Function at 0x1004dbdb
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006d78f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x25c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
and dword [ebp - 0x1c], 0
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1004ed59
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x150], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x114]
movzx eax, byte [eax]
test eax, eax
je 0x1004ecd9
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xf4]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1004dc6c
jmp 0x1004ed95
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0x28]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
cmp dword [eax], 0x4550
je 0x1004dc8b
jmp 0x1004ed95
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x44]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp dword [eax + 4], 0
jne 0x1004dca9
jmp 0x1004ed95
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x44]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x44]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xd8], 0x247f
mov dword [ebp - 0x13c], 0x10008bec
cmp dword [ebp - 0xd8], 0x279e
jle 0x1004de00
and dword [ebp - 0xac], 0
jmp 0x1004dcfb
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x21ec
jge 0x1004ddeb
and dword [ebp - 0xbc], 0
jmp 0x1004dd21
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0x31a
jge 0x1004dde6
and dword [ebp - 0xc4], 0
jmp 0x1004dd47
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x79bb
jge 0x1004dde1
and dword [ebp - 0xa8], 0
jmp 0x1004dd6d
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x5009
jge 0x1004dddc
mov eax, dword [ebp - 0xac]
add eax, dword [ebp - 0xbc]
sub eax, dword [ebp - 0xc4]
or eax, dword [ebp - 0xa8]
cdq
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], edx
push dword [ebp - 0x128]
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x224]
call fcn.1000a23e
pop ecx
pop ecx
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x134]
call fcn.1001e67c
push eax
call fcn.1005556f
pop ecx
lea ecx, [ebp - 0x224]
call fcn.1001e672
jmp 0x1004dd60
jmp 0x1004dd3a
jmp 0x1004dd14
jmp 0x1004dcee
push 0x112
push 0x1af6
push 0x2049
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push 0x792c
push 1
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0xe8]
push eax
push 0x12f1
lea eax, [ebp - 0x20]
push eax
push 0x5cd8
lea eax, [ebp - 0x44]
push eax
push 1
push 0x2fe5
push 0x4081
push 0x2690
push 0x4e22
call fcn.1004c818
add esp, 0x34
and dword [ebp - 4], 0
cmp dword [ebp - 0xd8], 0x23cf
jge 0x1004de5e
push dword [ebp - 0x13c]
call fcn.1005556f
pop ecx
jmp 0x1004de7a
or dword [ebp - 4], 0xffffffff
jmp 0x1004de84
cmp dword [ebp - 0x20], 0
jne 0x1004de8f
jmp 0x1004ed95
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax]
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x18], ecx
xor ecx, ecx
call fcn.100494c8
push eax
call fcn.10055f09
pop ecx
mov byte [ebp - 0x90], 7
mov byte [ebp - 0x8f], 6
mov byte [ebp - 0x8e], 2
mov byte [ebp - 0x8d], 1
mov byte [ebp - 0x8c], 8
mov byte [ebp - 0x8b], 7
mov byte [ebp - 0x8a], 5
mov byte [ebp - 0x89], 1
mov byte [ebp - 0x88], 1
mov byte [ebp - 0x87], 4
mov byte [ebp - 0x86], 0
mov byte [ebp - 0x85], 4
mov byte [ebp - 0x84], 9
mov byte [ebp - 0x83], 1
mov byte [ebp - 0x82], 4
mov byte [ebp - 0x81], 8
mov byte [ebp - 0x80], 4
mov byte [ebp - 0x7f], 0x6b
mov byte [ebp - 0x7e], 0x8b
mov byte [ebp - 0x7d], 0x7b
mov byte [ebp - 0x7c], 0x1f
mov byte [ebp - 0x7b], 6
mov byte [ebp - 0x7a], 9
mov byte [ebp - 0x79], 3
mov byte [ebp - 0x78], 6
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x90]
or eax, 0x30
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x90]
and ecx, 0x30
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x90]
mov byte [ebp + ecx - 0x110], al
mov dword [ebp - 0x2c], 2
and dword [ebp - 0xa4], 0
jmp 0x1004df90
mov eax, dword [ebp - 0x2c]
inc eax
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x19
jae 0x1004e05e
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x90]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x2c], eax
jne 0x1004dfda
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x90]
inc eax
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x90]
mov ecx, dword [ebp - 0x2c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x2c], eax
jmp 0x1004df88
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x8f]
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0xa4]
movzx ecx, byte [ebp + ecx - 0x92]
movsx ecx, byte [ebp + ecx - 0x110]
or eax, ecx
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x8f]
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0xa4]
movzx edx, byte [ebp + edx - 0x92]
movsx edx, byte [ebp + edx - 0x110]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x90]
mov byte [ebp + ecx - 0x110], al
push 0x1601
push 0x284c
push 1
push 1
push 0
lea eax, [ebp - 0xa4]
push eax
call fcn.1004c14b
add esp, 0x18
jmp 0x1004df88
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x110], 0
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x26c]
call fcn.1001e845
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 4], 2
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x14c]
call fcn.1004948d
pop ecx
mov dword [ebp - 0x124], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x26c]
call fcn.1001e868
and dword [ebp - 0xb4], 0
jmp 0x1004e0d2
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xb
jae 0x1004e0eb
mov eax, dword [ebp - 0xb4]
mov byte [ebp + eax - 0x110], 0
jmp 0x1004e0c5
mov byte [ebp - 0x60], 9
mov byte [ebp - 0x5f], 0x37
mov byte [ebp - 0x5e], 8
mov byte [ebp - 0x5d], 0
mov byte [ebp - 0x5c], 2
mov byte [ebp - 0x5b], 7
mov byte [ebp - 0x5a], 0
mov byte [ebp - 0x59], 6
mov byte [ebp - 0x58], 3
mov byte [ebp - 0x57], 3
mov byte [ebp - 0x56], 1
mov byte [ebp - 0x55], 4
mov byte [ebp - 0x54], 7
mov byte [ebp - 0x53], 0
mov byte [ebp - 0x52], 6
mov byte [ebp - 0x51], 0xf
mov byte [ebp - 0x50], 4
mov byte [ebp - 0x4f], 0xd
mov byte [ebp - 0x4e], 5
mov byte [ebp - 0x4d], 5
mov byte [ebp - 0x4c], 3
mov byte [ebp - 0x4b], 0xd8
mov byte [ebp - 0x4a], 0xc1
mov byte [ebp - 0x49], 0xd6
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x60]
or eax, 7
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x60]
and ecx, 7
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x60]
mov byte [ebp + ecx - 0x104], al
mov dword [ebp - 0x24], 2
and dword [ebp - 0x68], 0
jmp 0x1004e190
mov eax, dword [ebp - 0x24]
inc eax
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x18
jae 0x1004e241
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x60]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x24], eax
jne 0x1004e1ce
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x60]
inc eax
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x60]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x24], eax
jmp 0x1004e188
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x5f]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x68]
movzx ecx, byte [ebp + ecx - 0x62]
movsx ecx, byte [ebp + ecx - 0x104]
add eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x5f]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x68]
movzx edx, byte [ebp + edx - 0x62]
movsx edx, byte [ebp + edx - 0x104]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x5f]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x68]
movzx edx, byte [ebp + edx - 0x62]
movsx edx, byte [ebp + edx - 0x104]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x60]
mov byte [ebp + ecx - 0x104], al
and dword [ebp - 0x68], 0
jmp 0x1004e188
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x104], 0
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x254]
call fcn.1001e845
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 4], 3
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x11c]
call fcn.1004948d
pop ecx
mov dword [ebp - 0x170], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x254]
call fcn.1001e868
and dword [ebp - 0x9c], 0
jmp 0x1004e2b5
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xb
jae 0x1004e2ce
mov eax, dword [ebp - 0x9c]
mov byte [ebp + eax - 0x104], 0
jmp 0x1004e2a8
push dword [ebp - 0x170]
push dword [ebp - 0x124]
call fcn.1004a515
pop ecx
pop ecx
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 0x44]
push eax
push 0x5f8b
push 1
push 0x43f9
push 0xb1d
push 1
lea eax, [ebp - 0xe0]
push eax
push 0
call fcn.1004bf19
add esp, 0x20
push 0xf
push 5
call fcn.1004a515
pop ecx
pop ecx
add eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 4], eax
and dword [ebp - 0x70], 0
push 0
push 1
push 0x432
push 0x7430
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x70]
push eax
push 0x3236
call fcn.1004dbdb
add esp, 0x1c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x14]
sub eax, dword [ebp - 0x70]
mov dword [ebp - 0x48], eax
and dword [ebp - 0x74], 0
jmp 0x1004e36f
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x48]
jge 0x1004e44c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + 0x14]
sub eax, dword [ecx + 0x18]
cmp dword [ebp - 0x74], eax
jae 0x1004e3ca
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x4ff0
push 1
push 1
push 0x433c
push 0x7b3a
push 0x40f6
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x3b55
call fcn.1004bc7e
add esp, 0x30
jmp 0x1004e3f5
push 0x3ca6
push 1
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0xe8]
push eax
push 0x13a2
push 1
push 0x4d3
push 1
call fcn.1004cb33
add esp, 0x20
lea eax, [ebp - 0xd0]
push eax
push 0x1d69
lea eax, [ebp - 0x14]
push eax
push 0x53e6
push 0x3350
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push 1
push 0x641a
push 1
call fcn.1004bdba
add esp, 0x28
push 0x447c
push 1
push 0x1ab8
lea eax, [ebp - 0x14]
push eax
push 1
push 0x32db
call fcn.1004cc25
add esp, 0x18
jmp 0x1004e368
push 0x1d0c
push 0x496a
push 0x24d1
push 0x2f04
push 1
push 0x762d
push 0x21a9
lea eax, [ebp - 0x70]
push eax
push 0x7a94
push 1
push 0
push 0x317b
push 0x1347
lea eax, [ebp - 0x18]
push eax
push 0x2d08
call fcn.1004d833
add esp, 0x3c
push 0x7fbb
push 1
push 0
lea eax, [ebp - 0x48]
push eax
push 0x50fe
lea eax, [ebp - 0x18]
push eax
push 0x7162
push 0x49b8
push 0x30a6
lea eax, [ebp - 0x70]
push eax
call fcn.1004c70e
add esp, 0x28
and dword [ebp - 0xc8], 0
jmp 0x1004e4db
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x48]
jge 0x1004e530
push 0x4865
lea eax, [ebp - 0x20]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
push 1
push 0x5dc5
push 1
call fcn.1004bf19
add esp, 0x20
push 0x6041
push 0x1ee6
push 0x1494
push 0
push 1
push 0x5a9b
lea eax, [ebp - 0x14]
push eax
call fcn.1004c9a3
add esp, 0x1c
jmp 0x1004e4ce
lea eax, [ebp - 0x48]
push eax
push 0x4011
push 0x3039
lea eax, [ebp - 0x18]
push eax
push 0x5239
push 1
push 0x2bfe
push 0
lea eax, [ebp - 0x14]
push eax
push 0x5853
push 0x2e42
push 0x2958
call fcn.1004cce0
add esp, 0x30
push 1
push 0x4062
push 1
push 0x7e1a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x70]
push eax
push 0x2bff
push 0x5f4e
call fcn.1004ce1a
add esp, 0x20
and dword [ebp - 0xb8], 0
jmp 0x1004e5a9
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x48]
jge 0x1004e602
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0xb8]
lea eax, [ecx + eax*2]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x28]
mov ax, word [esi + eax]
mov word [edx + ecx], ax
push 0x7933
push 1
push 0xc80
push 0x7a43
lea eax, [ebp - 0x14]
push eax
push 1
push 0x6058
push 0
call fcn.1004cb33
add esp, 0x20
jmp 0x1004e59c
mov eax, dword [ebp - 0x48]
shl eax, 1
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x24], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax + 0xc]
add ecx, dword [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x1c4]
call fcn.1001e845
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x1c4]
call fcn.1001e8b4
mov dword [ebp - 0xec], eax
push dword [ebp - 0xec]
mov eax, dword [ebp - 0xec]
shr eax, 1
push eax
call fcn.1004a515
pop ecx
pop ecx
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x40], 1
mov byte [ebp - 0x3f], 0x58
mov byte [ebp - 0x3e], 0
mov byte [ebp - 0x3d], 0x4a
mov byte [ebp - 0x3c], 1
mov byte [ebp - 0x3b], 0xf7
mov byte [ebp - 0x3a], 2
mov byte [ebp - 0x39], 0x42
mov byte [ebp - 0x38], 3
mov byte [ebp - 0x37], 0
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x40]
or eax, 0x3c
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x40]
and ecx, 0x3c
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x40]
mov byte [ebp + ecx - 0x98], al
mov dword [ebp - 0x30], 2
and dword [ebp - 0xb0], 0
jmp 0x1004e6cb
mov eax, dword [ebp - 0x30]
inc eax
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xa
jae 0x1004e789
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x40]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x30], eax
jne 0x1004e70c
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x40]
inc eax
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x40]
mov ecx, dword [ebp - 0x30]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x30], eax
jmp 0x1004e6c3
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x3f]
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0xb0]
movzx ecx, byte [ebp + ecx - 0x42]
movsx ecx, byte [ebp + ecx - 0x98]
or eax, ecx
mov ecx, dword [ebp - 0x30]
movzx ecx, byte [ebp + ecx - 0x3f]
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0xb0]
movzx edx, byte [ebp + edx - 0x42]
movsx edx, byte [ebp + edx - 0x98]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x30]
movzx ecx, byte [ebp + ecx - 0x40]
mov byte [ebp + ecx - 0x98], al
push 0x1e76
push 0x14b3
push 1
lea eax, [ebp - 0xb0]
push eax
push 0x2a36
push 0x1aa
push 1
call fcn.1004cf6c
add esp, 0x1c
jmp 0x1004e6c3
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x98], 0
cmp dword [ebp - 0x6c], 4
jle 0x1004e851
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x23c]
call fcn.1001e845
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x154], eax
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x1c]
or eax, 1
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x6c]
sub eax, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.1004b8d8
pop ecx
pop ecx
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x138], eax
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x1c]
or eax, 2
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x154]
mov edx, dword [ebp - 0x138]
lea ecx, [ebp - 0x1f4]
call fcn.1004f399
pop ecx
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x140], eax
mov dword [ebp - 4], 7
mov eax, dword [ebp - 0x1c]
or eax, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xdc], eax
jmp 0x1004e87d
push dword [ebp - 0x6c]
lea eax, [ebp - 0x1dc]
push eax
call fcn.1004b8d8
pop ecx
pop ecx
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x1c]
or eax, 8
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x148], eax
push dword [ebp - 0x148]
lea ecx, [ebp - 0x1ac]
call fcn.1004ef4b
mov dword [ebp - 4], 8
mov eax, dword [ebp - 0x1c]
and eax, 8
je 0x1004e8b8
and dword [ebp - 0x1c], 0xfffffff7
lea ecx, [ebp - 0x1dc]
call fcn.1001e868
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x1c]
and eax, 4
je 0x1004e8d3
and dword [ebp - 0x1c], 0xfffffffb
lea ecx, [ebp - 0x1f4]
call fcn.1001e868
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x1c]
and eax, 2
je 0x1004e8ee
and dword [ebp - 0x1c], 0xfffffffd
lea ecx, [ebp - 0x20c]
call fcn.1001e868
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x1c]
and eax, 1
je 0x1004e909
and dword [ebp - 0x1c], 0xfffffffe
lea ecx, [ebp - 0x23c]
call fcn.1001e868
and dword [ebp - 0xc0], 0
jmp 0x1004e91f
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 5
jae 0x1004e938
mov eax, dword [ebp - 0xc0]
mov byte [ebp + eax - 0x98], 0
jmp 0x1004e912
push 0x4ca9
push 1
lea eax, [ebp - 0x18]
push eax
push 1
push 0x6cb5
push 0x6bb
lea eax, [ebp - 0x14]
push eax
call fcn.1004c05a
add esp, 0x1c
push 0
push dword [ebp - 0x6c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax + 0xc]
add ecx, dword [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x1ac]
call fcn.1004ef93
lea eax, [ebp - 0x14]
push eax
push 1
push 0x49f5
push 0x43aa
push 0x228c
push 0x791c
lea eax, [ebp - 0x6c]
push eax
push 0x48e9
push 0
push 0x5d07
push 0x3ea8
push 0x631c
push 0x13ff
call fcn.1004c818
add esp, 0x34
push 0x933
push 0x2952
push 0x543b
push 1
push 1
lea eax, [ebp - 0x14]
push eax
push 0x5e2f
lea eax, [ebp - 0x20]
push eax
push 0x62bd
lea eax, [ebp - 0x28]
push eax
push 1
push 0x1630
push 0x539f
push 0x3aea
call fcn.1004d220
add esp, 0x38
lea eax, [ebp - 0x14]
push eax
push 0x6d9d
push 1
push 1
push 1
push 0x2065
call fcn.1004c14b
add esp, 0x18
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x18], 0
jbe 0x1004ea75
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x18]
xor edx, edx
div dword [ecx + 0x18]
cmp eax, 0xc
jbe 0x1004ea49
mov dword [ebp - 0xf0], 0xc
jmp 0x1004ea67
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x18]
xor edx, edx
div dword [ecx + 0x18]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xe4], eax
jmp 0x1004ea7c
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xf8], eax
and dword [ebp - 0xa0], 0
jmp 0x1004ea9e
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xa0]
cmp ecx, dword [eax + 0x18]
jae 0x1004ec13
push dword [ebp - 0xf8]
mov eax, dword [ebp - 0xf8]
cdq
sub eax, edx
sar eax, 1
push eax
call fcn.1004a515
pop ecx
pop ecx
mov dword [ebp - 0xcc], eax
push dword [ebp - 0xcc]
lea eax, [ebp - 0x194]
push eax
call fcn.1004b8d8
pop ecx
pop ecx
mov byte [ebp - 4], 0xc
push 0xb58
push 0x3d30
lea eax, [ebp - 0x18]
push eax
push 0x1195
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0xa0]
push eax
push 0
push 0x1381
lea eax, [ebp - 0x14]
push eax
push 0x5cd1
lea eax, [ebp - 0x28]
push eax
call fcn.1004cce0
add esp, 0x30
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0xcc]
push eax
push 1
push 0x6821
push 0x3c73
push 0x276a
push 0x27ea
push 1
push 1
push 0x6ba0
push 0x69bd
push 0x6807
lea eax, [ebp - 0x14]
push eax
call fcn.1004d833
add esp, 0x3c
push 0x4d2a
lea eax, [ebp - 0x14]
push eax
push 0x7d24
push 1
lea eax, [ebp - 0xcc]
push eax
push 0x34ba
push 0x734b
push 0x4c93
push 0x5385
push 1
push 1
call fcn.1004c285
add esp, 0x2c
push 0x225b
push 0x821
push 0x1518
push 1
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x4ca5
lea eax, [ebp - 0x14]
push eax
push 0xab0
push 1
push 0x7939
push 0x16b9
call fcn.1004c5da
add esp, 0x30
push 1
push 0x6fb9
push 0x3aac
lea eax, [ebp - 0x14]
push eax
push 0x360e
push 1
call fcn.1004d9f7
add esp, 0x18
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x194]
call fcn.1001e868
jmp 0x1004ea91
and dword [ebp - 0x64], 0
jmp 0x1004ec20
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 4]
sub eax, ecx
cmp dword [ebp - 0x64], eax
jae 0x1004ec71
push 0x1dfe
push 0x7e4a
lea eax, [ebp - 0x64]
push eax
push 0x2e6
lea eax, [ebp - 0x20]
push eax
push 1
push 0x7a76
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x6ed9
push 0x701f
call fcn.1004d005
add esp, 0x30
jmp 0x1004ec19
push 0x6a29
push 0x1f19
push 0x14cf
push 0x7014
push 1
push 0x7f4
push 0x51c9
push 0xad1
push 0x1740
push 0
push 1
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x4e0e
push 0x2a40
call fcn.1004d833
add esp, 0x3c
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1ac]
call fcn.1001e868
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c4]
call fcn.1001e868
jmp 0x1004ed57
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
cmp dword [eax + 0x18], 0
jbe 0x1004ed57
push 0x372d
push 0x7712
push dword [ebp - 0x178]
push 0
push 1
push 0x6007
push 0x713b
push 0x2d08
push 0x46fe
push 0x6839
push 0x1baf
push dword [ebp - 0xd4]
call fcn.1004bc7e
add esp, 0x30
jmp 0x1004ed95
mov eax, dword [ebp + 8]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x160], eax
push 0x4e07
push 0x10fc
push 0x5e51
push dword [ebp - 0x160]
push dword [ebp - 0x118]
push 0
push 0x2013
call fcn.1004bd8c
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret