Function at 0x40c63b
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a5fc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1fbc
call fcn.004a2460
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x41acc9
mov eax, dword [ebp + 8]
mov dword [ebp - 0xfe4], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10a0], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xfec], eax
mov eax, dword [ebp - 0x10a0]
movzx eax, byte [eax]
test eax, eax
je 0x41ab1d
mov dword [ebp - 0x104c], 0xf30cc2fd
mov dword [ebp - 0xe58], 0x9f7c8b16
mov dword [ebp - 0xe40], 0xa8551b32
mov dword [ebp - 0x18b8], 0
mov dword [ebp - 0x76c], 0xffff
mov dword [ebp - 0x27c], 0
jmp 0x40c6e7
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 1
jge 0x40c703
mov eax, dword [ebp - 0x27c]
mov dword [ebp + eax*4 - 0x724], 0xecbfcf41
jmp 0x40c6da
lea eax, [ebp - 0x104c]
push eax
lea edx, [ebp - 0xe58]
lea ecx, [ebp - 0xe40]
call fcn.0041d718
pop ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x724], 0
je 0x40c741
mov eax, 0x9063
test eax, eax
je 0x40c741
mov dword [ebp - 0x968], 1
jmp 0x40c748
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x76c]
dec eax
mov dword [ebp - 0x76c], eax
mov eax, dword [ebp - 0x76c]
cmp eax, dword [ebp - 0x968]
jg 0x40c76f
mov dword [ebp - 0xe48], 1
jmp 0x40c776
and dword [ebp - 0xe48], 0
mov eax, dword [ebp - 0xe40]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x724]
imul ecx, dword [ebp - 0xe48]
lea eax, [eax + ecx + 0x4e627738]
cmp eax, 0x2398
jg 0x40c7aa
mov dword [ebp - 0xe50], 1
jmp 0x40c7b1
and dword [ebp - 0xe50], 0
cmp dword [ebp - 0xe50], 0xd8d9
jge 0x40c7c9
mov dword [ebp - 0xe60], 1
jmp 0x40c7d0
and dword [ebp - 0xe60], 0
mov eax, dword [ebp - 0xe58]
sub eax, 0xeb16
sub eax, dword [ebp - 0xe60]
je 0x40c7fa
mov dword [ebp - 0x1054], 1
lea ecx, [ebp - 0x1054]
call fcn.0041d6c9
jmp 0x40c817
mov dword [ebp - 0x105c], 0x38e21363
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x724]
mov dword [ebp - 0x105c], eax
mov dword [ebp - 0xe68], 0x3619
mov dword [ebp - 0x1064], 0xa9aeb0
cmp dword [ebp - 0xe68], 0x36d2
jle 0x40c906
and dword [ebp - 0x284], 0
jmp 0x40c851
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0x41ce
jge 0x40c906
and dword [ebp - 0x49c], 0
jmp 0x40c877
mov eax, dword [ebp - 0x49c]
inc eax
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 0x4d18
jge 0x40c901
and dword [ebp - 0x28c], 0
jmp 0x40c899
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0x463b
jge 0x40c8fc
mov eax, dword [ebp - 0x284]
cdq
idiv dword [ebp - 0x49c]
imul edx, dword [ebp - 0x28c]
mov eax, edx
cdq
mov dword [ebp - 0x10b0], eax
mov dword [ebp - 0x10ac], edx
push dword [ebp - 0x10ac]
push dword [ebp - 0x10b0]
lea ecx, [ebp - 0x1d6c]
call fcn.00401e2f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041b4cc
push eax
call fcn.0048ee0a
pop ecx
lea ecx, [ebp - 0x1d6c]
call fcn.00401328
jmp 0x40c88c
jmp 0x40c86a
jmp 0x40c844
mov dword [ebp - 0x1428], 0xf30cc2fd
and dword [ebp - 4], 0
cmp dword [ebp - 0xe68], 0x3526
jge 0x40c92c
push dword [ebp - 0x1064]
call fcn.0048ee0a
pop ecx
jmp 0x40c948
or dword [ebp - 4], 0xffffffff
jmp 0x40c952
mov dword [ebp - 0x60], 0xfb770a77
mov dword [ebp - 0x7a4], 0xbacde9e8
mov dword [ebp - 0x108c], 0x4d64ea33
mov dword [ebp - 0x107c], 0xffffffff
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1ac4], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1834], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1a24], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x7a4], eax
jle 0x40c9b2
mov dword [ebp - 0xe70], 1
jmp 0x40c9b9
and dword [ebp - 0xe70], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0xe70], eax
jle 0x40ca4b
mov dword [ebp - 0x62c], 0
jmp 0x40c9e1
mov eax, dword [ebp - 0x62c]
inc eax
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 2
jge 0x40c9fd
mov eax, dword [ebp - 0x62c]
mov dword [ebp + eax*4 - 0x1c8c], 0xdf62
jmp 0x40c9d4
mov dword [ebp - 0x60], 0
jmp 0x40ca0d
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jg 0x40ca46
mov dword [ebp - 0x106c], 0x2e40
lea eax, [ebp - 0x106c]
push eax
push 0x37f
push 0x6afb
push 0x5d64
push 0
push 1
push 0x3b37
call fcn.0040adda
add esp, 0x1c
jmp 0x40ca06
jmp 0x40cb95
mov dword [ebp - 0x1084], 0xfffffffb
mov dword [ebp - 0xe78], 0x6308
mov dword [ebp - 0x1074], 0xa9af50
cmp dword [ebp - 0xe78], 0x6358
jle 0x40caec
and dword [ebp - 0x294], 0
jmp 0x40ca8b
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0x63e
jge 0x40caec
and dword [ebp - 0x4a4], 0
jmp 0x40caad
mov eax, dword [ebp - 0x4a4]
inc eax
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 0x6ec5
jge 0x40caea
mov eax, dword [ebp - 0x294]
add eax, dword [ebp - 0x4a4]
cdq
mov dword [ebp - 0x10bc], eax
mov dword [ebp - 0x10b8], edx
push dword [ebp - 0x10b8]
push dword [ebp - 0x10bc]
mov ecx, 0xab36e8
call fcn.0041b4f7
jmp 0x40caa0
jmp 0x40ca7e
mov dword [ebp - 0x1094], 0xffffffff
mov dword [ebp - 4], 2
cmp dword [ebp - 0xe78], 0x6107
jge 0x40cb1b
push dword [ebp - 0x1074]
push 0xab36e8
call fcn.0041cf47
pop ecx
pop ecx
jmp 0x40cb37
or dword [ebp - 4], 0xffffffff
jmp 0x40cb41
push 1
push 0x2044
lea eax, [ebp - 0x107c]
push eax
push 0x5e4c
push 0x2753
lea eax, [ebp - 0x7a4]
push eax
lea eax, [ebp - 0x1084]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x108c]
push eax
lea eax, [ebp - 0x1094]
push eax
push 0
call fcn.00402284
add esp, 0x2c
mov byte [ebp - 0x10a], 0
lea ecx, [ebp - 0x10a]
call fcn.0041d7be
mov dword [ebp - 0x894], 0x9f7c8b16
mov dword [ebp - 0x6ac], 0xd1e1e87d
mov dword [ebp - 0xe80], 0x3e11
mov dword [ebp - 0x109c], 0xa9aff0
cmp dword [ebp - 0xe80], 0x410a
jle 0x40ccac
and dword [ebp - 0x4ac], 0
jmp 0x40cbe3
mov eax, dword [ebp - 0x4ac]
inc eax
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 0x192a
jge 0x40ccac
and dword [ebp - 0x29c], 0
jmp 0x40cc09
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0x149e
jge 0x40cca7
and dword [ebp - 0x5ac], 0
jmp 0x40cc2f
mov eax, dword [ebp - 0x5ac]
inc eax
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x5ac], 0x3d2e
jge 0x40cca2
and dword [ebp - 0x2a4], 0
jmp 0x40cc51
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0x44ab
jge 0x40cca0
mov eax, dword [ebp - 0x29c]
cdq
idiv dword [ebp - 0x5ac]
mov eax, edx
cdq
idiv dword [ebp - 0x2a4]
add edx, dword [ebp - 0x4ac]
mov eax, edx
cdq
mov dword [ebp - 0x10c8], eax
mov dword [ebp - 0x10c4], edx
push dword [ebp - 0x10c4]
push dword [ebp - 0x10c8]
mov ecx, 0xab36e8
call fcn.0041b4f7
jmp 0x40cc44
jmp 0x40cc22
jmp 0x40cbfc
jmp 0x40cbd6
mov dword [ebp - 0x2ac], 0
jmp 0x40ccc5
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 3
jge 0x40cce1
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0x1cb8], 0xfffffff9
jmp 0x40ccb8
mov dword [ebp - 4], 4
cmp dword [ebp - 0xe80], 0x3ac7
jge 0x40cd06
push dword [ebp - 0x109c]
push 0xab36e8
call fcn.0041cf47
pop ecx
pop ecx
jmp 0x40cd22
or dword [ebp - 4], 0xffffffff
jmp 0x40cd2c
mov dword [ebp - 0x6ac], 0
jmp 0x40cd45
mov eax, dword [ebp - 0x6ac]
inc eax
mov dword [ebp - 0x6ac], eax
cmp dword [ebp - 0x6ac], 2
jg 0x40cd9f
mov dword [ebp - 0xebc], 0xea6801fc
mov dword [ebp - 0x10a4], 0xf7d65121
cmp dword [ebp - 0xebc], 0
je 0x40cd6d
jmp 0x40cd9f
push 1
push 0
push 0x273
lea eax, [ebp - 0x10a4]
push eax
push 0x3aa4
push 0xcf8
lea eax, [ebp - 0xebc]
push eax
push 0x1155
push 1
call fcn.00405ea2
add esp, 0x24
jmp 0x40cd38
mov dword [ebp - 0xd74], 0xa8551b32
push 3
lea ecx, [ebp - 0xee4]
call fcn.0041b63b
mov dword [ebp - 0xec4], 0x5eaf
mov dword [ebp - 0x13e0], 0xa9b04c
cmp dword [ebp - 0xec4], 0x6228
jle 0x40ceb6
and dword [ebp - 0x5b4], 0
jmp 0x40cdf0
mov eax, dword [ebp - 0x5b4]
inc eax
mov dword [ebp - 0x5b4], eax
cmp dword [ebp - 0x5b4], 0x7cae
jge 0x40ceb6
and dword [ebp - 0x2b4], 0
jmp 0x40ce16
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0x2684
jge 0x40ceb1
and dword [ebp - 0x4b4], 0
jmp 0x40ce3c
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 0x3c31
jge 0x40ceac
and dword [ebp - 0x2bc], 0
jmp 0x40ce5e
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0x2b4d
jge 0x40ceaa
mov ecx, dword [ebp - 0x2b4]
imul ecx, dword [ebp - 0x4b4]
add ecx, dword [ebp - 0x2bc]
mov eax, dword [ebp - 0x5b4]
sar eax, cl
cdq
mov dword [ebp - 0x10d4], eax
mov dword [ebp - 0x10d0], edx
push dword [ebp - 0x10d0]
push dword [ebp - 0x10d4]
mov ecx, 0xab36e8
call fcn.0041b4f7
jmp 0x40ce51
jmp 0x40ce2f
jmp 0x40ce09
jmp 0x40cde3
mov dword [ebp - 0x183c], 5
mov dword [ebp - 4], 6
cmp dword [ebp - 0xec4], 0x5ce5
jge 0x40cee5
push dword [ebp - 0x13e0]
push 0xab36e8
call fcn.0041cf47
pop ecx
pop ecx
jmp 0x40cf01
or dword [ebp - 4], 0xffffffff
jmp 0x40cf0b
mov dword [ebp - 0xbc], 0xffffffff
mov dword [ebp - 0x7fc], 1
mov dword [ebp - 0xb8c], 0xfffffff8
push 0
lea eax, [ebp - 0xee4]
push eax
lea eax, [ebp - 0x1ec]
push eax
push 0x6295
push 0
call fcn.00407421
add esp, 0x14
mov dword [ebp - 0x1ec], 0
jmp 0x40cf61
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 2
jge 0x40cf7d
mov eax, dword [ebp - 0x1ec]
mov dword [ebp + eax*4 - 0xf50], 0x38591b6
jmp 0x40cf54
push 2
lea ecx, [ebp - 0xee4]
call fcn.00401332
cmp dword [eax], 0x4b811476
jl 0x40cf9e
mov dword [ebp - 0xe38], 1
jmp 0x40cfa5
and dword [ebp - 0xe38], 0
push 0
lea ecx, [ebp - 0xee4]
call fcn.00401332
mov eax, dword [eax]
sub eax, 0xeb98
mov dword [ebp - 0xecc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xecc]
mov dword [ebp + eax - 0xf50], ecx
push 2
lea ecx, [ebp - 0xee4]
call fcn.00401332
mov eax, dword [eax]
cmp eax, dword [ebp - 0xecc]
jge 0x40cff5
mov dword [ebp - 0xed4], 1
jmp 0x40cffc
and dword [ebp - 0xed4], 0
push 2
lea ecx, [ebp - 0xee4]
call fcn.00401332
mov eax, dword [eax]
cmp eax, dword [ebp - 0xed4]
jne 0x40d01f
mov dword [ebp - 0x7f4], 1
jmp 0x40d026
and dword [ebp - 0x7f4], 0
cmp dword [ebp - 0x7f4], 0xa9b6
jge 0x40d03e
mov dword [ebp - 0xe34], 1
jmp 0x40d045
and dword [ebp - 0xe34], 0
mov eax, dword [ebp - 0xe38]
add eax, dword [ebp - 0xe34]
je 0x40d12a
mov dword [ebp - 0x1b00], 0
mov dword [ebp - 0x1844], 2
mov dword [ebp - 0x1a2c], 4
mov dword [ebp - 0x184c], 0xffffffff
mov dword [ebp - 0x1acc], 1
mov dword [ebp - 0x1854], 0xb3847d22
mov dword [ebp - 0x1a34], 0xf86f25db
mov dword [ebp - 0x185c], 1
mov dword [ebp - 0x1b18], 0xfffffffa
mov dword [ebp - 0x1864], 0x11d7feae
mov dword [ebp - 0x1a3c], 0xffffffff
mov dword [ebp - 0x186c], 0x8f49235
mov dword [ebp - 0x80], 0
jmp 0x40d0df
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x40d0f5
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x1f9c], 1
jmp 0x40d0d8
mov dword [ebp - 0x80], 0
jmp 0x40d105
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x40d11b
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x1d18], 1
jmp 0x40d0fe
mov eax, dword [ebp - 0x7fc]
dec eax
mov dword [ebp - 0x7fc], eax
jmp 0x40d16b
mov dword [ebp - 0x13e8], 5
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x40d153
push 0
push 0x974
call dword [0xab60dc]
lea eax, [ebp - 0x13e8]
push eax
push 0
push 0
push 0x27ee
call fcn.0040a5f0
add esp, 0x10
mov dword [ebp - 0xbc], 1
jmp 0x40d184
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x40d2ac
push 4
lea ecx, [ebp - 0x1468]
call fcn.0041b63b
push 0
push 1
lea eax, [ebp - 0x1ad4]
push eax
push 0x5634
push 0x4c34
push 0x5726
push 0x22e9
lea eax, [ebp - 0x1468]
push eax
push 0
call fcn.00405ea2
add esp, 0x24
push dword [ebp - 0xbc]
lea ecx, [ebp - 0xee4]
call fcn.00401332
mov eax, 0x376e
cmp eax, 0x2ffa
jle 0x40d1f7
mov dword [ebp - 0x804], 1
jmp 0x40d1fe
and dword [ebp - 0x804], 0
mov dword [ebp - 0xb8c], 0x5b7518db
mov esi, dword [ebp - 0xb8c]
push dword [ebp - 0xbc]
lea ecx, [ebp - 0xee4]
call fcn.00401332
cmp esi, dword [eax]
jg 0x40d22f
mov dword [ebp - 0xd54], 1
jmp 0x40d236
and dword [ebp - 0xd54], 0
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp + eax*4 - 0xf50]
sub eax, dword [ebp - 0x804]
add eax, dword [ebp - 0xd54]
mov ecx, dword [ebp - 0xbc]
mov dword [ebp + ecx*4 - 0xf50], eax
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xf50]
neg esi
push 2
lea ecx, [ebp - 0x1468]
call fcn.00401332
mov dword [eax], esi
push 2
lea ecx, [ebp - 0x1468]
call fcn.00401332
cmp dword [eax], 0
je 0x40d29c
lea ecx, [ebp - 0x1468]
call fcn.0041b70d
jmp 0x40d177
lea ecx, [ebp - 0x1468]
call fcn.0041b70d
jmp 0x40d177
lea ecx, [ebp - 0xee4]
call fcn.0041b70d
mov dword [ebp - 0x1874], 0
mov dword [ebp - 0x774], 0xffff
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x15c], 0xbc40ed3c
mov dword [ebp - 0x2c4], 0
jmp 0x40d2f5
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 2
jge 0x40d311
mov eax, dword [ebp - 0x2c4]
mov dword [ebp + eax*4 - 0x1bc], 0x43cdf98a
jmp 0x40d2e8
mov dword [ebp - 0xb9c], 0x3254
mov dword [ebp - 0x13f0], 0xa9b088
cmp dword [ebp - 0xb9c], 0x33f7
jle 0x40d44b
push 0
push 0x104e
push 0x104f
push 0x2181
call dword [0xab60e8]
and dword [ebp - 0x634], 0
jmp 0x40d362
mov eax, dword [ebp - 0x634]
inc eax
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 0x3734
jge 0x40d44b
and dword [ebp - 0x4bc], 0
jmp 0x40d388
mov eax, dword [ebp - 0x4bc]
inc eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 0x2c09
jge 0x40d446
and dword [ebp - 0x2cc], 0
jmp 0x40d3ae
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0x3c0
jge 0x40d441
and dword [ebp - 0x2d4], 0
jmp 0x40d3d4
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0x662a
jge 0x40d43c
mov eax, dword [ebp - 0x4bc]
imul eax, dword [ebp - 0x2cc]
add eax, dword [ebp - 0x634]
mov ecx, dword [ebp - 0x2d4]
shl eax, cl
cdq
mov dword [ebp - 0x10e0], eax
mov dword [ebp - 0x10dc], edx
push dword [ebp - 0x10dc]
push dword [ebp - 0x10e0]
lea ecx, [ebp - 0x1e80]
call fcn.00401e2f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041b4cc
push eax
call fcn.0048ee0a
pop ecx
lea ecx, [ebp - 0x1e80]
call fcn.00401328
jmp 0x40d3c7
jmp 0x40d3a1
jmp 0x40d37b
jmp 0x40d355
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1bc]
mov dword [ebp - 0x1a48], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1bc]
mov dword [ebp - 0x187c], eax
cmp dword [ebp - 0x4c], 0
je 0x40d48c
cmp dword [ebp - 0x15c], 0
je 0x40d48c
mov dword [ebp - 0x80c], 1
jmp 0x40d493
and dword [ebp - 0x80c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1bc]
cmp eax, dword [ebp - 0x80c]
jl 0x40d4b4
mov dword [ebp - 0xb94], 1
jmp 0x40d4bb
and dword [ebp - 0xb94], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1bc]
cmp dword [ebp - 0xb94], eax
jl 0x40d4dc
mov dword [ebp - 0x814], 1
jmp 0x40d4e3
and dword [ebp - 0x814], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1bc]
cmp eax, dword [ebp - 0x814]
jge 0x40d504
mov dword [ebp - 0xeb0], 1
jmp 0x40d50b
and dword [ebp - 0xeb0], 0
mov eax, dword [ebp - 0xeb0]
inc eax
je 0x40d529
cmp dword [ebp - 0x15c], 0
je 0x40d529
mov dword [ebp - 0x81c], 1
jmp 0x40d530
and dword [ebp - 0x81c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x81c]
mov dword [ebp + eax - 0x1bc], ecx
mov dword [ebp - 4], 8
cmp dword [ebp - 0xb9c], 0x3149
jge 0x40d562
push dword [ebp - 0x13f0]
call fcn.0048ee0a
pop ecx
jmp 0x40d57e
or dword [ebp - 4], 0xffffffff
jmp 0x40d588
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bc]
mov dword [ebp - 0x1b08], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bc]
mov dword [ebp - 0x1884], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1bc], 0xfffb
jae 0x40d5cd
mov dword [ebp - 0x824], 1
jmp 0x40d5d4
and dword [ebp - 0x824], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x1bc]
cmp dword [ebp + eax - 0x1bc], ecx
jl 0x40d5fc
mov dword [ebp - 0xd5c], 1
jmp 0x40d603
and dword [ebp - 0xd5c], 0
mov eax, dword [ebp - 0x824]
add eax, dword [ebp - 0xd5c]
je 0x40d88a
mov dword [ebp - 0x15c], 0
jmp 0x40d62e
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0x13
jle 0x40d885
mov dword [ebp - 0x4c], 0x10
jmp 0x40d64b
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x30
je 0x40d880
mov dword [ebp - 0x82c], 0x64fe
mov dword [ebp - 0x13f8], 0xa9b118
cmp dword [ebp - 0x82c], 0x65f1
jle 0x40d6ec
and dword [ebp - 0x4c4], 0
jmp 0x40d68b
mov eax, dword [ebp - 0x4c4]
inc eax
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 0x8f1
jge 0x40d6ec
and dword [ebp - 0x2dc], 0
jmp 0x40d6ad
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0x5d44
jge 0x40d6ea
mov eax, dword [ebp - 0x4c4]
sub eax, dword [ebp - 0x2dc]
cdq
mov dword [ebp - 0x10ec], eax
mov dword [ebp - 0x10e8], edx
push dword [ebp - 0x10e8]
push dword [ebp - 0x10ec]
mov ecx, 0xab36e8
call fcn.0041b4f7
jmp 0x40d6a0
jmp 0x40d67e
push 3
lea ecx, [ebp - 0x1478]
call fcn.0041b63b
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x82c], 0x614d
jge 0x40d71e
push dword [ebp - 0x13f8]
push 0xab36e8
call fcn.0041cf47
pop ecx
pop ecx
jmp 0x40d73a
or dword [ebp - 4], 0xffffffff
jmp 0x40d744
push 0x174e
push 0
push 0
push 0x5c94
push 0x3553
push 0x1c5a
push 0xb07
lea eax, [ebp - 0x1478]
push eax
lea eax, [ebp - 0x1a54]
push eax
call fcn.004081ac
add esp, 0x24
push 0
lea ecx, [ebp - 0x1478]
call fcn.00401332
mov dword [eax], 0xffffffe6
jmp 0x40d7b0
push 0
lea ecx, [ebp - 0x1478]
call fcn.00401332
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0xba4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xba4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1478]
call fcn.00401332
cmp dword [eax], 0xe
je 0x40d870
mov dword [ebp - 0x5bc], 0x5d580090
mov byte [ebp - 0x145], 0
movzx eax, byte [ebp - 0x145]
test eax, eax
je 0x40d80e
push 0
push 0
push 0x5306
push 0x6c47
push 1
push 0x2479
push 0x2a09
push 0x34a8
push 0x5af7
call fcn.004070df
add esp, 0x24
mov dword [ebp - 0x5bc], 1
jmp 0x40d827
mov eax, dword [ebp - 0x5bc]
dec eax
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 0
jl 0x40d86b
mov byte [ebp - 0xf0], 0
movzx eax, byte [ebp - 0xf0]
test eax, eax
je 0x40d869
push 0
push 0x5466
push 0
push 0x33bc
push 1
push 0x61f5
push 0x2c65
push 0x62c9
call fcn.0040971c
add esp, 0x20
jmp 0x40d81a
jmp 0x40d78c
lea ecx, [ebp - 0x1478]
call fcn.0041b70d
jmp 0x40d644
jmp 0x40d621
jmp 0x40da04
mov byte [ebp - 0x10c], 0
movzx eax, byte [ebp - 0x10c]
test eax, eax
je 0x40d8b2
push 0x3814
push 0x2155
push 0
push 0
call fcn.0040bde8
add esp, 0x10
mov dword [ebp - 0x4c], 0
jmp 0x40d8c2
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jg 0x40da04
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x1bc]
mov dword [ebp + ecx*4 - 0x1bc], eax
mov byte [ebp - 0xf2], 0
mov dword [ebp - 0x834], 0x4ca
mov dword [ebp - 0x1400], 0xa9b158
cmp dword [ebp - 0x834], 0x6e0
jle 0x40d981
and dword [ebp - 0x2e4], 0
jmp 0x40d91d
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0x4a1d
jge 0x40d981
and dword [ebp - 0x4cc], 0
jmp 0x40d93f
mov eax, dword [ebp - 0x4cc]
inc eax
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x4cc], 0x37f3
jge 0x40d97f
mov eax, dword [ebp - 0x2e4]
cdq
idiv dword [ebp - 0x4cc]
mov eax, edx
cdq
mov dword [ebp - 0x10f8], eax
mov dword [ebp - 0x10f4], edx
push dword [ebp - 0x10f4]
push dword [ebp - 0x10f8]
mov ecx, 0xab36e8
call fcn.0041b4f7
jmp 0x40d932
jmp 0x40d910
push 0x1e1f
push 0x3e10
push 0x31ec
push 1
push 0xb19
push 1
push 0x7a30
lea eax, [ebp - 0xf2]
push eax
push 0x4b9e
push 0
call fcn.0040616e
add esp, 0x28
mov dword [ebp - 4], 0xc
cmp dword [ebp - 0x834], 0x24d
jge 0x40d9d9
push dword [ebp - 0x1400]
push 0xab36e8
call fcn.0041cf47
pop ecx
pop ecx
jmp 0x40d9f5
or dword [ebp - 4], 0xffffffff
jmp 0x40d9ff
jmp 0x40d8bb
mov dword [ebp - 0xbac], 0x2155
mov dword [ebp - 0x1420], 0xa9b1d8
cmp dword [ebp - 0xbac], 0x2391
jle 0x40daf0
and dword [ebp - 0x2ec], 0
jmp 0x40da3e
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0x12dc
jge 0x40daf0
and dword [ebp - 0x674], 0
jmp 0x40da64
mov eax, dword [ebp - 0x674]
inc eax
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0x4678
jge 0x40daeb
and dword [ebp - 0x2f4], 0
jmp 0x40da86
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0x639f
jge 0x40dae6
mov eax, dword [ebp - 0x2ec]
imul eax, dword [ebp - 0x674]
add eax, dword [ebp - 0x2f4]
cdq
mov dword [ebp - 0x1104], eax
mov dword [ebp - 0x1100], edx
push dword [ebp - 0x1100]
push dword [ebp - 0x1104]
lea ecx, [ebp - 0x1d9c]
call fcn.00401e2f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041b4cc
push eax
call fcn.0048ee0a
pop ecx
lea ecx, [ebp - 0x1d9c]
call fcn.00401328
jmp 0x40da79
jmp 0x40da57
jmp 0x40da31
mov dword [ebp - 0xe3c], 0x416b
mov dword [ebp - 0x1408], 0xa9b234
cmp dword [ebp - 0xe3c], 0x43e8
jle 0x40db89
and dword [ebp - 0x4d4], 0
jmp 0x40db26
mov eax, dword [ebp - 0x4d4]
inc eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 0x7ea0
jge 0x40db89
and dword [ebp - 0x2fc], 0
jmp 0x40db48
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0x48b2
jge 0x40db87
mov eax, dword [ebp - 0x4d4]
mov ecx, dword [ebp - 0x2fc]
shl eax, cl
cdq
mov dword [ebp - 0x1110], eax
mov dword [ebp - 0x110c], edx
push dword [ebp - 0x110c]
push dword [ebp - 0x1110]
mov ecx, 0xab36e8
call fcn.0041b4f7
jmp 0x40db3b
jmp 0x40db19
mov dword [ebp - 4], 0xe
cmp dword [ebp - 0xe3c], 0x3d85
jge 0x40dbae
push dword [ebp - 0x1408]
push 0xab36e8
call fcn.0041cf47
pop ecx
pop ecx
jmp 0x40dbca
or dword [ebp - 4], 0xffffffff
jmp 0x40dbd4
mov dword [ebp - 0x188c], 0xc8959310
mov dword [ebp - 0x1418], 0x12f3ccd2
mov dword [ebp - 0x98], 0
jmp 0x40dc01
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x40dc1d
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x1488], 8
jmp 0x40dbf4
mov dword [ebp - 0x98], 0
jmp 0x40dc36
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x40dc52
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x1adc], 1
jmp 0x40dc29
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1488], 0xffffffff
jmp 0x40dc80
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1488]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1488], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1488], 0x19
je 0x40dcc4
mov dword [ebp - 0x83c], 0xffffffff
mov dword [ebp - 0x1410], 0xfffffffb
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1488]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp - 0x83c]
mov dword [ebp - 0x1410], eax
jmp 0x40dc65
push 1
push 0x1d53
push 0x397f
lea eax, [ebp - 0x1418]
push eax
push 0
call fcn.00407421
add esp, 0x14
mov dword [ebp - 4], 0x10
cmp dword [ebp - 0xbac], 0x20bb
jge 0x40dd00
push dword [ebp - 0x1420]
call fcn.0048ee0a
pop ecx
jmp 0x40dd1c
or dword [ebp - 4], 0xffffffff
jmp 0x40dd26
mov dword [ebp - 0x5c4], 0
jmp 0x40dd3f
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 1
jge 0x40dd5b
mov eax, dword [ebp - 0x5c4]
mov dword [ebp + eax*4 - 0x7a0], 0xecbfcf41
jmp 0x40dd32
push 0xe0e
lea eax, [ebp - 0x894]
push eax
push 1
lea eax, [ebp - 0xd74]
push eax
push 0
push 0x2ecf
push 0
lea eax, [ebp - 0x1428]
push eax
call fcn.0040bb71
add esp, 0x20
mov dword [ebp - 0x1b0], 0xfffffff9
mov dword [ebp - 0x844], 0x3ab6
mov dword [ebp - 0x1430], 0xa9b2d0
cmp dword [ebp - 0x844], 0x3c13
jle 0x40de60
push 0
push 0x7c7
push 0x11bb
push 0
call dword [0xab62b4]
and dword [ebp - 0x304], 0
jmp 0x40dde0
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0x309d
jge 0x40de60
and dword [ebp - 0x4dc], 0
jmp 0x40de02
mov eax, dword [ebp - 0x4dc]
inc eax
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0xab9
jge 0x40de5b
mov eax, dword [ebp - 0x304]
add eax, dword [ebp - 0x4dc]
cdq
mov dword [ebp - 0x111c], eax
mov dword [ebp - 0x1118], edx
push dword [ebp - 0x1118]
push dword [ebp - 0x111c]
lea ecx, [ebp - 0x1f10]
call fcn.00401e2f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041b4cc
push eax
call fcn.0048ee0a
pop ecx
lea ecx, [ebp - 0x1f10]
call fcn.00401328
jmp 0x40ddf5
jmp 0x40ddd3
mov dword [ebp - 0x1c], 0xc04c
mov dword [ebp - 4], 0x12
cmp dword [ebp - 0x844], 0x3757
jge 0x40de86
push dword [ebp - 0x1430]
call fcn.0048ee0a
pop ecx
jmp 0x40dea2
or dword [ebp - 4], 0xffffffff
jmp 0x40deac
mov dword [ebp - 0x31c], 0x3f126c7f
push 4
lea ecx, [ebp - 0x16f8]
call fcn.0041b63b
push 0
push 0x8d8
push 0
lea eax, [ebp - 0x16f8]
push eax
lea eax, [ebp - 0x1894]
push eax
call fcn.004083bb
add esp, 0x14
mov dword [ebp - 0x1b0], 0
jmp 0x40defb
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xfffffff0
jl 0x40e43a
push 4
lea ecx, [ebp - 0xf3c]
call fcn.0041b63b
mov dword [ebp - 0x250], 0xffff
push 1
lea eax, [ebp - 0xf3c]
push eax
push 1
lea eax, [ebp - 0x1a64]
push eax
push 0
push 0xe0c
push 0x2e8b
push 0x1bca
call fcn.0040971c
add esp, 0x20
cmp dword [ebp - 0x1c], 0
jne 0x40e005
push 1
lea ecx, [ebp - 0xf3c]
call fcn.00401332
cmp dword [eax], 0x49f4ffcf
jle 0x40df75
mov dword [ebp - 0xd64], 1
jmp 0x40df7c
and dword [ebp - 0xd64], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0xd64]
cmp eax, 0x60a22152
je 0x40df99
mov dword [ebp - 0x84c], 1
jmp 0x40dfa0
and dword [ebp - 0x84c], 0
push 2
lea ecx, [ebp - 0xf3c]
call fcn.00401332
mov ecx, dword [ebp - 0x84c]
cmp ecx, dword [eax]
jge 0x40dfc3
mov dword [ebp - 0xbb4], 1
jmp 0x40dfca
and dword [ebp - 0xbb4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xbb4], eax
jne 0x40dfe4
cmp dword [ebp - 0x1c], 0
jne 0x40dfe4
and dword [ebp - 0x854], 0
jmp 0x40dfee
mov dword [ebp - 0x854], 1
mov eax, dword [ebp - 0x1b0]
cmp eax, dword [ebp - 0x854]
jg 0x40e005
and dword [ebp - 0xed8], 0
jmp 0x40e00f
mov dword [ebp - 0xed8], 1
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0xed8], eax
jle 0x40e029
mov dword [ebp - 0x85c], 1
jmp 0x40e030
and dword [ebp - 0x85c], 0
push 2
lea ecx, [ebp - 0xf3c]
call fcn.00401332
mov eax, dword [eax]
cmp eax, dword [ebp - 0x85c]
je 0x40e04c
xor eax, eax
inc eax
je 0x40e085
push 0x3fd8
push 0x3aff
lea eax, [ebp - 0x250]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x242f
push 0x722f
lea eax, [ebp - 0x31c]
push eax
push 1
call fcn.0040616e
add esp, 0x28
jmp 0x40e42a
mov dword [ebp - 0x1448], 0xffff
mov dword [ebp - 0x72c], 0xf34d89bb
mov dword [ebp - 0xbbc], 0x4976
mov dword [ebp - 0x1438], 0xa9b324
cmp dword [ebp - 0xbbc], 0x4c46
jle 0x40e1b9
and dword [ebp - 0x30c], 0
jmp 0x40e0d3
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0x64b9
jge 0x40e1b9
and dword [ebp - 0x63c], 0
jmp 0x40e0f9
mov eax, dword [ebp - 0x63c]
inc eax
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 0x7c93
jge 0x40e1b4
and dword [ebp - 0x314], 0
jmp 0x40e11f
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0x4788
jge 0x40e1af
and dword [ebp - 0x4e4], 0
jmp 0x40e145
mov eax, dword [ebp - 0x4e4]
inc eax
mov dword [ebp - 0x4e4], eax
cmp dword [ebp - 0x4e4], 0x788e
jge 0x40e1aa
mov eax, dword [ebp - 0x30c]
sub eax, dword [ebp - 0x63c]
add eax, dword [ebp - 0x314]
sub eax, dword [ebp - 0x4e4]
cdq
mov dword [ebp - 0x1128], eax
mov dword [ebp - 0x1124], edx
push dword [ebp - 0x1124]
push dword [ebp - 0x1128]
lea ecx, [ebp - 0x1dcc]
call fcn.00401e2f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041b4cc
push eax
call fcn.0048ee0a
pop ecx
lea ecx, [ebp - 0x1dcc]
call fcn.00401328
jmp 0x40e138
jmp 0x40e112
jmp 0x40e0ec
jmp 0x40e0c6
mov dword [ebp - 0x1440], 0xcd5ccfde
mov dword [ebp - 4], 0x14
cmp dword [ebp - 0xbbc], 0x47d8
jge 0x40e1e2
push dword [ebp - 0x1438]
call fcn.0048ee0a
pop ecx
jmp 0x40e1fe
or dword [ebp - 4], 0xffffffff
jmp 0x40e208
mov dword [ebp - 0x175c], 0xc9f13a4b
mov dword [ebp - 0x1758], 0xc9f13a4b
mov dword [ebp - 0x1754], 0xc9f13a4b
mov dword [ebp - 0x1750], 0xc9f13a4b
mov dword [ebp - 0x1c], 0
jmp 0x40e240
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 9
jge 0x40e42a
mov dword [ebp - 0xd6c], 0xffff
mov dword [ebp - 0x87c], 1
mov dword [ebp - 0x250], 0xfffffffc
jmp 0x40e277
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 3
jne 0x40e425
mov dword [ebp - 0x258], 0xd8c6
cmp dword [ebp - 0xd6c], 0
jne 0x40e3bb
cmp dword [ebp - 0x258], 0
jne 0x40e2b0
mov dword [ebp - 0xe44], 1
jmp 0x40e2b7
and dword [ebp - 0xe44], 0
push 0
lea ecx, [ebp - 0xf3c]
call fcn.00401332
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x189c], eax
push 0xfffffffffffffffc
pop eax
imul eax, eax, 0xfffffff6
cmp eax, 0x883f
jg 0x40e2e6
mov dword [ebp - 0x864], 1
jmp 0x40e2ed
and dword [ebp - 0x864], 0
cmp dword [ebp - 0x864], 0x58a13c4
je 0x40e305
mov dword [ebp - 0x86c], 1
jmp 0x40e30c
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0xd6c]
add eax, dword [ebp - 0x86c]
cmp eax, 0xffff
ja 0x40e32b
mov dword [ebp - 0xbc4], 1
jmp 0x40e332
and dword [ebp - 0xbc4], 0
mov eax, dword [ebp - 0xbc4]
mov dword [ebp - 0x72c], eax
mov eax, dword [ebp - 0x72c]
add eax, dword [ebp - 0x1440]
cmp eax, 0xfffffff8
jae 0x40e35b
mov dword [ebp - 0x874], 1
jmp 0x40e362
and dword [ebp - 0x874], 0
push 2
lea ecx, [ebp - 0xf3c]
call fcn.00401332
mov ecx, dword [ebp - 0x1448]
sub ecx, dword [ebp - 0x874]
imul ecx, dword [eax]
imul ecx, dword [ebp - 0xe44]
mov dword [ebp - 0x31c], ecx
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x1a98], eax
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x18a4], eax
mov eax, dword [ebp - 0x87c]
cmp dword [ebp - 0x72c], 0
jne 0x40e3bb
and dword [ebp - 0xbcc], 0
jmp 0x40e3c5
mov dword [ebp - 0xbcc], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbcc]
mov dword [ebp + eax - 0x175c], ecx
mov dword [ebp - 0x258], 0
jmp 0x40e3f1
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0x18
jl 0x40e420
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x40e41e
push 0x1ab0
push 0x1c7e
push 0
call dword [0xab60e4]
jmp 0x40e3e4
jmp 0x40e26a
jmp 0x40e239
lea ecx, [ebp - 0xf3c]
call fcn.0041b70d
jmp 0x40deee
mov dword [ebp - 0x1c], 3
jmp 0x40e44a
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x40e471
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x16f8]
call fcn.00401332
cmp dword [eax], 0
je 0x40e465
jmp 0x40e471
mov dword [ebp - 0x31c], 4
jmp 0x40e443
lea ecx, [ebp - 0x16f8]
call fcn.0041b70d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7a0], 0
je 0x40e4a1
mov eax, 0x9063
test eax, eax
je 0x40e4a1
mov dword [ebp - 0x884], 1
jmp 0x40e4a8
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x774]
dec eax
mov dword [ebp - 0x774], eax
mov eax, dword [ebp - 0x774]
cmp eax, dword [ebp - 0x884]
jg 0x40e4cf
mov dword [ebp - 0x88c], 1
jmp 0x40e4d6
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0xd74]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x7a0]
imul ecx, dword [ebp - 0x88c]
lea eax, [eax + ecx + 0x4e627738]
cmp eax, 0x2398
jg 0x40e50a
mov dword [ebp - 0xbd4], 1
jmp 0x40e511
and dword [ebp - 0xbd4], 0
cmp dword [ebp - 0xbd4], 0xd8d9
jge 0x40e529
mov dword [ebp - 0xeb8], 1
jmp 0x40e530
and dword [ebp - 0xeb8], 0
mov eax, dword [ebp - 0x894]
sub eax, 0xeb16
sub eax, dword [ebp - 0xeb8]
je 0x40e9e2
mov dword [ebp - 0x89c], 0x4d5c
mov dword [ebp - 0x1450], 0xa9b378
cmp dword [ebp - 0x89c], 0x5020
jle 0x40e683
push 0x19f
push 0
push 0
push 0
call dword [0xab62b8]
and dword [ebp - 0x4ec], 0
jmp 0x40e592
mov eax, dword [ebp - 0x4ec]
inc eax
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 0x631a
jge 0x40e67b
and dword [ebp - 0x5cc], 0
jmp 0x40e5b8
mov eax, dword [ebp - 0x5cc]
inc eax
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 0x4eeb
jge 0x40e676
and dword [ebp - 0x324], 0
jmp 0x40e5de
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0x555d
jge 0x40e671
and dword [ebp - 0x32c], 0
jmp 0x40e604
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0x3882
jge 0x40e66c
mov ecx, dword [ebp - 0x5cc]
imul ecx, dword [ebp - 0x324]
mov eax, dword [ebp - 0x4ec]
shl eax, cl
xor eax, dword [ebp - 0x32c]
cdq
mov dword [ebp - 0x1134], eax
mov dword [ebp - 0x1130], edx
push dword [ebp - 0x1130]
push dword [ebp - 0x1134]
lea ecx, [ebp - 0x1eb0]
call fcn.00401e2f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041b4cc
push eax
call fcn.0048ee0a
pop ecx
lea ecx, [ebp - 0x1eb0]
call fcn.00401328
jmp 0x40e5f7
jmp 0x40e5d1
jmp 0x40e5ab
jmp 0x40e585
push 0
call dword [0xab6424]
push 3
lea ecx, [ebp - 0x15c8]
call fcn.0041b63b
mov dword [ebp - 4], 0x16
cmp dword [ebp - 0x89c], 0x49e2
jge 0x40e6af
push dword [ebp - 0x1450]
call fcn.0048ee0a
pop ecx
jmp 0x40e6cb
or dword [ebp - 4], 0xffffffff
jmp 0x40e6d5
mov dword [ebp - 0x268], 1
push 2
lea ecx, [ebp - 0x1568]
call fcn.0041b63b
push 0x796e
push 0x1a1e
push 0
push 1
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x15c8]
push eax
push 0x7732
call fcn.00406559
add esp, 0x1c
mov dword [ebp - 0x260], 0
jmp 0x40e72e
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 2
jge 0x40e750
push dword [ebp - 0x260]
lea ecx, [ebp - 0x1568]
call fcn.00401332
mov dword [eax], 0x9c90e69c
jmp 0x40e721
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x15c8]
push eax
push 0x7b72
push 1
push 0x6e11
push 0
lea eax, [ebp - 0x1568]
push eax
push 0x4b2f
push 0x32e8
push 1
call fcn.0040616e
add esp, 0x28
mov dword [ebp - 0x268], 0x15
jmp 0x40e7a0
mov eax, dword [ebp - 0x268]
dec eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
je 0x40e837
mov dword [ebp - 0xf90], 0x6243a5d8
mov dword [ebp - 0x1044], 9
mov dword [ebp - 0x1458], 0xe094bf7d
push 0x753c
lea eax, [ebp - 0x1458]
push eax
lea eax, [ebp - 0x15c8]
push eax
lea eax, [ebp - 0xf90]
push eax
push 0
lea eax, [ebp - 0x1568]
push eax
push 0x26ad
lea eax, [ebp - 0x1044]
push eax
push 1
call fcn.0040c1c9
add esp, 0x24
mov byte [ebp - 0xf4], 0
movzx eax, byte [ebp - 0xf4]
test eax, eax
je 0x40e832
push 0x34a
push 0x13f0
push 0x67
push 0x23d5
push 0xbec
call dword [0xab60e0]
jmp 0x40e793
lea ecx, [ebp - 0x1568]
call fcn.0041b70d
lea ecx, [ebp - 0x15c8]
call fcn.0041b70d
mov dword [ebp - 0xf98], 1
mov dword [ebp - 0x114], 0x1c76d7be
mov dword [ebp - 0xbdc], 0xfffffff9
mov dword [ebp - 0x88], 0
jmp 0x40e884
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x40e8a0
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x1368], 0xf21009d4
jmp 0x40e877
mov dword [ebp - 0x88], 0
jmp 0x40e8b9
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x40e8d5
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x1b38], 0x13923cc
jmp 0x40e8ac
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x114], eax
jl 0x40e8ef
mov dword [ebp - 0x734], 1
jmp 0x40e8f6
and dword [ebp - 0x734], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x734]
mov dword [ebp + eax - 0x1368], ecx
mov eax, dword [ebp - 0x734]
sub eax, dword [ebp - 0x114]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xbdc]
cmp dword [ebp - 0x114], eax
jg 0x40e935
mov dword [ebp - 0x8a4], 1
jmp 0x40e93c
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x8a4], eax
je 0x40e956
mov dword [ebp - 0xd7c], 1
jmp 0x40e95d
and dword [ebp - 0xd7c], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0xd7c], eax
jne 0x40e97e
push 8
pop eax
test eax, eax
je 0x40e97e
mov dword [ebp - 0x8ac], 1
jmp 0x40e985
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x8ac], eax
jl 0x40e99f
mov dword [ebp - 0xbe4], 1
jmp 0x40e9a6
and dword [ebp - 0xbe4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbe4]
mov dword [ebp + eax - 0x1b38], ecx
push 0x2962
push 0
lea eax, [ebp - 0xf98]
push eax
push 1
push 0xc3d
push 0
push 0x823
call fcn.00408bdc
add esp, 0x1c
jmp 0x40f16c
mov dword [ebp - 0x1650], 3
mov dword [ebp - 0x164c], 3
mov dword [ebp - 0x1648], 3
mov dword [ebp - 0x1644], 3
lea ecx, [ebp - 0x755]
call fcn.0041b729
push eax
lea eax, [ebp - 0x1640]
push eax
lea eax, [ebp - 0x1650]
push eax
lea ecx, [ebp - 0x1b94]
call fcn.0041b72c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7c0]
call fcn.0041b6e7
mov dword [ebp - 0x124], 0x18885c6f
mov dword [ebp - 0x8b4], 0x60bb
mov dword [ebp - 0x12d0], 0xa9b3d8
cmp dword [ebp - 0x8b4], 0x60d7
jle 0x40eb6b
and dword [ebp - 0x694], 0
jmp 0x40ea83
mov eax, dword [ebp - 0x694]
inc eax
mov dword [ebp - 0x694], eax
cmp dword [ebp - 0x694], 0x6aa4
jge 0x40eb6b
and dword [ebp - 0x334], 0
jmp 0x40eaa9
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0x1254
jge 0x40eb66
and dword [ebp - 0x4f4], 0
jmp 0x40eacf
mov eax, dword [ebp - 0x4f4]
inc eax
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], 0x2cbc
jge 0x40eb61
and dword [ebp - 0x33c], 0
jmp 0x40eaf5
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0x7e8e
jge 0x40eb5c
mov eax, dword [ebp - 0x694]
and eax, dword [ebp - 0x334]
mov ecx, dword [ebp - 0x4f4]
and ecx, dword [ebp - 0x33c]
or eax, ecx
cdq
mov dword [ebp - 0x1140], eax
mov dword [ebp - 0x113c], edx
push dword [ebp - 0x113c]
push dword [ebp - 0x1140]
lea ecx, [ebp - 0x1dfc]
call fcn.00401e2f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041b4cc
push eax
call fcn.0048ee0a
pop ecx
lea ecx, [ebp - 0x1dfc]
call fcn.00401328
jmp 0x40eae8
jmp 0x40eac2
jmp 0x40ea9c
jmp 0x40ea76
mov dword [ebp - 0x8c4], 0xf2b8319b
mov dword [ebp - 4], 0x18
cmp dword [ebp - 0x8b4], 0x5e67
jge 0x40eb94
push dword [ebp - 0x12d0]
call fcn.0048ee0a
pop ecx
jmp 0x40ebb0
or dword [ebp - 4], 0xffffffff
jmp 0x40ebba
mov dword [ebp - 0xe4c], 0x551b
mov dword [ebp - 0xfa0], 0xa9b454
cmp dword [ebp - 0xe4c], 0x560b
jle 0x40ecc1
and dword [ebp - 0x5d4], 0
jmp 0x40ebf4
mov eax, dword [ebp - 0x5d4]
inc eax
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x5d4], 0x5adc
jge 0x40ecc1
and dword [ebp - 0x344], 0
jmp 0x40ec1a
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0x55af
jge 0x40ecbc
and dword [ebp - 0x4fc], 0
jmp 0x40ec40
mov eax, dword [ebp - 0x4fc]
inc eax
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x4fc], 0x40e6
jge 0x40ecb7
and dword [ebp - 0x34c], 0
jmp 0x40ec62
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0x58a0
jge 0x40ecb2
mov esi, dword [ebp - 0x5d4]
mov ecx, dword [ebp - 0x344]
sar esi, cl
mov eax, dword [ebp - 0x4fc]
cdq
idiv dword [ebp - 0x34c]
xor esi, edx
mov eax, esi
cdq
mov dword [ebp - 0x114c], eax
mov dword [ebp - 0x1148], edx
push dword [ebp - 0x1148]
push dword [ebp - 0x114c]
mov ecx, 0xab36e8
call fcn.0041b4f7
jmp 0x40ec55
jmp 0x40ec33
jmp 0x40ec0d
jmp 0x40ebe7
mov dword [ebp - 4], 0x1a
cmp dword [ebp - 0xe4c], 0x5452
jge 0x40ece6
push dword [ebp - 0xfa0]
push 0xab36e8
call fcn.0041cf47
pop ecx
pop ecx
jmp 0x40ed02
or dword [ebp - 4], 0xffffffff
jmp 0x40ed0c
mov dword [ebp - 0x124], 0
jmp 0x40ed25
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 3
jg 0x40f144
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x10e], 0
movzx eax, byte [ebp - 0x10e]
test eax, eax
je 0x40ed61
push 0x7503
push 1
push 0xb98
push 0
call fcn.00408ccf
add esp, 0x10
mov dword [ebp - 0x28], 0
jmp 0x40ed71
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jg 0x40f13f
mov dword [ebp - 0x11c], 0xe9323d1b
mov dword [ebp - 0x354], 0xfff9
mov dword [ebp - 0x12dc], 0xfffffffd
mov dword [ebp - 0x11c], 3
jmp 0x40edb2
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jl 0x40f13a
mov dword [ebp - 0x19c], 0xffffffff
mov dword [ebp - 0x644], 0
jmp 0x40ede2
mov eax, dword [ebp - 0x644]
inc eax
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 3
jge 0x40edfe
mov eax, dword [ebp - 0x644]
mov dword [ebp + eax*4 - 0x1920], 0x29ba
jmp 0x40edd5
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x7c0]
call fcn.00401332
mov ecx, dword [ebp - 0x124]
cmp dword [eax], ecx
jg 0x40ee25
mov dword [ebp - 0x8bc], 1
jmp 0x40ee2c
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x8bc], eax
je 0x40ee46
mov dword [ebp - 0xbec], 1
jmp 0x40ee4d
and dword [ebp - 0xbec], 0
mov eax, dword [ebp - 0xbec]
mov dword [ebp - 0x8c4], eax
cmp dword [ebp - 0x8c4], 0x5b3d
jl 0x40ee71
mov dword [ebp - 0xd84], 1
jmp 0x40ee78
and dword [ebp - 0xd84], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xd84], eax
jne 0x40ee8f
mov dword [ebp - 0x8cc], 1
jmp 0x40ee96
and dword [ebp - 0x8cc], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x7c0]
call fcn.00401332
mov ecx, dword [ebp - 0x8cc]
cmp ecx, dword [eax]
jl 0x40eeba
mov dword [ebp - 0xbf4], 1
jmp 0x40eec1
and dword [ebp - 0xbf4], 0
mov eax, dword [ebp - 0xbf4]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jne 0x40eee8
mov eax, 0xfff8
test eax, eax
jne 0x40eee8
and dword [ebp - 0x8d4], 0
jmp 0x40eef2
mov dword [ebp - 0x8d4], 1
cmp dword [ebp - 0x8d4], 1
jbe 0x40ef07
mov dword [ebp - 0x1370], 1
jmp 0x40ef0e
and dword [ebp - 0x1370], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x7c0]
call fcn.00401332
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x1a74], eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x7c0]
call fcn.00401332
mov esi, eax
push 2
lea ecx, [ebp - 0x7c0]
call fcn.00401332
mov ecx, dword [esi]
imul ecx, dword [eax]
cmp ecx, 6
jl 0x40ef5b
mov dword [ebp - 0xf18], 1
jmp 0x40ef62
and dword [ebp - 0xf18], 0
cmp dword [ebp - 0xf18], 0x662b0a94
jl 0x40ef7a
mov dword [ebp - 0x8dc], 1
jmp 0x40ef81
and dword [ebp - 0x8dc], 0
mov esi, dword [ebp - 0x8dc]
shl esi, 1
push dword [ebp - 0x28]
lea ecx, [ebp - 0x7c0]
call fcn.00401332
sub esi, dword [eax]
cmp esi, dword [ebp - 0x354]
jg 0x40efad
mov dword [ebp - 0xbfc], 1
jmp 0x40efb4
and dword [ebp - 0xbfc], 0
mov eax, dword [ebp - 0x354]
cmp dword [ebp - 0xbfc], eax
jne 0x40efce
mov dword [ebp - 0x8e4], 1
jmp 0x40efd5
and dword [ebp - 0x8e4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1920]
cmp dword [ebp - 0x8e4], eax
jge 0x40eff6
mov dword [ebp - 0xd8c], 1
jmp 0x40effd
and dword [ebp - 0xd8c], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xd8c], eax
je 0x40f014
mov dword [ebp - 0x8ec], 1
jmp 0x40f01b
and dword [ebp - 0x8ec], 0
push 2
lea ecx, [ebp - 0x7c0]
call fcn.00401332
mov ecx, dword [ebp - 0x8ec]
cmp ecx, dword [eax]
je 0x40f047
mov eax, 0xa4d2c64
test eax, eax
je 0x40f047
mov dword [ebp - 0xc04], 1
jmp 0x40f04e
and dword [ebp - 0xc04], 0
mov eax, dword [ebp - 0x354]
cmp dword [ebp - 0xc04], eax
je 0x40f068
mov dword [ebp - 0x8f4], 1
jmp 0x40f06f
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x8f4]
sub eax, dword [ebp - 0x124]
sub eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x28]
cmp eax, 0x69393dda
jl 0x40f094
mov dword [ebp - 0xfa8], 1
jmp 0x40f09b
and dword [ebp - 0xfa8], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xe54], eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x7c0]
call fcn.00401332
mov ecx, dword [ebp - 0xe54]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1920]
add eax, dword [ebp - 0xe54]
mov dword [ebp - 0x12dc], eax
mov dword [ebp - 0x19c], 2
jmp 0x40f0ef
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jl 0x40f135
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x40f11b
push 1
push 0x423b
push 0
call fcn.004072d9
add esp, 0xc
push dword [ebp - 0x124]
lea ecx, [ebp - 0x7c0]
call fcn.00401332
cmp dword [eax], 0
je 0x40f133
jmp 0x40f0e2
jmp 0x40f0e2
jmp 0x40eda5
jmp 0x40ed6a
jmp 0x40ed18
lea ecx, [ebp - 0x7c0]
call fcn.0041b70d
mov dword [ebp - 0xfb0], 0x38e21363
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7a0]
mov dword [ebp - 0xfb0], eax
push 0
push 0x5667
push 1
push 0x5294
push 1
push 0x52f0
push 0x1720
push 0x69ab
call fcn.0040971c
add esp, 0x20
mov byte [ebp - 0x15], 0
push 2
lea ecx, [ebp - 0x1930]
call fcn.0041b63b
mov dword [ebp - 0x35c], 0xffffffff
mov dword [ebp - 0x18ac], 6
mov dword [ebp - 0x504], 0
jmp 0x40f1d1
mov eax, dword [ebp - 0x504]
inc eax
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 2
jge 0x40f1f3
push dword [ebp - 0x504]
lea ecx, [ebp - 0x1930]
call fcn.00401332
mov dword [eax], 0xd3df
jmp 0x40f1c4
mov dword [ebp - 0x35c], 1
jmp 0x40f20c
mov eax, dword [ebp - 0x35c]
dec eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0
jl 0x40f21c
call fcn.0041d7d4
jmp 0x40f1ff
lea ecx, [ebp - 0x1930]
call fcn.0041b70d
mov dword [ebp - 0x364], 0x862fd41e
mov dword [ebp - 0x1628], 0x97963ba2
mov dword [ebp - 0x1624], 0x97963ba2
mov dword [ebp - 0x1620], 0x97963ba2
mov dword [ebp - 0x161c], 0x97963ba2
lea ecx, [ebp - 0x70d]
call fcn.0041b729
push eax
lea eax, [ebp - 0x1618]
push eax
lea eax, [ebp - 0x1628]
push eax
lea ecx, [ebp - 0x1c6c]
call fcn.0041b72c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x15a4]
call fcn.0041b6e7
mov dword [ebp - 0x924], 1
mov dword [ebp - 0x92c], 0x5bfeb1ec
mov dword [ebp - 0xc14], 2
mov dword [ebp - 0x5dc], 0
jmp 0x40f2c5
mov eax, dword [ebp - 0x5dc]
inc eax
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 1
jge 0x40f2e1
mov eax, dword [ebp - 0x5dc]
mov dword [ebp + eax*4 - 0x12f4], 5
jmp 0x40f2b8
mov dword [ebp - 0x364], 0xfffffffb
jmp 0x40f2fa
mov eax, dword [ebp - 0x364]
dec eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0xffffffef
jle 0x40f67a
mov dword [ebp - 0x64], 0xde2167fa
mov dword [ebp - 0x1380], 0xeca6696b
mov dword [ebp - 0x64], 0
jmp 0x40f328
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xffffffee
jle 0x40f675
mov dword [ebp - 0xcc], 0x5ed9a924
mov dword [ebp - 0x8fc], 0x97867a7b
mov dword [ebp - 0xfc8], 0
mov dword [ebp - 0x50c], 0
jmp 0x40f369
mov eax, dword [ebp - 0x50c]
inc eax
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], 4
jge 0x40f385
mov eax, dword [ebp - 0x50c]
mov dword [ebp + eax*4 - 0x1c04], 5
jmp 0x40f35c
cmp dword [ebp - 0xcc], 0
je 0x40f39e
cmp dword [ebp - 0x64], 0
je 0x40f399
jmp 0x40f675
jmp 0x40f670
mov dword [ebp - 0x934], 0
mov dword [ebp - 0x73c], 0x74f5
push 1
push 0
lea eax, [ebp - 0x15a4]
push eax
push 0x1775
push 0x6afe
call fcn.00405de3
add esp, 0x14
mov dword [ebp - 0x8fc], 1
mov eax, dword [ebp - 0x8fc]
mov dword [ebp - 0x1aa0], eax
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0x18b4], eax
cmp dword [ebp - 0x934], 0
jne 0x40f40b
or eax, 0xffffffff
jne 0x40f40b
mov dword [ebp - 0xc0c], 1
jmp 0x40f412
and dword [ebp - 0xc0c], 0
cmp dword [ebp - 0xc0c], 1
jbe 0x40f427
mov dword [ebp - 0x1378], 1
jmp 0x40f42e
and dword [ebp - 0x1378], 0
cmp dword [ebp - 0x64], 0
jne 0x40f440
mov dword [ebp - 0x904], 1
jmp 0x40f447
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x904]
add eax, 0x7ec5
cmp eax, 1
jge 0x40f463
mov dword [ebp - 0xd94], 1
jmp 0x40f46a
and dword [ebp - 0xd94], 0
mov eax, dword [ebp - 0x73c]
imul eax, dword [ebp - 0xd94]
add eax, 0x413eae2f
imul eax, eax, 0xa9ef
test eax, eax
jne 0x40f498
cmp dword [ebp - 0x924], 0
jne 0x40f498
and dword [ebp - 0xfb8], 0
jmp 0x40f4a2
mov dword [ebp - 0xfb8], 1
mov eax, dword [ebp - 0x92c]
cmp dword [ebp - 0x64], eax
jge 0x40f4b9
mov dword [ebp - 0x90c], 1
jmp 0x40f4c0
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0xc14], eax
mov eax, dword [ebp - 0x73c]
cmp dword [ebp - 0xc14], eax
jg 0x40f4e8
xor eax, eax
inc eax
jne 0x40f4e8
and dword [ebp - 0x914], 0
jmp 0x40f4f2
mov dword [ebp - 0x914], 1
cmp dword [ebp - 0x914], 0xfffffff7
jne 0x40f507
mov dword [ebp - 0xec0], 1
jmp 0x40f50e
and dword [ebp - 0xec0], 0
mov eax, dword [ebp - 0xcc]
imul eax, dword [ebp - 0xec0]
cmp eax, dword [ebp - 0xcc]
jg 0x40f538
cmp dword [ebp - 0xcc], 0
je 0x40f538
mov dword [ebp - 0x91c], 1
jmp 0x40f53f
and dword [ebp - 0x91c], 0
push 1
lea ecx, [ebp - 0x15a4]
call fcn.00401332
mov ecx, dword [ebp - 0x91c]
cmp ecx, dword [eax]
jl 0x40f56b
cmp dword [ebp - 0xcc], 0
je 0x40f56b
mov dword [ebp - 0xc1c], 1
jmp 0x40f572
and dword [ebp - 0xc1c], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0xc1c], eax
jle 0x40f589
mov dword [ebp - 0x77c], 1
jmp 0x40f590
and dword [ebp - 0x77c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x77c]
mov dword [ebp + eax - 0x1c04], ecx
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x77c], eax
jl 0x40f5b9
mov dword [ebp - 0x12e8], 1
jmp 0x40f5c0
and dword [ebp - 0x12e8], 0
cmp dword [ebp - 0x64], 0
jne 0x40f5cd
cmp dword [ebp - 0x924], 0
cmp dword [ebp - 0xcc], 0xefd9132e
jae 0x40f5e5
mov dword [ebp - 0xd9c], 1
jmp 0x40f5ec
and dword [ebp - 0xd9c], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0xd9c], eax
jge 0x40f606
mov dword [ebp - 0xc24], 1
jmp 0x40f60d
and dword [ebp - 0xc24], 0
mov eax, dword [ebp - 0x92c]
cmp dword [ebp - 0xc24], eax
je 0x40f627
mov dword [ebp - 0xe5c], 1
jmp 0x40f62e
and dword [ebp - 0xe5c], 0
mov eax, dword [ebp - 0x934]
cmp eax, dword [ebp - 0xe5c]
jge 0x40f648
mov dword [ebp - 0xfc0], 1
jmp 0x40f64f
and dword [ebp - 0xfc0], 0
mov eax, dword [ebp - 0x1380]
mov dword [ebp - 0x1a84], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x18bc], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xfc8], eax
jmp 0x40f321
jmp 0x40f2ed
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x12f4]
push 0
lea ecx, [ebp - 0x15a4]
call fcn.00401332
mov dword [eax], esi
lea ecx, [ebp - 0x15a4]
call fcn.0041b70d
mov dword [ebp - 0x68], 0xfffffff7
mov dword [ebp - 0x254], 0x5912
mov dword [ebp - 0x190], 2
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0x93c], 0x287b
mov dword [ebp - 0xfd0], 0xa9b49c
cmp dword [ebp - 0x93c], 0x2a34
jle 0x40f7e6
and dword [ebp - 0x36c], 0
jmp 0x40f700
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0x4cca
jge 0x40f7e6
and dword [ebp - 0x67c], 0
jmp 0x40f726
mov eax, dword [ebp - 0x67c]
inc eax
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 0x6387
jge 0x40f7e1
and dword [ebp - 0x26c], 0
jmp 0x40f74c
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0x2b64
jge 0x40f7dc
and dword [ebp - 0x374], 0
jmp 0x40f772
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0x6041
jge 0x40f7d7
mov eax, dword [ebp - 0x36c]
sub eax, dword [ebp - 0x67c]
sub eax, dword [ebp - 0x26c]
sub eax, dword [ebp - 0x374]
cdq
mov dword [ebp - 0x1158], eax
mov dword [ebp - 0x1154], edx
push dword [ebp - 0x1154]
push dword [ebp - 0x1158]
lea ecx, [ebp - 0x1f64]
call fcn.00401e2f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041b4cc
push eax
call fcn.0048ee0a
pop ecx
lea ecx, [ebp - 0x1f64]
call fcn.00401328
jmp 0x40f765
jmp 0x40f73f
jmp 0x40f719
jmp 0x40f6f3
mov dword [ebp - 0x94c], 0xe623b26d
mov dword [ebp - 4], 0x1c
cmp dword [ebp - 0x93c], 0x25c7
jge 0x40f80f
push dword [ebp - 0xfd0]
call fcn.0048ee0a
pop ecx
jmp 0x40f82b
or dword [ebp - 4], 0xffffffff
jmp 0x40f835
mov dword [ebp - 0x514], 0
jmp 0x40f84e
mov eax, dword [ebp - 0x514]
inc eax
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x514], 2
jge 0x40f86a
mov eax, dword [ebp - 0x514]
mov dword [ebp + eax*4 - 0x784], 0xc013cef3
jmp 0x40f841
mov dword [ebp - 0xdac], 0x42fd
mov dword [ebp - 0xfd8], 0xa9b4e0
cmp dword [ebp - 0xdac], 0x45b9
jle 0x40f924
and dword [ebp - 0x37c], 0
jmp 0x40f8a4
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0x7011
jge 0x40f924
and dword [ebp - 0x5e4], 0
jmp 0x40f8c6
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 0x5b27
jge 0x40f91f
mov eax, dword [ebp - 0x37c]
sub eax, dword [ebp - 0x5e4]
cdq
mov dword [ebp - 0x1164], eax
mov dword [ebp - 0x1160], edx
push dword [ebp - 0x1160]
push dword [ebp - 0x1164]
lea ecx, [ebp - 0x1e2c]
call fcn.00401e2f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041b4cc
push eax
call fcn.0048ee0a
pop ecx
lea ecx, [ebp - 0x1e2c]
call fcn.00401328
jmp 0x40f8b9
jmp 0x40f897
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x1aa8], eax
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0xdc], eax
je 0x40f95c
cmp dword [ebp - 0x190], 0
jne 0x40f95c
and dword [ebp - 0xc2c], 0
jmp 0x40f966
mov dword [ebp - 0xc2c], 1
mov eax, dword [ebp - 0xc2c]
sub eax, dword [ebp - 0x254]
cmp eax, dword [ebp - 0x190]
jl 0x40f986
mov dword [ebp - 0x944], 1
jmp 0x40f98d
and dword [ebp - 0x944], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x784]
cmp dword [ebp - 0x944], eax
jg 0x40f9ae
mov dword [ebp - 0xda4], 1
jmp 0x40f9b5
and dword [ebp - 0xda4], 0
mov eax, dword [ebp - 0xda4]
mov dword [ebp - 0x94c], eax
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0x94c], eax
jg 0x40f9d3
xor eax, eax
jne 0x40f9ec
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x784], 0
jne 0x40f9ec
and dword [ebp - 0x1388], 0
jmp 0x40f9f6
mov dword [ebp - 0x1388], 1
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x18c4], eax
mov eax, dword [ebp - 0x254]
mov ecx, dword [ebp - 0xdc]
lea eax, [eax + ecx - 1]
test eax, eax
jne 0x40fa28
cmp dword [ebp - 0xdc], 0
jne 0x40fa28
and dword [ebp - 0xc34], 0
jmp 0x40fa32
mov dword [ebp - 0xc34], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x784]
imul eax, dword [ebp - 0xc34]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x784]
jl 0x40fa61
mov dword [ebp - 0x954], 1
jmp 0x40fa68
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x190]
neg eax
cmp eax, dword [ebp - 0x954]
jne 0x40fa84
mov dword [ebp - 0xee8], 1
jmp 0x40fa8b
and dword [ebp - 0xee8], 0
mov eax, dword [ebp - 0x190]
cmp eax, dword [ebp - 0xee8]
jl 0x40faa5
mov dword [ebp - 0x95c], 1
jmp 0x40faac
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x254]
cmp eax, dword [ebp - 0x95c]
jg 0x40fac6
mov dword [ebp - 0xc3c], 1
jmp 0x40facd
and dword [ebp - 0xc3c], 0
mov eax, dword [ebp - 0xc3c]
add eax, 0xb1e5
jne 0x40faf1
cmp dword [ebp - 0xdc], 0
jne 0x40faf1
or eax, 0xffffffff
jne 0x40faf1
and dword [ebp - 0x964], 0
jmp 0x40fafb
mov dword [ebp - 0x964], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x964]
sub ecx, dword [ebp + eax - 0x784]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x784], ecx
mov dword [ebp - 4], 0x1e
cmp dword [ebp - 0xdac], 0x40a6
jge 0x40fb3a
push dword [ebp - 0xfd8]
call fcn.0048ee0a
pop ecx
jmp 0x40fb56
or dword [ebp - 4], 0xffffffff
jmp 0x40fb60
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xdc]
mov dword [ebp + eax - 0x784], ecx
mov dword [ebp - 0x54], 0xe83c773
mov dword [ebp - 0xdb4], 3
mov dword [ebp - 0xfe0], 0xe0f61949
mov dword [ebp - 0x384], 0
jmp 0x40fba7
cmp dword [ebp - 0x384], 3
jge 0x40fbc3
mov eax, dword [ebp - 0x384]
mov dword [ebp + eax*4 - 0x1940], 2
jmp 0x40fb9a
mov dword [ebp - 0x54], 2
jmp 0x40fbd3
mov eax, dword [ebp - 0xfe4]
mov dword [ebp - 0xff4], eax
mov eax, dword [ebp - 0xfec]
mov dword [ebp - 0x1004], eax
mov dword [ebp - 0xe18], 0x2c0e
mov dword [ebp - 0xffc], 0xa9c3b8
cmp dword [ebp - 0xe18], 0x2ed8
jle 0x41ac22
and dword [ebp - 0x690], 0
jmp 0x41ab6f
mov eax, dword [ebp - 0x690]
inc eax
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 0x5f33
jge 0x41ac22
and dword [ebp - 0x698], 0
jmp 0x41ab95
mov eax, dword [ebp - 0x698]
inc eax
mov dword [ebp - 0x698], eax
cmp dword [ebp - 0x698], 0x7510
jge 0x41ac1d
and dword [ebp - 0x6a0], 0
jmp 0x41abb7
mov eax, dword [ebp - 0x6a0]
inc eax
mov dword [ebp - 0x6a0], eax
cmp dword [ebp - 0x6a0], 0x707b
jge 0x41ac18
mov eax, dword [ebp - 0x690]
sub eax, dword [ebp - 0x698]
mov ecx, dword [ebp - 0x6a0]
sar eax, cl
cdq
mov dword [ebp - 0x1350], eax
mov dword [ebp - 0x134c], edx
push dword [ebp - 0x134c]
push dword [ebp - 0x1350]
lea ecx, [ebp - 0x1f7c]
call fcn.00401e2f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041b4cc
push eax
call fcn.0048ee0a
pop ecx
lea ecx, [ebp - 0x1f7c]
call fcn.00401328
jmp 0x41abaa
jmp 0x41ab88
jmp 0x41ab62
mov eax, dword [ebp - 0xff4]
mov dword [ebp - 0x248], eax
mov dword [ebp - 4], 0x70
cmp dword [ebp - 0xe18], 0x28ca
jge 0x41ac4d
push dword [ebp - 0xffc]
call fcn.0048ee0a
pop ecx
jmp 0x41ac69
or dword [ebp - 4], 0xffffffff
jmp 0x41ac73
mov eax, dword [ebp - 0x1004]
mov dword [ebp - 0x100c], eax
mov eax, dword [ebp - 0x248]
mov dword [eax], 0
jmp 0x41ac9e
mov eax, dword [ebp - 0x248]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x248]
mov dword [ecx], eax
mov eax, dword [ebp - 0x248]
cmp dword [eax], 2
jge 0x41acc4
mov eax, dword [ebp - 0x248]
push dword [eax]
mov ecx, dword [ebp - 0x100c]
call fcn.00401332
mov dword [eax], 0x15d0d658
jmp 0x41ac8d
jmp 0x41ae62
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x101c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x102c], eax
mov eax, dword [ebp - 0x1014]
movzx eax, byte [eax]
test eax, eax
je 0x41ad1f
mov eax, dword [ebp - 0x101c]
mov dword [ebp - 0x1024], eax
mov eax, dword [ebp - 0x1024]
mov dword [ebp - 0xe20], eax
mov eax, dword [ebp - 0xe20]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xe20]
mov dword [ecx], eax
jmp 0x41ae62
mov dword [ebp - 0xe28], 0x39d6
mov dword [ebp - 0x1034], 0xa9c438
cmp dword [ebp - 0xe28], 0x3d15
jle 0x41adee
and dword [ebp - 0x5a4], 0
jmp 0x41ad59
mov eax, dword [ebp - 0x5a4]
inc eax
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x5a4], 0x4eee
jge 0x41adee
and dword [ebp - 0x6a8], 0
jmp 0x41ad7f
mov eax, dword [ebp - 0x6a8]
inc eax
mov dword [ebp - 0x6a8], eax
cmp dword [ebp - 0x6a8], 0x5ea4
jge 0x41ade9
and dword [ebp - 0x6b0], 0
jmp 0x41ada1
mov eax, dword [ebp - 0x6b0]
inc eax
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 0x6293
jge 0x41ade7
mov eax, dword [ebp - 0x6a8]
cdq
idiv dword [ebp - 0x6b0]
or edx, dword [ebp - 0x5a4]
mov eax, edx
cdq
mov dword [ebp - 0x135c], eax
mov dword [ebp - 0x1358], edx
push dword [ebp - 0x1358]
push dword [ebp - 0x135c]
mov ecx, 0xab36e8
call fcn.0041b4f7
jmp 0x41ad94
jmp 0x41ad72
jmp 0x41ad4c
mov eax, dword [ebp - 0x102c]
mov dword [ebp - 0x103c], eax
mov dword [ebp - 4], 0x72
cmp dword [ebp - 0xe28], 0x37f6
jge 0x41ae1f
push dword [ebp - 0x1034]
push 0xab36e8
call fcn.0041cf47
pop ecx
pop ecx
jmp 0x41ae3b
or dword [ebp - 4], 0xffffffff
jmp 0x41ae45
mov eax, dword [ebp - 0x103c]
mov dword [ebp - 0xe30], eax
mov eax, dword [ebp - 0xe30]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xe30]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret