Function at 0x142df8
Capabilities:
Check for time delay via gettickcount
Check http status code
Delete registry key
Delete registry value
Disable system features via registry on windows
Parse pe header
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1f5
push 0
push 0
dec ecx
jne 0x142e00
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x14b2de
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x184]
call fcn.00013d18
cmp dword [0x2513ac], 0
je 0x14abe1
xor edx, edx
push ebp
push 0x14ab96
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x184]
mov edx, 0x14b2f8
call fcn.00013fb0
lea edx, [ebp - 0x78]
mov eax, 0x2513ac
mov ecx, 4
call fcn.0001291c
mov eax, dword [ebp - 0x78]
mov al, byte [eax]
mov byte [ebp - 0x45], al
xor eax, eax
mov dword [ebp - 0x14c], eax
mov al, byte [ebp - 0x45]
cmp al, byte [0x25129d]
jne 0x142f77
cmp byte [0x2511f0], 0
je 0x142f77
cmp byte [0x251198], 0
je 0x142f77
lea edx, [ebp - 0x4d8]
mov eax, 1
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x3d8]
call fcn.00013f4c
mov edx, dword [ebp - 0x3d8]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [ebp - 0x14c]
inc dword [ebp - 0x78]
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x78]
mov ecx, 4
call fcn.0001291c
cmp dword [ebp - 0x3c], 1
je 0x142f77
push 0x14b304
lea eax, [ebp - 0x4dc]
push eax
xor ecx, ecx
mov edx, dword [0x251144]
mov eax, dword [ebp - 0x3c]
call fcn.00115884
mov edx, dword [ebp - 0x4dc]
lea eax, [ebp - 0x128]
mov ecx, 0x14b314
call fcn.00013ff4
mov eax, dword [ebp - 0x128]
cmp byte [eax], 0x45
je 0x142f77
push 0x14b320
mov eax, dword [ebp - 0x3c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x4e4]
call fcn.0003009c
push dword [ebp - 0x4e4]
push 0x14b350
push dword [ebp - 0x128]
lea eax, [ebp - 0x4e0]
mov edx, 4
call fcn.00014068
mov edx, dword [ebp - 0x4e0]
mov eax, dword [0x251144]
call fcn.001171b0
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512a4]
jne 0x143067
cmp byte [0x2511f0], 0
je 0x143067
cmp byte [0x251198], 0
je 0x143067
lea edx, [ebp - 0x4d8]
mov eax, 8
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x4e8]
call fcn.00013f4c
mov edx, dword [ebp - 0x4e8]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [ebp - 0x14c]
inc dword [ebp - 0x78]
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x78]
mov ecx, 4
call fcn.0001291c
cmp dword [ebp - 0x3c], 0xffffffff
je 0x14300d
push 0x14b35c
lea eax, [ebp - 0x128]
push eax
xor ecx, ecx
mov edx, dword [0x251144]
mov eax, dword [ebp - 0x3c]
call fcn.00115884
mov eax, dword [ebp - 0x128]
mov edx, 0x14b36c
call fcn.000140b8
je 0x143067
push 0x14b320
mov eax, dword [ebp - 0x3c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x4f0]
call fcn.0003009c
push dword [ebp - 0x4f0]
push 0x14b350
push dword [ebp - 0x128]
lea eax, [ebp - 0x4ec]
mov edx, 4
call fcn.00014068
mov edx, dword [ebp - 0x4ec]
mov eax, dword [0x251144]
call fcn.001171b0
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512a2]
jne 0x14317a
cmp byte [0x2511f0], 0
je 0x14317a
cmp byte [0x251198], 0
je 0x14317a
lea edx, [ebp - 0x4d8]
mov eax, 6
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x4f4]
call fcn.00013f4c
mov edx, dword [ebp - 0x4f4]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [ebp - 0x14c]
inc dword [ebp - 0x78]
push 0x14b378
lea eax, [ebp - 0x128]
push eax
xor ecx, ecx
mov edx, dword [0x251144]
or eax, 0xffffffff
call fcn.00115884
mov eax, dword [ebp - 0x128]
mov edx, 0x14b36c
call fcn.000140b8
je 0x143154
call fcn.001157c8
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x14314c
mov eax, dword [ebp - 0x78]
mov byte [eax], 0xb
lea edx, [ebp - 0x4fc]
mov eax, dword [ebp - 0xbc]
call fcn.0003006c
mov ecx, dword [ebp - 0x4fc]
lea eax, [ebp - 0x4f8]
mov edx, 0x14b388
call fcn.00013ff4
mov edx, dword [ebp - 0x4f8]
mov eax, dword [0x251144]
call fcn.001171b0
jmp 0x14317a
mov eax, dword [ebp - 0x78]
mov byte [eax], 0xc
jmp 0x14317a
lea eax, [ebp - 0x500]
mov ecx, dword [ebp - 0x128]
mov edx, 0x14b3a0
call fcn.00013ff4
mov edx, dword [ebp - 0x500]
mov eax, dword [0x251144]
call fcn.001171b0
mov al, byte [ebp - 0x45]
cmp al, byte [0x25129e]
jne 0x143232
cmp byte [0x2511f0], 0
je 0x143232
cmp byte [0x251198], 0
je 0x143232
lea edx, [ebp - 0x4d8]
mov eax, 2
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x504]
call fcn.00013f4c
mov edx, dword [ebp - 0x504]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [ebp - 0x14c]
inc dword [ebp - 0x78]
cmp byte [0x251198], 0
je 0x143217
cmp dword [0x251220], 0xa
jg 0x1431fa
mov eax, dword [ebp - 0x78]
mov word [eax], 0x5049
jmp 0x143232
cmp byte [0x25123c], 0
je 0x14320d
mov eax, dword [ebp - 0x78]
mov word [eax], 0x1049
jmp 0x143232
mov eax, dword [ebp - 0x78]
mov word [eax], 0x4049
jmp 0x143232
cmp byte [0x2510f8], 0
je 0x14322a
mov eax, dword [ebp - 0x78]
mov word [eax], 0x2049
jmp 0x143232
mov eax, dword [ebp - 0x78]
mov word [eax], 0x3049
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512a3]
jne 0x1432ef
cmp byte [0x2511f0], 0
je 0x1432ef
cmp byte [0x251198], 0
je 0x1432ef
lea edx, [ebp - 0x4d8]
mov eax, 7
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x508]
call fcn.00013f4c
mov edx, dword [ebp - 0x508]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [ebp - 0x14c]
inc dword [ebp - 0x78]
call fcn.001157c8
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x1432e9
mov eax, dword [ebp - 0x78]
mov byte [eax], 1
lea edx, [ebp - 0x510]
mov eax, dword [ebp - 0xbc]
call fcn.0003006c
mov ecx, dword [ebp - 0x510]
lea eax, [ebp - 0x50c]
mov edx, 0x14b388
call fcn.00013ff4
mov edx, dword [ebp - 0x50c]
mov eax, dword [0x251144]
call fcn.001171b0
jmp 0x1432ef
mov eax, dword [ebp - 0x78]
mov byte [eax], 2
mov al, byte [ebp - 0x45]
cmp al, byte [0x25129f]
jne 0x143428
cmp byte [0x2511f0], 0
je 0x143428
cmp byte [0x251198], 0
je 0x143428
lea edx, [ebp - 0x4d8]
mov eax, 3
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x514]
call fcn.00013f4c
mov edx, dword [ebp - 0x514]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [ebp - 0x14c]
inc dword [ebp - 0x78]
mov dx, 0x15b
mov eax, dword [0x520408]
call fcn.00046e6c
add al, 0x64
and al, 0xff
mov edx, dword [ebp - 0x78]
mov byte [edx], al
mov dx, 0x15c
mov eax, dword [0x520408]
call fcn.00046e6c
test al, al
je 0x143392
mov dx, 0x15d
mov eax, dword [0x520408]
call fcn.00046e6c
cmp al, 3
jne 0x143428
xor ecx, ecx
mov dx, 0x15e
mov eax, dword [0x520408]
call fcn.00046e90
mov edx, 0x14b3d0
mov eax, dword [0x251144]
call fcn.001170e8
xor eax, eax
push ebp
push 0x143418
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x2511f4], 0xffffffff
cmp dword [0x251160], 0
je 0x1433dc
mov eax, dword [0x251160]
mov edx, dword [eax]
call dword [edx + 0x44]
push 1
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x12b010]
call fcn.0014d834
mov edx, dword [ebp - 4]
mov dword [edx + 0x104], eax
mov dx, 0x15f
mov eax, dword [0x520408]
call fcn.00046e6c
add al, 0x64
and al, 0xff
mov edx, dword [ebp - 0x78]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x143428
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512a1]
jne 0x143b5e
cmp byte [0x2511f0], 0
je 0x143b5e
cmp byte [0x251198], 0
je 0x143b5e
lea edx, [ebp - 0x4d8]
mov eax, 5
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x518]
call fcn.00013f4c
mov edx, dword [ebp - 0x518]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [ebp - 0x14c]
inc dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
xor ebx, ebx
mov bl, byte [eax]
inc dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
movzx eax, byte [eax]
mov dword [ebp - 0x3c], eax
shl dword [ebp - 0x3c], 8
inc dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
movzx eax, byte [eax]
add dword [ebp - 0x3c], eax
shl dword [ebp - 0x3c], 8
inc dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
movzx eax, byte [eax]
add dword [ebp - 0x3c], eax
shl dword [ebp - 0x3c], 8
inc dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
movzx eax, byte [eax]
add dword [ebp - 0x3c], eax
inc dword [ebp - 0x78]
inc dword [ebp - 0x78]
inc dword [ebp - 0x78]
inc dword [ebp - 0x78]
cmp ebx, 1
jb 0x143b5e
cmp ebx, 0xff
jae 0x143b5e
lea eax, [ebp - 0xc4]
mov edx, ebx
call fcn.000142dc
inc dword [ebp - 0x78]
lea eax, [ebp - 0xc4]
call fcn.00014178
mov edx, eax
mov eax, dword [ebp - 0x78]
mov ecx, ebx
call fcn.0001291c
mov edx, dword [ebp - 0xc4]
mov eax, 0x14b3ec
call fcn.00014294
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jle 0x143b5e
mov eax, dword [ebp - 0xbc]
cdq
push edx
push eax
mov eax, ebx
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x143556
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x143577
jmp 0x14355a
pop edx
pop eax
jle 0x143577
lea eax, [ebp - 0x110]
push eax
mov edx, dword [ebp - 0xbc]
inc edx
mov ecx, ebx
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
jmp 0x143582
lea eax, [ebp - 0x110]
call fcn.00013d18
mov edx, dword [ebp - 0xbc]
dec edx
lea eax, [ebp - 0xc4]
call fcn.000142dc
lea eax, [ebp - 0xfc]
call fcn.00013d18
mov edx, dword [ebp - 0xc4]
mov eax, 0x14b3f8
call fcn.00014294
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jle 0x143602
lea eax, [ebp - 0xfc]
push eax
mov ecx, dword [ebp - 0xbc]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
lea eax, [ebp - 0xc4]
push eax
mov eax, dword [ebp - 0xc4]
call fcn.00013fa8
mov ecx, eax
mov edx, dword [ebp - 0xbc]
inc edx
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
mov eax, dword [ebp - 0xfc]
call fcn.00013fa8
test eax, eax
jne 0x14361c
lea eax, [ebp - 0xfc]
call fcn.00028b64
mov ecx, 0x14b404
xor edx, edx
xor eax, eax
call fcn.000c82e8
mov ebx, eax
mov eax, ebx
and eax, 7
cmp eax, 0x10
jbe 0x1436a8
push 0x14b410
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x520]
call fcn.0003009c
push dword [ebp - 0x520]
push 0x14b41c
lea edx, [ebp - 0x524]
mov eax, 0x10
call fcn.0003006c
push dword [ebp - 0x524]
push 0x14b41c
lea edx, [ebp - 0x528]
mov eax, 7
call fcn.0003006c
push dword [ebp - 0x528]
lea eax, [ebp - 0x51c]
mov edx, 6
call fcn.00014068
mov edx, dword [ebp - 0x51c]
mov eax, dword [0x251144]
call fcn.001171b0
mov byte [ebp - 0x145], 0
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x15c]
push eax
push 1
push 0
push 0
call sub.wtsapi32.dll_WTSEnumerateSessionsA
test eax, eax
je 0x143b32
cmp dword [ebp - 0x174], 0
jbe 0x143abe
mov ebx, dword [ebp - 0x174]
dec ebx
test ebx, ebx
jl 0x143b41
inc ebx
mov dword [ebp - 0xbc], 0
mov eax, dword [ebp - 0xbc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x15c]
mov eax, dword [edx + eax*4]
cmp eax, dword [ebp - 0x3c]
je 0x143aac
cmp byte [ebp - 0x145], 0
jne 0x143aac
mov eax, dword [ebp - 0xbc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x15c]
mov al, byte [edx + eax*4 + 8]
test al, al
je 0x143740
add al, 0xfd
sub al, 2
jae 0x143aac
mov dword [ebp - 0x154], 0xf7
mov dword [ebp - 0x16c], 0xf7
mov eax, dword [ebp - 0xbc]
and eax, 7
xor edx, edx
mov dword [ebp + eax*4 - 0x2bc], edx
mov eax, dword [ebp - 0xbc]
and eax, 7
xor edx, edx
mov dword [ebp + eax*4 - 0x230], edx
lea eax, [ebp - 0x16c]
push eax
mov eax, dword [ebp - 0xbc]
and eax, 7
lea eax, [ebp + eax*4 - 0x230]
push eax
push 7
mov eax, dword [ebp - 0xbc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x15c]
mov eax, dword [edx + eax*4]
push eax
push 0
call sub.wtsapi32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x143a27
lea eax, [ebp - 0x154]
push eax
mov eax, dword [ebp - 0xbc]
and eax, 7
lea eax, [ebp + eax*4 - 0x2bc]
push eax
push 5
mov eax, dword [ebp - 0xbc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x15c]
mov eax, dword [edx + eax*4]
push eax
push 0
call sub.wtsapi32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x143a27
cmp dword [ebp - 0x16c], 1
jbe 0x143a36
cmp dword [ebp - 0x16c], 0xf7
jae 0x143a36
cmp dword [ebp - 0x154], 1
jbe 0x143a36
cmp dword [ebp - 0x154], 0xf7
jae 0x143a36
lea eax, [ebp - 0x530]
mov edx, dword [ebp - 0xbc]
and edx, 7
mov edx, dword [ebp + edx*4 - 0x230]
call fcn.00013ee0
mov eax, dword [ebp - 0x530]
lea edx, [ebp - 0x52c]
call fcn.0002fd54
mov eax, dword [ebp - 0x52c]
push eax
lea edx, [ebp - 0x534]
mov eax, dword [ebp - 0xfc]
call fcn.0002fd54
mov edx, dword [ebp - 0x534]
pop eax
call fcn.000140b8
jne 0x143a36
lea eax, [ebp - 0x53c]
mov edx, dword [ebp - 0xbc]
and edx, 7
mov edx, dword [ebp + edx*4 - 0x2bc]
call fcn.00013ee0
mov eax, dword [ebp - 0x53c]
lea edx, [ebp - 0x538]
call fcn.0002fd54
mov eax, dword [ebp - 0x538]
push eax
lea edx, [ebp - 0x540]
mov eax, dword [ebp - 0xc4]
call fcn.0002fd54
mov edx, dword [ebp - 0x540]
pop eax
call fcn.000140b8
jne 0x143a36
mov byte [ebp - 0x145], 1
push 0
lea eax, [ebp - 0x544]
mov edx, dword [ebp - 0x110]
call fcn.000145ac
mov eax, dword [ebp - 0x544]
call fcn.00014620
push eax
mov eax, dword [ebp - 0xbc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x15c]
mov eax, dword [edx + eax*4]
push eax
mov eax, dword [ebp - 0x3c]
push eax
push 0
call sub.WINSTA.DLL_WinStationConnectW
test eax, eax
je 0x1439a6
push 0x14b428
push dword [ebp - 0xfc]
push 0x14b3f8
push dword [ebp - 0xc4]
push 0x14b440
mov eax, dword [ebp - 0x3c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x54c]
call fcn.0003009c
push dword [ebp - 0x54c]
push 0x14b44c
mov eax, dword [ebp - 0xbc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x15c]
mov eax, dword [edx + eax*4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x550]
call fcn.0003009c
push dword [ebp - 0x550]
lea eax, [ebp - 0x548]
mov edx, 8
call fcn.00014068
mov edx, dword [ebp - 0x548]
mov eax, dword [0x251144]
call fcn.001170e8
jmp 0x143a36
push 0x14b45c
push dword [ebp - 0xfc]
push 0x14b3f8
push dword [ebp - 0xc4]
push 0x14b440
mov eax, dword [ebp - 0x3c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x558]
call fcn.0003009c
push dword [ebp - 0x558]
push 0x14b44c
mov eax, dword [ebp - 0xbc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x15c]
mov eax, dword [edx + eax*4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x55c]
call fcn.0003009c
push dword [ebp - 0x55c]
lea eax, [ebp - 0x554]
mov edx, 8
call fcn.00014068
mov edx, dword [ebp - 0x554]
mov eax, dword [0x251144]
call fcn.001171b0
jmp 0x143a36
mov edx, 0x14b480
mov eax, dword [0x251144]
call fcn.00117278
mov eax, dword [ebp - 0xbc]
and eax, 7
cmp dword [ebp + eax*4 - 0x2bc], 0
je 0x143a5f
mov eax, dword [ebp - 0xbc]
and eax, 7
mov eax, dword [ebp + eax*4 - 0x2bc]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
mov eax, dword [ebp - 0xbc]
and eax, 7
xor edx, edx
mov dword [ebp + eax*4 - 0x2bc], edx
mov eax, dword [ebp - 0xbc]
and eax, 7
cmp dword [ebp + eax*4 - 0x230], 0
je 0x143a9a
mov eax, dword [ebp - 0xbc]
and eax, 7
mov eax, dword [ebp + eax*4 - 0x230]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
mov eax, dword [ebp - 0xbc]
and eax, 7
xor edx, edx
mov dword [ebp + eax*4 - 0x230], edx
inc dword [ebp - 0xbc]
dec ebx
jne 0x1436f7
jmp 0x143b41
push 0x14b410
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x564]
call fcn.0003009c
push dword [ebp - 0x564]
push 0x14b41c
lea edx, [ebp - 0x568]
mov eax, 0x10
call fcn.0003006c
push dword [ebp - 0x568]
push 0x14b41c
lea edx, [ebp - 0x56c]
mov eax, 7
call fcn.0003006c
push dword [ebp - 0x56c]
lea eax, [ebp - 0x560]
mov edx, 6
call fcn.00014068
mov edx, dword [ebp - 0x560]
mov eax, dword [0x251144]
call fcn.001171b0
jmp 0x143b41
mov edx, 0x14b490
mov eax, dword [0x251144]
call fcn.00117278
cmp dword [ebp - 0x15c], 0
je 0x143b56
mov eax, dword [ebp - 0x15c]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
xor eax, eax
mov dword [ebp - 0x15c], eax
cmp byte [ebp - 0x45], 0xfd
jne 0x143d61
cmp byte [0x2511f0], 0
je 0x143d61
lea edx, [ebp - 0x4d8]
mov eax, 4
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x570]
call fcn.00013f4c
mov edx, dword [ebp - 0x570]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [ebp - 0x14c]
inc dword [ebp - 0x78]
cmp byte [0x251198], 0
je 0x143bf2
cmp dword [0x251220], 0xa
jle 0x143bcf
mov eax, dword [ebp - 0x78]
mov word [eax], 0x5049
jmp 0x143cf9
cmp byte [0x25123c], 0
je 0x143be5
mov eax, dword [ebp - 0x78]
mov word [eax], 0x4049
jmp 0x143cf9
mov eax, dword [ebp - 0x78]
mov word [eax], 0x49
jmp 0x143cf9
cmp byte [0x2510f8], 0
je 0x143c08
mov eax, dword [ebp - 0x78]
mov word [eax], 0x3049
jmp 0x143cf9
lea ecx, [ebp - 0x574]
mov dx, 0x230
mov eax, dword [0x521d10]
call fcn.00046eb4
mov eax, dword [ebp - 0x574]
call fcn.00013fa8
cmp eax, 7
jne 0x143cf1
lea ecx, [ebp - 0x578]
mov dx, 0x230
mov eax, dword [0x521d10]
call fcn.00046eb4
mov edx, dword [ebp - 0x578]
mov eax, 0x14b4a0
call fcn.00014294
test eax, eax
jg 0x143cf9
lea ecx, [ebp - 0x57c]
mov dx, 0x230
mov eax, dword [0x521d10]
call fcn.00046eb4
mov edx, dword [ebp - 0x57c]
mov eax, 0x14b4b0
call fcn.00014294
test eax, eax
jle 0x143c8e
mov eax, dword [ebp - 0x78]
mov word [eax], 0x5049
jmp 0x143cf9
lea ecx, [ebp - 0x580]
mov dx, 0x230
mov eax, dword [0x521d10]
call fcn.00046eb4
mov edx, dword [ebp - 0x580]
mov eax, 0x14b4c0
call fcn.00014294
test eax, eax
jne 0x143ce7
lea ecx, [ebp - 0x584]
mov dx, 0x230
mov eax, dword [0x521d10]
call fcn.00046eb4
mov edx, dword [ebp - 0x584]
mov eax, 0x14b4d0
call fcn.00014294
dec eax
jne 0x143ce7
mov eax, dword [ebp - 0x78]
mov word [eax], 0x5149
jmp 0x143cf9
mov eax, dword [ebp - 0x78]
mov word [eax], 0x2049
jmp 0x143cf9
mov eax, dword [ebp - 0x78]
mov word [eax], 0x2049
mov eax, dword [ebp - 0x78]
movzx eax, word [eax]
call fcn.0009b178
xor eax, eax
push ebp
push 0x143d26
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00142950
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x143d61
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512b5]
jne 0x143e22
cmp byte [0x2511f0], 0
je 0x143e22
cmp byte [0x251198], 0
je 0x143e22
lea edx, [ebp - 0x4d8]
mov eax, 0x29
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x58c]
call fcn.00013f4c
mov edx, dword [ebp - 0x58c]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [ebp - 0x14c]
inc dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov bx, word [eax]
test bx, bx
jbe 0x143e13
cmp bx, 0xc8
jae 0x143e13
add dword [ebp - 0x78], 2
movzx edx, bx
lea eax, [ebp - 0xe0]
call fcn.000142dc
lea eax, [ebp - 0xe0]
call fcn.00014178
mov edx, eax
movzx ecx, bx
mov eax, dword [ebp - 0x78]
call fcn.0001291c
mov edx, dword [ebp - 0xe0]
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x143e22
mov edx, 0x14b4f4
mov eax, dword [0x251144]
call fcn.00117278
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512be]
je 0x143e3c
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512bf]
jne 0x1482dd
cmp byte [0x2511f0], 0
je 0x1482dd
cmp byte [0x251198], 0
je 0x1482dd
lea edx, [ebp - 0x4d8]
mov eax, 0x3f
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x590]
call fcn.00013f4c
mov edx, dword [ebp - 0x590]
lea eax, [ebp - 0x184]
call fcn.00013fb0
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x10c]
call fcn.000143f0
inc dword [ebp - 0x14c]
inc dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
add dword [ebp - 0x78], 4
mov eax, dword [ebp - 0x78]
movzx ebx, word [eax]
cmp ebx, 1
jb 0x148282
cmp ebx, 0x3e8
jae 0x148282
lea edx, [ebp - 0x4d8]
mov eax, 0x40
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x594]
call fcn.00013f4c
mov edx, dword [ebp - 0x594]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0xc4]
mov edx, ebx
call fcn.000142dc
add dword [ebp - 0x78], 2
lea eax, [ebp - 0xc4]
call fcn.00014178
mov edx, eax
mov eax, dword [ebp - 0x78]
mov ecx, ebx
call fcn.0001291c
call fcn.00029d8c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xc0]
call fcn.0002a444
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 0xc0]
call fcn.00045580
lea ecx, [ebp - 0x4c]
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 0xc4]
call fcn.000459b4
mov eax, dword [ebp - 0x4c]
call fcn.00013fa8
test eax, eax
je 0x143f8f
lea eax, [ebp - 0x598]
push eax
mov ecx, 0x1b
mov edx, 1
mov eax, dword [ebp - 0x4c]
call fcn.000141b0
mov eax, dword [ebp - 0x598]
mov edx, 0x14b504
call fcn.000140b8
je 0x143ffd
lea edx, [ebp - 0x4d8]
mov eax, 0x41
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x59c]
call fcn.00013f4c
mov edx, dword [ebp - 0x59c]
lea eax, [ebp - 0x184]
call fcn.00013fb0
call fcn.00029d8c
fsub qword [0x251240]
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xc0]
call fcn.0002a444
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 0xc0]
call fcn.00045580
lea ecx, [ebp - 0x4c]
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 0xc4]
call fcn.000459b4
lea eax, [ebp - 0xc4]
mov edx, dword [ebp - 0x4c]
call fcn.00013db0
mov eax, dword [ebp - 0xc4]
call fcn.00013fa8
test eax, eax
je 0x144048
lea eax, [ebp - 0x5a0]
push eax
mov ecx, 0x1b
mov edx, 1
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
mov eax, dword [ebp - 0x5a0]
mov edx, 0x14b504
call fcn.000140b8
je 0x14405c
mov edx, 0x14b528
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x1482c0
lea edx, [ebp - 0x4d8]
mov eax, 0x42
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x5a4]
call fcn.00013f4c
mov edx, dword [ebp - 0x5a4]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0xc4]
mov ecx, 0x1b
mov edx, 1
call fcn.000141f0
mov eax, dword [ebp - 0xc4]
mov edx, 0x14b53c
call fcn.000140b8
jne 0x144276
lea edx, [ebp - 0x4d8]
mov eax, 0x43
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x5a8]
call fcn.00013f4c
mov edx, dword [ebp - 0x5a8]
lea eax, [ebp - 0x184]
call fcn.00013fb0
cmp dword [0x251110], 0
jne 0x14423e
xor eax, eax
push ebp
push 0x14422d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x2800
push 0
lea eax, [ebp - 0x5b0]
call fcn.0002d16c
mov eax, dword [ebp - 0x5b0]
lea edx, [ebp - 0x5ac]
call fcn.0001b994
lea eax, [ebp - 0x5ac]
push eax
lea eax, [ebp - 0x5b8]
call fcn.000259a0
mov edx, dword [ebp - 0x5b8]
lea eax, [ebp - 0x5b4]
call fcn.000145ac
mov edx, dword [ebp - 0x5b4]
pop eax
call fcn.0001463c
mov ecx, dword [ebp - 0x5ac]
mov dl, 1
mov eax, dword [0x47380]
call fcn.00048ea0
mov dword [0x251110], eax
cmp dword [0x251110], 0
je 0x144223
lea edx, [ebp - 0x5c0]
xor eax, eax
call fcn.0001ca88
lea eax, [ebp - 0x5c0]
push eax
push 0x14b550
lea edx, [ebp - 0x5cc]
xor eax, eax
call fcn.0001ca88
mov eax, dword [ebp - 0x5cc]
call fcn.00014620
lea edx, [ebp - 0x5c8]
call fcn.00027ef8
push dword [ebp - 0x5c8]
push 0x14b55c
lea edx, [ebp - 0x5d4]
mov eax, 0x10
call fcn.0003006c
mov edx, dword [ebp - 0x5d4]
lea eax, [ebp - 0x5d0]
call fcn.000145ac
push dword [ebp - 0x5d0]
push 0x14b564
lea eax, [ebp - 0x5c4]
mov edx, 5
call fcn.00014700
mov edx, dword [ebp - 0x5c4]
pop eax
call fcn.0001463c
mov edx, dword [ebp - 0x5c0]
lea ecx, [ebp - 0x5bc]
mov eax, dword [0x251110]
call fcn.00049e60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x14423e
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512be]
jne 0x144255
mov eax, dword [0x251110]
call fcn.00110704
jmp 0x14426a
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512bf]
jne 0x14426a
mov eax, dword [0x251110]
call fcn.001109e4
mov dword [ebp - 0x20], 0x20001015
jmp 0x1482c0
lea eax, [ebp - 0x5d8]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
mov eax, dword [ebp - 0x5d8]
mov edx, 0x14b570
call fcn.000140b8
jne 0x144afc
lea edx, [ebp - 0x4d8]
mov eax, 0x44
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x5dc]
call fcn.00013f4c
mov edx, dword [ebp - 0x5dc]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov eax, dword [0x251b24]
mov eax, dword [eax]
mov ecx, 0x3e8
xor edx, edx
div ecx
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x90]
mov edx, dword [ebp - 0xc4]
call fcn.00013db0
lea eax, [ebp - 0x90]
mov ecx, 0xc
mov edx, 1
call fcn.000141f0
lea eax, [ebp - 0x90]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 0x90]
call fcn.000141b0
mov eax, dword [ebp - 0x90]
call fcn.00013fa8
cmp eax, 0xa
je 0x14436a
lea eax, [ebp - 0x5e0]
mov ecx, dword [ebp - 0x90]
mov edx, 0x14b588
call fcn.00013ff4
mov edx, dword [ebp - 0x5e0]
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x1482c0
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0xc4]
call fcn.00013db0
lea eax, [ebp - 0x4c]
mov ecx, 0x16
mov edx, 1
call fcn.000141f0
mov eax, dword [ebp - 0x4c]
call fcn.00013fa8
cmp eax, 2
jge 0x1443ab
mov edx, 0x14b5a4
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x1482c0
lea edx, [ebp - 0x4d8]
mov eax, 0x45
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x5e4]
call fcn.00013f4c
mov edx, dword [ebp - 0x5e4]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x90]
call fcn.00015578
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x18], 0
je 0x144422
lea eax, [ebp - 0x5e8]
mov ecx, dword [ebp - 0x90]
mov edx, 0x14b5bc
call fcn.00013ff4
mov edx, dword [ebp - 0x5e8]
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x1482c0
cmp dword [ebp - 0x8c], 0
jne 0x144443
mov eax, dword [0x251b24]
mov eax, dword [eax]
mov ecx, 0x3e8
xor edx, edx
div ecx
mov dword [ebp - 0x20], eax
jmp 0x1482c0
cmp dword [ebp - 0x8c], 0xffffffff
jne 0x1446ca
lea edx, [ebp - 0x4d8]
mov eax, 0x46
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x5ec]
call fcn.00013f4c
mov edx, dword [ebp - 0x5ec]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov eax, dword [0x251b24]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x251b24]
mov eax, dword [eax]
call fcn.0004e57c
mov ebx, eax
test ebx, ebx
je 0x1444e1
lea edx, [ebp - 0x5f8]
mov eax, ebx
call fcn.00027478
mov ecx, dword [ebp - 0x5f8]
lea eax, [ebp - 0x5f4]
mov edx, 0x14b5d8
call fcn.00013ff4
mov edx, dword [ebp - 0x5f4]
lea eax, [ebp - 0x5f0]
call fcn.000145ac
mov edx, dword [ebp - 0x5f0]
mov eax, dword [0x251144]
call fcn.001174d0
mov eax, dword [0x251b24]
mov eax, dword [eax]
mov ecx, 0x3e8
xor edx, edx
div ecx
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x5fc]
mov eax, dword [ebp - 0x4c]
call fcn.00019210
mov eax, dword [ebp - 0x5fc]
push eax
lea eax, [ebp - 0x608]
call fcn.000252c4
push dword [ebp - 0x608]
push 0x14b350
lea eax, [ebp - 0x60c]
call fcn.00028ac4
push dword [ebp - 0x60c]
push 0x14b608
lea eax, [ebp - 0x610]
call fcn.00028ac4
push dword [ebp - 0x610]
push 0x14b644
lea eax, [ebp - 0x604]
mov edx, 6
call fcn.00014068
mov edx, dword [ebp - 0x604]
lea eax, [ebp - 0x600]
call fcn.000145ac
mov edx, dword [ebp - 0x600]
lea eax, [ebp - 0xb0]
pop ecx
call fcn.0001469c
mov edx, dword [ebp - 0xb0]
mov eax, dword [0x251144]
call fcn.00117340
xor eax, eax
call fcn.00050538
test al, al
je 0x1482c0
push 0x14b668
lea edx, [ebp - 0x61c]
mov eax, dword [ebp - 0x4c]
call fcn.00019210
mov edx, dword [ebp - 0x61c]
lea eax, [ebp - 0x618]
call fcn.00013f70
push dword [ebp - 0x618]
push 0x14b67c
push 0x14b688
lea edx, [ebp - 0x620]
mov eax, dword [ebp - 0x40]
call fcn.0002964c
push dword [ebp - 0x620]
push 0x14b67c
push 0x14b67c
push 0x14b69c
call fcn.00031890
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x624]
call fcn.0002b2e0
push dword [ebp - 0x624]
push 0x14b67c
push 0x14b69c
call fcn.00029d8c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x628]
call fcn.0002b2e0
push dword [ebp - 0x628]
push 0x14b6b0
lea eax, [ebp - 0x614]
mov edx, 0xd
call fcn.00014068
mov eax, dword [ebp - 0x614]
push eax
lea eax, [ebp - 0x62c]
mov edx, dword [ebp - 0xb0]
call fcn.00013f70
mov eax, dword [ebp - 0x62c]
pop edx
call fcn.0012b8b0
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jg 0x1482c0
push 0x14b6c0
lea edx, [ebp - 0x634]
mov eax, dword [ebp - 0xbc]
call fcn.0003006c
push dword [ebp - 0x634]
push 0x14b6fc
lea eax, [ebp - 0x630]
mov edx, 3
call fcn.00014068
mov edx, dword [ebp - 0x630]
mov eax, dword [0x251144]
call fcn.001170e8
jmp 0x1482c0
cmp dword [ebp - 0x8c], 0xe10
jb 0x144abc
cmp dword [ebp - 0x8c], 0x2a300
ja 0x144abc
lea edx, [ebp - 0x4d8]
mov eax, 0x47
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x638]
call fcn.00013f4c
mov edx, dword [ebp - 0x638]
lea eax, [ebp - 0x184]
call fcn.00013fb0
imul eax, dword [ebp - 0x8c], 0x3e8
mov edx, dword [0x251b24]
mov dword [edx], eax
mov eax, dword [0x251b24]
mov eax, dword [eax]
call fcn.0004e57c
mov ebx, eax
test ebx, ebx
je 0x144784
lea edx, [ebp - 0x644]
mov eax, ebx
call fcn.00027478
mov ecx, dword [ebp - 0x644]
lea eax, [ebp - 0x640]
mov edx, 0x14b708
call fcn.00013ff4
mov edx, dword [ebp - 0x640]
lea eax, [ebp - 0x63c]
call fcn.000145ac
mov edx, dword [ebp - 0x63c]
mov eax, dword [0x251144]
call fcn.001174d0
mov eax, dword [0x251b24]
mov eax, dword [eax]
mov ecx, 0x3e8
xor edx, edx
div ecx
mov dword [ebp - 0x20], eax
mov eax, dword [0x251b24]
mov eax, dword [eax]
mov dword [ebp - 0x64c], eax
xor eax, eax
mov dword [ebp - 0x648], eax
fild qword [ebp - 0x64c]
fistp qword [ebp - 0x120]
wait
call fcn.00031890
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x64c]
call fcn.00031340
lea eax, [ebp - 0x64c]
call fcn.000313cc
fild qword [ebp - 0x120]
faddp st(1)
fistp qword [ebp - 0x120]
wait
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
lea eax, [ebp - 0x64c]
call fcn.000313b0
lea eax, [ebp - 0x64c]
call fcn.00031380
fstp qword [ebp - 0xd0]
wait
lea eax, [ebp - 0x658]
call fcn.000252c4
push dword [ebp - 0x658]
push 0x14b350
lea eax, [ebp - 0x65c]
call fcn.00028ac4
push dword [ebp - 0x65c]
push 0x14b608
lea eax, [ebp - 0x660]
call fcn.00028ac4
push dword [ebp - 0x660]
push 0x14b738
lea eax, [ebp - 0x654]
mov edx, 6
call fcn.00014068
mov edx, dword [ebp - 0x654]
lea eax, [ebp - 0x650]
call fcn.000145ac
push dword [ebp - 0x650]
lea edx, [ebp - 0x664]
mov eax, dword [ebp - 0x4c]
call fcn.00019210
push dword [ebp - 0x664]
push dword [ebp - 0xcc]
push dword [ebp - 0xd0]
lea eax, [ebp - 0x670]
call fcn.0002b59c
mov ecx, dword [ebp - 0x670]
lea eax, [ebp - 0x66c]
mov edx, 0x14b75c
call fcn.00013ff4
mov edx, dword [ebp - 0x66c]
lea eax, [ebp - 0x668]
call fcn.000145ac
push dword [ebp - 0x668]
lea eax, [ebp - 0xb0]
mov edx, 3
call fcn.00014700
mov edx, dword [ebp - 0xb0]
mov eax, dword [0x251144]
call fcn.00117340
xor eax, eax
call fcn.00050538
test al, al
je 0x1482c0
lea edx, [ebp - 0x4d8]
mov eax, 0x48
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x674]
call fcn.00013f4c
mov edx, dword [ebp - 0x674]
lea eax, [ebp - 0x184]
call fcn.00013fb0
push 0x14b770
lea edx, [ebp - 0x680]
mov eax, dword [ebp - 0x4c]
call fcn.00019210
mov edx, dword [ebp - 0x680]
lea eax, [ebp - 0x67c]
call fcn.00013f70
push dword [ebp - 0x67c]
push 0x14b67c
push 0x14b788
lea edx, [ebp - 0x684]
mov eax, dword [ebp - 0x40]
call fcn.0002964c
push dword [ebp - 0x684]
push 0x14b67c
push 0x14b7a0
push dword [ebp - 0xcc]
push dword [ebp - 0xd0]
lea eax, [ebp - 0x688]
call fcn.0002b59c
push dword [ebp - 0x688]
push 0x14b67c
push 0x14b7b8
call fcn.00031890
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0xcc]
push dword [ebp - 0xd0]
lea eax, [ebp - 0x68c]
call fcn.0002e2c4
push dword [ebp - 0x68c]
push 0x14b67c
push 0x14b67c
push 0x14b7d0
call fcn.00031890
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x690]
call fcn.0002b2e0
push dword [ebp - 0x690]
push 0x14b67c
push 0x14b7d0
call fcn.00029d8c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x694]
call fcn.0002b2e0
push dword [ebp - 0x694]
push 0x14b6b0
lea eax, [ebp - 0x678]
mov edx, 0x13
call fcn.00014068
mov eax, dword [ebp - 0x678]
push eax
lea eax, [ebp - 0x698]
mov edx, dword [ebp - 0xb0]
call fcn.00013f70
mov eax, dword [ebp - 0x698]
pop edx
call fcn.0012b8b0
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jg 0x1482c0
push 0x14b6c0
lea edx, [ebp - 0x6a0]
mov eax, dword [ebp - 0xbc]
call fcn.0003006c
push dword [ebp - 0x6a0]
push 0x14b6fc
lea eax, [ebp - 0x69c]
mov edx, 3
call fcn.00014068
mov edx, dword [ebp - 0x69c]
mov eax, dword [0x251144]
call fcn.001170e8
jmp 0x1482c0
mov eax, dword [ebp - 0x8c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x6a8]
call fcn.0003009c
mov ecx, dword [ebp - 0x6a8]
lea eax, [ebp - 0x6a4]
mov edx, 0x14b5bc
call fcn.00013ff4
mov edx, dword [ebp - 0x6a4]
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x1482c0
lea eax, [ebp - 0x6ac]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
mov eax, dword [ebp - 0x6ac]
mov edx, 0x14b7e8
call fcn.000140b8
jne 0x145047
lea edx, [ebp - 0x4d8]
mov eax, 0x49
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x6b0]
call fcn.00013f4c
mov edx, dword [ebp - 0x6b0]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0xc4]
mov ecx, 0xd
mov edx, 1
call fcn.000141f0
lea eax, [ebp - 0x6b4]
push eax
mov eax, dword [0x25191c]
mov eax, dword [eax]
call fcn.00013fa8
mov ecx, eax
mov edx, 1
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
mov eax, dword [ebp - 0x6b4]
mov edx, dword [0x25191c]
mov edx, dword [edx]
call fcn.000140b8
jne 0x144bcd
mov eax, dword [0x25191c]
mov eax, dword [eax]
call fcn.00013fa8
mov ecx, eax
lea eax, [ebp - 0xc4]
mov edx, 1
call fcn.000141f0
mov edx, dword [ebp - 0xc4]
mov eax, 0x14b800
call fcn.00014294
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jg 0x144c1e
lea eax, [ebp - 0x6b8]
mov ecx, dword [ebp - 0xc4]
mov edx, 0x14b80c
call fcn.00013ff4
mov edx, dword [ebp - 0x6b8]
mov eax, dword [0x251144]
call fcn.00117278
mov dword [ebp - 0x20], 1
jmp 0x1482c0
lea edx, [ebp - 0x4d8]
mov eax, 0x4a
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x6bc]
call fcn.00013f4c
mov edx, dword [ebp - 0x6bc]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0xbc]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0xc4]
call fcn.00013fa8
mov ecx, eax
mov edx, dword [ebp - 0xbc]
inc edx
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
mov eax, dword [ebp - 0x90]
call fcn.00013fa8
test eax, eax
jne 0x144cfa
mov dword [ebp - 0x20], 0x89a
push 0x14b828
push dword [ebp - 0x90]
push 0x14b83c
push dword [ebp - 0x4c]
push 0x14b848
lea edx, [ebp - 0x6c4]
mov eax, 0x89a
call fcn.00027478
push dword [ebp - 0x6c4]
lea eax, [ebp - 0x6c0]
mov edx, 6
call fcn.00014068
mov edx, dword [ebp - 0x6c0]
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x1482c0
mov eax, dword [ebp - 0x4c]
call fcn.00028b88
test al, al
jne 0x144d5e
mov dword [ebp - 0x20], 3
push 0x14b828
push dword [ebp - 0x90]
push 0x14b83c
push dword [ebp - 0x4c]
push 0x14b848
lea edx, [ebp - 0x6cc]
mov eax, dword [ebp - 0x20]
call fcn.00027478
push dword [ebp - 0x6cc]
lea eax, [ebp - 0x6c8]
mov edx, 6
call fcn.00014068
mov edx, dword [ebp - 0x6c8]
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x1482c0
xor eax, eax
push ebp
push 0x144fb4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x4d8]
mov eax, 0x4b
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x6d0]
call fcn.00013f4c
mov edx, dword [ebp - 0x6d0]
lea eax, [ebp - 0x184]
call fcn.00013fb0
push 0x10000000
push 2
push 3
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x6d4]
mov edx, dword [ebp - 0x4c]
call fcn.000145ac
mov edx, dword [ebp - 0x6d4]
xor ecx, ecx
mov eax, 0x14b854
call fcn.0004c340
mov dword [ebp - 0x1c], eax
push 0x10000000
push 2
push 3
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x6d8]
mov edx, dword [ebp - 0x4c]
call fcn.000145ac
mov edx, dword [ebp - 0x6d8]
mov cl, 1
mov eax, 0x14b86c
call fcn.0004c340
mov ebx, eax
push 0x10000000
push 2
push 3
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x6dc]
mov edx, dword [ebp - 0x4c]
call fcn.000145ac
mov edx, dword [ebp - 0x6dc]
mov cl, 1
mov eax, dword [ebp - 0x90]
call fcn.0004c340
mov dword [ebp - 0x84], eax
push 0x14b828
push dword [ebp - 0x90]
push 0x14b83c
push dword [ebp - 0x4c]
push 0x14b6fc
lea eax, [ebp - 0x6e0]
mov edx, 5
call fcn.00014068
mov edx, dword [ebp - 0x6e0]
mov eax, dword [0x251144]
call fcn.001170e8
push 0x14b350
lea edx, [ebp - 0x4d8]
mov eax, dword [ebp - 0x1c]
call fcn.00029850
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x6e8]
call fcn.00013f4c
push dword [ebp - 0x6e8]
push 0x14b350
lea edx, [ebp - 0x6ec]
mov eax, dword [ebp - 0x144]
call fcn.00027478
push dword [ebp - 0x6ec]
lea eax, [ebp - 0x6e4]
mov edx, 4
call fcn.00014068
mov edx, dword [ebp - 0x6e4]
mov eax, dword [0x251144]
call fcn.001170e8
push 0x14b350
lea edx, [ebp - 0x4d8]
mov eax, ebx
call fcn.00029850
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x6f4]
call fcn.00013f4c
push dword [ebp - 0x6f4]
push 0x14b350
lea edx, [ebp - 0x6f8]
mov eax, dword [ebp - 0x104]
call fcn.00027478
push dword [ebp - 0x6f8]
lea eax, [ebp - 0x6f0]
mov edx, 4
call fcn.00014068
mov edx, dword [ebp - 0x6f0]
mov eax, dword [0x251144]
call fcn.001170e8
push 0x14b350
lea edx, [ebp - 0x4d8]
mov eax, dword [ebp - 0x84]
call fcn.00029850
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x700]
call fcn.00013f4c
push dword [ebp - 0x700]
push 0x14b350
lea edx, [ebp - 0x704]
mov eax, dword [ebp - 0x70]
call fcn.00027478
push dword [ebp - 0x704]
lea eax, [ebp - 0x6fc]
mov edx, 4
call fcn.00014068
mov edx, dword [ebp - 0x6fc]
mov eax, dword [0x251144]
call fcn.001170e8
mov dword [ebp - 0x20], 0x20001015
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1482c0
lea eax, [ebp - 0x710]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
mov eax, dword [ebp - 0x710]
mov edx, 0x14b890
call fcn.000140b8
jne 0x1451fc
lea edx, [ebp - 0x4d8]
mov eax, 0x4d
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x714]
call fcn.00013f4c
mov edx, dword [ebp - 0x714]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0xc4]
mov ecx, 0xc
mov edx, 1
call fcn.000141f0
mov eax, dword [ebp - 0xc4]
call fcn.00013fa8
dec eax
jne 0x1451d1
mov eax, dword [ebp - 0xc4]
cmp byte [eax], 0x31
jne 0x145139
lea edx, [ebp - 0x4d8]
mov eax, 0x4e
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x718]
call fcn.00013f4c
mov edx, dword [ebp - 0x718]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [0x251294]
cmp dword [0x251294], 1
jne 0x145123
call fcn.0012e744
call sub.kernel32.dll_GetTickCount
mov dword [0x251298], eax
mov dword [ebp - 0x20], 0x20001015
jmp 0x1482c0
mov eax, dword [ebp - 0xc4]
cmp byte [eax], 0x30
jne 0x1451a6
cmp dword [0x251294], 0
jbe 0x14519a
dec dword [0x251294]
cmp dword [0x251294], 0
jne 0x14519a
lea edx, [ebp - 0x4d8]
mov eax, 0x4f
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x71c]
call fcn.00013f4c
mov edx, dword [ebp - 0x71c]
lea eax, [ebp - 0x184]
call fcn.00013fb0
call fcn.0012ea84
xor eax, eax
mov dword [0x251298], eax
mov dword [ebp - 0x20], 0x20001015
jmp 0x1482c0
lea eax, [ebp - 0x720]
mov ecx, dword [ebp - 0xc4]
mov edx, 0x14b8a8
call fcn.00013ff4
mov edx, dword [ebp - 0x720]
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x1482c0
lea eax, [ebp - 0x724]
mov ecx, dword [ebp - 0xc4]
mov edx, 0x14b8c0
call fcn.00013ff4
mov edx, dword [ebp - 0x724]
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x1482c0
lea eax, [ebp - 0x728]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
mov eax, dword [ebp - 0x728]
mov edx, 0x14b8d8
call fcn.000140b8
jne 0x145332
lea edx, [ebp - 0x4d8]
mov eax, 0x50
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x72c]
call fcn.00013f4c
mov edx, dword [ebp - 0x72c]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0xc4]
mov ecx, 0xc
mov edx, 1
call fcn.000141f0
lea edx, [ebp - 0xbc]
mov eax, dword [ebp - 0xc4]
call fcn.00015578
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jb 0x145326
cmp dword [ebp - 0x40], 0xffffffff
je 0x145326
lea edx, [ebp - 0x4d8]
mov eax, 0x51
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x730]
call fcn.00013f4c
mov edx, dword [ebp - 0x730]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea edx, [ebp - 0x734]
mov eax, dword [ebp - 0x40]
call fcn.0003006c
push dword [ebp - 0x734]
push 0x14b8f0
mov eax, dword [ebp - 0x40]
call fcn.000c2050
lea edx, [ebp - 0x738]
call fcn.0003006c
push dword [ebp - 0x738]
push 0x14b6fc
lea eax, [ebp - 0xe0]
mov edx, 4
call fcn.00014068
mov edx, dword [ebp - 0xe0]
mov eax, dword [0x251144]
call fcn.001170e8
mov dword [ebp - 0x20], 0x20001015
jmp 0x1482c0
lea eax, [ebp - 0x73c]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
mov eax, dword [ebp - 0x73c]
mov edx, 0x14b918
call fcn.000140b8
jne 0x145472
lea edx, [ebp - 0x4d8]
mov eax, 0x52
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x740]
call fcn.00013f4c
mov edx, dword [ebp - 0x740]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov edx, dword [0x251144]
mov al, 1
call fcn.0012d76c
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 5
ja case.0x1453b2.0
jmp dword [eax*4 + 0x1453b9]
mov edx, 0x14b930
mov eax, dword [0x251144]
call fcn.001171b0
jmp 0x1482c0
mov edx, 0x14b968
mov eax, dword [0x251144]
call fcn.001170e8
jmp 0x1482c0
mov edx, 0x14b9a4
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x1482c0
mov edx, 0x14b9d4
mov eax, dword [0x251144]
call fcn.001170e8
jmp 0x1482c0
mov edx, 0x14ba08
mov eax, dword [0x251144]
call fcn.001170e8
jmp 0x1482c0
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x748]
call fcn.0003009c
mov ecx, dword [ebp - 0x748]
lea eax, [ebp - 0x744]
mov edx, 0x14ba3c
call fcn.00013ff4
mov edx, dword [ebp - 0x744]
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x1482c0
lea eax, [ebp - 0x74c]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
mov eax, dword [ebp - 0x74c]
mov edx, 0x14ba64
call fcn.000140b8
jne 0x1454de
lea edx, [ebp - 0x4d8]
mov eax, 0x53
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x750]
call fcn.00013f4c
mov edx, dword [ebp - 0x750]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov dword [ebp - 0x20], 0x63
jmp 0x1482c0
lea eax, [ebp - 0x754]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
mov eax, dword [ebp - 0x754]
mov edx, 0x14ba7c
call fcn.000140b8
jne 0x145886
lea edx, [ebp - 0x4d8]
mov eax, 0x54
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x758]
call fcn.00013f4c
mov edx, dword [ebp - 0x758]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov dword [ebp - 0x20], 0x63
lea eax, [ebp - 0x90]
mov edx, dword [ebp - 0xc4]
call fcn.00013db0
lea eax, [ebp - 0x90]
mov ecx, 0xc
mov edx, 1
call fcn.000141f0
lea eax, [ebp - 0x98]
call fcn.000143f0
lea ecx, [ebp - 0x38]
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x40]
call fcn.000c11d8
lea eax, [ebp - 0x98]
call fcn.000143f0
lea ecx, [ebp - 0x44]
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x40]
call fcn.000c1a2c
lea eax, [ebp - 0x98]
call fcn.000143f0
push dword [ebp - 0x44]
push 0x14ba90
push dword [ebp - 0x38]
lea eax, [ebp - 0x75c]
mov edx, 3
call fcn.00014700
mov eax, dword [ebp - 0x75c]
lea edx, [ebp - 0xec]
call fcn.0001bf50
mov eax, dword [ebp - 0xec]
call fcn.00013fa8
test eax, eax
jle 0x1456a1
lea eax, [ebp - 0x760]
call fcn.0002a320
push dword [ebp - 0x760]
push 0x14ba9c
lea edx, [ebp - 0x76c]
mov eax, dword [ebp - 0x40]
call fcn.0002964c
push dword [ebp - 0x76c]
push 0x14b350
lea eax, [ebp - 0x768]
mov edx, 3
call fcn.00014068
mov edx, dword [ebp - 0x768]
lea eax, [ebp - 0x764]
call fcn.000145ac
push dword [ebp - 0x764]
push dword [ebp - 0x44]
push 0x14ba90
push dword [ebp - 0x38]
push 0x14b350
push dword [ebp - 0xec]
push 0x14b350
push dword [ebp - 0x90]
lea eax, [ebp - 0x774]
mov edx, 4
call fcn.00014068
mov edx, dword [ebp - 0x774]
lea eax, [ebp - 0x770]
call fcn.000145ac
push dword [ebp - 0x770]
lea eax, [ebp - 0x98]
mov edx, 6
call fcn.00014700
jmp 0x145717
lea eax, [ebp - 0x778]
call fcn.0002a3b8
push dword [ebp - 0x778]
push 0x14ba9c
lea edx, [ebp - 0x784]
mov eax, dword [ebp - 0x40]
call fcn.0002964c
push dword [ebp - 0x784]
push 0x14babc
lea eax, [ebp - 0x780]
mov edx, 3
call fcn.00014068
mov edx, dword [ebp - 0x780]
lea eax, [ebp - 0x77c]
call fcn.000145ac
push dword [ebp - 0x77c]
push dword [ebp - 0x44]
push 0x14ba90
push dword [ebp - 0x38]
push 0x14bac4
lea eax, [ebp - 0x98]
mov edx, 6
call fcn.00014700
mov eax, dword [ebp - 0xec]
call fcn.00013fa8
test eax, eax
jle 0x14580d
mov eax, dword [ebp - 0x90]
mov edx, 0x14b36c
call fcn.000140b8
jne 0x14579d
lea edx, [ebp - 0x4d8]
mov eax, 0x55
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x788]
call fcn.00013f4c
mov edx, dword [ebp - 0x788]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov eax, dword [ebp - 0xec]
call fcn.0012edb0
test al, al
je 0x145794
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0xec]
call fcn.0012f2e4
jmp 0x145814
mov dword [ebp - 0x20], 2
jmp 0x145814
mov eax, dword [ebp - 0x90]
mov edx, 0x14bad0
call fcn.000140b8
jne 0x145814
lea edx, [ebp - 0x4d8]
mov eax, 0x56
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x78c]
call fcn.00013f4c
mov edx, dword [ebp - 0x78c]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov eax, dword [ebp - 0xec]
call fcn.0012f04c
test al, al
je 0x1457f9
mov dword [ebp - 0x20], 3
jmp 0x145800
mov dword [ebp - 0x20], 4
mov eax, dword [ebp - 0xec]
call fcn.0012f384
jmp 0x145814
mov dword [ebp - 0x20], 5
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x798]
call fcn.0003009c
mov ecx, dword [ebp - 0x798]
lea eax, [ebp - 0x794]
mov edx, 0x14b350
call fcn.00013ff4
mov edx, dword [ebp - 0x794]
lea eax, [ebp - 0x790]
call fcn.000145ac
mov edx, dword [ebp - 0x790]
lea eax, [ebp - 0x98]
call fcn.0001463c
mov eax, dword [ebp - 0x98]
call fcn.00014630
test eax, eax
jle 0x1482c0
mov edx, dword [ebp - 0x98]
mov eax, dword [0x251144]
call fcn.00117340
jmp 0x1482c0
lea eax, [ebp - 0x79c]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
mov eax, dword [ebp - 0x79c]
mov edx, 0x14badc
call fcn.000140b8
jne 0x145c2e
lea edx, [ebp - 0x4d8]
mov eax, 0x57
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x7a0]
call fcn.00013f4c
mov edx, dword [ebp - 0x7a0]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov dword [ebp - 0x20], 0x63
lea eax, [ebp - 0x90]
mov edx, dword [ebp - 0xc4]
call fcn.00013db0
lea eax, [ebp - 0x90]
mov ecx, 0xc
mov edx, 1
call fcn.000141f0
lea eax, [ebp - 0x98]
call fcn.000143f0
lea ecx, [ebp - 0x38]
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x40]
call fcn.000c11d8
lea eax, [ebp - 0x98]
call fcn.000143f0
lea ecx, [ebp - 0x44]
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x40]
call fcn.000c1a2c
lea eax, [ebp - 0x98]
call fcn.000143f0
push dword [ebp - 0x44]
push 0x14ba90
push dword [ebp - 0x38]
lea eax, [ebp - 0x7a4]
mov edx, 3
call fcn.00014700
mov eax, dword [ebp - 0x7a4]
lea edx, [ebp - 0xec]
call fcn.0001bf50
mov eax, dword [ebp - 0xec]
call fcn.00013fa8
test eax, eax
jle 0x145a49
lea eax, [ebp - 0x7a8]
call fcn.0002a320
push dword [ebp - 0x7a8]
push 0x14baf4
lea edx, [ebp - 0x7b4]
mov eax, dword [ebp - 0x40]
call fcn.0002964c
push dword [ebp - 0x7b4]
push 0x14b350
lea eax, [ebp - 0x7b0]
mov edx, 3
call fcn.00014068
mov edx, dword [ebp - 0x7b0]
lea eax, [ebp - 0x7ac]
call fcn.000145ac
push dword [ebp - 0x7ac]
push dword [ebp - 0x44]
push 0x14ba90
push dword [ebp - 0x38]
push 0x14b350
push dword [ebp - 0xec]
push 0x14b350
push dword [ebp - 0x90]
lea eax, [ebp - 0x7bc]
mov edx, 4
call fcn.00014068
mov edx, dword [ebp - 0x7bc]
lea eax, [ebp - 0x7b8]
call fcn.000145ac
push dword [ebp - 0x7b8]
lea eax, [ebp - 0x98]
mov edx, 6
call fcn.00014700
jmp 0x145abf
lea eax, [ebp - 0x7c0]
call fcn.0002a3b8
push dword [ebp - 0x7c0]
push 0x14baf4
lea edx, [ebp - 0x7cc]
mov eax, dword [ebp - 0x40]
call fcn.0002964c
push dword [ebp - 0x7cc]
push 0x14babc
lea eax, [ebp - 0x7c8]
mov edx, 3
call fcn.00014068
mov edx, dword [ebp - 0x7c8]
lea eax, [ebp - 0x7c4]
call fcn.000145ac
push dword [ebp - 0x7c4]
push dword [ebp - 0x44]
push 0x14ba90
push dword [ebp - 0x38]
push 0x14bac4
lea eax, [ebp - 0x98]
mov edx, 6
call fcn.00014700
mov eax, dword [ebp - 0xec]
call fcn.00013fa8
test eax, eax
jle 0x145bb5
mov eax, dword [ebp - 0x90]
mov edx, 0x14b36c
call fcn.000140b8
jne 0x145b45
lea edx, [ebp - 0x4d8]
mov eax, 0x58
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x7d0]
call fcn.00013f4c
mov edx, dword [ebp - 0x7d0]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov eax, dword [ebp - 0xec]
call fcn.0012f6a4
test al, al
je 0x145b3c
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0xec]
call fcn.0012fbd8
jmp 0x145bbc
mov dword [ebp - 0x20], 2
jmp 0x145bbc
mov eax, dword [ebp - 0x90]
mov edx, 0x14bad0
call fcn.000140b8
jne 0x145bbc
lea edx, [ebp - 0x4d8]
mov eax, 0x59
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x7d4]
call fcn.00013f4c
mov edx, dword [ebp - 0x7d4]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov eax, dword [ebp - 0xec]
call fcn.0012f940
test al, al
je 0x145ba1
mov dword [ebp - 0x20], 3
jmp 0x145ba8
mov dword [ebp - 0x20], 4
mov eax, dword [ebp - 0xec]
call fcn.0012fc78
jmp 0x145bbc
mov dword [ebp - 0x20], 5
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x7e0]
call fcn.0003009c
mov ecx, dword [ebp - 0x7e0]
lea eax, [ebp - 0x7dc]
mov edx, 0x14b350
call fcn.00013ff4
mov edx, dword [ebp - 0x7dc]
lea eax, [ebp - 0x7d8]
call fcn.000145ac
mov edx, dword [ebp - 0x7d8]
lea eax, [ebp - 0x98]
call fcn.0001463c
mov eax, dword [ebp - 0x98]
call fcn.00014630
test eax, eax
jle 0x1482c0
mov edx, dword [ebp - 0x98]
mov eax, dword [0x251144]
call fcn.00117340
jmp 0x1482c0
lea eax, [ebp - 0x7e4]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
mov eax, dword [ebp - 0x7e4]
mov edx, 0x14bb14
call fcn.000140b8
jne 0x145d8d
lea edx, [ebp - 0x4d8]
mov eax, 0x5a
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x7e8]
call fcn.00013f4c
mov edx, dword [ebp - 0x7e8]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0x90]
mov edx, dword [ebp - 0xc4]
call fcn.00013db0
lea eax, [ebp - 0x90]
mov ecx, 0xc
mov edx, 1
call fcn.000141f0
mov eax, dword [ebp - 0x90]
call fcn.00013fa8
dec eax
jne 0x145d4e
mov eax, dword [ebp - 0x90]
cmp byte [eax], 0x30
je 0x145d7e
mov eax, dword [ebp - 0x90]
cmp byte [eax], 0x31
jne 0x145d00
mov eax, dword [0x2515f4]
mov dword [eax], 1
mov edx, 0x14bb2c
mov eax, dword [0x251144]
call fcn.001171b0
jmp 0x145d7e
mov eax, dword [ebp - 0x90]
cmp byte [eax], 0x32
jne 0x145d27
mov eax, dword [0x2515f4]
mov dword [eax], 2
mov edx, 0x14bb58
mov eax, dword [0x251144]
call fcn.001170e8
jmp 0x145d7e
mov eax, dword [ebp - 0x90]
cmp byte [eax], 0x33
jne 0x145d7e
mov eax, dword [0x2515f4]
mov dword [eax], 3
mov edx, 0x14bb78
mov eax, dword [0x251144]
call fcn.001171b0
jmp 0x145d7e
push 0x14bba4
push dword [ebp - 0x90]
push 0x14b6fc
lea eax, [ebp - 0x7ec]
mov edx, 3
call fcn.00014068
mov edx, dword [ebp - 0x7ec]
mov eax, dword [0x251144]
call fcn.00117278
mov eax, dword [0x2515f4]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
jmp 0x1482c0
lea eax, [ebp - 0x7f0]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
mov eax, dword [ebp - 0x7f0]
mov edx, 0x14bbb4
call fcn.000140b8
jne 0x145f8b
lea edx, [ebp - 0x4d8]
mov eax, 0x5c
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x7f4]
call fcn.00013f4c
mov edx, dword [ebp - 0x7f4]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0x90]
mov edx, dword [ebp - 0xc4]
call fcn.00013db0
lea eax, [ebp - 0x90]
mov ecx, 0xc
mov edx, 1
call fcn.000141f0
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x90]
call fcn.00019210
mov eax, dword [ebp - 0x88]
call fcn.00014630
test eax, eax
jle 0x145f43
mov eax, dword [ebp - 0x88]
call fcn.00014630
cmp eax, 0xf0
jg 0x145f43
mov dx, 0x162
mov eax, dword [0x520280]
call fcn.00046e6c
test al, al
jne 0x145f28
xor eax, eax
push ebp
push 0x145ed7
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x4d8]
mov eax, 0x5d
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x7f8]
call fcn.00013f4c
mov edx, dword [ebp - 0x7f8]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x88]
mov dl, 1
mov eax, dword [0x12b304]
call fcn.0014fdb4
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x20], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1482c0
mov edx, 0x14bbe0
mov eax, dword [0x251144]
call fcn.001171b0
mov dword [ebp - 0x20], 4
jmp 0x1482c0
mov eax, dword [ebp - 0x88]
call fcn.00014630
lea edx, [ebp - 0x804]
call fcn.0003006c
mov ecx, dword [ebp - 0x804]
lea eax, [ebp - 0x800]
mov edx, 0x14bc28
call fcn.00013ff4
mov edx, dword [ebp - 0x800]
mov eax, dword [0x251144]
call fcn.00117278
mov dword [ebp - 0x20], 5
jmp 0x1482c0
lea eax, [ebp - 0x808]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
mov eax, dword [ebp - 0x808]
mov edx, 0x14bc58
call fcn.000140b8
jne 0x1460f8
lea edx, [ebp - 0x4d8]
mov eax, 0x5e
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x80c]
call fcn.00013f4c
mov edx, dword [ebp - 0x80c]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0xc4]
mov ecx, 0xc
mov edx, 1
call fcn.000141f0
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc4]
call fcn.00013fa8
dec eax
jne 0x1460cd
mov eax, dword [ebp - 0xc4]
cmp byte [eax], 0x34
jne 0x146055
call sub.kernel32.dll_GetTickCount
mov dword [0x251178], eax
mov dword [0x251184], 1
mov edx, 0x14bc70
mov eax, dword [0x251144]
call fcn.001171b0
mov dword [ebp - 0x20], 4
jmp 0x1482c0
mov eax, dword [ebp - 0xc4]
cmp byte [eax], 0x35
jne 0x14608f
call sub.kernel32.dll_GetTickCount
mov dword [0x2511c8], eax
mov dword [0x2511ac], 1
mov edx, 0x14bc98
mov eax, dword [0x251144]
call fcn.001171b0
mov dword [ebp - 0x20], 5
jmp 0x1482c0
lea eax, [ebp - 0x814]
mov edx, dword [ebp - 0xc4]
mov dl, byte [edx]
call fcn.00013ec0
mov ecx, dword [ebp - 0x814]
lea eax, [ebp - 0x810]
mov edx, 0x14bcbc
call fcn.00013ff4
mov edx, dword [ebp - 0x810]
mov eax, dword [0x251144]
call fcn.001170e8
jmp 0x1482c0
lea eax, [ebp - 0x818]
mov ecx, dword [ebp - 0xc4]
mov edx, 0x14bcd0
call fcn.00013ff4
mov edx, dword [ebp - 0x818]
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x1482c0
lea edx, [ebp - 0x4d8]
mov eax, 0x5f
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x81c]
call fcn.00013f4c
mov edx, dword [ebp - 0x81c]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0xec]
call fcn.00013d18
mov eax, dword [0x25191c]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc4]
call fcn.00014294
dec eax
jne 0x1462d2
lea edx, [ebp - 0x4d8]
mov eax, 0x60
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x820]
call fcn.00013f4c
mov edx, dword [ebp - 0x820]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov eax, dword [0x25191c]
mov eax, dword [eax]
call fcn.00013fa8
mov ecx, eax
lea eax, [ebp - 0xc4]
mov edx, 1
call fcn.000141f0
lea eax, [ebp - 0xec]
mov edx, dword [ebp - 0xc4]
call fcn.00013db0
lea ecx, [ebp - 0x44]
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xec]
call fcn.0001c0d8
push 0x14bce8
push dword [ebp - 0xec]
push 0x14bd00
lea eax, [ebp - 0x824]
mov edx, 3
call fcn.00014068
mov edx, dword [ebp - 0x824]
lea eax, [ebp - 0x10c]
call fcn.000145ac
push dword [ebp - 0x10c]
push dword [ebp - 0x44]
push 0x14ba90
push dword [ebp - 0x38]
lea eax, [ebp - 0x10c]
mov edx, 4
call fcn.00014700
lea edx, [ebp - 0x828]
mov eax, dword [ebp - 0xec]
call fcn.0002fd54
mov eax, dword [ebp - 0x828]
push eax
lea eax, [ebp - 0x830]
call fcn.0004b9a4
mov eax, dword [ebp - 0x830]
lea edx, [ebp - 0x82c]
call fcn.0002fd54
mov edx, dword [ebp - 0x82c]
pop eax
call fcn.000140b8
sete byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x146563
push 0x14bd0c
push dword [ebp - 0xec]
push 0x14bd3c
lea eax, [ebp - 0x83c]
mov edx, 3
call fcn.00014068
mov edx, dword [ebp - 0x83c]
lea eax, [ebp - 0x838]
call fcn.000145ac
push dword [ebp - 0x838]
lea eax, [ebp - 0x840]
call fcn.0004bde4
push dword [ebp - 0x840]
push 0x14b564
lea eax, [ebp - 0x834]
mov edx, 3
call fcn.00014700
mov edx, dword [ebp - 0x834]
mov eax, dword [0x251144]
call fcn.00117340
jmp 0x146563
lea edx, [ebp - 0x4d8]
mov eax, 0x61
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x844]
call fcn.00013f4c
mov edx, dword [ebp - 0x844]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov edx, 0x14bd6c
mov eax, dword [0x251144]
call fcn.00117408
lea eax, [ebp - 0x848]
mov ecx, dword [ebp - 0xc4]
mov edx, 0x14bce8
call fcn.00013ff4
mov edx, dword [ebp - 0x848]
lea eax, [ebp - 0x10c]
call fcn.000145ac
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 0xc4]
call fcn.000145ac
mov edx, dword [ebp - 0xc4]
mov eax, 0x14b3f8
call fcn.00014294
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jne 0x14637a
lea eax, [ebp - 0x90]
mov edx, dword [ebp - 0xc4]
call fcn.00013db0
jmp 0x146398
lea eax, [ebp - 0x90]
push eax
mov edx, dword [ebp - 0xbc]
inc edx
mov ecx, 0xc8
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
lea eax, [ebp - 0x850]
mov edx, dword [ebp - 0x90]
call fcn.000145ac
mov eax, dword [ebp - 0x850]
lea edx, [ebp - 0x84c]
call fcn.0001c9b0
mov eax, dword [ebp - 0x84c]
push eax
lea eax, [ebp - 0x858]
call fcn.0004bde4
mov eax, dword [ebp - 0x858]
lea edx, [ebp - 0x854]
call fcn.0001c9b0
mov edx, dword [ebp - 0x854]
pop eax
call fcn.00014748
sete byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x146460
push 0x14bd0c
push dword [ebp - 0xc4]
push 0x14bd3c
lea eax, [ebp - 0x864]
mov edx, 3
call fcn.00014068
mov edx, dword [ebp - 0x864]
lea eax, [ebp - 0x860]
call fcn.000145ac
push dword [ebp - 0x860]
lea eax, [ebp - 0x868]
call fcn.0004bde4
push dword [ebp - 0x868]
push 0x14b564
lea eax, [ebp - 0x85c]
mov edx, 3
call fcn.00014700
mov edx, dword [ebp - 0x85c]
mov eax, dword [0x251144]
call fcn.00117340
mov dword [ebp - 0x8c], 0x400
mov dword [ebp - 0x5c], 0x400
lea eax, [ebp - 0x10]
mov edx, 0x400
call fcn.000271f0
lea eax, [ebp - 0xa4]
mov edx, 0x400
call fcn.000271f0
lea eax, [ebp - 0xec]
call fcn.00013d18
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0xa4]
push eax
lea eax, [ebp - 0x8c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc4]
call fcn.0001416c
push eax
push 0
call sub.advapi32.dll_LookupAccountNameA
test eax, eax
je 0x146546
xor eax, eax
mov dword [ebp - 0xf0], eax
lea eax, [ebp - 0xf0]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ConvertSidToStringSidA_2
test al, al
je 0x146531
xor eax, eax
push ebp
push 0x14651c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xf0]
call fcn.00030b34
mov ecx, eax
lea eax, [ebp - 0xec]
mov edx, dword [ebp - 0xf0]
call fcn.00013e00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x146531
cmp dword [ebp - 0xf0], 0
je 0x146546
mov eax, dword [ebp - 0xf0]
push eax
call sub.kernel32.dll_LocalFree_1
lea eax, [ebp - 0xa4]
mov edx, 0x400
call fcn.00027218
lea eax, [ebp - 0x10]
mov edx, 0x400
call fcn.00027218
mov eax, dword [ebp - 0xec]
call fcn.00013fa8
test eax, eax
jle 0x148208
mov eax, dword [ebp - 0xec]
call fcn.00013fa8
test eax, eax
jle 0x1481c4
lea edx, [ebp - 0x4d8]
mov eax, 0x62
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x86c]
call fcn.00013f4c
mov edx, dword [ebp - 0x86c]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov eax, dword [ebp - 4]
mov byte [eax + 0x113], 0
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x112]
mov edx, dword [ebp - 4]
mov byte [edx + 0x111], al
mov eax, dword [ebp - 4]
mov byte [eax + 0x110], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x10c], 0
call fcn.0004d1c4
mov edx, dword [ebp - 4]
mov byte [edx + 0x112], al
call fcn.0004d4d4
mov edx, dword [ebp - 4]
mov byte [edx + 0x10e], al
mov eax, dword [ebp - 4]
mov byte [eax + 0x10f], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x10d], 0
xor eax, eax
mov dword [ebp - 0x17c], eax
xor eax, eax
mov dword [ebp - 0x158], eax
cmp byte [ebp - 9], 0
jne 0x1469fd
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512bf]
je 0x1469fd
lea edx, [ebp - 0x4d8]
mov eax, 0x63
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x870]
call fcn.00013f4c
mov edx, dword [ebp - 0x870]
lea eax, [ebp - 0x184]
call fcn.00013fb0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x251144]
push eax
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x874]
push eax
push dword [ebp - 0x44]
push 0x14ba90
push dword [ebp - 0x38]
lea eax, [ebp - 0x878]
mov edx, 3
call fcn.00014700
mov edx, dword [ebp - 0x878]
mov ecx, dword [ebp - 0x40]
mov eax, 0x14bad0
call fcn.000f1bec
mov eax, dword [0x2516ec]
cmp dword [eax], 0
je 0x1469fd
lea edx, [ebp - 0x4d8]
mov eax, 0x64
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x87c]
call fcn.00013f4c
mov edx, dword [ebp - 0x87c]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov eax, dword [0x2516ec]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jle 0x1469fd
mov ebx, dword [ebp - 0x158]
dec ebx
test ebx, ebx
jl 0x146797
inc ebx
mov dword [ebp - 0xbc], 0
lea ecx, [ebp - 0x88]
mov eax, dword [0x2516ec]
mov eax, dword [eax]
mov edx, dword [ebp - 0xbc]
mov esi, dword [eax]
call dword [esi + 0xc]
lea ecx, [ebp - 0x2c]
mov eax, dword [0x2517b0]
mov eax, dword [eax]
mov edx, dword [ebp - 0xbc]
mov esi, dword [eax]
call dword [esi + 0xc]
lea eax, [ebp - 0x880]
call fcn.00026328
mov edx, dword [ebp - 0x880]
mov eax, dword [ebp - 0x88]
call fcn.0002e8ac
test al, al
je 0x14678e
mov eax, dword [ebp - 4]
mov byte [eax + 0x111], 0
inc dword [ebp - 0xbc]
dec ebx
jne 0x146737
lea edx, [ebp - 0x4d8]
mov eax, 0x65
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x884]
call fcn.00013f4c
mov edx, dword [ebp - 0x884]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov ebx, dword [ebp - 0x158]
dec ebx
test ebx, ebx
jl 0x14687c
inc ebx
mov dword [ebp - 0xbc], 0
lea ecx, [ebp - 0x88]
mov eax, dword [0x2516ec]
mov eax, dword [eax]
mov edx, dword [ebp - 0xbc]
mov esi, dword [eax]
call dword [esi + 0xc]
lea eax, [ebp - 0x888]
call fcn.000262dc
mov edx, dword [ebp - 0x888]
mov eax, dword [ebp - 0x88]
call fcn.0002e8ac
test al, al
je 0x146825
mov eax, dword [ebp - 4]
mov byte [eax + 0x111], 1
lea eax, [ebp - 0x88c]
call fcn.00026374
mov edx, dword [ebp - 0x88c]
mov eax, dword [ebp - 0x88]
call fcn.0002e8ac
test al, al
je 0x14686f
mov edx, 0x14bd88
mov eax, dword [ebp - 0x88]
call fcn.0002e8ac
test al, al
je 0x146865
mov eax, dword [ebp - 4]
mov byte [eax + 0x10c], 1
jmp 0x14686f
mov eax, dword [ebp - 4]
mov byte [eax + 0x110], 1
inc dword [ebp - 0xbc]
dec ebx
jne 0x1467e3
lea edx, [ebp - 0x4d8]
mov eax, 0x66
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x890]
call fcn.00013f4c
mov edx, dword [ebp - 0x890]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov ebx, dword [ebp - 0x158]
dec ebx
test ebx, ebx
jl 0x1469fd
inc ebx
mov dword [ebp - 0xbc], 0
lea ecx, [ebp - 0x894]
mov eax, dword [0x251950]
mov eax, dword [eax]
mov edx, dword [ebp - 0xbc]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x894]
lea edx, [ebp - 0x88]
call fcn.0001bc38
lea ecx, [ebp - 0x2c]
mov eax, dword [0x2517b0]
mov eax, dword [eax]
mov edx, dword [ebp - 0xbc]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, 0x14bda0
mov eax, dword [ebp - 0x88]
call fcn.0002e8ac
test al, al
je 0x1469f0
lea edx, [ebp - 0x898]
mov eax, dword [ebp - 0x2c]
call fcn.0001c9b0
mov eax, dword [ebp - 0x898]
push eax
lea edx, [ebp - 0x89c]
mov eax, 0x14bdb8
call fcn.0001c9b0
mov edx, dword [ebp - 0x89c]
pop eax
call fcn.00014748
je 0x146971
lea edx, [ebp - 0x8a0]
mov eax, dword [ebp - 0x2c]
call fcn.0001c9b0
mov eax, dword [ebp - 0x8a0]
mov edx, 0x14bdc4
call fcn.00014748
jne 0x1469f0
mov eax, dword [ebp - 4]
mov byte [eax + 0x10f], 1
push dword [ebp - 0x44]
push 0x14ba90
push dword [ebp - 0x38]
push 0x14b350
lea edx, [ebp - 0x8b0]
mov eax, dword [ebp - 0x40]
call fcn.0002964c
push dword [ebp - 0x8b0]
push 0x14bdd0
push 0x14bda0
lea eax, [ebp - 0x8ac]
mov edx, 4
call fcn.00014068
mov edx, dword [ebp - 0x8ac]
lea eax, [ebp - 0x8a8]
call fcn.000145ac
push dword [ebp - 0x8a8]
lea eax, [ebp - 0x8a4]
mov edx, 4
call fcn.00014700
mov edx, dword [ebp - 0x8a4]
mov eax, dword [0x251144]
call fcn.00117408
inc dword [ebp - 0xbc]
dec ebx
jne 0x1468c8
lea edx, [ebp - 0x4d8]
mov eax, 0x67
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x8b4]
call fcn.00013f4c
mov edx, dword [ebp - 0x8b4]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0x7c]
mov edx, 0x400
call fcn.000271f0
push dword [ebp - 0xec]
push 0x14b3f8
push 0x14bde8
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00014068
xor eax, eax
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
mov eax, dword [ebp - 0x24]
call fcn.0001416c
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
mov esi, eax
test esi, esi
jne 0x146aa1
push 0x14be24
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegDeleteValueA
cmp dword [ebp - 0xb8], 0
je 0x146ab6
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xb8], eax
push dword [ebp - 0xec]
push 0x14b3f8
push 0x14be3c
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00014068
xor eax, eax
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
mov eax, dword [ebp - 0x24]
call fcn.0001416c
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
mov esi, eax
test esi, esi
jne 0x146b23
push 0x14be78
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegDeleteValueA
cmp dword [ebp - 0xb8], 0
je 0x146b38
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xb8], eax
xor eax, eax
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
lea eax, [ebp - 0x8b8]
mov ecx, 0x14be90
mov edx, dword [ebp - 0x24]
call fcn.00013ff4
mov eax, dword [ebp - 0x8b8]
call fcn.0001416c
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
mov esi, eax
xor eax, eax
mov dword [ebp - 0xbc], eax
test esi, esi
jne 0x146bbc
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xbc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test esi, esi
jne 0x146c37
cmp dword [ebp - 0xbc], 0
jle 0x146c37
dec dword [ebp - 0xbc]
mov edx, 0x400
mov eax, dword [ebp - 0x7c]
call fcn.00018100
mov dword [ebp - 0x8c], 0x3ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x8c]
push eax
mov eax, dword [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0xbc]
push eax
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegEnumValueW_1
mov esi, eax
test esi, esi
jne 0x146c2e
mov eax, dword [ebp - 0x7c]
call fcn.0001b94c
test eax, eax
jle 0x146c2e
mov eax, dword [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegDeleteValueW
cmp dword [ebp - 0xbc], 0
jg 0x146bc9
cmp dword [ebp - 0xb8], 0
je 0x146c4c
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xb8], eax
xor eax, eax
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
lea eax, [ebp - 0x8bc]
mov ecx, 0x14bea8
mov edx, dword [ebp - 0x24]
call fcn.00013ff4
mov eax, dword [ebp - 0x8bc]
call fcn.0001416c
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
mov esi, eax
xor eax, eax
mov dword [ebp - 0xbc], eax
test esi, esi
jne 0x146cd0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xbc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test esi, esi
jne 0x146d4b
cmp dword [ebp - 0xbc], 0
jle 0x146d4b
dec dword [ebp - 0xbc]
mov edx, 0x400
mov eax, dword [ebp - 0x7c]
call fcn.00018100
mov dword [ebp - 0x8c], 0x3ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x8c]
push eax
mov eax, dword [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0xbc]
push eax
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegEnumValueW_1
mov esi, eax
test esi, esi
jne 0x146d42
mov eax, dword [ebp - 0x7c]
call fcn.0001b94c
test eax, eax
jle 0x146d42
mov eax, dword [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegDeleteValueW
cmp dword [ebp - 0xbc], 0
jg 0x146cdd
cmp dword [ebp - 0xb8], 0
je 0x146d60
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
mov eax, dword [ebp - 0x24]
call fcn.0001416c
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
mov esi, eax
test esi, esi
jne 0x146e3b
push 0x14beb8
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegDeleteKeyA
mov esi, eax
test esi, esi
je 0x146dea
cmp esi, 2
je 0x146dea
lea edx, [ebp - 0x8c4]
mov eax, esi
call fcn.00027478
mov ecx, dword [ebp - 0x8c4]
lea eax, [ebp - 0x8c0]
mov edx, 0x14becc
call fcn.00013ff4
mov edx, dword [ebp - 0x8c0]
mov eax, dword [0x251144]
call fcn.00117278
push 0x14bee4
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegDeleteKeyA
mov esi, eax
test esi, esi
je 0x146e6e
cmp esi, 2
je 0x146e6e
lea edx, [ebp - 0x8cc]
mov eax, esi
call fcn.00027478
mov ecx, dword [ebp - 0x8cc]
lea eax, [ebp - 0x8c8]
mov edx, 0x14bef8
call fcn.00013ff4
mov edx, dword [ebp - 0x8c8]
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x146e6e
lea edx, [ebp - 0x8d4]
mov eax, esi
call fcn.00027478
mov ecx, dword [ebp - 0x8d4]
lea eax, [ebp - 0x8d0]
mov edx, 0x14bf18
call fcn.00013ff4
mov edx, dword [ebp - 0x8d0]
mov eax, dword [0x251144]
call fcn.001170e8
cmp dword [ebp - 0xb8], 0
je 0x146e83
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xb8], eax
lea edx, [ebp - 0x4d8]
mov eax, 0x68
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x8d8]
call fcn.00013f4c
mov edx, dword [ebp - 0x8d8]
lea eax, [ebp - 0x184]
call fcn.00013fb0
push 0x14bd00
lea edx, [ebp - 0x8e4]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x10e]
call fcn.0003006c
push dword [ebp - 0x8e4]
push 0x14b41c
lea edx, [ebp - 0x4d8]
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x112]
call fcn.000294b8
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0x8e8]
call fcn.00013f4c
push dword [ebp - 0x8e8]
push 0x14b41c
lea edx, [ebp - 0x9ec]
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x111]
call fcn.000294b8
lea edx, [ebp - 0x9ec]
lea eax, [ebp - 0x8ec]
call fcn.00013f4c
push dword [ebp - 0x8ec]
push 0x14b41c
lea edx, [ebp - 0x9f0]
mov eax, dword [ebp - 0x158]
call fcn.0003006c
push dword [ebp - 0x9f0]
push 0x14b41c
lea edx, [ebp - 0xaf4]
mov al, byte [ebp - 9]
call fcn.000294b8
lea edx, [ebp - 0xaf4]
lea eax, [ebp - 0x9f4]
call fcn.00013f4c
push dword [ebp - 0x9f4]
push 0x14b41c
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512bf]
sete al
lea edx, [ebp - 0xbf8]
call fcn.000294b8
lea edx, [ebp - 0xbf8]
lea eax, [ebp - 0xaf8]
call fcn.00013f4c
push dword [ebp - 0xaf8]
lea eax, [ebp - 0x8e0]
mov edx, 0xc
call fcn.00014068
mov edx, dword [ebp - 0x8e0]
lea eax, [ebp - 0x8dc]
call fcn.000145ac
mov edx, dword [ebp - 0x8dc]
lea eax, [ebp - 0x10c]
call fcn.0001463c
mov eax, dword [ebp - 0x17c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc04]
call fcn.0003009c
mov ecx, dword [ebp - 0xc04]
lea eax, [ebp - 0xc00]
mov edx, 0x14bf34
call fcn.00013ff4
mov edx, dword [ebp - 0xc00]
lea eax, [ebp - 0xbfc]
call fcn.000145ac
mov edx, dword [ebp - 0xbfc]
lea eax, [ebp - 0x10c]
call fcn.0001463c
cmp dword [ebp - 0x17c], 0
je 0x1470cc
lea edx, [ebp - 0x4d8]
mov eax, 0x69
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xc08]
call fcn.00013f4c
mov edx, dword [ebp - 0xc08]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea edx, [ebp - 0xc10]
mov eax, dword [ebp - 0x17c]
call fcn.00027478
mov ecx, dword [ebp - 0xc10]
lea eax, [ebp - 0xc0c]
mov edx, 0x14bf44
call fcn.00013ff4
mov edx, dword [ebp - 0xc0c]
mov eax, dword [0x251144]
call fcn.00117278
call fcn.0004d338
test al, al
je 0x1470c0
mov dword [ebp - 0x20], 0x20001019
jmp 0x1481b2
mov dword [ebp - 0x20], 0x20001015
jmp 0x1481b2
lea edx, [ebp - 0x4d8]
mov eax, 0x6a
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xc14]
call fcn.00013f4c
mov edx, dword [ebp - 0xc14]
lea eax, [ebp - 0x184]
call fcn.00013fb0
xor eax, eax
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xb8]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x24]
call fcn.0001416c
push eax
push 0x80000003
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x14718b
cmp dword [ebp - 0xb8], 0
je 0x147157
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
mov eax, dword [ebp - 0x24]
call fcn.0001416c
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x1473ef
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10e], 0
je 0x1471d3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x111], 0
je 0x1471d3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10e], 1
jne 0x1471c2
cmp dword [ebp - 0x158], 0
jle 0x1471d3
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512bf]
je 0x1471d3
cmp byte [ebp - 9], 0
je 0x1471dd
xor eax, eax
mov dword [ebp - 0x8c], eax
jmp 0x1471e7
mov dword [ebp - 0x8c], 1
push 4
lea eax, [ebp - 0x8c]
push eax
push 4
push 0
push 0x14beb8
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x14725d
mov eax, dword [ebp - 0x8c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc20]
call fcn.0003009c
mov ecx, dword [ebp - 0xc20]
lea eax, [ebp - 0xc1c]
mov edx, 0x14bf68
call fcn.00013ff4
mov edx, dword [ebp - 0xc1c]
lea eax, [ebp - 0xc18]
call fcn.000145ac
mov edx, dword [ebp - 0xc18]
lea eax, [ebp - 0x10c]
call fcn.0001463c
jmp 0x1472b6
push 0x14bf84
mov eax, dword [ebp - 0x8c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc28]
call fcn.0003009c
push dword [ebp - 0xc28]
push 0x14b350
lea edx, [ebp - 0xc2c]
mov eax, dword [ebp - 0x5c]
call fcn.00027478
push dword [ebp - 0xc2c]
lea eax, [ebp - 0xc24]
mov edx, 4
call fcn.00014068
mov edx, dword [ebp - 0xc24]
mov eax, dword [0x251144]
call fcn.00117278
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10e], 0
je 0x14730c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
jne 0x1472da
mov eax, dword [ebp - 4]
cmp byte [eax + 0x110], 0
je 0x14730c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10e], 1
jne 0x1472ef
cmp dword [ebp - 0x158], 0
jle 0x14730c
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512bf]
je 0x14730c
cmp byte [ebp - 9], 0
jne 0x14730c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10f], 0
je 0x147316
xor eax, eax
mov dword [ebp - 0x8c], eax
jmp 0x147320
mov dword [ebp - 0x8c], 1
push 4
lea eax, [ebp - 0x8c]
push eax
push 4
push 0
push 0x14bee4
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x147396
mov eax, dword [ebp - 0x8c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc38]
call fcn.0003009c
mov ecx, dword [ebp - 0xc38]
lea eax, [ebp - 0xc34]
mov edx, 0x14bf9c
call fcn.00013ff4
mov edx, dword [ebp - 0xc34]
lea eax, [ebp - 0xc30]
call fcn.000145ac
mov edx, dword [ebp - 0xc30]
lea eax, [ebp - 0x10c]
call fcn.0001463c
jmp 0x1473ef
push 0x14bfb8
mov eax, dword [ebp - 0x8c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc40]
call fcn.0003009c
push dword [ebp - 0xc40]
push 0x14b350
lea edx, [ebp - 0xc44]
mov eax, dword [ebp - 0x5c]
call fcn.00027478
push dword [ebp - 0xc44]
lea eax, [ebp - 0xc3c]
mov edx, 4
call fcn.00014068
mov edx, dword [ebp - 0xc3c]
mov eax, dword [0x251144]
call fcn.00117278
cmp dword [ebp - 0x5c], 0
je 0x1474b7
cmp dword [ebp - 0x5c], 0x8ad
jne 0x147460
push 0x14bfd0
lea eax, [ebp - 0xc4c]
mov edx, dword [ebp - 0x38]
call fcn.00013f70
push dword [ebp - 0xc4c]
push 0x14bfe0
lea eax, [ebp - 0xc48]
mov edx, 3
call fcn.00014068
mov edx, dword [ebp - 0xc48]
mov eax, dword [0x251144]
call fcn.001171b0
lea edx, [ebp - 0xc50]
mov eax, dword [ebp - 0x5c]
call fcn.00027478
mov edx, dword [ebp - 0xc50]
mov eax, dword [0x251144]
call fcn.001171b0
jmp 0x1474ae
push 0x14bfd0
push dword [ebp - 0xc4]
push 0x14c010
lea eax, [ebp - 0xc54]
mov edx, 3
call fcn.00014068
mov edx, dword [ebp - 0xc54]
mov eax, dword [0x251144]
call fcn.00117278
lea edx, [ebp - 0xc58]
mov eax, dword [ebp - 0x5c]
call fcn.00027478
mov edx, dword [ebp - 0xc58]
mov eax, dword [0x251144]
call fcn.00117278
mov dword [ebp - 0x20], 0x20001019
jmp 0x1474bc
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0xb8], 0
je 0x1474d1
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xb8], eax
lea edx, [ebp - 0x4d8]
mov eax, 0x6b
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xc5c]
call fcn.00013f4c
mov edx, dword [ebp - 0xc5c]
lea eax, [ebp - 0x184]
call fcn.00013fb0
cmp dword [ebp - 0x20], 0
jne 0x147805
lea edx, [ebp - 0x4d8]
mov eax, 0x6c
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xc60]
call fcn.00013f4c
mov edx, dword [ebp - 0xc60]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10e], 0
je 0x147805
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10c], 0
jne 0x147573
mov eax, dword [ebp - 4]
cmp byte [eax + 0x110], 0
je 0x147805
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10e], 1
jne 0x14758c
cmp dword [ebp - 0x158], 0
jle 0x147805
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512bf]
je 0x147805
cmp byte [ebp - 9], 0
jne 0x147805
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10f], 0
jne 0x147805
xor eax, eax
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xb8]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
lea eax, [ebp - 0xc64]
mov ecx, 0x14bea8
mov edx, dword [ebp - 0x24]
call fcn.00013ff4
mov eax, dword [ebp - 0xc64]
call fcn.0001416c
push eax
push 0x80000003
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jne 0x1477b1
mov eax, dword [0x25118c]
mov edx, dword [eax]
call dword [edx + 0x44]
mov esi, 1
mov eax, dword [0x251950]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x1477e8
inc ebx
mov dword [ebp - 0xbc], 0
lea eax, [ebp - 0x88]
call fcn.000143f0
lea ecx, [ebp - 0xc68]
mov eax, dword [0x251950]
mov eax, dword [eax]
mov edx, dword [ebp - 0xbc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xc68]
lea edx, [ebp - 0x2c]
call fcn.0001bc38
lea edx, [ebp - 0xd4]
mov eax, dword [ebp - 0x2c]
call fcn.0001bb90
lea edx, [ebp - 0xc6c]
mov eax, dword [ebp - 0xd4]
call fcn.0001ca18
mov eax, dword [ebp - 0xc6c]
mov edx, 0x14c038
call fcn.00014748
jne 0x1476bc
lea eax, [ebp - 0x88]
mov edx, dword [ebp - 0x2c]
call fcn.0001442c
jmp 0x1476f6
mov edx, 0x14bda0
mov eax, dword [ebp - 0x2c]
call fcn.0002e8ac
test al, al
je 0x1476f6
lea ecx, [ebp - 0xc70]
mov eax, dword [0x2517b0]
mov eax, dword [eax]
mov edx, dword [ebp - 0xbc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xc70]
lea edx, [ebp - 0x88]
call fcn.0001bc38
mov eax, dword [ebp - 0x88]
call fcn.00014630
dec eax
jle 0x1477a2
mov edx, dword [ebp - 0x88]
mov eax, dword [0x25118c]
mov ecx, dword [eax]
call dword [ecx + 0x54]
test eax, eax
jge 0x1477a2
mov edx, dword [ebp - 0x88]
mov eax, dword [0x25118c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0xc74]
mov eax, esi
call fcn.0003006c
mov edx, dword [ebp - 0xc74]
lea eax, [ebp - 0xd4]
call fcn.000145ac
inc esi
mov eax, dword [ebp - 0x88]
call fcn.00014630
inc eax
add eax, eax
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x88]
mov edx, 0x14c048
call fcn.0001463c
mov eax, dword [ebp - 0x8c]
push eax
mov eax, dword [ebp - 0x88]
call fcn.00014620
push eax
push 1
push 0
mov eax, dword [ebp - 0xd4]
call fcn.00014620
push eax
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegSetValueExW
inc dword [ebp - 0xbc]
dec ebx
jne 0x14764a
jmp 0x1477e8
mov edx, 0x14c054
mov eax, dword [0x251144]
call fcn.00117278
lea edx, [ebp - 0xc78]
mov eax, dword [ebp - 0x180]
call fcn.00027478
mov edx, dword [ebp - 0xc78]
mov eax, dword [0x251144]
call fcn.00117278
mov dword [ebp - 0x20], 0x20001019
cmp dword [ebp - 0xb8], 0
je 0x1477fd
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xb8], eax
lea edx, [ebp - 0x4d8]
mov eax, 0x6d
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xc7c]
call fcn.00013f4c
mov edx, dword [ebp - 0xc7c]
lea eax, [ebp - 0x184]
call fcn.00013fb0
cmp dword [ebp - 0x20], 0
jne 0x1481b2
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10e], 0
je 0x14787f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x111], 0
je 0x14787f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10e], 1
jne 0x14786e
cmp dword [ebp - 0x158], 0
jle 0x14787f
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512bf]
je 0x14787f
cmp byte [ebp - 9], 0
je 0x1478c9
lea edx, [ebp - 0x4d8]
mov eax, 0x6e
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xc80]
call fcn.00013f4c
mov edx, dword [ebp - 0xc80]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov dword [ebp - 0x20], 0x20001015
mov byte [ebp - 0x7d], 1
call fcn.00050d5c
mov byte [ebp - 0x7e], al
jmp 0x147dca
lea edx, [ebp - 0x4d8]
mov eax, 0x6f
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xc84]
call fcn.00013f4c
mov edx, dword [ebp - 0xc84]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov byte [ebp - 0x7d], 0
mov byte [ebp - 0x7e], 1
push dword [ebp - 0xec]
push 0x14b3f8
push 0x14be3c
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00014068
xor eax, eax
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xb8]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
lea eax, [ebp - 0xc88]
mov ecx, 0x14be90
mov edx, dword [ebp - 0x24]
call fcn.00013ff4
mov eax, dword [ebp - 0xc88]
call fcn.0001416c
push eax
push 0x80000003
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jne 0x147d76
mov eax, dword [0x25118c]
mov edx, dword [eax]
call dword [edx + 0x44]
mov esi, 1
mov eax, dword [0x251950]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
test ebx, ebx
jl 0x147d6d
inc ebx
mov dword [ebp - 0xbc], 0
mov eax, dword [0x251950]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [ebp - 0xbc]
jle 0x147c98
lea ecx, [ebp - 0xc8c]
mov eax, dword [0x251950]
mov eax, dword [eax]
mov edx, dword [ebp - 0xbc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xc8c]
lea edx, [ebp - 0x88]
call fcn.0001bc38
lea ecx, [ebp - 0xc90]
mov eax, dword [0x2516ec]
mov eax, dword [eax]
mov edx, dword [ebp - 0xbc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xc90]
lea edx, [ebp - 0x2c]
call fcn.0001bc38
lea eax, [ebp - 0xc98]
mov edx, dword [ebp - 0x88]
call fcn.00013f70
mov eax, dword [ebp - 0xc98]
lea edx, [ebp - 0xc94]
call fcn.0002fd54
mov eax, dword [ebp - 0xc94]
mov edx, 0x14c06c
call fcn.000140b8
jne 0x147a53
mov byte [ebp - 0x7d], 1
lea eax, [ebp - 0xc9c]
call fcn.000262dc
mov edx, dword [ebp - 0xc9c]
mov eax, dword [ebp - 0x2c]
call fcn.0002e8ac
test al, al
jne 0x147c73
lea eax, [ebp - 0xca0]
call fcn.00026374
mov edx, dword [ebp - 0xca0]
mov eax, dword [ebp - 0x2c]
call fcn.0002e8ac
test al, al
jne 0x147c73
lea eax, [ebp - 0xca4]
call fcn.00026328
mov edx, dword [ebp - 0xca4]
mov eax, dword [ebp - 0x2c]
call fcn.0002e8ac
test al, al
jne 0x147c73
lea eax, [ebp - 0xca8]
call fcn.000263c0
mov edx, dword [ebp - 0xca8]
mov eax, dword [ebp - 0x2c]
call fcn.0002e8ac
test al, al
jne 0x147c73
lea eax, [ebp - 0xcac]
call fcn.0002640c
mov edx, dword [ebp - 0xcac]
mov eax, dword [ebp - 0x2c]
call fcn.0002e8ac
test al, al
jne 0x147c73
lea eax, [ebp - 0xcb0]
call fcn.00026458
mov edx, dword [ebp - 0xcb0]
mov eax, dword [ebp - 0x2c]
call fcn.0002e8ac
test al, al
jne 0x147c73
lea eax, [ebp - 0xcb4]
call fcn.000264a4
mov edx, dword [ebp - 0xcb4]
mov eax, dword [ebp - 0x2c]
call fcn.0002e8ac
test al, al
jne 0x147c73
lea eax, [ebp - 0xcb8]
call fcn.000265d4
mov edx, dword [ebp - 0xcb8]
mov eax, dword [ebp - 0x2c]
call fcn.0002e8ac
test al, al
jne 0x147c73
lea eax, [ebp - 0xcbc]
call fcn.00026620
mov edx, dword [ebp - 0xcbc]
mov eax, dword [ebp - 0x2c]
call fcn.0002e8ac
test al, al
jne 0x147c73
lea eax, [ebp - 0xcc0]
call fcn.000264f0
mov edx, dword [ebp - 0xcc0]
mov eax, dword [ebp - 0x2c]
call fcn.0002e8ac
test al, al
jne 0x147c73
lea eax, [ebp - 0xcc4]
call fcn.0002653c
mov edx, dword [ebp - 0xcc4]
mov eax, dword [ebp - 0x2c]
call fcn.0002e8ac
test al, al
jne 0x147c73
lea eax, [ebp - 0xcc8]
call fcn.00026588
mov edx, dword [ebp - 0xcc8]
mov eax, dword [ebp - 0x2c]
call fcn.0002e8ac
test al, al
jne 0x147c73
lea eax, [ebp - 0xccc]
call fcn.0002666c
mov edx, dword [ebp - 0xccc]
mov eax, dword [ebp - 0x2c]
call fcn.0002e8ac
test al, al
jne 0x147c73
lea eax, [ebp - 0xcd0]
call fcn.000266b8
mov edx, dword [ebp - 0xcd0]
mov eax, dword [ebp - 0x2c]
call fcn.0002e8ac
test al, al
jne 0x147c73
lea eax, [ebp - 0xcd4]
call fcn.00026704
mov edx, dword [ebp - 0xcd4]
mov eax, dword [ebp - 0x2c]
call fcn.0002e8ac
test al, al
jne 0x147c73
lea eax, [ebp - 0xcd8]
call fcn.00026750
mov edx, dword [ebp - 0xcd8]
mov eax, dword [ebp - 0x2c]
call fcn.0002e8ac
test al, al
jne 0x147c73
lea eax, [ebp - 0xcdc]
call fcn.00025300
mov edx, dword [ebp - 0xcdc]
mov eax, dword [ebp - 0x88]
call fcn.0002e8ac
test al, al
je 0x147c7e
lea eax, [ebp - 0x88]
call fcn.000143f0
mov edx, 0x14c080
mov eax, dword [ebp - 0x88]
call fcn.0002e8ac
test al, al
je 0x147cb4
mov byte [ebp - 0x7e], 0
jmp 0x147cb4
lea eax, [ebp - 0xce0]
call fcn.00046098
mov edx, dword [ebp - 0xce0]
lea eax, [ebp - 0x88]
call fcn.000145ac
mov eax, dword [ebp - 0x88]
call fcn.00014630
dec eax
jle 0x147d60
mov edx, dword [ebp - 0x88]
mov eax, dword [0x25118c]
mov ecx, dword [eax]
call dword [ecx + 0x54]
test eax, eax
jge 0x147d60
mov edx, dword [ebp - 0x88]
mov eax, dword [0x25118c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0xce4]
mov eax, esi
call fcn.0003006c
mov edx, dword [ebp - 0xce4]
lea eax, [ebp - 0xd4]
call fcn.000145ac
inc esi
mov eax, dword [ebp - 0x88]
call fcn.00014630
inc eax
add eax, eax
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x88]
mov edx, 0x14c048
call fcn.0001463c
mov eax, dword [ebp - 0x8c]
push eax
mov eax, dword [ebp - 0x88]
call fcn.00014620
push eax
push 1
push 0
mov eax, dword [ebp - 0xd4]
call fcn.00014620
push eax
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegSetValueExW
inc dword [ebp - 0xbc]
dec ebx
jne 0x1479b4
mov dword [ebp - 0x20], 0x20001015
jmp 0x147dad
mov edx, 0x14c098
mov eax, dword [0x251144]
call fcn.00117278
lea edx, [ebp - 0xce8]
mov eax, dword [ebp - 0x180]
call fcn.00027478
mov edx, dword [ebp - 0xce8]
mov eax, dword [0x251144]
call fcn.00117278
mov dword [ebp - 0x20], 0x20001019
cmp dword [ebp - 0xb8], 0
je 0x147dc2
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xb8], eax
lea edx, [ebp - 0x4d8]
mov eax, 0x70
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xcec]
call fcn.00013f4c
mov edx, dword [ebp - 0xcec]
lea eax, [ebp - 0x184]
call fcn.00013fb0
push dword [ebp - 0xec]
push 0x14b3f8
push 0x14bde8
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00014068
xor eax, eax
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xb8]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x24]
call fcn.0001416c
push eax
push 0x80000003
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x147f48
cmp byte [ebp - 0x7d], 0
jne 0x147f80
mov dword [ebp - 0x8c], 1
push 4
lea eax, [ebp - 0x8c]
push eax
push 4
push 0
push 0x14be24
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x8c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xcf8]
call fcn.0003009c
mov ecx, dword [ebp - 0xcf8]
lea eax, [ebp - 0xcf4]
mov edx, 0x14c0b0
call fcn.00013ff4
mov edx, dword [ebp - 0xcf4]
lea eax, [ebp - 0xcf0]
call fcn.000145ac
mov edx, dword [ebp - 0xcf0]
lea eax, [ebp - 0x10c]
call fcn.0001463c
cmp dword [ebp - 0x5c], 0
je 0x147f80
push 0x14c0cc
mov eax, dword [ebp - 0x8c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xd00]
call fcn.0003009c
push dword [ebp - 0xd00]
push 0x14b350
lea edx, [ebp - 0xd04]
mov eax, dword [ebp - 0x5c]
call fcn.00027478
push dword [ebp - 0xd04]
lea eax, [ebp - 0xcfc]
mov edx, 4
call fcn.00014068
mov edx, dword [ebp - 0xcfc]
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x147f80
mov eax, dword [ebp - 0x5c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xd0c]
call fcn.0003009c
mov ecx, dword [ebp - 0xd0c]
lea eax, [ebp - 0xd08]
mov edx, 0x14c0e4
call fcn.00013ff4
mov edx, dword [ebp - 0xd08]
mov eax, dword [0x251144]
call fcn.00117278
cmp dword [ebp - 0xb8], 0
je 0x147f95
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xb8], eax
lea edx, [ebp - 0x4d8]
mov eax, 0x71
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xd10]
call fcn.00013f4c
mov edx, dword [ebp - 0xd10]
lea eax, [ebp - 0x184]
call fcn.00013fb0
push dword [ebp - 0xec]
push 0x14b3f8
push 0x14be3c
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00014068
xor eax, eax
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xb8]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x24]
call fcn.0001416c
push eax
push 0x80000003
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x14815d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10e], 0
je 0x148195
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10e], 1
jne 0x14805d
cmp dword [ebp - 0x158], 0
jle 0x148195
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512bf]
je 0x148195
cmp byte [ebp - 9], 0
jne 0x148195
cmp byte [ebp - 0x7e], 0
je 0x148195
mov dword [ebp - 0x8c], 1
push 4
lea eax, [ebp - 0x8c]
push eax
push 4
push 0
push 0x14be78
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x8c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xd1c]
call fcn.0003009c
mov ecx, dword [ebp - 0xd1c]
lea eax, [ebp - 0xd18]
mov edx, 0x14c0f4
call fcn.00013ff4
mov edx, dword [ebp - 0xd18]
lea eax, [ebp - 0xd14]
call fcn.000145ac
mov edx, dword [ebp - 0xd14]
lea eax, [ebp - 0x10c]
call fcn.0001463c
cmp dword [ebp - 0x5c], 0
je 0x148195
push 0x14c108
mov eax, dword [ebp - 0x8c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xd24]
call fcn.0003009c
push dword [ebp - 0xd24]
push 0x14b350
lea edx, [ebp - 0xd28]
mov eax, dword [ebp - 0x5c]
call fcn.00027478
push dword [ebp - 0xd28]
lea eax, [ebp - 0xd20]
mov edx, 4
call fcn.00014068
mov edx, dword [ebp - 0xd20]
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x148195
mov eax, dword [ebp - 0x5c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xd30]
call fcn.0003009c
mov ecx, dword [ebp - 0xd30]
lea eax, [ebp - 0xd2c]
mov edx, 0x14c108
call fcn.00013ff4
mov edx, dword [ebp - 0xd2c]
mov eax, dword [0x251144]
call fcn.00117278
cmp dword [ebp - 0xb8], 0
je 0x1481aa
mov eax, dword [ebp - 0xb8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0x7c]
mov edx, 0x400
call fcn.00027218
jmp 0x148261
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x180], eax
mov edx, 0x14c118
mov eax, dword [0x251144]
call fcn.00117278
lea edx, [ebp - 0xd34]
mov eax, dword [ebp - 0x180]
call fcn.00027478
mov edx, dword [ebp - 0xd34]
mov eax, dword [0x251144]
call fcn.00117278
mov dword [ebp - 0x20], 0x20001021
jmp 0x148261
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x180], eax
lea eax, [ebp - 0xd38]
mov ecx, dword [ebp - 0xc4]
mov edx, 0x14c138
call fcn.00013ff4
mov edx, dword [ebp - 0xd38]
mov eax, dword [0x251144]
call fcn.00117278
lea edx, [ebp - 0xd3c]
mov eax, dword [ebp - 0x180]
call fcn.00027478
mov edx, dword [ebp - 0xd3c]
mov eax, dword [0x251144]
call fcn.00117278
mov dword [ebp - 0x20], 0x20001018
mov eax, dword [ebp - 0x10c]
call fcn.00014630
test eax, eax
jle 0x1482c0
mov edx, dword [ebp - 0x10c]
mov eax, dword [0x251144]
call fcn.00117340
jmp 0x1482c0
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xd44]
call fcn.0003009c
mov ecx, dword [ebp - 0xd44]
lea eax, [ebp - 0xd40]
mov edx, 0x14c160
call fcn.00013ff4
mov edx, dword [ebp - 0xd40]
mov eax, dword [0x251144]
call fcn.001171b0
mov dword [ebp - 0x20], 0x20001017
lea edx, [ebp - 0x78]
mov eax, 0x2513ac
mov ecx, 4
call fcn.0001291c
inc dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov edx, dword [ebp - 0x20]
mov dword [eax], edx
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512b8]
jne 0x14837a
cmp byte [0x2511f0], 0
je 0x14837a
cmp byte [0x251198], 0
je 0x14837a
lea edx, [ebp - 0x4d8]
mov eax, 0x2c
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xd48]
call fcn.00013f4c
mov edx, dword [ebp - 0xd48]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [ebp - 0x14c]
inc dword [ebp - 0x78]
lea eax, [ebp - 0xd4c]
call fcn.0004bce8
mov edx, dword [ebp - 0xd4c]
lea eax, [ebp - 0xc4]
call fcn.00013f70
mov eax, dword [ebp - 0xc4]
call fcn.00013fa8
inc eax
push eax
lea eax, [ebp - 0xc4]
call fcn.00014178
mov edx, dword [ebp - 0x78]
pop ecx
call fcn.0001291c
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512bd]
jne 0x148d1a
cmp byte [0x2511f0], 0
je 0x148d1a
cmp byte [0x251198], 0
je 0x148d1a
lea edx, [ebp - 0x4d8]
mov eax, 0x37
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xd50]
call fcn.00013f4c
mov edx, dword [ebp - 0xd50]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [ebp - 0x14c]
inc dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov ebx, dword [eax]
add dword [ebp - 0x78], 4
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
add dword [ebp - 0x78], 4
add dword [ebp - 0x78], 4
cmp ebx, 1
jb 0x148d1a
cmp ebx, 0x258
jae 0x148d1a
lea edx, [ebp - 0x4d8]
mov eax, 0x38
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xd54]
call fcn.00013f4c
mov edx, dword [ebp - 0xd54]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0xc4]
mov edx, ebx
call fcn.000142dc
lea eax, [ebp - 0xc4]
call fcn.00014178
mov edx, eax
mov eax, dword [ebp - 0x78]
mov ecx, ebx
call fcn.0001291c
call fcn.00029d8c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xc0]
call fcn.0002a444
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 0xc0]
call fcn.00045580
lea ecx, [ebp - 0x4c]
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 0xc4]
call fcn.000459b4
mov eax, dword [ebp - 0x4c]
call fcn.00013fa8
test eax, eax
je 0x1484cf
lea eax, [ebp - 0xd58]
push eax
mov ecx, 0x1b
mov edx, 1
mov eax, dword [ebp - 0x4c]
call fcn.000141b0
mov eax, dword [ebp - 0xd58]
mov edx, 0x14b504
call fcn.000140b8
je 0x14850b
call fcn.00029d8c
fsub qword [0x251240]
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xc0]
call fcn.0002a444
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 0xc0]
call fcn.00045580
lea ecx, [ebp - 0x4c]
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 0xc4]
call fcn.000459b4
lea eax, [ebp - 0xc4]
mov edx, dword [ebp - 0x4c]
call fcn.00013db0
mov edx, dword [ebp - 0xc4]
mov eax, 0x14b3ec
call fcn.00014294
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xc4]
call fcn.00013fa8
test eax, eax
je 0x148575
lea eax, [ebp - 0xd5c]
push eax
mov ecx, 0x1b
mov edx, 1
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
mov eax, dword [ebp - 0xd5c]
mov edx, 0x14b504
call fcn.000140b8
jne 0x148575
cmp dword [ebp - 0xbc], 1
jg 0x148589
mov edx, 0x14c174
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x148d1a
lea edx, [ebp - 0x4d8]
mov eax, 0x39
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xd60]
call fcn.00013f4c
mov edx, dword [ebp - 0xd60]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0xc4]
mov ecx, 0x1b
mov edx, 1
call fcn.000141f0
mov eax, dword [ebp - 0xc4]
call fcn.00013fa8
mov ebx, eax
mov edx, dword [ebp - 0xc4]
mov eax, 0x14b3ec
call fcn.00014294
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jle 0x148619
lea eax, [ebp - 0x110]
push eax
mov edx, dword [ebp - 0xbc]
inc edx
mov ecx, ebx
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
jmp 0x148624
lea eax, [ebp - 0x110]
call fcn.00013d18
mov edx, dword [ebp - 0xbc]
dec edx
lea eax, [ebp - 0xc4]
call fcn.000142dc
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 0x110]
call fcn.0001c37c
mov edx, dword [ebp - 0xc4]
mov eax, 0x14b3f8
call fcn.00014294
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jle 0x14869e
lea eax, [ebp - 0xfc]
push eax
mov ecx, dword [ebp - 0xbc]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
lea eax, [ebp - 0xc4]
push eax
mov edx, dword [ebp - 0xbc]
inc edx
mov ecx, ebx
mov eax, dword [ebp - 0xc4]
call fcn.000141b0
jmp 0x1486a9
lea eax, [ebp - 0xfc]
call fcn.00013d18
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0xfc]
call fcn.0001c37c
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc4]
call fcn.0001c37c
lea edx, [ebp - 0x4d8]
mov eax, 0x3a
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xd64]
call fcn.00013f4c
mov edx, dword [ebp - 0xd64]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov ecx, 0x14c188
xor edx, edx
xor eax, eax
call fcn.000c82e8
mov ebx, eax
mov eax, ebx
and eax, 7
cmp eax, 0x10
jbe 0x148783
push 0x14b410
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xd6c]
call fcn.0003009c
push dword [ebp - 0xd6c]
push 0x14b41c
lea edx, [ebp - 0xd70]
mov eax, 0x10
call fcn.0003006c
push dword [ebp - 0xd70]
push 0x14b41c
lea edx, [ebp - 0xd74]
mov eax, 7
call fcn.0003006c
push dword [ebp - 0xd74]
lea eax, [ebp - 0xd68]
mov edx, 6
call fcn.00014068
mov edx, dword [ebp - 0xd68]
mov eax, dword [0x251144]
call fcn.001171b0
lea edx, [ebp - 0x4d8]
mov eax, 0x3b
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xd78]
call fcn.00013f4c
mov edx, dword [ebp - 0xd78]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov byte [ebp - 0x145], 0
xor eax, eax
mov dword [ebp - 0x188], eax
lea eax, [ebp - 0x170]
call fcn.00013d18
lea eax, [ebp - 0x188]
mov edx, 0x2ee0
call fcn.000271f0
lea eax, [ebp - 0x170]
push eax
push 0x14c194
lea ecx, [ebp - 0x174]
lea eax, [ebp - 0x188]
mov edx, 0x3e8
call fcn.000c6d30
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jne 0x148cc3
lea edx, [ebp - 0x4d8]
mov eax, 0x3c
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xd7c]
call fcn.00013f4c
mov edx, dword [ebp - 0xd7c]
lea eax, [ebp - 0x184]
call fcn.00013fb0
cmp dword [ebp - 0x174], 0
jbe 0x148c4f
push dword [ebp - 0x44]
push 0x14ba90
push dword [ebp - 0x38]
lea eax, [ebp - 0xd80]
mov edx, 3
call fcn.00014700
mov eax, dword [ebp - 0xd80]
lea edx, [ebp - 0x4c]
call fcn.0001c078
mov ebx, dword [ebp - 0x174]
dec ebx
test ebx, ebx
jl 0x148d0a
inc ebx
mov dword [ebp - 0xbc], 0
cmp byte [ebp - 0x145], 0
jne 0x148c3d
mov eax, dword [ebp - 0xbc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x188]
mov eax, dword [edx + eax*4]
cmp eax, dword [ebp - 0x3c]
je 0x148c3d
mov eax, dword [ebp - 0xbc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x188]
mov al, byte [edx + eax*4 + 8]
test al, al
je 0x1488df
add al, 0xfd
sub al, 2
jae 0x148c3d
lea eax, [ebp - 0x178]
call fcn.000143f0
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x160]
push eax
mov eax, dword [ebp - 0xbc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x188]
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x14d]
lea edx, [ebp - 0x180]
call fcn.000c09ac
lea eax, [ebp - 0x178]
call fcn.000143f0
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x168]
push eax
mov eax, dword [ebp - 0xbc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x188]
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x161]
lea edx, [ebp - 0x180]
call fcn.000c11fc
mov al, byte [ebp - 0x14d]
and al, byte [ebp - 0x161]
je 0x148bfc
mov eax, dword [ebp - 0x160]
call fcn.00014630
test eax, eax
jle 0x148bfc
mov eax, dword [ebp - 0x168]
call fcn.00014630
test eax, eax
jle 0x148bfc
mov eax, dword [ebp - 0x160]
call fcn.00014630
cmp eax, 0xf7
jg 0x148bfc
mov eax, dword [ebp - 0x168]
call fcn.00014630
cmp eax, 0xf7
jg 0x148bfc
push dword [ebp - 0x168]
push 0x14ba90
push dword [ebp - 0x160]
lea eax, [ebp - 0xd84]
mov edx, 3
call fcn.00014700
mov eax, dword [ebp - 0xd84]
lea edx, [ebp - 0x90]
call fcn.0001c078
lea eax, [ebp - 0x128]
call fcn.00013d18
mov eax, dword [ebp - 0x90]
mov edx, dword [ebp - 0x4c]
call fcn.000140b8
jne 0x148a1d
lea eax, [ebp - 0x128]
mov edx, 0x14c1a0
call fcn.00013db0
jmp 0x148b77
lea edx, [ebp - 0xd88]
mov eax, dword [ebp - 0x160]
call fcn.0001c9b0
mov eax, dword [ebp - 0xd88]
push eax
lea edx, [ebp - 0xd8c]
mov eax, dword [ebp - 0x38]
call fcn.0001c9b0
mov edx, dword [ebp - 0xd8c]
pop eax
call fcn.00014748
jne 0x148b77
lea edx, [ebp - 0xd90]
mov eax, dword [ebp - 0x168]
call fcn.0001c9b0
mov eax, dword [ebp - 0xd90]
push eax
lea edx, [ebp - 0xd94]
mov eax, dword [ebp - 0x44]
call fcn.0001c9b0
mov edx, dword [ebp - 0xd94]
pop eax
call fcn.00014748
jne 0x148b77
lea eax, [ebp - 0x128]
mov edx, 0x14c1ac
call fcn.00013db0
push dword [ebp - 0x44]
push 0x14ba90
push dword [ebp - 0x38]
lea eax, [ebp - 0xd98]
mov edx, 3
call fcn.00014700
mov edx, dword [ebp - 0xd98]
mov eax, dword [0x251144]
call fcn.00117340
push dword [ebp - 0x168]
push 0x14ba90
push dword [ebp - 0x160]
lea eax, [ebp - 0xd9c]
mov edx, 3
call fcn.00014700
mov edx, dword [ebp - 0xd9c]
mov eax, dword [0x251144]
call fcn.00117340
push dword [ebp - 0x44]
push 0x14ba90
push dword [ebp - 0x38]
lea eax, [ebp - 0xda4]
mov edx, 3
call fcn.00014700
mov eax, dword [ebp - 0xda4]
lea edx, [ebp - 0xda0]
call fcn.0001c9b0
mov edx, dword [ebp - 0xda0]
mov eax, dword [0x251144]
call fcn.00117340
push dword [ebp - 0x168]
push 0x14ba90
push dword [ebp - 0x160]
lea eax, [ebp - 0xdac]
mov edx, 3
call fcn.00014700
mov eax, dword [ebp - 0xdac]
lea edx, [ebp - 0xda8]
call fcn.0001c9b0
mov edx, dword [ebp - 0xda8]
mov eax, dword [0x251144]
call fcn.00117340
mov eax, dword [ebp - 0x128]
call fcn.00013fa8
test eax, eax
jle 0x148c0b
mov byte [ebp - 0x145], 1
lea edx, [ebp - 0x4d8]
mov eax, 0x3d
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xdb0]
call fcn.00013f4c
mov edx, dword [ebp - 0xdb0]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0xbc]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x188]
mov ecx, dword [edx + eax*4]
mov dl, 1
mov eax, dword [0x12b100]
call fcn.0014dbe8
mov edx, dword [ebp - 4]
mov dword [edx + 0x108], eax
jmp 0x148c0b
mov edx, 0x14b480
mov eax, dword [0x251144]
call fcn.00117278
lea edx, [ebp - 0x4d8]
mov eax, 0x3e
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xdb4]
call fcn.00013f4c
mov edx, dword [ebp - 0xdb4]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [ebp - 0xbc]
dec ebx
jne 0x148896
jmp 0x148d0a
push 0x14b410
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xdbc]
call fcn.0003009c
push dword [ebp - 0xdbc]
push 0x14b41c
lea edx, [ebp - 0xdc0]
mov eax, 0x10
call fcn.0003006c
push dword [ebp - 0xdc0]
push 0x14b41c
lea edx, [ebp - 0xdc4]
mov eax, 7
call fcn.0003006c
push dword [ebp - 0xdc4]
lea eax, [ebp - 0xdb8]
mov edx, 6
call fcn.00014068
mov edx, dword [ebp - 0xdb8]
mov eax, dword [0x251144]
call fcn.001171b0
jmp 0x148d0a
lea edx, [ebp - 0xdcc]
mov eax, dword [ebp - 0x180]
call fcn.00027478
mov ecx, dword [ebp - 0xdcc]
lea eax, [ebp - 0xdc8]
mov edx, 0x14c1b8
call fcn.00013ff4
mov edx, dword [ebp - 0xdc8]
mov eax, dword [0x251144]
call fcn.00117278
mov edx, dword [ebp - 0x170]
mov eax, dword [0x251144]
call fcn.00117278
lea eax, [ebp - 0x188]
mov edx, 0x2ee0
call fcn.00027218
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512ba]
je 0x148d3f
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512bb]
je 0x148d3f
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512bc]
jne 0x14970c
cmp byte [0x2511f0], 0
je 0x14970c
cmp byte [0x251198], 0
je 0x14970c
lea edx, [ebp - 0x4d8]
mov eax, 0x2e
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xdd0]
call fcn.00013f4c
mov edx, dword [ebp - 0xdd0]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [ebp - 0x14c]
inc dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffff
je 0x148dcb
lea eax, [ebp - 0xb0]
call fcn.000143f0
lea edx, [ebp - 0xb0]
mov eax, dword [ebp - 0x3c]
call fcn.000e7c98
mov edx, dword [ebp - 0xb0]
mov eax, dword [0x251144]
call fcn.00117340
add dword [ebp - 0x78], 4
mov eax, dword [ebp - 0x78]
mov bx, word [eax]
test bx, bx
jbe 0x1496ed
call fcn.00045cdc
sub eax, 0xc8
movzx edx, bx
cmp eax, edx
jle 0x1496ed
lea edx, [ebp - 0x4d8]
mov eax, 0x2f
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xdd4]
call fcn.00013f4c
mov edx, dword [ebp - 0xdd4]
lea eax, [ebp - 0x184]
call fcn.00013fb0
add dword [ebp - 0x78], 2
movzx edx, bx
lea eax, [ebp - 0xe0]
call fcn.000142dc
lea eax, [ebp - 0xe0]
call fcn.00014178
mov edx, eax
movzx ecx, bx
mov eax, dword [ebp - 0x78]
call fcn.0001291c
mov edx, dword [ebp - 0xe0]
mov eax, 0x14c1cc
call fcn.00014294
dec eax
jne 0x148ea0
lea edx, [ebp - 0x4d8]
mov eax, 0x8b
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xdd8]
call fcn.00013f4c
mov edx, dword [ebp - 0xdd8]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov byte [0x251238], 2
jmp 0x14970c
mov edx, dword [ebp - 0xe0]
mov eax, 0x14c1e4
call fcn.00014294
dec eax
jne 0x149026
lea edx, [ebp - 0x4d8]
mov eax, 0x30
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xddc]
call fcn.00013f4c
mov edx, dword [ebp - 0xddc]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0xe0]
mov ecx, 0xc
mov edx, 1
call fcn.000141f0
lea eax, [ebp - 0xb0]
call fcn.000143f0
mov edx, 0x14c1e4
lea eax, [ebp - 0xde4]
mov ecx, dword [ebp - 0xe0]
call fcn.00013ff4
mov edx, dword [ebp - 0xde4]
lea eax, [ebp - 0xde0]
call fcn.000145ac
mov eax, dword [ebp - 0xde0]
push eax
mov eax, dword [ebp - 0x3c]
push eax
push 0
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0xdf0]
call fcn.00027b40
mov eax, dword [ebp - 0xdf0]
lea edx, [ebp - 0xdec]
call fcn.00032acc
lea eax, [ebp - 0xdec]
push eax
lea eax, [ebp - 0xdf4]
call fcn.00025994
mov edx, dword [ebp - 0xdf4]
pop eax
call fcn.00013fb0
mov edx, dword [ebp - 0xdec]
lea eax, [ebp - 0xde8]
call fcn.000145ac
mov eax, dword [ebp - 0xde8]
push eax
lea eax, [ebp - 0xe00]
call fcn.00027b40
mov eax, dword [ebp - 0xe00]
lea edx, [ebp - 0xdfc]
call fcn.00032acc
lea eax, [ebp - 0xdfc]
push eax
lea eax, [ebp - 0xe04]
call fcn.00025994
mov edx, dword [ebp - 0xe04]
pop eax
call fcn.00013fb0
mov edx, dword [ebp - 0xdfc]
lea eax, [ebp - 0xdf8]
call fcn.000145ac
mov eax, dword [ebp - 0xdf8]
push eax
lea eax, [ebp - 0xe0c]
call fcn.00046098
mov edx, dword [ebp - 0xe0c]
lea eax, [ebp - 0xe08]
call fcn.000145ac
mov edx, dword [ebp - 0xe08]
pop eax
pop ecx
call fcn.000c2204
mov edx, dword [ebp - 0xb0]
mov eax, dword [0x251144]
call fcn.00117340
jmp 0x14970c
mov edx, dword [ebp - 0xe0]
mov eax, 0x14c1fc
call fcn.00014294
dec eax
jne 0x1490e0
lea edx, [ebp - 0x4d8]
mov eax, 0x31
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xe10]
call fcn.00013f4c
mov edx, dword [ebp - 0xe10]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0x90]
call fcn.0012708c
mov edx, dword [ebp - 0x90]
mov eax, dword [0x251144]
call fcn.001170e8
lea eax, [ebp - 0x90]
call fcn.001270f0
mov edx, dword [ebp - 0x90]
mov eax, dword [0x251144]
call fcn.001170e8
lea eax, [ebp - 0x90]
call fcn.001281a8
mov edx, dword [ebp - 0x90]
mov eax, dword [0x251144]
call fcn.001170e8
lea eax, [ebp - 0x88]
call fcn.001293b4
mov edx, dword [ebp - 0x88]
mov eax, dword [0x251144]
call fcn.00117340
jmp 0x14970c
mov edx, dword [ebp - 0xe0]
mov eax, 0x14c214
call fcn.00014294
dec eax
jne 0x1491d7
lea edx, [ebp - 0x4d8]
mov eax, 0x32
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xe14]
call fcn.00013f4c
mov edx, dword [ebp - 0xe14]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov eax, dword [0x2514a0]
mov eax, dword [eax]
mov edx, dword [0x251acc]
push edx
mov edx, dword [0x251544]
push edx
mov edx, dword [0x251998]
push edx
mov edx, dword [0x2516f8]
push edx
mov edx, dword [0x251988]
push edx
push eax
lea edx, [eax + 1]
push edx
lea edx, [eax + 2]
push edx
lea edx, [eax + 3]
push edx
lea edx, [eax + 4]
push edx
lea edx, [eax + 5]
push edx
lea edx, [eax + 6]
push edx
mov edx, dword [0x251578]
push edx
mov edx, dword [0x251b84]
push edx
lea edx, [eax + 7]
push edx
add eax, 8
push eax
mov eax, dword [0x2516dc]
push eax
mov ecx, dword [0x251510]
mov edx, dword [0x251a64]
mov eax, dword [0x251818]
call fcn.000e16e0
mov eax, dword [0x251510]
cmp byte [eax], 0
je 0x14970c
mov eax, dword [0x251b24]
cmp dword [eax], 0
je 0x14970c
mov edx, 0x14c22c
mov eax, dword [0x251144]
call fcn.001170e8
mov eax, dword [0x251b24]
xor edx, edx
mov dword [eax], edx
jmp 0x14970c
mov edx, dword [ebp - 0xe0]
mov eax, 0x14c290
call fcn.00014294
dec eax
jne 0x1493f7
lea edx, [ebp - 0x4d8]
mov eax, 0x33
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xe18]
call fcn.00013f4c
mov edx, dword [ebp - 0xe18]
lea eax, [ebp - 0x184]
call fcn.00013fb0
call fcn.0004ed48
test al, al
je 0x1493e3
lea edx, [ebp - 0x4d8]
mov eax, 0x34
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xe1c]
call fcn.00013f4c
mov edx, dword [ebp - 0xe1c]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0xe24]
call fcn.000252c4
push dword [ebp - 0xe24]
push 0x14b350
lea eax, [ebp - 0xe28]
call fcn.00028ac4
push dword [ebp - 0xe28]
push 0x14c2a8
mov eax, dword [0x251248]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xe2c]
call fcn.0003009c
push dword [ebp - 0xe2c]
push 0x14b6fc
lea eax, [ebp - 0xe20]
mov edx, 6
call fcn.00014068
mov eax, dword [ebp - 0xe20]
push eax
push 0x14c2c0
lea eax, [ebp - 0xe34]
call fcn.000252c4
push dword [ebp - 0xe34]
push 0x14bd00
lea eax, [ebp - 0xe38]
call fcn.00028ac4
push dword [ebp - 0xe38]
lea eax, [ebp - 0xe30]
mov edx, 4
call fcn.00014068
mov edx, dword [ebp - 0xe30]
pop eax
call fcn.0012b8b0
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jle 0x149383
push 0x14c2e8
mov eax, dword [0x251248]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xe40]
call fcn.0003009c
push dword [ebp - 0xe40]
push 0x14c308
lea edx, [ebp - 0xe44]
mov eax, dword [ebp - 0xbc]
call fcn.0003006c
push dword [ebp - 0xe44]
push 0x14c324
lea eax, [ebp - 0xe3c]
mov edx, 5
call fcn.00014068
mov edx, dword [ebp - 0xe3c]
mov eax, dword [0x251144]
call fcn.001170e8
inc dword [0x251248]
jmp 0x14970c
cmp dword [ebp - 0xbc], 0xffffffff
jne 0x1493a0
mov edx, 0x14c334
mov eax, dword [0x251144]
call fcn.001170e8
jmp 0x14970c
push 0x14c374
lea edx, [ebp - 0xe4c]
mov eax, dword [ebp - 0x18]
call fcn.0003006c
push dword [ebp - 0xe4c]
push 0x14b6fc
lea eax, [ebp - 0xe48]
mov edx, 3
call fcn.00014068
mov edx, dword [ebp - 0xe48]
mov eax, dword [0x251144]
call fcn.001170e8
jmp 0x14970c
mov edx, 0x14c3b0
mov eax, dword [0x251144]
call fcn.001170e8
jmp 0x14970c
mov eax, dword [0x25191c]
mov eax, dword [eax]
mov edx, dword [ebp - 0xe0]
call fcn.00014294
dec eax
jne 0x1495f0
lea edx, [ebp - 0x4d8]
mov eax, 0x35
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xe50]
call fcn.00013f4c
mov edx, dword [ebp - 0xe50]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov eax, dword [0x25191c]
mov eax, dword [eax]
call fcn.00013fa8
mov ecx, eax
lea eax, [ebp - 0xe0]
mov edx, 1
call fcn.000141f0
lea edx, [ebp - 0xb0]
mov eax, dword [ebp - 0xe0]
call fcn.0001c37c
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512ba]
jne 0x149566
lea eax, [ebp - 0x184]
mov edx, 0x14b2f8
call fcn.00013fb0
mov edx, dword [ebp - 0xb0]
mov eax, 0x14c3e8
call fcn.0001495c
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jl 0x1494e3
lea eax, [ebp - 0x184]
mov edx, 0x14c40c
call fcn.00013fb0
lea eax, [ebp - 0x184]
mov edx, 0x14c418
call fcn.00013fb0
mov edx, 0x14c424
mov eax, dword [0x251144]
call fcn.001171b0
jmp 0x14970c
lea eax, [ebp - 0x184]
mov edx, 0x14c448
call fcn.00013fb0
mov eax, dword [ebp - 0xb0]
call fcn.00014630
test eax, eax
jle 0x14970c
mov eax, dword [0x2515cc]
cmp dword [eax], 0
je 0x149551
call sub.kernel32.dll_GetTickCount
mov edx, dword [0x2515cc]
mov edx, dword [edx]
call fcn.000292ac
cmp eax, 0x1d4c0
jb 0x149534
mov eax, dword [0x2515cc]
xor edx, edx
mov dword [eax], edx
jmp 0x149551
mov edx, dword [ebp - 0xb0]
mov eax, 0x14c450
call fcn.0001495c
test eax, eax
jle 0x149551
mov eax, dword [0x2515cc]
xor edx, edx
mov dword [eax], edx
mov edx, dword [ebp - 0xb0]
mov eax, dword [0x251144]
call fcn.00117340
jmp 0x14970c
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512bb]
jne 0x1495a9
lea eax, [ebp - 0x184]
mov edx, 0x14c468
call fcn.00013fb0
mov eax, dword [ebp - 0xb0]
call fcn.00014630
test eax, eax
jle 0x14970c
mov edx, dword [ebp - 0xb0]
mov eax, dword [0x251144]
call fcn.00117408
jmp 0x14970c
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512bc]
jne 0x14970c
lea eax, [ebp - 0x184]
mov edx, 0x14c474
call fcn.00013fb0
mov eax, dword [ebp - 0xb0]
call fcn.00014630
test eax, eax
jle 0x14970c
mov edx, dword [ebp - 0xb0]
mov eax, dword [0x251144]
call fcn.001174d0
jmp 0x14970c
lea edx, [ebp - 0x4d8]
mov eax, 0x36
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xe54]
call fcn.00013f4c
mov edx, dword [ebp - 0xe54]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0x184]
mov edx, 0x14c480
call fcn.00013fb0
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512ba]
jne 0x149675
lea eax, [ebp - 0x184]
mov edx, 0x14c48c
call fcn.00013fb0
mov eax, dword [ebp - 0xe0]
call fcn.00013fa8
test eax, eax
jle 0x14970c
mov edx, dword [ebp - 0xe0]
mov eax, dword [0x251144]
call fcn.001170e8
jmp 0x14970c
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512bb]
jne 0x1496b1
lea eax, [ebp - 0x184]
mov edx, 0x14c498
call fcn.00013fb0
mov eax, dword [ebp - 0xe0]
call fcn.00013fa8
test eax, eax
jle 0x14970c
mov edx, dword [ebp - 0xe0]
mov eax, dword [0x251144]
call fcn.001171b0
jmp 0x14970c
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512bc]
jne 0x14970c
lea eax, [ebp - 0x184]
mov edx, 0x14c4a4
call fcn.00013fb0
mov eax, dword [ebp - 0xe0]
call fcn.00013fa8
test eax, eax
jle 0x14970c
mov edx, dword [ebp - 0xe0]
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x14970c
lea eax, [ebp - 0x184]
mov edx, 0x14c4b0
call fcn.00013fb0
mov edx, 0x14b4f4
mov eax, dword [0x251144]
call fcn.00117278
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512c3]
jne 0x149761
cmp byte [0x2511f0], 0
je 0x149761
cmp byte [0x251198], 0
je 0x149761
lea edx, [ebp - 0x4d8]
mov eax, 0x8a
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xe58]
call fcn.00013f4c
mov edx, dword [ebp - 0xe58]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [ebp - 0x14c]
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512c1]
jne 0x14a40c
cmp byte [0x2511f0], 0
je 0x14a40c
cmp byte [0x251198], 0
je 0x14a40c
lea edx, [ebp - 0x4d8]
mov eax, 0x72
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xe5c]
call fcn.00013f4c
mov edx, dword [ebp - 0xe5c]
lea eax, [ebp - 0x184]
call fcn.00013fb0
xor eax, eax
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x14c]
call fcn.00029d8c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xc0]
call fcn.0002a444
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 0xc0]
call fcn.00045580
cmp dword [ebp - 0x58], 0
jne 0x14a3aa
inc dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jbe 0x14a363
cmp dword [ebp - 0x8c], 0x2710
jae 0x14a363
lea edx, [ebp - 0x4d8]
mov eax, 0x73
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xe60]
call fcn.00013f4c
mov edx, dword [ebp - 0xe60]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0x90]
mov edx, dword [ebp - 0x8c]
call fcn.000142dc
add dword [ebp - 0x78], 4
lea eax, [ebp - 0x90]
call fcn.00014178
mov edx, eax
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x8c]
call fcn.0001291c
lea ecx, [ebp - 0x4c]
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 0x90]
call fcn.000459b4
lea eax, [ebp - 0xe64]
push eax
mov ecx, 0x1b
mov edx, 1
mov eax, dword [ebp - 0x4c]
call fcn.000141b0
mov eax, dword [ebp - 0xe64]
mov edx, 0x14b504
call fcn.000140b8
jne 0x14a319
lea edx, [ebp - 0x4d8]
mov eax, 0x74
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xe68]
call fcn.00013f4c
mov edx, dword [ebp - 0xe68]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0x4c]
mov ecx, 0x1b
mov edx, 1
call fcn.000141f0
mov dword [ebp - 0x3c], 0xffffffff
xor eax, eax
push ebp
push 0x149a2a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xe70]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 0x4c]
call fcn.000141b0
mov ecx, dword [ebp - 0xe70]
lea eax, [ebp - 0xe6c]
mov edx, 0x14c4bc
call fcn.00013ff4
mov eax, dword [ebp - 0xe6c]
call fcn.0003014c
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0xe78]
push eax
mov ecx, 8
mov edx, 9
mov eax, dword [ebp - 0x4c]
call fcn.000141b0
mov ecx, dword [ebp - 0xe78]
lea eax, [ebp - 0xe74]
mov edx, 0x14c4bc
call fcn.00013ff4
mov eax, dword [ebp - 0xe74]
call fcn.0003014c
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0xe80]
push eax
mov ecx, 4
mov edx, 0x11
mov eax, dword [ebp - 0x4c]
call fcn.000141b0
mov ecx, dword [ebp - 0xe80]
lea eax, [ebp - 0xe7c]
mov edx, 0x14c4bc
call fcn.00013ff4
mov eax, dword [ebp - 0xe7c]
call fcn.0003014c
mov ebx, eax
lea eax, [ebp - 0xe88]
push eax
mov ecx, 4
mov edx, 0x15
mov eax, dword [ebp - 0x4c]
call fcn.000141b0
mov ecx, dword [ebp - 0xe88]
lea eax, [ebp - 0xe84]
mov edx, 0x14c4bc
call fcn.00013ff4
mov eax, dword [ebp - 0xe84]
call fcn.0003014c
mov esi, eax
lea eax, [ebp - 0x4c]
mov ecx, 0x18
mov edx, 1
call fcn.000141f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x149a85
cmp dword [ebp - 0x40], 0xffffffff
je 0x14a29f
cmp dword [ebp - 0x3c], 0xffffffff
je 0x14a29f
test ebx, ebx
jbe 0x14a29f
cmp ebx, 0xff
jae 0x14a29f
test esi, esi
jbe 0x14a29f
cmp esi, 0xff
jae 0x14a29f
lea edx, [ebp - 0x4d8]
mov eax, 0x75
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xe94]
call fcn.00013f4c
mov edx, dword [ebp - 0xe94]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0xc4]
push eax
mov ecx, ebx
mov edx, 1
mov eax, dword [ebp - 0x4c]
call fcn.000141b0
lea eax, [ebp - 0x4c]
mov ecx, ebx
mov edx, 1
call fcn.000141f0
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov edx, 1
mov eax, dword [ebp - 0x4c]
call fcn.000141b0
mov eax, dword [ebp - 0x28]
mov edx, 0x14c4e0
call fcn.000140b8
je 0x149b6b
mov eax, dword [ebp - 0x28]
mov edx, 0x14c4f8
call fcn.000140b8
je 0x149b6b
mov eax, dword [ebp - 0x28]
mov edx, 0x14c510
call fcn.000140b8
je 0x149b6b
mov eax, dword [ebp - 0x28]
mov edx, 0x14c528
call fcn.000140b8
jne 0x14a27f
mov eax, dword [ebp - 0x28]
mov edx, 0x14c4e0
call fcn.000140b8
je 0x149b89
mov eax, dword [ebp - 0x28]
mov edx, 0x14c4f8
call fcn.000140b8
jne 0x149be3
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x3c]
jne 0x149be3
lea edx, [ebp - 0x4d8]
mov eax, 0x76
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xe98]
call fcn.00013f4c
mov edx, dword [ebp - 0xe98]
lea eax, [ebp - 0x184]
call fcn.00013fb0
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [0x251144]
push eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0xc4]
call fcn.000c4dd4
jmp 0x14a3ef
lea edx, [ebp - 0x4d8]
mov eax, 0x77
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xe9c]
call fcn.00013f4c
mov edx, dword [ebp - 0xe9c]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0x54]
call fcn.000143f0
lea eax, [ebp - 0xdc]
call fcn.000143f0
lea eax, [ebp - 0x98]
call fcn.000143f0
xor eax, eax
mov dword [ebp - 0x180], eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x9d]
lea edx, [ebp - 0x180]
mov eax, dword [ebp - 0x40]
call fcn.000c09ac
cmp byte [ebp - 0x9d], 0
je 0x149c6c
cmp dword [ebp - 0x180], 0
je 0x149cd5
push 0x14c540
lea edx, [ebp - 0x4d8]
mov al, byte [ebp - 0x9d]
call fcn.000294b8
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xea4]
call fcn.00013f4c
push dword [ebp - 0xea4]
push 0x14b350
lea edx, [ebp - 0xea8]
mov eax, dword [ebp - 0x180]
call fcn.00027478
push dword [ebp - 0xea8]
lea eax, [ebp - 0xea0]
mov edx, 4
call fcn.00014068
mov edx, dword [ebp - 0xea0]
mov eax, dword [0x251144]
call fcn.00117278
lea eax, [ebp - 0x98]
call fcn.000143f0
xor eax, eax
mov dword [ebp - 0x180], eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xfd]
lea edx, [ebp - 0x180]
mov eax, dword [ebp - 0x40]
call fcn.000c11fc
cmp byte [ebp - 0xfd], 0
je 0x149d19
cmp dword [ebp - 0x180], 0
je 0x149d82
push 0x14c554
lea edx, [ebp - 0x4d8]
mov al, byte [ebp - 0xfd]
call fcn.000294b8
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xeb0]
call fcn.00013f4c
push dword [ebp - 0xeb0]
push 0x14b350
lea edx, [ebp - 0xeb4]
mov eax, dword [ebp - 0x180]
call fcn.00027478
push dword [ebp - 0xeb4]
lea eax, [ebp - 0xeac]
mov edx, 4
call fcn.00014068
mov edx, dword [ebp - 0xeac]
mov eax, dword [0x251144]
call fcn.00117278
mov eax, dword [ebp - 0x38]
call fcn.00014630
test eax, eax
jg 0x149da2
mov edx, 0x14c568
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x14a26f
mov eax, dword [ebp - 0x44]
call fcn.00014630
test eax, eax
jg 0x149dcd
mov edx, 0x14c57c
mov eax, dword [0x251144]
call fcn.001171b0
lea eax, [ebp - 0x108]
mov edx, dword [ebp - 0x38]
call fcn.0001442c
jmp 0x149de8
push dword [ebp - 0x44]
push 0x14ba90
push dword [ebp - 0x38]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00014700
lea ecx, [ebp - 0xe0]
lea edx, [ebp - 0xb4]
lea eax, [ebp - 0x62]
call fcn.0004e060
mov edx, dword [ebp - 0xe0]
mov eax, dword [0x251144]
call fcn.001170e8
lea edx, [ebp - 0x4d8]
mov eax, 0x78
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xeb8]
call fcn.00013f4c
mov edx, dword [ebp - 0xeb8]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0x34]
call fcn.000143f0
lea eax, [ebp - 0x124]
call fcn.000143f0
lea eax, [ebp - 0xd8]
call fcn.000143f0
lea eax, [ebp - 0x130]
call fcn.000143f0
lea edx, [ebp - 0x4d8]
mov eax, 0x79
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xebc]
call fcn.00013f4c
mov edx, dword [ebp - 0xebc]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0x98]
call fcn.000143f0
xor eax, eax
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x124]
push eax
mov eax, dword [ebp - 0xd8]
push eax
mov eax, dword [ebp - 0x130]
push eax
mov eax, dword [0x251144]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x17c]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x108]
call fcn.0009e04c
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0x17c], 0
je 0x149f2f
lea edx, [ebp - 0xec4]
mov eax, dword [ebp - 0x17c]
call fcn.00027478
mov ecx, dword [ebp - 0xec4]
lea eax, [ebp - 0xec0]
mov edx, 0x14c590
call fcn.00013ff4
mov edx, dword [ebp - 0xec0]
mov eax, dword [0x251144]
call fcn.00117278
cmp dword [ebp - 0xbc], 0
jge 0x149fd2
push 0x14c5b0
push dword [ebp - 0x108]
push 0x14c614
lea edx, [ebp - 0xed0]
mov eax, dword [ebp - 0xbc]
call fcn.0003006c
push dword [ebp - 0xed0]
push 0x14c62c
lea edx, [ebp - 0xed4]
mov eax, dword [ebp - 0x17c]
call fcn.00027478
push dword [ebp - 0xed4]
push 0x14b6fc
lea eax, [ebp - 0xecc]
mov edx, 5
call fcn.00014068
mov edx, dword [ebp - 0xecc]
lea eax, [ebp - 0xec8]
call fcn.000145ac
push dword [ebp - 0xec8]
lea eax, [ebp - 0xed8]
call fcn.0004818c
push dword [ebp - 0xed8]
push dword [ebp - 0x98]
lea eax, [ebp - 0x98]
mov edx, 5
call fcn.00014700
mov eax, dword [ebp - 0x98]
call fcn.00014630
test eax, eax
jle 0x149ff1
mov edx, dword [ebp - 0x98]
mov eax, dword [0x251144]
call fcn.00117340
lea eax, [ebp - 0xedc]
call fcn.0004be54
mov edx, dword [ebp - 0xedc]
mov eax, dword [0x25149c]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov ebx, eax
lea edx, [ebp - 0x4d8]
mov eax, 0x7b
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xee0]
call fcn.00013f4c
mov edx, dword [ebp - 0xee0]
lea eax, [ebp - 0x184]
call fcn.00013fb0
test ebx, ebx
jge 0x14a132
cmp byte [ebp - 0x62], 0
jne 0x14a132
mov eax, dword [ebp - 0xb4]
call fcn.00014630
test eax, eax
jle 0x14a132
lea ecx, [ebp - 0x54]
lea edx, [ebp - 0xdc]
mov eax, dword [ebp - 0xb4]
call fcn.0002c384
push 0x14c634
push dword [ebp - 0x54]
push 0x14ba90
push dword [ebp - 0xdc]
lea eax, [ebp - 0xee4]
mov edx, 4
call fcn.00014700
mov edx, dword [ebp - 0xee4]
mov eax, dword [0x251144]
call fcn.00117340
mov eax, dword [ebp - 0xdc]
call fcn.00014630
test eax, eax
jle 0x14a12f
mov eax, dword [ebp - 0x54]
call fcn.00014630
test eax, eax
jle 0x14a12f
lea eax, [ebp - 0xef0]
call fcn.00028ac4
mov edx, dword [ebp - 0xef0]
lea eax, [ebp - 0xeec]
call fcn.000145ac
mov eax, dword [ebp - 0xeec]
lea edx, [ebp - 0xee8]
call fcn.0001c9b0
mov eax, dword [ebp - 0xee8]
push eax
lea edx, [ebp - 0xef4]
mov eax, dword [ebp - 0x54]
call fcn.0001c9b0
mov edx, dword [ebp - 0xef4]
pop eax
call fcn.00014748
jne 0x14a12f
mov eax, dword [0x25149c]
mov eax, dword [eax]
mov edx, dword [ebp - 0xdc]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov ebx, eax
jmp 0x14a132
or ebx, 0xffffffff
lea edx, [ebp - 0x4d8]
mov eax, 0x7c
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xef8]
call fcn.00013f4c
mov edx, dword [ebp - 0xef8]
lea eax, [ebp - 0x184]
call fcn.00013fb0
test ebx, ebx
jl 0x14a202
push 0x14c67c
push dword [ebp - 0x108]
lea edx, [ebp - 0xf08]
mov eax, dword [ebp - 0x40]
call fcn.0002964c
mov ecx, dword [ebp - 0xf08]
lea eax, [ebp - 0xf04]
mov edx, 0x14c6b8
call fcn.00013ff4
mov edx, dword [ebp - 0xf04]
lea eax, [ebp - 0xf00]
call fcn.000145ac
push dword [ebp - 0xf00]
lea eax, [ebp - 0xefc]
mov edx, 3
call fcn.00014700
mov edx, dword [ebp - 0xefc]
mov eax, dword [0x251144]
call fcn.00117340
mov eax, dword [ebp - 0x28]
mov edx, 0x14c528
call fcn.000140b8
je 0x14a26f
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [0x251144]
push eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0xc4]
call fcn.000c4dd4
jmp 0x14a26f
push 0x14c6c8
push dword [ebp - 0x108]
lea edx, [ebp - 0xf18]
mov eax, dword [ebp - 0x40]
call fcn.0002964c
mov ecx, dword [ebp - 0xf18]
lea eax, [ebp - 0xf14]
mov edx, 0x14c6b8
call fcn.00013ff4
mov edx, dword [ebp - 0xf14]
lea eax, [ebp - 0xf10]
call fcn.000145ac
push dword [ebp - 0xf10]
lea eax, [ebp - 0xf0c]
mov edx, 3
call fcn.00014700
mov edx, dword [ebp - 0xf0c]
mov eax, dword [0x251144]
call fcn.00117408
mov dword [ebp - 0x20], 5
lea eax, [ebp - 0x130]
call fcn.000143f0
jmp 0x14a3ef
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [0x251144]
push eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0xc4]
call fcn.000c4dd4
jmp 0x14a3ef
push 0x14c71c
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xf20]
call fcn.0003009c
push dword [ebp - 0xf20]
push 0x14b41c
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xf24]
call fcn.0003009c
push dword [ebp - 0xf24]
push 0x14b41c
mov eax, dword [ebp - 0x3c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xf28]
call fcn.0003009c
push dword [ebp - 0xf28]
lea eax, [ebp - 0xf1c]
mov edx, 6
call fcn.00014068
mov edx, dword [ebp - 0xf1c]
mov eax, dword [0x251144]
call fcn.001171b0
jmp 0x14a3ef
lea edx, [ebp - 0x4d8]
mov eax, dword [ebp - 0x58]
call fcn.00029850
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xf30]
call fcn.00013f4c
mov ecx, dword [ebp - 0xf30]
lea eax, [ebp - 0xf2c]
mov edx, 0x14c730
call fcn.00013ff4
mov edx, dword [ebp - 0xf2c]
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x14a3ef
lea edx, [ebp - 0x4d8]
mov eax, dword [ebp - 0x58]
call fcn.00029850
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xf38]
call fcn.00013f4c
mov ecx, dword [ebp - 0xf38]
lea eax, [ebp - 0xf34]
mov edx, 0x14c748
call fcn.00013ff4
mov edx, dword [ebp - 0xf34]
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x14a3ef
lea edx, [ebp - 0x4d8]
mov eax, dword [ebp - 0x58]
call fcn.00029850
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xf40]
call fcn.00013f4c
mov ecx, dword [ebp - 0xf40]
lea eax, [ebp - 0xf3c]
mov edx, 0x14c760
call fcn.00013ff4
mov edx, dword [ebp - 0xf3c]
mov eax, dword [0x251144]
call fcn.00117278
lea edx, [ebp - 0x78]
mov eax, 0x2513ac
mov ecx, 4
call fcn.0001291c
inc dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov edx, dword [ebp - 0x20]
mov dword [eax], edx
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512b7]
jne 0x14a484
cmp byte [0x2511f0], 0
je 0x14a484
cmp byte [0x251198], 0
je 0x14a484
lea edx, [ebp - 0x4d8]
mov eax, 0x2b
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xf44]
call fcn.00013f4c
mov edx, dword [ebp - 0xf44]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [ebp - 0x14c]
inc dword [ebp - 0x78]
mov eax, dword [0x251144]
call fcn.0004b4ac
test al, al
je 0x14a47c
mov eax, dword [ebp - 0x78]
mov word [eax], 1
jmp 0x14a484
mov eax, dword [ebp - 0x78]
mov word [eax], 2
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512b6]
jne 0x14a545
cmp byte [0x2511f0], 0
je 0x14a545
cmp byte [0x251198], 0
je 0x14a545
lea edx, [ebp - 0x4d8]
mov eax, 0x2a
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xf48]
call fcn.00013f4c
mov edx, dword [ebp - 0xf48]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [ebp - 0x14c]
inc dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov bx, word [eax]
test bx, bx
jbe 0x14a536
cmp bx, 0xc8
jae 0x14a536
add dword [ebp - 0x78], 2
movzx edx, bx
lea eax, [ebp - 0xe0]
call fcn.000142dc
lea eax, [ebp - 0xe0]
call fcn.00014178
mov edx, eax
movzx ecx, bx
mov eax, dword [ebp - 0x78]
call fcn.0001291c
mov edx, dword [ebp - 0xe0]
mov eax, dword [0x251144]
call fcn.001170e8
jmp 0x14a545
mov edx, 0x14b4f4
mov eax, dword [0x251144]
call fcn.00117278
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512b9]
jne 0x14a62f
cmp byte [0x2511f0], 0
je 0x14a62f
cmp byte [0x251198], 0
je 0x14a62f
lea edx, [ebp - 0x4d8]
mov eax, 0x2d
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xf4c]
call fcn.00013f4c
mov edx, dword [ebp - 0xf4c]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [ebp - 0x14c]
inc dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
cmp byte [eax], 1
jne 0x14a5bf
xor edx, edx
mov eax, 0x14c778
call fcn.00111610
jmp 0x14a62f
mov eax, dword [ebp - 0x78]
cmp byte [eax], 2
jne 0x14a5d8
mov edx, 1
mov eax, 0x14c778
call fcn.00111610
jmp 0x14a62f
mov eax, dword [ebp - 0x78]
cmp byte [eax], 3
jne 0x14a5f1
mov edx, 2
mov eax, 0x14c778
call fcn.00111610
jmp 0x14a62f
mov eax, dword [ebp - 0x78]
cmp byte [eax], 4
jne 0x14a60a
mov edx, 3
mov eax, 0x14c778
call fcn.00111610
jmp 0x14a62f
mov eax, dword [ebp - 0x78]
cmp byte [eax], 5
jne 0x14a623
mov edx, 3
mov eax, 0x14c778
call fcn.00111610
jmp 0x14a62f
xor edx, edx
mov eax, 0x14c778
call fcn.00111610
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512b4]
jne 0x14a6f0
cmp byte [0x2511f0], 0
je 0x14a6f0
cmp byte [0x251198], 0
je 0x14a6f0
lea edx, [ebp - 0x4d8]
mov eax, 0x28
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xf50]
call fcn.00013f4c
mov edx, dword [ebp - 0xf50]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [ebp - 0x14c]
inc dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov bx, word [eax]
test bx, bx
jbe 0x14a6e1
cmp bx, 0xc8
jae 0x14a6e1
add dword [ebp - 0x78], 2
movzx edx, bx
lea eax, [ebp - 0xe0]
call fcn.000142dc
lea eax, [ebp - 0xe0]
call fcn.00014178
mov edx, eax
movzx ecx, bx
mov eax, dword [ebp - 0x78]
call fcn.0001291c
mov edx, dword [ebp - 0xe0]
mov eax, dword [0x251144]
call fcn.001171b0
jmp 0x14a6f0
mov edx, 0x14b4f4
mov eax, dword [0x251144]
call fcn.00117278
mov al, byte [ebp - 0x45]
cmp al, byte [0x2512c2]
jne 0x14aa3a
cmp byte [0x2511f0], 0
je 0x14aa3a
cmp byte [0x251198], 0
je 0x14aa3a
lea edx, [ebp - 0x4d8]
mov eax, 0x7d
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xf54]
call fcn.00013f4c
mov edx, dword [ebp - 0xf54]
lea eax, [ebp - 0x184]
call fcn.00013fb0
inc dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
add dword [ebp - 0x78], 4
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
add dword [ebp - 0x78], 4
cmp eax, 8
jne 0x14a95b
cmp dword [ebp - 0x40], 0
jb 0x14a922
cmp dword [ebp - 0x40], 0xffffffff
je 0x14a922
lea edx, [ebp - 0x4d8]
mov eax, 0x7e
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xf58]
call fcn.00013f4c
mov edx, dword [ebp - 0xf58]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea edx, [ebp - 0x13e]
mov eax, dword [ebp - 0x78]
mov ecx, 0xa
call fcn.0001291c
lea eax, [ebp - 0x98]
call fcn.000143f0
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x13e]
mov eax, dword [ebp - 0x40]
call fcn.000e7db8
mov edx, dword [ebp - 0x98]
mov eax, dword [0x251144]
call fcn.00117340
lea edx, [ebp - 0x4d8]
mov eax, 0x7f
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xf5c]
call fcn.00013f4c
mov edx, dword [ebp - 0xf5c]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0xb0]
call fcn.000143f0
push 0
mov eax, dword [ebp - 0x40]
push eax
push 0
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0xf68]
call fcn.00027b40
mov eax, dword [ebp - 0xf68]
lea edx, [ebp - 0xf64]
call fcn.00032acc
lea eax, [ebp - 0xf64]
push eax
lea eax, [ebp - 0xf6c]
call fcn.00025994
mov edx, dword [ebp - 0xf6c]
pop eax
call fcn.00013fb0
mov edx, dword [ebp - 0xf64]
lea eax, [ebp - 0xf60]
call fcn.000145ac
mov eax, dword [ebp - 0xf60]
push eax
lea eax, [ebp - 0xf78]
call fcn.00027b40
mov eax, dword [ebp - 0xf78]
lea edx, [ebp - 0xf74]
call fcn.00032acc
lea eax, [ebp - 0xf74]
push eax
lea eax, [ebp - 0xf7c]
call fcn.00025994
mov edx, dword [ebp - 0xf7c]
pop eax
call fcn.00013fb0
mov edx, dword [ebp - 0xf74]
lea eax, [ebp - 0xf70]
call fcn.000145ac
mov eax, dword [ebp - 0xf70]
push eax
lea eax, [ebp - 0xf84]
call fcn.00045f6c
mov edx, dword [ebp - 0xf84]
lea eax, [ebp - 0xf80]
call fcn.000145ac
mov edx, dword [ebp - 0xf80]
pop eax
pop ecx
call fcn.000c2204
mov edx, dword [ebp - 0xb0]
mov eax, dword [0x251144]
call fcn.00117340
jmp 0x14aa34
lea edx, [ebp - 0xf8c]
mov eax, dword [ebp - 0x40]
call fcn.0002964c
mov ecx, dword [ebp - 0xf8c]
lea eax, [ebp - 0xf88]
mov edx, 0x14c78c
call fcn.00013ff4
mov edx, dword [ebp - 0xf88]
mov eax, dword [0x251144]
call fcn.00117278
jmp 0x14aa34
cmp eax, 9
jne 0x14aa34
cmp dword [ebp - 0x40], 0
jb 0x14aa00
cmp dword [ebp - 0x40], 0xffffffff
je 0x14aa00
lea edx, [ebp - 0x4d8]
mov eax, 0x80
call fcn.00029594
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xf90]
call fcn.00013f4c
mov edx, dword [ebp - 0xf90]
lea eax, [ebp - 0x184]
call fcn.00013fb0
lea eax, [ebp - 0x13e]
xor ecx, ecx
mov edx, 0xa
call fcn.00012c70
lea eax, [ebp - 0x98]
call fcn.000143f0
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x13e]
mov eax, dword [ebp - 0x40]
call fcn.000e7edc
mov edx, dword [ebp - 0x98]
mov eax, dword [0x251144]
call fcn.00117340
mov edx, dword [ebp - 0x78]
lea eax, [ebp - 0x13e]
mov ecx, 0xa
call fcn.0001291c
jmp 0x14aa34
lea edx, [ebp - 0xf98]
mov eax, dword [ebp - 0x40]
call fcn.0002964c
mov ecx, dword [ebp - 0xf98]
lea eax, [ebp - 0xf94]
mov edx, 0x14c78c
call fcn.00013ff4
mov edx, dword [ebp - 0xf94]
mov eax, dword [0x251144]
call fcn.00117278
inc dword [ebp - 0x14c]
lea eax, [ebp - 0x184]
mov edx, 0x14c40c
call fcn.00013fb0
cmp dword [ebp - 0x14c], 1
je 0x14ab63
cmp byte [0x2511f0], 0
je 0x14ab63
cmp byte [0x251198], 0
je 0x14ab63
push 0x14c7a0
lea edx, [ebp - 0xfa0]
mov eax, dword [ebp - 0x14c]
call fcn.0003006c
push dword [ebp - 0xfa0]
push 0x14c7b8
lea edx, [ebp - 0x4d8]
mov al, byte [ebp - 0x45]
call fcn.00029738
lea edx, [ebp - 0x4d8]
lea eax, [ebp - 0xfa4]
call fcn.00013f4c
push dword [ebp - 0xfa4]
push 0x14b350
lea edx, [ebp - 0xfa8]
mov eax, dword [0x251220]
call fcn.0003006c
push dword [ebp - 0xfa8]
lea eax, [ebp - 0xf9c]
mov edx, 6
call fcn.00014068
mov edx, dword [ebp - 0xf9c]
mov eax, dword [0x251144]
call fcn.001170e8
call fcn.00045cdc
mov edx, eax
mov eax, dword [0x2513ac]
xor ecx, ecx
call fcn.00012c70
inc dword [0x251220]
cmp dword [0x251220], 0xa
jle 0x14ab1e
mov al, byte [0x25123c]
mov byte [0x251198], al
cmp byte [0x251198], 0
je 0x14ab2e
mov byte [0x2511c0], 0
cmp dword [0x251220], 0xa
jle 0x14ab7c
cmp byte [0x251198], 0
jne 0x14ab7c
call fcn.0009b09c
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xfff8
je 0x14ab7c
mov eax, 0x5049
call fcn.0009b178
jmp 0x14ab7c
cmp byte [ebp - 0x45], 0xfd
je 0x14ab7c
cmp byte [ebp - 0x45], 0xfe
je 0x14ab7c
cmp byte [ebp - 0x45], 0xfc
je 0x14ab7c
xor eax, eax
mov dword [0x251220], eax
lea eax, [ebp - 0x184]
mov edx, 0x14c7c4
call fcn.00013fb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x14abe1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x14b2e8
lea eax, [ebp - 0xfac]
mov edx, 0xb
call fcn.00013d3c
lea eax, [ebp - 0xf80]
call fcn.000143f0
lea eax, [ebp - 0xf7c]
mov edx, 3
call fcn.00013d3c
lea eax, [ebp - 0xf70]
call fcn.000143f0
lea eax, [ebp - 0xf6c]
mov edx, 3
call fcn.00013d3c
lea eax, [ebp - 0xf60]
call fcn.000143f0
lea eax, [ebp - 0xf5c]
mov edx, 0x13
call fcn.00013d3c
lea eax, [ebp - 0xf10]
mov edx, 2
call fcn.00014408
lea eax, [ebp - 0xf08]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0xf00]
mov edx, 2
call fcn.00014408
lea eax, [ebp - 0xef8]
call fcn.00013d18
lea eax, [ebp - 0xef4]
call fcn.000143f0
lea eax, [ebp - 0xef0]
call fcn.00013d18
lea eax, [ebp - 0xeec]
mov edx, 3
call fcn.00014408
lea eax, [ebp - 0xee0]
call fcn.00013d18
lea eax, [ebp - 0xedc]
mov edx, 2
call fcn.00014408
lea eax, [ebp - 0xed4]
mov edx, 3
call fcn.00013d3c
lea eax, [ebp - 0xec8]
call fcn.000143f0
lea eax, [ebp - 0xec4]
mov edx, 0x2a
call fcn.00013d3c
lea eax, [ebp - 0xe1c]
mov edx, 5
call fcn.00013d3c
lea eax, [ebp - 0xe08]
call fcn.000143f0
lea eax, [ebp - 0xe04]
mov edx, 3
call fcn.00013d3c
lea eax, [ebp - 0xdf8]
call fcn.000143f0
lea eax, [ebp - 0xdf4]
mov edx, 3
call fcn.00013d3c
lea eax, [ebp - 0xde8]
call fcn.000143f0
lea eax, [ebp - 0xde4]
call fcn.00013d18
lea eax, [ebp - 0xde0]
call fcn.000143f0
lea eax, [ebp - 0xddc]
mov edx, 0xc
call fcn.00013d3c
lea eax, [ebp - 0xdac]
mov edx, 0xc
call fcn.00014408
lea eax, [ebp - 0xd7c]
mov edx, 0xc
call fcn.00013d3c
lea eax, [ebp - 0xd4c]
call fcn.000143f0
lea eax, [ebp - 0xd48]
mov edx, 0xd
call fcn.00013d3c
lea eax, [ebp - 0xd14]
call fcn.000143f0
lea eax, [ebp - 0xd10]
mov edx, 8
call fcn.00013d3c
lea eax, [ebp - 0xcf0]
call fcn.000143f0
lea eax, [ebp - 0xcec]
mov edx, 0x17
call fcn.00013d3c
lea eax, [ebp - 0xc90]
call fcn.000143f0
lea eax, [ebp - 0xc8c]
call fcn.000143f0
lea eax, [ebp - 0xc88]
mov edx, 6
call fcn.00013d3c
lea eax, [ebp - 0xc70]
mov edx, 3
call fcn.00014408
lea eax, [ebp - 0xc64]
mov edx, 0xd
call fcn.00013d3c
lea eax, [ebp - 0xc30]
call fcn.000143f0
lea eax, [ebp - 0xc2c]
mov edx, 5
call fcn.00013d3c
lea eax, [ebp - 0xc18]
call fcn.000143f0
lea eax, [ebp - 0xc14]
mov edx, 6
call fcn.00013d3c
lea eax, [ebp - 0xbfc]
call fcn.000143f0
lea eax, [ebp - 0xaf8]
call fcn.00013d18
lea eax, [ebp - 0x9f4]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0x8ec]
mov edx, 4
call fcn.00013d3c
lea eax, [ebp - 0x8dc]
call fcn.000143f0
lea eax, [ebp - 0x8d8]
mov edx, 0xc
call fcn.00013d3c
lea eax, [ebp - 0x8a8]
mov edx, 6
call fcn.00014408
lea eax, [ebp - 0x890]
mov edx, 6
call fcn.00013d3c
lea eax, [ebp - 0x878]
mov edx, 2
call fcn.00014408
lea eax, [ebp - 0x870]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0x868]
call fcn.000143f0
lea eax, [ebp - 0x864]
call fcn.00013d18
lea eax, [ebp - 0x860]
mov edx, 6
call fcn.00014408
lea eax, [ebp - 0x848]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0x840]
call fcn.000143f0
lea eax, [ebp - 0x83c]
call fcn.00013d18
lea eax, [ebp - 0x838]
mov edx, 2
call fcn.00014408
lea eax, [ebp - 0x830]
mov edx, 0xd
call fcn.00013d3c
lea eax, [ebp - 0x7fc]
mov edx, 9
call fcn.00013d3c
lea eax, [ebp - 0x7d8]
call fcn.000143f0
lea eax, [ebp - 0x7d4]
mov edx, 4
call fcn.00013d3c
lea eax, [ebp - 0x7c4]
mov edx, 2
call fcn.00014408
lea eax, [ebp - 0x7bc]
call fcn.00013d18
lea eax, [ebp - 0x7b8]
call fcn.000143f0
lea eax, [ebp - 0x7b4]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0x7ac]
mov edx, 3
call fcn.00014408
lea eax, [ebp - 0x7a0]
mov edx, 4
call fcn.00013d3c
lea eax, [ebp - 0x790]
call fcn.000143f0
lea eax, [ebp - 0x78c]
mov edx, 4
call fcn.00013d3c
lea eax, [ebp - 0x77c]
mov edx, 2
call fcn.00014408
lea eax, [ebp - 0x774]
call fcn.00013d18
lea eax, [ebp - 0x770]
call fcn.000143f0
lea eax, [ebp - 0x76c]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0x764]
mov edx, 3
call fcn.00014408
lea eax, [ebp - 0x758]
mov edx, 0x1f
call fcn.00013d3c
lea eax, [ebp - 0x6dc]
mov edx, 3
call fcn.00014408
lea eax, [ebp - 0x6d0]
mov edx, 0x14
call fcn.00013d3c
lea eax, [ebp - 0x680]
call fcn.000143f0
lea eax, [ebp - 0x67c]
mov edx, 3
call fcn.00013d3c
lea eax, [ebp - 0x650]
call fcn.000143f0
lea eax, [ebp - 0x670]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0x668]
mov edx, 2
call fcn.00014408
lea eax, [ebp - 0x660]
mov edx, 4
call fcn.00013d3c
lea eax, [ebp - 0x644]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0x63c]
call fcn.000143f0
lea eax, [ebp - 0x638]
mov edx, 7
call fcn.00013d3c
lea eax, [ebp - 0x61c]
call fcn.000143f0
lea eax, [ebp - 0x618]
mov edx, 6
call fcn.00013d3c
lea eax, [ebp - 0x600]
mov edx, 2
call fcn.00014408
lea eax, [ebp - 0x5f8]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0x5f0]
call fcn.000143f0
lea eax, [ebp - 0x5ec]
mov edx, 7
call fcn.00013d3c
lea eax, [ebp - 0x5d0]
mov edx, 6
call fcn.00014408
lea eax, [ebp - 0x5b8]
call fcn.00013d18
lea eax, [ebp - 0x5b4]
mov edx, 3
call fcn.00014408
lea eax, [ebp - 0x5a8]
mov edx, 0x19
call fcn.00013d3c
lea eax, [ebp - 0x544]
call fcn.000143f0
lea eax, [ebp - 0x540]
mov edx, 0x1a
call fcn.00013d3c
lea eax, [ebp - 0x3d8]
call fcn.00013d18
lea eax, [ebp - 0x184]
call fcn.00013d18
lea eax, [ebp - 0x178]
call fcn.000143f0
lea eax, [ebp - 0x170]
call fcn.00013d18
lea eax, [ebp - 0x168]
call fcn.000143f0
lea eax, [ebp - 0x160]
call fcn.000143f0
lea eax, [ebp - 0x130]
call fcn.000143f0
lea eax, [ebp - 0x128]
call fcn.00013d18
lea eax, [ebp - 0x124]
call fcn.000143f0
lea eax, [ebp - 0x110]
call fcn.00013d18
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.00014408
lea eax, [ebp - 0xfc]
call fcn.00013d18
lea eax, [ebp - 0xec]
call fcn.00013d18
lea eax, [ebp - 0xe8]
call fcn.000143f0
lea eax, [ebp - 0xe4]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0xdc]
mov edx, 3
call fcn.00014408
lea eax, [ebp - 0xc4]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0xb4]
mov edx, 2
call fcn.00014408
lea eax, [ebp - 0x98]
call fcn.000143f0
lea eax, [ebp - 0x90]
call fcn.00013d18
lea eax, [ebp - 0x88]
call fcn.000143f0
lea eax, [ebp - 0x74]
call fcn.00013d18
lea eax, [ebp - 0x54]
mov edx, 2
call fcn.00014408
lea eax, [ebp - 0x4c]
call fcn.00013d18
lea eax, [ebp - 0x44]
call fcn.000143f0
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00014408
lea eax, [ebp - 0x2c]
call fcn.000143f0
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00013d3c
ret