmp eax, dword [ebp - 0x3b0]
jge 0x1004c977
mov dword [ebp - 0x9e8], 1
jmp 0x1004c97e
and dword [ebp - 0x9e8], 0
cmp dword [ebp - 0x9e8], 5
jge 0x1004c993
mov dword [ebp - 0x9f0], 1
jmp 0x1004c99a
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x9f0]
mov dword [ebp - 0x9f8], eax
mov eax, dword [ebp - 0x400]
cmp dword [ebp - 0x9f8], eax
jge 0x1004c9c0
mov dword [ebp - 0x9cc], 1
jmp 0x1004c9c7
and dword [ebp - 0x9cc], 0
cmp dword [ebp - 0x9cc], 7
jne 0x1004c9dc
mov dword [ebp - 0x9f4], 1
jmp 0x1004c9e3
and dword [ebp - 0x9f4], 0
cmp dword [ebp - 0x9f4], 0xfffffffb
jl 0x1004c9f8
mov dword [ebp - 0x8b0], 1
jmp 0x1004c9ff
and dword [ebp - 0x8b0], 0
cmp dword [ebp - 0x8b0], 0x67d3d8e1
je 0x1004ca17
mov dword [ebp - 0x974], 1
jmp 0x1004ca1e
and dword [ebp - 0x974], 0
imul eax, dword [ebp - 0x974], 0xffffffff
cmp eax, dword [ebp - 0xc18]
jg 0x1004ca39
mov dword [ebp - 0x470], 1
jmp 0x1004ca40
and dword [ebp - 0x470], 0
cmp dword [ebp - 0x470], 0xffffffff
jge 0x1004ca55
mov dword [ebp - 0x748], 1
jmp 0x1004ca5c
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x748]
sub eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x164], eax
jmp 0x1004c7c8
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0xc20], eax
mov eax, dword [ebp - 0x6c]
cmp dword [eax + 4], 0
jne 0x1004ca8d
jmp 0x100542a8
and dword [ebp - 0x30], 0
mov dword [ebp - 0xa8], 0xfe7d8a87
mov dword [ebp - 0x8b8], 0x93c86992
mov dword [ebp - 0x1c8], 0
jmp 0x1004cabe
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 1
jge 0x1004cada
mov eax, dword [ebp - 0x1c8]
mov dword [ebp + eax*4 - 0x1d0], 0xfffffffd
jmp 0x1004cab1
mov dword [ebp - 0xa8], 0
jmp 0x1004caf3
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x1004cca3
mov dword [ebp - 0x58], 0xfffffffa
mov dword [ebp - 0x240], 0
jmp 0x1004cb20
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jge 0x1004cb3c
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0xeb8], 0x8a52b4b5
jmp 0x1004cb13
push 0x5da4
push 0x4669
push 0x305d
push 0x22af
push 0x5463
push 0x78e3
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.1004afcb
add esp, 0x20
mov eax, dword [ebp - 0xa8]
cmp dword [ebp + eax*4 - 0x1d0], 0xcbeb969
jle 0x1004cb87
mov dword [ebp - 0x478], 1
jmp 0x1004cb8e
and dword [ebp - 0x478], 0
cmp dword [ebp - 0x478], 0x41a9
jge 0x1004cba6
mov dword [ebp - 0x968], 1
jmp 0x1004cbad
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x968]
jne 0x1004cbc4
mov dword [ebp - 0x480], 1
jmp 0x1004cbcb
and dword [ebp - 0x480], 0
cmp dword [ebp - 0x480], 0
jb 0x1004cbe0
mov dword [ebp - 0x750], 1
jmp 0x1004cbe7
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x750], eax
jg 0x1004cbfe
mov dword [ebp - 0xc28], 1
jmp 0x1004cc05
and dword [ebp - 0xc28], 0
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x1d0]
mov dword [ebp - 0xfb4], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x10a4], eax
cmp dword [ebp - 0x58], 0
je 0x1004cc52
mov dword [ebp - 0x58], 0
jmp 0x1004cc3a
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1004cc50
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x1d0], 0
jmp 0x1004cc33
jmp 0x1004cc9e
cmp dword [ebp - 0x58], 0
jne 0x1004cc75
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x1d0]
sub eax, 0x413a139e
jne 0x1004cc75
and dword [ebp - 0x488], 0
jmp 0x1004cc7f
mov dword [ebp - 0x488], 1
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x8b8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8b8]
mov dword [ebp + eax - 0xeb8], ecx
jmp 0x1004cae6
mov byte [ebp - 0xce], 0
movzx eax, byte [ebp - 0xce]
test eax, eax
je 0x1004ccc3
push 0x51a1
push 0
call fcn.1004a946
pop ecx
pop ecx
mov eax, dword [ebp - 0xe0]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xe0]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x118], eax
and dword [ebp - 0x428], 0
jmp 0x1004cd02
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x118]
add eax, 0x28
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0xe0]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x428], eax
jge 0x1004cd88
mov eax, dword [ebp - 0x118]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x490]
jb 0x1004cd83
mov eax, dword [ebp - 0xe0]
push dword [eax + 0x38]
mov eax, dword [ebp - 0x118]
push dword [eax + 8]
call fcn.100499bb
pop ecx
pop ecx
add eax, dword [ebp - 0x490]
mov dword [ebp - 0xc30], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc30]
jae 0x1004cd83
push 0x6dc9
push 1
push 0x19b4
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10049ca1
add esp, 0x14
jmp 0x1004cd88
jmp 0x1004cce6
mov dword [ebp - 0x4c], 0xfffffffc
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0x3c0], 0
mov dword [ebp - 0x280], 3
mov dword [ebp - 0x298], 0
jmp 0x1004cdc6
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 3
jge 0x1004cde2
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0x1144], 2
jmp 0x1004cdb9
mov dword [ebp - 0x4c], 2
jmp 0x1004cdf2
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x1004ce15
push 0x5bcd
push 0x7a0e
lea eax, [ebp - 0xb4]
push eax
push 0
call fcn.1004bd1b
add esp, 0x10
jmp 0x1004cdeb
mov dword [ebp - 0xb4], 0
jmp 0x1004ce2e
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xfffffff7
jge 0x1004d2eb
or dword [ebp - 0xd38], 0xffffffff
or dword [ebp - 0xd34], 0xffffffff
or dword [ebp - 0xd30], 0xffffffff
or dword [ebp - 0xd2c], 0xffffffff
lea ecx, [ebp - 0x43e]
call fcn.10009103
push eax
lea eax, [ebp - 0xd28]
push eax
lea eax, [ebp - 0xd38]
push eax
lea ecx, [ebp - 0x11ec]
call fcn.10016c6b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe90]
call fcn.10016c31
mov dword [ebp - 4], 2
mov dword [ebp - 0xc48], 1
mov dword [ebp - 0x9e4], 0x2130bec3
mov dword [ebp - 0x1d8], 0
jmp 0x1004cec0
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 1
jge 0x1004cedc
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x14c], 0x4e80031a
jmp 0x1004ceb3
cmp dword [ebp - 0xb4], 0
je 0x1004d164
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0xc40], 0x3c17a3f0
mov dword [ebp - 0x4c], 0
jmp 0x1004cf0d
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x13
jle 0x1004d162
mov dword [ebp - 0x498], 0xef23e469
mov dword [ebp - 0x248], 0
jmp 0x1004cf3a
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 2
jge 0x1004cf56
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0xa30], 0x47d2038e
jmp 0x1004cf2d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14c]
mov dword [ebp - 0xfbc], eax
imul eax, dword [ebp - 0x1e0], 0x54e5
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x14c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0xa30]
je 0x1004cf9b
mov dword [ebp - 0x758], 1
jmp 0x1004cfa2
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x498], eax
jle 0x1004cfc8
mov dword [ebp - 0x9d8], 1
jmp 0x1004cfcf
and dword [ebp - 0x9d8], 0
cmp dword [ebp - 0x9d8], 0xffff
jb 0x1004cfe7
mov dword [ebp - 0x4a0], 1
jmp 0x1004cfee
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
sub eax, 0x6e14d327
cmp eax, dword [ebp - 0x4c]
jg 0x1004d010
cmp dword [ebp - 0x1e0], 0
jne 0x1004d010
and dword [ebp - 0x760], 0
jmp 0x1004d01a
mov dword [ebp - 0x760], 1
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x760], eax
jg 0x1004d031
mov dword [ebp - 0xc38], 1
jmp 0x1004d038
and dword [ebp - 0xc38], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa30]
mov dword [ebp - 0x10ac], eax
xor eax, eax
inc eax
je 0x1004d05c
mov dword [ebp - 0x4a8], 1
jmp 0x1004d063
and dword [ebp - 0x4a8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa30]
cmp eax, dword [ebp - 0x4a8]
jge 0x1004d084
mov dword [ebp - 0x8c0], 1
jmp 0x1004d08b
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x8c0], eax
je 0x1004d0a5
mov dword [ebp - 0x4b0], 1
jmp 0x1004d0ac
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x4b0], eax
jne 0x1004d0c6
mov dword [ebp - 0x768], 1
jmp 0x1004d0cd
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x768], eax
jg 0x1004d0e4
mov dword [ebp - 0x4b8], 1
jmp 0x1004d0eb
and dword [ebp - 0x4b8], 0
cmp dword [ebp - 0x4b8], 0x73d4
jle 0x1004d103
mov dword [ebp - 0x970], 1
jmp 0x1004d10a
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x970]
mov dword [ebp - 0xc40], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x14c]
cmp dword [ebp + eax - 0xa30], ecx
je 0x1004d13e
mov dword [ebp - 0x4c0], 1
jmp 0x1004d145
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x280], eax
jmp 0x1004cf06
jmp 0x1004d180
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x14c]
push 3
lea ecx, [ebp - 0xe90]
call fcn.10016c5c
mov dword [eax], esi
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0xe98], eax
mov eax, 0x9d0e131a
test eax, eax
jne 0x1004d1a7
cmp dword [ebp - 0x280], 0
jne 0x1004d1a7
and dword [ebp - 0x770], 0
jmp 0x1004d1b1
mov dword [ebp - 0x770], 1
cmp dword [ebp - 0x770], 0xa99
je 0x1004d1c9
mov dword [ebp - 0x4c8], 1
jmp 0x1004d1d0
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0xb4]
imul eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0xc48]
jne 0x1004d1f1
mov dword [ebp - 0x8c8], 1
jmp 0x1004d1f8
and dword [ebp - 0x8c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14c]
cmp dword [ebp - 0x8c8], eax
jg 0x1004d219
mov dword [ebp - 0x4d0], 1
jmp 0x1004d220
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x9e4]
cmp dword [ebp - 0x4d0], eax
jl 0x1004d23a
mov dword [ebp - 0x778], 1
jmp 0x1004d241
and dword [ebp - 0x778], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1144]
cmp dword [ebp - 0x778], eax
jge 0x1004d261
mov dword [ebp - 0x4d8], 1
jmp 0x1004d268
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x280]
cmp dword [ebp - 0x4d8], eax
jg 0x1004d284
xor eax, eax
inc eax
je 0x1004d284
and dword [ebp - 0xc50], 0
jmp 0x1004d28e
mov dword [ebp - 0xc50], 1
mov eax, dword [ebp - 0x9e4]
mov dword [ebp - 0xe9c], eax
mov eax, 0x9ea2
cmp eax, 0xdb7a
jg 0x1004d2c4
push 0
lea ecx, [ebp - 0xe90]
call fcn.10016c5c
cmp dword [eax], 0
je 0x1004d2c4
mov dword [ebp - 0x4e0], 1
jmp 0x1004d2cb
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x280], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe90]
call fcn.10016c57
jmp 0x1004ce21
cmp dword [ebp - 0x30], 0
jne 0x1004d2f6
jmp 0x100542a8
mov dword [ebp - 0x7c], 0xe164caf
mov dword [ebp - 0x104], 0x2aff6358
mov dword [ebp - 0x120], 0xffffffff
mov dword [ebp - 0xc4], 0xf5ee8790
mov dword [ebp - 0x548], 0xffffffff
mov dword [ebp - 0x538], 0
mov dword [ebp - 0x174], 0x99949389
mov dword [ebp - 0x7b0], 0xffffffff
mov dword [ebp - 0xea4], 1
mov dword [ebp - 0xeac], 0
mov dword [ebp - 0xd88], 0xbb6abd35
mov dword [ebp - 0xd84], 0xbb6abd35
mov dword [ebp - 0xd80], 0xbb6abd35
mov dword [ebp - 0xd7c], 0xbb6abd35
lea ecx, [ebp - 0x419]
call fcn.10009103
push eax
lea eax, [ebp - 0xd78]
push eax
lea eax, [ebp - 0xd88]
push eax
lea ecx, [ebp - 0x119c]
call fcn.10016c6b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xdf4]
call fcn.10016c31
mov dword [ebp - 4], 3
mov dword [ebp - 0x1f0], 0xfffffffd
mov dword [ebp - 0x540], 0xfffffffc
push 2
lea ecx, [ebp - 0xe3c]
call fcn.10016bef
mov byte [ebp - 4], 4
mov dword [ebp - 0x1e8], 0
jmp 0x1004d3f9
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 2
jge 0x1004d418
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0xe3c]
call fcn.10016c5c
or dword [eax], 0xffffffff
jmp 0x1004d3ec
lea eax, [ebp - 0x7c]
push eax
push 0x728a
push 1
lea eax, [ebp - 0x104]
push eax
push 0x7548
call fcn.10049d18
add esp, 0x14
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xee0], eax
cmp dword [ebp - 0x120], 0
je 0x1004d45b
cmp dword [ebp - 0x7c], 0
jne 0x1004d45b
and dword [ebp - 0x780], 0
jmp 0x1004d465
mov dword [ebp - 0x780], 1
cmp dword [ebp - 0x780], 0xb2d505bc
jbe 0x1004d47d
mov dword [ebp - 0x4e8], 1
jmp 0x1004d484
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 1
jge 0x1004d4a5
mov dword [ebp - 0x8d0], 1
jmp 0x1004d4ac
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x8d0], eax
jne 0x1004d4c6
mov dword [ebp - 0x4f0], 1
jmp 0x1004d4cd
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x4f0], eax
jl 0x1004d4e7
mov dword [ebp - 0x788], 1
jmp 0x1004d4ee
and dword [ebp - 0x788], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x788]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
imul eax, dword [ebp - 0x7c]
test eax, eax
je 0x1004d512
cmp dword [ebp - 0xc4], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x120], eax
jge 0x1004d529
mov dword [ebp - 0x4f8], 1
jmp 0x1004d530
and dword [ebp - 0x4f8], 0
mov eax, 0x5878
sub eax, dword [ebp - 0x4f8]
je 0x1004d86f
mov dword [ebp - 0x64], 0x17530975
mov dword [ebp - 0x408], 2
mov dword [ebp - 0x980], 0x8b3def2
mov dword [ebp - 0x250], 0
jmp 0x1004d575
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 1
jge 0x1004d591
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0x510], 0x10b2d4ad
jmp 0x1004d568
cmp dword [ebp - 0x64], 0
jne 0x1004d5a6
cmp dword [ebp - 0x64], 0
jne 0x1004d5a6
and dword [ebp - 0x978], 0
jmp 0x1004d5b0
mov dword [ebp - 0x978], 1
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x978]
je 0x1004d5ca
mov dword [ebp - 0x500], 1
jmp 0x1004d5d1
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x500], eax
jl 0x1004d5e8
mov dword [ebp - 0x790], 1
jmp 0x1004d5ef
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x790]
jl 0x1004d606
mov dword [ebp - 0x508], 1
jmp 0x1004d60d
and dword [ebp - 0x508], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x508]
mov dword [ebp + eax - 0x510], ecx
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0xee8], eax
cmp dword [ebp - 0x64], 0
je 0x1004d67c
cmp dword [ebp - 0x174], 8
jle 0x1004d654
mov dword [ebp - 0x8d8], 1
jmp 0x1004d65b
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x8d8]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
je 0x1004d67c
mov dword [ebp - 0xc58], 1
jmp 0x1004d683
and dword [ebp - 0xc58], 0
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0x510]
mov dword [ebp - 0xc60], eax
push 2
lea ecx, [ebp - 0xdf4]
call fcn.10016c5c
mov ecx, dword [ebp - 0xc60]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0xef0], eax
mov eax, 0x9805
imul eax, eax, 0xdb42
cmp eax, dword [ebp - 0x64]
jg 0x1004d6d5
mov dword [ebp - 0x798], 1
jmp 0x1004d6dc
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x540]
cmp eax, dword [ebp - 0x798]
jle 0x1004d6f6
mov dword [ebp - 0x518], 1
jmp 0x1004d6fd
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x518], eax
jl 0x1004d714
mov dword [ebp - 0x9d4], 1
jmp 0x1004d71b
and dword [ebp - 0x9d4], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x9d4], eax
je 0x1004d735
mov dword [ebp - 0x520], 1
jmp 0x1004d73c
and dword [ebp - 0x520], 0
cmp dword [ebp - 0x520], 0xfff8
jne 0x1004d754
mov dword [ebp - 0x7a0], 1
jmp 0x1004d75b
and dword [ebp - 0x7a0], 0
imul eax, dword [ebp - 0x7a0], 0x15ff
mov ecx, dword [ebp - 0x64]
lea eax, [eax + ecx - 1]
test eax, eax
je 0x1004d785
cmp dword [ebp - 0x1f0], 0
je 0x1004d785
mov dword [ebp - 0x528], 1
jmp 0x1004d78c
and dword [ebp - 0x528], 0
cmp dword [ebp - 0x528], 4
jge 0x1004d7a1
mov dword [ebp - 0x8e0], 1
jmp 0x1004d7a8
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x548]
cmp dword [ebp - 0x8e0], eax
jl 0x1004d7c2
mov dword [ebp - 0x530], 1
jmp 0x1004d7c9
and dword [ebp - 0x530], 0
cmp dword [ebp - 0x530], 0
jg 0x1004d7de
mov dword [ebp - 0xc98], 1
jmp 0x1004d7e5
and dword [ebp - 0xc98], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xef8], eax
mov eax, dword [ebp - 0x7b0]
mov dword [ebp - 0xf00], eax
or eax, 0xffffffff
jne 0x1004d80e
cmp dword [ebp - 0x64], 0
jne 0x1004d80e
and dword [ebp - 0x7a8], 0
jmp 0x1004d818
mov dword [ebp - 0x7a8], 1
mov eax, dword [ebp - 0x7a8]
mov dword [ebp - 0x980], eax
mov eax, dword [ebp - 0x538]
cmp dword [ebp - 0x980], eax
jle 0x1004d83e
mov dword [ebp - 0xc0c], 1
jmp 0x1004d845
and dword [ebp - 0xc0c], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xf08], eax
push 3
lea ecx, [ebp - 0xdf4]
call fcn.10016c5c
mov ecx, dword [ebp - 0x104]
imul ecx, dword [eax]
mov dword [ebp - 0x540], ecx
jmp 0x1004d986
mov dword [ebp - 0xc34], 3
mov dword [ebp - 0xb2c], 0x163b6ba6
mov dword [ebp - 0xa80], 0x64c941e8
push 0x2f68
lea eax, [ebp - 0xa80]
push eax
lea eax, [ebp - 0x120]
push eax
push 0x217d
push 0x563a
push 0x72dc
lea eax, [ebp - 0xb2c]
push eax
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x7b0]
push eax
push 1
push 0x4d38
lea eax, [ebp - 0xe3c]
push eax
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x1f0]
push eax
call fcn.10049eb9
add esp, 0x3c
mov dword [ebp - 0xc4], 0
jmp 0x1004d908
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jg 0x1004d986
mov byte [ebp - 0xf2], 0
movzx eax, byte [ebp - 0xf2]
test eax, eax
je 0x1004d931
push 0x336b
push 0
call fcn.1004a85c
pop ecx
pop ecx
mov dword [ebp - 0x7c], 0
jmp 0x1004d941
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jg 0x1004d981
mov dword [ebp - 0x174], 0
jmp 0x1004d960
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 1
jg 0x1004d97f
push 0x2524
push 0x1199
push 1
call fcn.1004a0a2
add esp, 0xc
jmp 0x1004d953
jmp 0x1004d93a
jmp 0x1004d8fb
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe3c]
call fcn.10016c57
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdf4]
call fcn.10016c57
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x30]
add ecx, dword [eax]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x40], 0x51ad386c
mov dword [ebp - 0x48], 0xa7b445ac
push 3
lea ecx, [ebp - 0x454]
call fcn.10016bef
mov dword [ebp - 4], 5
mov dword [ebp - 0xf10], 0
mov dword [ebp - 0x1f8], 0x98a8
mov dword [ebp - 0xbd4], 0xffffffff
mov dword [ebp - 0x2a8], 0
jmp 0x1004da0b
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 3
jge 0x1004da2d
push dword [ebp - 0x2a8]
lea ecx, [ebp - 0x454]
call fcn.10016c5c
mov dword [eax], 0x273d5943
jmp 0x1004d9fe
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xf18], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xf20], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x40], eax
jle 0x1004da53
mov dword [ebp - 0x8e8], 1
jmp 0x1004da5a
and dword [ebp - 0x8e8], 0
cmp dword [ebp - 0x8e8], 0
jne 0x1004da72
cmp dword [ebp - 0x40], 0
jne 0x1004da72
and dword [ebp - 0x550], 0
jmp 0x1004da7c
mov dword [ebp - 0x550], 1
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x40], eax
jne 0x1004da9c
cmp dword [ebp - 0x48], 0
jne 0x1004da9c
and dword [ebp - 0x7b8], 0
jmp 0x1004daa6
mov dword [ebp - 0x7b8], 1
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x7b8]
cmp eax, dword [ebp - 0x40]
jge 0x1004dac1
mov dword [ebp - 0x558], 1
jmp 0x1004dac8
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x558]
cmp eax, dword [ebp - 0x40]
jle 0x1004daf5
push 0
lea ecx, [ebp - 0x454]
call fcn.10016c5c
cmp dword [eax], 0
je 0x1004daf5
mov dword [ebp - 0x9a4], 1
jmp 0x1004dafc
and dword [ebp - 0x9a4], 0
cmp dword [ebp - 0x9a4], 0xd7c869b7
ja 0x1004db14
mov dword [ebp - 0x560], 1
jmp 0x1004db1b
and dword [ebp - 0x560], 0
push 0
lea ecx, [ebp - 0x454]
call fcn.10016c5c
mov ecx, dword [ebp - 0x560]
cmp ecx, dword [eax]
jle 0x1004db3e
mov dword [ebp - 0x7c0], 1
jmp 0x1004db45
and dword [ebp - 0x7c0], 0
push 0
lea ecx, [ebp - 0x454]
call fcn.10016c5c
mov ecx, dword [ebp - 0x7c0]
imul ecx, dword [eax]
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0x53bc
jne 0x1004db73
mov dword [ebp - 0x568], 1
jmp 0x1004db7a
and dword [ebp - 0x568], 0
push 1
lea ecx, [ebp - 0x454]
call fcn.10016c5c
mov ecx, dword [ebp - 0x568]
cmp ecx, dword [eax]
jg 0x1004dbe5
mov dword [ebp - 0x8f0], 0x7c5c6a81
lea eax, [ebp - 0x8f0]
push eax
push 0x6bda
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x48]
push eax
push 1
push 0x3260
call fcn.1004a121
add esp, 0x18
lea eax, [ebp - 0x8f0]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x345b
push 0x7fef
push 1
call fcn.1004a1eb
add esp, 0x14
jmp 0x1004dcd4
push 3
lea ecx, [ebp - 0xe6c]
call fcn.10016bef
mov byte [ebp - 4], 6
mov dword [ebp - 0xa88], 0xfffffff9
push 1
lea eax, [ebp - 0xe6c]
push eax
lea eax, [ebp - 0xf28]
push eax
call fcn.1004a24f
add esp, 0xc
push 0
lea ecx, [ebp - 0xe6c]
call fcn.10016c5c
cmp dword [eax], 0
je 0x1004dc3b
xor eax, eax
inc eax
je 0x1004dc3b
mov dword [ebp - 0x570], 1
jmp 0x1004dc42
and dword [ebp - 0x570], 0
push 0
lea ecx, [ebp - 0x454]
call fcn.10016c5c
mov ecx, dword [ebp - 0x570]
cmp ecx, dword [eax]
jne 0x1004dc65
mov dword [ebp - 0x7c8], 1
jmp 0x1004dc6c
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x7c8]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x6b9ec499
jg 0x1004dc8a
mov dword [ebp - 0x578], 1
jmp 0x1004dc91
and dword [ebp - 0x578], 0
imul eax, dword [ebp - 0x578], 0x5348
test eax, eax
jne 0x1004dcaf
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x1004dcaf
and dword [ebp - 0x988], 0
jmp 0x1004dcb9
mov dword [ebp - 0x988], 1
mov eax, dword [ebp - 0x988]
mov dword [ebp - 0xa88], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xe6c]
call fcn.10016c57
mov dword [ebp - 0x48], 0xbc1f9c85
mov eax, dword [ebp - 0x1f8]
add eax, dword [ebp - 0x48]
je 0x1004dd04
push 0
lea ecx, [ebp - 0x454]
call fcn.10016c5c
cmp dword [eax], 0
je 0x1004dd04
mov dword [ebp - 0x580], 1
jmp 0x1004dd0b
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x1f8]
cmp eax, dword [ebp - 0x580]
jge 0x1004dd25
mov dword [ebp - 0x7d0], 1
jmp 0x1004dd2c
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0x1f8]
sub eax, dword [ebp - 0x7d0]
cmp eax, dword [ebp - 0x1f8]
jge 0x1004dd86
cmp dword [ebp - 0xbd4], 0
je 0x1004dd86
mov dword [ebp - 0x48], 0
jmp 0x1004dd59
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jg 0x1004dd81
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x1004dd7f
push 0x4819
push 0
call fcn.1004a6f7
pop ecx
pop ecx
jmp 0x1004dd52
jmp 0x1004de07
mov dword [ebp - 0xa98], 2
mov dword [ebp - 0xc90], 0xfffffffa
mov dword [ebp - 0xa90], 0x65c3015d
mov dword [ebp - 0xf30], 5
mov dword [ebp - 0xf38], 0x56aa7d87
mov dword [ebp - 0xbdc], 0xfcff1470
lea eax, [ebp - 0x40]
push eax
push 0x5b4e
lea eax, [ebp - 0xa90]
push eax
push 1
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0xc90]
push eax
lea eax, [ebp - 0xa98]
push eax
call fcn.1004a2cc
add esp, 0x1c
lea eax, [ebp - 0xbdc]
push eax
push 0x7fc
push 1
call fcn.1004a361
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x454]
call fcn.10016c57
xor ecx, ecx
call fcn.10033d68
push eax
call fcn.10075fe8
pop ecx
mov byte [ebp - 0x320], 6
mov byte [ebp - 0x31f], 0xe
mov byte [ebp - 0x31e], 5
mov byte [ebp - 0x31d], 0
mov byte [ebp - 0x31c], 8
mov byte [ebp - 0x31b], 1
mov byte [ebp - 0x31a], 2
mov byte [ebp - 0x319], 7
mov byte [ebp - 0x318], 1
mov byte [ebp - 0x317], 2
mov byte [ebp - 0x316], 9
mov byte [ebp - 0x315], 5
mov byte [ebp - 0x314], 7
mov byte [ebp - 0x313], 6
mov byte [ebp - 0x312], 0x54
mov byte [ebp - 0x311], 0x1c
mov byte [ebp - 0x310], 0xd5
mov byte [ebp - 0x30f], 0xae
mov byte [ebp - 0x30e], 0x64
mov byte [ebp - 0x30d], 0xbe
mov byte [ebp - 0x30c], 0xc0
mov byte [ebp - 0x30b], 0xb9
mov byte [ebp - 0x30a], 0x82
mov byte [ebp - 0x309], 0x38
mov byte [ebp - 0x308], 0x1f
mov byte [ebp - 0x307], 0xe6
mov byte [ebp - 0x306], 0x15
mov byte [ebp - 0x305], 0xc7
mov byte [ebp - 0x304], 0xd6
mov byte [ebp - 0x303], 0x65
mov byte [ebp - 0x302], 0x37
mov byte [ebp - 0x301], 0xe9
mov byte [ebp - 0x300], 0x4d
mov byte [ebp - 0x2ff], 0x1e
mov byte [ebp - 0x2fe], 0x1d
mov byte [ebp - 0x2fd], 0x67
mov byte [ebp - 0x2fc], 0x20
mov byte [ebp - 0x2fb], 0x1f
mov byte [ebp - 0x2fa], 0x22
mov byte [ebp - 0x2f9], 0xda
mov byte [ebp - 0x2f8], 0xd0
mov byte [ebp - 0x2f7], 0xa6
mov byte [ebp - 0x2f6], 4
mov byte [ebp - 0x2f5], 0x74
mov byte [ebp - 0x2f4], 0x54
mov byte [ebp - 0x2f3], 0x89
mov byte [ebp - 0x2f2], 0x70
mov byte [ebp - 0x2f1], 0xe4
mov byte [ebp - 0x2f0], 0x9f
mov byte [ebp - 0x2ef], 0x19
mov byte [ebp - 0x2ee], 0xa0
mov byte [ebp - 0x2ed], 0xa7
mov byte [ebp - 0x2ec], 0x95
mov byte [ebp - 0x2eb], 0xe3
mov byte [ebp - 0x2ea], 0xf9
mov byte [ebp - 0x2e9], 0x9e
mov byte [ebp - 0x2e8], 0xa
mov byte [ebp - 0x2e7], 0xca
mov byte [ebp - 0x2e6], 0xf
mov byte [ebp - 0x2e5], 0xb3
mov byte [ebp - 0x2e4], 0x25
mov byte [ebp - 0x2e3], 0x5b
mov byte [ebp - 0x2e2], 0x6b
mov byte [ebp - 0x2e1], 0xf7
mov byte [ebp - 0x2e0], 0xde
mov byte [ebp - 0x2df], 0x6b
mov byte [ebp - 0x2de], 0x7f
mov byte [ebp - 0x2dd], 0x6c
mov byte [ebp - 0x2dc], 0x72
mov byte [ebp - 0x2db], 0xdf
mov byte [ebp - 0x2da], 0x31
mov byte [ebp - 0x2d9], 0xed
mov byte [ebp - 0x2d8], 0x5f
mov byte [ebp - 0x2d7], 0x1f
mov byte [ebp - 0x2d6], 0xc5
mov byte [ebp - 0x2d5], 0x7c
mov byte [ebp - 0x2d4], 0x77
mov byte [ebp - 0x2d3], 0x90
mov byte [ebp - 0x2d2], 0x3c
mov byte [ebp - 0x2d1], 0x43
mov byte [ebp - 0x2d0], 2
mov byte [ebp - 0x2cf], 0xb5
mov byte [ebp - 0x2ce], 0xca
mov byte [ebp - 0x2cd], 0x2a
mov byte [ebp - 0x2cc], pe_nt_image_headers32
mov byte [ebp - 0x2cb], 0x37
mov byte [ebp - 0x2ca], 0x90
mov byte [ebp - 0x2c9], 0x51
mov byte [ebp - 0x2c8], 0x8c
mov byte [ebp - 0x2c7], 0xed
mov byte [ebp - 0x2c6], 0x3d
mov byte [ebp - 0x2c5], 0x34
mov byte [ebp - 0x2c4], 0x2b
mov byte [ebp - 0x2c3], 0xcf
mov byte [ebp - 0x2c2], 0xa5
mov byte [ebp - 0x2c1], 0xe7
mov byte [ebp - 0x2c0], 0x72
mov byte [ebp - 0x2bf], 0x41
mov byte [ebp - 0x2be], 0x9f
mov byte [ebp - 0x2bd], 3
mov byte [ebp - 0x2bc], 1
mov byte [ebp - 0x2bb], 4
mov byte [ebp - 0x2ba], 0xf
mov byte [ebp - 0x2b9], 0
mov byte [ebp - 0x2b8], 9
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x320]
or eax, 0x3f
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x320]
and ecx, 0x3f
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x320]
mov byte [ebp + ecx - 0xa04], al
mov dword [ebp - 0x28], 2
and dword [ebp - 0x154], 0
jmp 0x1004e154
mov eax, dword [ebp - 0x28]
inc eax
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x69
jae 0x1004e232
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x320]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x28], eax
jne 0x1004e19e
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x320]
inc eax
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x320]
mov ecx, dword [ebp - 0x28]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x28], eax
jmp 0x1004e14c
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x31f]
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x154]
movzx ecx, byte [ebp + ecx - 0x322]
movsx ecx, byte [ebp + ecx - 0xa04]
add eax, ecx
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebp + ecx - 0x31f]
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x154]
movzx edx, byte [ebp + edx - 0x322]
movsx edx, byte [ebp + edx - 0xa04]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebp + ecx - 0x31f]
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x154]
movzx edx, byte [ebp + edx - 0x322]
movsx edx, byte [ebp + edx - 0xa04]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebp + ecx - 0x320]
mov byte [ebp + ecx - 0xa04], al
and dword [ebp - 0x154], 0
jmp 0x1004e14c
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0xa04], 0
mov dword [ebp - 0xbe4], 0xc75b57fd
mov dword [ebp - 0xaa8], 0xa4e86524
mov dword [ebp - 0xc3c], 0xffffffff
mov dword [ebp - 0xaa0], 0xe49a2f38
lea eax, [ebp - 0xaa0]
push eax
lea eax, [ebp - 0xc3c]
push eax
lea eax, [ebp - 0xaa8]
push eax
push 0x1bf
lea eax, [ebp - 0xbe4]
push eax
push 1
call fcn.1004a3a3
add esp, 0x18
lea eax, [ebp - 0xa04]
push eax
lea ecx, [ebp - 0x120c]
call fcn.10027516
mov dword [ebp - 0xab0], eax
mov eax, dword [ebp - 0xab0]
mov dword [ebp - 0xc74], eax
mov dword [ebp - 4], 7
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0xc74]
call fcn.10033d28
pop ecx
mov dword [ebp - 0xb88], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120c]
call fcn.10016b51
push 4
lea ecx, [ebp - 0x1000]
call fcn.10016bef
mov dword [ebp - 4], 8
mov dword [ebp - 0x200], 7
mov dword [ebp - 0x258], 0
jmp 0x1004e31a
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 4
jge 0x1004e33c
push dword [ebp - 0x258]
lea ecx, [ebp - 0x1000]
call fcn.10016c5c
mov dword [eax], 1
jmp 0x1004e30d
mov dword [ebp - 0x200], 0
jmp 0x1004e355
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 3
jg 0x1004e374
push 0xd4f
push 0x6cb6
push 0
call fcn.1004bdde
add esp, 0xc
jmp 0x1004e348
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1000]
call fcn.10016c57
and dword [ebp - 0x288], 0
jmp 0x1004e399
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0xb
jae 0x1004e3b2
mov eax, dword [ebp - 0x288]
mov byte [ebp + eax - 0xa04], 0
jmp 0x1004e38c
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0xf40], 7
mov dword [ebp - 0x15c], 0
jmp 0x1004e3df
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffff
je 0x1004e489
mov dword [ebp - 0x16c], 0x876e6bac
mov dword [ebp - 0x208], 0
jmp 0x1004e40f
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
jge 0x1004e42b
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0xec4], 0xc79c
jmp 0x1004e402
mov byte [ebp - 0xf7], 0
lea eax, [ebp - 0xf7]
push eax
push 1
call fcn.1004a4fe
pop ecx
pop ecx
mov dword [ebp - 0x16c], 9
jmp 0x1004e45b
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 7
je 0x1004e484
cmp dword [ebp - 0x16c], 0
je 0x1004e46f
jmp 0x1004e484
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x15c]
mov dword [ebp + eax - 0xec4], ecx
jmp 0x1004e44e
jmp 0x1004e3d2
and dword [ebp - 0xd10], 0
and dword [ebp - 0xd0c], 0
and dword [ebp - 0xd08], 0
and dword [ebp - 0xd04], 0
lea ecx, [ebp - 0x43d]
call fcn.10009103
push eax
lea eax, [ebp - 0xd00]
push eax
lea eax, [ebp - 0xd10]
push eax
lea ecx, [ebp - 0x11e4]
call fcn.10016c6b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x460]
call fcn.10016c31
mov dword [ebp - 4], 9
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x5a8], 0xd241d88c
mov dword [ebp - 0x74], 0
jmp 0x1004e50c
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jg 0x1004e88e
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0xac], 0x939e63a5
mov dword [ebp - 0x3c8], 3
push dword [ebp - 0x74]
lea ecx, [ebp - 0x460]
call fcn.10016c5c
cmp dword [eax], 1
jge 0x1004e553
mov dword [ebp - 0xab8], 1
jmp 0x1004e55a
and dword [ebp - 0xab8], 0
push dword [ebp - 0x74]
lea ecx, [ebp - 0x460]
call fcn.10016c5c
cmp dword [eax], 2
je 0x1004e579
mov dword [ebp - 0x588], 1
jmp 0x1004e580
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x588]
sub eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xac]
jne 0x1004e5a0
mov dword [ebp - 0x8f8], 1
jmp 0x1004e5a7
and dword [ebp - 0x8f8], 0
push dword [ebp - 0x74]
lea ecx, [ebp - 0x460]
call fcn.10016c5c
mov eax, dword [eax]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
imul eax, dword [ebp - 0x8f8]
cmp eax, dword [ebp - 0xac]
je 0x1004e5de
mov dword [ebp - 0x590], 1
jmp 0x1004e5e5
and dword [ebp - 0x590], 0
push dword [ebp - 0x74]
lea ecx, [ebp - 0x460]
call fcn.10016c5c
mov ecx, dword [ebp - 0x590]
inc ecx
cmp dword [eax], ecx
jge 0x1004e613
cmp dword [ebp - 0x3c8], 0
je 0x1004e613
mov dword [ebp - 0x7d8], 1
jmp 0x1004e61a
and dword [ebp - 0x7d8], 0
cmp dword [ebp - 0x7d8], 0
je 0x1004e631
push dword [ebp - 0x74]
lea ecx, [ebp - 0x460]
call fcn.10016c5c
push 3
lea ecx, [ebp - 0x460]
call fcn.10016c5c
cmp dword [eax], 0x4ed832cb
jg 0x1004e855
mov dword [ebp - 0x5a0], 0xfffffff7
push 1
lea ecx, [ebp - 0xe0c]
call fcn.10016bef
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xbec], 0x3b8a
push 1
push 0x42bf
lea eax, [ebp - 0xe0c]
push eax
push 0x5432
lea eax, [ebp - 0xf48]
push eax
call fcn.1004a556
add esp, 0x14
mov dword [ebp - 0x3c8], 1
cmp dword [ebp - 0x3c8], 0
jne 0x1004e6b0
mov dword [ebp - 0x9a8], 1
jmp 0x1004e6b7
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x598], eax
push 1
lea ecx, [ebp - 0x460]
call fcn.10016c5c
mov ecx, dword [ebp - 0x598]
mov dword [eax], ecx
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0x5a0], eax
mov eax, dword [ebp - 0x13c]
add eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x5a0]
jge 0x1004e719
mov dword [ebp - 0x7e0], 1
jmp 0x1004e720
and dword [ebp - 0x7e0], 0
push 0
lea ecx, [ebp - 0xe0c]
call fcn.10016c5c
mov ecx, dword [ebp - 0x7e0]
imul ecx, dword [eax]
inc ecx
mov dword [ebp - 0x5a8], ecx
mov eax, dword [ebp - 0xbec]
cmp dword [ebp - 0x5a8], eax
je 0x1004e757
mov dword [ebp - 0x900], 1
jmp 0x1004e75e
and dword [ebp - 0x900], 0
cmp dword [ebp - 0x900], 0xffffffff
jne 0x1004e77c
mov eax, 0x6135443
test eax, eax
jne 0x1004e77c
mov dword [ebp - 0x5b0], 1
jmp 0x1004e783
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x5b0], eax
je 0x1004e7fa
mov dword [ebp - 0xac0], 0xfffe
mov dword [ebp - 0xac], 0
jmp 0x1004e7b4
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jg 0x1004e7f8
mov dword [ebp - 0xf50], 0x2e30e5de
mov dword [ebp - 0xf58], 0xfffffff7
mov dword [ebp - 0xf60], 0xaf8a8ff0
lea eax, [ebp - 0xac0]
push eax
push 0x3bab
push 0x6d75
push 1
call fcn.1004a600
add esp, 0x10
jmp 0x1004e7a7
jmp 0x1004e844
mov byte [ebp - 0xf3], 0
movzx eax, byte [ebp - 0xf3]
test eax, eax
je 0x1004e822
push 0x26ac
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 0xd3], 0
push 0
lea eax, [ebp - 0xd3]
push eax
push 0x49e
push 0x483c
call fcn.1004c142
add esp, 0x10
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xe0c]
call fcn.10016c57
jmp 0x1004e889
cmp dword [ebp - 0x444], 0x5249
jl 0x1004e86d
mov dword [ebp - 0x7e8], 1
jmp 0x1004e874
and dword [ebp - 0x7e8], 0
push 3
lea ecx, [ebp - 0x460]
call fcn.10016c5c
mov ecx, dword [ebp - 0x7e8]
mov dword [eax], ecx
jmp 0x1004e505
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x460]
call fcn.10016c57
mov byte [ebp - 0x398], 9
mov byte [ebp - 0x397], 0x7a
mov byte [ebp - 0x396], 0
mov byte [ebp - 0x395], 1
mov byte [ebp - 0x394], 7
mov byte [ebp - 0x393], 7
mov byte [ebp - 0x392], 5
mov byte [ebp - 0x391], 7
mov byte [ebp - 0x390], 3
mov byte [ebp - 0x38f], 3
mov byte [ebp - 0x38e], 2
mov byte [ebp - 0x38d], 5
mov byte [ebp - 0x38c], 8
mov byte [ebp - 0x38b], 7
mov byte [ebp - 0x38a], 6
mov byte [ebp - 0x389], 9
mov byte [ebp - 0x388], 1
mov byte [ebp - 0x387], 0xf
mov byte [ebp - 0x386], 4
mov byte [ebp - 0x385], 2
mov byte [ebp - 0x384], 0x62
mov byte [ebp - 0x383], 0x71
mov byte [ebp - 0x382], 0x6e
mov byte [ebp - 0x381], 0x19
mov byte [ebp - 0x380], 0xc
mov byte [ebp - 0x37f], 0x22
mov byte [ebp - 0x37e], 0xdb
mov byte [ebp - 0x37d], 0x8d
mov byte [ebp - 0x37c], 0x28
mov byte [ebp - 0x37b], 0x2d
mov byte [ebp - 0x37a], 0x40
mov byte [ebp - 0x379], 0x7f
mov byte [ebp - 0x378], 0xd
mov byte [ebp - 0x377], 0x1f
mov byte [ebp - 0x376], 0x9d
mov byte [ebp - 0x375], 0x12
mov byte [ebp - 0x374], 0xf6
mov byte [ebp - 0x373], 0x92
mov byte [ebp - 0x372], 0x79
mov byte [ebp - 0x371], 0x88
mov byte [ebp - 0x370], 0x68
mov byte [ebp - 0x36f], 0xd3
mov byte [ebp - 0x36e], 0xae
mov byte [ebp - 0x36d], 0x53
mov byte [ebp - 0x36c], 0x59
mov byte [ebp - 0x36b], 0xe5
mov byte [ebp - 0x36a], 0x34
mov byte [ebp - 0x369], 0xc5
mov byte [ebp - 0x368], 0x61
mov byte [ebp - 0x367], 0x14
mov byte [ebp - 0x366], 0x3b
mov byte [ebp - 0x365], 0xcc
mov byte [ebp - 0x364], 0x5f
mov byte [ebp - 0x363], 3
mov byte [ebp - 0x362], 0xcc
mov byte [ebp - 0x361], 0x3e
mov byte [ebp - 0x360], 0xe7
mov byte [ebp - 0x35f], 0x7a
mov byte [ebp - 0x35e], 0x32
mov byte [ebp - 0x35d], 0x86
mov byte [ebp - 0x35c], 0xfc
mov byte [ebp - 0x35b], 0xda
mov byte [ebp - 0x35a], 0xf3
mov byte [ebp - 0x359], 0x60
mov byte [ebp - 0x358], 0x46
mov byte [ebp - 0x357], 0x6c
mov byte [ebp - 0x356], 0xae
mov byte [ebp - 0x355], 0x4f
mov byte [ebp - 0x354], 0xe3
mov byte [ebp - 0x353], 5
mov byte [ebp - 0x352], 0x77
mov byte [ebp - 0x351], 8
mov byte [ebp - 0x350], 0x90
mov byte [ebp - 0x34f], 0x31
mov byte [ebp - 0x34e], 0xb2
mov byte [ebp - 0x34d], 0xa
mov byte [ebp - 0x34c], 0x9a
mov byte [ebp - 0x34b], 0xd9
mov byte [ebp - 0x34a], 0x6e
mov byte [ebp - 0x349], 0xc
mov byte [ebp - 0x348], 0xf7
mov byte [ebp - 0x347], 0x17
mov byte [ebp - 0x346], 0x3d
mov byte [ebp - 0x345], 0x84
mov byte [ebp - 0x344], 0xf6
mov byte [ebp - 0x343], 0x25
mov byte [ebp - 0x342], 0x28
mov byte [ebp - 0x341], 0xe5
mov byte [ebp - 0x340], 0xda
mov byte [ebp - 0x33f], 0x2e
mov byte [ebp - 0x33e], 0x9a
mov byte [ebp - 0x33d], 0xe4
mov byte [ebp - 0x33c], 0x55
mov byte [ebp - 0x33b], 0x62
mov byte [ebp - 0x33a], 0x72
mov byte [ebp - 0x339], 0xdd
mov byte [ebp - 0x338], 0xb0
mov byte [ebp - 0x337], 0x8a
mov byte [ebp - 0x336], 0x98
mov byte [ebp - 0x335], 0x22
mov byte [ebp - 0x334], 0xac
mov byte [ebp - 0x333], 0x8c
mov byte [ebp - 0x332], 0xb3
mov byte [ebp - 0x331], 0x53
mov byte [ebp - 0x330], 0x44
mov byte [ebp - 0x32f], 0x9b
mov byte [ebp - 0x32e], 0
mov byte [ebp - 0x32d], 0x10
mov byte [ebp - 0x32c], 0x74
mov byte [ebp - 0x32b], 0x7b
mov byte [ebp - 0x32a], 0x45
mov byte [ebp - 0x329], 0x8d
mov byte [ebp - 0x328], 0x38
mov byte [ebp - 0x327], 0x16
mov byte [ebp - 0x326], 0x65
mov byte [ebp - 0x325], 0x77
mov byte [ebp - 0x324], 0x4a
mov byte [ebp - 0x323], 0x52
mov byte [ebp - 0x322], 0x2f
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x398]
or eax, 0x4a
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x398]
and ecx, 0x4a
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x398]
mov byte [ebp + ecx - 0xa10], al
mov dword [ebp - 0x24], 2
and dword [ebp - 0x140], 0
jmp 0x1004ec2f
mov eax, dword [ebp - 0x24]
inc eax
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x77
jae 0x1004ed21
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x398]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x24], eax
jne 0x1004ec79
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x398]
inc eax
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x398]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x24], eax
jmp 0x1004ec27
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x397]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x140]
movzx ecx, byte [ebp + ecx - 0x39a]
movsx ecx, byte [ebp + ecx - 0xa10]
add eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x397]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x140]
movzx edx, byte [ebp + edx - 0x39a]
movsx edx, byte [ebp + edx - 0xa10]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x397]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x140]
movzx edx, byte [ebp + edx - 0x39a]
movsx edx, byte [ebp + edx - 0xa10]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x398]
mov byte [ebp + ecx - 0xa10], al
lea eax, [ebp - 0x140]
push eax
push 0x2412
push 0x5b1f
push 0
call fcn.1004af5a
add esp, 0x10
jmp 0x1004ec27
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0xa10], 0
lea eax, [ebp - 0xa10]
push eax
lea ecx, [ebp - 0x1284]
call fcn.10027516
mov dword [ebp - 0xc44], eax
mov eax, dword [ebp - 0xc44]
mov dword [ebp - 0xac8], eax
mov dword [ebp - 4], 0xb
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0xac8]
call fcn.10033d28
pop ecx
mov dword [ebp - 0xb08], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1284]
call fcn.10016b51
mov dword [ebp - 0xa4], 0xfffffff8
mov dword [ebp - 0x3d0], 4
mov dword [ebp - 0xf68], 0xffffffff
mov dword [ebp - 0xf70], 4
mov dword [ebp - 0x418], 0x157736d0
mov dword [ebp - 0xc04], 0xfffffff8
mov dword [ebp - 0x5e8], 6
mov dword [ebp - 0xaf0], 4
mov dword [ebp - 0xad8], 0xdfbc43c
mov dword [ebp - 0xc88], 0xffffffff
mov dword [ebp - 0x410], 3
mov dword [ebp - 0xae0], 1
mov dword [ebp - 0xae8], 0x1e6db759
mov dword [ebp - 0xf78], 9
mov dword [ebp - 0x3e0], 8
mov dword [ebp - 0x8c], 0
jmp 0x1004ee2e
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1004ee4a
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x990], 0x6e6c8cac
jmp 0x1004ee21
mov dword [ebp - 0x8c], 0
jmp 0x1004ee63
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1004ee7f
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xcd4], 0xa3e8
jmp 0x1004ee56
mov dword [ebp - 0xa4], 0
jmp 0x1004ee98
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0xfffffff8
jne 0x1004efa4
mov dword [ebp - 0x210], 0x8e85a7b0
mov dword [ebp - 0x260], 0
jmp 0x1004eec8
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 2
jge 0x1004eee4
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0xb68], 0x164caf14
jmp 0x1004eebb
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0xf80], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xf88], eax
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0xf90], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb68]
mov dword [ebp - 0xbf4], eax
mov eax, dword [ebp - 0x210]
sub eax, dword [ebp - 0x210]
dec eax
dec eax
mov dword [ebp - 0xad0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb68]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xb68], eax
mov eax, dword [ebp - 0xbf4]
cmp eax, dword [ebp - 0xad0]
jl 0x1004ef64
mov dword [ebp - 0x5b8], 1
jmp 0x1004ef6b
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x3d0]
imul eax, dword [ebp - 0x5b8]
cmp dword [ebp - 0xa4], eax
jg 0x1004ef8c
mov dword [ebp - 0x994], 1
jmp 0x1004ef93
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0x210], eax
jmp 0x1004ee8b
mov eax, dword [ebp - 0x3d0]
cmp dword [ebp - 0xc88], eax
jne 0x1004efc7
mov eax, 0x701401ce
test eax, eax
je 0x1004efc7
mov dword [ebp - 0x5c0], 1
jmp 0x1004efce
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0xfffc
jne 0x1004eff2
mov dword [ebp - 0x7f0], 1
jmp 0x1004eff9
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0xa4]
imul eax, dword [ebp - 0x7f0]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x990]
jle 0x1004f02a
cmp dword [ebp - 0xad8], 0
je 0x1004f02a
mov dword [ebp - 0x5c8], 1
jmp 0x1004f031
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x5c8]
neg eax
cmp eax, 0x5ee87909
je 0x1004f04c
mov dword [ebp - 0xbfc], 1
jmp 0x1004f053
and dword [ebp - 0xbfc], 0
mov eax, dword [ebp - 0xae0]
mov dword [ebp - 0xf98], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x990]
cmp dword [ebp + eax - 0x990], ecx
jne 0x1004f087
mov dword [ebp - 0x908], 1
jmp 0x1004f08e
and dword [ebp - 0x908], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x990]
cmp dword [ebp - 0x908], eax
jge 0x1004f0af
mov dword [ebp - 0x5d0], 1
jmp 0x1004f0b6
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x410]
inc eax
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x410]
cmp eax, dword [ebp - 0x5d0]
jg 0x1004f0dd
mov dword [ebp - 0x7f8], 1
jmp 0x1004f0e4
and dword [ebp - 0x7f8], 0
mov eax, 0xe74e
sub eax, dword [ebp - 0x7f8]
cmp dword [ebp - 0xa4], eax
jne 0x1004f19b
mov dword [ebp - 0xfa0], 0
mov dword [ebp - 0xfa8], 0xac84c923
mov dword [ebp - 0xfb0], 1
mov dword [ebp - 0xfb8], 7
mov dword [ebp - 0xfc0], 0xf785b8ee
push 2
lea ecx, [ebp - 0x1010]
call fcn.10016bef
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xfc8], 1
mov dword [ebp - 0xc4c], 0xfbcb15e7
push 0x4675
lea eax, [ebp - 0xfd0]
push eax
push 0x28e8
lea eax, [ebp - 0x1010]
push eax
push 1
call fcn.1004a64d
add esp, 0x14
lea eax, [ebp - 0xc4c]
push eax
push 1
call fcn.1004a6f7
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1010]
call fcn.10016c57
jmp 0x1004f4dd
mov dword [ebp - 0xdb0], 4
mov dword [ebp - 0xdac], 4
mov dword [ebp - 0xda8], 4
mov dword [ebp - 0xda4], 4
lea ecx, [ebp - 0x411]
call fcn.10009103
push eax
lea eax, [ebp - 0xda0]
push eax
lea eax, [ebp - 0xdb0]
push eax
lea ecx, [ebp - 0x11bc]
call fcn.10016c6b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa74]
call fcn.10016c31
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x810], 0x8279
mov dword [ebp - 0x438], 0xffffffff
lea eax, [ebp - 0xae8]
push eax
push 1
call fcn.1004a746
pop ecx
pop ecx
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xcd4]
push 2
lea ecx, [ebp - 0xa74]
call fcn.10016c5c
cmp esi, dword [eax]
jg 0x1004f24d
mov dword [ebp - 0x5d8], 1
jmp 0x1004f254
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x438]
cmp dword [ebp - 0x5d8], eax
jle 0x1004f26e
mov dword [ebp - 0x9b0], 1
jmp 0x1004f275
and dword [ebp - 0x9b0], 0
cmp dword [ebp - 0x9b0], 2
je 0x1004f28a
mov dword [ebp - 0x5e0], 1
jmp 0x1004f291
and dword [ebp - 0x5e0], 0
cmp dword [ebp - 0x5e0], 0
je 0x1004f2a6
mov dword [ebp - 0x800], 1
jmp 0x1004f2ad
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x800]
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebp - 0x438]
cmp dword [ebp - 0x5e8], eax
jne 0x1004f2d3
mov dword [ebp - 0x910], 1
jmp 0x1004f2da
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x810]
imul eax, dword [ebp - 0x910]
cmp eax, 0xe34b743e
je 0x1004f2fa
mov dword [ebp - 0x5f0], 1
jmp 0x1004f301
and dword [ebp - 0x5f0], 0
push 2
lea ecx, [ebp - 0xa74]
call fcn.10016c5c
mov ecx, dword [ebp - 0x5f0]
cmp ecx, dword [eax]
jne 0x1004f324
mov dword [ebp - 0x808], 1
jmp 0x1004f32b
and dword [ebp - 0x808], 0
cmp dword [ebp - 0x808], 0x49196e2f
je 0x1004f343
mov dword [ebp - 0x5f8], 1
jmp 0x1004f34a
and dword [ebp - 0x5f8], 0
push 2
lea ecx, [ebp - 0xa74]
call fcn.10016c5c
mov ecx, dword [ebp - 0x5f8]
cmp ecx, dword [eax]
jge 0x1004f36d
mov dword [ebp - 0x9a0], 1
jmp 0x1004f374
and dword [ebp - 0x9a0], 0
push 2
lea ecx, [ebp - 0xa74]
call fcn.10016c5c
mov ecx, dword [ebp - 0x9a0]
cmp ecx, dword [eax]
jl 0x1004f397
mov dword [ebp - 0x3d8], 1
jmp 0x1004f39e
and dword [ebp - 0x3d8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3d8]
mov dword [ebp + eax - 0x990], ecx
mov eax, dword [ebp - 0x3d8]
sub eax, dword [ebp - 0x438]
jne 0x1004f3cb
mov dword [ebp - 0x600], 1
jmp 0x1004f3d2
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0xc04]
cmp dword [ebp - 0x600], eax
jne 0x1004f3e9
cmp dword [ebp - 0x810], 0
je 0x1004f3fc
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x1004f3fc
mov dword [ebp - 0x608], 1
jmp 0x1004f403
and dword [ebp - 0x608], 0
push 2
lea ecx, [ebp - 0xa74]
call fcn.10016c5c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x608]
jle 0x1004f426
mov dword [ebp - 0x918], 1
jmp 0x1004f42d
and dword [ebp - 0x918], 0
cmp dword [ebp - 0x918], 0xffffffff
jl 0x1004f442
mov dword [ebp - 0x610], 1
jmp 0x1004f449
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x3e0]
dec eax
mov dword [ebp - 0x3e0], eax
imul eax, dword [ebp - 0x3e0], 0x38fbac1
mov ecx, dword [ebp - 0x418]
imul ecx, dword [ebp - 0x610]
imul ecx, ecx, 0x1fb6
cmp eax, ecx
jg 0x1004f483
mov dword [ebp - 0x818], 1
jmp 0x1004f48a
and dword [ebp - 0x818], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x818]
sub ecx, dword [ebp + eax - 0xcd4]
je 0x1004f4b4
mov eax, 0xdff1
test eax, eax
je 0x1004f4b4
mov dword [ebp - 0x618], 1
jmp 0x1004f4bb
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0xa4]
imul eax, dword [ebp - 0x618]
mov dword [ebp - 0xaf0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa74]
call fcn.10016c57
and dword [ebp - 0x2a0], 0
jmp 0x1004f4f3
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0xb
jae 0x1004f50c
mov eax, dword [ebp - 0x2a0]
mov byte [ebp + eax - 0xa10], 0
jmp 0x1004f4e6
mov dword [ebp - 0x20], 0
push 2
lea ecx, [ebp - 0xa28]
call fcn.10016bef
mov dword [ebp - 4], 0xe
push 2
lea ecx, [ebp - 0xe54]
call fcn.10016bef
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x148], 0x34605dd8
push 0x6890
push 1
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.1004a778
add esp, 0x10
push 0x1922
lea eax, [ebp - 0xc84]
push eax
push 0
lea eax, [ebp - 0xe54]
push eax
call fcn.1004a88e
add esp, 0x10
cmp dword [ebp - 0x20], 0x825062d7
jb 0x1004f591
mov dword [ebp - 0x9b8], 1
jmp 0x1004f598
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x9b8], eax
jg 0x1004f5af
mov dword [ebp - 0xaf8], 1
jmp 0x1004f5b6
and dword [ebp - 0xaf8], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jne 0x1004f5cd
cmp dword [ebp - 0x20], 0
jne 0x1004f5cd
and dword [ebp - 0x620], 0
jmp 0x1004f5d7
mov dword [ebp - 0x620], 1
cmp dword [ebp - 0x620], 0
jae 0x1004f5f2
cmp dword [ebp - 0x20], 0
je 0x1004f5f2
mov dword [ebp - 0x820], 1
jmp 0x1004f5f9
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x820], eax
jne 0x1004f610
mov dword [ebp - 0x628], 1
jmp 0x1004f617
and dword [ebp - 0x628], 0
push 0
lea ecx, [ebp - 0xa28]
call fcn.10016c5c
mov ecx, dword [ebp - 0x628]
cmp ecx, dword [eax]
jl 0x1004f63a
mov dword [ebp - 0x920], 1
jmp 0x1004f641
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x920], eax
je 0x1004f658
mov dword [ebp - 0x630], 1
jmp 0x1004f65f
and dword [ebp - 0x630], 0
push 0
lea ecx, [ebp - 0xa28]
call fcn.10016c5c
mov ecx, dword [ebp - 0x630]
cmp ecx, dword [eax]
jle 0x1004f682
mov dword [ebp - 0x828], 1
jmp 0x1004f689
and dword [ebp - 0x828], 0
push 0
lea ecx, [ebp - 0xa28]
call fcn.10016c5c
mov ecx, dword [ebp - 0x828]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x20]
je 0x1004f6af
mov dword [ebp - 0x638], 1
jmp 0x1004f6b6
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x638]
je 0x1004f6cd
mov dword [ebp - 0x9c0], 1
jmp 0x1004f6d4
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x9c0]
jle 0x1004f6eb
mov dword [ebp - 0x640], 1
jmp 0x1004f6f2
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x640], eax
jl 0x1004f709
mov dword [ebp - 0x830], 1
jmp 0x1004f710
and dword [ebp - 0x830], 0
push 0
lea ecx, [ebp - 0xa28]
call fcn.10016c5c
mov ecx, dword [ebp - 0x830]
cmp ecx, dword [eax]
jg 0x1004f733
mov dword [ebp - 0x648], 1
jmp 0x1004f73a
and dword [ebp - 0x648], 0
push 1
lea ecx, [ebp - 0xe54]
call fcn.10016c5c
mov ecx, dword [ebp - 0x648]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x20]
je 0x1004f760
mov dword [ebp - 0x928], 1
jmp 0x1004f767
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x928], eax
jl 0x1004f77e
mov dword [ebp - 0x650], 1
jmp 0x1004f785
and dword [ebp - 0x650], 0
cmp dword [ebp - 0x650], 0x3a4a
jne 0x1004f990
mov dword [ebp - 0x218], 0xffffffff
mov dword [ebp - 0xb7c], 1
mov dword [ebp - 0x840], 0x281b1d0b
mov dword [ebp - 0xb80], 0x627823d1
mov dword [ebp - 0xa0], 0
jmp 0x1004f7d6
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1004f7f2
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0xa38], 8
jmp 0x1004f7c9
mov dword [ebp - 0xa0], 0
jmp 0x1004f80b
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x1004f827
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x1150], 0xfffffffc
jmp 0x1004f7fe
cmp dword [ebp - 0x218], 1
jg 0x1004f83c
mov dword [ebp - 0x668], 1
jmp 0x1004f843
and dword [ebp - 0x668], 0
xor eax, eax
inc eax
je 0x1004f864
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa38], 0
je 0x1004f864
mov dword [ebp - 0x838], 1
jmp 0x1004f86b
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x838]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1004f88f
cmp dword [ebp - 0x218], 0
je 0x1004f88f
mov dword [ebp - 0x658], 1
jmp 0x1004f896
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x218]
cmp eax, dword [ebp - 0x658]
jl 0x1004f8b0
mov dword [ebp - 0x3e8], 1
jmp 0x1004f8b7
and dword [ebp - 0x3e8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3e8]
mov dword [ebp + eax - 0x1150], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3e8]
sub ecx, dword [ebp + eax - 0xa38]
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0xa38]
jne 0x1004f8f8
mov dword [ebp - 0x9ac], 1
jmp 0x1004f8ff
and dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0xb7c]
cmp dword [ebp - 0x9ac], eax
jg 0x1004f919
mov dword [ebp - 0x148], 0
jmp 0x1004f9a9
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jg 0x1004f9e9
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1004f9e7
push 0x34b2
push 0x50bf
push 0
push 0x643b
push 0x2f76
push 0x7bea
call fcn.1004c0c4
add esp, 0x18
jmp 0x1004f99c
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xe54]
call fcn.10016c57
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa28]
call fcn.10016c57
push dword [ebp - 0xb08]
push dword [ebp - 0xb88]
call fcn.10047ab2
pop ecx
pop ecx
mov dword [ebp - 0x868], eax
and dword [ebp - 0xd24], 0
and dword [ebp - 0xd20], 0
and dword [ebp - 0xd1c], 0
and dword [ebp - 0xd18], 0
lea ecx, [ebp - 0x409]
call fcn.10009103
push eax
lea eax, [ebp - 0xd14]
push eax
lea eax, [ebp - 0xd24]
push eax
lea ecx, [ebp - 0x11f4]
call fcn.10016c6b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xccc]
call fcn.10016c31
mov dword [ebp - 4], 0x10
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0x110], 1
mov dword [ebp - 0xfe0], 0xfffffffe
mov dword [ebp - 0x290], 0xe623b26d
mov dword [ebp - 0xb10], 0xfffffffc
mov dword [ebp - 0xb20], 0xe2caeaba
push 2
lea ecx, [ebp - 0xcc0]
call fcn.10016bef
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x43c], 1
mov dword [ebp - 0xb98], 0xfffffffc
mov dword [ebp - 0x268], 0
jmp 0x1004faf2
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 2
jge 0x1004fb11
push dword [ebp - 0x268]
lea ecx, [ebp - 0xcc0]
call fcn.10016c5c
or dword [eax], 0xffffffff
jmp 0x1004fae5
push 0
lea ecx, [ebp - 0xccc]
call fcn.10016c5c
mov dword [eax], 1
jmp 0x1004fb4a
push 0
lea ecx, [ebp - 0xccc]
call fcn.10016c5c
cmp dword [eax], 0xfffffff0
jle 0x1004ff4e
mov dword [ebp - 0xb0], 0xe29ea414
mov dword [ebp - 0xca8], 0xc2e607d1
mov dword [ebp - 0xca4], 0xc2e607d1
mov dword [ebp - 0xca0], 0xc2e607d1
mov dword [ebp - 0xc9c], 0xc2e607d1
mov byte [ebp - 0xd9], 0
push 0x3470
push 0
push 0x4775
push 0xe8e
lea eax, [ebp - 0xd9]
push eax
push 0x6a38
push 0x1f8e
call fcn.1004b5bf
add esp, 0x1c
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xfe8], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xff0], eax
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0xd8], eax
jne 0x1004fbf5
mov dword [ebp - 0x670], 1
jmp 0x1004fbfc
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x10bc], eax
mov eax, 0x22db785b
add eax, 0x3267
sub eax, dword [ebp - 0xb0]
cmp eax, 0x8e486aeb
jb 0x1004fc37
mov dword [ebp - 0x848], 1
jmp 0x1004fc3e
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x670]
cmp eax, dword [ebp - 0x848]
jne 0x1004fc58
mov dword [ebp - 0x678], 1
jmp 0x1004fc5f
and dword [ebp - 0x678], 0
cmp dword [ebp - 0x678], 0x4292
jl 0x1004fd9d
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xcc0]
call fcn.10016c57
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xccc]
call fcn.10016c57
lea eax, [ebp - 0x868]
push eax
push 0x272d
push 1
lea eax, [ebp - 0xe0]
push eax
push 0x2cf9
call fcn.1004a7e9
add esp, 0x14
mov dword [ebp - 0x940], 0x4aa0
mov dword [ebp - 0xba0], 0x3e75cb55
mov dword [ebp - 0x10f8], 1
mov dword [ebp - 0xb28], 1
mov dword [ebp - 0x98], 0
jmp 0x1004ffcf
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 4
jge 0x1004ffeb
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x1138], 0x4d1454bc
jmp 0x1004ffc2
mov dword [ebp - 0x98], 0
jmp 0x10050004
cmp dword [ebp - 0x98], 4
jge 0x10050020
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xb1c], eax
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0xb24], eax
mov eax, dword [ebp - 0xb24]
movzx eax, byte [eax]
test eax, eax
je 0x100542a8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret